MISRA C:2012 Rule 12.2

The right hand operand of a shift operator shall lie in the range zero to one less than the width in bits of the essential type of the left hand operand

Description

Rule Definition

The right hand operand of a shift operator shall lie in the range zero to one less than the width in bits of the essential type of the left hand operand¹ .

Rationale

Consider this statement:

var = abc << num;

If abc is a 16-bit integer, then num must be in the range 0–15, (nonnegative and less than 16). If num is negative or greater than 16, then the shift behavior is undefined.

Polyspace Implementation

Polyspace^® raises a violation when the right operand of a shift operator exceeds the range defined in this rule. When the right operand is a variable, the violation is raised unless all possible value of the operand remains within the range defined in this rule.

When a preprocessor directive performs a shift operation on a number literal, Polyspace assumes that the number is 64 bits wide. The valid shift range for such a number is between 0 and 63. For instance:

#if (1 << 64) //Noncompliant
//...
#endif

When bitfields are within a complex expression, Polyspace extends this check onto the bitfield field width or the width of the base type.

Troubleshooting

If you expect a rule violation but do not see it, refer to Diagnose Why Coding Standard Violations Do Not Appear as Expected.

Examples

Avoid Shift Operations That Have Unacceptable Right Operand

void foo(void) {
  int i;
  unsigned int BitPack = 0U;
  
  for (i = 0; i <= 8; i++) {
    BitPack |= (1U << ((unsigned int)i));  //Noncompliant
  }
}

In this example, the left operand of the shift operator << is the literal constant 1U. According to the essential type model, the essential type of this unsigned integer constant is the unsigned type of lowest rank (UTLR), which is unsigned char. Acceptable values for the right operand of this operator lies in the range from zero to seven. Because the right operand i ranges from zero to eight, Polyspace reports a violation.

Check Information

Group: Expressions

Category: Required

AGC Category: Required

Version History

R2025a: true and false macros having value 1 and 0 considered essentially Boolean

Polyspace now considers the macros true and false from stdbool.h as essentially Boolean. If you specify the option -boolean-types, then the macros true/ TRUE/True and false/ FALSE/False are also considered essentially Boolean if they have values 1 and 0 respectively.

R2025a: Essential type of Boolean left operand used when calculating acceptable range of right operand

Polyspace uses the essential type of a Boolean left operand of shift operator to calculate the acceptable range of the right operand. For example, Polyspace now reports a violation on this shift operation:

void foo(unsigned char var2) {
	unsigned int var = (var2 == 3U) << 4U;
}

The acceptable range for the right operand of the shift operation is now calculated considering the essential type of the Boolean left operand. The value used in the code (4U) exceeds the acceptable range for Boolean left operand and Polyspace reports a violation.