JBaskota102211 (Community Member) asked a question.
Please help me fix the Integer overflow issue for the following code, Veracode flags the lines in bold.
BITMAPINFOHEADER bi;
bi.biSize = sizeof (BITMAPINFOHEADER);
// Check for potential overflow before addition
DWORD paletteSize = static_cast<DWORD> (PaletteSize (&bi)); // here PaletteSize returns a WORD
if (bi.biSize > (std::numeric_limits<DWORD>::max () - paletteSize))
{
return NULL;
}
DWORD dwLen = bi.biSize + paletteSize; //Veracode flags this line even though I have overflow check in place.
.png){kind=logo}
Hi @JBaskota102211 (Community Member)
The reason Veracode still flags that line is that it doesn't recognize your manual check as a valid mitigation for the DWORD + DWORD addition. The easiest fix is to use a safe-integer API that Veracode knows about.
On Windows, IntSafe.h works great:
#include <intsafe.h>
DWORD paletteSize = static_cast<DWORD>(PaletteSize(&bi));
DWORD dwLen = 0;
if (FAILED(DWordAdd(bi.biSize, paletteSize, &dwLen)))
{
return NULL;
}
// dwLen is safe to use here
If you'd rather keep the manual check, wrap numeric_limits::max in parentheses so the Windows max macro doesn't interfere, and compare against a local constant:
const DWORD headerSize = static_cast<DWORD>(sizeof(BITMAPINFOHEADER));
DWORD paletteSize = static_cast<DWORD>(PaletteSize(&bi));
if (paletteSize > (std::numeric_limits<DWORD>::max)() - headerSize)
{
return NULL;
}
DWORD dwLen = headerSize + paletteSize;
Hope that helps!