495
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Conversion between signed and unsigned values can lead
to a variety of errors, but from a security standpoint is most
commonly associated with integer overflow and buffer
overflow vulnerabilities.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
In this example the variable amount can hold a negative value when it is returned. Because the
function is declared to return an unsigned int, amount will be implicitly converted to unsigned.
Example Language: C (Bad)
unsigned int readdata () {
int amount = 0;
...
if (result == ERROR)
amount = -1;
...
return amount;
}
If the error condition in the code above is met, then the return value of readdata() will be
4,294,967,295 on a system that uses 32-bit integers.
Example 2:
In this example, depending on the return value of accecssmainframe(), the variable amount can
hold a negative value when it is returned. Because the function is declared to return an unsigned
value, amount will be implicitly cast to an unsigned number.
Example Language: C (Bad)
unsigned int readdata () {
int amount = 0;
...
amount = accessmainframe();
...
return amount;
}
If the return value of accessmainframe() is -1, then the return value of readdata() will be
4,294,967,295 on a system that uses 32-bit integers.
Example 3:
CWE Version 4.14
CWE-195: Signed to Unsigned Conversion Error
CWE-195: Signed to Unsigned Conversion Error