Add -Wshorten-64-to-32 for Clang

See #2365

19 files changed, 65 insertions, 51 deletions

diff --git a/src/build-data/cc/clang.txt b/src/build-data/cc/clang.txt
index c0e4eda5f..8b22eb667 100644
--- a/src/build-data/cc/clang.txt
+++ b/src/build-data/cc/clang.txt
@@ -4,7 +4,7 @@ binary_name clang++
 
 lang_flags "-std=c++17 -D_REENTRANT"
 
-warning_flags "-Wall -Wextra -Wpedantic -Wshadow -Wstrict-aliasing -Wstrict-overflow=5 -Wcast-align -Wmissing-declarations -Wpointer-arith -Wcast-qual"
+warning_flags "-Wall -Wextra -Wpedantic -Wshadow -Wstrict-aliasing -Wstrict-overflow=5 -Wcast-align -Wmissing-declarations -Wpointer-arith -Wcast-qual -Wshorten-64-to-32"
 
 werror_flags "-Werror -Wno-error=unused-parameter -Wno-error=unreachable-code -Wno-error=unused-lambda-capture"
 
diff --git a/src/cli/tls_client.cpp b/src/cli/tls_client.cpp
index 845623744..3ef7195dd 100644
--- a/src/cli/tls_client.cpp
+++ b/src/cli/tls_client.cpp
@@ -379,7 +379,7 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
 
       static void dgram_socket_write(int sockfd, const uint8_t buf[], size_t length)
          {
-         int r = ::send(sockfd, buf, length, MSG_NOSIGNAL);
+         auto r = ::send(sockfd, buf, length, MSG_NOSIGNAL);
 
          if(r == -1)
             {
diff --git a/src/lib/compression/bzip2/bzip2.cpp b/src/lib/compression/bzip2/bzip2.cpp
index c9dfc2ce8..df6ad562f 100644
--- a/src/lib/compression/bzip2/bzip2.cpp
+++ b/src/lib/compression/bzip2/bzip2.cpp
@@ -18,7 +18,7 @@ namespace Botan {
 
 namespace {
 
-class Bzip2_Stream : public Zlib_Style_Stream<bz_stream, char>
+class Bzip2_Stream : public Zlib_Style_Stream<bz_stream, char, unsigned int>
    {
    public:
       Bzip2_Stream()
@@ -46,7 +46,7 @@ class Bzip2_Compression_Stream final : public Bzip2_Stream
          if(block_size == 0 || block_size >= 9)
             block_size = 9;
 
-         int rc = BZ2_bzCompressInit(streamp(), block_size, 0, 0);
+         int rc = BZ2_bzCompressInit(streamp(), static_cast<unsigned int>(block_size), 0, 0);
 
          if(rc != BZ_OK)
             throw Compression_Error("BZ2_bzCompressInit", ErrorType::Bzip2Error, rc);
diff --git a/src/lib/compression/compress_utils.h b/src/lib/compression/compress_utils.h
index 396fc47be..cd84b086d 100644
--- a/src/lib/compression/compress_utils.h
+++ b/src/lib/compression/compress_utils.h
@@ -41,20 +41,20 @@ class Compression_Alloc_Info final
 /**
 * Wrapper for Zlib/Bzlib/LZMA stream types
 */
-template<typename Stream, typename ByteType>
+template<typename Stream, typename ByteType, typename StreamLenType = size_t>
 class Zlib_Style_Stream : public Compression_Stream
    {
    public:
       void next_in(uint8_t* b, size_t len) override
          {
          m_stream.next_in = reinterpret_cast<ByteType*>(b);
-         m_stream.avail_in = len;
+         m_stream.avail_in = static_cast<StreamLenType>(len);
          }
 
       void next_out(uint8_t* b, size_t len) override
          {
          m_stream.next_out = reinterpret_cast<ByteType*>(b);
-         m_stream.avail_out = len;
+         m_stream.avail_out = static_cast<StreamLenType>(len);
          }
 
       size_t avail_in() const override { return m_stream.avail_in; }
diff --git a/src/lib/compression/lzma/lzma.cpp b/src/lib/compression/lzma/lzma.cpp
index 73bb9eb89..680884c0e 100644
--- a/src/lib/compression/lzma/lzma.cpp
+++ b/src/lib/compression/lzma/lzma.cpp
@@ -60,7 +60,7 @@ class LZMA_Compression_Stream final : public LZMA_Stream
          else if(level > 9)
             level = 9; // clamp to maximum allowed value
 
