Bitwise shifts include left shift operations of the form shift-expression <<
additive-expression and right shift operations of the form shift-expression >>
additive-expression. The integer promotions are performed on the operands, each of which has an integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.
In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a bug (logic error). This is different than overflow, where there is simply a representational deficiency (see INT32-C. Ensure that integer operations on signed integers do not result in an overflow).
Non-Compliant Code Example (Left Shift, Signed Type)
...
The result of E1 << E2
is E1
left-shifted E2
bit positions; vacated bits are filled with zeros. According to C99, if E1
has an unsigned type, the value of the result is E1 * 2 E2
, reduced modulo one more than the maximum value representable in the result type. Although C99 specifies modulo behavior for unsigned integers, unsigned integer overflow frequently results in unexpected values and resultant security vulnerabilities (see INT32-C. Ensure that integer operations on signed integers do not result in an overflow). Consequently, unsigned overflow is generally non-compliant, and E1 * 2 E2
must be representable in the result type. Modulo behavior is allowed if the conditions in the exception section are met.
...