Programs must not allow mathematical operations to exceed the integer ranges provided by their primitive integer data types. According to The Java Language Specification (JLS), §4.2.2, "Integer Operations" [JLS 2015]:

The built-in integer operators do not indicate overflow or underflow in any way. Integer operators can throw a NullPointerException if unboxing conversion of a null reference is required. Other than that, the only integer operators that can throw an exception are the integer divide operator / and the integer remainder operator %, which throw an ArithmeticException if the right-hand operand is zero, and the increment and decrement operators ++ and -- which can throw an OutOfMemoryError if boxing conversion is required and there is insufficient memory to perform the conversion.

The integral types in Java, representation, and inclusive ranges are shown in the following table taken from the JLS, §4.2.1, "Integral Types and Values" [JLS 2015]:

According to Sun's Secure Coding Guidelines \[[SCG 2007|AA. Bibliography#SCG 07]\]

The (Java) language is type-safe, and the runtime provides automatic memory management and range-checking on arrays. These features also make Java programs immune to the stack-smashing and buffer overflow attacks possible in the C and C++ programming languages, and that have been described as the single most pernicious problem in computer security today.

While this statement is true, arithmetic operations in the Java platform require as much caution as in C and C++. Integer operations can result in overflow because Java does not provide any indication of overflow conditions and silently wraps. While integer overflows in vulnerable C and C++ programs may result in execution of arbitrary code, in Java, wrapped values typically result in incorrect computations and unanticipated outcomes.

According to the Java Language Specification Section 4.2.2 "Integer Operations"

The built-in integer operators do not indicate overflow or underflow in any way. Integer operators can throw a NullPointerException if unboxing conversion of a null reference is required. Other than that, the only integer operators that can throw an exception are the integer divide operator / and the integer remainder operator %, which throw an ArithmeticException if the right-hand operand is zero, and the increment and decrement operators ++ and -- which can throw an OutOfMemoryError if boxing conversion is required and there is not sufficient memory available to perform the conversion.

...

...

The following table shows the integer overflow behavior of the integral operators.

Because the ranges of Java types are not symmetric (the negation of each minimum value is one more than each maximum value), even operations such as unary negation can overflow if applied to a minimum value. Because the java.lang.math.abs() method returns the absolute value of any number, it can also overflow if given the minimum int or long as an argument.

When a mathematical operation cannot be represented using the supplied integer types, Java's built-in integer operators silently wrap the result without indicating overflow. The silent wrap can result in incorrect computations and unanticipated outcomes. Failure to account for integer overflow has resulted in failures of real systems, for example, when implementing the compareTo() method. The meaning of the return value of the compareTo() method is defined only in terms of its sign and whether it is zero; the magnitude of the return value is irrelevant. Consequently, an apparent but incorrect optimization would be to subtract the operands and return the result. For operands of opposite signs, this approach can result in integer overflow, consequently violating the compareTo() contract [Bloch 2008].

Comparison of Compliant Techniques

Following are the three main techniques for detecting unintended integer overflow:

• Precondition testing. Check the inputs to each arithmetic operator to ensure that overflow cannot occur. Throw an ArithmeticException when the operation would overflow if it were performed; otherwise, perform the operation.

• Upcasting. Cast the inputs to the next larger primitive integer type and perform the arithmetic in the larger size. Check each intermediate result for overflow of the original smaller type and throw an ArithmeticException if the range check fails. Note that the range check must be performed after each arithmetic operation; larger expressions without per-operation bounds checking can overflow the larger type. Downcast the final result to the original smaller type before assigning to a variable of the original smaller type. This approach cannot be used for type long because long is already the largest primitive integer type.

• BigInteger. Convert the inputs into objects of type BigInteger and perform all arithmetic using BigInteger methods. Type BigInteger is the standard arbitrary-precision integer type provided by the Java standard libraries. The arithmetic operations implemented as methods of this type cannot overflow; instead, they produce the numerically correct result. Consequently, compliant code performs only a single range check just before converting the final result to the original smaller type and throws an ArithmeticException if the final result is outside the range of the original smaller type.

The precondition testing technique requires different precondition tests for each arithmetic operation. This approach can be somewhat more difficult to implement and to audit than either of the other two approaches.

