Reject port numbers that contain a leading '+' in HttpStreamFactory::ProcessAlternateProtocol().

net/http/http_stream_factory.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory.h"
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "net/base/host_mapping_rules.h"
 #include "net/base/host_port_pair.h"
+#include "net/base/parse_number.h"
 #include "net/base/port_util.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_response_headers.h"
 #include "net/quic/quic_protocol.h"
 #include "net/spdy/spdy_alt_svc_wire_format.h"
 #include "url/gurl.h"
 
 namespace net {
 
 // WARNING: If you modify or add any static flags, you must keep them in sync
@@ skipping 137 matching lines @@
         base::SplitStringPiece(alternate_protocol_str, ":",
                                base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
     if (port_protocol_vector.size() != 2) {
       DVLOG(1) << kAlternateProtocolHeader
                << " header has too many tokens: "
                << alternate_protocol_str;
       is_valid = false;
       break;
     }
 
-    if (!base::StringToInt(port_protocol_vector[0], &port) ||
+    if (!ParseInt32(port_protocol_vector[0], ParseIntFormat::NON_NEGATIVE,
+                    &port) ||
         port == 0 || !IsPortValid(port)) {
       DVLOG(1) << kAlternateProtocolHeader
                << " header has unrecognizable port: "
                << port_protocol_vector[0];
       is_valid = false;
       break;
     }
 
     protocol = AlternateProtocolFromString(port_protocol_vector[1].as_string());
 
@@ skipping 19 matching lines @@
 }
 
 HostPortPair HttpStreamFactory::RewriteHost(HostPortPair host_port_pair) {
   const HostMappingRules* mapping_rules = GetHostMappingRules();
   if (mapping_rules)
     mapping_rules->RewriteHost(&host_port_pair);
   return host_port_pair;
 }
 
 }  // namespace net