Signed to Unsigned Conversion Error

Draft Variant

Structure: Simple

Description

This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative, the conversion produces a large, unexpected positive number instead of an error, breaking the program's logic.

Extended Description

Implicit conversions between signed and unsigned numbers are a common source of bugs because they happen silently during assignments or function calls. Developers often assume the value remains semantically the same, but a negative signed number becomes a very large unsigned number. This violates program assumptions and can lead to incorrect calculations, infinite loops, or flawed condition checks. A critical risk emerges when these converted values control memory operations. Many functions return negative numbers to signal errors (like -1). If such a return value is passed directly as a 'size' argument to functions like memcpy() or malloc(), the implicit conversion turns the failure indicator into a massive allocation or copy length. This typically causes a buffer overflow, crashing the program or creating a serious security exploit.

Common Consequences 1

Scope: Integrity

Impact: Unexpected State

Conversion between signed and unsigned values can lead to a variety of errors, but from a security standpoint is most commonly associated with integer overflow and buffer overflow vulnerabilities.

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Demonstrative Examples 6

ID : DX-73

In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.

Code Example:Bad
C
c

If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

ID : DX-74

In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.

Code Example:Bad
C
c

If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

ID : DX-21

The following code is intended to read an incoming packet from a socket and extract one or more headers.

Code Example:Bad
C
c

The code performs a check to make sure that the packet does not contain too many headers. However, numHeaders is defined as a signed int, so it could be negative. If the incoming packet specifies a value such as -3, then the malloc calculation will generate a negative number (say, -300 if each header can be a maximum of 100 bytes). When this result is provided to malloc(), it is first converted to a size_t type. This conversion then produces a large value such as 4294966996, which may cause malloc() to fail or to allocate an extremely large amount of memory (Signed to Unsigned Conversion Error). With the appropriate negative numbers, an attacker could trick malloc() into using a very small positive number, which then allocates a buffer that is much smaller than expected, potentially leading to a buffer overflow.

This example processes user input comprised of a series of variable-length structures. The first 2 bytes of input dictate the size of the structure to be processed.

Code Example:Bad
C
c

The programmer has set an upper bound on the structure size: if it is larger than 512, the input will not be processed. The problem is that len is a signed short, so the check against the maximum structure length is done with signed values, but len is converted to an unsigned integer for the call to memcpy() and the negative bit will be extended to result in a huge value for the unsigned integer. If len is negative, then it will appear that the structure has an appropriate size (the if branch will be taken), but the amount of memory copied by memcpy() will be quite large, and the attacker will be able to overflow the stack with data in strm.

ID : DX-114

In the following example, it is possible to request that memcpy move a much larger segment of memory than assumed:

Code Example:

Bad

/* if chunk info is valid, return the size of usable memory,*

If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is not checked before the memcpy operation (Unchecked Return Value), so -1 can be passed as the size argument to memcpy() (Buffer Access with Incorrect Length Value). Because memcpy() assumes that the value is unsigned, it will be interpreted as MAXINT-1 (Signed to Unsigned Conversion Error), and therefore will copy far more memory than is likely available to the destination buffer (Out-of-bounds Write, Access of Memory Location After End of Buffer).

ID : DX-138

This example shows a typical attempt to parse a string with an error resulting from a difference in assumptions between the caller to a function and the function's action.

Code Example:

Bad

int proc_msg(char *s, int msg_len) {

// Note space at the end of the string - assume all strings have preamble with space* int pre_len = sizeof("preamble: "); char buf[pre_len - msg_len];

char *s = "preamble: message\n"; char *sl = strchr(s, ':'); // Number of characters up to ':' (not including space) int jnklen = sl == NULL ? 0 : sl - s; // If undefined pointer, use zero length int ret_val = proc_msg ("s", jnklen); // Violate assumption of preamble length, end up with negative value, blow out stack

The buffer length ends up being -1, resulting in a blown out stack. The space character after the colon is included in the function calculation, but not in the caller's calculation. This, unfortunately, is not usually so obvious but exists in an obtuse series of calculations.

Observed Examples 2

CVE-2025-27363Font rendering library does not properly handle assigning a signed short value to an unsigned long (Signed to Unsigned Conversion Error), leading to an integer wraparound (Integer Overflow or Wraparound), causing too small of a buffer (Incorrect Calculation of Buffer Size), leading to an out-of-bounds write (Out-of-bounds Write).

CVE-2007-4268Chain: integer signedness error (Signed to Unsigned Conversion Error) passes signed comparison, leading to heap overflow (Heap-based Buffer Overflow)

References 2

The Art of Software Security Assessment

Mark Dowd, John McDonald, and Justin Schuh

Addison Wesley

2006

ID: REF-62

The CLASP Application Security Process

Secure Software, Inc.

2005

https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf(2024-11-17)

ID: REF-18