Page History

...

Failure to cast integers before comparing or assigning them to a larger integer size can result in software vulnerabilities that can allow the execution of arbitrary code by an attacker with the permissions of the vulnerable process.

Rule	Severity	Likelihood	Detectable	RepairableRemediation Cost	Priority	Level
INT18-C	High	Likelyhigh	likelyNo	mediumYes	P18	L1

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

Supported, but no explicit checker

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

LANG.TYPE.AWID
LANG.TYPE.OWID
LANG.CAST.VALUE
LANG.CAST.COERCE
ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
MISC.MEM.SIZE.ADDOFLOW
MISC.MEM.SIZE.BAD
MISC.MEM.SIZE.MULOFLOW
MISC.MEM.SIZE.SUBUFLOW
MISC.MEM.SIZE.TRUNC

Expression value widened by assignment
Expression value widened by other operand
Cast alters value
Coercion alters value
Addition overflow of allocation size
Integer overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Addition overflow of size
Unreasonable size argument
Multiplication overflow of size
Subtraction underflow of size
Truncation of size

Compass/ROSE

Can detect violations of this rule. It should look for patterns of (a op1 b) op2 c where

- c has a bigger type than a or b
- Neither a nor b is typecast to c's type
- op2 is assignment or comparison

Coverity 6.5 OVERFLOW_BEFORE_WIDEN Fully implemented

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C1890, C1891, C1892, C1893, C1894, C1895, C4490, C4491, C4492

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

PORTING.CAST.SIZE

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

452 S

Partially implemented

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-INT18-a
CERT_C-INT18-b
CERT_C-INT18-c

Avoid possible integer overflow in expressions in which the result is assigned to a variable of a wider integer type
Avoid possible integer overflow in expressions in which the result is compared to an expression of a wider integer type
Avoid possible integer overflow in expressions in which the result is cast to a wider integer type

Polyspace Bug Finder

R2016a

Integer conversion overflow

Integer overflow

Unsigned integer conversion overflow

Unsigned integer overflow

Overflow when converting between integer types

Overflow from operation between integers

Overflow when converting between unsigned integer types

Overflow from operation between unsigned integers

PRQA QA-C

Include Page