CWE-196: Unsigned to Signed Conversion Error
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
扩展描述
Although less frequent an issue than signed-to-unsigned conversion, unsigned-to-signed conversion can be the perfect precursor to dangerous buffer underwrite conditions that allow attackers to move down the stack where they otherwise might not have access in a normal buffer overflow condition. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.
常见后果
影响范围: Availability
技术影响: DoS: Crash, Exit, or Restart
说明: Incorrect sign conversions generally lead to undefined behavior, and therefore crashes.
影响范围: Integrity
技术影响: Modify Memory
说明: If a poor cast lead to a buffer overflow or similar condition, data integrity may be affected.
影响范围: Integrity Confidentiality Availability Access Control
技术影响: Execute Unauthorized Code or Commands Bypass Protection Mechanism
说明: Improper signed-to-unsigned conversions without proper checking can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.
潜在缓解措施
阶段: Requirements
描述: Choose a language which is not subject to these casting flaws.
阶段: Architecture and Design
描述: Design object accessor functions to implicitly check values for valid sizes. Ensure that all functions which will be used as a size are checked previous to use as a size. If the language permits, throw exceptions rather than using in-band errors.
阶段: Implementation
描述: Error check the return values of all functions. Be aware of implicit casts made, and use unsigned variables for sizes if at all possible.
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | - |
适用平台
编程语言
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| CLASP | - | Unsigned to signed conversion error | - |
| Software Fault Patterns | SFP1 | Glitch in computation | - |