2236
Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to
be shifted, produces a result which varies by architecture and compiler. In some languages, this
action is specifically listed as producing an undefined result.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 682 Incorrect Calculation 1499
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 189 Numeric Errors 2312
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Language : C# (Prevalence = Undetermined)
Language : Java (Prevalence = Undetermined)
Language : JavaScript (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity DoS: Crash, Exit, or Restart
Potential Mitigations
Phase: Implementation
Implicitly or explicitly add checks and mitigation for negative or over-shift values.
Demonstrative Examples
Example 1:
A negative shift amount for an x86 or x86_64 shift instruction will produce the number of bits to be
shifted by taking a 2's-complement of the shift amount and effectively masking that amount to the
lowest 6 bits for a 64 bit shift instruction.
Example Language: C (Bad)
unsigned int r = 1 << -5;
The example above ends up with a shift amount of -5. The hexadecimal value is
FFFFFFFFFFFFFFFD which, when bits above the 6th bit are masked off, the shift amount
becomes a binary shift value of 111101 which is 61 decimal. A shift of 61 produces a very different
result than -5. The previous example is a very simple version of the following code which is
probably more realistic of what happens in a real system.
CWE Version 4.14
CWE-1335: Incorrect Bitwise Shift of Integer
CWE-1335: Incorrect Bitwise Shift of Integer