...
Left- and right-shift operators are often employed to multiply or divide a number by a power of 2. However, using shift operators to represent multiplication or division is an optimization that renders the code less portable and less readable. Furthermore, most compilers routinely will optimize multiplications and divisions by constant powers of 2 with bit-shift operations, and they are more familiar with the implementation details of the current platform.
...
Noncompliant Code Example (Left Shift)
In this non-compliant noncompliant code example, both bit manipulation and arithmetic manipulation are performed on the integer type x. The result is a (prematurely) optimized statement that assigns 5x + 1 to x for implementations where integers are represented as two's complement values.
...
Although this is a valid manipulation, the result of the shift depends on the underlying representation of the integer type and is consequently implementation-defined. Additionally, the readability of the code is reduced.
Compliant Solution (Left Shift)
In this compliant solution, the assignment statement is modified to reflect the arithmetic nature of x, resulting in a clearer indication of the programmer's intentions.
...
A reviewer may now recognize that the operation should also be checked for integer overflow. This might not have been apparent in the original, non-compliant noncompliant code example.
...
Noncompliant Code Example (Right Shift)
In this non-compliant noncompliant code example, the programmer prematurely optimizes code by replacing a division with a right shift.
...
For example, if the internal representation of x is 0xFFFF FFCE (two's complement), an arithmetic shift results in 0xFFFF FFF3 (-13 in two's complement), while a logical shift results in 0x3FFF FFF3 (1 073 741 811 in two's complement).
Compliant Solution (Right Shift)
In this compliant solution, the right shift is replaced by division.
...
The resulting value is now more likely to be consistent with the programmer's expectations.
Risk Assessment
Performing bit manipulation and arithmetic operations on the same variable obscures the programmer's intentions and reduces readability. This in turn makes it more difficult for a security auditor or maintainer to determine which checks must be performed to eliminate security flaws and ensure data integrity.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
INT14-A C | medium | unlikely | medium | P4 | L3 |
Automated Detection
Fortify SCA Version 5.0 with the CERT C Rule Pack can detect violations of this recommendation that perform arithmetic and bit operations are performed on same line but cannot distinguish between operations of positive and negative numbers.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.2.6.2, "Integer types" \[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "STR Bit Representations" \[[MISRA 04|AA. C References#MISRA 04]\] Rules 6.4 and 6.5 \[[Steele 77|AA. C References#Steele 77]\] |
...
04. Integers (INT) INT15-A. Use intmax_t or uintmax_t for formatted IO on programmer-defined integer types