Prevent or detect domain errors and range errors in math functions before using the results in further computations. Most of the math functions can fail, if they are given arguments which do not produce a proper result. For example, the square root of a negative number, such as sqrt(-1.0), has no meaning in arithmetic. This is known as a domain error; the argument is outside the domain over which the function is defined. For another example, ten raised to the one-millionth power, pow(10., 1e6), cannot be represented in any (current) floating representation. This is known as a range error; the result cannot be represented as a proper double number. In all such error cases, the function will return some value, but the value returned is not the correct result of the computation.

The System V Interface Definition, Third Edition (SVID3) provide more control over the treatment of errors in the math library. The user can provide a function named matherr which is invoked if errors occur in a math function. This function could print diagnostics, terminate the execution, or specify the desired return-value. The matherr() function has not been adopted by the C standard, so its use is not generally portable.

Math errors can be prevented by carefully bounds-checking before calling functions. In particular, the following domain errors should be prevented by prior bounds-checking:

The calling function should take alternative action if these bounds are violated.

acos( x ), asin( x )

Non-Compliant Code Example

This code may produce a domain error if the argument is not in the range [-1, +1].

float x, result;

result = acos(x);

Compliant Solution

This code uses bounds checking to ensure there is not a domain error.

float x, result;

if ( islessequal(x,-1) || isgreaterequal(x, 1) ){
     /* handle domain error */
}

result = acos(x);

atan2( y, x )

Non-Compliant Code Example

This code may produce a domain error if both x and y are zero.

float x, y, result;

result = atan2(y, x);

Compliant Solution

This code tests the arguments to ensure that there is not a domain error.

float x, y, result;

if ( fpclassify(x) == FP_ZERO && fpclassify(y) == FP_ZERO){
     /* handle domain error */
}

result = atan2(y, x);

log( x ), log10( x )

Non-Compliant Code Example

This code may produce a domain error if x is negative and a range error if x is zero.

float result, x;

result = log(x);

Compliant Solution

This code tests the suspect arguments to ensure no domain or range errors are raised.

float result, x;

if (islessequal(x, 0)){
     /* handle domain and range errors */
}

result = log(x);

pow( x, y )

Non-Compliant Code Example

This code may produce a domain error if x is zero and y less than or equal to zero. A range error may also occur if x is zero and y is negative.

float x, y, result;

result = pow(x, y);

Compliant Solution

This code tests x and y to ensure that there will be no range or domain errors.

float x, y, result;

if (fpclassify(x) == FP_ZERO && islessequal(y, 0)){
     /* handle domain error condition */
}

result = pow(x, y);

sqrt( x )

Non-Compliant Code Example

This code may produce a domain error if x is negative.

float x, result;

result = sqrt(x);

Compliant Solution

This code tests the suspect argument to ensure no domain error is raised.

float x, result;

if (isless(x, 0)){
     /* handle domain error */
}

result = sqrt(x);

Non-Compliant Coding Example (error checking)

The extract treatment of error conditions from math functions is quite complex (see C99 Section 7.12.1, "Treatment of error conditions".

The sqrt() function returns zero when given a negative argument. The pow() function returns a very large number (appropriately positive or negative) on an overflow range error. This very large number is defined in <math.h> as described by C99:

The macro

HUGE_VAL

expands to a positive double constant expression, not necessarily representable as a
float. The macros

HUGE_VALF
HUGE_VALL

are respectively float and long double analogs of HUGE_VAL.

It is best not to check for errors by comparing the returned value against HUGE_VAL or zero) for several reasons. First of all, these are in general valid (albeit unlikely) data values. Secondly, making such tests requires detailed knowledge of the various error returns for each math function. Also, there are three different possibilities - -HUGE_VAL, 0, and HUGE_VAL - and you must know which are possible in each case. Finally, different versions of the library have differed in their error-return behavior.

Compliant Solution (error checking)

A more reliable way to test for errors is by using the global variable errno. This variable is set to a non-zero value by any of the math functions that encounters an error. Thus, setting errno to zero prior to a computation, and testing it afterwards, reveals if any library errors were reported during the computation as in the following compliant solution:

errno = 0;
/* perform computation */
if (errno != 0) {
  /* handle the error */
}
else {
  /* computation succeeded */
}

Risk Assessment

Failure to properly verify arguments supplied to math functions may result in unexpected results.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 9899-1999TC3]] Section 7.12, "Mathematics <math.h>"
[[Plum 85]] Rule 2-2
[[Plum 91]] Topic 2.10, "conv - conversions and overflow"