GitHub
CERT Secure Coding

NUM09-J. Do not use floating-point variables as loop counters

Floating-point variables must not be used as loop counters. Limited-precision IEEE 754 floating-point types cannot represent

  • All simple fractions exactly.
  • All decimals precisely, even when the decimals can be represented in a small number of digits.
  • All digits of large values, meaning that incrementing a large floating-point value might not change that value within the available precision.

For the purpose of this rule, a loop counter is an induction variable that is used as an operand of a comparison expression that is used as the controlling expression of a do, while or for loop. An induction variable is a variable that gets increased or decreased by a fixed amount on every iteration of a loop [Aho 1986]. Furthermore, the change to the variable must occur directly in the loop body (rather than inside a function executed within the loop.)

This rule is a subset of NUM04-J. Do not use floating-point numbers if precise computation is required .

Noncompliant Code Example

This noncompliant code example uses a floating-point variable as a loop counter. The decimal number 0.1 cannot be precisely represented as a float or even as a double .

Non-compliant code
for (float x = 0.1f; x <= 1.0f; x += 0.1f) {
  System.out.println(x);
}

Because 0.1f is rounded to the nearest value that can be represented in the value set of the float type, the actual quantity added to x on each iteration is somewhat larger than 0.1 . Consequently, the loop executes only nine times and typically fails to produce the expected output.

Compliant Solution

This compliant solution uses an integer loop counter from which the desired floating-point value is derived:

Compliant code
for (int count = 1; count <= 10; count += 1) {
  float x = count/10.0f;
  System.out.println(x);
}

Noncompliant Code Example

This noncompliant code example uses a floating-point loop counter that is incremented by an amount that is typically too small to change its value given the precision:

Non-compliant code
for (float x = 100000001.0f; x <= 100000010.0f; x += 1.0f) {
  /* ... */
}

The code loops forever on execution.

Compliant Solution

This compliant solution uses an integer loop counter from which the floating-point value is derived. Additionally, it uses a double to ensure that the available precision suffices to represent the desired values. The solution also runs in strict floating-point (FP-strict) mode to guarantee portability of its results (see NUM53-J. Use the strictfp modifier for floating-point calculation consistency across platforms for more information).

Compliant code
for (int count = 1; count <= 10; count += 1) {
  double x = 100000000.0 + count;
  /* ... */
}

Risk Assessment

Using floating-point loop counters can lead to unexpected behavior.

Rule Severity Likelihood Detectable Repairable Priority Level
NUM09-J Low Probable Yes No P4 L3

Automated Detection

Automated detection of floating-point loop counters is straightforward.

ToolVersionCheckerDescription
Klocwork

2025.2

JAVA.LOOP.CTR.FLOAT
Parasoft Jtest
2025.2
CERT.NUM09.FPLIDo not use floating point variables as loop indices
PVS-Studio

7.42

V6108
Security Reviewer - Static Reviewer

6.02

StringComparisonFloatFull Implementation
SEI CERT C Coding StandardFLP30-C. Do not use floating-point variables as loop counters
ISO/IEC TR 24772:2010Floating-point Arithmetic [PLF]

Bibliography

[ Aho 1986 ]

[ Bloch 2005 ]

Puzzle 34, "Down for the Count"

[ JLS 2015 ]

§4.2.3, "Floating-Point Types, Formats, and Values"

[ Seacord 2015 ]