# Integer Overflow or Wraparound (CWE-190)

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value.

**Stack:** JavaScript

- Prevalence: Medium 3 languages covered
- Impact: Medium Review recommended
- Prevention: Documented 3 fix examples

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of bits. This can lead to buffer overflows, incorrect financial calculations, or security bypasses.

## Prevention

Prevention strategies for Integer Overflow based on 1 Shoulder detection rules.

### JavaScript

Validate numeric bounds before using user input in allocations or arithmetic

## Warning Signs

- [MEDIUM] user-controlled values flowing into arithmetic operations without
bounds checking

## Consequences

- DoS
- Execute Unauthorized Code
- Modify Application Data

## Mitigations

- Use languages or libraries that check for integer overflow
- Validate that inputs are within expected ranges
- Use safe arithmetic functions that check for overflow

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Javascript (1 rules)

- **Integer Overflow via Unchecked Arithmetic** [MEDIUM]: Detects user-controlled values flowing into arithmetic operations without
bounds checking. While JavaScript uses 64-bit floats for most numbers,
integer overflow is still a concern in these scenarios:

1. TypedArrays (Uint8Array, Int32Array, etc.) - values wrap on overflow
2. Bitwise operations - convert to 32-bit signed integers
3. Large number arithmetic affecting security decisions
4. Array/Buffer allocation with user-controlled sizes

Common vulnerable patterns:
- Buffer allocation: Buffer.alloc(userSize)
- Array creation: new Array(userLength)
- TypedArray creation: new Uint8Array(userSize)
- Bitwise operations: userValue | 0, userValue >>> 0
  - Remediation: Validate numeric bounds before using user input in allocations:

```javascript
const MAX_SIZE = 1024 * 1024;
const size = parseInt(req.query.size, 10);

if (isNaN(size) || size < 0 || size > MAX_SIZE) {
  return res.status(400).send('Invalid size');
}

const buffer = Buffer.alloc(size);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-190/integer-overflow

### Typescript (1 rules)

- **Integer Overflow via Unchecked Arithmetic** [MEDIUM]: Detects user-controlled values flowing into arithmetic operations without
bounds checking. While JavaScript uses 64-bit floats for most numbers,
integer overflow is still a concern in these scenarios:

1. TypedArrays (Uint8Array, Int32Array, etc.) - values wrap on overflow
2. Bitwise operations - convert to 32-bit signed integers
3. Large number arithmetic affecting security decisions
4. Array/Buffer allocation with user-controlled sizes

Common vulnerable patterns:
- Buffer allocation: Buffer.alloc(userSize)
- Array creation: new Array(userLength)
- TypedArray creation: new Uint8Array(userSize)
- Bitwise operations: userValue | 0, userValue >>> 0
  - Remediation: Validate numeric bounds before using user input in allocations:

```javascript
const MAX_SIZE = 1024 * 1024;
const size = parseInt(req.query.size, 10);

if (isNaN(size) || size < 0 || size > MAX_SIZE) {
  return res.status(400).send('Invalid size');
}

const buffer = Buffer.alloc(size);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-190/integer-overflow