Page History

...

Section 6.3.1.4 of C99 \[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] says:

When a finite value of real floating type is converted to an integer type other than _Bool, the fractional part is discarded (i.e., the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the behavior is undefined.)

When a value of integer type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And section 6.3.1.5 says:

When a double is demoted to float, a long double is demoted to double or float, or a value being represented in greater precision and range than required by its semantic type (see 6.3.1.8) is explicitly converted (including to its own type), if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

...

This rule does not apply to demotions of floating-point types on implementations that support signed infinity, such as IEEE 754, as all numbers are representable.

Noncompliant Code Example (

...

Int-

...

Float)

This noncompliant code example leads to undefined behavior if the integral part of f1 cannot be represented as an integer.

float f1;
int i1;

/* initialize fl */

i1 = f1; /* Undefined if the integral part of f1 > INT_MAX */

Compliant Solution (

...

Int-

...

Float)

This compliant solution assumes that the range of floating-point values is greater than that of an int. (this This is the case in almost all implementations.) . Unfortunately, there is no safe way to inquire about this assumption in the code short of already knowing the implementation.

float f1;
int i1;

/* initialize fl */

if (f1 > (float) INT_MAX || f1 < (float) INT_MIN) {
  /* Handle error */
} else {
  i1 = f1;
}

Noncompliant Code Example (

...

Demotions)

This noncompliant code example contains conversions that may be outside of the range of the demoted types.

...

As a result of these conversions, it is possible that d1 is outside the range of values that can be represented by a float or that ld is outside the range of values that can be represented as either a float or a double. If this is the case, the result is undefined.

Compliant Solution (

...

Demotions)

This compliant solution checks to see whether the values to be stored can be represented in the new type.

...

Automated Detection

...

...

...

...

...

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

Related Guidelines

This rule appears in the C++ Secure Coding Standard as : FLP34-CPP. Ensure that floating point conversions are within range of the new type.

This rule appears in the Java Secure Coding Standard as : FLP03-J. Range check before casting floating point numbers to narrower types.

Bibliography

\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 6.3.1.4, "Real floating and integer," and Section 6.3.1.5, "Real floating types"
\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "FLC Numeric Conversion Errors"
\[[IEEE 754|AA. Bibliography#IEEE 754 2006]\] IEEE 754-1985 Standard for Binary Floating-Point Arithmetic
\[[MITRE 072007|AA. Bibliography#MITRE 07]\] [CWE ID 681|http://cwe.mitre.org/data/definitions/681.html], "Incorrect Conversion between Numeric Types"

...