If you think of the integer as a buffer of size 31, containing an unsigned integer, the attack overflows into a different buffer of size 1, containing a sign bi

If you think of the integer as a buffer of size 31, containing an unsigned integer, the attack overflows into a different buffer of size 1, containing a sign bit for scaling that integer. ;) But yeah, integer overflow and not buffer overflow.