uri: fix off-by-one in port bounds check (#140)

* uri: fix off-by-one in port bounds check

sc_uri_create() rejected ports > 65536 instead of > 65535, so the
invalid port 65536 was accepted as valid. Valid TCP/UDP ports are
0-65535 (16-bit range).

* Lock URI port boundary behavior with regression coverage

The off-by-one fix needs an executable test for both the maximum valid port and the first invalid port, so future changes cannot silently reopen the boundary.

Constraint: The maintainer requested a regression test on PR #140

Rejected: Add a standalone test binary | The existing uri test target already covers the parser and keeps the change focused

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Keep 65535 and 65536 as adjacent explicit boundary cases

Tested: Old origin/master fails at the 65536 assertion; fixed tree passes Linux GCC with ASan/UBSan, MinGW GCC 8, and official CMake/CTest

Not-tested: Zig Windows workflow remains blocked by its upstream 153-byte download

Related: #140 (comment)

Author: 94xhn

uri/sc_uri.c

@@ -94,7 +94,7 @@ struct sc_uri *sc_uri_create(const char *str)
 
 			errno = 0;
 			val = strtoul(ptr + 1, &parse_end, 10);
-			if (errno != 0 || val > 65536) {
+			if (errno != 0 || val > 65535) {
 				return NULL;
 			}
 

uri/uri_test.c

@@ -246,12 +246,22 @@ void test13(void)
 	const char *f = "foo://user:password@example.com:-1/over/there?x#3";
 	const char *f2 = "foo://user:password@example.com:100000/over/"
 			 "there?x#3";
+	const char *f3 = "foo://example.com:65535";
+	const char *f4 = "foo://example.com:65536";
 
 	uri = sc_uri_create(f);
 	assert(uri == NULL);
 
 	uri = sc_uri_create(f2);
 	assert(uri == NULL);
+
+	uri = sc_uri_create(f3);
+	assert(uri != NULL);
+	assert(strcmp(uri->port, "65535") == 0);
+	sc_uri_destroy(uri);
+
+	uri = sc_uri_create(f4);
+	assert(uri == NULL);
 }
 
 #ifdef SC_HAVE_WRAP