Hacker News Reader

Comment by mcguire | Hacker News Reader

"When sk_rcvbuf gets close to 2^31, adding the size of the packet can cause an integer overflow. And since it’s an int it becomes a negative number, therefore the condition is true when it should be false (for more, also check out this discussion of signed magnitude representation)."

And this is why you don't generally use signed numbers in systems code, unless you specifically need negative numbers. And why you gradually develop a paranoia about the sizes of numbers.

View on HN

I'm not sure how using an unsigned number would help, given that when it overflows you're still going to have some code do unexpected stuff anyway.

For one thing, it's a clue you need to step back and think, "What happens when this overflows?" rather than "Oh, it's just a number."

For another, that's why you get paranoid.

(For a third, I strongly recommend something like Frama-C with the Weakest-Precondition module---it's very good at finding issues like these.)

I'm not convinced that it would have been any more obvious to the person who made the error that the variable could overflow if it were unsigned.

It's also much easier, IMO, to accidentally underflow an unsigned integer; it's so much more common to work with 0 than it is to work with +/- 2 billion.

I'm being pedantic, but technically wrapping from 0 to MAX_INT is still considered overflow. Underflow refers to decimal truncation e.g. by integer division.

well... at least it takes twice as long to overflow.

Signed or unsigned doesn’t matter much both can overflow.

I actually started putting assertion checks about overflow issues almost everywhere but it requires great discipline. I wonder if there is a better solution available.

If you can allow yourself this kind of performance regression, you can compile in GCC or clang with `-fsanitize=signed-integer-overflow`, this will do runtime checks.

What happens when some dumbledork sets it to 2^32+1?

From the blog post:

> (if you try and set it to 2^31 the kernel returns “INVALID ARGUMENT”).

I would expect the same to happen for 2^31+1.

Reply on news.ycombinator.com