Integer types in C have two metrics associated with them, a size and a width. The size indicates the number of bytes used by a variable, and can be retrieved for any variable or type using the sizeof
operator, while the width indicates the number of bits that are actually used to encode the integer's value. The C standard permits an integer to contain internal padding bits; these contribute to the integer's size, but not to its width. Consequently, an integer type may have a size that could be used to incorrectly assume its width is larger than it actually is. Do not use the sizeof
operator to compute the width of an integer type.
Noncompliant Code Example
This noncompliant code example illustrates a function that produces 2 raised to the power of the function argument. To prevent undefined behavior, in compliance with INT34-C. Do not shift a negative number of bits or more bits than exist in the operand, the function ensures that the argument is less than the number of bits used to store an unsigned int
.
unsigned int pow2(unsigned int exp) { if (exp >= sizeof( unsigned int) * CHAR_BIT) { /* handle error */ } return 1 << exp; }
However, if this code runs on a platform where unsigned int
has one or more padding bits, it can still accept values for exp
that are too large. For instance, a platform that stores unsigned int
in 64 bits, but uses only 48 width bits could perform a left shift on an illegal value of 56.
Compliant Solution
This compliant solution uses a popcount()
function, which counts the number of bits set on any unsigned integer. This allows this code to count the number of width bits used by the unsigned int
type.
/* Returns the number of set bits */ size_t popcount(uintmax_t num) { size_t width = 0; while (num != 0) { if (num % 2 == 1) { width++; } num >>= 1; } return width; } #define UWIDTH(type, umax_value) popcount(umax_value) unsigned int pow2(unsigned int exp) { if (exp >= UWIDTH(unsigned int, UINT_MAX)) { /* handle error */ } return 1 << exp; }
Implementation Details
Some platforms, such as the Cray Linux Environment (CLE) provide a _popcnt
instruction which can substitute for our popcount()
function.
#define UWIDTH(type, umax_value) _popcnt(umax_value)
Exceptions
INT19-EX1: Platforms in which integer types have no padding may use the sizeof operator to compute integer widths. This includes x86 and x86-64 platforms.
#define UWIDTH(type, umax_value) (sizeof(type) * CHAR_BIT)
Risk Assessment
Mistaking an integer size for its width can permit invalid width arguments to operations such as bitwise shifts, resulting in undefined behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
INT19-C | low | unlikely | medium | P2 | L3 |
Bibliography
[Dowd 2006] | Chapter 6, "C Language Issues" |
[C99 Rationale 2003] | Subclause 6.5.7, "Bitwise Shift Operators" |
Cray Linux Environment (CLE): supported on Cray XT CNL compute nodes |