CS.DBZ.CONST
Zero constant value is passed to a function and might be used in a division by zero
An attempt to do a division or modulo operation using zero as the divisor causes a runtime error. Division by zero defects often occur due to ineffective error handling or race conditions, and typically cause abnormal program termination. Before a value is used as the divisor of a division or modulo operation in C# code, it must be checked to confirm that it is not equal to zero.
The DBZ checkers look for instances in which a zero constant value is used as the divisor of a division or modulo operation.
The CS.DBZ.CONST checker flags situations in which a zero constant value is used explicitly as a divisor of a division or modulo operation.
Vulnerability and risk
Integer division by zero usually results in the failure of the process or an exception. It can also result in the success of the operation, but gives an erroneous answer.
Mitigation and prevention
Division by zero issues typically occur due to ineffective exception handling. To avoid this vulnerability, check for a zero value before using it as the divisor of a division or modulo operation.
Vulnerable code example
namespace test
{
class A
{
void do_dbz()
{
int size = 10;
size = size % 0;
int res = 19;
res = res/0;
}
static void Main(string[] args)
{
}
}
}Klocwork produces an issue report at line 8 and 10, indicating that the zero constant value is used as the divisor of the division operation on line 8 and 10.
This code can be fixed by removing the division by zero.
Related checkers
External guidance
Security training
Application security training materials provided by Secure Code Warrior.
