Cybersecurity glossary
What is an Integer Overflow?
Learn what an integer overflow is, how wraparound breaks size calculations and security checks, how overflows lead to buffer overflows or logic bugs, and how to prevent unsafe integer arithmetic.
Definition
An integer overflow occurs when an arithmetic operation produces a value larger than the destination integer type can represent, causing wraparound (or other undefined behavior) that can break length checks, allocations, and security-critical logic.
Why integer overflows matter
Security logic often reduces to arithmetic: “is this length safe?”, “how many bytes should I allocate?”, “does index + count stay in range?” When those calculations wrap, the answers flip from safe to dangerous without an obvious crash at the arithmetic site.
Integer Overflow is therefore a force multiplier: the bug may look like a tiny math mistake, but the blast radius is frequently a buffer overflow, truncated check, or broken authorization boundary.
How overflow turns into exploitation
Attacker supplies large operands
Protocol fields, dimensions, counts, or offsets are chosen near type limits.
Arithmetic wraps
Multiplication or addition exceeds the type width and becomes a small value.
Safety check uses the wrapped result
A comparison that should reject the input incorrectly passes.
Allocation or copy proceeds
Too little memory is reserved, or a loop runs with a wrong bound.
Memory or logic corruption follows
Heap overflow, out-of-bounds access, or incorrect business totals result.
High-risk arithmetic patterns
Allocation size products
width * height * channels wrapping before malloc or new[].
Length + header checks
total = len + overhead wraps so total < capacity even when unsafe.
Index advancement
offset + size wraps, skipping a bounds check that assumed monotonic growth.
Quota and balance math
Monetary or credit counters wrapping can create logic bypasses without memory bugs.
Prevention techniques
| Control | Notes |
|---|---|
| Checked arithmetic APIs | Use builtins or libraries that report overflow instead of silently wrapping |
| Preflight maxima | Reject dimensions/counts above application-defined safe ceilings early |
| Wider intermediates | Compute in a wider type, then range-check before narrowing |
| Sanitizers in CI | Enable integer/UBSan on native test and fuzz builds |
| Static analysis | Flag unchecked size multiplications feeding allocations |
| Memory-safe languages | Prefer checked or panic-on-overflow modes for security-critical math |
- List all size and count calculations that influence allocation or copying.
- Replace unchecked multiply/add on those paths with overflow-detecting helpers.
- Cap untrusted dimensions and lengths to realistic maxima.
- Add regression tests with near-max integer values (e.g., 0xFFFFFFFF).
- Run UBSan/integer sanitizers in CI for C/C++ components.
- Review monetary and quota counters for wraparound logic bugs.
- Document which integer types are used for lengths on each protocol boundary.
- Treat wrapped-size heap overflows as integer-bug root causes in postmortems.
The practical takeaway
An integer overflow wraps a number past its type limit and can silently invalidate security checks and allocation sizes. Fix the arithmetic—not only the resulting memory crash.
Whenever untrusted input feeds a multiply used for malloc, assume overflow until you prove the math is checked.
Related security terms
Integer Underflow
The counterpart where subtraction or decrement wraps below the type’s minimum.
Buffer Overflow
A frequent consequence when overflowed sizes allocate too little memory.
Heap Overflow
Often enabled by wrapped allocation sizes followed by large copies.
Out-of-Bounds Write
Downstream memory corruption when overflowed lengths bypass checks.
Frequently asked questions
What is an integer overflow in simple terms?
Numbers in computers have a maximum. If you add past that maximum, the value can wrap to a small number. Security checks or malloc sizes that use the wrapped value become wrong.
How does integer overflow become a memory bug?
Classic pattern: width * height wraps to a tiny size, the program allocates that tiny buffer, then writes the full image into it—causing a heap overflow.
Are signed and unsigned overflows the same?
Unsigned wraparound is well-defined in C/C++. Signed overflow is undefined behavior in C/C++. Both can produce security failures if results are trusted for sizes or bounds.
Is integer overflow only a C/C++ problem?
No. Many languages wrap fixed-width integers. Some throw on overflow; others need checked APIs. Logic bugs from wraparound appear in any language that uses fixed-width math carelessly.
What is the difference between overflow and underflow?
Overflow exceeds the maximum representable value. Underflow (in the integer-security sense) goes below the minimum—often via subtraction—wrapping to a large value.
How do you prevent integer overflows in size math?
Use checked multiplication helpers, reject values above safe maxima, prefer size types with explicit overflow detection, and never trust a single arithmetic result for allocation without validation.
Do compiler warnings catch these bugs?
Sometimes. Enabling overflow sanitizers (-fsanitize=integer/undefined) and static analysis helps, but security-critical size paths still need explicit checks.
References
Explore authoritative guidance and frameworks related to integer overflow.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.