Bitwise shifts include left-shift operations of the form shift-expression << additive-expression and right-shift operations of the form shift-expression >> additive-expression. The integer promotions are performed on the operands, each of which has an integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.
In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a bug (logic error). This is different from overflow, where there is simply a representational deficiency (see INT32-C. Ensure that operations on signed integers do not result in overflow).
Noncompliant Code Example (Left Shift, Signed Type)
The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has a signed type and nonnegative value and E1 * 2E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.
This noncompliant code example can result in undefined behavior because there is no check to ensure that left and right operands have nonnegative values and that the right operand is less than or equal to the width of the promoted left operand.
int si1; int si2; int sresult; /* Initialize si1 and si2 */ sresult = si1 << si2;
Shift operators, and other bitwise operators, should only be used with unsigned integer operands, in accordance with INT13-C. Use bitwise operators only on unsigned operands.
Noncompliant Code Example (Left Shift, Unsigned Type)
The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. According to C99, if E1 has an unsigned type, the value of the result is E1 * 2E2, reduced modulo one more than the maximum value representable in the result type.
This noncompliant code example can result in undefined behavior because there is no check to ensure that the right operand is less than or equal to the width of the promoted left operand.
unsigned int ui1; unsigned int ui2; unsigned int uresult; /* Initialize ui1 and ui2 */ uresult = ui1 << ui2;
Compliant Solution (Left Shift, Unsigned Type)
This compliant solution eliminates the possibility of undefined behavior resulting from a left-shift operation on unsigned integers.
unsigned int ui1;
unsigned int ui2;
unsigned int uresult;
/* Initialize ui1 and ui2 */
if (ui2 >= sizeof(unsigned int)*CHAR_BIT) {
/* handle error condition */
} else {
uresult = ui1 << ui2;
}
Modulo behavior resulting from left shifting an unsigned integer type is permitted by this standard.
Noncompliant Code Example (Right Shift)
The result of E1 >> E2 is E1 right-shifted E2 bit positions. If E1 has an unsigned type or if E1 has a signed type and a nonnegative value, the value of the result is the integral part of the quotient of E1 / 2E2. If E1 has a signed type and a negative value, the resulting value is implementation defined and may be either an arithmetic (signed) shift:
or a logical (unsigned) shift:
This noncompliant code example fails to test whether the right operand is greater than or equal to the width of the promoted left operand, allowing undefined behavior.
unsigned int ui1; unsigned int ui2; unsigned int uresult; /* Initialize ui1 and ui2 */ uresult = ui1 >> ui2;
Making assumptions about whether a right shift is implemented as an arithmetic (signed) shift or a logical (unsigned) shift can also lead to vulnerabilities see INT13-C. Use bitwise operators only on unsigned operands.
Compliant Solution (Right Shift)
This compliant solution tests the suspect shift operations to guarantee there is no possibility of undefined behavior.
unsigned int ui1;
unsigned int ui2;
unsigned int uresult;
/* Initialize ui1 and ui2 */
if (ui2 >= sizeof(unsigned int) * CHAR_BIT) {
/* handle error condition */
}
else {
uresult = ui1 >> ui2;
}
Implementation Details
GCC has no options to handle shifts by negative amounts or by amounts outside the width of the type predictably or trap on them; they are always treated as undefined. Processors may reduce the shift amount modulo the width of the type. For example, 32 bit shifts are implemented using the following instructions on IA-32:
sa[rl]l %cl, %eax
The sa[rl]l instructions take a bit mask of the least significant 5 bits from %cl to produce a value in the range [0, 31] and then shift %eax that many bits.
64 bit shifts become sh[rl]dl %eax, %edx sa[rl]l %cl, %eax
where %eax stores the least significant bits in the double word to be shifted and %edx stores the most significant bits.
Risk Assessment
Although shifting a negative number of bits or more bits than exist in the operand is undefined behavior in C99, the risk is generally low because processors frequently reduce the shift amount modulo the width of the type.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
INT34-C |
low |
low |
medium |
P2 |
L3 |
Automated Detection
Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.
Compass/ROSE can detect violations of this rule. Unsigned operands are detected when checking for INT13-C. Use bitwise operators only on unsigned operands.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
This rule appears in the C++ Secure Coding Standard as INT34-CPP. Do not shift a negative number of bits or more bits than exist in the operand.
References
A test program for this rule is available at www.securecoding.cert.org
[[Dowd 06]] Chapter 6, "C Language Issues"
[[ISO/IEC 9899:1999]] Section 6.5.7, "Bitwise shift operators"
[[ISO/IEC PDTR 24772]] "XYY Wrap-around Error"
[[Seacord 05a]] Chapter 5, "Integers"
[[Viega 05]] Section 5.2.7, "Integer overflow"
[[ISO/IEC 03]] Section 6.5.7, "Bitwise shift operators"
INT33-C. Ensure that division and modulo operations do not result in divide-by-zero errors 04. Integers (INT) INT35-C. Evaluate integer expressions in a larger size before comparing or assigning to that size