Ignore ufrag/password in "a=candidate" lines in SDP.

webrtc/api/webrtcsdp_unittest.cc

 /*
  *  Copyright 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 3293 matching lines @@
 }
 
 TEST_F(WebRtcSdpTest, SerializeUnifiedPlanSessionDescription) {
   MakeUnifiedPlanDescription();
   TestSerialize(jdesc_, true);
 }
 
 // Regression test for heap overflow bug:
 // https://bugs.chromium.org/p/chromium/issues/detail?id=647916
 TEST_F(WebRtcSdpTest, DeserializeSctpPortInVideoDescription) {
-  JsepSessionDescription jdesc_output(kDummyString);
-
   // The issue occurs when the sctp-port attribute is found in a video
   // description. The actual heap overflow occurs when parsing the fmtp line.
-  const char kSdpWithSctpPortInVideoDescription[] =
+  static const char kSdpWithSctpPortInVideoDescription[] =
       "v=0\r\n"
       "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
       "s=-\r\n"
       "t=0 0\r\n"
       "m=video 9 UDP/DTLS/SCTP 120\r\n"
       "a=sctp-port 5000\r\n"
       "a=fmtp:108 foo=10\r\n";
 
   ExpectParseFailure(std::string(kSdpWithSctpPortInVideoDescription),
                      "sctp-port");
 }
 
 // Regression test for integer overflow bug:
 // https://bugs.chromium.org/p/chromium/issues/detail?id=648071
 TEST_F(WebRtcSdpTest, DeserializeLargeBandwidthLimit) {
-  JsepSessionDescription jdesc_output(kDummyString);
-
   // Bandwidth attribute is the max signed 32-bit int, which will get
   // multiplied by 1000 and cause int overflow if not careful.
-  const char kSdpWithLargeBandwidth[] =
+  static const char kSdpWithLargeBandwidth[] =
       "v=0\r\n"
       "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
       "s=-\r\n"
       "t=0 0\r\n"
       "m=video 3457 RTP/SAVPF 120\r\n"
       "b=AS:2147483647\r\n"
       "foo=fail\r\n";
 
   ExpectParseFailure(std::string(kSdpWithLargeBandwidth), "foo=fail");
 }
+
+// Test that "ufrag"/"pwd" in the candidate line itself are ignored, and only
+// the "a=ice-ufrag"/"a=ice-pwd" attributes are used.
+// Regression test for:
+// https://bugs.chromium.org/p/chromium/issues/detail?id=681286
+TEST_F(WebRtcSdpTest, IceCredentialsInCandidateStringIgnored) {
+  // Important piece is "ufrag foo pwd bar".
+  static const char kSdpWithIceCredentialsInCandidateString[] =
+      "v=0\r\n"
+      "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
+      "s=-\r\n"
+      "t=0 0\r\n"
+      "m=audio 9 RTP/SAVPF 111\r\n"
+      "c=IN IP4 0.0.0.0\r\n"
+      "a=rtcp:9 IN IP4 0.0.0.0\r\n"
+      "a=ice-ufrag:ufrag_voice\r\na=ice-pwd:pwd_voice\r\n"
+      "a=rtpmap:111 opus/48000/2\r\n"
+      "a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host "
+      "generation 2 ufrag foo pwd bar\r\n";
+
+  JsepSessionDescription jdesc_output(kDummyString);
+  EXPECT_TRUE(
+      SdpDeserialize(kSdpWithIceCredentialsInCandidateString, &jdesc_output));
+  const IceCandidateCollection* candidates = jdesc_output.candidates(0);
+  ASSERT_NE(nullptr, candidates);
+  ASSERT_EQ(1, candidates->count());
+  cricket::Candidate c = candidates->at(0)->candidate();
+  EXPECT_EQ("ufrag_voice", c.username());
+  EXPECT_EQ("pwd_voice", c.password());
+}