1496
Nature Type ID Name Page
ParentOf 195 Signed to Unsigned Conversion Error 494
ParentOf 196 Unsigned to Signed Conversion Error 498
ParentOf 197 Numeric Truncation Error 500
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ParentOf 194 Unexpected Sign Extension 491
ParentOf 195 Signed to Unsigned Conversion Error 494
ParentOf 196 Unsigned to Signed Conversion Error 498
ParentOf 197 Numeric Truncation Error 500
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 136 Type Errors 2310
MemberOf 189 Numeric Errors 2312
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Other
Integrity
Unexpected State
Quality Degradation
The program could wind up using the wrong number and
generate incorrect results. If the number is used to allocate
resources or make a security decision, then this could
introduce a vulnerability.
Potential Mitigations
Phase: Implementation
Avoid making conversion between numeric types. Always check for the allowed ranges.
Demonstrative Examples
Example 1:
In the following Java example, a float literal is cast to an integer, thus causing a loss of precision.
Example Language: Java (Bad)
int i = (int) 33457.8f;
Example 2:
This code adds a float and an integer together, casting the result to an integer.
Example Language: PHP (Bad)
$floatVal = 1.8345;
$intVal = 3;
$result = (int)$floatVal + $intVal;
Normally, PHP will preserve the precision of this operation, making $result = 4.8345. After the cast
to int, it is reasonable to expect PHP to follow rounding convention and set $result = 5. However,
CWE Version 4.14
CWE-681: Incorrect Conversion between Numeric Types
CWE-681: Incorrect Conversion between Numeric Types