Incorrect Type Conversion or Cast

Opis

The product does not correctly convert an object, resource, or structure from one type to a different type.

Skutki

• Other

  Other

Przykłady podatności

• CVE-2021-43537 Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122)
• CVE-2022-3979 Chain: data visualization program written in PHP uses the "!=" operator instead of the type-strict "!==" operator (CWE-480) when validating hash values, potentially leading to an incorrect type conversion (CWE-704)

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Słabości podrzędne

• CWE-588 Attempt to Access Child of a Non-structure Pointer
• CWE-681 Incorrect Conversion between Numeric Types
• CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
• CWE-1389 Incorrect Parsing of Numbers with Different Radices

Kiedy powstaje

• Implementation

Dotyczy

C, C++, Not Language-Specific, Memory-Unsafe, Not Technology-Specific

Źródła

1. Automated Source Code Reliability Measure (ASCRM) — Object Management Group (OMG), ASCRM-CWE-704, 2016