BF Type Conversion (TCV) Bugs Class
Irena Bojanova, Inventor, Creator, PI, Bugs Framework (BF)

Definition

Data are converted or coerced into other type improperly.

Taxonomy

OperationsDefinition
CastExplicitly convert the value of an object to another data type.
CoerceImplicitly (forced by the Type System) convert the value of a passed in/out argument or the return into the corresponding parameter or return data type. (Type Coercion is known also as Type Juggling.
OperandsDefinition
NameThe declared identifier for an entity.
DataThe data value of an object -- stored in object's memory.
TypeThe data type of an object -- the set of allowed values (e.g., char is within [-128, 127]) and the operations allowed over them (e.g., +, *, mod).
CausesDefinition
Code Defect BugThe operation has a bug, which is the first cause for the chain of weaknesses underlying a software security vulnerability. The bug must be fixed to resolve the vulnerability.
   Wrong CodeAn inappropriate data type is specified; or an inappropriate function/operator is used.
   Missing CodeThe entire operation implementation or a part of its specification is absent.
Name FaultThe resolved name is wrong.
   Wrong Object Resolvedzzzxxx Object is resolved from wrong scope.
   Wrong Object Type Resolvedzzzxxx Object is resolved from wrong scope, so its data type might be wrong (xxx parent vs child type).
   Missing Overloaded FunctionCode for particular function parameters' data types is absent.
Data FaultThe object data has harmed semantics or inconsistent or wrong value
   Under RangeData value is smaller than type's lower range.
   Over RangeData value is larger than type's upper range.
   Flipped SignSign bit is overwritten from type related calculation.
Type FaultThe set or range of allowed values is wrong or the operations allowed on them are wrong.
   Wrong TypeA data type range or structure is not correct.
   Mismatched ArgumentAn argument is not of the paraneter data type.
ConsequencesDefinition
Type ErrorThe set or range of allowed values is wrong or the operations allowed on them are wrong.
   Wrong TypeA data type range or structure is not correct.
Data ErrorThe object data has harmed semantics or inconsistent or wrong value
   Wrong ValueData value is not accurate value (e.g., outside of a range).
   Flipped SignSign bit is overwritten from type related calculation.
   Truncated ValueRightmost bits of value that won’t fit type size are cut off.
   Distorted ValueIncorrect value (although fits type size) due to sign flip or signed/unsigned and vice versa conversions.
   Rounded ValueReal number value precision loss.
Operations AttributesDefinition
MechanismShows how the buggy/faulty operation code is performed.
   Pass InSupplying "in" arguments' data values to a function/ operator.
   Pass OutSupplying "out" or "in/out" arguments' data values or a return value to a function/ operator.
Source CodeShows where the buggy/faulty operation code is in the program -- in what kind of software.
   CodebaseThe operation is in the programmer's code - in the application itself.
   Third-PartyThe operation is in a third-party software.
   Standard LibraryThe operation is in the standard library for a particular programming language.
   Compiler/InterpreterThe operation is in the language processor that allows execution or creates executables (compiler, assembler, interpreter).
Execution SpaceShows where the buggy/faulty operation code is running or with what privilege level).
   LocalThe bugged code runs in an environment with access control policy with limited (local user) permission.
   AdminThe bugged code runs in an environment with access control policy with unlimited (admin user) permission.
   Bare-MetalThe bugged code runs in an environment without privilege control. Usually, the program is the only software running and has total access to the hardware.
Operands AttributesDefinition
         Name StateShows at what stage the entity name is.
            ResolvedThe name scope is known to the Type System.
            BoundThe name is linked to a declared (or inferred) data type, a defined object's data, or a called function implementation.
         Data KindShows what the data value is.
            NumericA number -- a sequence of digits.
            TextA string -- a sequence of symbols.
            PointerA holder of the memory address of an object.
            BooleanA truth/falcity value -- true or false; 1 or 0.
         Type KindShows what the data type composition is.
            PrimitiveA scalar data type that mimics the hardware units - e.g., int (long, short, signed), float, double, string, Boolean. A primitive data type is only language defined and is not built from other data types.
            StructureA composite data type - e.g., array, list, map, class. A structured data type is built from other data types and has primitive or structured members.