Reject port numbers that contain a leading '+' in HttpStreamFactory::ProcessAlternateProtocol().

net/http/http_stream_factory.cc

Index: net/http/http_stream_factory.cc
diff --git a/net/http/http_stream_factory.cc b/net/http/http_stream_factory.cc
index 6ea3224dc96cb3534ca9788d0fdacf0767a5bbb2..0f2cf40abe7128d3e76b420b336f5776bb665ed5 100644
--- a/net/http/http_stream_factory.cc
+++ b/net/http/http_stream_factory.cc
@@ -11,6 +11,7 @@
 #include "base/time/time.h"
 #include "net/base/host_mapping_rules.h"
 #include "net/base/host_port_pair.h"
+#include "net/base/parse_number.h"
 #include "net/base/port_util.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_response_headers.h"
@@ -168,7 +169,8 @@ void HttpStreamFactory::ProcessAlternateProtocol(
       break;
     }
 
-    if (!base::StringToInt(port_protocol_vector[0], &port) ||
+    if (!ParseInt32(port_protocol_vector[0], ParseIntFormat::NON_NEGATIVE,
+                    &port) ||
         port == 0 || !IsPortValid(port)) {
       DVLOG(1) << kAlternateProtocolHeader
                << " header has unrecognizable port: "