Fix out of bound reads in ParseIceServerUrl() for various input.

webrtc/api/peerconnection.cc

 /*
  *  Copyright 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 213 matching lines @@
   // scheme        = "turn" / "turns"
   // transport     = "udp" / "tcp" / transport-ext
   // transport-ext = 1*unreserved
   // turn-host     = IP-literal / IPv4address / reg-name
   // turn-port     = *DIGIT
   RTC_DCHECK(stun_servers != nullptr);
   RTC_DCHECK(turn_servers != nullptr);
   std::vector<std::string> tokens;
   cricket::ProtocolType turn_transport_type = cricket::PROTO_UDP;
   RTC_DCHECK(!url.empty());
-  rtc::tokenize(url, '?', &tokens);
+  rtc::tokenize_with_empty_tokens(url, '?', &tokens);
   std::string uri_without_transport = tokens[0];
   // Let's look into transport= param, if it exists.
   if (tokens.size() == kTurnTransportTokensNum) {  // ?transport= is present.
     std::string uri_transport_param = tokens[1];
-    rtc::tokenize(uri_transport_param, '=', &tokens);
-    if (tokens[0] == kTransport) {
-      // As per above grammar transport param will be consist of lower case
-      // letters.
-      if (!cricket::StringToProto(tokens[1].c_str(), &turn_transport_type) ||
-          (turn_transport_type != cricket::PROTO_UDP &&
-           turn_transport_type != cricket::PROTO_TCP)) {
-        LOG(LS_WARNING) << "Transport param should always be udp or tcp.";
-        return false;
-      }
+    rtc::tokenize_with_empty_tokens(uri_transport_param, '=', &tokens);
+    if (tokens[0] != kTransport) {
+      LOG(LS_WARNING) << "Invalid transport parameter key.";
+      return false;
+    }
+    if (tokens.size() < 2 ||
+        !cricket::StringToProto(tokens[1].c_str(), &turn_transport_type) ||
+        (turn_transport_type != cricket::PROTO_UDP &&
+         turn_transport_type != cricket::PROTO_TCP)) {
+      LOG(LS_WARNING) << "Transport param should always be udp or tcp.";
+      return false;
     }
   }
 
   std::string hoststring;
   ServiceType service_type;
   if (!GetServiceTypeAndHostnameFromUri(uri_without_transport,
                                        &service_type,
                                        &hoststring)) {
     LOG(LS_WARNING) << "Invalid transport parameter in ICE URI: " << url;
     return false;
@@ skipping 2108 matching lines @@
 
 bool PeerConnection::StartRtcEventLog_w(rtc::PlatformFile file,
                                         int64_t max_size_bytes) {
   return event_log_->StartLogging(file, max_size_bytes);
 }
 
 void PeerConnection::StopRtcEventLog_w() {
   event_log_->StopLogging();
 }
 }  // namespace webrtc