-         lzma_ret rc = ::lzma_easy_encoder(streamp(), level, LZMA_CHECK_CRC64);
+         lzma_ret rc = ::lzma_easy_encoder(streamp(), static_cast<uint32_t>(level), LZMA_CHECK_CRC64);
 
          if(rc != LZMA_OK)
             throw Compression_Error("lzam_easy_encoder", ErrorType::LzmaError, rc);
diff --git a/src/lib/compression/zlib/zlib.cpp b/src/lib/compression/zlib/zlib.cpp
index 285bc4e91..92842a6e1 100644
--- a/src/lib/compression/zlib/zlib.cpp
+++ b/src/lib/compression/zlib/zlib.cpp
@@ -16,7 +16,7 @@ namespace Botan {
 
 namespace {
 
-class Zlib_Stream : public Zlib_Style_Stream<z_stream, Bytef>
+class Zlib_Stream : public Zlib_Style_Stream<z_stream, Bytef, unsigned int>
    {
    public:
       Zlib_Stream()
@@ -51,7 +51,7 @@ class Zlib_Compression_Stream : public Zlib_Stream
          else if(level == 0)
             level = 6;
 
-         int rc = ::deflateInit2(streamp(), level, Z_DEFLATED, wbits, 8, Z_DEFAULT_STRATEGY);
+         int rc = ::deflateInit2(streamp(), static_cast<int>(level), Z_DEFLATED, wbits, 8, Z_DEFAULT_STRATEGY);
 
          if(rc != Z_OK)
             throw Compression_Error("deflateInit2", ErrorType::ZlibError, rc);
diff --git a/src/lib/math/mp/mp_core.h b/src/lib/math/mp/mp_core.h
index c4bf8e881..25c8f2973 100644
--- a/src/lib/math/mp/mp_core.h
+++ b/src/lib/math/mp/mp_core.h
@@ -724,7 +724,7 @@ inline word bigint_divop(word n1, word n0, word d)
       throw Invalid_Argument("bigint_divop divide by zero");
 
 #if defined(BOTAN_HAS_MP_DWORD)
-   return ((static_cast<dword>(n1) << BOTAN_MP_WORD_BITS) | n0) / d;
+   return static_cast<word>(((static_cast<dword>(n1) << BOTAN_MP_WORD_BITS) | n0) / d);
 #else
 
    word high = n1 % d;
diff --git a/src/lib/prov/openssl/openssl.h b/src/lib/prov/openssl/openssl.h
index a68dda5af..17bbf650d 100644
--- a/src/lib/prov/openssl/openssl.h
+++ b/src/lib/prov/openssl/openssl.h
@@ -33,16 +33,16 @@ enum Cipher_Dir : int;
 class BOTAN_PUBLIC_API(2,0) OpenSSL_Error final : public Exception
    {
    public:
-      OpenSSL_Error(const std::string& what, int err) :
+      OpenSSL_Error(const std::string& what, unsigned long err) :
          Exception(what + " failed: " + ERR_error_string(err, nullptr)),
          m_err(err) {}
 
       ErrorType error_type() const noexcept override { return ErrorType::OpenSSLError; }
 
-      int error_code() const noexcept override { return m_err; }
+      int error_code() const noexcept override { return static_cast<int>(m_err); }
 
    private:
-      int m_err;
+      unsigned long m_err;
    };
 
