494
[REF-161]John McDonald, Mark Dowd and Justin Schuh. "C Language Issues for Application
Security". 2008 January 5. < http://www.informit.com/articles/article.aspx?p=686170&seqNum=6 >.
[REF-162]Robert Seacord. "Integral Security". 2006 November 3. < https://drdobbs.com/cpp/
integral-security/193501774 >.2023-04-07.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-195: Signed to Unsigned Conversion Error
Weakness ID : 195
Structure : Simple
Abstraction : Variant
Description
The product uses a signed primitive and performs a cast to an unsigned primitive, which can
produce an unexpected value if the value of the signed primitive can not be represented using an
unsigned primitive.
Extended Description
It is dangerous to rely on implicit casts between signed and unsigned numbers because the result
can take on an unexpected value and violate assumptions made by the program.
Often, functions will return negative values to indicate a failure. When the result of a function is to
be used as a size parameter, using these negative return values can have unexpected results. For
example, if negative size values are passed to the standard memory copy or allocation functions
they will be implicitly cast to a large unsigned value. This may lead to an exploitable buffer overflow
or underflow condition.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 681 Incorrect Conversion between Numeric Types 1495
CanFollow 839 Numeric Range Comparison Without Minimum Check 1767
CanPrecede 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer