tree c82e2e15825eb39cf8cb458b86fbb4b1e48054a3
parent 66a28e991d365189af7efc5a34634462b1e532ab
author Gilles Peskine <Gilles.Peskine@arm.com> 1539364752 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1539364752 +0200

Fix undefined behavior in unsigned-to-signed conversion

The code assumed that `int x = - (unsigned) u` with 0 <= u < INT_MAX
sets `x` to the negative of u, but actually this calculates
(UINT_MAX - u) and then converts this value to int, which overflows.
Cast to int before applying the unary minus operator to guarantee the
desired behavior.