...
| Wiki Markup |
|---|
When precise computation is necessary, carefully and methodically estimate the maximum cumulative error of the computations, regardless of whether decimal or binary is used, to ensure that the resulting error is within tolerances. Consider using numerical analysis to properly understand the numerical properties of the problem. A useful introduction can be found in \[[Goldberg 91|AA. C References#Goldberg 91]\]. |
...
Noncompliant Code Example
This non-compliant noncompliant code example takes the mean of ten numbers, and then checks to see if the mean matches the first number. It should, because the ten numbers are all 10.1. Yet, due to the imprecision of floating-point arithmetic, the computed mean does not match the numbers.
...
| Code Block |
|---|
array[0] = 10.100000 and total is 10.100000 array[1] = 10.100000 and total is 20.200001 array[2] = 10.100000 and total is 30.300001 array[3] = 10.100000 and total is 40.400002 array[4] = 10.100000 and total is 50.500000 array[5] = 10.100000 and total is 60.599998 array[6] = 10.100000 and total is 70.699997 array[7] = 10.100000 and total is 80.799995 array[8] = 10.100000 and total is 90.899994 array[9] = 10.100000 and total is 100.999992 mean is 10.099999 array[0] is not the mean |
Compliant Solution
This code may be fixed by replacing the floating point numbers with integers for the internal additions. Floats are used only when printing results, and when doing the division to compute the mean.
...
| Code Block |
|---|
array[0] = 10.100000 and total is 10.100000 array[1] = 10.100000 and total is 20.200000 array[2] = 10.100000 and total is 30.300000 array[3] = 10.100000 and total is 40.400000 array[4] = 10.100000 and total is 50.500000 array[5] = 10.100000 and total is 60.600000 array[6] = 10.100000 and total is 70.700000 array[7] = 10.100000 and total is 80.800000 array[8] = 10.100000 and total is 90.900000 array[9] = 10.100000 and total is 101.000000 mean is 10.100000 array[0] is the mean |
Risk Analysis
Using a representation other than floating point may allow for more precision and accuracy for critical arithmetic.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FLP02-A C | low | probable | high | P2 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[IEEE 754 2006|AA. C References#IEEE 754 2006]\] \[[ISO/IEC JTC1/SC22/WG11|AA. C References#ISO/IEC JTC1/SC22/WG11]\] \[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "PLF Floating Point Arithmetic" \[[ISO/IEC DTR 24732|AA. C References#ISO/IEC DTR 24732]\] \[[Goldberg 91|AA. C References#Goldberg 91]\] |
...
FLP01-C. Take care in rearranging floating point expressions 05. Floating Point (FLP) FLP03-AC. Detect and handle floating point errors