From 2ade068fb66fd916afd4f3305d0b67d743e1dbe6 Mon Sep 17 00:00:00 2001 From: Eric Wild Date: Tue, 28 Jul 2026 17:42:32 +0200 Subject: [PATCH] firmware: sniffer: fix ~INS procedure byte comparison (~g_tpdu.packet[1]) == byte can never be true. Unary ~ applies the integer promotions first, so for tpdu INS = 0xA4 lhs should be 0x5B but as int it gets zero extended to at least 16 bits and then flipped, so it is 0xFFFFFF5B = -165, byte promotes to 0..255. The ack was therefore dead code -> fallthrough to SW1 branch, fails 0x6x/0x9x test, TPDU gets flagged SNIFF_DATA_FLAG_ERROR_MALFORMED from what I can tell. But I am losing track of all these arcane issues to be honest. Narrow the complement back to 8 bits. Fyi this is unrelated to signedness and not specific to ARM. Change-Id: I800f50ef35356429d07aa685ea919e70ec34946e --- firmware/libcommon/source/sniffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/firmware/libcommon/source/sniffer.c b/firmware/libcommon/source/sniffer.c index 948eee84..419e8fb3 100644 --- a/firmware/libcommon/source/sniffer.c +++ b/firmware/libcommon/source/sniffer.c @@ -775,7 +775,7 @@ static void process_byte_tpdu(uint8_t byte) } else if (g_tpdu.packet[1] == byte) { /* get all remaining data bytes */ change_tpdu_state(TPDU_S_DATA_REMAINING); break; - } else if ((~g_tpdu.packet[1]) == byte) { /* get single data byte */ + } else if ((uint8_t)(~g_tpdu.packet[1]) == byte) { /* get single data byte */ change_tpdu_state(TPDU_S_DATA_SINGLE); break; }