[kgeist]

I'm quite paranoid about integer overflows, so in my hobby projects I now have a habit of always using helper functions (which generate an error on overflow) instead of "bare" math operators, and whenever I see a bare math operator without any checks in an open source project (and from what I've seen almost no one checks for overflows) I wonder whether they thought about potential consequences or I'm being too paranoid

[sshine]

My contribution to two open-source projects in recent years has involved a transition to the use of safe arithmetic, too.

I think it makes a lot of sense to think about. Ultimately, it matters more in some applications than in others.

[soiler]

Can you explain this as if I were a programmer who doesn't know what that looks like?

[favorited]

There are different ways to design it, but a simple version could be a function that takes 2 operands and 1 result pointer as inputs, and returns boolean (true if success, false if it overflowed):

    bool SafeAddIntInt(int32_t x, int32_t y, int32_t *r);

so the caller could say

    int32_t result;
    if (SafeAddIntInt(x, y, &result)) {
      // do something with result
    } else {
      // handle overflow
    }

An even simpler version could just abort on over/underflow.

[tsimionescu]

Note that there is no such thing as integer underflow. INT_MIN-1 is an overflow just as much as INT_MAX+1.

Only floats can suffer from underflow, which happens when you want to represent a number whose absolute value is smaller than the floating point precision can allow (e.g. trying to represent 1/2^32 in a 32-bit float).