The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
This can happen in signed and unsigned cases.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2004-0816
Integer underflow in firewall via malformed packet.
CVE: CVE-2004-1002
Integer underflow by packet with invalid length.
CVE: CVE-2005-0199
Long input causes incorrect length calculation.
CVE: CVE-2005-1891
Malformed icon causes integer underflow in loop counter variable.
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: The following example subtracts from a 32 bit signed integer.
Body: The example has an integer underflow. The value of i is already at the lowest negative value possible, so after subtracting 1, the new value of i is 2147483647.
#include <stdio.h> #include <stdbool.h> main (void) { int i; i = -2147483648; i = i - 1; return 0; }Intro: This code performs a stack allocation based on a length calculation.
Body: Since a and b are declared as signed ints, the "a - b" subtraction gives a negative result (-1). However, since len is declared to be unsigned, len is cast to an extremely large positive number (on 32-bit systems - 4294967295). As a result, the buffer buf[len] declaration uses an extremely large size to allocate on the stack, very likely more than the entire computer's memory space.
int a = 5, b = 6; size_t len = a - b; char buf[len]; // Just blows up the stack }