Undefined behavior / potential security issue when reading JSON from dashboard server

According to one of the Axivion-C++-Gurus, the code introduced when fixing QTCREATORBUG-32012 is potentially harmful:
 
Andreas Loth: a colleague from out C++ analysis team told me this: another coll...
sent on November 14, 2024 4:37 PM
 
a colleague from our C++ analysis team told me this:

 casting from double to int has undefined behavior in C++ if the value is out-of-range!

and I dimly remember a case where the compiler actually uses that UB to optimize out an integer array bound checks; resulting in an actual security issue

another colleague mentioned this as alternative:

 QString::number(num,'f',num_decimal_places)

f format never uses exponent notation

I don't have enough C++-expertise to know how to do this properly, but the security issue mentioned would likely require a malicious dashboard server sending a double value in the JSON data that doesn't fit into a qint64.