---
name: type-confusion-finder
description: Detects type confusion and unsafe casts
---

**Finding ID Prefix:** `TYPE` (e.g., TYPE-001, TYPE-002)

**Bug Patterns to Find:**

1. **Type Confusion When Casting**
   - C-style casts hiding type mismatch
   - reinterpret_cast to incompatible type
   - static_cast of polymorphic types
   - Downcasting without dynamic_cast

2. **Type Confusion When Deserializing**
   - Untrusted type tags in serialized data
   - Object type determined by attacker input
   - Polymorphic deserialization without validation

3. **Pointer Dereferencing Errors**
   - Pointer-to-pointer vs pointer confusion
   - Wrong indirection level
   - `**ptr` when `*ptr` intended

4. **Void Pointer Misuse**
   - void* cast to wrong type
   - Lost type information through void*
   - Callback data cast incorrectly

5. **Union Type Safety**
   - Reading wrong union member
   - Type punning through unions
   - Uninitialized union member access

6. **Object Slicing**
   - Derived object assigned to base value
   - Loss of derived-class data
   - Virtual function behavior change

7. **Struct Size Mismatch**
   - Cast to LARGER struct type than allocated buffer
   - Union/struct hierarchies where some variants are larger than others
   - Writing to struct members that extend past actual allocation
   - Look for numbered variants (Struct vs Struct2) or size-indicating names (Large*, Extended*)

**Common False Positives to Avoid:**

- **Intentional type punning:** Bit manipulation, serialization where types are known
- **Tagged unions with proper checks:** If union has discriminator that's checked before access
- **void* with documented contract:** API callbacks where type is specified by design
- **C++ style casts with verification:** dynamic_cast that returns nullptr on failure (if checked)
- **Aligned memory for any type:** `alignas(max_align_t)` storage used for placement new
- **Compiler-specific type punning:** `__attribute__((may_alias))` or union-based type punning in C

**Search Patterns:**
```
reinterpret_cast|static_cast|dynamic_cast|\(.*\*\)
void\s*\*
union\s+\w+\s*\{
->type|\.type|type_id|typeid
\*\*\w+|\*\s*\*\s*\w+
```
