C99 Section 7.12.1 of the C standard defines two types of errors that relate specifically to math functions in math.h [ISO/IEC 9899:19992011]:

a A domain error occurs if an input argument is outside the domain over which the mathematical function is defined.

a A range error occurs if the mathematical result of the function cannot be represented in an object of the specified type, due to extreme magnitude.

An example of a domain error is the square root of a negative number, such as sqrt(-1.0), which has no meaning in real arithmetic. On the other hand, ten  10 raised to the one1-millionth power, pow(10., 1e6), likely cannot be represented in an implementation's floating-point representation and consequently constitutes a range error.

In both cases, the function will return some value, but the value returned is not the correct result of the computation.

Domain errors can be prevented by carefully bounds-checking the arguments before calling functions , and taking alternative action if the bounds are violated.

Range errors usually can not cannot be prevented , as they because they are dependent on the implementation of floating-point numbers , as well as the on the function being applied. Instead of preventing range errors, one  programmers should attempt to detect them and take alternative action if a range error occurs.

The following table lists standard mathematical functions, along with any checks that should be performed on their domain, and indicates if they also throw range errors, as reported by the C standard [ISO/IEC 9899:19992011]. If a function has a specific domain over which it is defined, one  the programmer should check its input values, and if a function throws range errors, one should  the programmer should detect if a range error occurs. The standard math functions not on this not listed in this table, such as atan(), have no domain restrictions and do not throw range errors.

...

The most reliable way to handle domain errors is to prevent them by checking arguments beforehand, as in the following template:

if (/* arguments will cause a domain error */) {
  /* handle domain error */
}
else {
  /* perform computation */
}

...

The exact treatment of error conditions from math functions is quite complicated. C99C11, Section 7.12.1, defines the following behavior for floating point overflow overflow [ISO/IEC 9899:19992011]:

A floating result overflows if the magnitude of the mathematical result is finite but so large that the mathematical result cannot be represented without extraordinary roundoff error in an object of the specified type. If a floating result overflows and default rounding is in effect, or if the mathematical result is an exact infinity from finite arguments (for example log(0.0)), then the function returns the value of the macro HUGE_VAL, HUGE_VALF, or HUGE_VALL according to the return type, with the same sign as the correct value of the function; if the integer expression math_errhandling & MATH_ERRNO is nonzero, the integer expression errno acquires the value ERANGE; if the integer expression math_errhandling & MATH_ERREXCEPT is nonzero, the ''divide-by-zero'' ‘‘overflow’’ floating-point exception is raised if the mathematical result is an exact infinity and the ''overflow'' floating-point exception is raised otherwise.

It is best not to check for errors by comparing the returned value against HUGE_VAL or 0 for several reasons:

...

It is also difficult to check for math errors using errno because an implementation might not set it. For real functions, the programmer can tell whether the implementation sets errno by checking whether math_errhandling & MATH_ERRNO is nonzero. For complex functions, the C99C standard, Section 7.3.2, simply states that "an implementation may set errno but is not required to" [ISO/IEC 9899:19992011].

The System V Interface Definition, Third Edition (SVID3), provides more control over the treatment of errors in the math library. The user can provide a function named matherr that is invoked if errors occur in a math function. This function can print diagnostics, terminate the execution, or specify the desired return - value. The matherr() function has not been adopted by C99C, so its use is not generally portable.

The following error-handing template uses C99 C standard functions for floating-point errors when the C99 C macro math_errhandling is defined and indicates that they should be used, ; otherwise it examines errno.

#include <math.h>
#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
#include <fenv.h>
#endif

/* ... */

#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
  feclearexcept(FE_ALL_EXCEPT);
#endif
errno = 0;

/* call the function */

#if !defined(math_errhandling) \
  || (math_errhandling & MATH_ERRNO)
if (errno != 0) {
  /* handle range error */
}
#endif
#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
if (fetestexcept(FE_INVALID
               | FE_DIVBYZERO
               | FE_OVERFLOW
               | FE_UNDERFLOW) != 0) {
  /* handle range error */
}
#endif

See recommendation FLP03-C. Detect and handle floating point errors for more details on how to detect floating-point errors.

sqrt(x)

Noncompliant Code Example

...

double x;
double result;

result = sqrt(x);

However, this code may produce a domain error if x is negative.

Compliant Solution

Since this function has domain errors but no range errors, one can use bounds checking to can be used to prevent domain errors.

double x;
double result;

if (isless(x, 0)) {
  /* handle domain error */
}

result = sqrt(x);

cosh(x), sinh(x)

Noncompliant Code Example (Range Errors)

...

double x;
double result;

result = cosh(x);

...

Since this function has no domain errors but may have range errors, one must  the programmer must detect a range error and act accordingly.

#include <math.h>
#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
#include <fenv.h>
#endif

/* ... */

#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
  feclearexcept(FE_ALL_EXCEPT);
#endif
errno = 0;

double x;
double result;

result = sinh(x);

#if !defined(math_errhandling) \
  || (math_errhandling & MATH_ERRNO)
if (errno != 0) {
  /* handle range error */
}
#endif
#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
if (fetestexcept(FE_INVALID
               | FE_DIVBYZERO
               | FE_OVERFLOW
               | FE_UNDERFLOW) != 0)
{
  /* handle range error */
}
#endif

pow(x, y)

Noncompliant Code Example

...

double x;
double y;
double result;

result = pow(x, y);

However, this code may produce a domain error if x is negative and y is not an integer , or if x is zero and y is zero. A domain error or range error may occur if x is zero and y is negative, and a range error may occur if the result cannot be represented as a double.

...

Since the pow() function can produce both domain errors and range errors, we must  the programmer must first check that x and y lie within the proper domain. We must also detect , then detect if a range error occurs , and act accordingly.

#include <math.h>
#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
#include <fenv.h>
#endif

/* ... */

#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
  feclearexcept(FE_ALL_EXCEPT);
#endif
errno = 0;

/* call the function */

double x;
double y;
double result;

if (((x == 0.f) && islessequal(y, 0)) || (isless(x, 0))) {
  /* handle domain error */
}

result = pow(x, y);

#if !defined(math_errhandling) \
  || (math_errhandling & MATH_ERRNO)
if (errno != 0) {
  /* handle range error */
}
#endif
#if defined(math_errhandling) \
  && (math_errhandling & MATH_ERREXCEPT)
if (fetestexcept(FE_INVALID
               | FE_DIVBYZERO
               | FE_OVERFLOW
               | FE_UNDERFLOW) != 0)
{
  /* handle range error */
}
#endif

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT C++ Secure Coding Standard: FLP32-CPP. Prevent or detect domain and range errors in math functions

ISO/IEC 9899:19992011 Section 7.3, "Complex arithmetic <complex.h>", and Section 7.12, "Mathematics <math.h>"

MITRE CWE: CWE-682, "Incorrect Calculationcalculation"

Bibliography

[Plum 1985] Rule 2-2
[Plum 1989] Topic 2.10, "conv - conversions conv—conversions and overflow"

...