CWE-1077 使用不正确的比较运算符比较浮点值

Floating Point Comparison with Incorrect Operator

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

扩展描述

Numeric calculation using floating point values can generate imprecise results because of rounding errors. As a result, two different calculations might generate numbers that are mathematically equal, but have slightly different bit representations that do not translate to the same mathematically-equal values. As a result, an equality test or other comparison might produce unexpected results.

This issue can prevent the software from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 697 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

分类映射

引用

• REF-961 Automated Source Code Reliability Measure (ASCRM)

• REF-975 Comparing Floating Point Numbers, 2012 Edition