CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.4)  

CWE-191: Integer Underflow (Wrap or Wraparound)

Individual Definition in a New Window
Integer Underflow (Wrap or Wraparound)
Status: Draft
Weakness ID: 191 (Weakness Base)
+ Description
Summary

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Extended Description

This can happen in signed and unsigned cases.

+ Alternate Terms
Integer underflow

"Integer underflow" is sometimes used to identify signedness errors in which an originally positive number becomes negative as a result of subtraction. However, there are cases of bad subtraction in which unsigned integers are involved, so it's not always a signedness issue.

"Integer underflow" is occasionally used to describe array index errors in which the index is negative.

+ Time of Introduction
* Implementation
+ Applicable Platforms
Languages
C
C++
Java
.NET
+ Demonstrative Examples

The following example has an integer underflow. The value of i is already at the lowest negative value possible. The new value of i is 2147483647.

C Example:
#include <stdio.h>
#include <stdbool.h>
main (void)
{
int i;
unsigned int j = 0;
i = -2147483648;
i = i - 1;
j = j - 1;
return 0;
}
 
+ Observed Examples
ReferenceDescription
Integer underflow in firewall via malformed packet.
Integer underflow by packet with invalid length.
Long input causes incorrect length calculation.
Malformed icon causes integer underflow in loop counter variable.
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class682Incorrect Calculation
Development Concepts (primary)699
Research Concepts (primary)1000
+ Research Gaps

Under-studied.

+ Taxonomy Mappings
Mapped Taxonomy NameMapped Node Name
PLOVERInteger underflow (wrap or wraparound)
+ Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Demonstrative_Example
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Alternate_Terms, Applicable_Platforms, Relationships, Taxonomy_Mappings
CWE Content Team. MITRE. 2008-10-14. (Internal)
updated Description
CWE Content Team. MITRE. 2009-05-27. (Internal)
updated Demonstrative_Examples
Page Last Updated: May 26, 2009