C traps and defects Chapter 3 semantic "traps" 3.9 integer overflow

Integer overflow
C There are two kinds of integer arithmetic operations in language ： Signed and unsigned operations . In unsigned arithmetic operations , It doesn't matter “ overflow ” said ： All unsigned operations are based on 2 Of n Power module , here n Is the number of digits in the result . If an operand of an arithmetic operator is a signed integer , The other is unsigned integer , Then signed integers will be converted to unsigned integers ,“ overflow ” It can't happen .
however , When both operands are signed integers ,“ overflow ” It could happen , and “ overflow ” The result of is undefined . When the result of an operation occurs “ overflow ” when , It's not safe to make any assumptions .
Assume a and b It's two nonnegative integer variables , We need to check a+b Whether it will “ overflow ”. One way to take it for granted is this ： 
//a >= 0, b >= 0
if (a + b < 0) {
    complain();
}
This does not work properly . When a+b It does happen “ overflow ” when , All assumptions about the outcome are no longer reliable . for example , On some machines , The addition operation will set an internal register to 4 One of the states in ： just 、 negative 、 Zero sum overflow . On this kind of machine ,a And b The result of adding is overflow , Not negative , therefore if The check of the statement will fail .
A correct way is to a and b Are cast to unsigned integers ： 
if ((unsigned)a + (unsigned)b > INT_MAX) {
    complain();
}
Here INT_MAX Is a defined constant , Represents the maximum possible integer value .ANSI C Standard in <limits.h> It defines INT_MAX; If it's in another C Language implementation , Readers may need to redefine themselves .
Another possible way to eliminate the need for unsigned arithmetic operations is ： 
if (a > INT_MAX - b) {
    complain();
}