lib: uri-util - harden uri_parse_port against overflow

The invalid input 72817 (2^16*10/9) is parsed as a valid value.
7281 * 10 + 7 = 72817 == 7281 (mod 2^16), so the prev check fails.

Signed-off-by: Phil Carmody <phil@dovecot.fi>

diff --git a/src/lib/uri-util.c b/src/lib/uri-util.c
index a69e581e531611f2073844d892a2e2d78f9d30f9..ee8334805b3e0b65ae0cdebc253d77ab34b8cd25 100644 (file)
--- a/src/lib/uri-util.c
+++ b/src/lib/uri-util.c
@@ -479,7 +479,7 @@ static int uri_parse_host(struct uri_parser *parser, struct uri_authority *auth)
 
 static int uri_parse_port(struct uri_parser *parser, struct uri_authority *auth)
 {
-       in_port_t port = 0;
+       unsigned long port = 0;
        int count = 0;
 
        /* RFC 3986:
@@ -488,10 +488,8 @@ static int uri_parse_port(struct uri_parser *parser, struct uri_authority *auth)
         */
 
        while (parser->cur < parser->end && i_isdigit(*parser->cur)) {
-               in_port_t prev = port;
-
-               port = port * 10 + (in_port_t)(parser->cur[0] - '0');
-               if (port < prev) {
+               port = port * 10 + (parser->cur[0] - '0');
+               if (port > (in_port_t)-1) {
                        parser->error = "Port number is too high";
                        return -1;
                }