Skip to end of metadata
Go to start of metadata

The object representation for floating-point values is implementation defined. However, an implementation that defines the __STDC_IEC_559__ macro shall conform to the IEC 60559 floating-point standard and uses what is frequently referred to as IEEE 754 floating-point arithmetic [ISO/IEC 9899:2011]. The floating-point object representation used by IEC 60559 is one of the most common floating-point object representations in use today.

All floating-point object representations use specific bit patterns to encode the value of the floating-point number being represented. However, equivalence of floating-point values is not encoded solely by the bit pattern used to represent the value. For instance, if the floating-point format supports negative zero values (as IEC 60559 does), the values -0.0 and 0.0 are equivalent and will compare as equal, but the bit patterns used in the object representation are not identical. Similarly, if two floating-point values are both (the same) NaN, they will not compare as equal, despite the bit patterns being identical, because they are not equivalent.

Do not compare floating-point object representations directly, such as by calling memcmp()or its moral equivalents. Instead, the equality operators (== and !=) should be used to determine if two floating-point values are equivalent.

Noncompliant Code Example

In this noncompliant code example, memcmp() is used to compare two structures for equality. However, since the structure contains a floating-point object, this code may not behave as the programmer intended.

#include <stdbool.h>
#include <string.h>
 
struct S {
  int i;
  float f;
};
 
bool are_equal(const struct S *s1, const struct S *s2) {
  if (!s1 && !s2)
    return true;
  else if (!s1 || !s2)
    return false;
  return 0 == memcmp(s1, s2, sizeof(struct S));
}

Compliant Solution

In this compliant solution, the structure members are compared individually:

#include <stdbool.h>
#include <string.h>
 
struct S {
  int i;
  float f;
};
 
bool are_equal(const struct S *s1, const struct S *s2) {
  if (!s1 && !s2)
    return true;
  else if (!s1 || !s2)
    return false;
  return s1->i == s2->i &&
         s1->f == s2->f;
}

Risk Assessment

Using the object representation of a floating-point value for comparisons can lead to incorrect equality results, which can lead to unexpected behavior.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

FLP37-C

Low

Unlikely

Medium

P2

L3

Automated Detection

Tool

Version

Checker

Description

Astrée
19.04
memcmp-with-floatPartially checked
Axivion Bauhaus Suite

6.9.0

CertC-FLP37Fully implemented
LDRA tool suite
9.7.1
618 SEnhanced Enforcement
Parasoft C/C++test

10.4.2

CERT_C-FLP37-a
CERT_C-FLP37-b
CERT_C-FLP37-c

Avoid accessing arrays out of bounds
Pointer arithmetic should not be used
Do not use object representations to compare floating-point values

Polyspace Bug Finder

R2018a

Memory comparison of float-point valuesObject representation of floating-point values can be different (same) for equal (not equal) floating-point values
 PRQA QA-C

9.5

 5026 
RuleChecker

19.04

memcmp-with-floatPartially checked

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

[ISO/IEC 9899:2011]Annex F, "IEC 60559 floating-point arithmetic"