Signed/Unsigned Conversion Detection
Detection Workflow
- Identify conversions: Find all signed/unsigned conversions, locate implicit conversions, identify comparison operations, map arithmetic operations
- Analyze conversion safety: Check for negative values, assess overflow potential, verify conversion correctness, review comparison logic
- Trace value flow: Follow values through conversions, identify impact on operations, assess security implications, verify value constraints
- Assess exploitability: Can attacker trigger negative value? Can conversion bypass security checks? What's the potential impact? Is it exploitable?
Key Patterns
- Comparison errors: comparing signed with unsigned values, negative values treated as large positive, bypassed bounds checks, incorrect loop conditions
- Arithmetic errors: signed to unsigned conversion in arithmetic, integer overflow after conversion, underflow after conversion, unexpected results
- Function parameter issues: passing signed to unsigned parameters, implicit conversions in function calls, missing explicit casting, type mismatch in APIs
- Size calculation issues: signed values used for sizes, negative sizes after conversion, overflow in size calculations, incorrect buffer allocations
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, comparison_operation, signed_variable, unsigned_variable, issue, exploitable, attack_scenario, impact, mitigation.
Severity Guidelines
- HIGH: Conversion bypassing security checks
- MEDIUM: Conversion causing logic errors
- LOW: Minor conversion issues
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-signed-unsigned-conversion3description: Detects unsafe signed/unsigned integer conversions that can lead to integer overflow and security check bypasses. Use when analyzing integer operations, comparisons, or investigating conversion-related vulnerabilities.4---5
6# Signed/Unsigned Conversion Detection
7
8## Detection Workflow
9
101. **Identify conversions**: Find all signed/unsigned conversions, locate implicit conversions, identify comparison operations, map arithmetic operations
112. **Analyze conversion safety**: Check for negative values, assess overflow potential, verify conversion correctness, review comparison logic
123. **Trace value flow**: Follow values through conversions, identify impact on operations, assess security implications, verify value constraints
134. **Assess exploitability**: Can attacker trigger negative value? Can conversion bypass security checks? What's the potential impact? Is it exploitable?
14
15## Key Patterns
16
17- Comparison errors: comparing signed with unsigned values, negative values treated as large positive, bypassed bounds checks, incorrect loop conditions
18- Arithmetic errors: signed to unsigned conversion in arithmetic, integer overflow after conversion, underflow after conversion, unexpected results
19- Function parameter issues: passing signed to unsigned parameters, implicit conversions in function calls, missing explicit casting, type mismatch in APIs
20- Size calculation issues: signed values used for sizes, negative sizes after conversion, overflow in size calculations, incorrect buffer allocations
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, comparison_operation, signed_variable, unsigned_variable, issue, exploitable, attack_scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Conversion bypassing security checks
29- **MEDIUM**: Conversion causing logic errors
30- **LOW**: Minor conversion issues
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
aibot88