The upcast technique is the preferred approach when applicable. The checks it requires are simpler than those of the previous technique; it is substantially more efficient than using BigInteger. Unfortunately, it cannot be applied to operations involving type long, as there is no bigger type to upcast to.

The BigInteger technique is conceptually the simplest of the three techniques because arithmetic operations on BigInteger cannot overflow. However, it requires the use of method calls for each operation in place of primitive arithmetic operators, which can obscure the intended meaning of the code. Operations on objects of type BigInteger can also be significantly less efficient than operations on the original primitive integer type.

Precondition Testing

The following code example shows the necessary precondition checks required for each arithmetic operation on arguments of type int. The checks for the other integral types are analogous. These methods throw an exception when an integer overflow would otherwise occur; any other conforming error handling is also acceptable. Since ArithmeticException inherits from RuntimeException, we do not need to declare it in a throws clause.

static final int safeAdd(int left, int right) {
  if (right > 0 ? left > Integer.MAX_VALUE - right
                : left < Integer.MIN_VALUE - right) {

According to the Java Language Specification Section 4.2.1 "Integral Types and Values," the values of the integral types are integers in the following ranges:

• For byte, from –128 to 127, inclusive
• For short, from –32,768 to 32,767, inclusive
• For int, from –2,147,483,648 to 2,147,483,647
• For long, from –9,223,372,036,854,775,808 to 9,223,372,036,854,775,807, inclusive
• For char, from \u0000 to \uffff inclusive, that is, from 0 to 65,535

The table below shows the integer overflow behavior of the integral operators.

Failure to account for integer overflow has resulted in failures of real systems, for instance, when implementing the {{compareTo()}} method. The meaning of the return value of the {{compareTo()}} method is defined only in terms of its sign and whether it is zero; the magnitude of the return value is irrelevant. Consequently, an apparent --- but incorrect --- optimization would be to subtract the operands and return the result. For operands of opposite sign, this can result in integer overflow; consequently violating the {{compareTo()}} contract \[[Bloch 2008, item 12|AA. Bibliography#Bloch 08]\].

Addition

Addition (as with all arithmetic operations) in Java is performed on signed numbers only; unsigned numbers are unsupported. One exception is the unsigned char type. Performing arithmetic operations that use operands of type char is strongly discouraged.

Noncompliant Code Example

In this noncompliant code example, the result of the addition can overflow.

public int do_operation(int a, int b){
  // May result in overflow 
  int temp = a + b;
  return temp;
}

When the result of the addition is outside the range that can be represented as an int, the variable temp will contain an erroneous result. This problem does not occur when using short types, such as byte and short because the operands are promoted to type int before the operation is carried out. The language disallows storing the result of such operations in variables of types shorter than type int.

Compliant Solution (Bounds Checking)

Explicitly check the range of the operands of arithmetic operations; throw an ArithmeticException when overflow would occur.

Compliant Solution (Use a larger type and downcast)

For all integral types other than long, the next larger integral type can represent the result of any single integral operation. For example, operations on values of type int, can be safely performed using type long. Therefore, we can perform an operation using the larger type and range-check before down casting to the original type. Note, however, that this guarantee holds only for a one arithmetic operation; larger expressions without per-operation bounds checks may overflow the larger type.

Because type long is the largest primitive integral type, the only possible way to use a larger type and downcast is to perform arithmetic operations using the BigInteger class, range-check, and then convert the result back to type long.

This compliant solution converts two variables of type int to type long, performs the addition of the long values, and range checks the result before converting back to type int using a range-checking method. The range-checking method determines whether its input can be represented by type int. If so, it returns the downcast result; otherwise it throws an ArithmeticException.

public int do_operation(int a, int b) throws ArithmeticException {
  return intRangeCheck((long) a + (long) b);
}

// Either perform a safe downcast to int, or throw ArithmeticException
public static int intRangeCheck(long val) throws ArithmeticException {
   if (val > Integer.MAX_VALUE || val < Integer.MIN_VALUE) {
     throw new ArithmeticException("OutInteger of rangeoverflow");
   }
   return (int)val; // Value within range; downcast is safe
}

Compliant Solution (Bounds Checking)

This compliant solution range checks the operand values to ensure that the result does not overflow.

