commit 2ea764fed6a266e291cf37375f52bc92260f686c
Author:     Henrique194 <henriquejb194@gmail.com>
AuthorDate: Wed Apr 17 12:10:45 2024 -0300
Commit:     Turo Lamminen <turol@users.noreply.github.com>
CommitDate: Tue Apr 23 20:42:08 2024 +0300

    doom/strife: Fix possible UB in function P_SpawnMapThing when executing left shift with negative gameskill
---
 src/doom/p_mobj.c   | 6 +++++-
 src/strife/p_mobj.c | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/doom/p_mobj.c b/src/doom/p_mobj.c
index fe00d401..481c5282 100644
--- a/src/doom/p_mobj.c
+++ b/src/doom/p_mobj.c
@@ -804,7 +804,11 @@ void P_SpawnMapThing (mapthing_t* mthing)
     else if (gameskill == sk_nightmare)
 	bit = 4;
     else
-	bit = 1<<(gameskill-1);
+        // avoid undefined behavior (left shift by negative value and rhs too big)
+        // by accurately emulating what doom.exe did: reduce mod 32.
+        // For more details check:
+        // https://github.com/chocolate-doom/chocolate-doom/issues/1677
+        bit = (int) (1U << ((gameskill - 1) & 0x1F));

     if (!(mthing->options & bit) )
 	return;
diff --git a/src/strife/p_mobj.c b/src/strife/p_mobj.c
index ef49e8ef..038c3edb 100644
--- a/src/strife/p_mobj.c
+++ b/src/strife/p_mobj.c
@@ -952,7 +952,11 @@ void P_SpawnMapThing (mapthing_t* mthing)
     else if (gameskill == sk_nightmare)
         bit = 4;
     else
-        bit = 1<<(gameskill-1);
+        // avoid undefined behavior (left shift by negative value and rhs too big)
+        // by accurately emulating what doom.exe did: reduce mod 32.
+        // For more details check:
+        // https://github.com/chocolate-doom/chocolate-doom/issues/1677
+        bit = (int) (1U << ((gameskill - 1) & 0x1F));

     if (!(mthing->options & bit) )
         return;