28

There's (1):

// assume x,y are non-negative
if(x > max - y) error;

And (2):

// assume x,y are non-negative
int sum = x + y;
if(sum < x || sum < y) error;

Whichs is preferred or is there a better way.

4
  • 1
    Actually the duplicate is not a duplicate at all, it is talking about unsigned that have well-defined wraparound semantics, whereas overflowing a signed integer is undefined behaviour in C. Mar 16, 2015 at 15:33
  • 2
    There is no need to check both sum < x and sum < y. Oct 7, 2015 at 13:43
  • This was previously closed as a duplicate of How to detect integer overflow?, but that's about unsigned where wrapping is well-defined behaviour. signed int is harder because you can't just add and then check if it overflowed, that would already be UB and thus compilers can assume there was no overflow! Feb 4, 2019 at 6:00
  • Possible duplicate of How do I detect unsigned integer multiply overflow?
    – GSerg
    May 7, 2019 at 15:42

3 Answers 3

63

Integer overflow is the canonical example of "undefined behaviour" in C (noting that operations on unsigned integers never overflow, they are defined to wrap-around instead). This means that once you've executed x + y, if it overflowed, you're already hosed. It's too late to do any checking - your program could have crashed already. Think of it like checking for division by zero - if you wait until after the division has been executed to check, it's already too late.

So this implies that method (1) is the only correct way to do it. For max, you can use INT_MAX from <limits.h>.

If x and/or y can be negative, then things are harder - you need to do the test in such a way that the test itself can't cause overflow.

if ((y > 0 && x > INT_MAX - y) ||
    (y < 0 && x < INT_MIN - y))
{
    /* Oh no, overflow */
}
else
{
    sum = x + y;
}
8
  • Btw, can you comment on the performance of this solution compared to other alternative solutions?
    – Pacerier
    Sep 22, 2013 at 18:10
  • 8
    It makes little sense to compare the performance against an incorrect solution. What other correct solution did you have in mind?
    – caf
    Sep 23, 2013 at 1:04
  • 2
    the other usual way seem to be casting to a wider type. I'm not sure of a third alternative but there are surely more.
    – Pacerier
    Sep 24, 2013 at 4:12
  • @Pacerier Casting to a wider type is not possible if you're already working with the largest type on the platform. Mar 3, 2017 at 22:29
  • 1
    @Tuntable: What every single compiler does is optimizations which can lead to horror: blog.llvm.org/2011/05/…
    – ilstam
    Jun 7, 2019 at 0:20
5

You can really only check for overflow with unsigned integers and arithmatic:

unsigned a,b,c;
a = b + c;
if (a < b) {
    /* overflow */
}

The behavior of overflow with signed integers is undefined in C, but on most machines you can use

int a,b,c;
a = b + c;
if (c < 0 ? a > b : a < b) {
    /* overflow */
}

This may require compile-time flags to get the compiler to enforce wrapping semantics, and won't work on machines that use any kind of saturating or trapping arithmetic

3
  • 9
    Checking for overflow after the fact with signed integers isn't correct. It's undefined behaviour, so compilers will happily optimize out the checks without passing a switch like -fwrapv to enable signed wrapping as a language extension. It's not just a portability issue across architectures.
    – strcat
    Sep 8, 2015 at 21:24
  • 1
    Overflow for signed integers can also be checked. See securecoding.cert.org/confluence/display/c/…
    – sbhatla
    Nov 30, 2016 at 15:28
  • 2
    Nope, modern gcc breaks your signed int example. Signed integer not overflowing on ARM64?. Feb 4, 2019 at 5:59
-6

You only have to check one of them. If x + y overflows, it will be less than both x and y. Hence:

int sum = x + y;
if (sum < x) error;

should be sufficient.

The following site has a bunch of stuff about integer overflow:

http://www.fefe.de/intof.html

If you want to handle negative numbers, it can be expanded:

int sum = x + y;
if (y >= 0) {
   if (sum < x) error;
} else {
   if (sum > x) error;
}
4
  • 1
    The original poster specified non-negative integers, but I've added code to handle negative numbers.
    – clahey
    Apr 13, 2010 at 22:40
  • 21
    This isn't correct - once x + y has overflowed, the program has undefined behaviour. You have to check before you actually execute the overflowing operation - just as you do for integer division by zero.
    – caf
    Apr 13, 2010 at 23:28
  • If anything is more wrong than this answer, then possibly the page it links to. Mar 16, 2015 at 15:28
  • This is correct for unsigned though, and I think it's really good for that case. Sep 22, 2015 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.