Page History

If a floating-point value is to be demoted converted to a floating-point value of a smaller range and precision or to an integer type, or if an integer type is to be converted to a floating-point type, the value must be representable in the new destination type.

The C Standard, subclause 6.3.1.4 paragraphs 1  , paragraph 1 [ISO/IEC 9899:2011], says,

When a finite value of real floating type is converted to an integer type other than _Bool, the fractional part is discarded (i.e., the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the behavior is undefined.

...

When a value of integer type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And subclause 6.3.1.5, paragraph 1, says,

When a value of real floating type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

...

Compliant Solution (float to int)

This compliant solution assumes ensures that the range of values of type float is greater than that of an int, as is the case in most implementations. Unfortunately, there is no safe way to inquire about this assumption in the code short of already knowing the implementation. Converting INT_MAX to float is a problem on many implementations, resulting in a number one greater than the value of INT_MAX.  Converting INT_MIN to float is a problem on many implementations, resulting in a number one less than the value of INT_MIN.

:

#include <limits.h>
#include <float.h>
#include <limits<assert.h>
 
void func(float f_a) {
  int i_a;

  static_assert( if
 (f_a >= ((floatdouble)INT_MAX -1.0) || f_a < ((float)INT_MIN +1.0)|| (f_a >= 0.0F && f_a < FLT_MIN)) {double)FLT_MAX), 
   "not /*all Handleint errorvalues */
can be }represented elseas {float"
  );
  i_a = f_a;
  }
}

Noncompliant Code Example (

...

Narrowing Conversion)

This noncompliant code example contains attempts to perform conversions that may be result in truncating values outside the range of the demoted destination types:

void func(double d_a, long double big_d) {
  double d_b = (float)big_d;
  float f_a = (float)d_a;
  float f_b = (float)big_d;
}

As a result of these conversions, it is possible that d_a is outside the range of values that can be represented by a float or that big_d is outside the range of values that can be represented as either a float or a double. If this is the case, the result is undefined on implementations that do not support Annex F, "IEC 60559 Floating-Point Arithmetic."

Compliant Solution (

...

Narrowing Conversion)

This compliant solution checks whether the values to be stored can be represented in the new type:

#include <float.h>
 
void func(double d_a, long double big_d) {
  double d_b;
  float f_a;
  float f_b;

  if (isgreater(d_a >, FLT_MAX) || isless(d_a, < -FLT_MAX)) {
    /* Handle error condition */
  } else {
    f_a = (float)d_a;
  }
  if (isgreater(big_d >, FLT_MAX) || isless(big_d, < -FLT_MAX)) {
    /* Handle error condition */
  } else {
    f_b = (float)big_d;
  }
  if (isgreater (big_d, > DBL_MAX) || isless(big_d <, -DBL_MAX)) {
    /* Handle error condition */
  } else {
    d_b = (double)big_d;
  }  
}

Risk Assessment

Demoting Converting a floating-point value to a floating-point value of a smaller range and precision or to an integer type, or converting an integer type to a floating-point type, can result in a value that is not representable in the new destination type and is undefined behavior on implementations that do not support Annex F.

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Bibliography

...