Page History

...

Division

The result of the / operator is the quotient from the division of the first arithmetic operand by the second arithmetic operand. Division operations are susceptible to divide-by-zero errors. Overflow can also occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. (See INT32-C. Ensure that operations on signed integers do not result in overflow.)

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the division of the signed operands s_a and s_b:. It can also result in a signed integer overflow error on twos-complement platforms. The IA-32 architecture, for example, requires that both conditions result in a fault, which can easily result in a denial-of-service attack.

void func(signed long s_a, signed long s_b) {
  signed long result = s_a / s_b;

  /* ... */
}

...

The modulo operator provides the remainder when two operands of integer type are divided. 

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the modulo operation on the signed operands operands s_a and  and s_b:. Furthermore, many hardware platforms implement modulo as part of the division operator, which can overflow. Overflow can occur during a modulo operation when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. This occurs despite that the result of such a modulo operation should theoretically be 0.

void func(signed long s_a, signed long s_b) {
  signed long result = s_a % s_b;

  /* ... */
}

Implementation Details

On x86 platforms, the modulo operator for signed integers is implemented by the idiv instruction code, along with the divide operator. Because LONG_MIN / -1 overflows, this code will throw a floating-point exception on LONG_MIN % -1.

...

On Microsoft Visual Studio 2013, taking the modulo of LONG_MIN by −1 results in abnormal termination on x86 and x64. On GCC/Linux, taking the modulo of LONG_MIN by −1 produces a floating-point exception. However, on GCC 4.2.4 and newer, with optimization enabled, taking the modulo of LONG_MIN by −1 yields the value 0.

Compliant Solution (Overflow Prevention)

This compliant solution tests the suspect modulo operation operand to guarantee there is no possibility of a divide-by-zero error or an (internal) overflow error:

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if ((s_b == 0 ) || ((s_a == LONG_MIN) && (s_b == -1))) {
    /* Handle error */
  } else {
    result = s_a % s_b;
  }
  
  /* ... */
}

Compliant Solution (Absolute Value)

This compliant solution is based on the fact that both the division and modulo operators truncate toward 0, as specified in subclause 6.5.5, footnote 105, of the C Standard [ISO/IEC 9899:2011], which guarantees that

i % j

and

i % -j

are always equivalent.

However, the minimum signed value modulo −1 results in undefined behavior because the minimum signed value divided by -1 is not representable.

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if (s_b == 0 || (s_a == LONG_MIN && s_b == -1)) {
    /* Handle error */
  } else {
    if ((s_b < 0) && (s_b != LONG_MIN)) {
      s_b = -s_b;
    }
    result = s_a % s_b;
  }

  /* ... */
}

Risk Assessment

...