Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-195 Variante Borrador
Signed to Unsigned Conversion Error
This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative,…
Definición
What is CWE-195?
This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative, the conversion produces a large, unexpected positive number instead of an error, breaking the program's logic.
Implicit conversions between signed and unsigned numbers are a common source of bugs because they happen silently during assignments or function calls. Developers often assume the value remains semantically the same, but a negative signed number becomes a very large unsigned number. This violates program assumptions and can lead to incorrect calculations, infinite loops, or flawed condition checks.
A critical risk emerges when these converted values control memory operations. Many functions return negative numbers to signal errors (like -1). If such a return value is passed directly as a 'size' argument to functions like memcpy() or malloc(), the implicit conversion turns the failure indicator into a massive allocation or copy length. This typically causes a buffer overflow, crashing the program or creating a serious security exploit.
Impacto en el mundo real
Real-world CVEs caused by CWE-195
-
Font rendering library does not properly handle assigning a signed short value to an unsigned long (CWE-195), leading to an integer wraparound (CWE-190), causing too small of a buffer (CWE-131), leading to an out-of-bounds write (CWE-787).
-
Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.
- 2
If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
- 3
In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.
- 4
If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
- 5
The following code is intended to read an incoming packet from a socket and extract one or more headers.
Ejemplo de código vulnerable
Vulnerable C
In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.
unsigned int readdata () {
int amount = 0;
...
if (result == ERROR)
amount = -1;
...
return amount;
} Ejemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-195
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Señales de detección
How to detect CWE-195
CWE-195
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Preguntas frecuentes ¿Qué es CWE-195?
¿Qué gravedad tiene CWE-195?
¿Qué lenguajes o plataformas se ven afectados por CWE-195?
¿Cómo puedo prevenir CWE-195?
¿Cómo detecta y corrige Plexicus CWE-195?
¿Dónde puedo aprender más sobre CWE-195?
Frequently asked questions
¿Qué es CWE-195?
This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative, the conversion produces a large, unexpected positive number instead of an error, breaking the program's logic.
¿Qué gravedad tiene CWE-195?
MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.
¿Qué lenguajes o plataformas se ven afectados por CWE-195?
MITRE lists the following affected platforms: C, C++.
¿Cómo puedo prevenir CWE-195?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
¿Cómo detecta y corrige Plexicus CWE-195?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-195 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-195?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/195.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-195
CWE-681 Padre
Incorrect Conversion between Numeric Types
This vulnerability occurs when a program converts a value from one numeric type to another (like a 64-bit integer to a 32-bit integer) and…
CWE-192 Hermano
Integer Coercion Error
An integer coercion error occurs when a program incorrectly converts, extends, or truncates a number between different data types, leading…
CWE-194 Hermano
Unexpected Sign Extension
This vulnerability occurs when a signed number from a smaller data type is moved or cast to a larger type, causing its sign bit to be…
CWE-196 Hermano
Unsigned to Signed Conversion Error
This vulnerability occurs when a program takes an unsigned integer and converts it directly to a signed integer. If the original unsigned…
CWE-197 Hermano
Numeric Truncation Error
A numeric truncation error happens when a program converts a number to a smaller data type, cutting off its higher-order bits and…
CWE-119 Puede preceder
Improper Restriction of Operations within the Bounds of a Memory Buffer
This vulnerability occurs when software accesses a memory buffer but reads from or writes to a location outside its allocated boundary.…
¿Listo para validar lo que importa?
Listo para validar lo que importa.
Plexicus es Proof-Driven AppSec: hallazgos validados, comprensión contextual y remediación revisada — anclada en evidencia, acotada contigo.