Attribute the proxy port range to TCP, not RFC 3986

RFC 3986 defines port as *DIGIT with no range; the 1..65535 bound comes from
TCP's 16-bit port field.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

lang.indexes

@@ -23,7 +23,7 @@ pt:7
 ro:25
 ru:8
 sk:20
-sl:24
+si:24
 sv:17
 tr:10
 uk:22

lang/Slovenian.txt

@@ -3,7 +3,7 @@ Slovenian
 LANGUAGE_FILE
 Slovenian
 LANGUAGE_ISO
-sl
+si
 LANGUAGE_AUTHOR
 Jadran Rudec,iur.\r\njrudec@email.si \r\n
 LANGUAGE_CHARSET

src/htslib.c

@@ -65,6 +65,7 @@ Please visit our Website: http://www.httrack.com
 #endif /* _WIN32 */
 #include <stdarg.h>
 
+#include <ctype.h>
 #include <string.h>
 #include <time.h>
 #include <stdarg.h>
@@ -3747,6 +3748,20 @@ static int proxy_default_port(const char *arg) {
   return hts_proxy_is_socks(arg) ? 1080 : 8080;
 }
 
+// port "a" of -P argument "arg": digits fitting TCP's 1..65535, else the scheme
+// default. Not sscanf("%d"): past INT_MAX it wraps to a garbage port (#602)
+static int parse_proxy_port(const char *a, const char *arg) {
+  char *end;
+  long p;
+
+  if (!isdigit((unsigned char) *a)) // strtol would eat a sign or leading space
+    return proxy_default_port(arg);
+  p = strtol(a, &end, 10);
+  if (*end != '\0' || p < 1 || p > 65535) // ERANGE lands out of range too
+    return proxy_default_port(arg);
+  return (int) p;
+}
+
 void hts_parse_proxy(const char *arg, char *name, size_t name_size, int *port) {
   const char *authority = strstr(arg, "://");
   const char *a;
@@ -3762,10 +3777,7 @@ void hts_parse_proxy(const char *arg, char *name, size_t name_size, int *port) {
   while (a > authority && a[-1] != ':' && a[-1] != '@' && a[-1] != ']')
     a--;
   if (a > authority && a[-1] == ':') {
-    int p = -1;
-
-    sscanf(a, "%d", &p);
-    *port = (p > 0) ? p : proxy_default_port(arg);
+    *port = parse_proxy_port(a, arg);
     namelen = (size_t) (a - 1 - arg);
   } else {
     *port = proxy_default_port(arg);

src/webhttrack

@@ -33,19 +33,6 @@ function log {
     return 0
 }
 
-# Map a POSIX locale ("zh_TW.UTF-8@euro") to its lang.indexes number, English (1) if unknown
-function lang_index {
-    local locale=$1 indexes=$2 tag n t
-    tag=$(echo "${locale}" | cut -f1 -d'.' | cut -f1 -d'@' | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z_')
-    # a few languages carry a region-specific entry (zh_tw, pt_br); else use the bare language
-    for t in "${tag}" "${tag%%_*}"; do
-        n=$(grep -E "^${t}:" "${indexes}" | cut -f2 -d':')
-        test -n "${n}" && break
-    done
-    test -n "${n}" || n=1
-    echo "${n}"
-}
-
 function launch_browser {
     log "Launching $1"
     browser=$1
@@ -72,11 +59,13 @@ test -f "${DISTPATH}/lang.indexes" || ! log "Could not find ${DISTPATH}/lang.ind
 test -d "${DISTPATH}/lang" || ! log "Could not find ${DISTPATH}/lang" || exit 1
 test -d "${DISTPATH}/html" || ! log "Could not find ${DISTPATH}/html" || exit 1
 
-# Locale: POSIX precedence, LC_ALL overrides LC_MESSAGES overrides LANG
-HTSLANG="${LC_ALL}"
-! test -n "${HTSLANG}" && HTSLANG="${LC_MESSAGES}"
+# Locale
+HTSLANG="${LC_MESSAGES}"
+! test -n "${HTSLANG}" && HTSLANG="${LC_ALL}"
 ! test -n "${HTSLANG}" && HTSLANG="${LANG}"
-LANGN=$(lang_index "${HTSLANG}" "${DISTPATH}/lang.indexes")
+HTSLANG="$(echo "$LANG" | cut -f1 -d'.' | cut -f1 -d'_')"
+LANGN=$(grep -E "^${HTSLANG}:" "${DISTPATH}/lang.indexes" | cut -f2 -d':')
+! test -n "${LANGN}" && LANGN=1
 
 # Find the browser
 # note: not all systems have sensible-browser or www-browser alternative

tests/01_engine-proxyurl.test

@@ -71,3 +71,23 @@ p 'http://a]b:c@host' 'name=http://a]b:c@host port=8080 host=host kind=http'
 
