CERT C: Rule INT34-C

Shift of a negative value occurs when a bit-wise shift is used on a variable that can have negative values.

Shifts on negative values overwrite the sign bit that identifies a number as negative. The shift operation can result in unexpected values.

The fix depends on the root cause of the defect. Often the result details show a sequence of events that led to the defect. Use this event list to determine how the variable being shifted acquires negative values. You can implement the fix on any event in the sequence. If the result details do not show the event history, you can trace back using right-click options in the source code and see previous related events. See also Interpret Bug Finder Results in Polyspace Desktop User Interface.

To fix the defect, check for negative values before the bit-wise shift operation and perform appropriate error handling.

See examples of fixes below.

If you do not want to fix the issue, add comments to your result or code to avoid another review. See:

int shifting(int val)
{
    int res = -1;
    return res << val; //Noncompliant
}

In the return statement, the variable res is shifted a certain number of bits to the left. However, because res is negative, the shift might overwrite the sign bit.

One possible correction is to change the data type of the shifted variable to unsigned. This correction eliminates the sign bit, so left shifting does not change the sign of the variable.

int shifting(int val)
{
    unsigned int res = -1;
    return res << val;
}

Shift operation overflow occurs when a shift operation can result in values that cannot be represented by the result data type. The data type of a variable determines the number of bytes allocated for the variable storage and constrains the range of allowed values.

The exact storage allocation for different floating point types depends on your processor. See Target processor type (-target).

Shift operation overflows can result in undefined behavior.

The fix depends on the root cause of the defect. Often the result details show a sequence of events that led to the defect. Use this event list to determine how the variables in the shift operation acquire their current values. You can implement the fix on any event in the sequence. If the result details do not show the event history, you can trace back using right-click options in the source code and see previous related events. See also Interpret Bug Finder Results in Polyspace Desktop User Interface.

You can fix the defect by:

See examples of fixes below.

If you do not want to fix the issue, add comments to your result or code to avoid another review. See:

int left_shift(void) {

    int foo = 33;
    return 1 << foo;  //Noncompliant
}

In the return statement of this function, bit-wise shift operation is performed shifting 1 foo bits to the left. However, an int has only 32 bits, so the range of the shift must be between 0 and 31. Therefore, this shift operation causes an overflow.

One possible correction is to store the shift operation result in a larger data type. In this example, by returning a long long instead of an int, the overflow defect is fixed.

long long left_shift(void) {

    int foo = 33;
    return 1LL << foo; 
}