public int add(int a, int b) throws ArithmeticExceptionleft + right;
}

static final int safeSubtract(int left, int right) {
  if ( bright > 0 ? aleft >< Integer.MAXMIN_VALUE - b + right 
                : aleft <> Integer.MINMAX_VALUE -+ b right) {
    throw new ArithmeticException("NotInteger in rangeoverflow");
  }
  return aleft +- bright;
}

static final // Value within range so addition can be performed
}

public int add(int a, int b) throws ArithmeticException {
  if (((a > 0) && (b > 0) && (a > (Integer.MAX_VALUE - b))) 
   || ((a < 0) && (b < 0) && (a < (Integer.MIN_VALUE - b)))) {
     throw new ArithmeticException("Not in range");
}
else {
  return a + b;  // Value within range so addition can be performed
}

Compliant Solution (Use BigInteger Class)

This compliant solution uses the BigInteger class as a wrapper to test for overflow.

public long do_operation(long a, long b) throws ArithmeticException {
  return longRangeCheck(BigInteger.valueOf(a).add(BigInteger.valueOf(b));
}

public long longRangeCheck(BigInteger val) throws ArithmeticException {
  if (val.compareTo(BigInteger.valueOf(Long.MAX_VALUE)) == 1 ||
int safeMultiply(int left, int right) {
  if (right > 0 ? left > Integer.MAX_VALUE/right
                  || left < Integer.MIN_VALUE/right 
                : (right < -1 ? left > Integer.MIN_VALUE/right 
                                || left < Integer.MAX_VALUE/right
                              : right == -1 
                                val.compareTo(BigInteger.valueOf(Long.&& left == Integer.MIN_VALUE)) == -1) {
    throw new ArithmeticException("Out of range for longInteger overflow");
  }
  return val.longValue();
}

The BigInteger class eliminates integer overflows but at the cost of increased overhead.

Subtraction

Subtraction overflows when the first operand is a negative integer and the second operand is a large positive integer such that their difference is not representable as a value of type int. Subtraction also overflows when the first operand is positive and the second operand is negative and their difference is not representable as a value of type int.

Note that the "Use a larger type and downcast" approach suffices to avoid overflow for subtraction.

Multiplication

Multiplication overflows whenever the sum of the number of bits required to represent its operands is larger than the number of bits in the result type. Once again, the "Use a larger type and downcast" approach suffices to avoid overflow.

Division

Although Java throws a java.lang.ArithmeticException for division by zero, it fails to do so when dividing Integer.MIN_VALUE by -1. Rather, Java produces Integer.MIN_VALUE in this case, because the result is -(Integer.MIN_VALUE) = Integer.MAX_VALUE + 1)) which overflows to Integer.MIN_VALUE; this may surprise many programmers.

Once again, the "Use a larger type and downcast" approach suffices to avoid overflow. In some cases, checking for the specific case above may be more efficient.

Remainder Operator

The Java remainder operator does not present overflow issues. However, it has the following behavior for corner cases:

• When the modulo of Integer.MIN_VALUE with -1 is taken, the result is always 0.

• When the right-hand operand is zero, the integer remainder operator % will throw an ArithmeticException.

• The sign of the remainder is always the same as that of the dividend. For example, -3 % -2 results in the value -1. This behavior may be unexpected.

Refer to guideline INT02-J. Remember that the remainder operator may return a negative result value for more details.

Unary Negation

The result of negating Integer.MIN_VALUE is Integer.MIN_VALUE, because -Integer.MIN_VALUE is logically equivalent to Integer.MAX_VALUE+1 which overflows to Integer.MIN_VALUE.

Once again, the "Use a larger type and downcast" approach suffices to avoid overflow. In some cases, checking for the specific case above may be more efficient.

Absolute Value

A related pitfall is the use of the Math.abs() method that takes a parameter of type int and returns its absolute value. Because of the asymmetry between the two's complement representation of negative and positive integer values (Integer.MAX_VALUE is 2147483647 and Integer.MIN_VALUE is -2,147,483,648, which means there is one more negative integer than positive integers), there is no equivalent positive value (+2,147,483,648) for Integer.MIN_VALUE. Consequenly, the Math.abs() returns Integer.MIN_VALUE when the value of its argument is Integer.MIN_VALUE; this may surprise many programmers.

Once again, the "Use a larger type and downcast" approach suffices to avoid overflow. In some cases, checking for the specific case above may be more efficient.

