Page History

...

• Integer operands of any pointer arithmetic, including array indexing;
• The assignment expression for the declaration of a variable length array;
• The postfix expression preceding square brackets [] or the expression in square brackets [] of a subscripted designation of an element of an array object; and
• Function arguments of type size_t or rsize_t (for example, an argument to a memory allocation function).

Most integer operations can result in Integer operations will overflow if the resulting value cannot be represented by the underlying representation of the integer. The following table indicates which operations can result in overflow.

...

Subtraction is between two operands of arithmetic type, two pointers to qualified or unqualified versions of compatible object types, or a pointer to an object type and an integer type. This rule applies only applies to subtraction between two operands of arithmetic type (see ARR36-C. Do not subtract or compare two pointers that do not refer to the same array, ARR37-C. Do not add or subtract an integer to a pointer to a non-array object, and ARR30-C. Do not form or use out-of-bounds pointers or array subscripts for information about pointer subtraction).

...

The assertion fails if long long has less than twice the precision of int. The  PRECISION() macro and popcount() function are explained in provide the correct precision for any integer type (see INT35-C. Use correct integer precisions).  

Compliant Solution

The following portable compliant solution can be used with any conforming implementation, including those that do not have an integer type that is at least twice the precision of int:

...

The left-shift operator takes two integer operands of integer type. The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. 

The C Standard, 6.5.7, paragraph 4 [ISO/IEC 9899:2011], states

...

In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a logic error. These issues are covered by INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand.

Noncompliant Code Example

This noncompliant code example performs a left shift, after verifying that the number being shifted is not negative, and the number of bits to shift is valid.  The PRECISION() macro and popcount() function are explained in provide the correct precision for any integer type (see INT35-C. Use correct integer precisions). However, because this code does no overflow check, it can result in an unrepresentable value. 

...

Compliant Solution

This compliant solution eliminates the possibility of overflow resulting from a left-shift operation:

...

...