477
int determineFirstQuarterRevenue() {
...
// Calculate quarterly total
long quarterSold = JanSold + FebSold + MarSold;
// Calculate the total revenue for the quarter
quarterRevenue = calculateRevenueForQuarter(quarterSold);
...
}
Note that an integer overflow could also occur if the quarterSold variable has a primitive type long
but the method calculateRevenueForQuarter has a parameter of type short.
Observed Examples
Reference Description
CVE-2021-43537 Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit
integer (CWE-681) and potentially leading to an integer overflow (CWE-190).
If an integer overflow occurs, this can cause heap memory corruption
(CWE-122)
https://www.cve.org/CVERecord?id=CVE-2021-43537
CVE-2022-21668 Chain: Python library does not limit the resources used to process images
that specify a very large number of bands (CWE-1284), leading to excessive
memory consumption (CWE-789) or an integer overflow (CWE-190).
https://www.cve.org/CVERecord?id=CVE-2022-21668
CVE-2022-0545 Chain: 3D renderer has an integer overflow (CWE-190) leading to write-whatwhere
condition (CWE-123) using a crafted image.
https://www.cve.org/CVERecord?id=CVE-2022-0545
CVE-2021-30860 Chain: improper input validation (CWE-20) leads to integer overflow
(CWE-190) in mobile OS, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-30860
CVE-2021-30663 Chain: improper input validation (CWE-20) leads to integer overflow
(CWE-190) in mobile OS, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-30663
CVE-2018-10887 Chain: unexpected sign extension (CWE-194) leads to integer overflow
(CWE-190), causing an out-of-bounds read (CWE-125)
https://www.cve.org/CVERecord?id=CVE-2018-10887
CVE-2019-1010006Chain: compiler optimization (CWE-733) removes or modifies code used to
detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).
https://www.cve.org/CVERecord?id=CVE-2019-1010006
CVE-2010-1866 Chain: integer overflow (CWE-190) causes a negative signed value, which
later bypasses a maximum-only check (CWE-839), leading to heap-based
buffer overflow (CWE-122).
https://www.cve.org/CVERecord?id=CVE-2010-1866
CVE-2010-2753 Chain: integer overflow leads to use-after-free
https://www.cve.org/CVERecord?id=CVE-2010-2753
CVE-2005-1513 Chain: integer overflow in securely-coded mail program leads to buffer
overflow. In 2005, this was regarded as unrealistic to exploit, but in 2020, it
was rediscovered to be easier to exploit due to evolutions of the technology.
https://www.cve.org/CVERecord?id=CVE-2005-1513
CVE-2002-0391 Integer overflow via a large number of arguments.
https://www.cve.org/CVERecord?id=CVE-2002-0391
CVE-2002-0639 Integer overflow in OpenSSH as listed in the demonstrative examples.
https://www.cve.org/CVERecord?id=CVE-2002-0639
CVE-2005-1141 Image with large width and height leads to integer overflow.
https://www.cve.org/CVERecord?id=CVE-2005-1141
CVE-2005-0102 Length value of -1 leads to allocation of 0 bytes and resultant heap overflow.
https://www.cve.org/CVERecord?id=CVE-2005-0102
CWE Version 4.14
CWE-190: Integer Overflow or Wraparound
CWE-190: Integer Overflow or Wraparound