YChen289792 (Community Member) asked a question.

April 22, 2022 at 4:53 AM
Hi, I received the following warning: integer Overflow or Wraparound (CWE ID 190). I just simplified the code to something like below. what goes wrong here? j in active[] is definitely smaller than its dimension.
thanks!

#include "stdio.h"

#include "string.h"

 

int main()

{

  static const unsigned int MAX_GNSS_SVID = 146;

  bool active[MAX_NUM];

  for (U32 j = 1; j < MAX_NUM; j++)

  {

   if (active[j] == false) //this is where veracode complains

     continue;

  }

  return 0;

}

  • 3 answers
  • 598 views

  • Kashif, Security Consultant (Veracode inc)

    Hi, @YChen289792 (Community Member)​ 

     

    This may be a valid finding depending on the data type of MAX_NUM

    We see the U32 is unsigned 32 bit and has range that may be lower than the possible range of data type for MAX_NUM

    If you are sure that range of MAX_NUM is within the same limit, then You can raise mitigation by design as the For loop takes care of variable J's limit.

     

    Regards

    Kashif

     

    Expand Post

    • YChen289792 (Community Member)

      Hi, @Kashif, Security Consultant (Veracode inc)​ , thanks for your quick help!

      I forgot to mention that U32 is actually defined as unsigned int so that j and MAX_NUM do have the same data type. What do you mean "You can raise mitigation by design"? More information please!

      Thanks again!

      Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.