Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

It is implementation-defined whether the specifier int designates the same type as signed int or the same type as unsigned int for bit-fields. According to the C Standard [ISO/IEC 9899:2011], C integer promotions also require that "If if an int can represent all values of the original type (as restricted by the width, for a bit-field), the value is converted to an int; otherwise, it is converted to an unsigned int."

This is a similar issue This issue is similar to the signedness of plain char, discussed in INT07-AC. Use only explicitly signed or unsigned char type for numeric values.   A plain int bit-field that is treated as unsigned will promote to int as long as its field width is less than that of int, because int can hold all values of the original type.   This behavior is the same behavior as that of a plain char treated as unsigned.   However, a plain int bit-field treated as unsigned will promote to unsigned int if its field width is the same as that of int.   This difference makes a plain int bit-field even trickier than a plain char.

Bit-field types other than _Bool, int, signed int, and unsigned int are implementation-defined.   They still obey the integer promotions quoted above previously when the specified width is at least as narrow as CHAR_BIT*sizeof(int), but wider bit-fields are not portable.

...

Noncompliant Code Example

This non-compliant noncompliant code depends on implementation-defined behavior.   It prints either -1 or 255, depending on whether a plain int bit-field is signed or unsigned.

Code Block
bgColor#FFcccc
langc

struct {
  int a: 8;
} bits = {255};

int main(void) {
  printf("bits.a = %d.\n", bits.a);
  return 0;
}

Compliant Solution

This compliant solution uses an unsigned int bit-field and does not depend on implementation-defined behavior.:

Code Block
bgColor#ccccff
langc

struct {
  unsigned int a: 8;
} bits = {255};

int main(void) {
  printf("bits.a = %d.\n", bits.a);
  return 0;
}

Risk Assessment

Making invalid assumptions about the type of a bit-field or its layout can result in unexpected program flow.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

INT12-

A

C

low

Low

unlikely

Unlikely

medium

Medium

P2

L3

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V
bitfield-typeFully checked
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-INT12
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
LANG.TYPE.BFSIGNBit-field signedness not explicit
Compass/ROSE




ECLAIR

Include Page
ECLAIR_V
ECLAIR_V

CC2.INT12

Fully implemented

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C0634, C0635
Klocwork
Include Page
Klocwork_V
Klocwork_V
MISRA.BITFIELD.TYPE
LDRA tool suite
Include Page
LDRA_V
LDRA_V

73 S

Fully implemented

Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V

CERT_C-INT12-a

Bit fields shall only be defined to be of type unsigned int or signed int

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

846

Fully supported

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. INT12-C


Checks for bit-field declared without appropriate type (rec. fully covered)

RuleChecker
Include Page
RuleChecker_V
RuleChecker_V
bitfield-typeFully checked
SonarQube C/C++ Plugin
Include Page
SonarQube C/C++ Plugin_V
SonarQube C/C++ Plugin_V
S814

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Wiki Markup
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.7.2, "Type specifiers"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "STR Bit Representations"
\[[MISRA 04|AA. C References#MISRA 04]\] Rule 12.7

Related Guidelines

Bibliography

[ISO/IEC 9899:2011]Subclause 6.3.1.1, "Boolean, Characters, and Integers"


...

Image Added Image Added Image AddedINT11-A. Do not make assumptions about the layout of bit-field structures      04. Integers (INT)       INT13-A. Use bitwise operators only on unsigned operands