CWE-192
Integer Coercion Error
AI Translation Available
Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
Status
incomplete
Abstraction
variant
Likelihood
medium
Affected Platforms
C
C#
C++
Java
Extended Description
AI Translation
Several flaws fall under the category of integer coercion errors. For the most part, these errors in and of themselves result only in availability and data integrity issues. However, in some circumstances, they may result in other, more complicated security related flaws, such as buffer overflow conditions.
Technical Details
AI Translation
Common Consequences
availability
integrity
confidentiality
other
Impacts
dos: resource consumption (cpu)
dos: resource consumption (memory)
dos: crash, exit, or restart
execute unauthorized code or commands
other
Detection Methods
automated static analysis
Potential Mitigations
Phases:
requirements
architecture and design
implementation
Descriptions:
•
A language which throws exceptions on ambiguous data casts might be chosen.
•
Ensure that any data type casting that you must used is entirely understood in order to reduce the plausibility of error in use.
•
Design objects and program flow such that multiple or complex casts are unnecessary