CWE-190: Integer Overflow or Wraparound

Description:
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.

Affected languages: Not Language-Specific, C
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-682, CWE-682, CWE-20

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Modify Memory
  - Confidentiality: Execute Unauthorized Code or Commands
  - Availability: Alter Execution Logic
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Automated Static Analysis: This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.
  - Black Box: Sometimes, evidence of this weakness can be detected using dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing),
  - Manual Analysis: This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and m
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Mitigations:
  - [Requirements] Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
  - [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   If possible, choose a language or compiler that performs automatic bounds checking.
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. 
                   Use libraries or frameworks that make it easier to handle numbers without unexpected consequences. 
                   Examples 
  - [Implementation] Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range. 
                   Use unsigned integers where possible. This makes it easier to perform validation for inte

Demonstrative examples:
The following image processing code allocates a table for images.
This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119).
img_t table_ptr; /*struct containing img data, 10kB each*/ int num_imgs; ... num_imgs = get_num_imgs(); table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs); ...

The following code excerpt from OpenSSH 3.3 demonstrates a classic case of integer overflow:
If nresp has the value[PII_REDACTED] and sizeof(char*) has its typical value of 4, then the result of the operation nresp*sizeof(char*) overflows, and the argument to xmalloc() will be 0. Most malloc() implementations will happily allocate a 0-byte buffer, causing the subsequent loop iterations to overflow the heap buffer response.
nresp = packet_get_int(); if (nresp > 0) { response = xmalloc(nresp*sizeof(char*)); for (i = 0; i < nresp; i++) response[i] = packet_get_string(NULL); }

Real-world examples:
  - CVE-2025-46687: Chain: Javascript engine code does not perform a length check (CWE-1284) leading to integer overflow (CWE-190) causing allocation of smaller buffer than expected (CWE-131) resulting in a heap-based bu
  - CVE-2025-27363: Font rendering library does not properly
               handle assigning a signed short value to an unsigned
               long (CWE-195), leading to an integer wraparound
               (CWE-190), c
  - CVE-2021-43537: Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cau
  - CVE-2019-19911: Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow
  - CVE-2022-0545: Chain: 3D renderer has an integer overflow (CWE-190) leading to write-what-where condition (CWE-123) using a crafted image.