Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer)
Description
Compiler-enforced runtime detection of integer overflow and unsafe numeric type conversions. Encompasses: (1) GCC/Clang -ftrapv — traps on signed integer overflow at ~2-5% overhead, suitable for production; (2) UBSan integer sanitizers (-fsanitize=signed-integer-overflow, -fsanitize=unsigned-integer-overflow, -fsanitize=implicit-conversion) — detect signed/unsigned overflow and implicit narrowing/sign-change conversions at runtime with configurable abort or logging; (3) MSVC /RTCc — detects data loss from runtime type conversions. When enabled, integer conversion errors that would silently produce incorrect values instead terminate the process, converting potential code execution vulnerabilities into denial-of-service conditions (a less severe outcome). Particularly effective against the dominant CWE-681 attack pattern where a negative signed value converted to unsigned becomes an enormous positive value that bypasses bounds checks and corrupts memory. Complements CME-116 (FORTIFY_SOURCE) which catches the buffer overflow consequence of integer conversion errors, while this control catches the conversion error itself at the point of occurrence.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Integer conversion errors (signed-to-unsigned confusion, implicit narrowing, overflow wrapping) are detected at the point of occurrence and the process is terminated before the corrupted value reaches memory operations; the attacker must find a conversion path in code that is not instrumented by the sanitizer or reach the vulnerable operation through an alternative call chain that bypasses the compiler-inserted checks |
CWE Relationships
Verification
Check that system packages are compiled with -ftrapv or UBSan integer sanitizers, or that binaries contain UBSan runtime symbols indicating instrumented integer operations
# Expected: -ftrapv or -fsanitize flag present in system build flags
# Expected: non-zero count indicates UBSan-instrumented integer operations
# Expected: non-zero count indicates UBSan integer overflow handlers present
# Expected: /RTCc flag present in Visual Studio build configuration