Techniques for static code analysis in detecting integer overflows

Question

I'm trying to find some effective techniques which I can base my integer-overflow detection tool on. I know there are many ready-made detection tools out there, but I'm trying to implement a simple one on my own, both for my personal interest in this area and also for my knowledge.

I know techniques like Pattern Matching and Type Inference, but I read that more complicated code analysis techniques are required to detect the int overflows. There's also the Taint Analysis which can "flag" un-trusted sources of data.

Is there some other technique, which I might not be aware of, which is capable of detecting integer overflows?

Answer 1

It may be worth to try with cppcheck static analysis tool, that claims to detect signed integer overflow as of version 1.67:

New checks:
- Detect shift by too many bits, signed integer overflow and dangerous sign conversion

Notice that it supports both C and C++ languages.

There is no overflow check for unsigned integers, as by Standard unsigned types never overflow.

Here is some basic example:

#include <stdio.h>

int main(void)
{
    int a = 2147483647;
    a = a + 1;

    printf("%d\n", a);

    return 0;
}

With such code it gets:

$ ./cppcheck --platform=unix64 simple.c 
Checking simple.c...
[simple.c:6]: (error) Signed integer overflow for expression 'a+1'

However I wouldn't expect too much from it (at least with current version), as slighly different program:

int a = 2147483647;
a++;

passes without noticing overflow.