SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 187

changes.mady.by.user Pamela Curtis

Saved on

compared with

New Version 188

changes.mady.by.user Pamela Curtis

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Wiki Markup
When a mathematical operation cannot be represented using the supplied integer types, Java's built-in integer operators silently wrap the result, without indicating overflow. This can result in incorrect computations and unanticipated outcomes. Failure to account for integer overflow has resulted in failures of real systems, for example, when implementing the {{compareTo()}} method. The meaning of the return value of the {{compareTo()}} method is defined only in terms of its sign and whether it is zero; the magnitude of the return value is irrelevant. Consequently, an apparent but incorrect optimization would be to subtract the operands and return the result. For operands of opposite signs, this can result in integer overflow, consequently violating the {{compareTo()}} contract \[[Bloch 2008, Item 12|AA. Bibliography#Bloch 08], Item 12\].

Comparison of Compliant Techniques

...

The CERT C Secure Coding Standard

INT32-C. Ensure that operations on signed integers do not result in overflow

The CERT C++ Secure Coding Standard

INT32-CPP. Ensure that operations on signed integers do not result in overflow

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3ee11ca4a6820060-73a134de-41f34b56-b4b695b0-33a1fcf444aab651c4476ae4"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Wrap?around Error [XYY]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-682, "Incorrect Calculation"

 

CWE-190, "Integer Overflow or Wraparound"

 

CWE-191, "Integer Underflow (Wrap or Wraparound)"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5e95d88dabf02413-5523525e-49154c6c-84f5ae67-912462290c31ea69fc58c34d"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

class [AtomicInteger

http://download.oracle.com/javase/6/docs/api/java/util/concurrent/atomic/AtomicInteger.html]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="06f4bcd7e2ea8e68-85d93252-44ee47b1-9d12bf16-90f3715f485a4e2dbfca3c98"><ac:plain-text-body><![CDATA[

[[Bloch 2005

AA. Bibliography#Bloch 05]]

Puzzle 27: Shifty i's

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ad0069bf6fdfdbb5-3f2d0640-4e8a40bf-848f9434-13451458a0571041314cad96"><ac:plain-text-body><![CDATA[

[[JLS 2005

AA. Bibliography#JLS 05]]

[§4.2.2, "Integer Operations"

http://java.sun.com/docs/books/jls/third_edition/html/typesValues.html#4.2.2]

]]></ac:plain-text-body></ac:structured-macro>

 

§15.22, "Bitwise and Logical Operators"

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c184a5b6c706cbbe-211e593d-425047ee-9ed2b287-9b75d8933e636d9a27e008d4"><ac:plain-text-body><![CDATA[

[[Seacord 2005

AA. Bibliography#Seacord 05]]

Chapter 5. Integers

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d2858c95b0d571b9-87129be9-422e4d7d-9113961f-ba8c6d880cc9f46fb0e1e019"><ac:plain-text-body><![CDATA[

[[Tutorials 2008

AA. Bibliography#Tutorials 08]]

Primitive Data Types

]]></ac:plain-text-body></ac:structured-macro>

...