Integer overflow, truncation, and allocation arithmetic

Mechanism

An arithmetic bug can make the number of bytes allocated differ from the number subsequently accessed. Common boundaries include signed-to-unsigned conversion, multiplication wraparound, truncation to a smaller type, and comparisons performed before conversion. C signed overflow is undefined behavior, so a source-level wraparound model may not match optimized machine code.

Practical method

Trace the types through parsing, validation, allocation, and copying. Test zero, one, maximum valid values, and neighbors of powers of two. Compute expected sizes using unbounded arithmetic in a separate script, then compare the compiled instruction widths. Distinguish an invalid huge request from a successful unexpectedly small allocation.

if (count > SIZE_MAX / sizeof(*items)) return ERROR;
size_t bytes = count * sizeof(*items);

Interpreting evidence

The key evidence is a concrete input for which validation succeeds while allocation and access sizes diverge. Record each intermediate type and value; a final crash alone obscures the conversion responsible.

Pitfalls and limits

An overflow sanitizer changes the execution environment and may expose only some paths. Negative inputs parsed into unsigned values behave differently from overflow. A bounds check can itself overflow.