FLP38-C. Avoid undefined behavior while using type-generic macro functions

Section 7.27 of [ ISO/IEC 9899:2024 ] provides the headers <tgmath.h>, <math.h> and <complex.h> and provides type-generic macros. Many of these are designed to work on complex numbers or various types of floating-point numbers. However, there are many ways to misuse these functions, which can lead to undefined behaviors 203, 204, 206, and 207.

Noncompliant Code Example

This noncompliant code example attempts to compute the remainder between a double and a _Decimal64, which violates undefined behavior 203.

double d = 3.0;
_Decimal64 d64 = 2.0;
double result = remainder(d64, d);   // Undefined Behavior
printf("result is %fl\n", result);

Implementation Details

While this program fails to compile on modern versions of Clang and MSVC, it compiles correctly on GCC 16.1 and the (deprecated) Intel x86-64 icc 2021.10.0 compiler, and produces the expected result of -1.0.

Compliant Solution

This compliant solution casts the _Decimal64 to a double for doing the remainder.

double d = 3.0;
_Decimal64 d64 = 2.0;
double result = remainder((double) d64, d);
printf("result is %lf\n", result);

Noncompliant Code Example

This noncompliant code example attempts to compute the next number beyond 2.0, but passes a _Float32 and a long double to the nexttoward function. This violates undefined behavior 204.

_Float32 f = 2.0;
long double d = 3.0;
double result = nexttoward(f, d);   // Undefined Behavior
printf("result is %lf\n", result);

Implementation Details

While this program fails to compile on modern versions of Clang, and MSVC, it compiles correctly on GCC 16.1 and the Intel x86-64 icx 2024.0 compiler, and produces the expected result of 2.000000.

Compliant Solution

This compliant solution casts the _Float32 to a double for the computation, producing the correct answer.

_Float32 f = 2.0;
long double d = 3.0;
double result = nexttoward((double) f, d);
printf("result is %lf\n", result);

Risk Assessment

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website .

Bibliography