Merge pull request #179 from tanjiroK-coder/uri-port-truncation

fix port number truncation in httpSeparateURI

Author: michaelrsweet

CHANGES.md

@@ -34,6 +34,8 @@ v3.0.4 - YYYY-MM-DD
 - Fixed some character testing that wasn't safe on platforms with a signed
   `char` type (Issue #177)
 - Fixed support for mDNSResponder on Windows (Issue #178)
+- Fixed `httpSeparateURI` to reject URI port numbers whose value was truncated
+  when converted to `int`.
 
 
 v3.0.3 - 2026-08-20

cups/http-support.c

@@ -938,21 +938,25 @@ httpSeparateURI(
     // See if we have a port number...
     if (*uri == ':')
     {
+      long	portnum;		// Port number
+
       // Yes, collect the port number...
       if (!_cups_isdigit(uri[1]))
       {
         *port = 0;
         return (HTTP_URI_STATUS_BAD_PORT);
       }
 
-      *port = (int)strtol(uri + 1, (char **)&uri, 10);
+      portnum = strtol(uri + 1, (char **)&uri, 10);
 
-      if (*port <= 0 || *port > 65535)
+      if (portnum <= 0 || portnum > 65535)
       {
         *port = 0;
         return (HTTP_URI_STATUS_BAD_PORT);
       }
 
+      *port = (int)portnum;
+
       if (*uri != '/' && *uri)
       {
         *port = 0;

cups/testhttp.c

@@ -191,6 +191,9 @@ static uri_test_t	uri_tests[] =	// URI test data
 			  { HTTP_URI_STATUS_BAD_PORT, "http://127.0.0.1:9999a/index.html",
 			    "http", "", "127.0.0.1", "", 0, 0,
 			    HTTP_URI_CODING_MOST  },
+			  { HTTP_URI_STATUS_BAD_PORT, "http://127.0.0.1:4294967377/index.html",
+			    "http", "", "127.0.0.1", "", 0, 0,
+			    HTTP_URI_CODING_MOST  },
 
 			  // Bad resource
 			  { HTTP_URI_STATUS_BAD_RESOURCE, "mailto:\r\nbla",