Page History

...

int compute(int x) {
 = 50;
x += (x << 2) + 1;
  return x;
}
// ...

int x = compute(50);

Noncompliant Code Example (Left Shift)

...

int compute(int x) {
 = 50;
int y = x << 2;
  x += y + 1;
  return x;
}
// ...

int x = compute(50);

This example is noncompliant because the actual data has both bitwise and arithmetic operations performed on it, even though the operations are performed on different variables.

...

int compute(int x) = 50;
x ={
  return 5 * x + 1;
}
// ...

int x = compute(50);

A reviewer could now recognize that the operation should also be checked for overflow. The need for an overflow check might not have been apparent in the original, noncompliant code example (see NUM00-J. Detect or prevent integer overflow for more information).

...

int compute(int x) {
  x >>>= -50;
x >>>= 22;
  return x;
}
// ...

int x = compute(-50);

The >>>= operator is a logical right shift; it fills the leftmost bits with zeroes, regardless of the number's original sign. After execution of this code sequence, x contains a large positive number (specifically, 0x3FFFFFF3). Using logical right shift for division produces an incorrect result when the dividend (x in this example) contains a negative value.

...

int compute(int x) {
  x >>= -50;
x >>= 2 2;
  return x;
}
// ...

int x = compute(-50);

After this code sequence is run, x contains the value -13 rather than the expected -12. Arithmetic right shift truncates the resulting value toward negative infinity, whereas integer division truncates toward zero.

...

int compute(int x) {
  x /= -50;
x /= 4 4
  return x;
}
// ...

int x = compute(-50);

Noncompliant Code Example

...

In the bitwise operation, the value of the byte array element b[i] is promoted to an int by sign extension. When a byte array element contains a negative value (for example, 0xff), the sign extension propagates 1-bits into the upper 24 bits of the int. This behavior might be unexpected if the programmer is assuming that byte is an unsigned type. In this example, adding the promoted byte values to result fails to result in a packed integer representation of the bytes [FindBugs 2008].

See NUM01-J-EX1 for details about doing similar calculations for the purpose of serializing numbers into bytes.

Noncompliant Code Example

...

byte[] b = new byte[] {-1, -1, -1, -1};
int result = 0;
for (int i = 0; i < 4; i++) {
  result = ((result << 8) | (b[i] & 0xff));
}

See NUM01-J-EX1 for details about doing similar calculations for the purpose of serializing numbers into bytes.

Exceptions

NUM01-J-EX0: Bitwise operations may be used to construct constant expressions.

...

int limit = 0x1FFFF; // 2^17 - 1 = 131071

NUM01-J-EX1: Data that is normally treated arithmetically may be treated with bitwise operations for the purpose of serialization or deserialization. This alternative treatment is often required for reading or writing the data from a file or network socket. Bitwise operations are also permitted when reading or writing the data from a tightly packed data structure of bytes.

...

Performing bitwise manipulation and arithmetic operations on the same variable obscures the programmer's intentions and reduces readability. Consequently, it is more difficult for a security auditor or maintainer to determine which checks must be performed to eliminate security flaws and ensure data integrity. For instance, overflow checks are critical for numeric types that undergo arithmetic operations but less critical for numeric types that undergo bitwise operations.

Automated Detection

Related Guidelines

Bibliography

[FindBugs 2008]

 

[Seacord 2015]	Image Modified NUM01-J. Do not perform bitwise and arithmetic operations on the same data LiveLesson
[Steele 1977]

 

...

...