Guarantee that Integer conversions do not result in lost or misinterpreted data

Integer conversions, including implicit and explicit (using a cast) must be guaranteed not to result in lost or misinterpreted data. The only integer type conversions that are guaranteed to be safe for all data values and all possible conforming implementations are conversions of an integral value to a wider type of the same signedness.

Non-Compliant Solution 1

Type range errors including loss of data (truncation) and loss of sign (sign errors) can occur when converting from an unsigned type to a signed type. The following code is likely to result in a truncation error for almost all implementations:

unsigned long int ul = ULONG_MAX;
signed car sc;
sc = (signed char)ul; /* cast eliminates warning */

Compliant Solution 1

Validate ranges when converting from an unsigned type to a signed type.  The following code, for example, can be used when converting from unsigned long int to a signed char.

unsigned long int ul = ULONG_MAX;
signed car sc;
if (i <= SCHAR_MAX) {
  sc = (signed char)ul;  /* use cast to eliminate warning */
}
else {
	/* handle error condition */
}

Non-Compliant Solution 2

Type range errors including loss of data (truncation) and loss of sign (sign errors) can occur when converting from a signed type to an unsigned type.  The following code results in a loss of sign:

signed int si = INT_MIN;
unsigned int ui;
si = (unsigned int)ui;  /* cast eliminates warning */

Compliant Solution 3

Validate ranges when converting from a signed type to an unsigned type.  The following code, for example, can be used when converting from signed int to unsigned int.

signed int si = INT_MIN;
unsigned int ui;
if ( (si < 0) || (si > UINT_MAX) ) {
  /* handle error condition */
}
else {
  si = (unsigned int)ui;  /* cast eliminates warning */
}

NOTE: While unsigned types can usually represent all positive values of the corresponding signed type this relationship is not guaranteed by the C99 standard.

Non-Compliant Solution 3

A loss of data (truncation) can occur when converting from signed type to a signed type with less precision. The following code, the following code is likely to result in a truncation error for most all implementations:

signed long int sl = LONG_MAX;
signed car sc;
sc = (signed char)sl; /* cast eliminates warning */

Compliant Solution 3

Validate ranges when converting from an unsigned type to a signed to a signed type. The following code can be used, for example, to convert from an signed long int to a signed char:

signed long int sl = LONG_MAX;
signed car sc;
if ( (sl < SCHAR_MIN) || (sl > SCHAR_MAX) ) {
	/* handle error condition */
}
else {
	sc = (signed char)sl; /* use cast to eliminate warning */
}

Conversions from signed types with greater precision to signed types with lesser precision require both the upper and lower bounds to be checked.

Non-Compliant Solution 4

A loss of data (truncation) can occur when converting from unsigned type to a unsigned type with less precision. The following code is likely to result in a truncation error for most all implementations:

unsigned long int ul = ULONG_MAX;
unsigned car uc;
uc = (unsigned char)ul;  /* cast eliminates warning */

Compliant Solution 4

Validate ranges when converting from an unsigned type to a signed to a signed type. The following code can be used, for example, to convert from an unsigned long int to an unsigned char:

unsigned long int ul = ULONG_MAX;
unsigned car uc;
if (ul > UCHAR_MAX) ) {
	/* handle error condition */
}
else {
	uc = (unsigned char)ul; /* use cast to eliminate warning */
}

Exceptions

C99 defines minimum ranges for standard integer types.  For example, the minimum range for an object of type unsigned short int is 0-65,535---while the minimum range for int is -32,767 to +32,767.  This means that it is not always possible to represent all possible values of an unsigned short int as an int.  However, on the IA-32 architecture, for example, the actual integer range is from -2,147,483,648 +2,147,483,647 meaning that is quite possible to represent all the values of an unsigned short int as an int on this platform.  As a result, it is not necessary to provide a test for this conversion on IA-32.  It is not possible to make assumptions about conversions without knowing the precision of the underlying types.  If these tests are not provided, assumptions concerning precision must be clearly documented as the resulting code cannot safely ported to a system where these assumptions are invalid.