Page History

If a floating-point value is to be demoted converted to a floating-point value of a smaller range and precision or to an integer type, or if an integer type is to be converted to a floating-point type, the value must be represented representable in the new destination type.

Wiki MarkupSection The C Standard, 6.3.1.4 of C99 \[[, paragraph 2 [ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] says2024], says,

When a finite value of real decimal floating type is converted to an integer type other than _Boolbool, the fractional part is discarded (i.e. , the value is truncated toward zero). If the value of the integral part cannot be represented by the integer type, the behavior is undefined."invalid" floating-point exception shall be raised and the result of the conversion is unspecified.

Paragraph 2 of the same subclause says,

When a value of integer type is converted to a real standard floating type, if the value being converted can be represented exactly in the new type, it is unchanged. If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined.

And section subclause 6.3.1.5, paragraph 1+2, says,

When a double is demoted to float, a long double is demoted to double or float, or a value being represented in greater precision and range than required by its semantic type (see 6.3.1.8) is explicitly converted (including to its own type)value of real floating type is converted to a real floating type, if the value being converted can be represented exactly in the new type, it is unchanged.

When a value of real floating type is converted to a standard floating type, if If the value being converted is in the range of values that can be represented but cannot be represented exactly, the result is either the nearest higher or nearest lower representable value, chosen in an implementation-defined manner. If the value being converted is outside the range of values that can be represented, the behavior is undefined. 

See also undefined behavior 15 and 16 in Annex J of the same standard.Consequently, in implementations that do not allow for the representation of all numbers, conversions of numbers between zero and FLT_MIN may result in undefined behaviorbehaviors 17 and 18.

This rule does not apply to demotions of floating-point types on implementations that support signed infinity, such as IEEE 754, as all numbers values are representablewithin range.

Noncompliant Code Example (

...

float to int)

This noncompliant code example leads to undefined behavior if the integral part of f1 f_a cannot be represented as an integer.:

void func(float f_a) {
  int i_a;
 
  
float f1;
int i1;

/* initialize fl */

i1 = f1; /* Undefined if the integral part of f1 > INT_MAXf_a cannot be represented. */
  i_a = f_a;
}

Compliant Solution (

...

float to int)

This compliant solution assumes that the range of floating-point values is greater than that of an int. (This is the case in almost all implementations.) Unfortunately, there is no safe way to inquire about this assumption in the code short of already knowing the implementationtests to ensure that the float value will fit within the int variable before performing the assignment.

float f1;
int i1;

/* initialize fl */

if (f1 > (float) INT_MAX || f1 < (float) INT_MIN) {
  #include <float.h>
#include <limits.h>
#include <math.h>
#include <stddef.h>
#include <stdint.h>
 
extern size_t popcount(uintmax_t); /* See INT35-C */
#define PRECISION(umax_value) popcount(umax_value)
 
void func(float f_a) {
  int i_a;
 
  if (isnan(f_a) ||
      PRECISION(INT_MAX) < log2f(fabsf(f_a)) ||
      (f_a != 0.0F && fabsf(f_a) < FLT_MIN)) {
    /* Handle error */
  } else {
    i1i_a = f1;f_a;
  }
}

Noncompliant Code Example (

...

Narrowing Conversion)

This noncompliant code example contains attempts to perform conversions that may be result in truncating values outside of the range of the demoted destination types. :

void func(double d_a, long double big_d) {
  double d_b
long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

f1 = (float)d1big_d;
f2  float f_a = (float)ldd_a;
d2  float f_b = (doublefloat)ldbig_d;
}

As a result of these conversions, it is possible that d1 d_a is outside the range of values that can be represented by a float or that ld big_d is outside the range of values that can be represented as either a float or a double. If this is the case, the result is undefined on implementations that do not support Annex F, "IEC 60559 Floating-Point Arithmetic."

Compliant Solution (

...

Narrowing Conversion)

This compliant solution checks to see whether the values to be stored can be represented in the new type.:

#include <float.h>
#include <float<math.h>
 
void func(double d_a, long double ld;
double d1;
double d2;
float f1;
float f2;

/* initializations */

if (d1 > FLT_MAX || d1 < -FLT_MAX) {
big_d) {
  double d_b;
  float f_a;
  float f_b;

  if (d_a != 0.0 &&
      (isnan(d_a) ||
       isgreater(fabs(d_a), FLT_MAX) ||
       isless(fabs(d_a), FLT_MIN))) {
    /* Handle error condition */
  } else {
   f1 f_a = (float)d1d_a;
  }
  if (ld >big_d != 0.0 &&
      (isnan(big_d) ||
       isgreater(fabs(big_d), FLT_MAX) || ld < -FLT_MAX
       isless(fabs(big_d), FLT_MIN))) {
    /* Handle error condition */
  } else {
  f2  f_b = (float)ldbig_d;
  }
  if (big_d != (ld >0.0 &&
      (isnan(big_d) ||
       isgreater(fabs(big_d), DBL_MAX) || ld < -DBL_MAX
       isless(fabs(big_d), DBL_MIN))) {
    /* Handle error condition */
  } else {
   d2 d_b = (double)ldbig_d;
  }  
}

Risk Assessment

Failing to check that Converting a floating-point value to a floating-point value fits within a demoted type of a smaller range and precision or to an integer type, or converting an integer type to a floating-point type, can result in a value too large to be represented by the new type, resulting in undefined behaviorthat is not representable in the destination type and is undefined behavior on implementations that do not support Annex F.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: FLP34-CPP. Ensure that floating point conversions are within range of the new type

...

Key here (explains table format and definitions)

...

...

...

...

...

...

...

...

...

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-197 and FLP34-C

Independent( FLP34-C, INT31-C) FIO34-C = Subset( INT31-C)

CWE-197 = Union( FLP34-C, INT31-C)

CWE-195 and FLP34-C

Intersection( CWE-195, FLP34-C) = Ø

Both conditions involve type conversion. However, CWE-195 explicitly focuses on conversions between unsigned vs signed types, whereas FLP34-C focuses on floating-point arithmetic.

CWE-681 and FLP34-C

CWE-681 = Union( FLP34-C, INT31-C)

Bibliography

...

Image Added Image Added Image Added

Bibliography

\[[IEEE 754|AA. Bibliography#IEEE 754 2006]\] IEEE 754-1985 Standard for Binary Floating-Point Arithmetic

FLP33-C. Convert integers to floating point for floating point operations      05. Floating Point (FLP)      void FLP35-C. Take granularity into account when comparing floating point values