...
INT31-EX1: The C Standard defines minimum ranges for standard integer types. For example, the minimum range for an object of type unsigned short int is 0 to 65,535, whereas the minimum range for int is −32,767 to +32,767. Consequently, it is not always possible to represent all possible values of an unsigned short int as an int. However, on the IA-32 architecture, for example, the actual integer range is from −2,147,483,648 to +2,147,483,647, meaning that it is quite possible to represent all the values of an unsigned short int as an int for this architecture. As a result, it is not necessary to provide a test for this conversion on IA-32. It is not possible to make assumptions about conversions without knowing the precision of the underlying types. If these tests are not provided, assumptions concerning precision must be clearly documented, as the resulting code cannot be safely ported to a system where these assumptions are invalid. A good way to document these assumptions is to use static assertions. (See DCL03-C. Use a static assertion to test the value of a constant expression.)
INT31-EX2: Conversion from any integer with a value between SCHAR_MIN and UCHAR_MAX into a character type is permitted if the value is used to represent a character rather than a mathematical number.
Conversions to unsigned character types are well-defined by C11 to have modular behavior. A character's value is not misinterpreted by the loss of sign or conversion to a negative number. For example, the Euro symbol € is sometimes represented by bit pattern 0x80 which can have the mathematical value 128 or -127.
Conversions to signed character types are more problematic.
C11 subclause 6.3.1.3 paragraph 3 says, regarding conversions:
Otherwise, the new type is signed and the value cannot be represented in it; either the result is implementation-defined or an implementation-defined signal is raised.
Furthermore, subclause 6.2.6.2, paragraph 2 says, regarding integer modifications:
If the sign bit is one, the value shall be modified in one of the following ways:
— the corresponding value with sign bit 0 is negated (sign and magnitude); — the sign bit has the value −(2M ) (two’s complement);
— the sign bit has the value −(2M − 1) (ones’ complement).
Which of these applies is implementation-defined, as is whether the value with sign bit 1 and all value bits zero (for the first two), or with sign bit and all value bits 1 (for ones’ complement), is a trap representation or a normal value.
Consequently the standard allows for this code to trap:
| Code Block |
|---|
int i = 128; /* 1000 0000 in binary */
assert( SCHAR_MAX == 127);
signed char c = i; /* can trap */
|
However, platforms where this code traps or produces an unexpected value seem to be rare. According to The New C Standard: An Economic and Cultural Commentary by Derek Jones:
Implementations with such trap representations are thought to have existed in the past. Your author was unable to locate any documents describing such processors.
Risk Assessment
Integer truncation errors can lead to buffer overflows and the execution of arbitrary code by an attacker.
...