...
| Code Block | ||||
|---|---|---|---|---|
| ||||
int rc = 0;
unsigned int stringify = 0x80000000;
char buf[sizeof("256")];
rc = snprintf(buf, sizeof(buf), "%u", stringify >> 24);
if (rc == -1 || rc >= sizeof(buf)) {
/* Handle error */
} |
Also, consider using the sprintf_s() function, defined in ISO/IEC TR 24731-1, instead of snprintf() to provide some additional checks. (See STR07-C. Use the bounds-checking interfaces for string manipulation.)
Exceptions
INT13-C-EX1: When used as bit flags, it is acceptable to use preprocessor macros or enumeration constants as arguments to the & and | operators even if the value is not explicitly declared as unsigned.
...
Performing bitwise operations on signed numbers can lead to buffer overflows and the execution of arbitrary code by an attacker in some cases, unexpected or implementation-defined behavior in others.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
INT13-C | High | Unlikely | Yes |
No | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| bitop-type | Fully checked | ||||||
| Axivion Bauhaus Suite |
| CertC-INT13 | |||||||
| CodeSonar |
| LANG.TYPE.IOT | Inappropriate operand type | ||||||
| Compass/ROSE |
Can detect violations of this rule. In particular, it flags bitwise operations that involved variables not declared with | |||||||||
| CC2.INT13 | Fully implemented | |||||||
| Helix QAC |
| C4532, C4533, C4534, C4543, C4544 | |||||||
| Klocwork |
| MISRA.BITS.NOT_UNSIGNED MISRA.BITS.NOT_UNSIGNED.PREP |
| LDRA tool suite |
| 50 S | Fully implemented | ||||||
| Parasoft C/C++test |
| CERT_C-INT13-a CERT_C-INT13-b | Operands of bitwise and complement operators shall have an unsigned type Operands of shift operators shall have an unsigned type | |||||||
| PC-lint Plus |
| 9233 | Partially supported: reports use of a bitwise operator on an expression with a signed MISRA C 2004 underlying type | ||||||
| Checks for bitwise operation on negative value (rec. fully covered) | ||||||||
| RuleChecker |
| bitop-type | Fully checked | ||||||
| SonarQube C/C++ Plugin |
|
| Splint |
|
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | VOID INT13-CPP. Use bitwise operators only on unsigned operands |
| ISO/IEC TR 24772:2013 | Bit Representations [STR] Arithmetic Wrap-around Error [FIF] Sign Extension Error [XZI] |
| MITRE CWE | CWE-682, Incorrect calculation |
Bibliography
| [Dowd 2006] | Chapter 6, "C Language Issues" |
| [C99 Rationale 2003] | Subclause 6.5.7, "Bitwise Shift Operators" |
...
...