Page History

...

Type range errors, including loss of data (truncation) and loss of sign (sign errors), can occur when converting when converting from a value of a signed type to a value of an unsigned type. This noncompliant code example results in a loss of sign:

...

Validate ranges when converting from a signed type to an unsigned type. This compliant solution can be used to convert from signed int to unsigned intconverts a value of a signed int type to a value of an unsigned int type:

#include <limits.h>

void func(void) {
  signed int si = INT_MIN;
  unsigned int ui;
  if (si < 0) {
    /* Handle error condition */
  } else {
    ui = (unsigned int)si;  /* Cast eliminates warning */
  }
  /* ... */
}

...

A loss of data (truncation) can occur when converting from a value of a signed integer type to a value of a signed type with less precision. This noncompliant code example results in a truncation error on most implementations:

...

Validate ranges when converting from a signed type to a signed type with less precision. This compliant solution can be used to convert from converts a value of a signed long int type to a value of a signed char type:

#include <limits.h>

void func(void) {
  signed long int s_a = LONG_MAX;
  signed char sc;
  if ((s_a < SCHAR_MIN) || (s_a > SCHAR_MAX)) {
    /* Handle error condition */
  } else {
    sc = (signed char)s_a; /* Use cast to eliminate warning */
  }
  /* ... */
}

Conversions from signed types with greater precision to signed types a value of a signed integer type to a value of a signed integer type with less precision require requires that both the upper and lower bounds to be are checked.

Noncompliant Code Example (Unsigned, Loss of Precision)

A loss of data (truncation) can occur when converting from a value of an unsigned integer type to a value of an unsigned type with less precision. The following This noncompliant code example results in a truncation error on most implementations:

...

Validate ranges when converting from a value of an unsigned integer type to a value of an unsigned integer type with less precision. The following code can be used, for example, to convert from This compliant solution converts a value of an unsigned long int type to a value of an unsigned char type:

#include <limits.h>

void func(void) {
  unsigned long int u_a = ULONG_MAX;
  unsigned char uc;
  if (u_a > UCHAR_MAX) ) {
    /* Handle error condition */
  } else {
    uc = (unsigned char)u_a; /* Use cast to eliminateCast eliminates warning */
  }
  /* ... */
}

Conversions from unsigned types with greater precision to unsigned types with less precision require only the upper bounds to be checked.

...

The time() function returns a the value (time_t)(-1) to indicate that the calendar time is not available. The C Standard requires only that the time_t type is an arithmetic a real type capable of representing time. (The integer and real floating types are collectively called real types.) It is left to the implementor to decide the best arithmetic real type to use to represent time. If time_t is implemented as an unsigned integer type smaller with less precision than a signed int, the return value of time() will never compare equal to the integer literal -1.

...

This solution is in accordance with INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size.

Exceptions

INT31-EX0EX1: The C Standard defines minimum ranges for standard integer types. For example, the minimum range for an object of type unsigned short int is 0 to 65,535, whereas the minimum range for int is −32,767 to +32,767. Consequently, it is not always possible to represent all possible values of an unsigned short int as an int. However, on the IA-32 architecture, for example, the actual integer range is from −2,147,483,648 to +2,147,483,647, meaning that it is quite possible to represent all the values of an unsigned short int as an int for this architecture. As a result, it is not necessary to provide a test for this conversion on IA-32. It is not possible to make assumptions about conversions without knowing the precision of the underlying types. If these tests are not provided, assumptions concerning precision must be clearly documented, as the resulting code cannot be safely ported to a system where these assumptions are invalid. A good way to document these assumptions is to use static assertions. (See DCL03-C. Use a static assertion to test the value of a constant expression.)

...