Integer overflow


In computer programming, an integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of digits – either higher than the maximum or lower than the minimum representable value.
The most common result of an overflow is that the least significant representable digits of the result are stored; the result is said to wrap around the maximum.
An overflow condition may give results leading to unintended behavior. In particular, if the possibility has not been anticipated, overflow can compromise a program's reliability and security.
For some applications, such as timers and clocks, wrapping on overflow can be desirable. The C11 standard states that for unsigned integers modulo wrapping is the defined behavior and the term overflow never applies: "a computation involving unsigned operands can never overflow."
On some processors like graphics processing units and digital signal processors which support saturation arithmetic, overflowed results would be "clamped", i.e. set to the minimum or the maximum value in the representable range, rather than wrapped around.

Origin

The register width of a processor determines the range of values that can be represented in its registers. Though the vast majority of computers can perform multiple-precision arithmetic on operands in memory, allowing numbers to be arbitrarily long and overflow to be avoided, the register width limits the sizes of numbers that can be operated on using a single instruction per operation. Typical binary register widths for unsigned integers include:
When an arithmetic operation produces a result larger than the maximum above for an N-bit integer, an overflow reduces the result to modulo N-th power of 2, retaining only the least significant bits of the result and effectively causing a wrap around.
In particular, multiplying or adding two integers may result in a value that is unexpectedly small, and subtracting from a small integer may cause a wrap to a large positive value.
Such wraparound may cause security detriments—if an overflowed value is used as the number of bytes to allocate for a buffer, the buffer will be allocated unexpectedly small, potentially leading to a buffer overflow which, depending on the usage of the buffer, might in turn cause arbitrary code execution.
If the variable has a signed integer type, a program may make the assumption that a variable always contains a positive value. An integer overflow can cause the value to wrap and become negative, which violates the program's assumption and may lead to unexpected behavior.

Flags

Most computers have two dedicated processor flags to check for overflow conditions.
The carry flag is set when the result of an addition or subtraction, considering the operands and result as unsigned numbers, does not fit in the given number of bits. This indicates an overflow with a carry or borrow from the most significant bit. An immediately following add with carry or subtract with borrow operation would use the contents of this flag to modify a register or a memory location that contains the higher part of a multi-word value.
The overflow flag is set when the result of an operation on signed numbers does not have the sign that one would predict from the signs of the operands, e.g., a negative result when adding two positive numbers. This indicates that an overflow has occurred and the signed result represented in two's complement form would not fit in the given number of bits.

Definition variations and ambiguity

For an unsigned type, when the ideal result of an operation is outside the type's representable range and the returned result is obtained by wrapping, then this event is commonly defined as an overflow.
In contrast, the C11 standard defines that this event is not an overflow and states "a computation involving unsigned operands can never overflow."
When the ideal result of an integer operation is outside the type's representable range and the returned result is obtained by clamping, then this event is commonly defined as a saturation.
Usage varies as to whether a saturation is or is not an overflow.
To eliminate ambiguity, the terms wrapping overflow
and saturating overflow
can be used.
The term underflow is most commonly used for floating-point math and not for integer math.
But, many references can be found to integer underflow.
When the term integer underflow is used,
it means the ideal result was closer to minus infinity
than the output type's representable value closest to minus infinity.
When the term integer underflow is used,
the definition of overflow may include all types of overflows
or it may only include cases where the ideal result was closer to positive infinity
than the output type's representable value closest to positive infinity.
When the ideal result of an operation is not an exact integer, the meaning of overflow can be ambiguous in edge cases.
Consider the case where the ideal result has value 127.25 and the output type's maximum representable value is 127.
If overflow is defined as the ideal value being outside the representable range of the output type, then this case would be classified as an overflow.
For operations that have well defined rounding behavior, overflow classification may need to be postponed until after rounding is applied.
The C11 standard
defines that conversions from floating point to integer must round toward zero.
If C is used to convert the floating point value 127.25 to integer, then rounding should be applied first to give an ideal integer output of 127.
Since the rounded integer is in the outputs range, the C standard would not classify this conversion as an overflow.

