Fixing SDP parsing crash due to invalid port numbers.

webrtc/pc/webrtcsdp.cc

 /*
  *  Copyright 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 1008 matching lines @@
   const std::string& transport = fields[2];
   uint32_t priority = 0;
   if (!GetValueFromString(first_line, fields[3], &priority, error)) {
     return false;
   }
   const std::string& connection_address = fields[4];
   int port = 0;
   if (!GetValueFromString(first_line, fields[5], &port, error)) {
     return false;
   }
+  if (port < 0 || port > 65535) {
+    return ParseFailed(first_line, "Invalid port number.", error);
+  }
   SocketAddress address(connection_address, port);
 
   cricket::ProtocolType protocol;
   if (!StringToProto(transport.c_str(), &protocol)) {
     return ParseFailed(first_line, "Unsupported transport type.", error);
   }
   switch (protocol) {
     case cricket::PROTO_UDP:
     case cricket::PROTO_TCP:
     case cricket::PROTO_SSLTCP:
@@ skipping 26 matching lines @@
     related_address.SetIP(fields[++current_position]);
     ++current_position;
   }
   if (fields.size() >= (current_position + 2) &&
       fields[current_position] == kAttributeCandidateRport) {
     int port = 0;
     if (!GetValueFromString(
         first_line, fields[++current_position], &port, error)) {
       return false;
     }
+    if (port < 0 || port > 65535) {

[pthatcher1, 2017/02/10 18:13:33]

Might as well make an IsValidPort() function.

[Taylor Brandstetter, 2017/02/10 19:25:30]

Done.

+      return ParseFailed(first_line, "Invalid port number.", error);
+    }
     related_address.SetPort(port);
     ++current_position;
   }
 
   // If this is a TCP candidate, it has additional extension as defined in
   // RFC 6544.
   std::string tcptype;
   if (fields.size() >= (current_position + 2) &&
       fields[current_position] == kTcpCandidateType) {
     tcptype = fields[++current_position];
@@ skipping 2106 matching lines @@
     UpdateCodec<AudioContentDescription, cricket::AudioCodec>(
         media_desc, payload_type, feedback_param);
   } else if (media_type == cricket::MEDIA_TYPE_VIDEO) {
     UpdateCodec<VideoContentDescription, cricket::VideoCodec>(
         media_desc, payload_type, feedback_param);
   }
   return true;
 }
 
 }  // namespace webrtc