Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

NaN values are particularly problematic because the expression NaN == NaN always returns false (See FLP02guideline FLP05-J. Do not attempt comparisons with NaN.) . In general, any comparisons with NaN return false, and all arithmetic functions on NaN inputs simply propagate the taint throughout the code. Just one occurrence of a NaN value can effectuate regressions within other code segments.

...

Code Block
bgColor#ccccff
double currentBalance; // User's cash balance

void doDeposit(String s){
  double val;
  try {
    val = Double.valueOf(userInput);
  }
  catch(NumberFormatException e) {
    // Handle input format error
  }

  if (Double.isInfinite(val)){
    // Handle infinity error
  }

  if (Double.isNaN(val)) {
    // Handle NaN error
  }

  if(val >= Double.MAX_VALUE - currentBalance) {
    // Handle range error
  }
  currentBalance += val;
}

Exceptions

FLP06-EX1: Occasionally, NaN or infinity may be acceptable as expected inputs to a program. In such cases, explicit checks may not be necessary. However, such programs must be prepared to handle these inputs gracefully and should not allow the propagation of taint to other values by using them in mathematical expressions where they are inappropriate.

...

Incorrect or missing validation of floating point input can result in miscalculations and unexpected results, possibly leading to inconsistent program behavior and Denial of Service (DoS).

Recommendation Guideline

Severity

Likelihood

Remediation Cost

Priority

Level

FLP06-J

low

probable

medium

P4

L3

...