fix: cast buf bytes to uint64_t before shifting in BIT_STRING_TO_NR_CELL_IDENTITY

Without explicit casts, each buf byte was promoted to a 32-bit signed
int before shifting. For NR Cell Identity (36-bit, per 3GPP TS 38.423
§9.2.2.9), this causes two problems:

  - Shifting buf[0] left by 28 can push bits into or past the sign bit,
    producing undefined/implementation-defined behavior.
  - The 32-bit intermediate result is too narrow to hold a 36-bit value,
    causing silent truncation before the OR-reduction.

Fix by casting each byte to uint64_t prior to the shift, ensuring all
intermediate expressions are evaluated in a 64-bit unsigned domain and
all 36 bits are preserved without overflow.
This commit is contained in:
Rakesh BB
2026-04-27 07:01:43 +00:00
parent d191447a01
commit 7c29d27487

View File

@@ -268,12 +268,12 @@ do { \
BUFFER_TO_UINT32((aSN)->buf, x); \
} while (0)
#define BIT_STRING_TO_NR_CELL_IDENTITY(aSN, vALUE) \
do { \
DevCheck((aSN)->bits_unused == 4, (aSN)->bits_unused, 4, 0); \
vALUE = ((aSN)->buf[0] << 28) | ((aSN)->buf[1] << 20) | \
((aSN)->buf[2] << 12) | ((aSN)->buf[3]<<4) | ((aSN)->buf[4]>>4); \
} while(0)
#define BIT_STRING_TO_NR_CELL_IDENTITY(aSN, vALUE) \
do { \
DevCheck((aSN)->bits_unused == 4, (aSN)->bits_unused, 4, 0); \
(vALUE) = ((uint64_t)(aSN)->buf[0] << 28) | ((uint64_t)(aSN)->buf[1] << 20) | ((uint64_t)(aSN)->buf[2] << 12) \
| ((uint64_t)(aSN)->buf[3] << 4) | ((uint64_t)(aSN)->buf[4] >> 4); \
} while (0)
#define MCC_HUNDREDS(vALUE) \
((vALUE) / 100)