The C Standard, 7.12.1 [ISO/IEC 9899:20112024], defines three types of errors that relate specifically to math functions in <math.h>
. Paragraph 2 states
...
A pole error (also known as a singularity or infinitary) occurs if the mathematical function has an exact infinite result as the finite input argument(s) are approached in the limit.
Paragraph 4 states
A arange error occurs if and only if the mathematical result of the function cannot be represented in an object of the specified type, due to extreme magnitude.result overflows or underflows
An example of a domain error is the square root of a negative number, such as sqrt(-1.0)
, which has no meaning in real arithmetic. Contrastingly, 10 raised to the 1-millionth power, pow(10., 1e6)
, cannot be represented in many floating-point implementations because of the limited range of the type double
and consequently constitutes a range error. In both cases, the function will return some value, but the value returned is not the correct result of the computation. An example of a pole error is log(0.0)
, which results in negative infinity.
...
Function | Domain | Range | Pole |
---|---|---|---|
|
| No | No |
asin(x) | -1 <= x && x <= 1 | Yes | No |
atan(x) | None | Yes | No |
|
| No | No |
|
| Yes | No |
asinh(x) | None | Yes | No |
|
| Yes | Yes |
| None | Yes | No |
| None | Yes | No |
| None | Yes | No |
|
| No | Yes |
|
| No | Yes |
|
| Yes | No |
logb(x) | x != 0 | Yes | Yes |
| None | Yes | No |
| None | Yes | No |
|
| Yes | Yes |
|
| No | No |
erf(x) | None | Yes | No |
| None | Yes | No |
|
| Yes | Yes |
| None | Yes | No |
|
| Yes | No |
| None | Yes | No |
| None | Yes | No |
| None | Yes | No |
...
The exact treatment of error conditions from math functions is tedious. The C Standard, 7.12.1 paragraph 5 [ISO/IEC 9899:20112024], defines the following behavior for floating-point overflow:
A floating result overflows if the magnitude of the mathematical result is finite but so large that the mathematical result cannot be represented without extraordinary roundoff error in an object of the specified type. a finite result value with ordinary accuracy would have magnitude (absolute value) too large for the representation with full precision in the specified type. A result that is exactly an infinity does not overflow. If a floating result overflows and default rounding is in effect, then the function returns the value of the macro HUGE_VAL, HUGE_VALF, or HUGE_VALL according to the return type, with the same sign as the correct value of the function; if the integer expression
math_errhandling & MATH_ERRNO
is nonzero, the integer expressionerrno
acquires the valueERANGE
; if the integer expression however, for the types with reduced-precision representations of numbers beyond the overflow threshold, the function may return a representation of the result with less than full precision for the type. If a floating resultoverflowsanddefaultroundingisineffectandtheintegerexpressionmath_errhandling & MATH_ERRNO is nonzero, then the integer expression errno acquires the value ERANGE. If a floating result overflows, and the integer expression math_errhandling & MATH_ERREXCEPT is nonzero, the the "overflow" floating-point exception is raised (regardless of whether default rounding is in effect).
It is preferable not to check for errors by comparing the returned value against HUGE_VAL
or 0
for several reasons:
...
It can be unreliable to check for math errors using errno
because an implementation might not set errno
. For real functions, the programmer determines if the implementation sets errno
by checking whether math_errhandling & MATH_ERRNO
is nonzero. For complex functions, the
The C Standard, 7.3.2, paragraph 1 , simply states that "an [ISO/IEC 9899:2024], states:
an implementation may set
errno
but is not required to
...
.
The obsolete System V Interface Definition (SVID3) [UNIX 1992] provides more control over the treatment of errors in the math library. The programmer can define a function named matherr()
that is invoked if errors occur in a math function. This function can print diagnostics, terminate the execution, or specify the desired return value. The matherr()
function has not been adopted by C or POSIX, so it is not generally portable.
...
A subnormal number is a nonzero number that does not use all of its precision bits [IEEE 754 2006]. These numbers can be used to represent values that are closer to 0 than the smallest normal number (one that uses all of its precision bits). However, the asin()
, asinh()
, atan()
, atanh()
, and erf()
functions may produce range errors, specifically when passed a subnormal number. When evaluated with a subnormal number, these functions can produce an inexact, subnormal value, which is an underflow error.
