libxml: Fix undefined behavior due to integer overflow when parsing uri port.

third_party/libxml/src/uri.c

 /**
  * uri.c: set of generic URI related routines
  *
  * Reference: RFCs 3986, 2732 and 2373
  *
  * See Copyright for the status of this software.
  *
  * daniel@veillard.com
  */
 
@@ skipping 296 matching lines @@
     }
     *str = cur;
     return (0);
 }
 
 /**
  * xmlParse3986Port:
  * @uri:  pointer to an URI structure
  * @str:  the string to analyze
  *
- * Parse a port  part and fills in the appropriate fields
+ * Parse a port part and fills in the appropriate fields
  * of the @uri structure
  *
  * port          = *DIGIT
  *
  * Returns 0 or the error code
  */
 static int
 xmlParse3986Port(xmlURIPtr uri, const char **str)
 {
     const char *cur = *str;
 
     if (ISA_DIGIT(cur)) {
-        if (uri != NULL)
-            uri->port = 0;
+        unsigned port = 0; /* unsigned for defined overflow behavior */
         while (ISA_DIGIT(cur)) {
-            if (uri != NULL)
-                uri->port = uri->port * 10 + (*cur - '0');
+            port = port * 10 + (*cur - '0');
             cur++;
         }
+        if (uri != NULL)
+            uri->port = port & INT_MAX; /* port value modulo INT_MAX+1 */
         *str = cur;
         return(0);
     }
     return(1);
 }
 
 /**
  * xmlParse3986Userinfo:
  * @uri:  pointer to an URI structure
  * @str:  the string to analyze
@@ skipping 2210 matching lines @@
     }
 #endif
     memset(&temp, 0, sizeof(temp));
     temp.path = (char *) cal;
     ret = xmlSaveUri(&temp);
     xmlFree(cal);
     return(ret);
 }
 #define bottom_uri
 #include "elfgcchack.h"