Integer Overflow.

Integer overflows occur when computations exceed the maximum (or minimum) value an integer type can hold, causing wraparound, sign flips, or truncation. They become security issues when the wrong value is later used as a buffer size, loop counter, array index, or authorization check — frequently producing buffer overflows, infinite loops, or bypassed limits.

The classic pattern. A common sink is malloc(count * size): if count * size wraps past SIZE_MAX, the allocator returns a buffer far smaller than the code assumes, and the subsequent copy writes past the end — an overflow driven by a multiplication, not a bad memcpy length. Android's 2015 Stagefright family (CVE-2015-1538) exploited exactly this: an integer overflow in the stsc metadata atom of an MP4 file caused a short heap allocation, letting a single MMS message achieve remote code execution across an estimated 950 million devices. The 2002 OpenSSH challenge-response flaw (CVE-2002-0639) and many image-codec and font-parser bugs follow the same shape. Signed-to-unsigned conversions are a related trap: a negative length interpreted as a huge unsigned value defeats a naive if (len > max) check.

Defences include checked arithmetic (Rust checked_add/checked_mul, C23 ckd_*, compiler -ftrapv and UBSan), computing in a wider type then range-checking before narrowing, choosing types that match the domain, validating attacker-controlled sizes before allocation, and aggressive fuzzing of parsers.

flowchart TD
  A[Attacker-controlled<br/>count and size] --> B[size = count * elem]
  B --> C{Product exceeds<br/>type max?}
  C -->|No| D[Correct allocation]
  C -->|Yes| E[Value wraps to<br/>small number]
  E --> F[Undersized buffer allocated]
  F --> G[Copy writes past end<br/>heap corruption / RCE]