fix(bin): reject oversized ports before arithmetic conversion

parse_port_from_url() converted the digit string with $((10#$port))
before bounding it. Bash evaluates in 64 bits and wraps silently, so an
out-of-range value could re-enter 1..65535 and be accepted as a real
port: 18446744073709551617 parsed as 1, and 18446744073709559616 as
8000. The preflight would then abort startup naming a port that was
never configured.

Normalise the leading-zero form textually instead, reject anything
longer than five digits, and only then convert and range-check. Java
reads 08080 as 8080, so that form is still accepted.

Covers both wrapping values, an all-zero port, and a long leading-zero
form in the URL-parsing table.

Author: bitflicker64

hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh

@@ -176,8 +176,13 @@ function parse_port_from_url() {
     fi
 
     [[ "$port" =~ ^[0-9]+$ ]] || return 1
-    # Normalise leading-zero forms; Java reads 08080 as decimal 8080.
-    port=$((10#$port))
+    # Normalise leading-zero forms textually; Java reads 08080 as decimal 8080.
+    # Arithmetic conversion must not happen before the value is bounded: Bash
+    # evaluates in 64-bit and wraps silently, so 18446744073709559616 would
+    # otherwise pass the range check as port 8000.
+    port="${port#"${port%%[!0]*}"}"
+    [[ -z "$port" ]] && return 1
+    (( ${#port} <= 5 )) || return 1
     (( port >= 1 && port <= 65535 )) || return 1
 
     echo "$port"

hugegraph-server/hugegraph-dist/src/assembly/travis/test-check-port.sh

@@ -93,6 +93,12 @@ url_cases=(
     'http://127.0.0.1:0|SKIP'
     'http://127.0.0.1:70000|SKIP'
     '127.0.0.1|SKIP'
+    # Oversized values must be rejected on their digits, not after a 64-bit
+    # arithmetic conversion that would wrap them back into range.
+    'http://127.0.0.1:18446744073709551617|SKIP'
+    'http://127.0.0.1:18446744073709559616|SKIP'
+    'http://127.0.0.1:0000000000000008080|8080'
+    'http://127.0.0.1:00000|SKIP'
 )
 for case in "${url_cases[@]}"; do
     url="${case%|*}"