NUM01-J. Avoid performing bitwise and arithmetic operations on the same data

Integer variables are frequently intended to represent either a numeric value or a bit collection. Numeric values must be exclusively operated upon using arithmetic operations, while bit collections should be exclusively operated upon using logical operations. However, static analyzers are frequently unable to determine the intended use of a particular integer variable.

Performing bitwise and arithmetic operations on the same data suggests confusion regarding the purpose of the data stored in the variable. Unfortunately, bitwise operations are frequently performed on arithmetic values as a form of premature optimization. Bitwise operators include the unary operator ~ and the binary operators <<, >>, &, ^, and |. Although such operations are valid and will compile, they can reduce code readability.

Noncompliant Code Example (Left Shift)

Left- and right-shift operators are often employed to multiply or divide a number by a power of 2. This compromises code readability and portability for the sake of often-illusory speed gains. The JVM will usually make such optimizations automatically, and, unlike a programmer, the JVM can optimize for the implementation details of the current platform. This noncompliant code example includes both bit and arithmetic manipulations of the integer x that conceptually contains a numeric value. The result is a prematurely optimized statement that assigns 5x + 1 to x, which is what the programmer intended to express.

int x = 50;
x += (x << 2) + 1;

Noncompliant Code Example (Left Shift)

This noncompliant code example segregates arithmetic and bitwise operators by variables. The x variable participates only in bitwise operations, and y participates only in arithmetic operations.

int x = 50;
int y = x << 2;
x += y + 1;

This example is noncompliant because the actual data receives both bitwise and arithmetic operations performed on it, even though they are segregated into different variables.

Compliant Solution (Left Shift)

In this compliant solution, the assignment statement is modified to reflect the arithmetic nature of x, resulting in a clearer indication of the programmer's intentions.

int x = 50;
x = 5 * x + 1;

A reviewer could now recognize that the operation should also be checked for overflow. This might not have been apparent in the original, noncompliant code example. For more information, see rule NUM00-J. Detect or prevent integer overflow.

Noncompliant Code Example (Logical Right Shift)

In this noncompliant code example, the programmer wishes to divide x by 4. Hence, the programmer attempts to optimize performance by using a right shift operation, rather than a division operation.

int x = -50;
x >>>= 2;

The >>>= operator is a logical right shift; it fills the leftmost bits with zeroes, regardless of the number's original sign. After execution of this code sequence, x contains a large positive number (specifically, 0x3FFFFFF3). Using logical right shift for division produces an incorrect result when the dividend (x in this example) contains a negative value.

Noncompliant Code Example (Arithmetic Right Shift)

In this noncompliant code example, the programmer attempts to correct the previous example by using an arithmetic right shift (the >>= operator):

int x = -50;
x >>= 2;

After this code sequence is run, x contains the value -13 rather than the expected -12. Arithmetic right shift truncates its results towards negative infinity; integer division truncates towards zero.

Compliant Solution (Right Shift)

In this compliant solution, the right shift is correctly replaced by division.

int x = -50;
x /= 4;

Noncompliant Code Example

In this noncompliant code example, a programmer is attempting to fetch four values from a byte array and pack them into the integer variable result. The integer value in this example represents a bit collection, not a numeric value.

// b[] is a byte array, initialized to 0xff
byte[] b = new byte[] {-1, -1, -1, -1};
int result = 0;
for (int i = 0; i < 4; i++) {
  result = ((result << 8) + b[i]);
}

In the bitwise operation, the value of the byte array element b[i] is promoted to an int by sign-extension. When a byte array element contains a negative value (for example, 0xff), the sign-extension propagates 1-bits into the upper 24 bits of the int. This behavior could be unexpected if the programmer is assuming that byte is an unsigned type. In this example, adding the promoted byte values to result fails to result in a packed integer representation of the bytes [[FindBugs 2008]].

Noncompliant Code Example

This noncompliant code example masks off the upper 24 bits of the promoted byte array element before performing the addition. The number of bits required to mask the sizes of byte and int are specified by the JLS. Although this code calculates the correct result, it violates this rule by combining bitwise and arithmetic operations on the same data.

byte[] b = new byte[] {-1, -1, -1, -1};
int result = 0;
for (int i = 0; i < 4; i++) {
  result = ((result << 8) + (b[i] & 0xff));
}

Compliant Solution

This compliant solution masks off the upper 24 bits of the promoted byte array element. The result is then combined with result using a logical OR operation.

byte[] b = new byte[] {-1, -1, -1, -1};
int result = 0;
for (int i = 0; i < 4; i++) {
  result = ((result << 8) | (b[i] & 0xff));
}

Exceptions

NUM01-EX0: Bitwise operations may be used to construct constant expressions.

int limit = 1 << 17 - 1; // 2^17 - 1 = 131071

Nevertheless, as a matter of style, we recommend replacing such constant expressions with the equivalent hexadecimal constants.

int limit = 0x1FFFF; // 2^17 - 1 = 131071

NUM01-EX1: Data that is normally treated arithmetically may be treated with bitwise operations for the purpose of serialization or deserialization. This is often required for reading or writing the data from a file or network socket. Bitwise operations are also permitted when reading or writing the data from a tightly packed data structure of bytes.

int value = /* interesting value */
Byte[] bytes = new Byte[4];
for (int i = 0; i < bytes.length; i++) {
  bytes[i] = value >> (i*8) & 0xFF;
}
/* bytes[] now has same bit representation as value  */

Risk Assessment

Performing bit manipulation and arithmetic operations on the same variable obscures the programmer's intentions and reduces readability. This, in turn, makes it more difficult for a security auditor or maintainer to determine which checks must be performed to eliminate security flaws and ensure data integrity. For instance, overflow checks are critical for numeric types that undergo arithmetic operations, but less critical for numeric types that undergo bitwise operations.

Related Guidelines

Bibliography

      03. Numeric Types and Operations (NUM)      NUM02-J. Ensure that division and modulo operations do not result in divide-by-zero errors