| Wiki Markup |
|---|
Conversions can occur explicitly as the result of a cast or implicitly as required by an operation. While conversions are generally required for the correct execution of a program, they can also lead to lost or misinterpreted data. Conversion of an operand value to a compatible type causes no change to the value or the representation \[[ISO/IEC 9899-:1999|AA. C References#ISO/IEC 9899-1999]\]. |
...
Integer types smaller than int are promoted when an operation is performed on them. If all values of the original type can be represented as an int, the value of the smaller type is converted to an int; otherwise, it is converted to an unsigned int. Integer promotions are applied as part of the usual arithmetic conversions to certain argument expressions, operands of the unary +, -, and ~ operators, and operands of the shift operators. The following code fragment illustrates shows the application of integer promotions:
...
Care must be taken when performing operations on mixed types. This non-compliant code example illustrates shows an idiosyncrasy of integer promotions.
...
This vulnerability in Adobe Flash arises because Flash passes a signed integer to calloc(). An attacker has control over this integer, and can send negative numbers. Since calloc() takes size_t, which is unsigned, the negative number is converted to a very large number, which is generally too big to allocate, and thus as a result calloc() returns NULL, thus as a result permitting the vulnerability to exist.
...
| Wiki Markup |
|---|
\[[Dowd 06|AA. C References#Dowd 06]\] Chapter 6, "C Language Issues" (Type Conversions 223-270) \[[ISO/IEC 9899-:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.3, "Conversions" \[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "FLC Numeric Conversion Errors" \[[MISRA 04|AA. C References#MISRA 04]\] Rules 10.1, 10.3, 10.5, and 12.9 \[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 192|http://cwe.mitre.org/data/definitions/192.html], "Integer Coercion Error"; [CWE ID 197|http://cwe.mitre.org/data/definitions/197.html], "Numeric Truncation Error" \[[Seacord 05|AA. C References#Seacord 05]\] Chapter 5, "Integers" |
...