Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Updated references from C11->C23

If a floating-point value is to be converted to a floating-point value of a smaller range and precision or to an integer type, or if an integer type is to be converted to a floating-point type, the value must be representable in the destination type.

The C Standard, Wiki MarkupFrom 6.3.1.5 of the C99 standard \[4, paragraph 2 [ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\]:9899:2024], says,

When a finite value of decimal floating type is converted to an integer type other than bool, the fractional part is discarded (i.e. the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the "invalid" floating-point exception shall be raised and the result of the conversion is unspecified.

Paragraph 2 of the same subclause says,

When a value of integer type is converted to a standard floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And subclause 6.3.1.5, paragraph 1+2, says,

When a value of real floating type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged.

When a value of real floating type is converted to a standard floating type, if the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is When a double is demoted to float or a long double is demoted to double or float...if the value being converted is outside the range of values that can be represented, the behavior is undefined. 

See undefined behaviors 17 and 18.

This rule does not apply to machines demotions of floating-point types on implementations that support signed infinity, such as ones that support IEEE - 754, as all numbers values are representable.

For some non-IEEE-754 machines, conversions of too small numbers (between zero and FLT_MIN) might produce underflow exceptions that might be considered undefined.

Non-Compliant Code Example

This non-compliant code example illustrates possible undefined behavior associated with demoting floating point represented numbers.

within range.

Noncompliant Code Example (float to int)

This noncompliant code example leads to undefined behavior if the integral part of f_a cannot be represented as an integer:

Code Block
bgColor#ffcccc
langc
void func(float f_a) {
  int i_a;
 
  /* Undefined if the integral part of f_a cannot be represented. */
  i_a = f_a;
}

Compliant Solution (float to int)

This compliant solution tests to ensure that the float value will fit within the int variable before performing the assignment.

Code Block
bgColor#ccccff
langc
#include <float.h>
#include <limits.h>
#include <math.h>
#include <stddef.h>
#include <stdint.h>
 
extern size_t popcount(uintmax_t); /* See INT35-C */
#define PRECISION(umax_value) popcount(umax_value)
 
void func(float f_a) {
  int i_a;
 
  if (isnan(f_a) ||
      PRECISION(INT_MAX) < log2f(fabsf(f_a)) ||
      (f_a != 0.0F && fabsf(f_a) < FLT_MIN)) {
    /* Handle error */
  } else {
    i_a = f_a;
  }
}

Noncompliant Code Example (Narrowing Conversion)

This noncompliant code example attempts to perform conversions that may result in truncating values outside the range of the destination types:

Code Block
bgColor#FFCCCC
langc
void func(double d_a, long double big_d) {
  double d_b = (float)big_d;
  float f_a = (float)d_a;
  float f_b = (float)big_d;
}
Code Block
bgColor#FFCCCC

long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

f1 = (float)d1;
f2 = (float)ld;
d2 = (double)ld;

As a result of these conversions, it is possible that d1 d_a is outside the range of values that can be represented by a float or that ld big_d is outside the range of values that can be represented as either a float or a double. If this is the case, the result is undefined on implementations that do not support Annex F, "IEC 60559 Floating-Point Arithmetic."

Compliant Solution (Narrowing Conversion)

This compliant solution properly checks to see whether the values to be stored can be represented in the new type.:

Code Block
bgColor#ccccff
langc
#include <float.h>
#include <float<math.h>
 
void func(double d_a, long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

if (d1 > FLT_MAX || d1 < -FLT_MAX) {
  	 big_d) {
  double d_b;
  float f_a;
  float f_b;

  if (d_a != 0.0 &&
      (isnan(d_a) ||
       isgreater(fabs(d_a), FLT_MAX) ||
       isless(fabs(d_a), FLT_MIN))) {
    /* Handle error condition */
  } else {
 	f1   f_a = (float)d1d_a;
  }
  if (ld >big_d != 0.0 &&
      (isnan(big_d) ||
       isgreater(fabs(big_d), FLT_MAX) || ld < -FLT_MAX
       isless(fabs(big_d), FLT_MIN))) {
	    /* Handle error condition */
  } else {
	f2    f_b = (float)ldbig_d;
  }
  if (ld >big_d != 0.0 &&
      (isnan(big_d) ||
       isgreater(fabs(big_d), DBL_MAX) || ld < -DBL_MAX
       isless(fabs(big_d), DBL_MIN))) {
	    /* Handle error condition */
  } else {
	d2    d_b = (double)ldbig_d;
  }  
}

Risk

...

