482
size_t len = a - b;
char buf[len]; // Just blows up the stack
}
Since a and b are declared as signed ints, the "a - b" subtraction gives a negative result (-1).
However, since len is declared to be unsigned, len is cast to an extremely large positive number
(on 32-bit systems - 4294967295). As a result, the buffer buf[len] declaration uses an extremely
large size to allocate on the stack, very likely more than the entire computer's memory space.
Miscalculations usually will not be so obvious. The calculation will either be complicated or the
result of an attacker's input to attain the negative value.
Observed Examples
Reference Description
CVE-2004-0816 Integer underflow in firewall via malformed packet.
https://www.cve.org/CVERecord?id=CVE-2004-0816
CVE-2004-1002 Integer underflow by packet with invalid length.
https://www.cve.org/CVERecord?id=CVE-2004-1002
CVE-2005-0199 Long input causes incorrect length calculation.
https://www.cve.org/CVERecord?id=CVE-2005-0199
CVE-2005-1891 Malformed icon causes integer underflow in loop counter variable.
https://www.cve.org/CVERecord?id=CVE-2005-1891
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1137 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 03. Numeric Types and Operations (NUM)
1133 2445
MemberOf 1158 SEI CERT C Coding Standard - Guidelines 04. Integers
(INT)
1154 2456
MemberOf 1408 Comprehensive Categorization: Incorrect Calculation 1400 2534
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Integer underflow (wrap or wraparound)
Software Fault Patterns SFP1 Glitch in computation
CERT C Secure Coding INT30-C Imprecise Ensure that unsigned integer
operations do not wrap
CERT C Secure Coding INT32-C Imprecise Ensure that operations on signed
integers do not result in overflow
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-192: Integer Coercion Error
Weakness ID : 192
Structure : Simple
Abstraction : Variant
CWE Version 4.14
CWE-192: Integer Coercion Error
CWE-192: Integer Coercion Error