Does this function for detecting integer addition overflow actually work?

Question

While reading the comments for this question, I came across a link to the comp.lang.c FAQ that shows a "careful addition function" which purportedly detects integer overflow:

int
chkadd(int a, int b)
{
    if (INT_MAX - b < a) {
        fputs("int overflow\n", stderr);
        return INT_MAX;
    }
    return a + b;
}

How does this not overflow if b == -1? If the assumption is that a and b are both positive, why make them int rather than unsigned int in the first place?

Signed `int` **might** wrap: but it is *undefined behaviour*. — Weather Vane, Apr 28 '16 at 15:34
Assumes `a` and `b` are positive. Useful for converting strings to `int` while checking for overflow. — user3386109, Apr 28 '16 at 15:36
@ddz In C, `INT_MAX - (-1)` is undefined behavior. A compiler can optimize that code to any answer including `INT_MIN, 0, or 42` and still be a compliant compiler. — chux - Reinstate Monica, Apr 28 '16 at 16:32

score 4 · Answer 1 · answered Apr 28 '16 at 16:24

OP has identified that INT_MAX - b may overflow, rendering the remaining code invalid for proper overflow detection. It does not work.

if (INT_MAX - b < a) {  // Invalid overflow detection

A method to detect overflow without UB follows:

int is_undefined_add1(int a, int b) {
  return (a < 0) ? (b < INT_MIN - a) : (b > INT_MAX - a);
}

why make them int rather than unsigned int in the first place?

Changing to unsigned does not solve the problem in general. The range of unsigned: [0...UINT_MAX] could be half of that of int: [INT_MIN...INT_MAX]. IOWs: INT_MAX == UINT_MAX. Such systems are rare these days. IAC, changing types is not needed as coded with is_undefined_add1().

score 1 · Accepted Answer · 2016-04-28T16:07:47.737

1

Probably they just overlooked it. Additional links on the FAQ page seem to provide more correct code.

edited Apr 28 '16 at 16:07

answered Apr 28 '16 at 15:35

1

And those will fail if `b == INT_MIN`, but at least they mention it. I guess it's really just not as easy as they pretend, which is also my experience... – zennehoy Apr 28 '16 at 15:44
That's what they also say in the "correct code": (Note: these functions all share one bug: they may fail if invoked on the largest negative integer, INT_MIN.). – user3078414 Apr 28 '16 at 16:06

Does this function for detecting integer addition overflow actually work?

2 Answers2