Cybersecurity glossary
What is an Integer Underflow?
Learn what an integer underflow is, how subtraction wraparound breaks bounds checks and lengths, how underflows enable memory corruption or logic bypasses, and how to prevent unsafe decrement and difference math.
Definition
An integer underflow (in the security sense) occurs when an arithmetic operation produces a value smaller than the destination integer type can represent—commonly via subtraction—causing wraparound to a large value that can break bounds checks, lengths, or security-critical counters.
Why integer underflows matter
Many parsers answer “how many bytes are left?” with subtraction. If an attacker makes the subtracted value larger than the current total, an unsigned result does not become negative—it becomes huge.
Integer Underflow turns that mistake into oversized copies, skipped bounds checks, or wild loop counts. The arithmetic line looks innocent; the failure appears later as memory corruption or broken business logic.
How underflow leads to impact
Establish a length or counter
Code stores total size, remaining bytes, balance, or retry count.
Subtract an attacker-influenced amount
An offset, header size, or debit is taken from the value without a prior compare.
Value wraps to a large number
Unsigned math wraps below zero into a near-maximum integer.
Downstream logic trusts the result
Allocation, memcpy length, or authorization math proceeds with the wrapped value.
Corruption or logic bypass
Out-of-bounds access, huge allocations, or impossible balances appear.
Underflow hotspots
remaining = len - offset
Classic parser bug when offset can exceed len on unsigned types.
Header size subtraction
payload_len = total - sizeof(header) without ensuring total is large enough.
Loop decrements
Unsigned loop counters decremented past zero become enormous iteration counts.
Balance and quota debits
Subtracting from unsigned balances can wrap and look like a huge credit.
Safe patterns
| Control | Notes |
|---|---|
| Compare before subtract | Require offset <= len (and similar) before computing differences |
| Checked subtraction | Use APIs that fail closed on wrap instead of returning modular results |
| Invariant asserts | Abort parsing if remaining length ever increases unexpectedly |
| Reject early | Validate headers and offsets before any size arithmetic |
| Sanitizers | Integer sanitizers catch many wrap bugs in test and fuzz builds |
| Type discipline | Document signed vs unsigned length types; avoid mixing carelessly |
- Search for length and remaining calculations that subtract untrusted values.
- Add explicit preconditions (a >= b) before every security-critical subtraction.
- Fuzz parsers with offsets larger than declared lengths.
- Enable integer sanitizers for native CI builds.
- Review unsigned counters used for retries, quotas, and balances.
- Add unit tests for empty buffers and minimal packet sizes.
- Fail closed on malformed size math—do not continue parsing.
- Link underflow root causes in memory-corruption bug write-ups.
The practical takeaway
An integer underflow wraps a value below its minimum—often via unsafe subtraction—and can authorize huge copies or bypass checks. Always compare before you subtract on length and counter paths.
If a parser computes remaining from attacker-controlled offsets, that single line deserves a security review.
Related security terms
Integer Overflow
Wrap past the maximum; underflow wraps below the minimum.
Buffer Overflow
Can result when underflowed lengths allocate or copy incorrectly.
Out-of-Bounds Read
Incorrect remaining-length math after underflow can read past buffers.
Out-of-Bounds Write
Wrapped sizes may authorize writes that should have been rejected.
Frequently asked questions
What is an integer underflow in simple terms?
If you subtract more than a number currently holds, a fixed-width integer can wrap to a huge value instead of going negative (especially with unsigned types). Code that trusts that result may allocate or copy far too much.
How is underflow different from overflow?
Overflow exceeds the type’s maximum. Underflow goes below its minimum. Both are wraparound failures; they often appear in different formulas (products vs differences).
Why are unsigned underflows common in parsers?
Parsers frequently compute remaining = total - offset. If offset is attacker-controlled and larger than total, unsigned remaining becomes enormous and later checks fail open.
Is floating-point underflow the same issue?
No. Floating-point underflow means a value becomes too small to represent precisely. Security discussions of integer underflow refer to modular wrap of integer types.
Can underflow cause privilege or logic bugs without memory corruption?
Yes. Account balances, retry counters, and rate-limit tallies can wrap and grant unintended access or resources.
How do you prevent integer underflows?
Check that the subtrahend is not larger than the value before subtracting, use checked arithmetic, prefer signed types with explicit range validation where appropriate, and reject malformed lengths early.
What tests catch underflows?
Inputs where offsets exceed lengths, empty buffers with nonzero skips, and counters decremented past zero. Sanitizers and assertions on remaining-length invariants help.
References
Explore authoritative guidance and frameworks related to integer underflow.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.