[EventSource] retry field including non-digit chars should be ignored

third_party/WebKit/Source/core/page/EventSource.cpp

 /*
  * Copyright (C) 2009, 2012 Ericsson AB. All rights reserved.
  * Copyright (C) 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011, Code Aurora Forum. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 37 matching lines @@
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/loader/ThreadableLoader.h"
 #include "core/page/EventSourceInit.h"
 #include "platform/HTTPNames.h"
 #include "platform/network/ResourceError.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/network/ResourceResponse.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/WebURLRequest.h"
+#include "wtf/ASCIICType.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace blink {
 
 const unsigned long long EventSource::defaultReconnectDelay = 3000;
 
 inline EventSource::EventSource(ExecutionContext* context, const KURL& url, const EventSourceInit& eventSourceInit)
     : ActiveDOMObject(context)
     , m_url(url)
     , m_withCredentials(eventSourceInit.withCredentials())
@@ skipping 333 matching lines @@
 
         if (field == "data") {
             if (valueLength)
                 m_data.append(&m_receiveBuf[bufPos], valueLength);
             m_data.append('\n');
         } else if (field == "event") {
             m_eventName = valueLength ? AtomicString(&m_receiveBuf[bufPos], valueLength) : "";
         } else if (field == "id") {
             m_currentlyParsedEventId = valueLength ? AtomicString(&m_receiveBuf[bufPos], valueLength) : "";
         } else if (field == "retry") {
+            bool hasOnlyDigits = true;
+            for (int i = 0; i < valueLength && hasOnlyDigits; ++i) {
+                hasOnlyDigits = isASCIIDigit(m_receiveBuf[bufPos + i]);
+            }
             if (!valueLength) {
                 m_reconnectDelay = defaultReconnectDelay;
-            } else {
+            } else if (hasOnlyDigits) {
                 String value(&m_receiveBuf[bufPos], valueLength);
                 bool ok;
                 unsigned long long retry = value.toUInt64(&ok);
                 if (ok)
                     m_reconnectDelay = retry;
             }
         }
     }
 }
 
@@ skipping 22 matching lines @@
     return event.release();
 }
 
 DEFINE_TRACE(EventSource)
 {
     RefCountedGarbageCollectedEventTargetWithInlineData::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink