1501
evaluating the correctness of allocation calculations. This can be useful for detecting overflow
conditions (CWE-190) or similar weaknesses that might have serious security impacts on the
program.
Effectiveness = High
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Potential Mitigations
Phase: Implementation
Understand your programming language's underlying representation and how it interacts with
numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned
distinctions, truncation, conversion and casting between types, "not-a-number" calculations,
and how your language handles numbers that are too large or too small for its underlying
representation.
Phase: Implementation
Strategy = Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range.
Enforce that the input meets both the minimum and maximum requirements for the expected
range.
Phase: Implementation
Use the appropriate type for the desired action. For example, in C/C++, only use unsigned
types for values that could never be negative, such as height, width, or other numbers related to
quantity.
Phase: Architecture and Design
Strategy = Language Selection
Use languages, libraries, or frameworks that make it easier to handle numbers without
unexpected consequences. Examples include safe integer handling packages such as SafeInt (C
++) or IntegerLib (C or C++).
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use languages, libraries, or frameworks that make it easier to handle numbers without
unexpected consequences. Examples include safe integer handling packages such as SafeInt (C
++) or IntegerLib (C or C++).
Phase: Implementation
Strategy = Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications,
such as signed / unsigned mismatch in memory operations, or use of uninitialized variables.
Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the
entire system.
Phase: Testing
Use automated static analysis tools that target this type of weakness. Many modern techniques
use data flow analysis to minimize the number of false positives. This is not a perfect solution,
since 100% accuracy and coverage are not feasible.
Phase: Testing
Use dynamic tools and techniques that interact with the product using large test suites with
many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The
CWE Version 4.14
CWE-682: Incorrect Calculation
CWE-682: Incorrect Calculation