1497
the explicit cast to int always rounds DOWN, so the final value of $result is 4. This behavior may
have unintended consequences.
Example 3:
In this example the variable amount can hold a negative value when it is returned. Because the
function is declared to return an unsigned int, amount will be implicitly converted to unsigned.
Example Language: C (Bad)
unsigned int readdata () {
int amount = 0;
...
if (result == ERROR)
amount = -1;
...
return amount;
}
If the error condition in the code above is met, then the return value of readdata() will be
4,294,967,295 on a system that uses 32-bit integers.
Example 4:
In this example, depending on the return value of accecssmainframe(), the variable amount can
hold a negative value when it is returned. Because the function is declared to return an unsigned
value, amount will be implicitly cast to an unsigned number.
Example Language: C (Bad)
unsigned int readdata () {
int amount = 0;
...
amount = accessmainframe();
...
return amount;
}
If the return value of accessmainframe() is -1, then the return value of readdata() will be
4,294,967,295 on a system that uses 32-bit integers.
Observed Examples
Reference Description
CVE-2022-2639 Chain: integer coercion error (CWE-192) prevents a return value from
indicating an error, leading to out-of-bounds write (CWE-787)
https://www.cve.org/CVERecord?id=CVE-2022-2639
CVE-2021-43537 Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit
integer (CWE-681) and potentially leading to an integer overflow (CWE-190).
If an integer overflow occurs, this can cause heap memory corruption
(CWE-122)
https://www.cve.org/CVERecord?id=CVE-2021-43537
CVE-2007-4268 Chain: integer signedness error (CWE-195) passes signed comparison,
leading to heap overflow (CWE-122)
https://www.cve.org/CVERecord?id=CVE-2007-4268
CVE-2007-4988 Chain: signed short width value in image processor is sign extended during
conversion to unsigned int, which leads to integer overflow and heap-based
buffer overflow.
https://www.cve.org/CVERecord?id=CVE-2007-4988
CVE-2009-0231 Integer truncation of length value leads to heap-based buffer overflow.
https://www.cve.org/CVERecord?id=CVE-2009-0231
CWE Version 4.14
CWE-681: Incorrect Conversion between Numeric Types
CWE-681: Incorrect Conversion between Numeric Types