Question

Please explain why these are overflows. Also I do not understand how they got these numbers please show on paper how with good detail I am confused on these

1. int i; 2. unsigned int j; 3. ? = INT MAX ; // 2 , 147 , 483 , 647 5. printf("i - Sd\n", i); i--2,147,483,648 6. j- UINT MAX; // 4,294,967,295; 0

Answer 1

1. int i; 2. unsiqned int Here "i" is a variable of type signed integer, signed integer can hold both positive and negative values. The max positive value it can hold as as "2, 147,483,643". and the min negative value it can hold as "-2,147,483,648". In below they assigned the max positive value to the variable"" 3. İ = INT MAX; // 2 , 147 , 483 , 647 Now they are incrementing one the value of variable "i". And as "i" already holding the max positive value"2,147,483,647" so no further increment can be happened. so the value of i would be reversed For an integer type variable 2,147,483,648 (Min Value) 2,147,483,648 (Max Value) In the following line the min negative value would be printed 5. printf (''i- %d\n" , i) ; i-2, 147 , 483 , 648 Here "J" is a variable of type unsigned integer and unsigned integer variable can hold only positive values. Tha max positive value it can hold as "4,294,967,295", and the min positive value it can hold as "O". In below they assigned the max positive value to the variable "J" 6. j - UINT MAX; // 4,294,967,295; Now they are incrementing one the valus of variable "j" and as "j" already holding the max value so no further increment can be happened. So the value of "J" would be reversed For an unsigned integer variable 4,294,967,295 (Max Value) (Min Value) In the following line Zero would be printed

void getComment (unsigned int len, char *src) i unsiqned int size; The variable len contains "1" as passed from below function. And here we are decrementing the value of "len" by two and assigning it to the unsigned variable size.if you remember in the first question we discussed about unassigned variable, so based on that the value of size variable would be reversed to max positive value as "4,294,967,295" . 0 byte malloc ) succeeds size = len char *comment = (char *)malloc (size + 1) As the "size" variable contains the maximum positive value so the "size is interpreted as a large positive value." memcpy (comment, src, size return 2 ; Size is interpreted as a large positive value of Oxffffffff From the followingfunction execition starts int tmain(int argc, TCHAR* argv[)I Here it make a call to the above function "getComment(unsigned int len, char *src)" by passingtwo parameters. but the second parameter "Comment "here is a string and in the above function it declared as "char *src" so there is an overflow getComment (1, "Comment "); return O; Possible to cause an overflow by creating an image with a comment length field of 1