Methods to address integer overflow problems

Detection

Run-time overflow detection implementation UBSan is available for C compilers.
In Java 8, there are overloaded methods, for example like, which will throw in case of overflow.
Computer emergency response team developed the As-if Infinitely Ranged integer model, a largely automated mechanism to eliminate integer overflow and truncation in C/C++ using run-time error handling.

Avoidance

By allocating variables with data types that are large enough to contain all values that may possibly be computed and stored in them, it is always possible to avoid overflow. Even when the available space or the fixed data types provided by a programming language or environment are too limited to allow for variables to be defensively allocated with generous sizes, by carefully ordering operations and checking operands in advance, it is often possible to ensure a priori that the result will never be larger than can be stored. Static analysis tools, formal verification and design by contract techniques can be used to more confidently and robustly ensure that an overflow cannot accidentally result.

Handling

If it is anticipated that overflow may occur, then tests can be inserted into the program to detect when it happens and do other processing to mitigate it. For example, if an important result computed from user input overflows, the program can stop, reject the input, and perhaps prompt the user for different input, rather than the program proceeding with the invalid overflowed input and probably malfunctioning as a consequence. This full process can be automated: it is possible to automatically synthesize a handler for an integer overflow, where the handler is for instance a clean exit.
CPUs generally have a way of detecting this to support addition of numbers larger than their register size, typically using a status bit; the technique is called multiple-precision arithmetic.
Thus, it is possible to add two numbers each two bytes wide using just a byte addition in steps: first add the low bytes then add the high bytes, but if it is necessary to carry out of the low bytes this is arithmetic overflow of the byte addition and it becomes necessary to detect and increment the sum of the high bytes.

Explicit propagation

if a value is too large to be stored it can be assigned a special value indicating that overflow has occurred and then have all successive operation return this flag value. Such values are sometimes referred to as NaN, for "not a number". This is useful so that the problem can be checked for once at the end of a long calculation rather than after each step. This is often supported in floating point hardware called FPUs.

Programming language support

Programming languages implement various mitigation methods against an accidental overflow: Ada, Seed7, trigger an exception condition on overflow, while Python seamlessly converts internal representation of the number to match its growth, eventually representing it as long – whose ability is only limited by the available memory.
In languages with native support for Arbitrary-precision arithmetic and type safety, numbers are promoted to a larger size automatically when overflows occur, or exceptions thrown when a range constraint exists. Using such languages may thus be helpful to mitigate this issue. However, in some such languages, situations are still possible where an integer overflow can occur. An example is explicit optimization of a code path which is considered a bottleneck by the profiler. In the case of Common Lisp, this is possible by using an explicit declaration to type-annotate a variable to a machine-size word and lower the type safety level to zero for a particular code block.

Saturated arithmetic

In computer graphics or signal processing, it is typical to work on data that ranges from 0 to 1 or from −1 to 1. For example, take a grayscale image where 0 represents black, 1 represents white, and the values in-between represent shades of gray. One operation that one may want to support is brightening the image by multiplying every pixel by a constant. Saturated arithmetic allows one to just blindly multiply every pixel by that constant without worrying about overflow by just sticking to a reasonable outcome that all these pixels larger than 1 just become white and all values "darker than black" just become black.

