From 4a647784c77473aef5c84edc08b128427dd256bc Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Mon, 17 Aug 2026 10:19:39 -0400 Subject: [PATCH] doc/bytemath: document the result of wide shifts Record that << and >> yield 0 when rvalue is 64 or more, beside the existing note about division by zero. A shift count can come from a byte_extract variable, so the rule text alone does not say which counts land in that case. Issue: 8845 --- doc/userguide/rules/payload-keywords.rst | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index bb64b1681e..4b0db2cfca 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -569,6 +569,8 @@ When ``relative`` is included, there must be a previous ``content`` or ``pcre`` Note: if ``oper`` is ``/`` and the divisor is 0, there will never be a match on the ``byte_math`` keyword. +Note: if ``oper`` is ``<<`` or ``>>`` and ``rvalue`` is 64 or greater, the result is 0. + The result can be stored in a result variable and referenced by other rule options later in the rule.