 /* Block Ciphers */
diff --git a/src/lib/prov/openssl/openssl_block.cpp b/src/lib/prov/openssl/openssl_block.cpp
index fdded7285..138f9f9e1 100644
--- a/src/lib/prov/openssl/openssl_block.cpp
+++ b/src/lib/prov/openssl/openssl_block.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/block_cipher.h>
+#include <botan/internal/safeint.h>
 #include <botan/internal/openssl.h>
 #include <openssl/evp.h>
 
@@ -38,7 +39,9 @@ class OpenSSL_BlockCipher final : public BlockCipher
          {
          verify_key_set(m_key_set);
          int out_len = 0;
-         if(!EVP_EncryptUpdate(m_encrypt, out, &out_len, in, blocks * m_block_sz))
+         const size_t total_bytes = blocks * m_block_sz;
+         const int itotal_bytes = checked_cast_to<int>(total_bytes);
+         if(!EVP_EncryptUpdate(m_encrypt, out, &out_len, in, itotal_bytes))
             throw OpenSSL_Error("EVP_EncryptUpdate", ERR_get_error());
          }
 
@@ -46,7 +49,9 @@ class OpenSSL_BlockCipher final : public BlockCipher
          {
          verify_key_set(m_key_set);
          int out_len = 0;
-         if(!EVP_DecryptUpdate(m_decrypt, out, &out_len, in, blocks * m_block_sz))
+         const size_t total_bytes = blocks * m_block_sz;
+         const int itotal_bytes = checked_cast_to<int>(total_bytes);
+         if(!EVP_DecryptUpdate(m_decrypt, out, &out_len, in, itotal_bytes))
             throw OpenSSL_Error("EVP_DecryptUpdate", ERR_get_error());
          }
 
@@ -143,8 +148,9 @@ void OpenSSL_BlockCipher::key_schedule(const uint8_t key[], size_t length)
       }
    else
       {
-      if(EVP_CIPHER_CTX_set_key_length(m_encrypt, length) == 0 ||
-         EVP_CIPHER_CTX_set_key_length(m_decrypt, length) == 0)
+      const int ilength = checked_cast_to<int>(length);
+      if(EVP_CIPHER_CTX_set_key_length(m_encrypt, ilength) == 0 ||
+         EVP_CIPHER_CTX_set_key_length(m_decrypt, ilength) == 0)
          throw Invalid_Argument("OpenSSL_BlockCipher: Bad key length for " +
                                 m_cipher_name);
       }
diff --git a/src/lib/prov/openssl/openssl_ec.cpp b/src/lib/prov/openssl/openssl_ec.cpp
index 3f691f68a..1bbd613a0 100644
--- a/src/lib/prov/openssl/openssl_ec.cpp
+++ b/src/lib/prov/openssl/openssl_ec.cpp
@@ -170,22 +170,17 @@ class OpenSSL_ECDSA_Verification_Operation final : public PK_Ops::Verification_w
          std::unique_ptr<ECDSA_SIG, std::function<void (ECDSA_SIG*)>> sig(nullptr, ECDSA_SIG_free);
          sig.reset(::ECDSA_SIG_new());
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-         sig->r = BN_bin2bn(sig_bytes              , sig_len / 2, sig->r);
-         sig->s = BN_bin2bn(sig_bytes + sig_len / 2, sig_len / 2, sig->s);
-#else
-         BIGNUM* r = BN_bin2bn(sig_bytes              , sig_len / 2, nullptr);
-         BIGNUM* s = BN_bin2bn(sig_bytes + sig_len / 2, sig_len / 2, nullptr);
+         BIGNUM* r = BN_bin2bn(sig_bytes              , static_cast<int>(sig_len / 2), nullptr);
+         BIGNUM* s = BN_bin2bn(sig_bytes + sig_len / 2, static_cast<int>(sig_len / 2), nullptr);
          if(r == nullptr || s == nullptr)
             throw OpenSSL_Error("BN_bin2bn sig s", ERR_get_error());
 
