Page History

Bitwise shifts include left shift operations of the form shift-expression << additive-expression and right shift operations of the form shift-expression >> additive-expression. The integer promotions are performed on the operands, each of which has integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.

Non-Compliant Code Example (left shift, signed type)

The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has a signed type and nonnegative value, and E1 * 2 E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.

The following code can result in undefined behavior because there is no check to ensure that left and right operands have nonnegative values, and that the right operand is greater than or equal to the width of the promoted left operand.

int si1, si2, sresult;

sresult = si1 << si2;

Compliant Solution (left shift, signed type)

This compliant solution eliminates the possibility of undefined behavior resulting from a left shift operation on signed and unsigned integers.  Smaller sized integers are promoted according to the integer promotion rules \[[INT02-A|INT02-A. Understand integer conversion rules]\].

int si1, si2, sresult;

if ( (si1 < 0) || (si2 < 0) || (si2 >= sizeof(int)*CHAR_BIT) || si1 > (INT_MAX >> si2) ) {
  /* handle error condition */
}
else {
  sresult = si1 << si2;
}

In C99, the CHAR_BIT macro defines the number of bits for smallest object that is not a bit-field (byte). A byte, therefore, contains CHAR_BIT bits.

Non-Compliant Code Example (left shift, unsigned type)

The result of {{E1 << E2}} is {{E1}} left-shifted {{E2}} bit positions; vacated bits are filled with zeros. If According to C99, if {{E1}} has an unsigned type, the value of the result is {{E1 * 2 ^E2^}}, reduced modulo one more than the maximum value representable in the result type.  Although C99 specifies modulo Asbehavior for aunsigned resultintegers, leftunsigned shiftinteger operationsoverflow canfrequently resultresults in unexpected anvalues and integerresultant overflowsecurity conditionvulnerabilities (see \[[INT32-C|INT32-C. Ensure that integer operations do not result in an overflow]\]). If {{E1}} has a signed type and nonnegative value,Consequently, unsigned overflow is generally non-compliant and {{E1 * 2 ^E2^}} ismust be representable in the result type,.  thenModulo thatbehavior is allowed if the resultingconditions value;in otherwise,the theexception behaviorsection isare undefinedmet.  

The following code can result in undefined behavior because there is no check to ensure that left and right operands have nonnegative values, and that the right operand is greater than or equal to the width of the promoted left operand.

int si1, si2, sresult;
unsigned int ui1, ui2, uresult;

sresult = si1 << si2;
uresult = ui1 << ui2;

Compliant Solution (left shift, unsigned type)

Wiki MarkupThis compliant solution eliminates the possibility of undefined behavior resulting from a left shift operation on signed and unsigned integers. Smaller sized integers are promoted according to the integer promotion rules \[[INT02-A|INT02-A. Understand integer conversion rules]\].Example solutions are provided for the fully compliant case (unsigned overflow is prohibited) and the exceptional case (modulo behavior is allowed).

unsigned int si1ui1, si2ui2, sresulturesult;
unsigned int ui1mod1, ui2, uresult;

if ( (si1 < 0) || (si2 < 0) || (si2 mod2;  /* modulo behavior is allowed on mod1 and mod2 by exception */

if ( (ui2 >= sizeof(unsigned int)*CHAR_BIT) || si1(ui1 > (INTUINT_MAX >> si2 / (1 << ui2))) ) {
  /* handle error condition */
}
else {
  sresulturesult = si1ui1 << si2ui2;
}

if ( (ui2mod2 >= sizeof(unsigned int)*CHAR_BIT) || (ui1 > (UINT_MAX / (1 << ui2))) ) {
  /* handle error condition */
}
else {
  uresult = ui1mod1 << ui2;
}

...

mod2; /* modulo behavior is allowed by exception */
}

Non-Compliant Code Example (right shift)

...

signed int si1, si2, result;

result = ui1 >> ui2;

Compliant Solution (left shift)

This compliant solution tests the suspect shift operation to guarantee there is no possibility of unsigned overflow.

unsigned int ui1, ui2, result;

if ( (ui2 < 0) || (ui2 >= sizeof(unsigned int)*CHAR_BIT) ) {
  /* handle error condition */
}
result = ui1 >> ui2;

Exceptions

Unsigned integers can be allowed to exhibit modulo behavior if and only if

1. the variable declaration is clearly commented as supporting modulo behavior
2. each operation on that integer is also clearly commented as supporting modulo behavior

If the integer exhibiting modulo behavior contributes to the value of an integer not marked as exhibiting modulo behavior, the resulting integer must obey this rule.

References

• ISO/IEC 9899-1999 Section 6.5, "Expressions," and Section 7.10, "Sizes of integer types <limits.h>"
• Seacord 05 Chapter 5, "Integers"
• Viega 05 Section 5.2.7, "Integer overflow"
• Dowd 06 Chapter 6, "C Language Issues"