1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "ipc/ipc_message_attachment_set.h" 6 7 #include <stddef.h> 8 9 #include <algorithm> 10 11 #include "base/logging.h" 12 #include "base/posix/eintr_wrapper.h" 13 #include "build/build_config.h" 14 #include "ipc/ipc_message_attachment.h" 15 16 namespace IPC { 17 18 namespace { 19 20 unsigned count_attachments_of_type( 21 const std::vector<scoped_refptr<MessageAttachment>>& attachments, 22 MessageAttachment::Type type) { 23 unsigned count = 0; 24 for (const scoped_refptr<MessageAttachment>& attachment : attachments) { 25 if (attachment->GetType() == type) 26 ++count; 27 } 28 return count; 29 } 30 31 } // namespace 32 33 MessageAttachmentSet::MessageAttachmentSet() 34 : consumed_descriptor_highwater_(0) { 35 } 36 37 MessageAttachmentSet::~MessageAttachmentSet() { 38 if (consumed_descriptor_highwater_ == size()) 39 return; 40 41 // We close all the owning descriptors. If this message should have 42 // been transmitted, then closing those with close flags set mirrors 43 // the expected behaviour. 44 // 45 // If this message was received with more descriptors than expected 46 // (which could a DOS against the browser by a rogue renderer) then all 47 // the descriptors have their close flag set and we free all the extra 48 // kernel resources. 49 LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: " 50 << consumed_descriptor_highwater_ << "/" << size(); 51 } 52 53 unsigned MessageAttachmentSet::num_descriptors() const { 54 return count_attachments_of_type(attachments_, 55 MessageAttachment::Type::PLATFORM_FILE); 56 } 57 58 unsigned MessageAttachmentSet::size() const { 59 return static_cast<unsigned>(attachments_.size()); 60 } 61 62 bool MessageAttachmentSet::AddAttachment( 63 scoped_refptr<MessageAttachment> attachment, 64 size_t* index) { 65 #if defined(OS_POSIX) || defined(OS_FUCHSIA) 66 if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE && 67 num_descriptors() == kMaxDescriptorsPerMessage) { 68 DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full."; 69 return false; 70 } 71 #endif 72 73 switch (attachment->GetType()) { 74 case MessageAttachment::Type::PLATFORM_FILE: 75 case MessageAttachment::Type::MOJO_HANDLE: 76 case MessageAttachment::Type::WIN_HANDLE: 77 case MessageAttachment::Type::MACH_PORT: 78 case MessageAttachment::Type::FUCHSIA_HANDLE: 79 attachments_.push_back(attachment); 80 *index = attachments_.size() - 1; 81 return true; 82 } 83 return false; 84 } 85 86 bool MessageAttachmentSet::AddAttachment( 87 scoped_refptr<MessageAttachment> attachment) { 88 size_t index; 89 return AddAttachment(attachment, &index); 90 } 91 92 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt( 93 unsigned index) { 94 if (index >= size()) { 95 DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size(); 96 return scoped_refptr<MessageAttachment>(); 97 } 98 99 // We should always walk the descriptors in order, so it's reasonable to 100 // enforce this. Consider the case where a compromised renderer sends us 101 // the following message: 102 // 103 // ExampleMsg: 104 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m} 105 // 106 // Here the renderer sent us a message which should have a descriptor, but 107 // actually sent two in an attempt to fill our fd table and kill us. By 108 // setting the index of the descriptor in the message to 1 (it should be 109 // 0), we would record a highwater of 1 and then consider all the 110 // descriptors to have been used. 111 // 112 // So we can either track of the use of each descriptor in a bitset, or we 113 // can enforce that we walk the indexes strictly in order. 114 if (index == 0 && consumed_descriptor_highwater_ == size()) { 115 DLOG(WARNING) << "Attempted to double-read a message attachment, " 116 "returning a nullptr"; 117 } 118 119 if (index != consumed_descriptor_highwater_) 120 return scoped_refptr<MessageAttachment>(); 121 122 consumed_descriptor_highwater_ = index + 1; 123 124 return attachments_[index]; 125 } 126 127 void MessageAttachmentSet::CommitAllDescriptors() { 128 attachments_.clear(); 129 consumed_descriptor_highwater_ = 0; 130 } 131 132 } // namespace IPC 133