...
The following noncompliant code accepts user data without first validating it.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
float currentBalance; /* User's cash balance */
void doDeposit() {
float val;
scanf("%f", &val);
if(val >= MAX_VALUE - currentBalance) {
/* Handle range error */
}
currentBalance += val;
}
|
...
The following table shows the value of currentBalance returned for various arguments.:
Input |
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
...
Search for vulnerabilities resulting from the violation of this recommendation on the CERT website.
Related Guidelines
| CERT C++ Secure Coding Standard | FLP04-CPP. Check floating-point inputs for exceptional values |
| CERT Oracle Secure Coding Standard for Java | FLP06-J. Check floating-point inputs for exceptional values |
Bibliography
...