MISRA C:2012 Rule 10.8

The value of a composite expression shall not be cast to a different essential type category or a wider essential type

Description

Rule Definition

The value of a composite expression shall not be cast to a different essential type category or a wider essential type.

Rationale

A composite expression is a non-constant expression using a composite operator. In the Essential Type Model, composite operators are:

Multiplicative (*, /, %)
Additive (binary +, binary -)
Bitwise (&, |, ^)
Shift (<<, >>)
Conditional (?, :)

Casting to a wider type is not permitted because the result may vary between implementations. Consider this expression:

(uint32_t) (u16a +u16b);

On a 16-bit machine the addition is performed in 16 bits. The result is wrapped before it is cast to 32 bits. On a 32-bit machine, the addition takes place in 32 bits and preserves high-order bits that are lost on a 16-bit machine. Casting to a narrower type with the same essential type category is acceptable as the explicit truncation of the results always leads to the same loss of information.

For more information on essential types, see MISRA C:2012 Rule 10.1.

Polyspace Implementation

The rule checker raises a defect only if the result of a composite expression is cast to a different or wider essential type.

For instance, in this example, a violation is shown in the first assignment to i but not the second. In the first assignment, a composite expression i+1 is directly cast from a signed to an unsigned type. In the second assignment, the composite expression is first cast to the same type and then the result is cast to a different type.

typedef int int32_T;
typedef unsigned char uint8_T; 
...
...
int32_T i;
i = (uint8_T)(i+1); /* Noncompliant */
i = (uint8_T)((int32_T)(i+1)); /* Compliant */

Additional Message in Report

The value of a composite expression shall not be cast to a different essential type category.
The value of a composite expression shall not be cast to a wider essential type.

Troubleshooting

If you expect a rule violation but do not see it, refer to Coding Standard Violations Not Displayed.

Examples

expand all

Casting to Different or Wider Essential Type

extern unsigned short ru16a, u16a, u16b;
extern unsigned int   u32a, ru32a;
extern signed int     s32a, s32b;

void foo(void)
{
  ru16a  = (unsigned short) (u32a + u32a);/* Compliant                           */
  ru16a += (unsigned short) s32a;    /* Compliant - s32a is not composite        */
  ru32a  = (unsigned int) (u16a + u16b);  /* Noncompliant - wider essential type */
}

In this example, rule 10.8 is violated in the following cases:

s32a and s32b are essentially signed variables. However, the result ( s32a + s32b ) is cast to an essentially unsigned type.
u16a and u16b are essentially unsigned short variables. However, the result ( s32a + s32b ) is cast to a wider essential type, unsigned int.

Check Information

Group: The Essential Type Model

Category: Required

AGC Category: Advisory

Documentation