catch other potential overflow

scan/scan_ushort.c

@@ -18,7 +18,7 @@ size_t scan_ushort(const char* src,unsigned short* dest) {
       unsigned short int n;
       /* division is very slow on most architectures */
       n=(unsigned short)(l<<3); if ((n>>3)!=l) break;
-      if (n+(l<<1) < n) break;
+      if ((unsigned short)(n+(l<<1)) < n) break;
       n=(unsigned short)(n+(l<<1));
       if ((unsigned short)(n+c) < n) break;
       l=(unsigned short)(n+c);

test/marshal.c

@@ -219,6 +219,9 @@ int main() {
   assert(scan_uint("4294967296",&ui)==9 && ui==429496729);
   assert(scan_ushort("65535",&us)==5 && us==0xffff);
   assert(scan_ushort("65536",&us)==4 && us==6553);
+  assert(scan_ushort("655350",&us)==5 && us==0xffff);
+  assert(scan_ushort("75535",&us)==4 && us==7553);
+
 
   assert(scan_xint("0ffffffff",&ui)==9 && ui==0xffffffff);
   assert(scan_xint("ffffffff0",&ui)==8 && ui==0xffffffff);