From 742746dc7b443e2ebc90abc45490b8fc271becc2 Mon Sep 17 00:00:00 2001 From: Robin Getz Date: Sat, 1 Aug 2026 14:58:12 -0400 Subject: [PATCH] Fix undefined shift in SimpleDeserializer::readS32 The signed integer deserialization code used a signed temporary value while assembling bytes: tmp = (tmp << 8) | byte; For negative values, tmp was initialized to -1 for sign extension, causing a left shift of a negative value, which is undefined behavior in C++. Use an unsigned temporary while constructing the 32-bit representation and convert to qint32 only after all bytes have been assembled. This preserves the existing two's complement sign handling while avoiding undefined signed shifts. Fixes static analysis (cppcheck) warning about shifting a negative value. Signed-off-by: Robin Getz --- sdrbase/util/simpleserializer.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sdrbase/util/simpleserializer.cpp b/sdrbase/util/simpleserializer.cpp index 77857b021..822e74382 100644 --- a/sdrbase/util/simpleserializer.cpp +++ b/sdrbase/util/simpleserializer.cpp @@ -340,7 +340,7 @@ setInvalid: bool SimpleDeserializer::readS32(quint32 id, qint32* result, qint32 def) const { uint readOfs; - qint32 tmp; + quint32 tmp; Elements::const_iterator it = m_elements.constFind(id); if(it == m_elements.constEnd()) goto returnDefault; @@ -354,10 +354,10 @@ bool SimpleDeserializer::readS32(quint32 id, qint32* result, qint32 def) const for(uint i = 0; i < it->length; i++) { quint8 byte = readByte(&readOfs); if((i == 0) && (byte & 0x80)) - tmp = -1; + tmp = 0xFFFFFFFF; tmp = (tmp << 8) | byte; } - *result = tmp; + *result = static_cast(tmp); return true; returnDefault: