The C Standard identifies the following condition under which division and remainder operations result in undefined behavior (UB):
UB | Description |
The value of the second operand of the |
Ensure that division and remainder operations do not result in divide-by-zero errors.
Division
The result of the /
operator is the quotient from the division of the first arithmetic operand by the second arithmetic operand. Division operations are susceptible to divide-by-zero errors. Overflow can also occur during two's complement signed integer division when the dividend is equal to the minimum (most negative) value for the signed integer type and the divisor is equal to −1.
(See INT32-C. Ensure that operations on signed integers do not result in overflow.)
Noncompliant Code Example
This noncompliant code example prevents signed integer overflow in compliance with INT32-C. Ensure that operations on signed integers do not result in overflow but fails to prevent a divide-by-zero error during the division of the signed operands s_a
and s_b
:
Compliant Solution
This compliant solution tests the division operation to guarantee there is no possibility of divide-by-zero errors or signed overflow:
Remainder
The remainder operator provides the remainder when two operands of integer type are divided.
Noncompliant Code Example
This noncompliant code example prevents signed integer overflow in compliance with INT32-C. Ensure that operations on signed integers do not result in overflow but fails to prevent a divide-by-zero error during the remainder operation on the signed operands s_a
and s_b
:
Compliant Solution
This compliant solution tests the remainder operand to guarantee there is no possibility of a divide-by-zero error or an overflow error:
Risk Assessment
A divide-by-zero error can result in abnormal program termination and denial of service.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
INT33-C | Low | Likely | Medium | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description |
---|---|---|---|
Astrée | 17.04i | int-division-by-zero int-modulo-by-zero | Fully checked |
CodeSonar | 4.4 | LANG.ARITH.DIVZERO | Division by zero |
Compass/ROSE | Can detect some violations of this rule (In particular, it ensures that all operations involving division or modulo are preceded by a check ensuring that the second operand is nonzero.) | ||
Coverity | 2017.07 | DIVIDE_BY_ZERO | Fully implemented |
Cppcheck | 1.66 | zerodiv zerodivcond | Context sensitive analysis of division by zero |
Klocwork | 2017 | DBZ.CONST DBZ.CONST.CALL DBZ.GENERAL DBZ.ITERATOR | |
LDRA tool suite | 9.5.6 | 43 D, 127 D, 248 S, 629 S, 80 X | Partially implemented |
Parasoft C/C++test | 9.5 | BD-PB-ZERO | Fully implemented |
Parasoft Insure++ | Runtime detection | ||
Polyspace Bug Finder | R2016a | Integer division by zero, Tainted division operand, Tainted modulo operand | Dividing integer number by zero Division Remainder |
PRQA QA-C | 9.3 | 2830 (C) | Fully implemented |
SonarQube C/C++ Plugin | 3.11 | S3518 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
[Seacord 2013b] | Chapter 5, "Integer Security" |
[Warren 2002] | Chapter 2, "Basics" |
6 Comments
Confluence Administrator
Add compliant solutions demonstrating the use of signals in Linux and structured exception handling in Windows?
John McDonald
Another division and modulo nuance that might be worth including is their ability to return negative numbers. This is probably obvious for division, but it can be surprising sometimes when (-10 % 1024) evaluates to -10. One possible concern would be in code for hash tables that takes a user malleable signed index.
David Svoboda
INT32 already has the NCCE/CCE pairs mentioned here. (although INT32 is strictly about signed integers.)
Robert Seacord (Manager)
I don't think the "stupid" NCE adds anything, and in fact, it recreates the problem you were trying to fix in having a noncompliant example that violates multiple rules.
David Svoboda
I added the 'stupid' NCCE b/c it is more likely to occur in the real world. Normally I am uncomfortable with NCCEs that violate multiple rules, but I feel less uncomfortable than usual here because we already have an NCCE (the 2nd one) that violates this rule but no others.
I considered adding this 'stupid' NCCE to INT32-C but felt that that rule was long enough already.
Robert Seacord
Yeah, no one does any checking in the real world, but based on our examples, they can figure out this is wrong. I'm going to remove.