          ECDSA_SIG_set0(sig.get(), r, s);
-#endif
 
-         const int res = ECDSA_do_verify(msg, msg_len, sig.get(), m_ossl_ec.get());
+         const int res = ECDSA_do_verify(msg, static_cast<int>(msg_len), sig.get(), m_ossl_ec.get());
          if(res < 0)
             {
-            int err = ERR_get_error();
+            auto err = ERR_get_error();
 
             bool hard_error = true;
 
@@ -237,7 +232,7 @@ class OpenSSL_ECDSA_Signing_Operation final : public PK_Ops::Signature_with_EMSA
                                    RandomNumberGenerator&) override
          {
          std::unique_ptr<ECDSA_SIG, std::function<void (ECDSA_SIG*)>> sig(nullptr, ECDSA_SIG_free);
-         sig.reset(::ECDSA_do_sign(msg, msg_len, m_ossl_ec.get()));
+         sig.reset(::ECDSA_do_sign(msg, static_cast<int>(msg_len), m_ossl_ec.get()));
 
          if(!sig)
             throw OpenSSL_Error("ECDSA_do_sign", ERR_get_error());
diff --git a/src/lib/prov/openssl/openssl_mode.cpp b/src/lib/prov/openssl/openssl_mode.cpp
index 81f8413a2..bdb2f0ca7 100644
--- a/src/lib/prov/openssl/openssl_mode.cpp
+++ b/src/lib/prov/openssl/openssl_mode.cpp
@@ -112,10 +112,10 @@ size_t OpenSSL_Cipher_Mode::process(uint8_t msg[], size_t msg_len)
       return 0;
    if(msg_len > INT_MAX)
       throw Internal_Error("msg_len overflow");
-   int outl = msg_len;
+   int outl = static_cast<int>(msg_len);
    secure_vector<uint8_t> out(outl);
 
-   if(!EVP_CipherUpdate(m_cipher, out.data(), &outl, msg, msg_len))
+   if(!EVP_CipherUpdate(m_cipher, out.data(), &outl, msg, outl))
       throw OpenSSL_Error("EVP_CipherUpdate", ERR_get_error());
    copy_mem(msg, out.data(), outl);
    return outl;
@@ -132,7 +132,7 @@ void OpenSSL_Cipher_Mode::finish(secure_vector<uint8_t>& buffer,
    const size_t buf_size = buffer.size() - offset;
 
    size_t written = process(buf, buf_size);
-   int outl = buf_size - written;
+   int outl = static_cast<int>(buf_size - written);
    secure_vector<uint8_t> out(outl);
 
    if(!EVP_CipherFinal_ex(m_cipher, out.data(), &outl))
@@ -201,7 +201,7 @@ Key_Length_Specification OpenSSL_Cipher_Mode::key_spec() const
 
 void OpenSSL_Cipher_Mode::key_schedule(const uint8_t key[], size_t length)
    {
-   if(!EVP_CIPHER_CTX_set_key_length(m_cipher, length))
+   if(!EVP_CIPHER_CTX_set_key_length(m_cipher, static_cast<int>(length)))
       throw OpenSSL_Error("EVP_CIPHER_CTX_set_key_length", ERR_get_error());
    if(!EVP_CipherInit_ex(m_cipher, nullptr, nullptr, key, nullptr, -1))
       throw OpenSSL_Error("EVP_CipherInit_ex key", ERR_get_error());
diff --git a/src/lib/prov/openssl/openssl_rc4.cpp b/src/lib/prov/openssl/openssl_rc4.cpp
index 882ef4516..748e31cbb 100644
--- a/src/lib/prov/openssl/openssl_rc4.cpp
+++ b/src/lib/prov/openssl/openssl_rc4.cpp
@@ -67,7 +67,7 @@ class OpenSSL_RC4 final : public StreamCipher
 
