Page History

...

In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a bug (logic error). This is different than from overflow, where there is simply a representational deficiency (see INT32-C. Ensure that operations on signed integers do not result in overflow).

...

The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has a signed type and nonnegative value and E1 * 2E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.

...

The following code can result in undefined behavior because there is no check to ensure that left and right operands have non-negative nonnegative values and that the right operand is less than or equal to the width of the promoted left operand.

int si1;
int si2;
int sresult;

/* Initialize si1 and si2 */

sresult = si1 << si2;

Shift operators, and other bitwise operators, should only be used with unsigned integer operands, in accordance with INT13-C. Use bitwise operators only on unsigned operands.

...

The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. According to C99, if E1 has an unsigned type, the value of the result is E1 * 2E2, reduced modulo one more than the maximum value representable in the result type. Although C99 specifies modulo behavior for unsigned integers, unsigned integer overflow frequently results in unexpected values and resultant security vulnerabilities (see INT32-C. Ensure that operations on signed integers do not result in overflow). Consequently, unsigned overflow is generally noncompliant, and E1 * 2E2 must be representable in the result type. Modulo behavior is allowed if the conditions in the exception section are metunder exception INT36-EX1.

The following code can result in undefined behavior because there is no check to ensure that the right operand is less than or equal to the width of the promoted left operand.

unsigned int ui1;
unsigned int ui2;
unsigned int uresult;

/* Initialize ui1 and ui2 */

uresult = ui1 << ui2;

Compliant Solution (Left Shift, Unsigned Type)

...

unsigned int ui1;
unsigned int ui2;
unsigned int uresult;

unsigned int mod1; /* modulo behavior is allowed by exceptionINT36-EX1 */
unsigned int mod2; /* modulo behavior is allowed by exceptionINT36-EX1 */

/* ... Initialize ui1, ui2, mod1, and mod2 */

if ( (ui2 >= sizeof(unsigned int)*CHAR_BIT)
  || (ui1 > (UINT_MAX  >> ui2))) ) {
  /* handle error condition */
} else {
  uresult = ui1 << ui2;
}

if (mod2 >= sizeof(unsigned int)*CHAR_BIT) {
  /* handle error condition */
} else {
  /* modulo behavior is allowed by exception */
  uresult = mod1 << mod2;
}

...

The result of E1 >> E2 is E1 right-shifted E2 bit positions. If E1 has an unsigned type or if E1 has a signed type and a nonnegative value, the value of the result is the integral part of the quotient of E1 / 2E2. If E1 has a signed type and a negative value, the resulting value is implementation - defined and may be either an arithmetic (signed) shift, as depicted here,

Image Removed

in Figure 5—2, or a logical (unsigned) shift, as depicted in Figure 5—3

Image Added

Figure 5—2. Arithmetic (signed) shift.

This noncompliant code example fails to test whether the right operand is greater than or equal to the width of the promoted left operand, allowing undefined behavior.

unsigned int ui1 = /* initialized using untrusted data */;
unsigned int ui2;
unsigned =int uresult;

/* initializedInitialize usingui1 untrustedand dataui2 */;
unsigned int uresult;

uresult = ui1 >> ui2;

Making assumptions about whether a right shift is implemented as an arithmetic (signed) shift or a logical (unsigned) shift can also lead to vulnerabilities see INT13-C. Use bitwise operators only on unsigned operands.

Compliant Solution (Right Shift)

...

unsigned int ui1 = /* initialized using untrusted data */;
unsigned int ui2;
unsigned =int uresult;

/* initializedInitialize usingui1 untrustedand dataui2 */;
unsigned int uresult;

if (ui2 >= sizeof(unsigned int) * CHAR_BIT) {
  /* handle error condition */
}
else {
  uresult = ui1 >> ui2;
}

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

A test program for this rule is available at www.securecoding.cert.org

\[[Dowd 06|AA. C References#Dowd 06]\] Chapter 6, "C Language Issues"
\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.5.7, "Bitwise shift operators"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "XYY Wrap-around Error"
\[[Seacord 05a|AA. C References#Seacord 05]\] Chapter 5, "Integers"
\[[Viega 05|AA. C References#Viega 05]\] Section 5.2.7, "Integer overflow"
\[[ISO/IEC 03|AA. C References#ISO/IEC 03]\] Section 6.5.7, "Bitwise shift operators"

...