Assessment

Converting a floating-point value to Failing to check that a floating-point value fits within a demoted type of a smaller range and precision or to an integer type, or converting an integer type to a floating-point type, can result in a value too large to be represented by the new type, resulting in undefined behaviorthat is not representable in the destination type and is undefined behavior on implementations that do not support Annex F.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

FLP34-C

1 (low)

1 (unlikely)

3 (low)

Low

Unlikely

Low

P3

L3

Automated Detection

Tool

...

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

Supported

Astrée reports all potential overflows resulting from floating-point conversions.

Compass/ROSE



Can detect some violations of this rule. However, it does not flag implicit casts, only explicit ones

CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

LANG.TYPE.IAT

Inappropriate Assignment Type

Coverity

Include Page
Coverity_V
Coverity_V

MISRA_CAST (needs verification)

Can detect instances where implicit float conversion is involved: implicitly converting a complex expression with integer type to floating type, implicitly converting a double expression to narrower float type (may lose precision), implicitly converting a complex expression from float to double, implicitly converting from float to double in a function argument, and so on

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C4450, C4451, C4452, C4453, C4454, C4462, C4465

C++3011


Klocwork

Include Page
Klocwork_V
Klocwork_V

MISRA.CAST.FLOAT.WIDER
MISRA.CAST.FLOAT.INT
MISRA.CAST.INT_FLOAT
MISRA.CONV.FLOAT


LDRA tool suite
Include Page
LDRA_V
LDRA_V
435 S, 93 SPartially implemented
Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V
CERT_C-FLP34-a
CERT_C-FLP34-b

Avoid implicit conversions from wider to narrower floating type
Avoid implicit conversions of floating point numbers from wider to narrower floating type

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

735, 736,
915, 922,
9118, 9227

Partially supported

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule FLP34-C

Checks for float conversion overflow (rule partially covered)

PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V615, V2003, V2004
TrustInSoft Analyzer

Include Page
TrustInSoft Analyzer_V
TrustInSoft Analyzer_V

float_to_int

Exhaustively verified (see one compliant and one non-compliant example).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

...

Related Guidelines

Key here (explains table format and definitions)

Taxonomy

Taxonomy item

Relationship

CERT Oracle Secure Coding Standard for JavaNUM12-J. Ensure conversions of numeric types to narrower types do not result in lost or misinterpreted dataPrior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TR 24772:2013Numeric Conversion Errors [FLC]Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11CWE-681, Incorrect Conversion between Numeric Types2017-06-29: CERT: Rule subset of CWE
CWE 2.11CWE-1972017-06-14: CERT: Rule subset of CWE

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-197 and FLP34-C

Independent( FLP34-C, INT31-C) FIO34-C = Subset( INT31-C)

CWE-197 = Union( FLP34-C, INT31-C)

CWE-195 and FLP34-C

Intersection( CWE-195, FLP34-C) = Ø

Both conditions involve type conversion. However, CWE-195 explicitly focuses on conversions between unsigned vs signed types, whereas FLP34-C focuses on floating-point arithmetic.

CWE-681 and FLP34-C

CWE-681 = Union( FLP34-C, INT31-C)

Bibliography

...

6.3.1.

...

4,

...

"Real Floating and Integer"
Subclause 6.3.1.5, "Real Floating Types"


...

Image Added Image Added Image Added floating types" [IEEE 754-1985] IEEE 754-1985 Standard for Binary Floating-Point ArithmeticFLP33-C. Convert integers to floating point for floating point operations      05. Floating Point (FLP)       06. Arrays (ARR)