From a report received today:

CWE-197: Silent truncation of 64-bit length fields in S-expression encoding

In five locations, unsigned long length fields are cast to `unsigned
int` when building S-expressions:

cms.c:951      sprintf (numbuf,"(%u:", (unsigned int)n->len);
cert.c:521     sprintf (numbuf,"(%u:", (unsigned int)n->len);
cert.c:1923    sprintf (numbuf,"(%u:", (unsigned int)ti.length);
cert.c:1936    sprintf (numbuf,"(%u:", (unsigned int)keyid_derlen);
cert.c:2011    sprintf (numbuf,"(%u:", (unsigned int)ti.length);

On 64-bit platforms where sizeof(unsigned long) > sizeof(unsigned
int), any field with length > UINT_MAX (4,294,967,295) produces a
silently truncated length prefix while the data is copied in full
using the original unsigned long value. The resulting S-expression is
structurally malformed: the declared length does not match the actual
content. Downstream consumers (gpgsm, GnuPG's certificate store) would
either mismatch or skip the object.