Example - 1

The following example subtracts from a 32 bit signed integer.

int i;i = -2147483648;i = i - 1;return 0;
#include <stdio.h>#include <stdbool.h>main (void){}

The example has an integer underflow. The value of i is already at the lowest negative value possible, so after subtracting 1, the new value of i is 2147483647.

Example - 2

This code performs a stack allocation based on a length calculation.

int a = 5, b = 6;size_t len = a - b;char buf[len];    // Just blows up the stack}

Since a and b are declared as signed ints, the "a - b" subtraction gives a negative result (-1). However, since len is declared to be unsigned, len is cast to an extremely large positive number (on 32-bit systems - 4294967295). As a result, the buffer buf[len] declaration uses an extremely large size to allocate on the stack, very likely more than the entire computer's memory space.

Miscalculations usually will not be so obvious. The calculation will either be complicated or the result of an attacker's input to attain the negative value.