Incorrect Conversion between Numeric Types

Opis

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Skutki

• Other, Integrity

  Unexpected State; Quality Degradation

  The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.

Zapobieganie

• Implementation

  Avoid making conversion between numeric types. Always check for the allowed ranges.

Przykłady podatności

• CVE-2022-2639 Chain: integer coercion error (CWE-192) prevents a return value from indicating an error, leading to out-of-bounds write (CWE-787)
• CVE-2021-43537 Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122)
• CVE-2007-4268 Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)
• CVE-2007-4988 Chain: signed short width value in image processor is sign extended during conversion to unsigned int, which leads to integer overflow and heap-based buffer overflow.
• CVE-2009-0231 Integer truncation of length value leads to heap-based buffer overflow.
• CVE-2008-3282 Size of a particular type changes for 64-bit platforms, leading to an integer truncation in document processor causes incorrect index to be generated.

Słabość nadrzędna

• CWE-704 Incorrect Type Conversion or Cast

Może prowadzić do

• CWE-682 Incorrect Calculation

Słabości podrzędne

• CWE-192 Integer Coercion Error
• CWE-194 Unexpected Sign Extension
• CWE-195 Signed to Unsigned Conversion Error
• CWE-196 Unsigned to Signed Conversion Error
• CWE-197 Numeric Truncation Error

Kiedy powstaje

• Implementation

Dotyczy

C, Not Language-Specific, Not Technology-Specific

Źródła

1. Automated Source Code Security Measure (ASCSM) — Object Management Group (OMG), ASCSM-CWE-681, 2016