 
                            ...
Failure to cast integers before comparing or assigning them to a larger integer size can result in software vulnerabilities that can allow the execution of arbitrary code by an attacker with the permissions of the vulnerable process.
| Rule | Severity | Likelihood | 
|---|
| Detectable | Repairable | Priority | Level | 
|---|---|---|---|
| INT18-C | High | 
| Likely | 
| No | 
| Yes | P18 | L1 | 
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée | 
 | Supported, but no explicit checker | |||||||
| CodeSonar | 
 | LANG.TYPE.AWID | Expression value widened by assignment | ||||||
| Compass/ROSE | 
| Can detect violations of this rule. It should look for patterns of  
 | |||
| Coverity | 6.5 | OVERFLOW_BEFORE_WIDEN | Fully | 
5.0
Can detect violations of this rule with CERT C Rule Pack
1890
1891
1892
1893
1894
1895
2790 (C)
| implemented | |||||||||
| Helix QAC | 
 | C1890, C1891, C1892, C1893, C1894, C1895, C4490, C4491, C4492 | |||||||
| Klocwork | 
 | PORTING.CAST.SIZE | |||||||
| LDRA tool suite | 
 | 452 S | Partially implemented | ||||||
| Parasoft C/C++test | 
 | CERT_C-INT18-a | Avoid possible integer overflow in expressions in which the result is assigned to a variable of a wider integer type | ||||||
| Polyspace Bug Finder | 
 | Checks for integer overflow and unsigned integer overflow (rec. fully covered) | 
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ | 
| Coding Standard | INT35-CPP. Evaluate integer expressions in a larger size before comparing or assigning to that size | 
| ISO/IEC TR 24772:2013 | Numeric Conversion Errors [FLC] | 
| MITRE CWE | CWE-681, Incorrect conversion between numeric types CWE-190, Integer overflow (wrap or wraparound) | 
Bibliography
| [Dowd 2006] | Chapter 6, "C Language Issues" | 
| [Seacord 2013] | Chapter 5, "Integer Security" | 
...
...