Bitwise shifts include left-shift operations of the form shift-expression << additive-expression and right-shift operations of the form shift-expression >> additive-expression. The integer promotions are performed on the operands, each of which has an integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined. See also undefined behavior 51 of Annex J of C11 [ISO/IEC 9899:2011].
In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a bug (logic error). This is different from overflow, where there is simply a representational deficiency. (See INT32-C. Ensure that operations on signed integers do not result in overflow.)
Noncompliant Code Example (Left Shift, Signed Type)
The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has a signed type and nonnegative value and E1 * 2E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.
This noncompliant code example can result in undefined behavior because there is no check to ensure that left and right operands have nonnegative values and that the right operand is less than or equal to the width of the promoted left operand.
...
Shift operators and other bitwise operators should be used only with unsigned integer operands in accordance with INT13-C. Use bitwise operators only on unsigned operands.
Noncompliant Code Example (Left Shift, Unsigned Type)
...
The result of E1 >> E2 is E1 right-shifted E2 bit positions. If E1 has an unsigned type or if E1 has a signed type and a nonnegative value, the value of the result is the integral part of the quotient of E1 / 2E2. If E1 has a signed type and a negative value, the resulting value is implementation-defined and can be either an arithmetic (signed) shift:
or a logical (unsigned) shift:
This noncompliant code example fails to test whether the right operand is greater than or equal to the width of the promoted left operand, allowing undefined behavior.
...
Making assumptions about whether a right shift is implemented as an arithmetic (signed) shift or a logical (unsigned) shift can also lead to vulnerabilities. See INT13-C. Use bitwise operators only on unsigned operands.
Compliant Solution (Right Shift)
...
Tool | Version | Checker | Description | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 403 S | Partially implemented. | |||||||||
Fortify SCA | V. 5.0 |
| Can detect violations of this rule with CERT C Rule Pack. | ||||||||
Compass/ROSE |
|
| Can detect violations of this rule. Unsigned operands are detected when checking for INT13-C. Use bitwise operators only on unsigned operands. | ||||||||
| ECLAIR |
| shiftrhs | Partially implemented. | ||||||||
| PRQA QA-C |
| 0499 0500 0501 2790 2791 (D) 2792 (A) 2793 (S) | Partially implemented |
Related Vulnerabilities
...
ISO/IEC 9899:2011 Section 6.5.7, "Bitwise shift operators"
ISO/IEC TR 24772 "XYY Wrap-around error"
ISO/IEC 2003 Section 6.5.7, "Bitwise shift operators"
...
A test program for this rule is available at www.securecoding.cert.org.
[Dowd 2006] Chapter 6, "C Language Issues"
[Seacord 2005a] Chapter 5, "Integers"
[Viega 2005] Section 5.2.7, "Integer overflow"
...