Shifting

The shift operation in Java has the following properties:

• The right shift is an arithmetic shift.

• The types boolean, float and double cannot use the bit shifting operators.

• If the value to be shifted is of type int, only the five lowest-order bits of the right-hand operand are used as the shift distance. That is, the shift distance is the value of the right-hand operand masked by 31 (0x1F). This results in a value modulo 31, inclusive.

• Wiki Markup
  When the value to be shifted (left-operand) is of type {{long}}, only the last 6 bits of the right-hand operand are used to perform the shift. The shift distance is the value of the right-hand operand masked by 63 (0x3D) \[[JLS 2003|AA. Bibliography#JLS 03]\]. (That is to say, the shift value is always between 0 and 63. If the shift value is greater than 64, then the shift is {{value % 64}}.)

Refer to guideline INT05-J. Use shift operators correctly for further details about the behavior of the shift operators.

Noncompliant Code Example

This noncompliant code example attempts to shift the value {{i}} of type {{int}} until, after 32 iterations, the value becomes 0. Unfortunately, this loop never terminates because an attempt to shift a value of type {{int}} by 32 bits results in the original value rather than the value 0 \[[Bloch 2005|AA. Bibliography#Bloch 05]\]. 

int i = 0;
while ((-1 << i) != 0)
  i++;

Compliant Solution

This compliant solution initially sets the value val to -1 and repeatedly shifts the value by one place on each successive iteration.

for (int val = -1; val != 0; val <<= 1) { /* ... */ }

Noncompliant Code Example (Concurrent Code)

This noncompliant code example uses an AtomicInteger which is part of the concurrency utilities. The concurrency utilities do not enforce checks for integer overflow.

class InventoryManager {
  private final AtomicInteger itemsInInventory = new AtomicInteger(100);

  //...
  public final void returnItem() {
    itemsInInventory++;
  }
} 

Consequently, itemsInInventory may wrap around to Integer.MIN_VALUE after the increment operation.

Noncompliant Code Example (Concurrent Code—TOCTOU Condition in Check)

This noncompliant code example installs a check for integer overflow; however, there is a time-of-check-time-of-use vulnerability between the check and the increment operation.

 left * right;
}

static final int safeDivide(int left, int right) {
  if ((left == Integer.MIN_VALUE) && (right == -1)) {
    throw new ArithmeticException("Integer overflow");
  }
  return left / right;
}

static final int safeNegate(int a) {
  if (a == Integer.MIN_VALUE) {
    throw new ArithmeticException("Integer overflow");
  }
  return -a;
}
static final int safeAbs(int a) {
  if (a == Integer.MIN_VALUE) {
    throw new ArithmeticException("Integer overflow");
  }
  return Math.abs(a);
}

These method calls are likely to be inlined by most just-in-time (JIT) systems.

These checks can be simplified when the original type is char. Because the range of type char includes only positive values, all comparisons with negative values may be omitted.

Noncompliant Code Example

Either operation in this noncompliant code example could result in an overflow. When overflow occurs, the result will be incorrect.

public static int multAccum(int oldAcc, int newVal, int scale) {
  // May result in overflow
  return oldAcc + (newVal * scale);
}

Compliant Solution (Precondition Testing)

This compliant solution uses the safeAdd() and safeMultiply() methods defined in the "Precondition Testing" section to perform secure integral operations or throw ArithmeticException on overflow:

public static int multAccum(int oldAcc, int newVal, int scale) {
  return safeAdd(oldAcc, safeMultiply(newVal, scale));
}

Compliant Solution (Java 8, Math.*Exact())

This compliant solution uses the addExact() and multiplyExact() methods defined in the Math class. These methods were added to Java as part of the Java 8 release, and they also either return a mathematically correct value or throw ArithmeticException. The Math class also provides SubtractExact() and negateExact() but does not provide any methods for safe division or absolute value.

public static int multAccum(int oldAcc, int newVal, int scale) {
  return Math.addExact(oldAcc, Math.multiplyExact(newVal, scale));
}

Compliant Solution (Upcasting)

This compliant solution shows the implementation of a method for checking whether a value of type long falls within the representable range of an int using the upcasting technique. The implementations of range checks for the smaller primitive integer types are similar.

public static long intRangeCheck(long value) {
  if ((value < Integer.MIN_VALUE) || (value > Integer.MAX_VALUE)) {
    throw new ArithmeticException("Integer overflow");
  }
  return value;
}

public static int multAccum(int oldAcc, int newVal, int scale) {
  final long res = intRangeCheck(
   ((long) oldAcc) + intRangeCheck((long) newVal * (long) scale)
  );
  return (int) res; // Safe downcast
}

Note that this approach cannot be applied to values of type long because long is the largest primitive integral type. Use the BigInteger technique instead when the original variables are of type long.

