CWE-196 (无符号至有符号转换错误) — Vulnerability Class 3

CWE-196 is a numeric representation weakness occurring when an unsigned value is cast to a signed type, potentially resulting in an unexpected negative value if the original data exceeds the signed type’s maximum capacity. Attackers typically exploit this by supplying large unsigned inputs that, upon conversion, become negative, leading to critical buffer underwrite vulnerabilities. This allows malicious actors to write data to memory locations preceding the intended buffer, facilitating arbitrary code execution or system crashes. To prevent such errors, developers must implement rigorous input validation to ensure values remain within the safe range of the target signed type before any casting occurs. Additionally, using static analysis tools to detect implicit conversions and employing safer, explicit conversion functions with range checks can effectively mitigate the risk of unintended negative values arising from unsigned-to-signed transitions.