Bitwise shifts include left shift operations of the form shift-expression << additive-expression and right shift operations of the form shift-expression >> additive-expression. The integer promotions are performed on the operands, each of which has integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.
Non-Compliant Code Example (left shift)
The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2 E2, reduced modulo one more than the maximum value representable in the result type. As a result, left shift operations can result in an integer overflow condition (see [[INT32-C]]). If E1 has a signed type and nonnegative value, and E1 * 2 E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.
The following code can result in undefined behavior because there is no check to ensure that left and right operands have nonnegative values, and that the right operand is greater than or equal to the width of the promoted left operand.
signed int si1, si2, result; result = si1 << si2;
Compliant Solution (unsigned)
This compliant solution tests the suspect shift operation to guarantee there is no possibility of unsigned overflow.
int si1, si2, result;
if ( (si2 < 0) || (si2 < 0) || (si2 >= sizeof(int)*CHAR_BIT) || (si1 > (INT_MAX / (1 << si2)) ) {
/* handle error condition */
}
result = si1 << si2;
In C99, the CHAR_BIT macro defines the number of bits for smallest object that is not a bit-field (byte). A byte, therefore, contains CHAR_BIT bits.
Non-Compliant Code Example (right shift)
The result of E1 >> E2 is E1 right-shifted E2 bit positions. If E1 has an unsigned type or if E1 has a signed type and a nonnegative value, the value of the result is the integral
part of the quotient of E1 / 2E2. If E1 has a signed type and a negative value, theresulting value is implementation-defined.
This code can result in an unsigned overflow during the shift operation of the unsigned operands ui1 and ui2. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner that could lead to an exploitable vulnerability.
signed int si1, si2, result; result = ui1 >> ui2;
Compliant Solution (left shift)
This compliant solution tests the suspect shift operation to guarantee there is no possibility of unsigned overflow.
unsigned int ui1, ui2, result;
if ( (ui2 < 0) || (ui2 >= sizeof(unsigned int)*CHAR_BIT) ) {
/* handle error condition */
}
result = ui1 >> ui2;
References
- ISO/IEC 9899-1999 Section 6.5, "Expressions," and Section 7.10, "Sizes of integer types <limits.h>"
- Seacord 05 Chapter 5, "Integers"
- Viega 05 Section 5.2.7, "Integer overflow"
- Dowd 06 Chapter 6, "C Language Issues"