CS.DBZ.ITERATOR

Loop iterator might be used in a division by zero

An attempt to do a division or modulo operation using zero as the divisor causes a runtime error. Division by zero defects often occur due to ineffective error handling or race conditions, and typically cause abnormal program termination. Before a value is used as the divisor of a division or modulo operation in C# code, it must be checked to confirm that it is not equal to zero.

The DBZ checkers look for instances in which a zero constant value is used as the divisor of a division or modulo operation.

The CS.DBZ.ITERATOR checker flags situations in which a loop iterator that has been assigned a zero constant value in the execution of the loop might subsequently be used explicitly or passed to a function that might use it as a divisor of a division or modulo operation without checking it for the zero value.

Vulnerability and risk

Integer division by zero usually results in the failure of the process or an exception. It can also result in the success of the operation, but gives an erroneous answer.

Mitigation and prevention

Division by zero issues typically occur due to ineffective exception handling. To avoid this vulnerability, check for a zero value before using it as the divisor of a division or modulo operation.

Vulnerable code example

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
   namespace DBZ
   {
       class Program
       {
           static void Test12()
           {
               int sum = 12;
               for (int i = 10; i > -1; --i)
               {
                  sum = 3628800 / i;
              }
          }
      }
  }

Klocwork produces an issue report at line 10 indicating that Loop iterator 'i' might be used in a division by zero.

Fixed code example

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
   namespace DBZ
   {
       class Program
       {
           static void Test12()
           {
               int sum = 12;
               for (int i = 10; i > -1; --i)
               {
                  if(i != 0 )
                  {
                     sum = 3628800 / i;
                  }
              }
          }
      }
  }

The issue from the vulnerable code example is fixed. The input variable 'i' is checked for a zero constant value in line 10 and prevents the division operation from occurring if the value is zero.

Related checkers

External guidance

CWE-369: Divide By Zero

Security training

Application security training materials provided by Secure Code Warrior.

Business Logic Training Video - Test your skills with a training example