Preventing C integer overflow

Question

I have some code in a function which will change/update values with the increment/decrement operator. For example:

static void update_value(char op)
{
    if (op == '+')
        value++;    // uint32_t global value
    else
        value--;
}

The function does not check whether we've gone over/under max/min values. So the caller can call it 20 times when value is say 16. resulting in 2^32 - 1 - 4.

I'd like to guard against that but I would like to use standard library constants. I remember there was a size_t (or similar) variable that would represent the largest number that a uint32_t can hold.

I can't remember the exact constants nor the header where they were defined. Any help?

"the largest number that a uint32_t can hold" - `~(uint32_t)0` — chill, Nov 30 '12 at 14:11
@chill: This works only for some systems. The portable solution is using the limits defined in the limits includes. — datenwolf, Nov 30 '12 at 14:15
A portable value is also `-1`, but using the macro (or the C++ trait) is more readable, since it makes your *intention* obvious. — Kerrek SB, Nov 30 '12 at 14:19
The maximum value that uint32_t can hold is always 4,29 billion (2^32), or more easily written: 0xFFFFFFFF. Simply hardcode it, 32 bits will always be 32 bits. — Lundin, Nov 30 '12 at 14:27
...although using the UINT32_MAX constant in stdint.h is more elegant. — Lundin, Nov 30 '12 at 14:31
In fact the C99 standard explicitly says "If the promoted type is an unsigned type, the expression `~E` is equivalent to the maximum value representable in that type minus `E`. [6.5.3.3 Unary arithmetic operators #4]" — chill, Nov 30 '12 at 14:43
My bad I was thinking about signed types (in the case of signed type you've to consider 1-complement vs. 2-complement), not unsigned. — datenwolf, Nov 30 '12 at 14:46
BTW you should also protect against underflow. See http://stackoverflow.com/questions/2760502/question-about-c-behaviour-for-unsigned-integer-underflow — Peter M, Nov 30 '12 at 15:21

score 14 · Answer 1 · edited May 23 '17 at 11:53

14

In C the header file you want is <stdint.h> and the constant is UINT32_MAX

static void update_value(char op)
{
    if (op == '+')
        if ( value < (UINT32_MAX - 1))
            value++;    // uint32_t global value
        else
            printf("too big!\n");
    else
       if (value > 0)
           value--;
       else
           printf("too small!\n");
}

For C++ you can use any number of solutions found here: What's the C++ equivalent of UINT32_MAX?

edited May 23 '17 at 11:53

Community

1
1

answered Nov 30 '12 at 14:12

Mike

47,263
29
113
177

+1, the only correct answer posted. – Lundin Nov 30 '12 at 14:29
You should also protect against underflow. See http://stackoverflow.com/questions/2760502/question-about-c-behaviour-for-unsigned-integer-underflow – Peter M Nov 30 '12 at 15:16

Kuba hasn't forgotten Monica · Accepted Answer · 2020-07-13T18:16:43.983

I've found that the most general solution is to check if the incremented value is in fact greater than the previous value, or if the decremented value is smaller than the previous value. This works only if the value is unsigned, independently of the size of the variable, and is pretty much as portable as C code ever gets.

static void update_value(char op)
{
  if (op == '+') {
    if (value + 1 > value) value ++;
  } else {
    if (value - 1 < value) value --;
  }
}

Note that the code may happen to work with signed values, but per the C standard this would be undefined behavior, and the compilers are free to replace if (value + 1 > value) ... with if (1) .... You should not use this code with signed values unless you have a process in place to audit the generated object code after it has been linked.

With gcc and clang, you'd need to add -fwrapv option to let this code work for signed values; with other compilers your mileage may vary.

A sane way of doing this is to be type-specific and use constants from limits.h. For example:

#include "limits.h"

static void update_int(char op, int *value)
{
  int val = *value; // ignoring NULL pointer dereference

  if (op == '+') {
    if (val != INT_MAX) *value = val + 1;
  } else {
    if (val != INT_MIN) *value = val - 1;
  }
}

static void update_int(char op, unsigned int *value)
{
  unsigned int val = *value; // ignoring NULL pointer dereference

  if (op == '+') {
    if (val != UINT_MAX) *value = val + 1;
  } else {
    if (val != UINT_MIN) *value = val - 1;
  }
}

hinafu · Answer 3 · 2012-11-30T14:41:13.057

4

Maybe you are looking for <limits>: http://www.cplusplus.com/reference/limits/numeric_limits/

You can do something like this to get what you want:

unsigned int n = numeric_limits<unsigned int>::max()

You also have this <cstdint>: http://www.cplusplus.com/reference/cstdint/

UINTN_MAX: Maximum value of exact-width unsigned type (Exactly 2^N-1)

edited Nov 30 '12 at 14:41

answered Nov 30 '12 at 14:10

hinafu

689
2
5
13

it is quite ironic that the type of `n` (`int`) triggers an overflow ;) – Matthieu M. Nov 30 '12 at 14:29
How is this relevant for uint32_t? – Lundin Nov 30 '12 at 14:32

score 2 · Answer 4 · answered Nov 30 '12 at 14:10

2

If you're using C, you're looking for limits.h. The macro you want is UINT_MAX.

If you're in the C++ world, you want std::numeric_limits<uint32_t>::max().

answered Nov 30 '12 at 14:10

Dan

12,409
3
50
87

That's a `uint32_t`, not `int`. – kennytm Nov 30 '12 at 14:10
Indeed, UINT_MAX has no relevance for uint32_t. – Lundin Nov 30 '12 at 14:28

Sergey L. · Answer 5 · 2012-11-30T15:02:53.027

2

Check #include <stdint.h> and http://en.wikipedia.org/wiki/C_data_types#Fixed_width_integer_types

What you are looking for are UINT32_MAX.

edited Nov 30 '12 at 15:02

answered Nov 30 '12 at 14:12

Sergey L.

21,822
5
49
75

UINT32_MAX is not located in limits.h. – Lundin Nov 30 '12 at 14:30
@Lundin sorry, it is in `stdint.h` – Sergey L. Nov 30 '12 at 15:02

score 0 · Answer 6 · answered Nov 30 '12 at 16:33

static void update_value(char op)
{
    if (op == '+')
        if (value == UINT_MAX)
            printf("Maximum value achieved.\n");
        else
            value ++;
    else
       if (value == 0)
           printf("Minimum value achieved.\n");
       else
           value --;
}

UINT_MAX, for this constant you have to include limits.h

score -1 · Answer 7 · answered Nov 30 '12 at 14:12

-1

You need limits.h (INT_MIN and INT_MAX) : more info here : http://www.cplusplus.com/reference/climits/

answered Nov 30 '12 at 14:12

Joze

1,285
4
19
33

How is this relevant for uint32_t? – Lundin Nov 30 '12 at 14:32

Preventing C integer overflow

7 Answers7