Fixing invalid IPv6 address parsing stack underflow on Windows.

webrtc/base/win32.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 258 matching lines @@
           // Special case - trailing ::.
           addr_cursor = addr_end;
         } else {
           while (*coloncounter) {
             if (*coloncounter == ':') {
               ++coloncount;
             }
             ++coloncounter;
           }
           // (coloncount + 1) is the number of shorts left in the address.
+          // If this number is greater than the number of available shorts, the
+          // address is malformed.
+          if (coloncount + 1 > addr_end - addr_cursor) {
+            return 0;
+          }
           addr_cursor = addr_end - (coloncount + 1);
           seencompressed = true;
         }
       } else {
         ++readcursor;
       }
     } else {
       uint16_t word;
       int bytesread = 0;
-      if (sscanf(readcursor, "%hx%n", &word, &bytesread) != 1) {
+      if (sscanf(readcursor, "%4hx%n", &word, &bytesread) != 1) {
         return 0;
       } else {
         *addr_cursor = HostToNetwork16(word);
         ++addr_cursor;
         readcursor += bytesread;
         if (*readcursor != ':' && *readcursor != '\0') {
           return 0;
         }
       }
     }
@@ skipping 148 matching lines @@
         *level = *GetSidSubAuthority(til->Label.Sid, count - 1);
         ret = true;
       }
     }
     CloseHandle(token);
   }
   return ret;
 }
 
 }  // namespace rtc