Type conversions occur explicitly as the result of a cast or implicitly as required by an operation. While conversions are generally required for the correct execution of a program, they can also lead to lost or misinterpreted data.
The C99 standard rules define how C compilers handle conversions. These rules include integer promotions, integer conversion rank, and the usual arithmetic conversions.
Misunderstanding integer conversion rules can lead to integer errors, which in turn can lead to exploitable vulnerabilities.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
INT02-A |
2 (medium) |
2 (probable) |
2 (medium) |
P8 |
L2 |
Examples of vulnerabilities resulting from the violation of this recommendation can be found on the CERTwebsite.
\[[Dowd 06|AA. C References#Dowd 06]\] Chapter 6, "C Language Issues" (Type Conversions 223-270) \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.3, "Conversions" \[[Seacord 05|AA. C References#Seacord 05]\] Chapter 5, "Integers" |