| Note | ||
|---|---|---|
| ||
This rule may be deprecated and replaced by a similar guideline. 06/28/2014 -- Version 1.0 |
Java uses the IEEE 754 standard for floating-point representation. In this representation, floats are encoded using 1 sign bit, 8 exponent bits, and 23 mantissa bits. Doubles are encoded and used exactly the same way, except they use 1 sign bit, 11 exponent bits, and 52 mantissa bits. These bits encode the values of s, the sign; M, the significand; and E, the exponent. Floating-point numbers are then calculated as (-1)s * M * 2 E.
...
Using denormalized numbers can severely impair the precision of floating-point calculations; as a result, denormalized numbers must not be used.
Detecting Denormalized Numbers
The following code tests whether a float value is denormalized in FP-strict mode or for platforms that lack extended range support. Testing for denormalized numbers in the presence of extended range support is platform-dependent; see rule NUM06 NUM53-J. Use the strictfp modifier for floating-point calculation consistency across platforms for additional information.
...
Testing whether values of type double are denormalized is analogous.
Print Representation of Denormalized Numbers
Denormalized numbers can also be troublesome because their printed representation is unusual. Floats and normalized doubles, when formatted with the %a specifier, begin with a leading nonzero digit. Denormalized doubles can begin with a leading zero to the left of the decimal point in the mantissa.
...
| Code Block |
|---|
normalized float with %e : 2.350989e-38 normalized float with %a : 0x1.0p-125 denormalized float with %e : 7.174648e-43 denormalized float with %a : 0x1.0p-140 normalized double with %e : 8.900295e-308 normalized double with %a : 0x1.0p-1020 denormalized double with %e : 8.289046e-317 denormalized double with %a : 0x0.0000001p-1022 |
Noncompliant Code Example
This noncompliant code example attempts to reduce a floating-point number to a denormalized value and then restore the value.
...
| Code Block |
|---|
Original : 0.33333334 Denormalized: 2.8E-45 Restored : 0.4 |
Compliant Solution
Do not use code that could use denormalized numbers. When calculations using float produce denormalized numbers, use of double can provide sufficient precision.
...
| Code Block |
|---|
Original : 0.3333333333333333 Normalized: 2.333333333333333E-45 Restored : 0.3333333333333333 |
Exceptions
NUM05-J-EX0: Denormalized numbers are acceptable when suitable numerical analysis demonstrates that the computed values meet all accuracy and behavioral requirements appropriate to the application.
Risk Assessment
Floating-point numbers are an approximation; denormalized floating-point numbers are a less precise approximation. Use of denormalized numbers can cause unexpected loss of precision, possibly leading to incorrect or unexpected results. Although the severity for violations of this rule is low, applications that require accurate results should make every attempt to comply.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
NUM05-J | low | probable | high | P2 | L3 |
Related Vulnerabilities
CVE-2010-4476 [CVE 2008 ] reports a vulnerability in the Double.parseDouble() method in Java 1.6 update 23 and earlier, Java 1.5 update 27 and earlier, and 1.4.2_29 and earlier. This vulnerability causes a denial of service when this method is passed a crafted string argument. The value 2.2250738585072012e-308 is close to the minimum normalized, positive, double-precision floating-point number; when encoded as a string it triggers an infinite loop of estimations during conversion to a normalized or denormalized double.
Related Guidelines
Bibliography
Computer Systems: A Programmer's Perspective, Section 2.4, Floating Point | |
[CVE 2008 ] | |
[IEEE 754] |
|
| [Seacord 2015] | |
...