Page History

If a floating point value is to be demoted to a floating point value of a smaller range and precision or to an integer type, or if an integer type is to be converted to a floating point type, it must be ensured that this value is representable by the demoted new type.

FromSection 6.3.1.54 of C99 says \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\]

When a finite value of real floating type is converted to an integer type other than _Bool, the fractional part is discarded (i.e., the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the behavior is undefined.)

When a value of integer type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And section 6.3.1.5 says C99 standard \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\]:

When a double is demoted to float or a long double is demoted to double or float...if the value being converted is outside the range of values that can be represented, the behavior is undefined.

...

This rule does not apply to demotions of floating point types on implementations that support signed infinity, such as IEEE 754, as all numbers are representable.

Non-Compliant Code Example (int-float)

float f1;
int i1;

/* initializations */
if (f1 > (float) INT_MAX || f1 < (float) INT_MIN) {
  /* Handle Error */
} else {
  i1 = f1;
}

/* XXX NOT DONE */

Compliant Solution (int-float)

Non-Compliant Code Example (demotions)

The following non-compliant code illustrates casts of values that may not be outside of the range of the demoted type.

...

As a result of these conversions, it is possible that d1 is outside the range of values that can be represented by a float or that ld is outside the range of values that can be represented as either a float or a double. If this is the case, the result is undefined.

Compliant Solution (demotions)

This compliant solution properly checks to see whether the values to be stored can be represented in the new type.

#include <float.h>

long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

if (d1 > FLT_MAX || d1 < -FLT_MAX) {
  	/* Handle error condition */
} else {
 	f1 = (float)d1;
}
if (ld > FLT_MAX || ld < -FLT_MAX) {
	/* Handle error condition */
} else {
	f2 = (float)ld;
}
if (ld > DBL_MAX || ld < -DBL_MAX) {
	/* Handle error condition */
} else {
	d2 = (double)ld;
}

Risk Analysis

Failing to check that a floating point value fits within a demoted type can result in a value too large to be represented by the new type, resulting in undefined behavior.

Automated Detection

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.3.1.4, "Real floating and integer," and Section 6.3.1.5, "Real floating types"
\[[IEEE 754|AA. C References#IEEE 754 2006]\] IEEE 754-1985 Standard for Binary Floating-Point Arithmetic

...