integer-truncation.yaml

rules:
  - id: raptor-integer-truncation
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      references:
        - https://cwe.mitre.org/data/definitions/197
        - https://cwe.mitre.org/data/definitions/681
        - https://g.co/kgs/PCHQjJ
        - https://github.com/struct/mms
      confidence: MEDIUM
      # NOTE: the deep expression operator is necessary to catch some
      # matches because C/C++ integer promotions do not seem entirely
      # supported by Semgrep; this may generate false positives.
      # NOTE: some types (e.g., ptrs) and use cases (e.g., comparisons) 
      # are not covered.
    message: >-
      Truncation errors occur when a primitive is cast to a primitive of a 
      smaller size and data is lost in the conversion. The value cannot be 
      trusted and the application will be in an undefined state.
    severity: WARNING
    languages:
      - c
      - cpp
    pattern-either:
      # char: assignments
      - pattern: (char $NARROW) = <... (short $LARGE) ...>
      - pattern: (char $NARROW) = <... (short int $LARGE) ...>
      - pattern: (char $NARROW) = <... (unsigned short $LARGE) ...>
      - pattern: (char $NARROW) = <... (unsigned short int $LARGE) ...>
      - pattern: (char $NARROW) = <... (int $LARGE) ...>
      - pattern: (char $NARROW) = <... (unsigned $LARGE) ...>
      - pattern: (char $NARROW) = <... (unsigned int $LARGE) ...>
      - pattern: (char $NARROW) = <... (long $LARGE) ...>
      - pattern: (char $NARROW) = <... (long int $LARGE) ...>
      - pattern: (char $NARROW) = <... (unsigned long $LARGE) ...>
      - pattern: (char $NARROW) = <... (unsigned long int $LARGE) ...>
      # char: function return
      - patterns:
        - pattern-either:
          - pattern: |
              char $FUN(...)
              {
              ...
              return (short $LARGE);
              }
          - pattern: |
              char $FUN(...)
              {
              ...
              return (int $LARGE);
              }
          - pattern: |
              char $FUN(...)
              {
              ...
              return (long $LARGE);
              }
        # improve output readability
        - focus-metavariable: $FUN
      # short: assignments
      - pattern: (short $NARROW) = <... (unsigned short $LARGE) ...>
      - pattern: (short int $NARROW) = <... (unsigned short int $LARGE) ...>
      - pattern: (short $NARROW) = <... (int $LARGE) ...>
      - pattern: (short $NARROW) = <... (unsigned $LARGE) ...>
      - pattern: (short int $NARROW) = <... (unsigned int $LARGE) ...>
      - pattern: (short $NARROW) = <... (long $LARGE) ...>
      - pattern: (short int $NARROW) = <... (long int $LARGE) ...>
      - pattern: (short $NARROW) = <... (unsigned long $LARGE) ...>
      - pattern: (short int $NARROW) = <... (unsigned long int $LARGE) ...>
      - pattern: (unsigned short $NARROW) = <... (int $LARGE) ...>
      - pattern: (unsigned short $NARROW) = <... (unsigned $LARGE) ...>
      - pattern: (unsigned short int $NARROW) = <... (unsigned int $LARGE) ...>
      - pattern: (unsigned short $NARROW) = <... (long $LARGE) ...>
      - pattern: (unsigned short int $NARROW) = <... (long int $LARGE) ...>
      - pattern: (unsigned short $NARROW) = <... (unsigned long $LARGE) ...>
      - pattern: (unsigned short int $NARROW) = <... (unsigned long int $LARGE) ...>
      # short: function return
      - patterns:
        - pattern-either:
          - pattern: |
              short $FUN(...)
              {
              ...
              return (int $LARGE);
              }
          - pattern: |
              short $FUN(...)
              {
              ...
              return (long $LARGE);
              }
        # improve output readability
        - focus-metavariable: $FUN
      # int: assignments
      - pattern: (int $NARROW) = <... (unsigned $LARGE) ...>
      - pattern: (int $NARROW) = <... (unsigned int $LARGE) ...>
      - pattern: (int $NARROW) = <... (long $LARGE) ...>
      - pattern: (int $NARROW) = <... (long int $LARGE) ...>
      - pattern: (int $NARROW) = <... (unsigned long $LARGE) ...>
      - pattern: (int $NARROW) = <... (unsigned long int $LARGE) ...>
      # int: function return
      - patterns:
        - pattern: |
            int $FUN(...)
            {
            ...
            return (long $LARGE);
            }
        # improve output readability
        - focus-metavariable: $FUN
      # long: assignments
      - pattern: (long $NARROW) = <... (unsigned long $LARGE) ...>
      - pattern: (long int $NARROW) = <... (unsigned long int $LARGE) ...>