fix: Avoid signed-int UB when decoding 4-byte RLP length headers
rlp_decode_length() decoded RLP_*_LEN_OF_BYTES_4 strings and lists with `*(buffer + 1) << 24` where buffer is a uint8_t pointer. The C integer promotions widen the byte to a signed `int`, and a shift by 24 of an `int` whose result sets the sign bit is undefined behavior under the standard. In practice this triggers whenever the most- significant byte of the encoded length is >= 0x80. Cast each byte to uint32_t before shifting (and switch from `+` to `|` so the byte composition matches the surrounding intent), removing the UB without changing the decoded value. (cherry picked from commit b93e591db83c0f4479150edcce95e62fd9714871)
C
Charles-Edouard de la Vergne committed
e9e4db95a7812882aec370fa826da13bf8c1bb2e
Parent: e0b8c65
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr>
on 8/25/2026, 3:03:59 PM