CWE-197: Numeric Truncation Error
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
How it's found
Numeric Truncation Error is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
When a primitive is cast to a smaller primitive, the high order bits of the large value are lost in the conversion, potentially resulting in an unexpected value that is not equal to the original value. This value may be required as an index into a buffer, a loop iterator, or simply necessary state data. In any case, the value cannot be trusted and the system will be in an undefined state. While this method may be employed viably to isolate the low bits of a value, this usage is rare, and truncation usually implies that an implementation error has occurred.
Vulnerable vs. safe
// update sales database for number of product sold with product ID
// get the total number of products in inventory database
// convert integer values to short, the method for the
// sales object requires the parameters to be of type short
// update sales database for productint productCount = inventory.getProductCount(productID);short count = (short) productCount;short sold = (short) amountSold;sales.updateSalesCount(productID, count, sold);...public void updateSalesForProduct(String productID, int amountSold) {}...// update sales database for number of product sold with product ID
// get the total number of products in inventory database
// make sure that integer numbers are not greater than
// maximum value for type short before converting
// throw exception or perform other processing
// convert integer values to short, the method for the
// sales object requires the parameters to be of type short
// update sales database for productshort count = (short) productCount;short sold = (short) amountSold;sales.updateSalesCount(productID, count, sold);
...int productCount = inventory.getProductCount(productID);if ((productCount < Short.MAX_VALUE) && (amountSold < Short.MAX_VALUE)) {else {}...public void updateSalesForProduct(String productID, int amountSold) {}...Consequences
- Modify Memory: The true value of the data is lost and corrupted data is used.
Mitigations
- Implementation: Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-197?
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
How do you find Numeric Truncation Error?
Numeric Truncation Error is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-197?
Modify Memory: The true value of the data is lost and corrupted data is used.
Does TurboPentest test for Numeric Truncation Error?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest