nerdexam
CompTIA

CAS-002 · Question #788

A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user's age. This input gets placed…

The correct answer is B. The age variable has had an integer overflow and was assigned a very small negative number. A very large number submitted to a signed integer age field causes an integer overflow, wrapping the stored value to a large negative number that bypasses the adult age check.

Enterprise Security

Question

A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user's age. This input gets placed into a signed integer variable and is then checked to ensure that the user is in the adult age range. Users have reported that the website is not functioning correctly. The web developer has inspected log files and sees that a very large number (in the billions) was submitted just before the issue started occurring. Which of the following is the MOST likely situation that has occurred?

Options

  • AThe age variable stored the large number and filled up disk space which stopped the application
  • BThe age variable has had an integer overflow and was assigned a very small negative number
  • CComputers are able to store numbers well above "billions" in size.
  • DThe application has crashed because a very large integer has lead to a "divide by zero".

How the community answered

(51 responses)
  • A
    4% (2)
  • B
    82% (42)
  • C
    10% (5)
  • D
    4% (2)

Why each option

A very large number submitted to a signed integer age field causes an integer overflow, wrapping the stored value to a large negative number that bypasses the adult age check.

AThe age variable stored the large number and filled up disk space which stopped the application

Storing a numeric value in an integer variable consumes a fixed amount of memory (typically 4 or 8 bytes) regardless of the magnitude of the number, so it cannot fill disk space.

BThe age variable has had an integer overflow and was assigned a very small negative numberCorrect

Signed integers have a fixed maximum value (e.g., 2,147,483,647 for a 32-bit signed int). When a value in the billions exceeds this ceiling, the variable wraps around to a large negative number due to how two's complement arithmetic works. A negative age would then fail the adult range check, causing the application to malfunction exactly as reported.

CComputers are able to store numbers well above "billions" in size.

This statement is factually misleading in context - while computers can represent large numbers using specific data types, a standard signed integer has a hard upper bound, and exceeding it causes overflow rather than correct storage.

DThe application has crashed because a very large integer has lead to a "divide by zero".

Integer overflow causes a value wrap-around, not a division operation; a divide-by-zero error requires an explicit division by zero in the code, which is a separate and unrelated vulnerability.

Concept tested: Integer overflow vulnerability in signed integer variables

Source: https://cwe.mitre.org/data/definitions/190.html

Topics

#integer overflow#input validation#signed integers#web application security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice