...
In the bitwise operation, the value of the byte array element b[i] is promoted to an int by sign-extension. When a byte array element contains a negative value (for example, 0xff), the sign-extension propagates 1-bits into the upper 24 bits of the int. This behavior might be unexpected if the programmer is assuming that byte is an unsigned type. In this example, adding the promoted byte values to result fails to result in a packed integer representation of the bytes [FindBugs 2008].
Noncompliant Code Example
...
Performing bitwise manipulation and arithmetic operations on the same variable obscures the programmer's intentions and reduces readability. This, in turn, makes it more difficult for a security auditor or maintainer to determine which checks must be performed to eliminate security flaws and ensure data integrity. For instance, overflow checks are critical for numeric types that undergo arithmetic operations, but less critical for numeric types that undergo bitwise operations.
...
INT14-C. Avoid performing bitwise and arithmetic operations on the same data | |
INT14-CPP. Avoid performing bitwise and arithmetic operations on the same data |
Bibliography
...