Page History

Floating-point numbers can take on two classes of three exceptional values; : infinity, -infinity, and NaN (not-a-number). These values are returned produced as the a result of exceptional or otherwise unresolvable floating-point operations. (See also: FLP32-C. Prevent or detect domain and range errors in math functions). Additionally, they can be parsed from user input using , such as division by zero. These exceptional values can also be obtained directly from user input through methods such as Double.valueOf(Stirng String s) or a similar method. Failure to detect and handle such exceptional values can result in undefined inconsistent behavior. NaN values are particularly problematic, as the expression NaN==NaN (for every possible value of NaN) returns false. Any comparisons made with NaN as one of the arguments returns false, and all arithmetic functions on NaNs simply propagate them through the code. Hence, a NaN entered in one location in the code and not properly handled could potentially cause problems in other, more distant sections.

The method Double.valueOf(String s) can return NaN or an infinite double as normal operation, as specified by its contract. Programs should therefore check to must ensure that all input floating-point values inputs (especially those controlled by obtained from the user) do not have either of these values if doing so would be inappropriate.  are free of unexpected exceptional values. The methods Double.isNaN(double d) and Double.isInfinite(double d) can be used to do the appropriate testingfor this purpose.

NaN values are particularly problematic because they are unordered. That is, the expression NaN == NaN always returns false (see NUM07-J. Do not attempt comparisons with NaN for more information).

Noncompliant Code Example

The following This noncompliant code example accepts user data without first validating it.:

double currentBalance; /*/ User's cash balance */

void doDeposit(String userInput) {
  double val = 0;

  try {
      val = Double.valueOf(userInput);
  }
 catch catch(NumberFormatException e) {
     // /*Handle input format error*/
  }

  if (val>=val >= Double.MAX_VALUE - currentBalance) {
    //* Handle range error*/
  }

  currentBalance += val;
}

This can be a problem if an invalid code produces unexpected results when an exceptional value is entered for val and subsequently used for in calculations or as control values. The user could, for example, input the strings "Infinity" infinity or "NaN" on the command line, which would be parsed by Double.valueOf(String s) into the floating-point representations of either infinity and or NaN. All subsequent calculations using these values would be invalid, possibly crashing the program and enabling a DOS attack.causing runtime exceptions or enabling denial-of-service (DoS) attacks.

In this noncompliant Here, for example, entering "NaN" for val would force cause currentBalance to be set to also equal "NaN", corrupting its value. If this value is used elsewhere for calculationswere used in other expressions, every resulting value would also be become NaN, possibly destroying corrupting important data.

Compliant

...

Solution

This compliant solution The following code first validates the floating-point input float before using it. The value is tested to ensure that it is neither infinity nor negative , -infinity, nor NaN.

double currentBalance; /*/ User's cash balance */

void doDeposit(String suserInput){
  double val = 0;

  try {
      val = Double.valueOf(userInput);
  }
 catch catch(NumberFormatException e) {
     // /*Handle input format error*/
  }

  if (Double.isInfinite(val)){

    /*/ handleHandle infinity error */

  }

  if (Double.isNaN(val)) {

    /*/ handleHandle NaN error */

  }

  if (val>=val >= Double.MAX_VALUE - currentBalance) {
    //* Handle range error*/
  }

  currentBalance += val;
}

Exceptions

NUM08-J-EX0: Occasionally, NaN, infinity, or -infinity may be acceptable or as expected inputs to a program. If this is the case, then In such cases, explicit checks may might not be necessary. Such However, such programs must , however, be prepared to handle these inputs gracefully and not blindly use them in mathematical expressions where they are not appropriateexceptional values gracefully and should prevent propagation of the exceptional values to other code that fails to handle exceptional values. The choice to permit input of exceptional values during ordinary operation should be explicitly documented.

Risk Assessment

Inappropriate Incorrect or missing validation of floating-point inputs input can result in invalid calculations miscalculations and unexpected results, possibly leading to crashing and providing a DOS opportunityinconsistent program behavior and denial of service.

Automated Detection

...

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

...

Automated detection is infeasible in the general case. It could be possible to develop a taint-like analysis that detects many interesting cases.

Tool	Version	Checker	Description
Parasoft Jtest	Include Page Parasoft_V Parasoft_V	CERT.NUM08.FPEXC	Check floating-point inputs for exceptional values

Related Guidelines

References

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[[IEEE 754|https://www.securecoding.cert.org/confluence/display/seccode/AA.+C+References#AA.CReferences-IEEE7542006|IEEE 754]\] \[[ISO/IEC 9899:1999|https://www.securecoding.cert.org/confluence/display/seccode/AA.+C+References#AA.CReferences-ISO%2FIEC98991999|ISO/IEC 9899:1999]\] \[[IEEE 1003.1, 2004|https://www.securecoding.cert.org/confluence/display/seccode/AA.+C+References#AA.CReferences-IEEE1003|IEEE 1003.1, 2004]\]