Integer overflow occurs when an arithmetic operation (addition, multiplication, subtraction) produces a value that exceeds the maximum range of the integer type. In C/C++, unsigned integer overflow wraps around (modulo 2^n), while signed integer overflow is undefined behavior (UB). Attackers exploit integer overflows to bypass size checks, allocate undersized buffers (heap/stack), and cause buffer overflows leading to remote code execution (RCE). 15% of memory corruption vulnerabilities involve integer overflows (CVE database).
Integer Overflow Statistics: 15% of memory corruption vulnerabilities involve integer overflows. 60% of integer overflows occur in multiplication (size = count * sizeof(struct)). 40% occur in addition/subtraction. Average CVSS score: 8.8 (High).
Common integer overflow targets:
Wraps around modulo 2^n. Example: 0xFFFFFFFF + 1 = 0 (32-bit unsigned). Used to bypass size checks (malloc(0) instead of large allocation).
Undefined behavior in C/C++. INT_MAX + 1 = INT_MIN (two's complement). Compiler optimizations may remove overflow checks.
Subtraction wraps below zero. Example: 0 - 1 = 0xFFFFFFFF (unsigned). Bypass buffer index checks.
Most dangerous. size = count * element_size overflows, leading to undersized allocation → heap buffer overflow.
// Integer overflow examples (vulnerable C code)
// 1. Multiplication overflow (heap buffer overflow)
size_t size = count * sizeof(struct item); // overflow if count > SIZE_MAX / sizeof(struct item)
char *buffer = malloc(size); // undersized allocation
for (i = 0; i < count; i++) {
buffer[i] = user_data[i]; // heap buffer overflow
}
// 2. Addition overflow (stack buffer overflow)
int length = header_len + payload_len; // overflow if header_len + payload_len > INT_MAX
char buffer[1024];
memcpy(buffer, payload, length); // stack buffer overflow (length > 1024)
// 3. Signed integer overflow (undefined behavior)
int result = a + b; // undefined if a + b > INT_MAX or < INT_MIN
if (result < 0) { // Compiler may optimize away this check
error("overflow");
}
// 4. Integer underflow (array index)
int index = offset - length; // underflow if length > offset
if (index < 0) { // Check before array access
error("negative index");
}
array[index] = value; // Out-of-bounds write (index negative → large unsigned)
// 5. Safe integer checks (C++)
#include
SafeInt safe_size = SafeInt(count) * sizeof(struct item);
char* buffer = new char[safe_size];
OpenSSL heartbeat extension integer overflow. Attacker sends malformed heartbeat request with length > payload length. Heap buffer over-read leaks private keys, passwords, session data. Affected 17% of HTTPS servers.
ImageMagick integer overflow in MVG parser. Multiple overflows lead to arbitrary code execution (RCE). Exploited via image uploads.
Integer overflow in Linux kernel (kvm subsystem). Local privilege escalation (user → root). Affected kernels 3.11-3.19.
Integer overflow in Android Stagefright media framework. Remote code execution via MMS (text message). Affected 95% of Android devices (2015).
// Integer overflow statistics (CVE database, 2023-2024)
- 15% of memory corruption vulnerabilities involve integer overflows
- 60% of integer overflows occur in multiplication (size = count * sizeof(struct))
- 30% occur in addition/subtraction (buffer size calculations)
- 10% occur in bitwise operations
- 50% of integer overflows occur in C/C++ code
- 30% in Java (library code, Android)
- 15% in Rust (unsafe blocks)
- 5% in other languages
- Average CVSS score: 8.8 (High - Critical)
- 70% of integer overflows lead to buffer overflows (heap/stack)
- 30% lead to denial of service (DoS)
// Top software categories affected
1. Image/Video parsers (JPEG, PNG, GIF, MP4): 35%
2. Network protocols (TLS, HTTP, DNS): 25%
3. Operating systems (kernels): 20%
4. Cryptographic libraries: 10%
5. Memory allocators: 10%
This demonstration simulates integer overflow leading to heap buffer overflow:
This is a simulated demonstration. Real integer overflows (multiplication: count * sizeof) lead to undersized allocations → heap buffer overflows → RCE. Defenses: Use safe integer libraries (SafeInt, checked_int). Enable compiler flags: -ftrapv (traps signed overflow), -fwrapv (wraps signed). Use larger types (size_t, uint64_t). Validate arithmetic operations (if (count > SIZE_MAX / sizeof(struct))).
GCC/Clang -ftrapv traps signed integer overflow (abort). -fsanitize=signed-integer-overflow detects overflows at runtime.
Detects signed integer overflow, unsigned integer overflow, shift overflow. Reports at runtime (log + abort).
Detects potential integer overflows (multiplication, addition). Flags dangerous patterns (count * sizeof).
SafeInt (C++), checked_int (C) check overflow before arithmetic. Throws exception/error on overflow.
Check if (count > SIZE_MAX / sizeof(struct)) before multiplication. Use built-in overflow-checking functions (__builtin_mul_overflow).
Use size_t for sizes (64-bit on 64-bit systems). Use uint64_t for large values. Avoid int/unsigned int for sizes.
-ftrapv traps signed overflow (abort). -fwrapv wraps signed overflow (defined behavior). -fsanitize=integer detects overflows.
Best Practice - Safe Integer Libraries + Runtime Checks: Use SafeInt (C++) or checked_int (C) libraries. Validate arithmetic operations before computation (if (count > SIZE_MAX / sizeof(struct))). Enable compiler flags (-ftrapv for signed overflow, -fsanitize=integer). Use larger types (size_t, uint64_t). Use __builtin_mul_overflow, __builtin_add_overflow (GCC/Clang).
Integer overflow exploitation is illegal when used without authorization (CFAA). Ethical uses include:
Integer overflow exploits are illegal when used without authorization. Penalties include:
Important: This guide is for educational and defensive purposes only. Only test integer overflow vulnerabilities on systems you own or have explicit written authorization. Responsible disclosure to vendors.
C++ library for safe integer operations (overflow detection).
Compiler built-in functions for overflow-checking arithmetic.
Detailed analysis of integer overflow in heartbeat extension.