buffer: fix sign overflow in `readUIn32BE`

`|` operation takes precendence on `+`, which will result in
`new Buffer('ffffffff', 16).readUInt32BE(0)` returning `-1` instead of
`ffffffff`.
Merge remote-tracking branch 'upstream/v0.10' into v0.10