Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: edited

Floating-point numbers can take on two classes kinds of exceptional values; , infinity and NaN (not-a-number). These values are returned produced as the a result of exceptional or otherwise unresolvable floating point operations. (See also: , FLP32-C. Prevent or detect domain and range errors in math functions). Additionally, they can be parsed obtained directly from user input using through the aid of methods like Double.valueOf(Stirng String s) or a similar method. Failure to detect and handle such values can result in undefined inconsistent behavior.

NaN values are particularly problematic, as the expression NaN == NaN (for every possible value of NaN) returns false. Any always returns false (See FLP02-J. Do not attempt comparisons with NaN). In general, any comparisons made with NaN as one of the arguments returns return false, and all arithmetic functions on NaNs NaN inputs simply propagate them through the taint throughout the code. Hence, a NaN entered in one location in the code and not properly handled could potentially cause problems in other, more distant sections.just one occurrence of a NaN value can effectuate negative repercussions within other code segments.

The method Double.valueOf(String s) can return NaN or an infinite double as normal operationspecified by its contract. Programs should therefore check install checks to ensure that all input floating point values inputs (especially those controlled by obtained from the user) do not have contain either of these values if doing so would be inappropriate.  before proceeding to operate on them. The methods Double.isNaN(double d) and Double.isInfinite(double d) can be used to do the appropriate testing.  Be sure to not attempt checking using "d == Double.NaN" instead of "Double.isNaN(d)" as per FLP02-J. Do not attempt comparisons with NaNfor this purpose.

Noncompliant Code Example

The following noncompliant code accepts user data without first validating it.

Code Block
bgColor#FFCCCC

double currentBalance; /* User's cash balance */

void doDeposit(String userInput){
  double val;

  try {
      val = Double.valueOf(userInput);
  }
  catch(NumberFormatException e) {
      /*Handle input format error*/
  }

  if(val>val >= Double.MAX_VALUE - currentBalance) {
    /*Handle range error*/
  }

  currentBalance+=val;
}

This can be a problem if an invalid value is entered for val and subsequently used for in calculations or as control values. The user could, for example, input the strings "Infinity" or "NaN" on the command line, which would be parsed by Double.valueOf(String s) into the floating-point representations of either infinity and or NaN. All subsequent calculations using these values would be invalid, possibly crashing the program and enabling a DOS DoS attack.

Here, for example, entering "NaN" for val would force currentBalance to also equal "NaN", corrupting its value. If this value is used elsewhere for calculationsin other expressions, every resulting value would also be NaN, possibly destroying important data.

...

The following code first validates the floating point input float before using it. The value is tested to ensure that it is neither infinity nor , negative infinity nor NaN.

Code Block
bgColor#ccccff

double currentBalance; /* User's cash balance */

void doDeposit(String s){
  double val;

  try {
      val = Double.valueOf(userInput);
  }
  catch(NumberFormatException e) {
      /*Handle input format error*/
  }

  if (Double.isInfinite(val)){

    /* handle infinity error */

  }

  if (Double.isNaN(val)) {

    /* handle NaN error */

  }

  if(val>val >= Double.MAX_VALUE-currentBalance) {
    /*Handle range error*/
  }

  currentBalance+=val;
}

Exceptions

Occasionally, NaN or infinity may be acceptable or expected inputs to a program. If this is the case, then explicit checks may not be necessary. Such programs must, however, be prepared to handle these inputs gracefully and not blindly use should not allow the propagation of taint to other values when using them in mathematical expressions where they are not appropriateinappropriate.

Risk Assessment

Inappropriate Incorrect or missing validation of floating point inputs can result in invalid calculations miscalculations and unexpected results, possibly leading to crashing and providing a DOS opportunityinconsistent program behavior and denial of service (DoS).

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

FLP04-J.

low

probable

high medium

P6 P4

L2 L3

Automated Detection

TODO

Related Vulnerabilities

...