1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "ipc/ipc_message_attachment_set.h"
6
7 #include <stddef.h>
8
9 #include <algorithm>
10
11 #include "base/logging.h"
12 #include "base/posix/eintr_wrapper.h"
13 #include "build/build_config.h"
14 #include "ipc/ipc_message_attachment.h"
15
16 namespace IPC {
17
18 namespace {
19
count_attachments_of_type(const std::vector<scoped_refptr<MessageAttachment>> & attachments,MessageAttachment::Type type)20 unsigned count_attachments_of_type(
21 const std::vector<scoped_refptr<MessageAttachment>>& attachments,
22 MessageAttachment::Type type) {
23 unsigned count = 0;
24 for (const scoped_refptr<MessageAttachment>& attachment : attachments) {
25 if (attachment->GetType() == type)
26 ++count;
27 }
28 return count;
29 }
30
31 } // namespace
32
MessageAttachmentSet()33 MessageAttachmentSet::MessageAttachmentSet()
34 : consumed_descriptor_highwater_(0) {
35 }
36
~MessageAttachmentSet()37 MessageAttachmentSet::~MessageAttachmentSet() {
38 if (consumed_descriptor_highwater_ == size())
39 return;
40
41 // We close all the owning descriptors. If this message should have
42 // been transmitted, then closing those with close flags set mirrors
43 // the expected behaviour.
44 //
45 // If this message was received with more descriptors than expected
46 // (which could a DOS against the browser by a rogue renderer) then all
47 // the descriptors have their close flag set and we free all the extra
48 // kernel resources.
49 LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: "
50 << consumed_descriptor_highwater_ << "/" << size();
51 }
52
num_descriptors() const53 unsigned MessageAttachmentSet::num_descriptors() const {
54 return count_attachments_of_type(attachments_,
55 MessageAttachment::Type::PLATFORM_FILE);
56 }
57
size() const58 unsigned MessageAttachmentSet::size() const {
59 return static_cast<unsigned>(attachments_.size());
60 }
61
AddAttachment(scoped_refptr<MessageAttachment> attachment,size_t * index)62 bool MessageAttachmentSet::AddAttachment(
63 scoped_refptr<MessageAttachment> attachment,
64 size_t* index) {
65 #if defined(OS_POSIX) || defined(OS_FUCHSIA)
66 if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE &&
67 num_descriptors() == kMaxDescriptorsPerMessage) {
68 DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
69 return false;
70 }
71 #endif
72
73 switch (attachment->GetType()) {
74 case MessageAttachment::Type::PLATFORM_FILE:
75 case MessageAttachment::Type::MOJO_HANDLE:
76 case MessageAttachment::Type::WIN_HANDLE:
77 case MessageAttachment::Type::MACH_PORT:
78 case MessageAttachment::Type::FUCHSIA_HANDLE:
79 attachments_.push_back(attachment);
80 *index = attachments_.size() - 1;
81 return true;
82 }
83 return false;
84 }
85
AddAttachment(scoped_refptr<MessageAttachment> attachment)86 bool MessageAttachmentSet::AddAttachment(
87 scoped_refptr<MessageAttachment> attachment) {
88 size_t index;
89 return AddAttachment(attachment, &index);
90 }
91
GetAttachmentAt(unsigned index)92 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
93 unsigned index) {
94 if (index >= size()) {
95 DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
96 return scoped_refptr<MessageAttachment>();
97 }
98
99 // We should always walk the descriptors in order, so it's reasonable to
100 // enforce this. Consider the case where a compromised renderer sends us
101 // the following message:
102 //
103 // ExampleMsg:
104 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
105 //
106 // Here the renderer sent us a message which should have a descriptor, but
107 // actually sent two in an attempt to fill our fd table and kill us. By
108 // setting the index of the descriptor in the message to 1 (it should be
109 // 0), we would record a highwater of 1 and then consider all the
110 // descriptors to have been used.
111 //
112 // So we can either track of the use of each descriptor in a bitset, or we
113 // can enforce that we walk the indexes strictly in order.
114 if (index == 0 && consumed_descriptor_highwater_ == size()) {
115 DLOG(WARNING) << "Attempted to double-read a message attachment, "
116 "returning a nullptr";
117 }
118
119 if (index != consumed_descriptor_highwater_)
120 return scoped_refptr<MessageAttachment>();
121
122 consumed_descriptor_highwater_ = index + 1;
123
124 return attachments_[index];
125 }
126
CommitAllDescriptors()127 void MessageAttachmentSet::CommitAllDescriptors() {
128 attachments_.clear();
129 consumed_descriptor_highwater_ = 0;
130 }
131
132 } // namespace IPC
133