4

I know there are many similar questions on SO. Please read carefully before calling this a dup. If it is, I would be happy to get a reference to the relevant question.

It seems to me that the clang sanitizer is complaining about a perfectly valid left shift of an unsigned number.

int main()
{
    unsigned int x = 0x12345678;
    x = x << 12;
    return 15 & x;
}

Compiled thusly:

clang -fsanitize=undefined,integer shift-undefined.cpp -lubsan -lstdc++

Results in this error:

shift-undefined.cpp:4:11: runtime error: left shift of 305419896 by 12 places cannot be represented in type 'unsigned int'

I understand that some bits will be shifted off into oblivion, but I thought that was legal for unsigned numbers. What gives?

9
  • Since the expression is only using compile time constants, the compiler is probably trying to simplify it to a single constant and realizes it can't. Sep 19, 2022 at 22:06
  • 1
    @MikelF in case of left bitwise shift on unsigned it is defined.
    – Slava
    Sep 19, 2022 at 22:08
  • Cannot reproduce neither clang-12 nor clang13, what version of clang are you using?
    – Slava
    Sep 19, 2022 at 22:10
  • @Slava Thanks for the clarification. Learning new things on a Monday. Who would have thought?
    – Mikel F
    Sep 19, 2022 at 22:12
  • 1
    -fsanitize=integer is useful if you are not expecting your code to do the kind of this your code is doing.
    – Eljay
    Sep 19, 2022 at 22:19

1 Answer 1

10
-fsanitize=address,integer

The integer sanitizer turns on checking for "suspicious" overflows of unsigned integers too, which do not have undefined behavior.

See "-fsanitize=unsigned-integer-overflow: Unsigned integer overflow, where the result of an unsigned integer computation cannot be represented in its type. Unlike signed integer overflow, this is not undefined behavior, but it is often unintentional. This sanitizer does not check for lossy implicit conversions performed before such a computation (see -fsanitize=implicit-conversion)."

I'd remove that option and only concentrate on signed integer overflow:

-fsanitize=address,signed-integer-overflow
15
  • It might be nice if the sanitizer wording was a little clearer. The "SUMMARY" contains "undefined-behavior". Sep 19, 2022 at 22:28
  • @BenYlvisaker Yes, that's very unfortunate.
    – Ted Lyngmo
    Sep 19, 2022 at 22:29
  • Also I found the following bit of clang documentation, which seems relevant, but didn't seem to work the way I expected to with 30 seconds of testing. clang.llvm.org/docs/… Sep 20, 2022 at 19:10
  • @BenYlvisaker Yes, UBSAN_OPTIONS=silence_unsigned_overflow=1 works, but not if the type you are overflowing is smaller than an int so it gets promoted. I tried with an unsigned short and then it still triggered, but when switching to an unsigned int it stopped.
    – Ted Lyngmo
    Sep 20, 2022 at 19:27
  • @TedLyngmo: Note that in gcc, integer overflow that occurs with promoted unsigned short operands may cause arbitrary nonsensical behavior, even in cases where code does nothing with the computed result but store it in an unsigned object whose value would be ignored.
    – supercat
    Sep 21, 2022 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.