...
The only integer type conversions that are guaranteed to be safe for all data values and all possible conforming implementations are conversions of an integral value to a wider type of the same signedness. C11, Section 6.3.1.3 of the C Standard [ISO/IEC 9899:2011] , says,
When a value with integer type is converted to another integer type other than
_Bool, if the value can be represented by the new type, it is unchanged.Otherwise, if the new type is unsigned, the value is converted by repeatedly adding or subtracting one more than the maximum value that can be represented in the new type until the value is in the range of the new type.
Otherwise, the new type is signed and the value cannot be represented in it; either the result is implementation-defined or an implementation-defined signal is raised.
...
INT31-EX1: The C standard defines minimum ranges for standard integer types. For example, the minimum range for an object of type unsigned short int is 0 to 65,535, while the minimum range for int is −32,767 to +32,767. This means that it is not always possible to represent all possible values of an unsigned short int as an int. However, on the IA-32 architecture, for example, the actual integer range is from −2,147,483,648 to +2,147,483,647, meaning that it is quite possible to represent all the values of an unsigned short int as an int for this architecture. As a result, it is not necessary to provide a test for this conversion on IA-32. It is not possible to make assumptions about conversions without knowing the precision of the underlying types. If these tests are not provided, assumptions concerning precision must be clearly documented, as the resulting code cannot be safely ported to a system where these assumptions are invalid. A good way to document these assumptions is by using to use static assertions. (See DCL03-C. Use a static assertion to test the value of a constant expression.)
...
Tool | Version | Checker | Description | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Include Page | LDRA_V | LDRA_V | 93 S | Fully implemented. | Fortify SCA | V. 5.0 | Can detect violations of this rule with CERT C Rule Pack. | ||||||
Compass/ROSE | Can detect violations of this rule. However, false warnings may be raised if | | Include Page | | Klocwork_V | Klocwork_V | ||||||||
| NEGATIVE_RETURNS | Can find array accesses, loop bounds, and other expressions that may contain dangerous implied integer conversions that would result in unexpected behavior. | |||||||||||
| REVERSE_NEGATIVE | Can find instances where a negativity check occurs after the negative value has been used for something else. | |||||||||||
| MISRA_CAST | Can find the instances where an integer expression is implicitly converted to a narrower integer type, or implicitly converting the signedness of an integer value or implicitly converting the type of a complex expression. | |||||||||||
Fortify SCA | 5.0 | Can detect violations of this rule with CERT C Rule Pack. | |||||||||||
| PRECISION.LOSS | ||||||||||||
| 93 S | Fully implemented. | |||||||||||
| PRQA QA-C |
| 2850 (C) | Partially implemented |
Coverity * Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
...
...
...
...
...
| Numeric conversion errors |
...
| [FLC] |
| MISRA |
...
| -C | Rule 10.1 (required): The value of an expression of integer type shall not be implicitly converted to a different underlying type if: |
...
or | |
| MITRE CWE | CWE-192, Integer coercion error CWE-197, Numeric truncation error CWE-681, Incorrect conversion between numeric types |
...
Bibliography
| [Dowd 2006] | Chapter 6, "C Language Issues" ("Type |
|---|
...
| Conversions," pp. 223–270) | |
|---|---|
| [ISO/IEC 9899:2011] | Section 6.3.1.3, "Signed and Unsigned Integers" |
| [Seacord 2005a] | Chapter 5, "Integers" |
| [Viega 2005] | Section 5.2.9, "Truncation |
...
| Error" Section 5.2.10, "Sign |
...
| Extension Error" Section 5.2.11, "Signed to |
...
| Unsigned Conversion Error" Section 5.2.12, "Unsigned to |
...
| Signed Conversion Error" | |
| [Warren 2002] | Chapter 2, "Basics" |
| [xorl 2009] | "CVE-2009-1376: Pidgin MSN SLP |
...