GSilva849776 (Community Member) asked a question.
190 - Integer Overflow or Wraparound . Good morning, I spent a long time trying to fix this code unsuccessfully.
long timeout;
if ((timeout = 60 * atoi(argv[1])) == 0 ) { <===== here is the problem
I tried to fix it with:
if (( labs((long)(60*atoi(argv[1])))) > LONG_MAX ) {
// some error
} else {
timeout = 60 * atoi(argv[1]);
}
but it is not working,
could you help me with this please?
.png){kind=logo}
Hi @GSilva849776 (Community Member) ,
In this code, if the expression would overflow, then it would wrap around and be a negative value, i.e. `(( labs((long)(60*atoi(argv[1])))) > LONG_MAX )` would be false.
I would recommend changing the check slightly. Say if you have something like this:
if (x+y > MAX_INT) { // some error } else { int result = x + y; }
Here, the same problem would occur.
Instead, a check like that would prevent it as no overflow would occur in the check itself anymore:
if (MAX_INT - X >= Y) { int result = x + y;} else { // some error }
Please note that you may have to propose a mitigation for this as Static Analysis might not be able to detect this automatically. For more information on how to do this, please refer to: https://docs.veracode.com/r/improve_mitigation .
Thank you,
Florian Walter