Issue #14036: return None when port in urlparse cross 65535

3 files changed, 11 insertions, 0 deletions

diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
index 73150cf..e9adaef 100755
--- a/Lib/test/test_urlparse.py
+++ b/Lib/test/test_urlparse.py
@@ -524,6 +524,11 @@ class UrlParseTestCase(unittest.TestCase):
         self.assertEqual(p.port, 80)
         self.assertEqual(p.geturl(), url)
 
+        # Verify an illegal port is returned as None
+        url = b"HTTP://WWW.PYTHON.ORG:65536/doc/#frag"
+        p = urllib.parse.urlsplit(url)
+        self.assertEqual(p.port, None)
+
     def test_attributes_bad_port(self):
         """Check handling of non-integer ports."""
         p = urllib.parse.urlsplit("http://www.example.net:foo")
diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
index 92170ad..528c0a7 100644
--- a/Lib/urllib/parse.py
+++ b/Lib/urllib/parse.py
@@ -143,6 +143,9 @@ class _NetlocResultMixinBase(object):
         port = self._hostinfo[1]
         if port is not None:
             port = int(port, 10)
+            # Return None on an illegal port
+            if not ( 0 <= port <= 65535):
+                return None
         return port
 
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 7ed8f15..d9b8b5c 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -67,6 +67,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #14036: Add an additional check to validate that port in urlparse does
+  not go in illegal range and returns None.
+
 - Issue #14875: Use float('inf') instead of float('1e66666') in the json module.
 
 - Issue #14426: Correct the Date format in Expires attribute of Set-Cookie