34814f787b
These links are no longer relevant since SANS now just link to CWE, and we already have links to CWEs.
54 lines
1.3 KiB
Plaintext
54 lines
1.3 KiB
Plaintext
== Why is this an issue?
|
|
|
|
When division is performed on ``++int++``s, the result will always be an ``++int++``. You can assign that result to a ``++double++``, ``++float++`` or ``++decimal++`` with automatic type conversion, but having started as an ``++int++``, the result will likely not be what you expect. If the result of ``++int++`` division is assigned to a floating-point variable, precision will have been lost before the assignment. Instead, at least one operand should be cast or promoted to the final type before the operation takes place.
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,csharp]
|
|
----
|
|
static void Main()
|
|
{
|
|
decimal dec = 3/2; // Noncompliant
|
|
Method(3/2); // Noncompliant
|
|
}
|
|
|
|
static void Method(float f) { }
|
|
----
|
|
|
|
=== Compliant solution
|
|
|
|
[source,csharp]
|
|
----
|
|
static void Main()
|
|
{
|
|
decimal dec = (decimal)3/2;
|
|
Method(3.0F/2);
|
|
}
|
|
|
|
static void Method(float f) { }
|
|
----
|
|
|
|
== Resources
|
|
|
|
* https://cwe.mitre.org/data/definitions/190[MITRE, CWE-190] - Integer Overflow or Wraparound
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Cast one of the operands of this division to "xxx".
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|