CWE-190 · Memory Safety

Integer Overflow: Examples, Impact, Detection, and Fixes

Integer overflow (CWE-190) occurs when arithmetic produces a value too large for its type, wrapping to a small number. When this happens in size calculations passed to malloc, the result is an undersized allocation and a heap overflow. This guide covers the vulnerable patterns, how to detect them, and safe alternatives.

What is integer overflow?

Integer overflow happens when a calculation produces a result beyond the range of its integer type. For a 32-bit unsigned integer, adding 1 to 0xFFFFFFFF wraps to 0x00000000. For a signed integer, overflow is undefined behavior in C — the compiler may optimize it in unexpected ways.

In security contexts, integer overflow is most dangerous when the overflowed value is used as a memory allocation size. Multiplying a user-controlled count by an element size without checking for overflow can produce a tiny allocation, setting up a heap buffer overflow when that buffer is filled with the intended number of elements.

Common vulnerable patterns

PatternRiskySafeWhy
count * size before mallocmalloc(count * element_size)calloc(count, element_size)calloc checks for size overflow internally
User-controlled size arithmeticmalloc(user_len + HEADER_SIZE)Check user_len <= SIZE_MAX - HEADER_SIZE before mallocAddition can overflow if user_len is near SIZE_MAX
Loop counter as allocation sizemalloc(n * sizeof(struct foo))__builtin_mul_overflow check or reallocarray()reallocarray checks for overflow in n * size
Signed/unsigned mismatchint count = ...; malloc(count * 4)size_t count = ...; malloc(count * 4)Negative int cast to size_t becomes huge allocation size

Vulnerable vs secure examples

Integer overflow before malloc (C)

Vulnerable

// count is user-controlled
// If count = 0x40000001, then count * 4 overflows to 4
// malloc(4) succeeds but buffer is way too small
void *buf = malloc(count * sizeof(int));
if (!buf) return NULL;
// Subsequent copy of count elements overflows heap
memcpy(buf, src, count * sizeof(int));

Secure

// Option 1: calloc checks overflow internally
void *buf = calloc(count, sizeof(int));
if (!buf) return NULL;

// Option 2: explicit overflow check
if (count > SIZE_MAX / sizeof(int)) return NULL;
void *buf = malloc(count * sizeof(int));
if (!buf) return NULL;

Addition overflow in buffer sizing (C)

Vulnerable

#define HEADER_SIZE 16
// user_len near SIZE_MAX causes overflow
char *buf = malloc(user_len + HEADER_SIZE);

Secure

#define HEADER_SIZE 16
// Check before adding
if (user_len > SIZE_MAX - HEADER_SIZE) return NULL;
char *buf = malloc(user_len + HEADER_SIZE);

How to detect integer overflow

  • Semgrep / CodeQL: Rules that flag unchecked arithmetic passed to malloc/realloc
  • UBSan: -fsanitize=integer detects signed/unsigned overflow at runtime
  • -ftrapv: Traps signed integer overflow (generates SIGABRT)
  • AddressSanitizer: Detects the heap overflow that results from an undersized allocation
# Semgrep: flag malloc(a * b) where a or b may be user-controlled
rules:
  - id: malloc-integer-overflow
    pattern: malloc($A * $B)
    message: >
      Unchecked multiplication before malloc may overflow (CWE-190).
      Use calloc($A, $B) or check for overflow before malloc.
    severity: WARNING
    languages: [c, cpp]

How Orbis AppSec detects integer overflow

Orbis AppSec identifies unchecked size arithmetic before allocation calls and opens automated fix pull requests replacing the pattern with calloc or adding explicit overflow guards.

Source:User-controlled count / length
Sink:malloc(count * size), malloc(len + N)
Missing control:Overflow check before multiplication/addition
CWE:CWE-190 → CWE-122 (heap overflow)
Fix:calloc(), SIZE_MAX guard, __builtin_mul_overflow

Want Orbis AppSec to find and fix integer overflow issues in your GitHub repositories?

Try Orbis AppSec

Related CWEs

CWE-190Integer Overflow or WraparoundCWE-122Heap-based Buffer OverflowCWE-120Classic Buffer OverflowCWE-191Integer Underflow

Real-world Orbis AppSec case studies

Browse posts where Orbis AppSec detected and fixed integer overflow vulnerabilities in real open-source repositories:

View all memory safety case studies

FAQ

What is integer overflow?

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value for the integer type. The result wraps around, typically to a very small number.

What CWE is integer overflow?

CWE-190: Integer Overflow or Wraparound.

How does integer overflow lead to a heap buffer overflow?

When an overflowed size is passed to malloc, the allocator receives a much smaller size than intended and allocates a too-small buffer. Subsequent writes to this buffer overflow the heap allocation, corrupting adjacent memory.

How do you prevent integer overflow before malloc in C?

Use calloc(count, element_size) instead of malloc(count * size) — calloc checks for overflow internally. For addition, verify the operands don't exceed SIZE_MAX before adding. Use __builtin_mul_overflow or reallocarray for explicit overflow-safe multiplication.

Can integer overflow be detected at compile time?

Partially. Compiler flags like -ftrapv trap signed overflow at runtime. UndefinedBehaviorSanitizer (UBSan) detects integer overflow during testing. Static analyzers can flag unchecked size arithmetic before allocation calls.

Is integer overflow undefined behavior in C?

Signed integer overflow is undefined behavior in C. Unsigned integer overflow is well-defined (wraps modulo 2^n) but can still lead to security bugs when the wrapped value is used as an allocation size.

References