       void key_schedule(const uint8_t key[], size_t length) override
          {
-         ::RC4_set_key(&m_rc4, length, key);
+         ::RC4_set_key(&m_rc4, static_cast<int>(length), key);
          uint8_t d = 0;
          for(size_t i = 0; i != m_skip; ++i)
             ::RC4(&m_rc4, 1, &d, &d);
diff --git a/src/lib/prov/openssl/openssl_rsa.cpp b/src/lib/prov/openssl/openssl_rsa.cpp
index 8fbfa6b5d..05f8c8bed 100644
--- a/src/lib/prov/openssl/openssl_rsa.cpp
+++ b/src/lib/prov/openssl/openssl_rsa.cpp
@@ -83,7 +83,8 @@ class OpenSSL_RSA_Encryption_Operation final : public PK_Ops::Encryption
             inbuf.assign(msg, msg + msg_len);
             }
 
-         int rc = ::RSA_public_encrypt(inbuf.size(), inbuf.data(), outbuf.data(),
+         int rc = ::RSA_public_encrypt(static_cast<int>(inbuf.size()), inbuf.data(),
+                                       outbuf.data(),
                                        m_openssl_rsa.get(), m_padding);
          if(rc < 0)
             throw OpenSSL_Error("RSA_public_encrypt", ERR_get_error());
@@ -118,7 +119,8 @@ class OpenSSL_RSA_Decryption_Operation final : public PK_Ops::Decryption
                                   const uint8_t msg[], size_t msg_len) override
          {
          secure_vector<uint8_t> buf(::RSA_size(m_openssl_rsa.get()));
-         int rc = ::RSA_private_decrypt(msg_len, msg, buf.data(), m_openssl_rsa.get(), m_padding);
+         int rc = ::RSA_private_decrypt(static_cast<int>(msg_len), msg,
+                                        buf.data(), m_openssl_rsa.get(), m_padding);
          if(rc < 0 || static_cast<size_t>(rc) > buf.size())
             {
             valid_mask = 0;
@@ -183,7 +185,8 @@ class OpenSSL_RSA_Verification_Operation final : public PK_Ops::Verification_wit
 
          secure_vector<uint8_t> outbuf(mod_sz);
 
-         int rc = ::RSA_public_decrypt(inbuf.size(), inbuf.data(), outbuf.data(),
+         int rc = ::RSA_public_decrypt(static_cast<int>(inbuf.size()), inbuf.data(),
+                                       outbuf.data(),
                                        m_openssl_rsa.get(), RSA_NO_PADDING);
          if(rc < 0)
             throw Invalid_Argument("RSA_public_decrypt");
@@ -224,7 +227,8 @@ class OpenSSL_RSA_Signing_Operation final : public PK_Ops::Signature_with_EMSA
 
          secure_vector<uint8_t> outbuf(mod_sz);
 
-         int rc = ::RSA_private_encrypt(inbuf.size(), inbuf.data(), outbuf.data(),
+         int rc = ::RSA_private_encrypt(static_cast<int>(inbuf.size()), inbuf.data(),
+                                        outbuf.data(),
                                         m_openssl_rsa.get(), RSA_NO_PADDING);
          if(rc < 0)
             throw OpenSSL_Error("RSA_private_encrypt", ERR_get_error());
@@ -280,9 +284,9 @@ make_openssl_rsa_private_key(RandomNumberGenerator& rng, size_t rsa_bits)
    if (rsa_bits > INT_MAX)
       throw Internal_Error("rsa_bits overflow");
 
