• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "ipc/ipc_message_attachment_set.h"
6 
7 #include <stddef.h>
8 
9 #include <algorithm>
10 
11 #include "base/logging.h"
12 #include "base/posix/eintr_wrapper.h"
13 #include "build/build_config.h"
14 #include "ipc/ipc_message_attachment.h"
15 
16 namespace IPC {
17 
18 namespace {
19 
count_attachments_of_type(const std::vector<scoped_refptr<MessageAttachment>> & attachments,MessageAttachment::Type type)20 unsigned count_attachments_of_type(
21     const std::vector<scoped_refptr<MessageAttachment>>& attachments,
22     MessageAttachment::Type type) {
23   unsigned count = 0;
24   for (const scoped_refptr<MessageAttachment>& attachment : attachments) {
25     if (attachment->GetType() == type)
26       ++count;
27   }
28   return count;
29 }
30 
31 }  // namespace
32 
MessageAttachmentSet()33 MessageAttachmentSet::MessageAttachmentSet()
34     : consumed_descriptor_highwater_(0) {
35 }
36 
~MessageAttachmentSet()37 MessageAttachmentSet::~MessageAttachmentSet() {
38   if (consumed_descriptor_highwater_ == size())
39     return;
40 
41   // We close all the owning descriptors. If this message should have
42   // been transmitted, then closing those with close flags set mirrors
43   // the expected behaviour.
44   //
45   // If this message was received with more descriptors than expected
46   // (which could a DOS against the browser by a rogue renderer) then all
47   // the descriptors have their close flag set and we free all the extra
48   // kernel resources.
49   LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: "
50                << consumed_descriptor_highwater_ << "/" << size();
51 }
52 
num_descriptors() const53 unsigned MessageAttachmentSet::num_descriptors() const {
54   return count_attachments_of_type(attachments_,
55                                    MessageAttachment::Type::PLATFORM_FILE);
56 }
57 
size() const58 unsigned MessageAttachmentSet::size() const {
59   return static_cast<unsigned>(attachments_.size());
60 }
61 
AddAttachment(scoped_refptr<MessageAttachment> attachment,size_t * index)62 bool MessageAttachmentSet::AddAttachment(
63     scoped_refptr<MessageAttachment> attachment,
64     size_t* index) {
65 #if defined(OS_POSIX) || defined(OS_FUCHSIA)
66   if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE &&
67       num_descriptors() == kMaxDescriptorsPerMessage) {
68     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
69     return false;
70   }
71 #endif
72 
73   switch (attachment->GetType()) {
74     case MessageAttachment::Type::PLATFORM_FILE:
75     case MessageAttachment::Type::MOJO_HANDLE:
76     case MessageAttachment::Type::WIN_HANDLE:
77     case MessageAttachment::Type::MACH_PORT:
78     case MessageAttachment::Type::FUCHSIA_HANDLE:
79       attachments_.push_back(attachment);
80       *index = attachments_.size() - 1;
81       return true;
82   }
83   return false;
84 }
85 
AddAttachment(scoped_refptr<MessageAttachment> attachment)86 bool MessageAttachmentSet::AddAttachment(
87     scoped_refptr<MessageAttachment> attachment) {
88   size_t index;
89   return AddAttachment(attachment, &index);
90 }
91 
GetAttachmentAt(unsigned index)92 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
93     unsigned index) {
94   if (index >= size()) {
95     DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
96     return scoped_refptr<MessageAttachment>();
97   }
98 
99   // We should always walk the descriptors in order, so it's reasonable to
100   // enforce this. Consider the case where a compromised renderer sends us
101   // the following message:
102   //
103   //   ExampleMsg:
104   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
105   //
106   // Here the renderer sent us a message which should have a descriptor, but
107   // actually sent two in an attempt to fill our fd table and kill us. By
108   // setting the index of the descriptor in the message to 1 (it should be
109   // 0), we would record a highwater of 1 and then consider all the
110   // descriptors to have been used.
111   //
112   // So we can either track of the use of each descriptor in a bitset, or we
113   // can enforce that we walk the indexes strictly in order.
114   if (index == 0 && consumed_descriptor_highwater_ == size()) {
115     DLOG(WARNING) << "Attempted to double-read a message attachment, "
116                      "returning a nullptr";
117   }
118 
119   if (index != consumed_descriptor_highwater_)
120     return scoped_refptr<MessageAttachment>();
121 
122   consumed_descriptor_highwater_ = index + 1;
123 
124   return attachments_[index];
125 }
126 
CommitAllDescriptors()127 void MessageAttachmentSet::CommitAllDescriptors() {
128   attachments_.clear();
129   consumed_descriptor_highwater_ = 0;
130 }
131 
132 }  // namespace IPC
133