472
Nature Type ID Name Page
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Reliance on data layout
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-190: Integer Overflow or Wraparound
Weakness ID : 190
Structure : Simple
Abstraction : Base
Description
The product performs a calculation that can produce an integer overflow or wraparound, when
the logic assumes that the resulting value will always be larger than the original value. This can
introduce other weaknesses when the calculation is used for resource management or execution
control.
Extended Description
An integer overflow or wraparound occurs when an integer value is incremented to a value that
is too large to store in the associated representation. When this occurs, the value may wrap to
become a very small or negative number. While this may be intended behavior in circumstances
that rely on wrapping, it can have security consequences if the wrap is unexpected. This is
especially the case if the integer overflow can be triggered using user-supplied inputs. This
becomes security-critical when the result is used to control looping, make a security decision, or
determine the offset or size in behaviors such as memory allocation, copying, concatenation, etc.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 682 Incorrect Calculation 1499
ParentOf 680 Integer Overflow to Buffer Overflow 1493
PeerOf 128 Wrap-around Error 339
PeerOf 1339 Insufficient Precision or Accuracy of a Real Number 2242
CanPrecede 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer