2 ms·
Several comments in this thread take the POV that "integer overflows never happen in practice" but of course they do! https://cve.mitre.org/cgi-bin/cvekey.cgi?k
by ridiculous_fish 5y ago
Several comments in this thread take the POV that "integer overflows never happen in practice" but of course they do! https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=integer+overflow https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=integer+ove...
Of course uints overflow too, which just means arithmetic is hard, and it's often (not always) made harder when you have to consider negative values. Bounds checking, average, division, etc. INT_MIN is a horrible edge case which is easy to forget.
- jcelerier 5y agoI opened one at random and it's an uint overflow lol. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10879 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1087...
- ridiculous_fish 5y agoThe patch is completely bogus: https://github.com/teeworlds/teeworlds/commit/4d529dcd2d01022e979ebfa0b91167dee37cdb8e https://github.com/teeworlds/teeworlds/commit/4d529dcd2d0102... Here it tries to avoid overflow by assigning the result of 32 bit arithmetic to a 64 bit type. That's a common mistake.