[bug #68295] is_valid_port: undefined behavior with atoi on overflow

--8323329-1714636915-1777487544=:3538878
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

URL:=0A  <https://savannah.gnu.org/bugs/?68295>=0A=0A                 Summa=
ry: is_valid_port: undefined behavior with atoi on=0Aoverflow=0A           =
        Group: GNU Wget=0A               Submitter: sdainard=0A            =
   Submitted: Wed 29 Apr 2026 06:32:17 PM UTC=0A                Category: N=
one=0A                Severity: 3 - Normal=0A                Priority: 5 - =
Normal=0A                  Status: None=0A                 Privacy: Public=
=0A             Assigned to: None=0A         Originator Name: Samuel Dainar=
d=0A        Originator Email:=0A             Open/Closed: Open=0A         D=
iscussion Lock: Unlocked=0A                 Release: trunk=0A        Operat=
ing System: None=0A         Reproducibility: None=0A           Fixed Releas=
e: None=0A         Planned Release: None=0A              Regression: None=
=0A           Work Required: None=0A          Patch Included: Yes=0A=0A=0A =
   _______________________________________________________=0A=0AFollow-up C=
omments:=0A=0A=0A-------------------------------------------------------=0A=
Date: Wed 29 Apr 2026 06:32:17 PM UTC By: sdainard <sdainard>=0AThe is_vali=
d_port() function introduced in commit c419542d uses atoi() to=0Aparse the =
port string. atoi() has undefined behavior on integer overflow per=0Athe C =
standard.=0A                                  =0A=0A                       =
                                     =0A  Since this function processes unt=
rusted URL input, an attacker-controlled=0Astring like "99999999999" trigge=
rs UB before the range check can reject it.=0A                             =
                             =0A=0A                                        =
                    =0A  Replacing atoi() with strtoul() avoids UB =E2=80=
=94 strtoul sets errno to ERANGE=0Aon overflow. The end pointer also elimin=
ates the need for the separate=0Astrspn() call.=0A                         =
                                 =0A=0A                                    =
                        =0A  Patch attached.=0A=0A=0A=0A=0A=0A=0A    ______=
_________________________________________________=0AFile Attachments:=0A=0A=
Name: Fix-undefined-behavior-in-is_valid_port.patch Size: 1.6KiB=0A=0A<http=
s://file.savannah.gnu.org/file/Fix-undefined-behavior-in-is_valid_port.patc=
h?file_id=3D58526>=0A=0A=0A=0A    AGPL NOTICE=0A=0AThese attachments are se=
rved by Savane. You can download the corresponding=0Asource code of Savane =
at=0Ahttps://savannah.gnu.org/source/savane-c36938be85ff6c1b727bc7dd7fd30e4=
8f9142870.tar.gz=0A=0A    _________________________________________________=
______=0A=0AReply to this item at:=0A=0A  <https://savannah.gnu.org/bugs/?6=
8295>=0A=0A_______________________________________________=0AMessage sent v=
ia Savannah=0Ahttps://savannah.gnu.org/=0A
--8323329-1714636915-1777487544=:3538878
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCafJOuAAKCRCqLAuaBUf3
TtEkAP4sZekM7nZgfXGZEy+ewJdIkjCqbQH7Gt2My8yUD6mUbgD9FVTBP8MyMfhX
sweB3MEd+M1wrFSnm/5XdLBVuxq/eAk=
=jWpf
-----END PGP SIGNATURE-----

--8323329-1714636915-1777487544=:3538878--