Division and modulo operations are susceptible to divide-by-zero errors. According to C11, Section 6.5.5, para. 5  [ISO/IEC 9899:2011],

The result of the / operator is the quotient from the division of the first operand by the second; the result of the % operator is the remainder. In both operations, if the value of the second operand is zero, the behavior is undefined.

(See also undefined behavior 45 of Annex J.)

Division

The result of the / operator is the quotient from the division of the first arithmetic operand by the second arithmetic operand. Division operations are susceptible to divide-by-zero errors. Overflow can also occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. (See INT32-C. Ensure that operations on non-atomic signed integers do not result in overflow.)

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the division of the signed operands sl1 and sl2.

signed long sl1, sl2, result;

/* Initialize sl1 and sl2 */

result = sl1 / sl2;

Compliant Solution

This compliant solution tests the suspect division operation to guarantee there is no possibility of divide-by-zero errors or signed overflow.

signed long sl1, sl2, result;

/* Initialize sl1 and sl2 */

if ( (sl2 == 0) || ( (sl1 == LONG_MIN) && (sl2 == -1) ) ) {
  /* handle error condition */
}
else {
  result = sl1 / sl2;
}

Modulo

The modulo operator provides the remainder when two operands of integer type are divided.

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the modulo operation on the signed operands sl1 and sl2.

signed long sl1, sl2, result;

/* Initialize sl1 and sl2 */

result = sl1 % sl2;

Compliant Solution

This compliant solution tests the suspect modulo operation to guarantee there is no possibility of a divide-by-zero error or an overflow error.

signed long sl1, sl2, result;

/* Initialize sl1 and sl2 */

if ( (sl2 == 0 ) || ( (sl1 == LONG_MIN) && (sl2 == -1) ) ) {
  /* handle error condition */
}
else {
  result = sl1 % sl2;
}

Risk Assessment

A divide by zero can result in abnormal program termination and denial of service.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: INT33-CPP. Ensure that division and modulo operations do not result in divide-by-zero errors

CERT Oracle Secure Coding Standard for Java: NUM02-J. Ensure that division and modulo operations do not result in divide-by-zero errors

ISO/IEC 9899:2011 Section 6.5.5, "Multiplicative operators"

ISO/IEC TR 17961 (Draft) Dividing by zero [divzero]

MITRE CWE: CWE-369, "Divide By Zero"

Bibliography

[Seacord 2005] Chapter 5, "Integers"
[Warren 2002] Chapter 2, "Basics"