Page History

Bitwise shifts include left-shift operations of the form shift-expression << additive-expression and right-shift operations of the form shift-expression >> additive-expression. The integer promotions are performed on the operands, each of which has an integer type. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined. See also undefined behavior 51 in Annex J of the C Standard.

Do not shift a negative number of bits or by more than the precision of the promoted left operand. The precision of an integer type is the number of bits it uses to represent values, excluding any sign and padding bits. For unsigned integer types the width and the precision are the same, while for signed integer types the width is one greater than the precision.  We use precision instead of width in this rule to prevent a bit change from escaping the value bits to enter the sign bit, which is a violation of INT32-C. Ensure that operations on signed integers do not result in overflow.

In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the by The precision of an integer type is the number of bits it uses to represent values, excluding any sign and padding bits. operand indicates a bug (logic error). A logic error is different from overflow, in which there is simply a representational deficiency. (See INT32-C. Ensure that operations on signed integers do not result in overflow.)

Noncompliant Code Example (Left Shift, Signed Type)

...

This noncompliant code example can result in undefined behavior because there is no check to ensure that left and right operands have nonnegative values and that the right operand is less than or equal to the width precision of the promoted left operand. The example can also produce signed integer overflow; see INT32-C. Ensure that operations on signed integers do not result in overflow for more information.

...

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>
 
extern size_t popcount(uintmax_t);
#define UWIDTHPRECISION(x) popcount(x)

void func(signed long si_a, signed long si_b) {
  signed long result;
  if ((si_a < 0) || (si_b < 0) ||
      (si_b >= UWIDTHPRECISION(ULONG_MAX)) ||
      (si_a > (LONG_MAX >> si_b))) {
    /* Handle error */
  } else {
    result = si_a << si_b;
  }
  /* ... */
}

The UWIDTHPRECISION() macro macro provides the correct width precision for an unsigned integer type (see INT19-C. Correctly compute integer widths). This solution also complies with INT34-C. Do not shift a negative number of bits or more bits than exist in the operand. See INT13-C. Use bitwise operators only on unsigned operands.

...

This noncompliant code example can result in undefined behavior because there is no check to ensure that the right operand is less than or equal to the width precision of the promoted left operand:

...

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>

extern size_t popcount(uintmax_t);
#define UWIDTHPRECISION(x) popcount(x)
 
void func(unsigned int ui_a, unsigned int ui_b) {
  unsigned int uresult = 0;
  if (ui_b >= UWIDTHPRECISION(UINT_MAX)) {
    /* Handle error condition */
  } else {
    uresult = ui_a << ui_b;
  }

  /* ... */
}

Modulo behavior resulting from left-shifting an unsigned integer type is permitted by exception INT30-EX3 to INT30-C. Ensure that unsigned integer operations do not wrap.

The UWIDTHThe PRECISION() macro provides the correct width precision for an unsigned integer type and is defined in INT35-C. Use correct integer precisions.

...

This noncompliant code example fails to test whether the right operand is greater than or equal to the width precision of the promoted left operand, allowing undefined behavior:

...

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>

extern size_t popcount(uintmax_t);
#define UWIDTHPRECISION(x) popcount(x)
 
void func(unsigned int ui_a, unsigned int ui_b) {
  unsigned int uresult = 0;
  if (ui_b >= UWIDTHPRECISION(UINT_MAX)) {
    /* Handle error condition */
  } else {
    uresult = ui_a >> ui_b;
  }
  /* ... */
}

 The UWIDTHThe PRECISION() macro provides the correct width for an unsigned integer type and is defined in INT35-C. Use correct integer precisions.

...

where %eax stores the least significant bits in the doubleword to be shifted, and %edx stores the most significant bits.

Exceptions

INT34-EX1: The signed integer value zero can be shifted by the width and not the precision.  Assuming a 32-bit int, for example, the following expression is allowed:

Risk Assessment

Although shifting a negative number of bits or more bits than exist in the operand is undefined behavior in C, the risk is generally low because processors frequently reduce the shift amount modulo the width of the type.

...