Bitwise shifts include left shift operations of the form shift-expression << additive-expression and right shift operations of the form shift-expression >> additive-expression. The integer promotions are performed on the operands, each of which has integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.
Non-Compliant Code Example (left shift)
The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2^E2^, reduced modulo
one more than the maximum value representable in the result type. If E1 has a signed type and nonnegative value, and E1 * 2^E2^ is representable in the result type, then that is
the resulting value; otherwise, the behavior is undefined.
unsigned int ui1, ui2, result; result = ui1 >> ui2;
Compliant Solution
This compliant solution tests the suspect shift operation to guarantee there is no possibility of unsigned overflow.
unsigned int ui1, ui2, result;
if ( (ui2 < 0) || (ui2 >= sizeof(unsigned int)*CHAR_BIT) ) {
/* handle error condition */
}
result = ui1 >> ui2;
Non-Compliant Code Example (right shift)
The result of E1 >> E2 is E1 right-shifted E2 bit positions. If E1 has an unsigned type or if E1 has a signed type and a nonnegative value, the value of the result is the integral
part of the quotient of E1 / 2E2. If E1 has a signed type and a negative value, theresulting value is implementation-defined.
This code can result in an unsigned overflow during the shift operation of the unsigned operands ui1 and ui2. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner that could lead to an exploitable vulnerability.