ext/ftp: validate $port range before narrowing to short in ftp_connect/ftp_ssl_connect

[lacatoire]

ftp_connect() and ftp_ssl_connect() accept $port as zend_long but cast it to C short at the ftp_open() call site without range-checking first. Values outside 0–65535 silently wrap: 65536 narrows to 0, which ftp_open() rewrites to 21, connecting to the FTP control port regardless of what the caller requested.

The fix validates $port before the cast and throws a ValueError for out-of-range values, consistent with how other extensions handle integer narrowing.

A test covering the boundary and the silent-wrap case is added.

[Sjord]

Looks good to me. Does this need a line in UPGRADING?

[devnexen]

diff --git a/ext/ftp/tests/ftp_connect_port_range.phpt b/ext/ftp/tests/ftp_connect_port_range.phpt
index 4225c07cd00..116e1bf94e6 100644
--- a/ext/ftp/tests/ftp_connect_port_range.phpt
+++ b/ext/ftp/tests/ftp_connect_port_range.phpt
@@ -1,31 +1,25 @@
 --TEST--
-ftp_connect(): $port values outside 0-65535 must throw ValueError, not alias onto a valid port
+ftp_connect(): $port outside 0-65535 must throw instead of aliasing onto a valid port
 --EXTENSIONS--
 ftp
 --FILE--
 <?php
 foreach ([-1, 65536, 65536 + 2121, PHP_INT_MIN, PHP_INT_MAX] as $port) {
     try {
-        ftp_connect('127.0.0.1', $port);
+        ftp_connect('totes.invalid', $port, 1);
     } catch (ValueError $e) {
-        echo $e->getMessage(), "\n";
+        echo $e::class, ': ', $e->getMessage(), PHP_EOL;
     }
 }

-// Port 0 must be accepted (maps to default FTP port 21 in ftp_open)
-// We expect false (connection refused), not ValueError.
-$result = @ftp_connect('127.0.0.1', 0);
-var_dump($result === false || is_object($result)); // true either way
-
-// Port 65535 must be accepted (last valid port).
-$result = @ftp_connect('127.0.0.1', 65535);
-var_dump($result === false || is_object($result)); // true either way
+var_dump(@ftp_connect('totes.invalid', 0, 1));
+var_dump(@ftp_connect('totes.invalid', 65535, 1));
 ?>
 --EXPECT--
-ftp_connect(): Argument #2 ($port) must be between 0 and 65535
-ftp_connect(): Argument #2 ($port) must be between 0 and 65535
-ftp_connect(): Argument #2 ($port) must be between 0 and 65535
-ftp_connect(): Argument #2 ($port) must be between 0 and 65535
-ftp_connect(): Argument #2 ($port) must be between 0 and 65535
-bool(true)
-bool(true)
+ValueError: ftp_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_connect(): Argument #2 ($port) must be between 0 and 65535
+bool(false)
+bool(false)
diff --git a/ext/ftp/tests/ftp_ssl_connect_port_range.phpt b/ext/ftp/tests/ftp_ssl_connect_port_range.phpt
new file mode 100644
index 00000000000..8b423e2c4a7
--- /dev/null
+++ b/ext/ftp/tests/ftp_ssl_connect_port_range.phpt
@@ -0,0 +1,29 @@
+--TEST--
+ftp_ssl_connect(): $port outside 0-65535 must throw instead of aliasing onto a valid port
+--EXTENSIONS--
+ftp
+--SKIPIF--
+<?php
+if (!function_exists('ftp_ssl_connect')) die('skip ftp_ssl is disabled');
+?>
+--FILE--
+<?php
+foreach ([-1, 65536, 65536 + 2121, PHP_INT_MIN, PHP_INT_MAX] as $port) {
+    try {
+        ftp_ssl_connect('totes.invalid', $port, 1);
+    } catch (ValueError $e) {
+        echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+    }
+}
+
+var_dump(@ftp_ssl_connect('totes.invalid', 0, 1));
+var_dump(@ftp_ssl_connect('totes.invalid', 65535, 1));
+?>
+--EXPECT--
+ValueError: ftp_ssl_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_ssl_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_ssl_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_ssl_connect(): Argument #2 ($port) must be between 0 and 65535
+ValueError: ftp_ssl_connect(): Argument #2 ($port) must be between 0 and 65535
+bool(false)
+bool(false)

[devnexen]

change is good but do not forget to add UPGRADING entry ;)