...
Division is between two operands of arithmetic type. Overflow can occur during twos-complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to -1. Both signed and unsigned division Division operations are also susceptible to divide-by-zero errors (see INT33-C. Ensure that division and modulo operations do not result in divide-by-zero errors).
...
The left shift operator is between two operands of integer type.
This next example needs to be signed. h2.
Non-Compliant Code Example
...
This non-compliant code example can result in an unsigned overflow during the shift operation of the unsigned operands ui1 and ui2. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner that could lead to an exploitable vulnerability.
| Code Block | ||
|---|---|---|
| ||
int si1, si2, sresult;
sresult = si1 << si2;
|
Compliant Solution
This compliant solution eliminates the possibility of overflow resulting from a left shift operation.
| Code Block | |
|---|---|
|
...
| |
|
...
int |
...
si1, |
...
si2, |
...
sresult; |
...
if |
...
( |
...
(si1 |
...
| bgColor | #ccccff |
|---|
...
< 0) || (si2 < 0) || (si2 >= sizeof( |
...
int)*CHAR_BIT) || |
...
si1 > ( |
...
INT_MAX |
...
>> |
...
si2) |
...
) {
/* handle error condition */
}
else {
|
...
sresult = |
...
si1 << |
...
si2; } |
This solution is also compliant with INT36-C. Do not shift a negative number of bits or more bits than exist in the operand.
Risk Assessment
Integer overflow can lead to buffer overflows and the execution of arbitrary code by an attacker.
...