question on validity of overflow bugs

[sunbeomso]

Hi, I have a question on validity of injected overflow bugs.

It seems that, some parts that are marked as injected overflow bugs are not actually bugs (i.e., they are safe).

Could you please confirm whether they are indeed bugs or not?

For example, in a code snippet

function bug_intou20(uint8 p_intou20) public{
    uint8 vundflw1=0;
    vundflw1 = vundflw1 + p_intou20;   // overflow bug
}

which comes from https://github.com/DependableSystemsLab/SolidiFI-benchmark/blob/master/buggy_contracts/Overflow-Underflow/buggy_11.sol#L98

the expression vundflw1 + p_intou20 will not overflow because vulndflw1 is initialized as 0 and it is a local variable (hence effects by transactions will not be accumulated).

To introduce overflow bugs in the function bug_intou20, for example, vulndlfw1 should be initialized with non-zero values.