CWE-194 — Unexpected Sign Extension
CWE-194: Unexpected Sign Extension
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | High |
Description
The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
Common consequences
- Integrity, Confidentiality, Availability, Other: Read Memory, Modify Memory, Other
Mitigations
Implementation — Avoid using signed variables if you don't need to represent negative values. When negative values are needed, perform validation after you save those values to larger data types, or before passing them to functions that are expecting unsigned values.
References
- CWE page: https://cwe.mitre.org/data/definitions/194.html
- CWE list: https://cwe.mitre.org/data/index.html