SIGN IN SIGN UP

fix: Avoid signed-int UB when decoding 4-byte RLP length headers

rlp_decode_length() decoded RLP_*_LEN_OF_BYTES_4 strings and lists
with `*(buffer + 1) << 24` where buffer is a uint8_t pointer. The C
integer promotions widen the byte to a signed `int`, and a shift by
24 of an `int` whose result sets the sign bit is undefined behavior
under the standard. In practice this triggers whenever the most-
significant byte of the encoded length is >= 0x80.

Cast each byte to uint32_t before shifting (and switch from `+` to
`|` so the byte composition matches the surrounding intent),
removing the UB without changing the decoded value.

(cherry picked from commit b93e591db83c0f4479150edcce95e62fd9714871)
C
Charles-Edouard de la Vergne committed
e9e4db95a7812882aec370fa826da13bf8c1bb2e
Parent: e0b8c65
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr> on 8/25/2026, 3:03:59 PM