From cee659d2ac1e4e9d1ce388338f46df6c4bae8278 Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Fri, 17 Oct 2025 22:57:39 +0000
Subject: [PATCH] reqs: fix integer overflow in port number processing

From: rofl0r <rofl0r@users.noreply.github.com>

closes #586

CVE: CVE-2025-63938
Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/3c0fde94981b025271ffa1788ae425257841bf5a]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 src/reqs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/reqs.c b/src/reqs.c
index a65ed54..1e5895c 100644
--- a/src/reqs.c
+++ b/src/reqs.c
@@ -174,7 +174,7 @@ static int strip_return_port (char *host)
 {
         char *ptr1;
         char *ptr2;
-        int port;
+        unsigned port;
 
         ptr1 = strrchr (host, ':');
         if (ptr1 == NULL)
@@ -186,8 +186,11 @@ static int strip_return_port (char *host)
                 return 0;
 
         *ptr1++ = '\0';
-        if (sscanf (ptr1, "%d", &port) != 1)    /* one conversion required */
-                return 0;
+
+        port = atoi(ptr1);
+        /* check that port string is in the valid range 1-0xffff) */
+        if(strlen(ptr1) > 5 || (port & 0xffff0000)) return 0;
+
         return port;
 }
 
