Page History

Integer conversions, both implicit and explicit (using a cast), must be guaranteed not to result in lost or misinterpreted data. This is particularly true for integer values that originate from untrusted sources and are used in any of the following ways:

• As an array index
• In integer operands of any pointer arithmetic
• As a length or size of an object
• As the bound of an array (for example, a loop counter)
• , including array indexing;
• the assignment expression for the declaration of a variable length array;
• the postfix expression preceding square brackets [] or the expression in square brackets [] of a subscripted designation of an element of an array object; and
• function arguments of type size_t or rsize_t (for example, As an argument to a memory allocation functionIn security-critical code).

The only integer type conversions that are guaranteed to be safe for all data values and all possible conforming implementations are conversions of an integral value to a wider type of the same signedness. Subclause 6.3.1.3 of the C Standard [ISO/IEC 9899:2011] says,

...

Type range errors, including loss of data (truncation) and loss of sign (sign errors), can occur when converting from a a value of an unsigned integer type to a value of a signed integer type. The following This noncompliant code example results in a truncation error on most implementations:

...

Validate ranges when converting from an unsigned type to a signed type. The following code, for example, This compliant solution can be used when converting from to convert a value of unsigned long int type to a value of signed char type :

#include <limits.h>
 
void func(void) {
  unsigned long int u_a = ULONG_MAX;
  signed char sc;
  if (u_a <= SCHAR_MAX) {
    sc = (signed char)u_a;  /* Use cast to eliminateCast eliminates warning */
  } else {
    /* Handle error condition */
  }
}

...

Type range errors, including loss of data (truncation) and loss of sign (sign errors), can occur when converting from a signed type to an unsigned type. The following This noncompliant code example results in a loss of sign:

...

Validate ranges when converting from a signed type to an unsigned type. The following code, for example, This compliant solution can be used when converting to convert from signed int to unsigned int:

#include <limits.h>

void func(void) {
  signed int si = INT_MIN;
  unsigned int ui;
  if (si < 0) {
    /* Handle error condition */
  } else {
    ui = (unsigned int)si;  /* Cast eliminates warning */
  }
  /* ... */
}

NOTE: Although unsigned types can usually represent all positive values of the corresponding signed type, this relationship is not guaranteed by the C Standard.

Noncompliant Code Example (Signed, Loss of Precision)

A loss of data (truncation) can occur when converting from a signed type to a signed type with less precision. The following This noncompliant code example results in a truncation error on most implementations::

#include <limits.h>

void func(void) {
  signed long int s_a = LONG_MAX;
  signed char sc = (signed char)s_a; /* Cast eliminates warning */
  /* ... */
}

...

Validate ranges when converting from a signed type to a signed type with less precision. The following code This compliant solution can be used , for example, to convert from a signed long int to a signed char:

...

Conversions from signed types with greater precision to signed types with lesser less precision require both the upper and lower bounds to be checked.

...

Validate ranges when converting from an unsigned type to an unsigned type with lesser less precision. The following code can be used, for example, to convert from an unsigned long int to an unsigned char:

...

Conversions from unsigned types with greater precision to unsigned types with lesser less precision require only the upper bounds to be checked.

...