Integer overflow

Integer overflow occurs when an arithmetic result lies outside the range representable by its integer type. An unsigned n-bit value normally ranges from 0 to 2ⁿ−1, while a typical signed two's-complement type ranges from −2ⁿ⁻¹ to 2ⁿ⁻¹−1. The overflow can happen during addition, subtraction, multiplication, conversion, or arithmetic used to calculate an array size, file offset, or memory allocation.

The visible result depends on the language specification and machine representation. In modular arithmetic, adding one to the maximum unsigned value produces zero; this is commonly called wraparound. A signed overflow is more dangerous to reason about: in C, the behavior is undefined, allowing a compiler to make optimization assumptions rather than produce a predictable wrapped value.² The related term integer underflow describes crossing the lower bound.

Programming languages deliberately give integer overflow different semantics, so code cannot be assessed from the hardware result alone. C and C++ define unsigned arithmetic modulo the type's range, but signed overflow is undefined behavior; compiler optimizations can therefore remove or transform checks that depend on it.² Java defines fixed-width integer arithmetic to use two's-complement operations, with overflow silently discarding high-order bits, while explicit library methods such as Math.addExact can throw an exception.³

Rust can panic on overflow in debug builds and provides checked, overflowing, wrapping, and saturating operations for explicit choices; release-mode behavior should not be treated as a substitute for specifying intent.⁴ Python's built-in integers grow to accommodate larger values, so ordinary integer arithmetic does not overflow, although conversions to fixed-width formats, memory limits, and external protocols still impose bounds.⁵

Overflow becomes a vulnerability when a computed value controls a security boundary, resource size, index, or trust decision. A wrapped allocation size can cause a program to reserve less memory than intended and then copy the original amount; a wrapped index or length can enable an out-of-bounds access, while a signed overflow can invalidate range checks under an optimizing compiler. MITRE classifies this pattern as CWE-190 and associates it with improper restriction of operations within the bounds of a memory buffer.¹

Not every overflow is exploitable: image processing, cryptographic counters, hash functions, and ring buffers sometimes require deliberate modular arithmetic. The distinction is whether wraparound is specified and safe for the algorithm. Security-sensitive code should validate operands before arithmetic, choose types whose ranges match the domain, and treat conversions between signed and unsigned types as separate boundary checks rather than harmless casts.²

Reliable prevention combines range reasoning, checked operations, and testing rather than relying on a single compiler warning. Static analyzers and compiler sanitizers can identify many suspicious operations; boundary-focused tests should include zero, the minimum and maximum representable values, and products or sums just beyond those limits. APIs that return an overflow flag, option, or exception make failure visible to callers, whereas silent truncation hides it.

A subtle case is overflow in an intermediate expression: assigning the final result to a wider variable does not help if the operands were first promoted or multiplied in a narrower type. Another is narrowing conversion, where a valid large value becomes an unrelated small value without an arithmetic operator. Fixed-width serialization and database fields create the same risk even in languages with unbounded integers. The CERT C guidelines recommend ensuring that unsigned operations do not wrap when wraparound would violate program assumptions.²

Wraparound

A modular result in which an integer passing its upper or lower bound reappears at the opposite end of its range.

Undefined behavior

A language-defined category in which the specification imposes no requirements on the result; signed overflow in C is a prominent example.

Saturating arithmetic

Arithmetic that clamps an out-of-range result to the type's minimum or maximum value.

Checked arithmetic

An operation that detects overflow and reports it through an exception, flag, option, or similar result.

Integer underflow

An integer result that falls below the minimum value representable by its type.