...
Double.valueOf(String s) can return NaN or an infinite double as normal operation. Programs should therefore check to ensure that all input floating point values (especially those controlled by the user) do not have either of these values if doing so would be inappropriate. Double.isNaN(double d) and Double.isInfinite(double d) can be used to do the appropriate testing. Be sure to not attempt checking using "d == Double.NaN" instead of "Double.isNaN(d)" as per FLP02-J. Do not attempt comparisons with NaN
Noncompliant Code Example
...
| Code Block | ||
|---|---|---|
| ||
double currentBalance; /* User's cash balance */
void doDeposit(String userInput){
double val;
try {
val = Double.valueOf(userInput);
}
catch(NumberFormatException e) {
/*Handle input format error*/
}
if(val>=Double.MAX_VALUE-currentBalance) {
/*Handle range error*/
}
currentBalance+=val;
}
|
...
| Code Block | ||
|---|---|---|
| ||
double currentBalance; /* User's cash balance */
void doDeposit(String s){
double val;
try {
val = Double.valueOf(userInput);
}
catch(NumberFormatException e) {
/*Handle input format error*/
}
if (Double.isInfinite(val)){
/* handle infinity error */
}
if (Double.isNaN(val)){
/* handle NaN error */
}
if(val>=Double.MAX_VALUE-currentBalance) {
/*Handle range error*/
}
currentBalance+=val;
}
|
...
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FLP04-CJ. | low | probable | high | P6 | L2 |
Automated Detection
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
This rule appears in the C Secure Coding Standard as FLP04-C. Check floating point inputs for exceptional values
...