For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/rust-code-quality/as-conversions.md. A documentation index is available at /llms.txt.

Use From/TryFrom over `as` to avoid silent numeric coercion

This product is not supported for your selected Datadog site. ().

Metadata

ID: rust-code-quality/as-conversions

Language: Rust

Severity: Warning

Category: Error Prone

CWE: 681

Related CWEs:

Description

Using as for numeric type conversions can silently truncate, wrap, or coerce values in ways that are easy to miss. For example, 300u32 as u8 evaluates to 44 because the value wraps around, and 1.9f64 as u8 truncates to 1. Even widening casts that happen to be safe today can become lossy if the source type changes. Explicit conversions make the intent clear and surface potential issues at compile time.

How to remediate?

Replace as casts with explicit conversions using From or TryFrom:

// Before — silently truncates if n > 255
let x = n as u8;

// After — fails to compile if the conversion could truncate (widening is infallible)
let x = u8::from(n);       // use when the source type guarantees no truncation
let x = u8::try_from(n)?;  // use when the conversion may fail (returns Result)

For pointer-to-integer conversions, prefer .addr() over ptr as usize.

Non-Compliant Code Examples

fn truncating(n: u32) -> u8 {
    n as u8
}

fn widening_as(x: i32) -> i64 {
    x as i64
}

fn float_precision(x: f64) -> f32 {
    x as f32
}

fn bool_as_int(flag: bool) -> u8 {
    flag as u8
}

fn ptr_to_addr(ptr: *const i32) -> usize {
    ptr as usize
}

Compliant Code Examples

fn widening(x: i32) -> i64 {
    i64::from(x)
}

fn narrowing(n: i32) -> u8 {
    u8::try_from(n).unwrap_or(0)
}

fn bool_to_int(flag: bool) -> u8 {
    u8::from(flag)
}

fn pointer_cast(ptr: *const i32) -> *const u8 {
    ptr as *const u8
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security