Incorrect Type Conversion or Cast

Incomplete Class

Structure: Simple

Description

This vulnerability occurs when software incorrectly changes data from one type to another, leading to unexpected behavior or security flaws.

Extended Description

Incorrect type conversion, often called a type confusion or type casting bug, happens when a developer assumes a piece of data is one kind of object or structure (like an integer, string, or class instance) but the program treats it as another. This mismatch can cause the application to misinterpret the data's meaning, access the wrong memory locations, or call incorrect functions, which attackers can exploit to crash the system, leak information, or execute arbitrary code. These issues are common in languages that allow manual type casting (like C/C++) or have weak typing, but they can also appear in higher-level languages during serialization, inter-process communication, or when using reflection. To prevent this, developers should validate data types before conversion, use safe casting functions provided by the language, and implement strict input validation at all system boundaries.

Common Consequences 1

Scope: Other

Impact: Other

Detection Methods 1

FuzzingHigh

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

Demonstrative Examples 2

ID : DX-74

In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.

Code Example:Bad
C
c

If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.

ID : DX-188

The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.

Code Example:

Bad

/* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. /

The code intends to process the message as a NAME_TYPE, and sets the default message to "Hello World." However, since both buf.name and buf.nameID are part of the same union, they can act as aliases for the same memory location, depending on memory layout after compilation.

As a result, modification of buf.nameID - an int - can effectively modify the pointer that is stored in buf.name - a string.

Execution of the program might generate output such as:

``` Pointer of name is 10830 Pointer of name is now 10831 Message: ello World ```

Notice how the pointer for buf.name was changed, even though buf.name was not explicitly modified.

In this case, the first "H" character of the message is omitted. However, if an attacker is able to fully control the value of buf.nameID, then buf.name could contain an arbitrary pointer, leading to out-of-bounds reads or writes.

Observed Examples 2

CVE-2021-43537Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (Incorrect Conversion between Numeric Types) and potentially leading to an integer overflow (Integer Overflow or Wraparound). If an integer overflow occurs, this can cause heap memory corruption (Heap-based Buffer Overflow)

CVE-2022-3979Chain: data visualization program written in PHP uses the "!=" operator instead of the type-strict "!==" operator (Use of Incorrect Operator) when validating hash values, potentially leading to an incorrect type conversion (Incorrect Type Conversion or Cast)

References 1

Automated Source Code Reliability Measure (ASCRM)

Object Management Group (OMG)

01-2016

http://www.omg.org/spec/ASCRM/1.0/

ID: REF-961

Applicable Platforms

Languages:

C : OftenC++ : OftenNot Language-Specific : Undetermined

Modes of Introduction

Implementation

Related Weaknesses

ChildOf:

Improper Control of a Resource Through its Lifetime (CWE-664)

Taxonomy Mapping

CERT C Secure Coding
CERT C Secure Coding
CERT C Secure Coding
CERT C Secure Coding
CERT C Secure Coding
CERT C Secure Coding
Software Fault Patterns
OMG ASCRM