# Signed integer overflow bypasses bounds guards

Size or index arithmetic that can wrap before a bounds check, then used as length or index

_Area: Memory corruption and native code. Seen in 5 disclosed reports; one confirmed bounty: $1,000; latest 2026-10-16. Updated 2026-10-24._

## How it works
A length, count or index is computed with signed arithmetic (multiply, add, shift) and then compared against a limit. The arithmetic wraps before the comparison, so the value that reaches the check is small or negative and passes. The wrapped value is then used as an allocation size, slice length or index, and the real size is far larger than what was validated. The guard assumes arithmetic on the value is exact; it is not.

## Where it shows up
- Element count multiplied by element size, or length plus delimiter, in the same expression as a limit check [E3](https://bugbountylibrary.com/r/h1%3A185899.md)[E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh.md)
- Bounds checks that only reject negative values, with no upper bound [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh.md)
- `1 << n` or `| 0` where n comes from user-controlled size or index [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v56q-mh7h-f735.md)
- Accumulating parsers (base-N, digit loops) with only a post-loop range check [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c85p-xxjj-2r75.md)
- Wrapper scanners that validate source length or repeat bounds separately from the real engine [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229.md)
- A hardened check on one axis (row) while the sibling axis (column) is untouched [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c85p-xxjj-2r75.md)

## How to review
Find every place a computed size or index crosses a trust boundary. The invariant: the check must be performed on a value that cannot have wrapped, or the arithmetic must be done in a width that cannot overflow for any accepted input. Concretely: confirm the limit is expressed in the same unit as the arithmetic (bytes vs elements) [E3](https://bugbountylibrary.com/r/h1%3A185899.md); confirm upper and lower bounds are both enforced before use [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh.md); confirm shift counts and coercions cannot exceed the type width [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v56q-mh7h-f735.md); confirm `err == nil` from a parser is not treated as proof the value is in domain [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c85p-xxjj-2r75.md); confirm wrapper validation and engine parsing agree on the same input [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229.md).

## Variants seen
- Signed multiply of body length by repeat bound overflows negative, bypassing expansion limit [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229.md)
- 32-bit shift wraps at 2^30/2^31, loop never terminates [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v56q-mh7h-f735.md)
- Element-count bound not divided by element size, allocation too small [E3](https://bugbountylibrary.com/r/h1%3A185899.md)
- int64 accumulation wraps to 0, passes max-column guard [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c85p-xxjj-2r75.md)
- Length plus delimiter overflows negative, downstream slice panics [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh.md)

## Why fixes fail
E4 shows a prior fix hardening the row axis while the column axis kept the same flaw; the class was not applied to the sibling path.

## Impact and severity
Out-of-bounds write and segfault [E3](https://bugbountylibrary.com/r/h1%3A185899.md); arbitrary command execution as a service user [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229.md); unrecoverable DoS via a single request [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-v56q-mh7h-f735.md)[E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh.md); panic on attacker-supplied files [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-c85p-xxjj-2r75.md). Severity rises when the path is unauthenticated [E1](https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229.md) and when the wrapped value reaches a write rather than a read.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-v56q-mh7h-f735.md
- E3: https://bugbountylibrary.com/r/h1%3A185899.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-c85p-xxjj-2r75.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-43g7-cwr8-q3jh.md