916
Example 3:
The following C# example contains a function that divides two numeric values without verifying
that the input value used as the denominator is not zero. This will create an error for attempting
to divide by zero, if this error is not caught by the error handling capabilities of the language,
unexpected results can occur.
Example Language: C# (Bad)
int Division(int x, int y){
return (x / y);
}
The method can be modified to raise, catch and handle the DivideByZeroException if the input
value used as the denominator is zero.
Example Language: (Good)
int SafeDivision(int x, int y){
try{
return (x / y);
}
catch (System.DivideByZeroException dbz){
System.Console.WriteLine("Division by zero attempted!");
return 0;
}
}
Observed Examples
Reference Description
CVE-2007-3268 Invalid size value leads to divide by zero.
https://www.cve.org/CVERecord?id=CVE-2007-3268
CVE-2007-2723 "Empty" content triggers divide by zero.
https://www.cve.org/CVERecord?id=CVE-2007-2723
CVE-2007-2237 Height value of 0 triggers divide by zero.
https://www.cve.org/CVERecord?id=CVE-2007-2237
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 730 OWASP Top Ten 2004 Category A9 - Denial of Service 711 2339
MemberOf 738 CERT C Secure Coding Standard (2008) Chapter 5 -
Integers (INT)
734 2342
MemberOf 739 CERT C Secure Coding Standard (2008) Chapter 6 -
Floating Point (FLP)
734 2343
MemberOf 848 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 5 - Numeric Types and Operations
(NUM)
844 2363
MemberOf 872 CERT C++ Secure Coding Section 04 - Integers (INT) 868 2374
MemberOf 873 CERT C++ Secure Coding Section 05 - Floating Point
Arithmetic (FLP)
868 2375
MemberOf 884 CWE Cross-section 884 2567
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1137 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 03. Numeric Types and Operations (NUM)
1133 2445
CWE Version 4.14
CWE-370: Missing Check for Certificate Revocation after Initial Check
CWE-370: Missing Check for Certificate Revocation after Initial Check