FLP30-C. Do not use floating point variables as loop counters

Because floating point numbers can represent fractions, it is often mistakenly assumed that they can represent any simple fraction exactly. In fact, floating point numbers are subject to precision limitations just as integers are, and binary floating point numbers cannot represent all decimal fractions exactly, even if they can be represented in a small number of decimal digits.

In addition, because floating point numbers can represent large values, it is often mistakenly assumed that they can represent all digits of those values. To gain a large dynamic range, floating point numbers maintain a fixed number of bits of precision and an exponent. Incrementing a large floating point value may not change that value within the available precision.

Different implementations have different precision limitations, and to keep code portable, floating point variables should not be used as loop counters.

Noncompliant Code Example

In this noncompliant example, a floating point variable has been used as a loop counter. The decimal number 0.1 is a repeating fraction in binary and so cannot be represented exactly in a binary floating point number.

float x;
for (x = 0.1f; x <= 1.0f; x += 0.1f) {
  /* ... */
}

Implementation-Specific Details

Using a binary compiled with Microsoft Visual C++ 2005 Express version 8.0, running on an x86 machine with Windows XP, this loop was executed only nine times.

Compliant Solution

In this compliant solution, the loop counter is an integer.  The floating point value is derived from the integer.

int count;
for (count = 1; count <= 10; count += 1) {
  float x = count/10.0f;
  /* ... */
}

Noncompliant Code Example

In this noncompliant example, a floating point loop counter is incremented by an amount that is too small to change its value given its precision.

float x;
for (x = 100000001.0f; x <= 100000010.0f; x += 1.0f) {
  /* ... */
}

On many implementations, this produces an infinite loop.

Compliant Solution

In this compliant solution, the loop counter is an integer, the floating point value is derived from it, and a double rather than a float is used to gain enough precision.

int count;
for (count = 1; count <= 10; count += 1) {
  double x = 100000000.0 + count;
  /* ... */
}

Risk Assessment

Using floating point loop counters can lead to unexpected behavior.

Automated Detection

The LDRA tool suite V 7.6.0 can detect violations of this rule.

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.

Compass/ROSE can detect violations of this rule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 14882:2003]] Sections 2.13.3, "Floating literals," and 3.9.1, "Fundamental types"
[[ISO/IEC PDTR 24772]] "PLF Floating Point Arithmetic"
[[Lockheed Martin 05]] AV Rule 197, "Floating point variables shall not be used as loop counters."
[[MISRA 04]] Rules 13.3 and 13.4
[[MITRE 07]] CWE ID 606, "Unchecked Input for Loop Condition"

FLP02-C. Consider avoiding floating point numbers when precise computation is needed      05. Floating Point (FLP)       FLP31-C. Do not call functions expecting real values with complex values