Page History

...

The C Standard, 6.3.1.4, paragraph 1 2 [ISO/IEC 9899:20112024], says,

When a finite value of real decimal floating type is converted to an integer type other than _Boolbool, the fractional part is discarded (i.e. , the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the behavior is undefinedthe "invalid" floating-point exception shall be raised and the result of the conversion is unspecified.

Paragraph 2 of the same subclause says,

When a value of integer type is converted to a real standard floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And subclause 6.3.1.5, paragraph 1+2, says,

When a value of real floating type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged.

When a value of real floating type is converted to a standard floating type, if If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined. 

See undefined behaviors 16 and 17 and 18.

This rule does not apply to demotions of floating-point types on implementations that support signed infinity, such as IEEE 754, as all values are within range.

...

void func(float f_a) {
  int i_a;
 
  /* Undefined if the integral part of f_a cannot >= INT_MAXbe represented. */
  i_a = f_a;
}

Compliant Solution (float to int)

This compliant solution assumes tests to ensure that the range of values of type float is greater than that of an int, as is the case in most implementations. Unfortunately, there is no safe way to inquire about this assumption in the code short of already knowing the implementation. Converting INT_MAX to float is a problem on many implementations, resulting in a number that is one greater than the value of INT_MAX.  Converting INT_MIN to float is a problem on many implementations, resulting in a number that is one less than the value of INT_MIN. float value will fit within the int variable before performing the assignment.

#include <float.h>
#include <limits.h>
#include <math.h>
#include <stddef.h>
#include <stdint.h>
 
extern size_t popcount(uintmax_t); /* See INT35-C */
#define PRECISION(umax_value) popcount(umax_value)
 
void func(float f_a) {
  int i_a;
 
  if (isnan(f_a >= ((float)) ||
      PRECISION(INT_MAX -1.0) || < log2f(fabsf(f_a < ((float)INT_MIN +1.0)|| )) ||
      (f_a >!= 0.0F && fabsf(f_a) < FLT_MIN)) {
    /* Handle error */
  } else {
    i_a = f_a;
  }
}

...

#include <float.h>
#include <math.h>
 
void func(double d_a, long double big_d) {
  double d_b;
  float f_a;
  float f_b;

  if (d_a != 0.0 &&
      (isnan(d_a) ||
       isgreater(fabs(d_a), FLT_MAX) ||
       isless(fabs(d_a), FLT_MIN))) {
    /* Handle error */
  } else {
    f_a = (float)d_a;
  }
  if (big_d != 0.0 &&
      (isnan(big_d) ||
       isgreater(fabs(big_d), FLT_MAX) ||
       isless(fabs(big_d), FLT_MIN))) {
    /* Handle error */
  } else {
    f_b = (float)big_d;
  }
  if (isgreater big_d != 0.0 &&
      (isnan(big_d) ||
       isgreater(fabs(big_d), DBL_MAX) ||
       isless(fabs(big_d), DBL_MIN))) {
    /* Handle error */
  } else {
    d_b = (double)big_d;
  }  
}

...

Converting a floating-point value to a floating-point value of a smaller range and precision or to an integer type, or converting an integer type to a floating-point type, can result in a value that is not representable in the destination type and is undefined behavior on implementations that do not support Annex F.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-197 and FLP34-C

Independent( FLP34-C, INT31-C) FIO34-C = Subset( INT31-C)

CWE-197 = Union( FLP34-C, INT31-C)

CWE-195 and FLP34-C

Intersection( CWE-195, FLP34-C) = Ø

Both conditions involve type conversion. However, CWE-195 explicitly focuses on conversions between unsigned vs signed types, whereas FLP34-C focuses on floating-point arithmetic.

CWE-681 and FLP34-C

CWE-681 = Union( FLP34-C, INT31-C)

Bibliography

...

...

Image Modified Image Modified Image Modified