Fix ParseCIDRBlock() to no longer accept invalid inputs.

net/base/ip_address.cc

 // Copyright (c) 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/ip_address.h"
 
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_split.h"
 #include "net/base/ip_address_number.h"
@@ skipping 140 matching lines @@
 
   std::vector<base::StringPiece> parts = base::SplitStringPiece(
       cidr_literal, "/", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
   if (parts.size() != 2)
     return false;
 
   // Parse the IP address.
   if (!ip_address->AssignFromIPLiteral(parts[0]))
     return false;
 
+  // TODO(martijnc): Find a more general solution for the overly permissive
+  // base::StringToInt() parsing. https://crbug.com/596523.
+  const base::StringPiece& prefix_length = parts[1];
+  if (prefix_length.starts_with("+"))
+    return false;
+
   // Parse the prefix length.
   int number_of_bits = -1;
-  if (!base::StringToInt(parts[1], &number_of_bits))
+  if (!base::StringToInt(prefix_length, &number_of_bits))
     return false;
 
   // Make sure the prefix length is in a valid range.
   if (number_of_bits < 0 ||
       number_of_bits > static_cast<int>(ip_address->size() * 8))
     return false;
 
   *prefix_length_in_bits = static_cast<size_t>(number_of_bits);
   return true;
 }
 
 unsigned CommonPrefixLength(const IPAddress& a1, const IPAddress& a2) {
   return CommonPrefixLength(a1.bytes(), a2.bytes());
 }
 
 unsigned MaskPrefixLength(const IPAddress& mask) {
   return MaskPrefixLength(mask.bytes());
 }
 
 }  // namespace net