SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 312

changes.mady.by.user David Svoboda

Saved on

compared with

New Version Current

changes.mady.by.user Caden Milne

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Updated references from C11->C23

...

The left-shift operator takes two integer operands. The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. 

The C Standard,  66.5.78, paragraph 4 [ISO/IEC 9899:20112024], states

If E1 has a signed type and nonnegative value, and E1 × 2E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.

In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a logic error. These issues are covered by INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand.

Noncompliant Code Example

This noncompliant code example performs a left shift, after verifying that the number being shifted is not negative, and the number of bits to shift is valid.  The PRECISION() macro and popcount() function provide the correct precision for any integer type. (See INT35-C. Use correct integer precisions.) However, because this code does no overflow check, it can result in an unrepresentable value. 

...

Compliant Solution

This compliant solution eliminates the possibility of overflow resulting from a left-shift operation:

...

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

integer-overflow

Fully checked
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
MISC.MEM.SIZE.ADDOFLOW
MISC.MEM.SIZE.BAD
MISC.MEM.SIZE.MULOFLOW
MISC.MEM.SIZE.SUBUFLOW

Addition overflow of allocation size
Integer overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Addition overflow of size
Unreasonable size argument
Multiplication overflow of size
Subtraction underflow of size

Coverity
Include Page
Coverity_V
Coverity_V

TAINTED_SCALAR

BAD_SHIFT

Implemented
Cppcheck Premium

Include Page
Cppcheck Premium_V
Cppcheck Premium_V

premium-cert-int32-cPartially implemented
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C2800, C2860

C++2800, C++2860

DF2801, DF2802, DF2803, DF2861, DF2862, DF2863


Klocwork

Include Page
Klocwork_V
Klocwork_V

NUM.OVERFLOW
CWARN.NOEFFECT.OUTOFRANGE
NUM.OVERFLOW.DF


LDRA tool suite
Include Page
LDRA_V
LDRA_V

493 S, 494 S

Partially implemented
Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-INT32-a
CERT_C-INT32-b
CERT_C-INT32-c

Avoid signed integer overflows
Integer overflow or underflow in constant expression in '+', '-', '*' operator
Integer overflow or underflow in constant expression in '<<' operator

Parasoft Insure++

Runtime analysis
Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule INT32-C


Checks for:

  • Integer overflow
  • Tainted division operand
  • Tainted modulo operand

Rule partially covered.

PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V1026, V1070, V1081, V1083, V1085, V5010
TrustInSoft Analyzer

Include Page
TrustInSoft Analyzer_V
TrustInSoft Analyzer_V

signed_overflow

Exhaustively verified (see one compliant and one non-compliant example).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

[Dowd 2006]Chapter 6, "C Language Issues" ("Arithmetic Boundary Conditions," pp. 211–223)
[ISO/IEC 9899:20112024]Subclause 6.5.58, "Multiplicative OperatorsBitwise shift operators"
[Seacord 2013b]Chapter 5, "Integer Security"
[Viega 2005]Section 5.2.7, "Integer Overflow"
[Warren 2002]Chapter 2, "Basics"

...