Shift of a negative value

Shift operator on negative value

expand all in page

Description

This defect occurs when a bit-wise shift is used on a variable that can have negative values.

Risk

Shifts on negative values overwrite the sign bit that identifies a number as negative. The shift operation can result in unexpected values.

Fix

The fix depends on the root cause of the defect. Often the result details (or source code tooltips in Polyspace® as You Code™) show a sequence of events that led to the defect. You can implement the fix on any event in the sequence. If the result details do not show this event history, you can search for previous references of variables relevant to the defect using right-click options in the source code and find related events. See also Interpret Polyspace Bug Finder Results in Polyspace Platform User Interface or Interpret Bug Finder Results in Polyspace Access Web Interface (Polyspace Access).

To fix the defect, check for negative values before the bit-wise shift operation and perform appropriate error handling.

See examples of fixes below.

If you do not want to fix the issue, add comments to your result or code to avoid another review. See:

Extend Checker

A default Bug Finder analysis might not raise this defect when the input values are unknown and only a subset of inputs cause an issue. To check for defects caused by specific system input values, run a stricter Bug Finder analysis. See Extend Bug Finder Checkers to Find Defects from Specific System Input Values.

Examples

expand all

int shifting(int val)
{
    int res = -1;
    return res << val;
}

In the return statement, the variable res is shifted a certain number of bits to the left. However, because res is negative, the shift might overwrite the sign bit.

Correction — Change the Data Type

One possible correction is to change the data type of the shifted variable to unsigned. This correction eliminates the sign bit, so left shifting does not change the sign of the variable.

int shifting(int val)
{
    unsigned int res = -1;
    return res << val;
}

Result Information

Group: Numerical
Language: C | C++
Default: Off
Command-Line Syntax: SHIFT_NEG
Impact: Low
PQL Name: std.defects.SHIFT_NEG

Version History

Introduced in R2013b

See Also

|

Topics