Division and modulo operations are susceptible to divide-by-zero errors. 

The C Standard identifies two conditions under which division and modulo operations result in undefined behavior (UB):

Division

The result of the / operator is the quotient from the division of the first arithmetic operand by the second arithmetic operand. Division operations are susceptible to divide-by-zero errors. Overflow can also occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. (See INT32-C. Ensure that operations on signed integers do not result in overflow.)

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the division of the signed operands s_a and s_b. 

void func(signed long s_a, signed long s_b) {
  if ((s_a == LONG_MIN) && (s_b == -1)) {
    /* Handle error */
  } else {
    signed long result = s_a / s_b;
  }
  /* ... */
}

Compliant Solution

This compliant solution tests the suspect division operation to guarantee there is no possibility of divide-by-zero errors or signed overflow:

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if ((s_b == 0) || ((s_a == LONG_MIN) && (s_b == -1))) {
    /* Handle error */
  } else {
    result = s_a / s_b;
  }

  /* ... */
}

Remainder

The remainder operator provides the remainder when two operands of integer type are divided. 

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the modulo operation on the signed operands s_a and s_b.

void func(signed long s_a, signed long s_b) {
  if ((s_a == LONG_MIN) && (s_b == -1)) {
    /* Handle error */
  } else {
    signed long result = s_a % s_b;
  }
  /* ... */
}

Compliant Solution

This compliant solution tests the remainder operand to guarantee there is no possibility of a divide-by-zero error or an overflow error:

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if ((s_b == 0 ) || ((s_a == LONG_MIN) && (s_b == -1))) {
    /* Handle error */
  } else {
    result = s_a % s_b;
  }
  
  /* ... */
}

Compliant Solution (Absolute Value)

The division and remainder operators truncate toward 0, as specified in subclause 6.5.5, footnote 105, of the C Standard [ISO/IEC 9899:2011], which guarantees that

i % j

and

i % -j

are always equivalent.

However, the minimum signed value remainder −1 results in undefined behavior because the minimum signed value divided by -1 is not representable.

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if (s_b == 0 || (s_a == LONG_MIN && s_b == -1)) {
    /* Handle error */
  } else {
    if ((s_b < 0) && (s_b != LONG_MIN)) {
      s_b = -s_b;
    }
    result = s_a % s_b;
  }

  /* ... */
}

Risk Assessment

A divide by zero can result in abnormal program termination and denial of service.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography