CWE-1335: Incorrect Bitwise Shift of Integer

A negative shift amount for an x86 or x86_64 shift instruction will produce the number of bits to be shifted by taking a 2's-complement of the shift amount and effectively masking that amount to the lowest 6 bits for a 64 bit shift instruction.

The example above ends up with a shift amount of -5. The hexadecimal value is FFFFFFFFFFFFFFFD which, when bits above the 6th bit are masked off, the shift amount becomes a binary shift value of 111101 which is 61 decimal. A shift of 61 produces a very different result than -5. The previous example is a very simple version of the following code which is probably more realistic of what happens in a real system.

unsigned int r = 1 << -5;

A negative shift amount for an x86 or x86_64 shift instruction will produce the number of bits to be shifted by taking a 2's-complement of the shift amount and effectively masking that amount to the lowest 6 bits for a 64 bit shift instruction.

The example above ends up with a shift amount of -5. The hexadecimal value is FFFFFFFFFFFFFFFD which, when bits above the 6th bit are masked off, the shift amount becomes a binary shift value of 111101 which is 61 decimal. A shift of 61 produces a very different result than -5. The previous example is a very simple version of the following code which is probably more realistic of what happens in a real system.

int choose_bit(int reg_bit, int bit_number_from_elsewhere)  					  { 					   					    if (NEED_TO_SHIFT) 					    { 					     					      reg_bit -= bit_number_from_elsewhere; 					     					    } 					    return reg_bit; 					   					  } 					  unsigned int handle_io_register(unsigned int *r) 					  { 					   					    unsigned int the_bit = 1 << choose_bit(5, 10); 					    *r |= the_bit; 					    return the_bit; 					   					  }

A negative shift amount for an x86 or x86_64 shift instruction will produce the number of bits to be shifted by taking a 2's-complement of the shift amount and effectively masking that amount to the lowest 6 bits for a 64 bit shift instruction.

The example above ends up with a shift amount of -5. The hexadecimal value is FFFFFFFFFFFFFFFD which, when bits above the 6th bit are masked off, the shift amount becomes a binary shift value of 111101 which is 61 decimal. A shift of 61 produces a very different result than -5. The previous example is a very simple version of the following code which is probably more realistic of what happens in a real system.

int choose_bit(int reg_bit, int bit_number_from_elsewhere)  					  { 					   					    if (NEED_TO_SHIFT) 					    { 					     					      reg_bit -= bit_number_from_elsewhere; 					     					    } 					    return reg_bit; 					   					  } 					   					  unsigned int handle_io_register(unsigned int *r) 					  { 					   					    int the_bit_number = choose_bit(5, 10); 					    if ((the_bit_number > 0) && (the_bit_number < 63)) 					    { 					     					      unsigned int the_bit = 1 << the_bit_number; 					      *r |= the_bit; 					     					    } 					    return the_bit; 					   					  }