Page History

...

In almost every case, an attempt to shift by a negative number of bits or by The by more than the precision of an integer type is the number of bits it uses to represent values, excluding any sign and padding bits. operand indicates a bug (logic error). A logic error is different from overflow, in which there is simply a representational deficiency.  In general, shifts should only be performed on unsigned operands (see INT13-C. Use bitwise operators only on unsigned operands).

Noncompliant Code Example (Left Shift, Signed Type)

...

This noncompliant code example can result in undefined behavior because there is no check fails to ensure that left and right operands have nonnegative values and that the right operand is less than or equal to the precision of the promoted left operand. The example can also produce signed integer overflow; see INT32-C. Ensure that operations on signed integers do not result in overflow for more information.

...

The PRECISION()macro provides the correct precision for an unsigned any integer type (see INT19see INT35-C. Correctly compute Use correct integer widths). This solution also complies with INT34-C. Do not shift a negative number of bits or more bits than exist in the operand. See INT13-C. Use bitwise operators only on unsigned operands.precisions). 

Noncompliant Code Example (Left Shift, Unsigned Type)

...

This noncompliant code example can result in undefined behavior because there is no check fails to ensure that the right operand is less than or equal to the precision of the promoted left operand:

void func(unsigned int ui_a, unsigned int ui_b) {
  unsigned int uresult = ui_a << ui_b;

  /* ... */
}

Compliant Solution (Left Shift, Unsigned Type)

This compliant solution eliminates the possibility of undefined behavior resulting from a left-shift operation on unsigned integersshifting by more bits than exist in the left hand operand:

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>

extern size_t popcount(uintmax_t);
#define PRECISION(x) popcount(x)
 
void func(unsigned int ui_a, unsigned int ui_b) {
  unsigned int uresult = 0;
  if (ui_b >= PRECISION(UINT_MAX)) {
    /* Handle error condition */
  } else {
    uresult = ui_a << ui_b;
  }

  /* ... */
}

Modulo behavior resulting from left-shifting an unsigned integer type is permitted by exception INT30-EX3 to INT30-C. Ensure that unsigned integer operations do not wrap.

The PRECISION() macro provides the correct precision for an unsigned integer type and is defined in INT35-C. Use correct integer precisions.

Noncompliant Code Example (Right Shift)

...

void func(unsigned int ui_a, unsigned int ui_b) {
  unsigned int uresult = ui_a >> ui_b;

  /* ... */
}

Making assumptions about whether a right shift is implemented as an arithmetic (signed) shift or a logical (unsigned) shift can also lead to vulnerabilities. See INT13-C. Use bitwise operators only on unsigned operands.

Compliant Solution (Right Shift)

This compliant solution tests the suspect shift operations to guarantee there is no possibility of undefined behavioreliminates the possibility of shifting by more bits than exist in the left hand operand:

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>

extern size_t popcount(uintmax_t);
#define PRECISION(x) popcount(x)
 
void func(unsigned int ui_a, unsigned int ui_b) {
  unsigned int uresult = 0;
  if (ui_b >= PRECISION(UINT_MAX)) {
    /* Handle error condition */
  } else {
    uresult = ui_a >> ui_b;
  }
  /* ... */
}

 The PRECISION() macro provides the correct width for an unsigned integer type and is defined in INT35-C. Use correct integer precisions.

Implementation Details

GCC has no options to handle shifts by negative amounts or by amounts outside the width of the type predictably or to trap on them; they are always treated as undefined. Processors may reduce the shift amount modulo the width of the type. For example, 32-bit shifts are implemented using the following instructions on x86-32:

...

where %eax stores the least significant bits in the doubleword to be shifted, and %edx stores the most significant bits.

Exceptions

INT34-EX1: The signed integer value zero can be shifted by the width and not the precision.  Assuming a 32-bit int, for example, the following expression is allowed:

 0 << 31;

INT34-EX2: Any positive integer value can be right shifted by the width of the promoted left hand operand.  For example, positive >> 31 is valid for implementations where int has a width of 32 bits. However, any portable shift expression that takes advantage of the full width of a signed integer is guaranteed to have a result of zero, so it is not useful to shift beyond the precision.

Risk Assessment

Although shifting a negative number of bits or more bits than exist in the operand is undefined behavior in C, the risk is generally low because processors frequently reduce the shift amount modulo the width of the type.

...