CWE-1077 使用不正确的比较运算符比较浮点值

Floating Point Comparison with Incorrect Operator

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

The code performs a comparison such as an
equality test between two float (floating point) values, but
it uses comparison operators that do not account for the
possibility of loss of precision.

扩展描述

Numeric calculation using floating point values
can generate imprecise results because of rounding errors.
As a result, two different calculations might generate
numbers that are mathematically equal, but have slightly
different bit representations that do not translate to the
same mathematically-equal values. As a result, an equality
test or other comparison might produce unexpected
results.

This issue can prevent the software from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 697 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

范围	影响	注释
Other	Reduce Reliability

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
OMG ASCRM	ASCRM-RLB-9

引用

• REF-961 Automated Source Code Reliability Measure (ASCRM)

• REF-975 Comparing Floating Point Numbers, 2012 Edition

文章来源于互联网:scap中文网