Mitigating Integer Overflow in C

Why Integer Overflows Persist

Kees Cook of the Linux kernel self-protection project argues integer overflows remain a root cause of vulnerabilities despite mitigations like control-flow integrity that only catch downstream effects. CVE analysis shows hundreds of medium-and-higher kernel overflow issues over the past decade with little meaningful reduction.

C Semantics and Compiler Traps

Unsigned overflow must wrap per the C standard, while signed overflow is undefined behavior that modern optimizers exploit, eliminating checks like "if (value + offset < value)". The kernel adopted -fno-strict-overflow to force predictable wraparound, but that disables signed-integer-overflow sanitizers that only fire on undefined cases.

Sanitizer Paradox

Clang and GCC offer signed and unsigned overflow sanitizers with warn or trap modes. Cook highlights the absurdity: -fno-strict-overflow makes signed overflow defined, silencing UBSan, while the unsigned sanitizer reports wraps that are legal behavior. Kernel developers need instrumentation regardless of standard semantics.

Path Forward

The talk surveys saturation strategies such as refcount_t, trapping on unexpected overflow, and ongoing efforts to make overflow detection workable alongside kernel build flags. Cook calls for treating arithmetic bounds as a first-class hardening problem rather than relying solely on memory-safe languages elsewhere.