CS.DBZ.CONST.CALL

Zero constant value is passed to a function and might be used in a division by zero

An attempt to do a division or modulo operation using zero as the divisor causes a runtime error. Division by zero defects often occur due to ineffective error handling or race conditions, and typically cause abnormal program termination. Before a value is used as the divisor of a division or modulo operation in C# code, it must be checked to confirm that it is not equal to zero.

The DBZ checkers look for instances in which a zero constant value is used as the divisor of a division or modulo operation.

The CS.DBZ.CONST.CALL checker flags situations in which an explicit zero constant value is passed directly to a function call and might be used as a divisor of a division or modulo operation without checking it for the zero value.

Vulnerability and risk

Integer division by zero usually results in the failure of the process or an exception. It can also result in the success of the operation, but gives an erroneous answer.

Mitigation and prevention

Division by zero issues typically occur due to ineffective exception handling. To avoid this vulnerability, check for a zero value before using it as the divisor of a division or modulo operation.

Vulnerable code example

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
   namespace DBZ
   {
       class Program
       {
           static int Test1(int a, int size)
           {
               return a / size;
           }
           static void Main(string[] args)
          {
              int mean = Test1(0, 0);
         }
      }
  }

Klocwork produces an issue report at line 11 indicating that the value '0' might be used in a division by zero by passing argument 2 to function 'Test1' at line 11.

Fixed code example

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
   namespace DBZ
   {
       class Program
       {
           static int Test1(int a, int size)
           {
               if(size ==0)
               { 
                  return 0; 
              }
              return a / size;
          }
          static void Main(string[] args)
          {
              int mean = Test1(0, 0);
         }
      }
  }

The issue from the vulnerable code example is fixed. The input variable 'size' is checked for a zero constant value in line 9 and prevents the division operation from occurring if the value is zero.

Related checkers

External guidance

CWE-369: Divide By Zero

Security training

Application security training materials provided by Secure Code Warrior.

Business Logic Training Video - Test your skills with a training example