Integer overflow: when numbers wrap

October 5, 2025 · 1 min read · #binary-exploitation #integer-overflow #memory

Integers have finite size. uint32 at 0xFFFFFFFF + 1 wraps to 0. If a size or index overflows, checks are bypassed.

int len = a + b;          // a+b overflows -> len small/negative
char *p = malloc(len);    // too-small buffer
memcpy(p, src, a + b);    // but the copy uses the real value -> overflow

Variants: signed/unsigned confusion (a negative becomes huge in size_t), multiplication overflow (count * size), truncation going 64 to 32 bits.

Defence

Safe-arithmetic checks: verify a > MAX - b before adding, use overflow-checking allocators (calloc, reallocarray), consistent types (size_t), and sanitizers (-fsanitize=integer) in testing.

« back to home