Incorrect Conversion between Numeric Types

Draft Base
Structure: Simple
Description

This vulnerability occurs when a program converts a value from one numeric type to another (like a 64-bit integer to a 32-bit integer) and the conversion loses or misinterprets data. If these corrupted values are later used in security-critical operations—like calculating buffer sizes, checking permissions, or performing financial transactions—they can lead to crashes, incorrect behavior, or security bypasses.

Extended Description

At its core, this flaw is about mismatched containers. Think of pouring a gallon of water into a quart-sized bottle; you're going to lose most of the water. In programming, this 'spillage' happens during type casting or implicit conversion when a larger data type (like a `long` or `size_t`) is squeezed into a smaller one (like an `int`). The high-order bits are simply chopped off—a process called truncation—which silently turns a large number into a much smaller, and often positive, number. This is especially dangerous because the code might not crash; it just starts working with wildly incorrect data. Developers most often encounter this when dealing with memory sizes, array indices, or loop counters in code that must work across different architectures (32-bit vs. 64-bit). The primary defense is to proactively validate that a value fits within the target type's range *before* performing the conversion. Use compiler warnings, static analysis tools, and explicit checks with limits defined in headers like `<limits.h>`. Always assume that inputs, especially those derived from user or file data, can exceed your variable's capacity.

Common Consequences 1
Scope: OtherIntegrity

Impact: Unexpected StateQuality Degradation

The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.

Potential Mitigations 1
Phase: Implementation
Avoid making conversion between numeric types. Always check for the allowed ranges.
Demonstrative Examples 4
In the following Java example, a float literal is cast to an integer, thus causing a loss of precision.

Code Example:

Bad
Java
java
This code adds a float and an integer together, casting the result to an integer.

Code Example:

Bad
PHP
php
Normally, PHP will preserve the precision of this operation, making $result = 4.8345. After the cast to int, it is reasonable to expect PHP to follow rounding convention and set $result = 5. However, the explicit cast to int always rounds DOWN, so the final value of $result is 4. This behavior may have unintended consequences.

ID : DX-73

In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.

Code Example:

Bad
C
c
If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

ID : DX-74

In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.

Code Example:

Bad
C
c
If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
Observed Examples 6
CVE-2022-2639Chain: integer coercion error (Integer Coercion Error) prevents a return value from indicating an error, leading to out-of-bounds write (Out-of-bounds Write)
CVE-2021-43537Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (Incorrect Conversion between Numeric Types) and potentially leading to an integer overflow (Integer Overflow or Wraparound). If an integer overflow occurs, this can cause heap memory corruption (Heap-based Buffer Overflow)
CVE-2007-4268Chain: integer signedness error (Signed to Unsigned Conversion Error) passes signed comparison, leading to heap overflow (Heap-based Buffer Overflow)
CVE-2007-4988Chain: signed short width value in image processor is sign extended during conversion to unsigned int, which leads to integer overflow and heap-based buffer overflow.
CVE-2009-0231Integer truncation of length value leads to heap-based buffer overflow.
CVE-2008-3282Size of a particular type changes for 64-bit platforms, leading to an integer truncation in document processor causes incorrect index to be generated.
References 1
Automated Source Code Security Measure (ASCSM)
Object Management Group (OMG)
01-2016
ID: REF-962
Likelihood of Exploit

High

Applicable Platforms
Languages:
C : UndeterminedNot Language-Specific : Undetermined
Modes of Introduction
Implementation
Taxonomy Mapping
  • CERT C Secure Coding
  • CERT C Secure Coding
  • CERT C Secure Coding
  • CERT C Secure Coding
  • The CERT Oracle Secure Coding Standard for Java (2011)
  • Software Fault Patterns
  • OMG ASCSM