Integer Overflow or Wraparound (CWE-190)

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value.

An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of bits. This can lead to buffer overflows, incorrect financial calculations, or security bypasses.

व्यापकता

मध्यम

3 भाषाएँ कवर की गईं

प्रभाव

मध्यम

समीक्षा अनुशंसित

रोकथाम

प्रलेखित

3 फिक्स उदाहरण

2 रोकथाम

इस भेद्यता को कैसे ठीक करें

3 Shoulder डिटेक्शन नियमों पर आधारित Integer Overflow के लिए रोकथाम रणनीतियाँ।

🐹 Go सब देखें Go विवरण →

Integer Overflow via Unchecked Arithmetic MEDIUM

Validate bounds before arithmetic operations with user-controlled integers

+5 -1 go

  func handler(w http.ResponseWriter, r *http.Request) {
-     count, _ := strconv.Atoi(r.URL.Query().Get("count"))
+     count, err := strconv.Atoi(r.URL.Query().Get("count"))
+     if err != nil || count < 0 || count > 10000 {
+         http.Error(w, "Invalid count", 400)
+         return
+     }
      buffer := make([]byte, count*1024)
  }

🟨 JavaScript सब देखें JavaScript विवरण →

Integer Overflow via Unchecked Arithmetic MEDIUM

Validate numeric bounds before using user input in allocations or arithmetic

+5 -1 javascript

- const size = parseInt(req.query.size, 10);
+ const MAX_SIZE = 1024 * 1024;
+ const size = parseInt(req.query.size, 10);
+ if (isNaN(size) || size < 0 || size > MAX_SIZE) {
+   return res.status(400).json({ error: 'Invalid size' });
+ }
  const buffer = Buffer.alloc(size);

🐍 Python सब देखें Python विवरण →

Integer Overflow / Large Number Handling LOW

Validate numeric bounds before arithmetic operations on user input

+9 -7 python

- from flask import request
- 
- @app.route('/calculate')
- def calculate():
-     count = int(request.args.get('count'))
-     total = count * unit_price
-     return {'total': total}
+ from flask import request, jsonify
+ 
+ @app.route('/calculate')
+ def calculate():
+     count = int(request.args.get('count', 0))
+     if count < 0 or count > 10000:
+         return jsonify({'error': 'Invalid count'}), 400
+     total = count * unit_price
+     return jsonify({'total': total})

3 पहचान

अपने कोड में भेद्यताएँ खोजें

Integer Overflow or Wraparound पैटर्न के लिए अपने कोडबेस को स्कैन करने के लिए Shoulder का उपयोग करें। 3 नियम.

टर्मिनल

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=190

# Or scan entire project
npx @shoulderdev/cli trust .

पहचान नियम (3)

🐹 Go 1 rules

Integer Overflow via Unchecked Arithmetic MEDIUM

User-controlled integer used in arithmetic or allocation without bounds checking.

🟨 Javascript 1 rules

Integer Overflow via Unchecked Arithmetic MEDIUM

Detects user-controlled values flowing into arithmetic operations without bounds checking. While JavaScript uses 64-bit floats for most numbers, integer overflow is still a concern in these scenarios: 1. TypedArrays (Uint8Array, Int32Array, etc.) - values wrap on overflow 2. Bitwise operations - convert to 32-bit signed integers 3. Large number arithmetic affecting security decisions 4. Array/Buffer allocation with user-controlled sizes Common vulnerable patterns: - Buffer allocation: Buffer.a

🔷 Typescript 1 rules

Integer Overflow via Unchecked Arithmetic MEDIUM

🐍 Python 1 rules

Integer Overflow / Large Number Handling LOW

Detects potential integer overflow in numeric operations.

4 चेतावनी संकेत

कोड समीक्षा में किन बातों पर ध्यान दें

ये पैटर्न संभावित Integer Overflow or Wraparound भेद्यताओं का संकेत देते हैं। कोड समीक्षा और सुरक्षा ऑडिट के दौरान इन्हें देखें।

🟡

user-controlled values flowing into arithmetic operations without bounds checking javascript-integer-overflow

🔵

potential integer overflow in numeric operations python-integer-overflow

🔍

अपने कोडबेस को इसके लिए स्कैन करें: Integer Overflow or Wraparound

Shoulder CLI आपके पूरे कोडबेस में भेद्य पैटर्न खोजता है।

npx shoulder trust सभी नियम देखें