Compliant Solution (BigInteger)

This compliant solution uses the BigInteger technique to detect overflow:

private static final BigInteger bigMaxInt = 
  BigInteger.valueOf(Integer.MAX_VALUE);
private static final BigInteger bigMinInt =    
  BigInteger.valueOf(Integer.MIN_VALUE);

public static BigInteger intRangeCheck(BigInteger val) {
  if (val.compareTo(bigMaxInt) == 1 ||
      val.compareTo(bigMinInt) == -1) {
    throw new ArithmeticException("Integer overflow");
  }
  return val;
}

public static int multAccum(int oldAcc, int newVal, int scale) {
  BigInteger product =
    BigInteger.valueOf(newVal).multiply(BigInteger.valueOf(scale));
  BigInteger res = 
    intRangeCheck(BigInteger.valueOf(oldAcc).add(product));
  return res.intValue(); // Safe conversion
}

Noncompliant Code Example (AtomicInteger)

Operations on objects of type AtomicInteger suffer from the same overflow issues as other integer types. The solutions are generally similar to the solutions already presented; however, concurrency issues add additional complications. First, potential issues with time-of-check, time-of-use (TOCTOU) must be avoided (see VNA02-J. Ensure that compound operations on shared variables are atomic for more information). Second, use of an AtomicInteger creates happens-before relationships between the various threads that access it. Consequently, changes to the number of accesses or order of accesses can alter the execution of the overall program. In such cases, you must either choose to accept the altered execution or carefully craft your implementation to preserve the exact number of accesses and order of accesses to the AtomicInteger.

This noncompliant code example uses an AtomicInteger, which is part of the concurrency utilities. The concurrency utilities lack integer overflow checks.

class InventoryManager {
  private volatilefinal intAtomicInteger itemsInInventory = new AtomicInteger(100);

  // ...

  public final void returnItemnextItem() {
    if (itemsInInventory == itemsInInventory.getAndIncrement();
  }
}

Consequently, itemsInInventory can wrap around to Integer.MIN_VALUE when the nextItem() method is invoked when itemsInInventory == Integer.MAX_VALUE

...

.

Compliant Solution (

...

AtomicInteger)

This compliant solution uses the get() and compareAndSet() methods provided by AtomicInteger to guarantee successful manipulation of the shared value of itemsInInventory. This solution has the following characteristics:

• The number and order of accesses to itemsInInventory remain unchanged from the noncompliant code example.
• All operations on the value of itemsInInventory are performed on a temporary local copy of its value.
• The overflow check in this example is performed in inline code rather than encapsulated in a method call. This is an acceptable alternative implementation. The choice of method call versus inline code should be made according to your organization's standards and needs.

class InventoryManager {
  private final AtomicInteger itemsInInventory =
      new AtomicInteger(100);

  public final void returnItemnextItem() {
    while (true) {
      int old = itemsInInventory.get();
      if (old == Integer.MAX_VALUE) {
        throw new IllegalStateExceptionArithmeticException("OutInteger of boundsoverflow");
      }
      int next = old + 1; // Increment
      if (itemsInInventory.compareAndSet(old, next)) {
        break;
      }
    } // endEnd while
  } // endEnd removeItemnextItem()
} 

...

The {{two arguments to the compareAndSet()}} method takes two arguments, the expected value of a variable when the method is invoked and the updated value. This compliant solution uses this method to atomically set the value of {{itemsInInventory}} to the updated value if and only if the current value equals the expected value \[[API 2006|AA. Bibliography#API 06]\]. The while loop ensures that the {{removeItem()}} method succeeds in decrementing the most recent value of {{itemsInInventory}} as long as the inventory count is greater than {{MIN_INVENTORY}}. Refer to guideline [VNA02-J. Ensure that compound operations on shared variables are atomic] for more details.

