Page History

If a floating-point value is to be demoted to a floating-point value of a smaller range and precision or to an integer type, or if an integer type is to be converted to a floating-point type, the value must be represented in the new type.

Section 6.3.1.4 of C99 of the C standard [ISO/IEC 9899:19992011] says:

When a finite value of real floating type is converted to an integer type other than _Bool, the fractional part is discarded (i.e., the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the behavior is undefined.

When a value of integer type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And section 6.3.1.5 says,

When a double is demoted to float, a long double is demoted to double or float, or a value being represented in greater precision and range than required by its semantic type (see 6.3.1.8) is explicitly converted (including to its own type), if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

See also undefined behavior 15 behaviors 17 and 16 18 in Annex J of the same C standard.

Consequently, in implementations that do not allow for the representation of all numbers, conversions of numbers between zero and FLT_MIN may result in undefined behavior.

...

float f1;
int i1;

/* initialize fl */

i1 = f1; /* Undefined if the integral part of f1 > INT_MAX */

...

float f1;
int i1;

/* initialize fl */

if (f1 > (float) INT_MAX || f1 < (float) INT_MIN) {
  /* Handle error */
} else {
  i1 = f1;
}

...

long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

f1 = (float)d1;
f2 = (float)ld;
d2 = (double)ld;

...

This compliant solution checks to see whether the values to be stored can be represented in the new type.

#include <float.h>

long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

if (d1 > FLT_MAX || d1 < -FLT_MAX) {
  /* Handle error condition */
} else {
  f1 = (float)d1;
}
if (ld > FLT_MAX || ld < -FLT_MAX) {
  /* Handle error condition */
} else {
  f2 = (float)ld;
}
if (ld > DBL_MAX || ld < -DBL_MAX) {
  /* Handle error condition */
} else {
  d2 = (double)ld;
}

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT C++ Secure Coding Standard: FLP34-CPP. Ensure that floating point conversions are within range of the new type

ISO/IEC 9899:19992011 Section 6.3.1.4, "Real floating and integer," and Section 6.3.1.5, "Real floating types"

ISO/IEC TR 24772 "FLC Numeric Conversion Errorsconversion errors"

The CERT Oracle Secure Coding Standard for Java: NUM12-J. Ensure conversions of numeric types to narrower types do not result in lost or misinterpreted data

MITRE CWE: CWE-681, "Incorrect Conversion conversion between Numeric Typesnumeric types"

Bibliography

[IEEE 754] IEEE 754-1985 Standard for Binary Floating-Point Arithmetic

...