-   secure_vector<uint8_t> seed(BOTAN_SYSTEM_RNG_POLL_REQUEST);
+   secure_vector<uint8_t> seed(128);
    rng.randomize(seed.data(), seed.size());
-   RAND_seed(seed.data(), seed.size());
+   RAND_seed(seed.data(), static_cast<int>(seed.size()));
 
    std::unique_ptr<BIGNUM, std::function<void (BIGNUM*)>> bn(BN_new(), BN_free);
    if(!bn)
@@ -293,7 +297,7 @@ make_openssl_rsa_private_key(RandomNumberGenerator& rng, size_t rsa_bits)
    std::unique_ptr<RSA, std::function<void (RSA*)>> rsa(RSA_new(), RSA_free);
    if(!rsa)
       throw OpenSSL_Error("RSA_new", ERR_get_error());
-   if(!RSA_generate_key_ex(rsa.get(), rsa_bits, bn.get(), nullptr))
+   if(!RSA_generate_key_ex(rsa.get(), static_cast<int>(rsa_bits), bn.get(), nullptr))
       throw OpenSSL_Error("RSA_generate_key_ex", ERR_get_error());
 
    uint8_t* der = nullptr;
diff --git a/src/lib/prov/pkcs11/p11_object.cpp b/src/lib/prov/pkcs11/p11_object.cpp
index 4dd191efe..e708d7555 100644
--- a/src/lib/prov/pkcs11/p11_object.cpp
+++ b/src/lib/prov/pkcs11/p11_object.cpp
@@ -29,13 +29,13 @@ void AttributeContainer::add_class(ObjectClass object_class)
 void AttributeContainer::add_string(AttributeType attribute, const std::string& value)
    {
    m_strings.push_back(value);
-   add_attribute(attribute, reinterpret_cast<const uint8_t*>(m_strings.back().data()), static_cast<Ulong>(value.size()));
+   add_attribute(attribute, reinterpret_cast<const uint8_t*>(m_strings.back().data()), static_cast<uint32_t>(value.size()));
    }
 
 void AttributeContainer::add_binary(AttributeType attribute, const uint8_t* value, size_t length)
    {
    m_vectors.push_back(secure_vector<uint8_t>(value, value + length));
-   add_attribute(attribute, reinterpret_cast< const uint8_t* >(m_vectors.back().data()), static_cast<Ulong>(length));
+   add_attribute(attribute, reinterpret_cast< const uint8_t* >(m_vectors.back().data()), static_cast<uint32_t>(length));
    }
 
 void AttributeContainer::add_bool(AttributeType attribute, bool value)
diff --git a/src/lib/pubkey/ec_group/point_mul.cpp b/src/lib/pubkey/ec_group/point_mul.cpp
index 2dff959d7..211905723 100644
--- a/src/lib/pubkey/ec_group/point_mul.cpp
+++ b/src/lib/pubkey/ec_group/point_mul.cpp
@@ -279,7 +279,7 @@ PointGFp PointGFp_Var_Point_Precompute::mul(const BigInt& k,
    const BigInt scalar = k + group_order * mask;
 
    const size_t elem_size = 3*m_p_words;
-   const size_t window_elems = (1ULL << m_window_bits);
+   const size_t window_elems = static_cast<size_t>(1) << m_window_bits;
 
    size_t windows = round_up(scalar.bits(), m_window_bits) / m_window_bits;
    PointGFp R(m_curve);
diff --git a/src/lib/pubkey/newhope/newhope.cpp b/src/lib/pubkey/newhope/newhope.cpp
index 36044eb75..b6ef8e350 100644
--- a/src/lib/pubkey/newhope/newhope.cpp
+++ b/src/lib/pubkey/newhope/newhope.cpp
@@ -68,7 +68,7 @@ inline void ntt(uint16_t* a, const uint16_t* omega)
    for(size_t i = 0; i < 10; i+=2)
       {
       // Even level
-      size_t distance = (1ULL << i);
+      size_t distance = static_cast<size_t>(1) << i;
       for(size_t start = 0; start < distance; start++)
          {
          size_t jTwiddle = 0;
diff --git a/src/lib/pubkey/xmss/xmss_signature_operation.cpp b/src/lib/pubkey/xmss/xmss_signature_operation.cpp
index 49f1041d9..6631f2dcd 100644
--- a/src/lib/pubkey/xmss/xmss_signature_operation.cpp
+++ b/src/lib/pubkey/xmss/xmss_signature_operation.cpp
@@ -70,8 +70,8 @@ XMSS_Signature_Operation::build_auth_path(XMSS_PrivateKey& priv_key,
 