Exceptions

INT00-EX1: Depending on circumstances, integer overflow may be benign. For instance, the Object.hashcode() method may return all representable values of type int; further, many algorithms for computing hashcodes intentionally allow overflow to occur.

INT00-EX2: The added complexity and cost of programmer-written overflow checks may exceed their value for all but the most-critical code. In such cases, consider the alternative of treating integral values as though they are tainted data, using appropriate range checks as the notional "sanitizing" code. These range checks should ensure that incoming values cannot cause integer overflow. Note that sound determination of allowable ranges may require deep understanding of the details of the code protected by the range checks; this is non-trivial.

Risk Assessment

Failure to perform appropriate range checking can lead to integer overflows, which may cause unexpected program control flow or unanticipated program behavior.

Automated Detection

Automated detection of integer operations that may potentially overflow is straightforward. Automatic determination of which potential overflows are true errors and which are intended by the programmer is infeasible. Heuristic warnings may be helpful.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Other Languages

...

method are the expected value of the variable when the method is invoked and the intended new value. The variable's value is updated only when the current value and the expected value are equal [API 2006] (refer to VNA02-J. Ensure that compound operations on shared variables are atomic for more details).

Exceptions

NUM00-J-EX0: Depending on circumstances, integer overflow could be benign. For example, many algorithms for computing hash codes use modular arithmetic, intentionally allowing overflow to occur. Such benign uses must be carefully documented.

NUM00-J-EX1: Prevention of integer overflow is unnecessary for numeric fields that undergo bitwise operations and not arithmetic operations (see NUM01-J. Do not perform bitwise and arithmetic operations on the same data for more information).

Risk Assessment

Failure to perform appropriate range checking can lead to integer overflows, which can cause unexpected program control flow or unanticipated program behavior.

Automated Detection

Automated detection of integer operations that can potentially overflow is straightforward. Automatic determination of which potential overflows are true errors and which are intended by the programmer is infeasible. Heuristic warnings might be helpful.

Related Guidelines

...

Android Implementation Details

Mezzofanti for Android contained an integer overflow that prevented the use of a big SD card. Mezzofanti contained an expression:

(int) StatFs.getAvailableBlocks() * (int) StatFs.getBlockSize() 

to calculate the available memory in an SD card, which could result in a negative value when the available memory is larger than Integer.MAX_VALUE. Note that these methods are deprecated in API level 18 and replaced by getAvailableBlocksLong() and getBlockSizeLong().

Bibliography

[API 2006]	Class AtomicInteger
[Bloch 2005]	Puzzle 27, "Shifty i's"
[Bloch 2008]	Item 12, "Minimize the Accessibility of Classes and Members"
[Java Tutorials]	Primitive Data Types
[JLS 2015]	§4.2.1, "Integral Types and Values" §4.2.2, "Integer Operations" §15.22, "Bitwise and Logical Operators"
[Seacord 2005]	Chapter 5, "Integers"
[Seacord 2015]	Image Added IDS17-J. Prevent XML External Entity Attacks LiveLesson

...

Image Added Image Added Image Added

This guideline appears in the C++ Secure Coding Standard as INT32-CPP. Ensure that operations on signed integers do not result in overflow.

Bibliography

\[[Bloch 2005|AA. Bibliography#Bloch 05]\] Puzzle 27: Shifty i's\[[SCG 2007|AA. Bibliography#SCG 07]\] Introduction
\[[JLS 2003|AA. Bibliography#JLS 03]\] 4.2.2 Integer Operations and 15.22 Bitwise and Logical Operators
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 682|http://cwe.mitre.org/data/definitions/682.html] "Incorrect Calculation", [CWE ID 190|http://cwe.mitre.org/data/definitions/190.html] "Integer Overflow or Wraparound", [CWE ID 191|http://cwe.mitre.org/data/definitions/191.html]  "Integer Underflow (Wrap or Wraparound)"
\[[Seacord 2005|AA. Bibliography#Seacord 05]\] Chapter 5. Integers
\[[Tutorials 2008|AA. Bibliography#Tutorials 08]\] Primitive Data Types

06. Integers (INT)      06. Integers (INT)      INT01-J. Check ranges before casting integers to narrower types