Examples

Unanticipated arithmetic overflow is a fairly common cause of program errors. Such overflow bugs may be hard to discover and diagnose because they may manifest themselves only for very large input data sets, which are less likely to be used in validation tests.
Taking the arithmetic mean of two numbers by adding them and dividing by two, as done in many search algorithms, causes error if the sum is too large to be represented and hence overflows.
An unhandled arithmetic overflow in the engine steering software was the primary cause of the crash of the 1996 maiden flight of the Ariane 5 rocket. The software had been considered bug-free since it had been used in many previous flights, but those used smaller rockets which generated lower acceleration than Ariane 5. Frustratingly, the part of the software in which the overflow error occurred was not even required to be running for the Ariane 5 at the time that it caused the rocket to fail— it was a launch-regime process for a smaller predecessor of the Ariane 5 that had remained in the software when it was adapted for the new rocket. Furthermore, the actual cause of the failure was a flaw in the engineering specification of how the software dealt with the overflow when it was detected: it did a diagnostic dump to its bus, which would have been connected to test equipment during software testing during development but was connected to the rocket steering motors during flight; the data dump drove the engine nozzle hard to one side which put the rocket out of aerodynamic control and precipitated its rapid breakup in the air.
On 30 April 2015, the U.S. Federal Aviation Authority announced it will order Boeing 787 operators to reset its electrical system periodically, to avoid an integer overflow which could lead to loss of electrical power and ram air turbine deployment, and Boeing deployed a software update in the fourth quarter. The European Aviation Safety Agency followed on 4 May 2015. The error happens after 2³¹ centiseconds, indicating a 32-bit signed integer.
Overflow bugs are evident in some computer games. In the arcade game Donkey Kong, it is impossible to advance past level 22 due to an integer overflow in its time/bonus. The game takes the level number a user is on, multiplies it by 10 and adds 40. When they reach level 22, the time/bonus number is 260, which is too large for its 8-bit 256 value register, so it resets itself to 0 and gives the remaining 4 as the time/bonus – too short to finish the level. In Donkey Kong Jr. Math, when trying to calculate a number over 10,000, it shows only the first 4 digits. Overflow is the cause of the famous "split-screen" level in Pac-Man and "Nuclear Gandhi" in Civilization. It also caused the "Far Lands" in Minecraft which existed from the Infdev development period to Beta 1.7.3; however, it was later fixed in Beta 1.8 but still exists in the Pocket Edition and Windows 10 Edition versions of Minecraft. In the Super Nintendo game Lamborghini American Challenge, the player can cause their amount of money to drop below $0 during a race by being fined over the limit of remaining money after paying the fee for a race, which glitches the integer and grants the player $65,535,000 more than it would have had after going negative. A similar glitch occurs in where the player can drop into a negative amount by fast travelling without sufficient funds, then proceeding to the event where the player gets robbed and has all of their currency taken away. After the game attempts to take the player's money away to an amount of $0, the player is granted 2147482963 in game currency.
In the data structure of Pokémon in the Pokémon games, the number of gained Experience Points is stored in a 3-byte integer. However, in the first and second generations, the Medium Slow experience group, which requires 1,059,860 Experience Points to reach level 100, is calculated to have -54 Experience Points at level 1. Due to the integer being unsigned, the value turns into 16,777,162. If the Pokémon gets less than 54 Experience Points in a battle, then the Pokémon will instantaneously jump to level 100. Additionally, if these Pokémon at level 1 are deposited into the PC, and the player will try to withdraw them, the game will crash, causing these Pokémon to be stuck in the PC permanently. In the same games, the player, by using Rare Candies, can level up their Pokémon past level 100. If they get to level 255 and another Rare Candy is used, then the level overflows to 0.
Microsoft / IBM MACRO Assembler Version 1.00, and likely all other programs built by the same Pascal compiler, had an integer overflow and signedness error in the stack setup code, which prevented them from running on newer DOS machines or emulators under some common configurations with more than 512 KB of memory. The program either hangs or displays an error message and exits to DOS.
In August 2016, a Casino machine at Resorts World Casino printed a prize ticket of $42,949,672.76 as a result of an overflow bug. The Casino refused to pay this amount, calling it a malfunction, using in their defense that the machine clearly stated that the maximum payout was $10,000, so any prize exceeding that had to be the result of a programming bug. The Iowa Supreme Court ruled in favor of the Casino.