From 8746f82b79e759d0ba84ae973d6782fa8f2e84c4 Mon Sep 17 00:00:00 2001
From: Affan Ziya <affan@research.itecz.au>
Date: Thu, 22 Oct 2026 23:06:06 +0530
Subject: [PATCH] parser cbor BUGFIX negative integers below INT64_MIN

---
 src/parser_cbor.c             | 15 ++++++++++++---
 tests/utests/data/test_cbor.c | 21 +++++++++++++++++++++
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/src/parser_cbor.c b/src/parser_cbor.c
index 29abdbd17..1a0ec3c41 100644
--- a/src/parser_cbor.c
+++ b/src/parser_cbor.c
@@ -381,15 +381,24 @@ lydcbor_item_to_string(const cbor_item_t *item, char **str_val, size_t *str_len)
         break;
     }
     case CBOR_TYPE_NEGINT: {
-        int64_t val = -1 - (int64_t)cbor_get_int(item);
-        int len = snprintf(NULL, 0, "%" PRId64, val);
+        /* the value is -1 - val, which does not fit into int64_t for val > INT64_MAX */
+        uint64_t val = cbor_get_int(item);
+        int len;
+
+        if (val == UINT64_MAX) {
+            *str_val = strdup("-18446744073709551616");
+            LY_CHECK_ERR_RET(!*str_val, LOGMEM(NULL), LY_EMEM);
+            *str_len = strlen(*str_val);
+            break;
+        }
 
+        len = snprintf(NULL, 0, "-%" PRIu64, val + 1);
         if (len < 0) {
             return LY_ESYS;
         }
         *str_val = malloc(len + 1);
         LY_CHECK_ERR_RET(!*str_val, LOGMEM(NULL), LY_EMEM);
-        sprintf(*str_val, "%" PRId64, val);
+        sprintf(*str_val, "-%" PRIu64, val + 1);
         *str_len = len;
         break;
     }
diff --git a/tests/utests/data/test_cbor.c b/tests/utests/data/test_cbor.c
index fab33ad4c..43c76cc0e 100644
--- a/tests/utests/data/test_cbor.c
+++ b/tests/utests/data/test_cbor.c
@@ -408,6 +408,26 @@ test_invalid_input(void **state)
     CHECK_LOG_CTX("Value \"1000\" is out of type int8 min/max bounds.", "/cbor-test:lf-intg8", 0);
 }
 
+static void
+test_negint(void **state)
+{
+    struct lyd_node *tree;
+
+    /* {"cbor-test:lf-uintg8": -18446744073709551611} */
+    const char data1[] = "\xa1\x73" "cbor-test:lf-uintg8" "\x3b\xff\xff\xff\xff\xff\xff\xff\xfa";
+
+    /* {"cbor-test:lf-uintg8": -18446744073709551616} */
+    const char data2[] = "\xa1\x73" "cbor-test:lf-uintg8" "\x3b\xff\xff\xff\xff\xff\xff\xff\xff";
+
+    assert_int_equal(LY_EVALID, lyd_parse_data_mem_len(UTEST_LYCTX, data1, sizeof data1 - 1, LYD_CBOR, 0,
+            LYD_VALIDATE_PRESENT, &tree));
+    CHECK_LOG_CTX("Value \"-18446744073709551611\" is out of type uint8 min/max bounds.", "/cbor-test:lf-uintg8", 1);
+
+    assert_int_equal(LY_EVALID, lyd_parse_data_mem_len(UTEST_LYCTX, data2, sizeof data2 - 1, LYD_CBOR, 0,
+            LYD_VALIDATE_PRESENT, &tree));
+    CHECK_LOG_CTX("Invalid type uint8 value \"-18446744073709551616\".", "/cbor-test:lf-uintg8", 1);
+}
+
 int
 main(void)
 {
@@ -419,6 +439,7 @@ main(void)
         UTEST(test_opaque, setup),
         UTEST(test_attributes, setup),
         UTEST(test_invalid_input, setup),
+        UTEST(test_negint, setup),
     };
 
     return cmocka_run_group_tests(tests, NULL, NULL);