Integer Overflow
Basic Information
At the heart of an integer overflow is the limitation imposed by the size of data types in computer programming and the interpretation of the data.
For example, an 8-bit unsigned integer can represent values from 0 to 255. If you attempt to store the value 256 in an 8-bit unsigned integer, it wraps around to 0 due to the limitation of its storage capacity. Similarly, for a 16-bit unsigned integer, which can hold values from 0 to 65,535, adding 1 to 65,535 will wrap the value back to 0.
Moreover, an 8-bit signed integer can represent values from -128 to 127. This is because one bit is used to represent the sign (positive or negative), leaving 7 bits to represent the magnitude. The most negative number is represented as -128 (binary 10000000
), and the most positive number is 127 (binary 01111111
).
Max values
For potential web vulnerabilities it's very interesting to know the maximum supported values:
Examples
Pure overflow
The printed result will be 0 as we overflowed the char:
Signed to Unsigned Conversion
Consider a situation where a signed integer is read from user input and then used in a context that treats it as an unsigned integer, without proper validation:
In this example, if a user inputs a negative number, it will be interpreted as a large unsigned integer due to the way binary values are interpreted, potentially leading to unexpected behavior.
Other Examples
https://guyinatuxedo.github.io/35-integer_exploitation/int_overflow_post/index.html
Only 1B is used to store the size of the password so it's possible to overflow it and make it think it's length of 4 while it actually is 260 to bypass the length check protection
https://guyinatuxedo.github.io/35-integer_exploitation/puzzle/index.html
Given a couple of numbers find out using z3 a new number that multiplied by the first one will give the second one:
Only 1B is used to store the size of the password so it's possible to overflow it and make it think it's length of 4 while it actually is 260 to bypass the length check protection and overwrite in the stack the next local variable and bypass both protections
ARM64
This doesn't change in ARM64 as you can see in this blog post.
Last updated