From 2be39cf0d011221d3ead9ec40ae2304ac214f590 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Wed, 7 Aug 2024 13:04:16 +0200
Subject: [PATCH] ldap: Promote uint8 to uint64 before shifting

Relates to zeek/spicy#1829
---
 src/analyzer/protocol/ldap/ldap.spicy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/analyzer/protocol/ldap/ldap.spicy b/src/analyzer/protocol/ldap/ldap.spicy
index 52ab0e6160..0816e6afe9 100644
--- a/src/analyzer/protocol/ldap/ldap.spicy
+++ b/src/analyzer/protocol/ldap/ldap.spicy
@@ -196,7 +196,7 @@ type MaybeEncrypted = unit(ctx: Ctx&) {
   # If so, switch into KRB mode assuming that's what is being used and
   # have a chance seeing some more plaintext LDAP in non-sealed tokens.
   rem: uint8[3] if ( ctx.messageMode == MessageMode::ENCRYPTED && (|self.mech| == 0 || self.mech.starts_with(b"GSS")) ) {
-    self.saslLen = (self.first << 24) + ($$[0] << 16) + ($$[1] << 8) + $$[2];
+    self.saslLen = (uint64(self.first) << 24) + (uint64($$[0]) << 16) + (uint64($$[1]) << 8) + uint64($$[2]);
   }
 
   : uint16 if ( self.saslLen >= 2 ) {