485
s = i;
/* s is -1 so it passes the safety check - CWE-697 */
if (s > 256) {
DiePainfully("go away!\n");
}
/* s is sign-extended and saved in sz */
sz = s;
/* output: i=65535, s=-1, sz=4294967295 - your mileage may vary */
printf("i=%d, s=%d, sz=%u\n", i, s, sz);
input = GetUserInput("Enter pathname:");
/* strncpy interprets s as unsigned int, so it's treated as MAX_INT
(CWE-195), enabling buffer overflow (CWE-119) */
strncpy(path, input, s);
path[255] = '\0'; /* don't want CWE-170 */
printf("Path is: %s\n", path);
}
This code first exhibits an example of CWE-839, allowing "s" to be a negative number. When the
negative short "s" is converted to an unsigned integer, it becomes an extremely large positive
integer. When this converted integer is used by strncpy() it will lead to a buffer overflow (CWE-119).
Observed Examples
Reference Description
CVE-2022-2639 Chain: integer coercion error (CWE-192) prevents a return value from
indicating an error, leading to out-of-bounds write (CWE-787)
https://www.cve.org/CVERecord?id=CVE-2022-2639
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 738 CERT C Secure Coding Standard (2008) Chapter 5 -
Integers (INT)
734 2342
MemberOf 872 CERT C++ Secure Coding Section 04 - Integers (INT) 868 2374
MemberOf 1158 SEI CERT C Coding Standard - Guidelines 04. Integers
(INT)
1154 2456
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Maintenance
Within C, it might be that "coercion" is semantically different than "casting", possibly depending
on whether the programmer directly specifies the conversion, or if the compiler does it implicitly.
This has implications for the presentation of this entry and others, such as CWE-681, and
whether there is enough of a difference for these entries to be split.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Integer coercion error
CERT C Secure Coding INT02-C Understand integer conversion rules
CERT C Secure Coding INT05-C Do not use input functions to convert
character data if they cannot handle all
possible inputs
CERT C Secure Coding INT31-C Exact Ensure that integer conversions do not
result in lost or misinterpreted data
References
CWE Version 4.14
CWE-193: Off-by-one Error
CWE-193: Off-by-one Error