Page History

...

The only integer type conversions that are guaranteed to be safe for all data values and all possible conforming implementations are conversions of an integral value to a wider type of the same signedness. C99 C11, Section 6.3.1.3 [ISO/IEC 9899:2011], says,

When a value with integer type is converted to another integer type other than _Bool, if the value can be represented by the new type, it is unchanged.

Otherwise, if the new type is unsigned, the value is converted by repeatedly adding or subtracting one more than the maximum value that can be represented in the new type until the value is in the range of the new type.

Otherwise, the new type is signed and the value cannot be represented in it; either the result is implementation-defined or an implementation-defined signal is raised.

...

unsigned long int ul = ULONG_MAX;
signed char sc;
sc = (signed char)ul; /* cast eliminates warning */

...

unsigned long int ul = ULONG_MAX;
signed char sc;
if (ul <= SCHAR_MAX) {
  sc = (signed char)ul;  /* use cast to eliminate warning */
}
else {
  /* handle error condition */
}

...

signed int si = INT_MIN;
unsigned int ui = (unsigned int)si;  /* cast eliminates warning */

...

signed int si = INT_MIN;
unsigned int ui;
if (si < 0) {
  /* handle error condition */
}
else {
  ui = (unsigned int)si;  /* cast eliminates warning */
}

NOTE: While unsigned types can usually represent all positive values of the corresponding signed type, this relationship is not guaranteed by the C99 C standard.

Noncompliant Code Example (Signed, Loss of Precision)

...

signed long int sl = LONG_MAX;
signed char sc = (signed char)sl; /* cast eliminates warning */

...

signed long int sl = LONG_MAX;
signed char sc;
if ( (sl < SCHAR_MIN) || (sl > SCHAR_MAX) ) {
  /* handle error condition */
}
else {
  sc = (signed char)sl; /* use cast to eliminate warning */

}

...

unsigned long int ul = ULONG_MAX;
unsigned char uc = (unsigned char)ul;  /* cast eliminates warning */

...

unsigned long int ul = ULONG_MAX;
unsigned char uc;
if (ul > UCHAR_MAX) ) {
  /* handle error condition */
}
else {
  uc = (unsigned char)ul; /* use cast to eliminate warning */
}

Conversions from unsigned types with greater precision to unsigned types with lesser precision require only the upper bounds to be checked.

Exceptions

INT31-EX1: C99 defines  The C standard defines minimum ranges for standard integer types. For example, the minimum range for an object of type unsigned short int is 0 to 65,535, while the minimum range for int is -32−32,767 to +32,767. This means that it is not always possible to represent all possible values of an unsigned short int as an int. However, on the IA-32 architecture, for example, the actual integer range is from -2−2,147,483,648 to +2,147,483,647, meaning that it is quite possible to represent all the values of an unsigned short int as an int for this architecture. As a result, it is not necessary to provide a test for this conversion on IA-32. It is not possible to make assumptions about conversions without knowing the precision of the underlying types. If these tests are not provided, assumptions concerning precision must be clearly documented, as the resulting code cannot be safely ported to a system where these assumptions are invalid. A good way to document these assumptions is by using static assertions. (See recommendation DCL03-C. Use a static assertion to test the value of a constant expression.)

...

Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

...

The CERT Oracle Secure Coding Standard for Java: NUM12-J. Ensure conversions of numeric types to narrower types do not result in lost or misinterpreted data

ISO/IEC 9899:19992011 6.3, "Conversions"

ISO/IEC 17961 (Draft) Overflowing signed integers [intoflow]

ISO/IEC TR 24772 "FLC Numeric Conversion Errors"

...