Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: REM cost reform

Decimal Literal decimal floating-point numbers cannot always be precisely represented as a BigDecimal if an IEEE 754 floating-point value. Consequently, the BigDecimal(double val) constructor is usedmust not be passed a floating-point literal as an argument when doing so results in an unacceptable loss of precision.

Noncompliant Code Example

This noncompliant code example passes a double value to the BigDecimal constructor. Because of thisthe decimal literal 0.1 cannot be precisely represented by a double, precision of the literal BigDecimal is affected.

Code Block
bgColor#FFcccc

// printsPrints 0.1000000000000000055511151231257827021181583404541015625
// when run in FP-strict mode 
System.out.println(new BigDecimal(0.1)); 

Compliant Solution

This compliant solution passes the decimal literal as a String so that the BigDecimal(String val) constructor is invoked . and the precision is preserved:

Code Block
bgColor#ccccff

// printsPrints 0.1
// when run in FP-strict mode 
System.out.println(new BigDecimal(""0.1""));

Risk Assessment

Using the BigDecimal constructor that accepts decimal (double val) constructor with decimal floating-point literals can lead to loss of precision.

Rule

Severity

Likelihood

Detectable

Remediation Cost

Repairable

Priority

Level

FLP33

NUM10-J

Low

low

Probable

probable

Yes

low

Yes

P6

L2

Automated Detection

...

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Automated detection is straightforward.

ToolVersionCheckerDescription
Klocwork

Include Page
Klocwork_V
Klocwork_V

JAVA.BIGDEC.FLOAT
Parasoft Jtest
Include Page
Parasoft_V
Parasoft_V
CERT.NUM10.BBDCCDo not pass floating point values to the 'BigDecimal' constructor
PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V6068
SonarQube
Include Page
SonarQube_V
SonarQube_V
S2111"BigDecimal(double)" should not be used

Bibliography


...

Image Added Image Added Image Added

References

[JLS 05]

FLP32-J. Range check before casting floating point numbers to narrower types      07. Floating Point (FLP)      07. Floating Point (FLP)