...
It is implementation-defined whether the specifier int
designates the same type as signed int
or the same type as unsigned int
for bit-fields. According to the C Standard [ISO/IEC 9899:2011], C integer promotions also require that "if an int
can represent all values of the original type (as restricted by the width, for a bit-field), the value is converted to an int
; otherwise, it is converted to an unsigned int
."
This issue is similar to the signedness of plain char
, discussed in INT07-C. Use only explicitly signed or unsigned char type for numeric values. A plain int
bit-field that is treated as unsigned will promote to int
as long as its field width is less than that of int
because int
can hold all values of the original type. This behavior is the same behavior as that of a plain char
treated as unsigned. However, a plain int
bit-field treated as unsigned will promote to unsigned int
if its field width is the same as that of int
. This difference makes a plain int
bit-field even trickier than a plain char
.
...
This noncompliant code depends on implementation-defined behavior. It prints either -1
or 255
, depending on whether a plain int
bit-field is signed or unsigned.
...
Making invalid assumptions about the type of a bit-field or its layout can result in unexpected program flow.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
INT12-C |
Low |
Unlikely |
Medium | P2 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
Astrée |
| bitfield-type | Fully checked | ||||||
Axivion Bauhaus Suite |
| CertC-INT12 | |||||||
CodeSonar |
| LANG.TYPE.BFSIGN | Bit-field signedness not explicit | ||||||
Compass/ROSE |
| CC2.INT12 | Fully implemented | |||||||
Helix QAC |
| C0634, C0635 | |||||||
Klocwork |
| MISRA.BITFIELD.TYPE | |||||||
LDRA tool suite |
| 73 S | Fully implemented |
Parasoft C/C++test |
| CERT_C-INT12-a | Bit fields shall only be defined to be of type unsigned int or signed int | ||||||
PC-lint Plus |
| 846 | Fully supported | ||||||
Polyspace Bug Finder |
| Checks for bit-field declared without appropriate type (rec. fully covered) | |||||||
RuleChecker |
| bitfield-type | Fully checked | ||||||
SonarQube C/C++ Plugin |
| S814 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
SEI CERT C++ |
Coding Standard | VOID INT12-CPP. Do not make assumptions about the type of a plain int bit-field when used in an expression |
ISO/IEC TR 24772:2013 | Bit Representations [STR] |
MISRA C:2012 | Rule 10.1 (required) |
Bibliography
...
...