Update release notes wrt #124

Author: cowtowncoder

cbor/src/main/java/com/fasterxml/jackson/dataformat/cbor/CBORParser.java

@@ -701,8 +701,7 @@ public JsonToken nextToken() throws IOException
                             _numberLong = -l - 1L;
                             _numTypesValid = NR_LONG;
                         } else {
-                            BigInteger unsignedBase = _bigPositive(l);
-                            _numberBigInt = unsignedBase.negate().subtract(BigInteger.ONE);
+                            _numberBigInt = _bigNegative(l);
                             _numTypesValid = NR_BIGINT;
                         }
                     }
@@ -1176,8 +1175,7 @@ public String nextTextValue() throws IOException
                         _numberLong = l;
                         _numTypesValid = NR_LONG;
                     } else {
-                        BigInteger unsignedBase = _bigPositive(l);
-                        _numberBigInt = unsignedBase.negate().subtract(BigInteger.ONE);
+                        _numberBigInt = _bigNegative(l);
                         _numTypesValid = NR_BIGINT;
                     }
                 }
@@ -3145,6 +3143,8 @@ private final BigInteger _bigPositive(long l) {
     }
 
     private final BigInteger _bigNegative(long l) {
-        return BigInteger.valueOf(l).subtract(BigInteger.ONE);
+        // 03-Dec-2017, tatu: [dataformats-binary#149] Careful with overflow
+        BigInteger unsignedBase = _bigPositive(l);
+        return unsignedBase.negate().subtract(BigInteger.ONE);
     }
 }

release-notes/CREDITS

@@ -56,3 +56,7 @@ philipa@github
 * Reported #114 (cbor), contributed fix for: copyStructure(): avoid duplicate tags
   when copying tagged binary
  (2.9.3)
+
+Jacek Lach (JacekLach@github)
+* Reported #124: Invalid value returned for negative int32 where the absolute value is > 2^31 - 1
+ (2.9.3)

release-notes/VERSION

@@ -15,6 +15,8 @@ Modules:
  (contributed by philipa@github)
 #116: (protobuf) Should skip the positive byte which is the last byte of an varint
  (contributed by marsqing@github)
+#124: Invalid value returned for negative int32 where the absolute value is > 2^31 - 1
+ (repoted by Jacek L)
 - (protobuf) Minor fix to skipping with `nextFieldName()`
 - (avro) Fix a typo in SPI Metadata (META-INF/services/com.fasterxml.jackson.core.JsonFactory)