You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 82 Next »

Division and modulo operations are susceptible to divide-by-zero errors. 

C identifies two conditions under which division and modulo operations result in undefined behavior:

UBDescription

45

The value of the second operand of the / or % operator is zero (6.5.5).

n/aIf the quotient a/b is not representable, . . . the behavior of both a/b and a%b is undefined (6.5.5).

Division

The result of the / operator is the quotient from the division of the first arithmetic operand by the second arithmetic operand. Division operations are susceptible to divide-by-zero errors. Overflow can also occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. (See INT32-C. Ensure that operations on signed integers do not result in overflow.)

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the division of the signed operands s_a and s_b:

signed long s_a;
signed long s_b;
signed long result;

void func(void) {
  /* Initialize s_a and s_b */
  result = s_a / s_b;

  /* ... */
}

Compliant Solution

This compliant solution tests the suspect division operation to guarantee there is no possibility of divide-by-zero errors or signed overflow:

#include <limits.h>
 
signed long s_a;
signed long s_b;
signed long result;

void func(void) {
  /* Initialize s_a, s_b and result*/

  if ( (s_b == 0) || ( (s_a == LONG_MIN) && (s_b == -1) ) ) {
    /* Handle error condition */
  } else {
    result = s_a / s_b;
  }

  /* ... */
}

Modulo

The modulo operator provides the remainder when two operands of integer type are divided.

Noncompliant Code Example

This noncompliant code example can result in a divide-by-zero error during the modulo operation on the signed operands s_a and s_b:

signed long s_a;
signed long s_b;
signed long result;

void func(void) {
  /* Initialize s_a and s_b */
  result = s_a % s_b;

  /* ... */
}

Compliant Solution

This compliant solution tests the suspect modulo operation to guarantee there is no possibility of a divide-by-zero error or an overflow error:

#include <limits.h>
 
signed long s_a;
signed long s_b;
signed long result;

void func(void) {
  /* Initialize s_a, s_b and result*/

  if ( (s_b == 0 ) || ( (s_a == LONG_MIN) && (s_b == -1) ) ) {
    /* Handle error condition */
  } else {
    result = s_a % s_b;
  }
  /* ... */
}

Risk Assessment

A divide by zero can result in abnormal program termination and denial of service.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

INT33-C

low

likely

medium

P6

L2

Automated Detection

Tool

Version

Checker

Description

Compass/ROSE

  

Can detect some violations of this rule. In particular, it ensures that all operations involving division or modulo are preceded by a check ensuring that the second operand is nonzero

Coverity6.5DIVIDE_BY_ZEROFully Implemented
Fortify SCA5.0 

Can detect violations of this rule with CERT C Rule Pack

LDRA tool suite

9.7.1

43 D
248 S

Partially implemented
PRQA QA-C
Unable to render {include} The included page could not be found.

2830 (C)
2831 (D)
2832 (A)
2833 (S)
2834 (P)

Fully implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

[Seacord 2013]Chapter 5, "Integer Security"
[Warren 2002]Chapter 2, "Basics"

 


  • No labels