    for(size_t j = 0; j < m_xmss_params.tree_height(); j++)
       {
-      size_t k = (m_leaf_idx / (1ULL << j)) ^ 0x01;
-      auth_path[j] = priv_key.tree_hash(k * (1ULL << j), j, adrs);
+      size_t k = (m_leaf_idx / (static_cast<size_t>(1) << j)) ^ 0x01;
+      auth_path[j] = priv_key.tree_hash(k * (static_cast<size_t>(1) << j), j, adrs);
       }
 
    return auth_path;
diff --git a/src/lib/utils/safeint.h b/src/lib/utils/safeint.h
index 9a55dc4cb..f014be0b0 100644
--- a/src/lib/utils/safeint.h
+++ b/src/lib/utils/safeint.h
@@ -34,6 +34,15 @@ inline size_t checked_add(size_t x, size_t y, const char* file, int line)
    return z;
    }
 
+template<typename RT, typename AT>
+RT checked_cast_to(AT i)
+   {
+   RT c = static_cast<RT>(i);
+   if(i != static_cast<AT>(c))
+      throw Internal_Error("Error during integer conversion");
+   return c;
+   }
+
 #define BOTAN_CHECKED_ADD(x,y) checked_add(x,y,__FILE__,__LINE__)
 
 }
diff --git a/src/lib/utils/sqlite3/sqlite3.cpp b/src/lib/utils/sqlite3/sqlite3.cpp
index 8c71ecd96..ad942a1c3 100644
--- a/src/lib/utils/sqlite3/sqlite3.cpp
+++ b/src/lib/utils/sqlite3/sqlite3.cpp
@@ -81,27 +81,27 @@ void Sqlite3_Database::Sqlite3_Statement::bind(int column, size_t val)
    {
    if(val != static_cast<size_t>(static_cast<int>(val))) // is this cast legit?
       throw SQL_DB_Error("sqlite3 cannot store " + std::to_string(val) + " without truncation");
-   int rc = ::sqlite3_bind_int(m_stmt, column, val);
+   int rc = ::sqlite3_bind_int(m_stmt, column, static_cast<int>(val));
    if(rc != SQLITE_OK)
       throw SQL_DB_Error("sqlite3_bind_int failed", rc);
    }
 
 void Sqlite3_Database::Sqlite3_Statement::bind(int column, std::chrono::system_clock::time_point time)
    {
-   const int timeval = std::chrono::duration_cast<std::chrono::seconds>(time.time_since_epoch()).count();
-   bind(column, timeval);
+   const uint64_t timeval = std::chrono::duration_cast<std::chrono::seconds>(time.time_since_epoch()).count();
+   bind(column, static_cast<size_t>(timeval));
    }
 
 void Sqlite3_Database::Sqlite3_Statement::bind(int column, const std::vector<uint8_t>& val)
    {
-   int rc = ::sqlite3_bind_blob(m_stmt, column, val.data(), val.size(), SQLITE_TRANSIENT);
+   int rc = ::sqlite3_bind_blob(m_stmt, column, val.data(), static_cast<int>(val.size()), SQLITE_TRANSIENT);
    if(rc != SQLITE_OK)
       throw SQL_DB_Error("sqlite3_bind_text failed", rc);
    }
 
 void Sqlite3_Database::Sqlite3_Statement::bind(int column, const uint8_t* p, size_t len)
    {
-   int rc = ::sqlite3_bind_blob(m_stmt, column, p, len, SQLITE_TRANSIENT);
+   int rc = ::sqlite3_bind_blob(m_stmt, column, p, static_cast<int>(len), SQLITE_TRANSIENT);
    if(rc != SQLITE_OK)
       throw SQL_DB_Error("sqlite3_bind_text failed", rc);
    }