 # a lone ':' must not underflow the backward scan
 p ':' 'name= port=8080 host= kind=http'
+
+# a port is *DIGIT in 1..65535, else the scheme default: sscanf("%d") used to
+# wrap past INT_MAX and hand back a garbage port (#602)
+p 'http://host:65535' 'name=http://host port=65535 host=host kind=http'
+p 'http://host:1' 'name=http://host port=1 host=host kind=http'
+p 'http://host:65536' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:2147483648' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:4294967296' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:99999999999999' 'name=http://host port=8080 host=host kind=http'
+# discriminating: this one wrapped to a plausible 80, so range-checking the
+# sscanf result instead of rejecting the overflow still passes everything above
+p 'http://host:4294967376' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:999999999999999999999999999999' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:0' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:-1' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:80x' 'name=http://host port=8080 host=host kind=http'
+p 'http://host: 80' 'name=http://host port=8080 host=host kind=http'
+p 'http://host:' 'name=http://host port=8080 host=host kind=http'
+# the fallback is the scheme's own default, not a hardcoded 8080
+p 'socks5://host:99999999999999' 'name=socks5://host port=1080 host=host kind=socks'

tests/61_webhttrack-locale.test

@@ -1,91 +0,0 @@
-#!/bin/bash
-#
-# webhttrack must map the caller's locale to the right lang.indexes number.
-# Guards: LC_ALL/LC_MESSAGES were ignored, and zh_tw/pt_br were unreachable.
-
-set -euo pipefail
-
-testdir=$(cd "$(dirname "$0")" && pwd)
-distdir=$(cd "${testdir}/.." && pwd)
-script="${distdir}/src/webhttrack"
-
-fail() {
-    echo "FAIL: $*" >&2
-    exit 1
-}
-
-test -r "${script}" || fail "no ${script}"
-test -r "${distdir}/lang.indexes" || fail "no ${distdir}/lang.indexes"
-
-# Lift the locale code out of the launcher, so this tests the shipped logic itself.
-funcs=$(sed -n '/^function lang_index/,/^}/p' "${script}")
-# End on the next section, not a blank line: a blank line grown inside the block
-# would truncate the lift and silently stop testing everything below it.
-grep -q '^# Find the browser' "${script}" || fail "locale block terminator moved in ${script}"
-block=$(sed -n '/^# Locale/,/^# Find the browser/p' "${script}" | sed '$d')
-echo "${block}" | grep -q 'LANGN=.*lang_index' || fail "could not lift the whole locale block from ${script}"
-
-# Run the lifted block against whatever locale vars the caller exported.
-run_block() {
-    # shellcheck disable=SC2034 # read by the eval'd locale block
-    DISTPATH="${distdir}"
-    # the launcher runs under neither -e ("! test -n x && y" returns 1) nor -u
-    set +eu
-    eval "${funcs}"
-    eval "${block}"
-    # shellcheck disable=SC2153 # LANGN is set by the eval'd block, not a LANG typo
-    echo "${LANGN}"
-}
-
-# Resolve LANG/LC_ALL/LC_MESSAGES (empty = unset) to the language number.
-lang_of() {
-    (
-        unset LANG LC_ALL LC_MESSAGES
-        # only the value matters here; hide bash's setlocale gripe when the locale is not installed
-        # shellcheck disable=SC2030 # confining the locale to this subshell is the point
-        {
-            if test -n "$1"; then export LANG="$1"; fi
-            if test -n "$2"; then export LC_ALL="$2"; fi
-            if test -n "$3"; then export LC_MESSAGES="$3"; fi
-        } 2>/dev/null
-        run_block
-    )
-}
-
-check() {
-    local want=$1 got desc
-    shift
-    desc="LANG='$1' LC_ALL='$2' LC_MESSAGES='$3'"
-    got=$(lang_of "$1" "$2" "$3")
-    test "${got}" = "${want}" || fail "${desc}: want ${want}, got ${got}"
-    echo "ok: ${desc} -> ${got}"
-}
-
-#      want  LANG            LC_ALL          LC_MESSAGES
-check 2 "fr_FR.UTF-8" "" ""
-check 14 "zh_TW.UTF-8" "" ""                      # region-qualified: Chinese-BIG5, not Simplified (13)
-check 12 "pt_BR.UTF-8" "" ""                      # region-qualified: Portugues-Brasil, not Portugues (7)
-check 13 "zh_CN.UTF-8" "" ""                      # unlisted region falls back to the bare language
-check 24 "sl_SI.UTF-8" "" ""                      # Slovenian is ISO 639-1 "sl"
-check 4 "" "de_DE.UTF-8" ""                       # LC_ALL alone
-check 4 "" "" "de_DE.UTF-8"                       # LC_MESSAGES alone
-check 4 "fr_FR.UTF-8" "de_DE.UTF-8" ""            # LC_ALL wins over LANG
-check 4 "fr_FR.UTF-8" "" "de_DE.UTF-8"            # LC_MESSAGES wins over LANG
-check 2 "de_DE.UTF-8" "fr_FR.UTF-8" "de_DE.UTF-8" # LC_ALL wins over LC_MESSAGES
-check 2 "fr_FR@euro" "" ""                        # @modifier without a charset
-check 1 "C" "" ""                                 # C, unknown and unset all mean English
-check 1 "xx_YY.UTF-8" "" ""
-check 1 "" "" ""
-
-# Exported but empty is unset (POSIX), so it must not mask LANG. lang_of cannot
-# express this: it exports nothing for an empty argument.
-got=$(
-    unset LANG LC_ALL LC_MESSAGES
-    # shellcheck disable=SC2031 # confining the locale to this subshell is the point
-    { export LANG="fr_FR.UTF-8" LC_ALL="" LC_MESSAGES=""; } 2>/dev/null
-    run_block
-)
-test "${got}" = 2 || fail "empty LC_ALL/LC_MESSAGES must not mask LANG: want 2, got ${got}"
-echo "ok: LANG='fr_FR.UTF-8' with LC_ALL='' exported -> ${got}"
-
-echo "PASS"

tests/Makefile.am

@@ -136,7 +136,6 @@ TESTS = \
 	55_local-chunked.test \
 	56_local-proxy-noleak.test \
 	57_local-proxy-connect.test \
-	58_watchdog.test \
-	61_webhttrack-locale.test
+	58_watchdog.test
 
 CLEANFILES = check-network_sh.cache