C#


CSHARP.MATH.ABSRAND : Abs on random (C#)

Summary

The absolute value of a random number might actually be negative.

By computing the absolute value of a random integral number, one might actually yield a negative number, if Math.Abs() is used. For instance, Console.WriteLine(Math.Abs(Int32.MaxValue)) would actually print the negative value -2147483648. As a consequence, this might result in unexpected or erroneous computations.

Properties

Class Name Abs on random (C#)
Significance reliability
Mnemonic CSHARP.MATH.ABSRAND
Categories
CWE CWE:682 Incorrect Calculation
Availability Available for C# only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Abs on random (C#)"

Example

using System;

namespace DocumentationExamples
{

    public class AbsOfRandom
    {

        public static void Main(string[] args)
        {
            System.Random r = new System.Random();
            int i = r.Next();
            i = Math.Abs(i);     // Abs on random (C#) warning issued here 
            Console.WriteLine(i);
        }
    }

}

In this example, the programmer should check for the minimum integral value explicitly and behave accordingly, as in the following example.

System.Random r = new System.Random();
int i = r.Next();
if (i == Int32.MinValue)
    i = 0; // any non-negative value would do
else if (i < 0)
    i = -i;

Console.WriteLine(i);

Resolution

Check, explicitly, for the minimal integral value, before computing the absolute value. Otherwise, since Java 15, java.lang.Math.absExact and java.lang.StrictMath.absExact allows to compute the absolute values in a safe way, throwing ArithmeticException if the result overflows.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.