Bitwise or shift operator applied to a signed operand
ID |
c.correctness.bitwise_on_signed_operand |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Numeric Operation |
Language |
C / C++ |
Description
A bitwise or shift operator is applied to a signed operand. The bit pattern of a negative value, and how a right shift fills the vacated bits, are implementation-defined for signed types, so the result of this expression is not portable and can differ across compilers and platforms. Give the operand an unsigned type before applying the bitwise operation.
Rationale
A bitwise or shift operator is applied to a signed operand. The bit pattern of a negative value, and how a right shift fills the vacated bits, are implementation-defined for signed types, so the result of this expression is not portable and can differ across compilers and platforms. Give the operand an unsigned type before applying the bitwise operation.
The following code illustrates the pattern detected by this rule:
void configure(char signedByte, short signedShort, long signedLong, long long signedLongLong,
unsigned int uFlags, int shiftAmount)
{
// FLAGGED: Bitwise or shift operator applied to a signed operand
int a = signedByte & 0x0F;
// FLAGGED: Bitwise or shift operator applied to a signed operand
int b = signedShort | 0x10;
// FLAGGED: Bitwise or shift operator applied to a signed operand
long c = signedLong ^ 0x01;
// FLAGGED: Bitwise or shift operator applied to a signed operand
long long d = signedLongLong << shiftAmount;
// FLAGGED: Bitwise or shift operator applied to a signed operand
int e = signedShort >> shiftAmount;
// FLAGGED: Bitwise or shift operator applied to a signed operand
int f = ~signedLong;
// FLAGGED: Bitwise or shift operator applied to a signed operand
int i = shiftAmount & 0x0F;
unsigned int g = uFlags & 0x0Fu;
unsigned int h = uFlags << shiftAmount;
(void)i; (void)a; (void)b; (void)c; (void)d; (void)e; (void)f; (void)g; (void)h;
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.