# Integer Overflow

> Integer Overflow Testing for Web Applications

- Skill: `abelrguezr/integer-overflow` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/integer-overflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/integer-overflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/abelrguezr/integer-overflow

---


# Integer Overflow Testing for Web Applications

This skill helps you identify and exploit integer overflow/truncation vulnerabilities in web applications. Even in memory-safe languages, underlying runtimes and libraries often use C/C++ where 32-bit or 64-bit wrap-around can transform harmless parameters into out-of-bounds reads/writes, logic bypasses, or DoS conditions.

## When to Use This Skill

Use this skill when:
- Testing numeric request parameters (`id`, `offset`, `count`, `limit`)
- Auditing length/size headers (`Content-Length`, WebSocket frame length, HTTP/2 continuation_len)
- Reviewing file format parsers (image dimensions, chunk sizes, font tables)
- Checking business logic calculations (prices, coupons, balances, pagination)
- Analyzing code with signed↔unsigned casts or type conversions
- Security testing any application that performs arithmetic on user-controlled input

## Attack Surface Overview

1. **Numeric request parameters** - Classic `id`, `offset`, `count` fields in GET/POST
2. **Length/size headers** - `Content-Length`, WebSocket frame length, HTTP/2 fields
3. **File-format metadata** - Image dimensions, chunk sizes, font tables parsed server-side or client-side
4. **Language-level conversions** - Signed↔unsigned casts in PHP/Go/Rust FFI, JS `Number` → `int32` truncations in V8
5. **Authentication & business logic** - Coupon values, prices, balance calculations that silently overflow

## Testing Strategy

### Step 1: Identify Integer Inputs

Look for these patterns in requests and code:

```http
GET /api/items?id=123&offset=0&count=50 HTTP/1.1
Content-Length: 256
X-Custom-Size: 1024
```

```php
$price = (int)$_POST['price'];
$total = $price * 100;
```

```javascript
const buffer = new ArrayBuffer(size * 4); // size from user input
```

### Step 2: Send Boundary Values

Use the boundary value cheat-sheet. Send these extreme signed/unsigned values wherever an integer is expected:

**Critical boundaries:**
- `-1, 0, 1`
- `127, 128, 255, 256` (8-bit boundaries)
- `32767, 32768, 65535, 65536` (16-bit boundaries)
- `2147483647, 2147483648, 4294967295` (32-bit boundaries)
- `9223372036854775807, 9223372036854775808` (64-bit boundaries)
- `0x7fffffff, 0x80000000, 0xffffffff` (hex representations)

**Additional formats to try:**
- Hex: `0x100`, `0x7fffffff`
- Octal: `0377`
- Scientific notation: `1e10`, `9.99e18`
- JSON big-int: `9999999999999999999`
- Very long digit strings (>1kB) to hit custom parsers

### Step 3: Use Automated Testing

**Burp Intruder template:**
```
§INTEGER§
Payload type: Numbers
From: -10 To: 4294967300 Step: 1
Pad to length: 10, Enable hex prefix 0x
```

**Fuzzing tools:**
- **AFL++/Honggfuzz** with `libFuzzer` harness around parsers (WebP, PNG, protobuf)
- **Fuzzilli** - Grammar-aware fuzzing of JavaScript engines for V8/JSC integer truncations
- **boofuzz** - Network-protocol fuzzing (WebSocket, HTTP/2) focusing on length fields

### Step 4: Analyze Responses

Watch for these indicators of integer overflow:

| Indicator | What it means |
|-----------|---------------|
| Crash / 500 error | Buffer overflow or invalid memory access |
| Unexpected success | Logic bypass (negative value wrapped to positive) |
| Slow response / timeout | Memory exhaustion or DoS |
| Different response size | Truncation changed buffer allocation |
| Data corruption | Out-of-bounds read/write |

## Exploitation Patterns

### Pattern 1: Logic Bypass in Server-Side Code

**Vulnerable PHP example:**
```php
$price = (int)$_POST['price'];          // expecting cents (0-10000)
$total = $price * 100;                  // ← 32-bit overflow possible
if($total > 1000000){
    die('Too expensive');
}
// Sending price=21474850 → $total wraps to -2147483648 and check is bypassed
```

**Test:** Send `price=21474850` and verify the expensive check is bypassed.

### Pattern 2: Heap Overflow via Image Decoder

**Real-world example (CVE-2023-4863):**
The WebP lossless decoder multiplied `width × height × 4` (RGBA) inside a 32-bit `int`. A crafted file with dimensions `16384 × 16384` overflows the multiplication, allocates a short buffer, and writes ~1GB of decompressed data past the heap.

**Test:** Create images with extreme dimensions and observe allocation behavior.

### Pattern 3: Browser-Based XSS/RCE Chain

1. Integer overflow in V8 gives arbitrary read/write
2. Escape the sandbox with a second bug or call native APIs
3. Inject malicious script into origin context → stored XSS

## Defensive Guidelines

When reviewing code or recommending fixes:

1. **Use wide types or checked math**
   - `size_t` instead of `int` for sizes
   - Rust: `checked_add`, `checked_mul`
   - Go: `math/bits.Add64`, `math/bits.Mul64`

2. **Validate ranges early**
   - Reject any value outside business domain before arithmetic
   - Example: `if ($price < 0 || $price > 10000) die('Invalid price');`

3. **Enable compiler sanitizers**
   - `-fsanitize=integer` (Clang/GCC)
   - UBSan (UndefinedBehaviorSanitizer)
   - Go race detector

4. **Adopt fuzzing in CI/CD**
   - Combine coverage feedback with boundary corpora
   - Test parsers with extreme values automatically

5. **Stay patched**
   - Browser integer overflow bugs are frequently weaponized within weeks
   - Monitor CVE databases for relevant vulnerabilities

## Recent Real-World Vulnerabilities

| Year | Component | Root Cause | Impact |
|------|-----------|------------|--------|
| 2023 | libwebp (CVE-2023-4863) | 32-bit multiplication overflow in decoded pixel size | Chrome 0-day RCE (BLASTPASS on iOS) |
| 2024 | V8 (CVE-2024-0519) | Truncation to 32-bit when growing JSArray | Remote code execution after single visit |
| 2025 | Apollo GraphQL Server | 32-bit signed int for pagination args; negative wraps to huge positive | Logic bypass & memory exhaustion (DoS) |

## Quick Reference

**Most common overflow points:**
- `width * height * bytes_per_pixel`
- `count * element_size`
- `offset + length`
- `price * quantity`
- `first/last` pagination arguments

**Quick test command:**
```bash
# Test with boundary values
curl -X POST http://target/api/checkout \
  -d "price=2147483648&quantity=1"

curl -X GET "http://target/api/items?offset=-1&count=4294967295"
```

## References

- [NVD CVE-2023-4863 – libwebp Heap Buffer Overflow](https://nvd.nist.gov/vuln/detail/CVE-2023-4863)
- [Google Project Zero – Understanding V8 CVE-2024-0519](https://googleprojectzero.github.io/)
- [HackTricks – Integer Overflow and Underflow](https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/integer-overflow)