[tanjiroK-coder]

httpSeparateURI collects the port portion of a URI with *port = (int)strtol(uri + 1, ...), so the range check that follows runs on the already-truncated int. On 64-bit platforms a numeric port of 2^32+N truncates to N, and a URI such as ipp://host:4294967953/ipp/print comes back as HTTP_URI_STATUS_OK with port 657 instead of HTTP_URI_STATUS_BAD_PORT, while http://127.0.0.1:99999/ is rejected as expected. URIs that land here are often remote input, for example printer-uri-supported values from an IPP printer or endpoint URLs from OAuth server metadata, so this parser and a strict RFC 3986 parser disagree about the same string. Keeping the strtol result in a long and checking the range before narrowing restores the rejection for out-of-range values of any size. Added a testhttp case under the bad-port entries that returns OK with port 81 before the change and BAD_PORT after; make test still passes with a 100% score.

[michaelrsweet]

LGTM