NUM.OVERFLOW.DF.UNBOUNDED

Possible numeric overflow or wraparound from an unconstrained value

The NUM.OVERFLOW.DF.UNBOUNDED checker detects possible cases of numeric overflow or wraparound in an arithmetic operation where the violated bound is reached only through an unconstrained (untrusted) value, such as an unconstrained function parameter that falls back to the full range of its type.

This checker uses the same underlying overflow analysis as NUM.OVERFLOW.DF. The two checkers report disjoint sets of defects:

• NUM.OVERFLOW.DF reports overflows on a trusted bound, for example when concrete constant values force the crossing.

• NUM.OVERFLOW.DF.UNBOUNDED reports overflows whose violated side is reached only through an untrusted value, such as an unconstrained parameter or another value with a full-type-range fallback.

Separating these cases lets you triage or suppress untrusted-source overflows independently from overflows produced by concrete values.

Vulnerability and risk

A numeric overflow condition can give results that lead to undefined behavior. In addition, an overflow can compromise the reliability and security of the program.

Vulnerable code example

1
2
3
4
5
6
  unsigned char checkOverflowUnbounded(unsigned char c)
  {
      unsigned char r;
      r = (unsigned char)(c + 1);
      return r;
  }

In this example, Klocwork reports a NUM.OVERFLOW.DF.UNBOUNDED defect at line 4. Because c is an unconstrained parameter, its value can span the full unsigned char range [0, 255]. The expression c + 1 can therefore reach 256, which crosses the upper bound of unsigned char. The crossing occurs only on the untrusted side, so it is reported as NUM.OVERFLOW.DF.UNBOUNDED rather than NUM.OVERFLOW.DF.

Fixed code example

1
2
3
4
5
6
7
8
9
10
  unsigned char checkOverflowUnbounded(unsigned char c)
  {
      unsigned char r;
      if (c < 255U) {
          r = (unsigned char)(c + 1);
      } else {
          r = c;
      }
      return r;
  }

The compliant solution guards the addition so that the result cannot exceed the range of unsigned char.

Related checkers

• NUM.OVERFLOW
• NUM.OVERFLOW.DF

• MISRA.COMP.WRAPAROUND

External guidance

• CWE-190: Integer Overflow or Wraparound
• CERT INT30-C: Ensure that unsigned integer operations do not wrap
• CERT INT32-C: Ensure that operations on signed integers do not result in overflow

Security training

Application security training materials provided by Secure Code Warrior.

• Integer Overflow Training Video - Test your skills with a training example

Extension

This checker cannot be extended.