ipc_message_attachment_set.cc 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "ipc/ipc_message_attachment_set.h"
  5. #include <stddef.h>
  6. #include <algorithm>
  7. #include "base/logging.h"
  8. #include "base/posix/eintr_wrapper.h"
  9. #include "build/build_config.h"
  10. #include "ipc/ipc_message_attachment.h"
  11. namespace IPC {
  12. namespace {
  13. unsigned count_attachments_of_type(
  14. const std::vector<scoped_refptr<MessageAttachment>>& attachments,
  15. MessageAttachment::Type type) {
  16. unsigned count = 0;
  17. for (const scoped_refptr<MessageAttachment>& attachment : attachments) {
  18. if (attachment->GetType() == type)
  19. ++count;
  20. }
  21. return count;
  22. }
  23. } // namespace
  24. MessageAttachmentSet::MessageAttachmentSet()
  25. : consumed_descriptor_highwater_(0) {
  26. }
  27. MessageAttachmentSet::~MessageAttachmentSet() {
  28. if (consumed_descriptor_highwater_ == size())
  29. return;
  30. // We close all the owning descriptors. If this message should have
  31. // been transmitted, then closing those with close flags set mirrors
  32. // the expected behaviour.
  33. //
  34. // If this message was received with more descriptors than expected
  35. // (which could a DOS against the browser by a rogue renderer) then all
  36. // the descriptors have their close flag set and we free all the extra
  37. // kernel resources.
  38. LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: "
  39. << consumed_descriptor_highwater_ << "/" << size();
  40. }
  41. unsigned MessageAttachmentSet::num_descriptors() const {
  42. return count_attachments_of_type(attachments_,
  43. MessageAttachment::Type::PLATFORM_FILE);
  44. }
  45. unsigned MessageAttachmentSet::size() const {
  46. return static_cast<unsigned>(attachments_.size());
  47. }
  48. bool MessageAttachmentSet::AddAttachment(
  49. scoped_refptr<MessageAttachment> attachment,
  50. size_t* index) {
  51. #if BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
  52. if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE &&
  53. num_descriptors() == kMaxDescriptorsPerMessage) {
  54. DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
  55. return false;
  56. }
  57. #endif
  58. switch (attachment->GetType()) {
  59. case MessageAttachment::Type::PLATFORM_FILE:
  60. case MessageAttachment::Type::MOJO_HANDLE:
  61. case MessageAttachment::Type::WIN_HANDLE:
  62. case MessageAttachment::Type::MACH_PORT:
  63. case MessageAttachment::Type::FUCHSIA_HANDLE:
  64. attachments_.push_back(attachment);
  65. *index = attachments_.size() - 1;
  66. return true;
  67. }
  68. return false;
  69. }
  70. bool MessageAttachmentSet::AddAttachment(
  71. scoped_refptr<MessageAttachment> attachment) {
  72. size_t index;
  73. return AddAttachment(attachment, &index);
  74. }
  75. scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
  76. unsigned index) {
  77. if (index >= size()) {
  78. DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
  79. return scoped_refptr<MessageAttachment>();
  80. }
  81. // We should always walk the descriptors in order, so it's reasonable to
  82. // enforce this. Consider the case where a compromised renderer sends us
  83. // the following message:
  84. //
  85. // ExampleMsg:
  86. // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
  87. //
  88. // Here the renderer sent us a message which should have a descriptor, but
  89. // actually sent two in an attempt to fill our fd table and kill us. By
  90. // setting the index of the descriptor in the message to 1 (it should be
  91. // 0), we would record a highwater of 1 and then consider all the
  92. // descriptors to have been used.
  93. //
  94. // So we can either track of the use of each descriptor in a bitset, or we
  95. // can enforce that we walk the indexes strictly in order.
  96. if (index == 0 && consumed_descriptor_highwater_ == size()) {
  97. DLOG(WARNING) << "Attempted to double-read a message attachment, "
  98. "returning a nullptr";
  99. }
  100. if (index != consumed_descriptor_highwater_)
  101. return scoped_refptr<MessageAttachment>();
  102. consumed_descriptor_highwater_ = index + 1;
  103. return attachments_[index];
  104. }
  105. void MessageAttachmentSet::CommitAllDescriptors() {
  106. attachments_.clear();
  107. consumed_descriptor_highwater_ = 0;
  108. }
  109. } // namespace IPC