The C Standard, 77.12.1, paragraph 6 [ISO/IEC 9899:20112024], defines the following behavior for floating-point underflow:
The result underflows if
the magnitude of the mathematical result is so small that the mathematical result cannot be represented, without extraordinary roundoff error, in an object of the specified type.a nonzero result value with ordinary accuracy would have magnitude (absolute value) less than the minimum normalized number in the type; however a zero result that is specified to be an exact zero does not underflow. Also, a result with ordinary accuracy and the magnitude of the minimum normalized number may underflow.269) If the result underflows, the function returns an implementation-defined value whose magnitude is no greater than the smallest normalized positive number in the specified type; if the integer expression math_errhandling & MATH_ERRNO is nonzero, whether errno
acquiresacquires the value ERANGE
isis implementation-defined; if the integer expression math_errhandling & MATH_ERREXCEPT
iss nonzero, whether the
‘‘underflow’’"underflow" floating-point exception is raised is implementation-defined.
Implementations that support floating-point arithmetic but do not support subnormal numbers, such as IBM S/360 hex floating-point or nonconforming IEEE-754 implementations that skip subnormals (or support them by flushing them to zero), can return a range error when calling one of the following families of functions with the following arguments:
...
If Annex F is supported and subnormal results subnormal results are supported, the returned value is exact and a range error cannot occur. The C Standard, F.10.7.1 paragraph 2 [ISO/IEC 9899:20112024], specifies the following for the fmod()
, remainder()
, and remquo()
functions:
...
Tool | Version | Checker | Description | Parasoft C/C++test | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Include Page | Parasoft_V | Parasoft_V | CERT_C-FLP32-a | Validate values passed to library functions | Polyspace Bug Finder | |||||||||
Include Page | Polyspace Bug Finder_V | Polyspace Bug Finder_V | ||||||||||||
Astrée |
| stdlib-limits | Partially checked | |||||||||||
Axivion Bauhaus Suite |
| CertC-FLP32 | Partially implemented | |||||||||||
CodeSonar |
| MATH.DOMAIN.ATAN MATH.DOMAIN.TOOHIGH MATH.DOMAIN.TOOLOW MATH.DOMAIN MATH.RANGE MATH.RANGE.GAMMA MATH.DOMAIN.LOG MATH.RANGE.LOG MATH.DOMAIN.FE_INVALID MATH.DOMAIN.POW MATH.RANGE.COSH.TOOHIGH MATH.RANGE.COSH.TOOLOW MATH.DOMAIN.SQRT | Arctangent Domain Error Argument Too High Argument Too Low Floating Point Domain Error Floating Point Range Error Gamma on Zero Logarithm on Negative Value Logarithm on Zero Raises FE_INVALID Undefined Power of Zero cosh on High Number cosh on Low Number sqrt on Negative Value | |||||||||||
Helix QAC |
| C5025 C++5033 | ||||||||||||
Parasoft C/C++test |
| CERT_C-FLP32-a | Validate values passed to library functions | |||||||||||
PC-lint Plus |
| 2423 | Partially supported: reports domain errors for functions with the Semantics *dom_1, *dom_lt0, or *dom_lt1, including standard library math functions | |||||||||||
Polyspace Bug Finder |
| CERT-C: Rule FLP32-C | Checks for invalid use of standard library floating point routine (rule fully covered) | |||||||||||
RuleChecker |
| stdlib-limits | Partially checked | |||||||||||
TrustInSoft Analyzer |
| out-of-range argument | Partially verified. | Invalid use of standard library floating point routine | Wrong arguments to standard library function | PRQA QA-C | 9.1 | 5025 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
Bibliography
[ISO/IEC 9899:20112024] | 7.3.2, "Conventions" |
[IEEE 754 2006 ] | |
[Plum 1985] | Rule 2-2 |
[Plum 1989] | Topic 2.10, "conv—Conversions and Overflow" |
[UNIX 1992] | System V Interface Definition (SVID3) |
...