# Integer Overflow

> Integer overflow/underflow bugs: width conversion, mul/add wrap, size calc to alloc/copy, signedness, exploits to heap/stack corruption.

- Skill: `netvar1337/integer-overflow` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/integer-overflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/integer-overflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/integer-overflow

---


# Integer overflow & underflow

## Bug patterns
1. **Add/mul wrap** before `malloc(n * size)` → small alloc, large copy
2. **Truncation** `size_t` → `uint32`/`uint16` on boundary checks
3. **Signed/unsigned mix** — negative length passes `< max` then huge `size_t`
4. **Off-by-one** length including/excluding NUL
5. **Custom saturating math done wrong** (checked add that doesn't)

## Underflow specifics
- `len - hdr` when `len < hdr` → enormous unsigned
- Loop `for (i = n-1; i >= 0; i--)` with unsigned `i`
- Refcount `--` at zero → free-while-live / UAF setup

## From integer to memory corruption
```
bad_size = wrap(count * elem)
p = alloc(bad_size)          # small
copy(src, p, count * elem)   # large → heap overflow
```
Also: index OOB via wrapped index; stack alloc via VLAs/`alloca` with wrapped size.

## Hunting
- CodeQL/semgrep: mul then alloc; unchecked casts
- Diff size checks vs copy lengths
- Fuzz with maxed integers (`0xffffffff`, `1<<31`, `0`)

## Exploit notes
- Prefer stable heap layout after wrap-induced overflow
- Record exact widths (32 vs 64) per build
- On C++ `size_t`/`int` APIs (Win32 `int cb`) watch 2GB boundary

## Pair with
`heap-overflow`, `heap-exploitation`, `stack-buffer-overflow`, `c-review`.