off an offbyone error oboe also commonly known as an obob offbyone bug or ob1 error is a logic error involving the discrete equivalent of a boundary condition it often occurs in computer programming when an iterative loop iterates one time too many or too few this problem could arise when a programmer makes mistakes such as using is less than or equal to where is less than should have been used in a comparison or fails to take into account that a sequence starts at zero rather than one as with array indices in many languages this can also occur in a mathematical context looping over arrays consider an array of items and items m through n inclusive are to be processed how many items are there an intuitive answer may be nm but that is off by one exhibiting a fencepost error the correct answer is nm1 for this reason ranges in computing are often represented by halfopen intervals the range from m to n inclusive is represented by the range from m inclusive to n1 exclusive to avoid fencepost errors for example a loop that iterates five times from 0 to 4 inclusive can be written as a halfopen interval from 0 to5 for i 0 i 5 i body of the loop the loop body is executed first of all with i equal to 0 i then becomes 1 2 3 and finally 4 on successive iterations at that point i becomes 5 so i 5 is false and the loop ends however if the comparison used were less than or equal to the loop would be carried out six times i takes the values 0 1 2 3 4 and 5 likewise if i were initialized to 1 rather than 0 there would only be four iterations i takes the values 1 2 3 and 4 both of these alternatives can cause offbyone errors another such error can occur if a dowhile loop is used in place of a while loop or vice versa a dowhile loop is guaranteed to run at least once arrayrelated confusion may also result from differences in programming languages numbering from 0 is most common but some languages start array numbering with 1 pascal has arrays with userdefined indices this makes it possible to model the array indices after the problem domain fencepost error a straight fence with n sections has n1 posts a fencepost error occasionally called a telegraph pole lamppost or picket fence error is a specific type of offbyone error an early description of this error appears in the works of vitruvius the following problem illustrates the error if you build a straight fence 30 meters long with posts spaced 3 meters apart how many posts do you need the naive answer 10 is wrong the fence has 10 sections but 11 posts the reverse error occurs when the number of posts is known and the number of sections is assumed to be the same the actual number of sections is one less than the number of posts more generally the problem can be stated as follows if you have n posts how many sections are there between them the correct answer may be n 1 if the line of posts is openended n if they form a loop or n 1 if the open sides of the sequence of posts count as sections the precise problem definition must be carefully considered as the setup for one situation may give the wrong answer for other situations fencepost errors come from counting things rather than the spaces between them or vice versa or by neglecting to consider whether one should count one or both ends of a row fencepost errors can also occur in units other than length for example the time pyramid consisting of 120 blocks placed at 10 year intervals between blocks is scheduled to take 1190 not 1200 years to build from the installation of the first block to the last block one of the earliest fencepost errors involved time where the julian calendar originally calculated leap years incorrectly due to counting inclusively rather than exclusively yielding a leap year every three years rather than every four fencepost error can in rare occasions refer to an error induced by unexpected regularities in input values which can for instance completely thwart a theoretically efficient binary tree or hash function implementation this error involves the difference between expected and worst case behaviours of an algorithm in larger numbers being offbyone is often not a major issue in smaller numbers however and specific cases where accuracy is paramount committing an offbyone error can be disastrous sometimes such an issue will also be repeated and therefore worsened by someone passing on an incorrect calculation if the following person makes the same kind of mistake again of course the error might also be reversed an example of this error can occur in the computational language matlab with the linspace function whose parameters are lower value upper value number of values and not lower value upper value number of increments a programmer who misunderstands the third parameter to be the number of increments might hope that linspace0105 would achieve a sequence security implications a common offbyone error which results in a securityrelated bug is caused by misuse of the c standard library strncat routine a common misconception with strncat is that the guaranteed null termination will not write beyond the maximum length in reality it will write a terminating null character one byte beyond the maximum length specified the following code contains such a bug void foo char s char buf memsetbuf 0 sizeofbuf strncatbuf s sizeofbuf final parameter should be sizeofbuf1 offbyone errors are common in using the c library because it is not consistent with respect to whether one needs to subtract 1 byte functions like fgets and strncpy will never write past the length given them fgets subtracts 1 itself and only retrieves length1 bytes whereas others like strncat will write past the length given them so the programmer has to remember for which functions they need to subtract 1 on some systems little endian architectures in particular this can result in the overwriting of the least significant byte of the frame pointer this can cause an exploitable condition where an attacker can hijack the local variables for the calling routine one approach that often helps avoid such problems is to use variants of these functions that calculate how much to write based on the total length of the buffer rather than the maximum number of characters to write such functions include strlcat and strlcpy and are often considered safer because they make it easier to avoid accidentally writing past the end of a buffer in the code example above calling strlcatbuf s sizeofbuf instead would remove the bug boundaryvalue analysis pigeonhole principle rounding error zerobased numbering an earlier version of this article was based on fencepost error at foldoc used with permission dijkstra edsger wybe may 2 2008 why numbering should start at zero ewd 831 e w dijkstra archive university of texas at austin retrieved 20110316 