Simple method to detect int overflow

Question

To detect int overflow/underflow in C, I use this code. What might be a simpler and more portable way of coding this (that is, fewer conditions)?

Assume 2's complement and don't use wider integers.

int a,b,sum;
sum = a + b;
// out-of-range only possible when the signs are the same.
if ((a < 0) == (b < 0)) {
  if (a < 0) {
    // Underflow here means the result is excessively negative.
    if (sum > b) UnderflowDetected();
  }
  else {
    if (sum < b) OverflowDetected();  
  }

Answer 1

It's not possible to avoid undefined behaviour by testing for it after the fact! If the addition overflows then there is already undefined behaviour here:

sum = a + b;

so attempting to test afterwards is too late. You have to test for possible overflow before you do a signed addition. (If you're puzzled by this, read Dietz et al. (2012), "Understanding Integer Overflow in C/C++". Or even you're not puzzled: it's an excellent paper!)

If it were me, I'd do something like this:

#include <limits.h>

int safe_add(int a, int b) {
    if (a > 0 && b > INT_MAX - a) {
        /* handle overflow here */
    } else if (a < 0 && b < INT_MIN - a) {
        /* handle underflow here */
    }
    return a + b;
}

but I'm not entirely sure what the point of having separate cases for overflow and underflow is.

I also use Clang's -fsanitize=undefined when building for test.

Update (2023) Several modern compilers now have built-in functions for arithmetic with overflow checking. For example, using GCC's __builtin_add_overflow, we could implement safe_add like this:

int safe_add(int a, int b) {
    int sum;
    if (__builtin_add_overflow(a, b, &sum)) {
        /* handle overflow or underflow here */
    } else {
        return sum;
    }
}

Answer 2

Simpler method to detect int overflow...

The two simplest methods I know are:

• Use the SafeInt library in C++
• Use the safe_iop library in C

SafeInt was written by David LeBlanc, and Microsoft uses it. safe_iop was written by ???, and Android uses it.

---

The next simplest method is to use a compiler intrinsic. Unfortunately, I have not seen many of them. I believe I saw some for GCC recently.

The neat thing about intrinsics are (1) they provide a familiar C function call and (2) they are not bound by the Undefined Behavior you are trying to avoid. That means an instrinsic can perform the addition and the program will still be well defined, even it it overflows.

(In C/C++, if you perform the addition and it overflows, then the program is illegal. You are not allowed to perform the operation and then check the result).

---

The next simplest method is assembly and inline assembly. Again, its not bound by the Undefined Behavior you are trying to avoid in C/C++.

Assembly and inline assembly routines are the method I use. I work on mobile platforms and I have a library for i686, x86_64, ARM and MIPS.

I learned a long time ago its a pain in the butt to try and do this cross-platform in a well defined, portable and efficient manner from C, especially for some operations.

I was constantly checking results of compilations and starring at disassembled code to make sure the code generation was good. So I abandoned portable in the name of simplicity and efficiency.

---

Also see How to detect integer overflow in C/C++? on Stack Overflow.

Answer 3

Why not use a long to hold the result of the calculation? Then the long can be checked against the (int) MAX and MIN values to see if overflow or underflow occurred? If no violations have occurred, then the result can safely be re-cast back to an (int).

Or, is this too simple and I'm missing something very fundamental? One thing that I HAVE omitted is the possibility that the long will also overflow.

Answer 4

Overflow and underflow can happen in two cases : either

1. Both negative numbers and sum becomes positive or
2. Both positive numbers and sum becomes negative.

Then you can use this logical expression:

     ((a<0)&&(b<0)&&(a+b>0)) || ((a>0)&&(b>0)&&(a+b<0))

or if you prefer integer arithmetics to logical expressions:

     (a<0)*(b<0)*(a+b>0) + (a>0)*(b>0)*(a+b<0)

In two complements one can be pedantic and just pick out the sign bit to do operations on, or even in hardware.