Integer Overflow
Integer Overflow
Ganzzahlüberlauf
An integer overflow occurs when the result of an arithmetic operation exceeds the value range that the integer type used can represent and silently „wraps around“ — for instance from a very large positive to a negative value. Such silent errors can defeat security checks and lead to further vulnerabilities such as buffer overflows.
History & facts. Integers have a fixed value range in programming; if it is exceeded, the result can wrap around unexpectedly. This is insidious because usually no error is triggered, but the calculation simply continues incorrectly. If, for instance, a size value for a memory allocation is falsified by an overflow, a zone that is too small can be reserved and then overwritten — the overflow thus becomes the precursor of a buffer overflow. This vulnerability class is recorded in CWE.
Outlook & recommendation. Prevention means: validate inputs and intermediate results, choose suitable data types and use language features that detect or prevent overflows. Static analysis and targeted tests uncover such errors before they go into production. For defenders the class is relevant above all as a precursor to more dangerous effects — a reported integer-overflow CVE deserves the same prompt treatment as a direct memory vulnerability.