Home | History | Annotate | Download | only in ipc 
      1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "ipc/ipc_message_attachment_set.h"
      6 
      7 #include <stddef.h>
      8 
      9 #include <algorithm>
     10 
     11 #include "base/logging.h"
     12 #include "base/posix/eintr_wrapper.h"
     13 #include "build/build_config.h"
     14 #include "ipc/ipc_message_attachment.h"
     15 
     16 namespace IPC {
     17 
     18 namespace {
     19 
     20 unsigned count_attachments_of_type(
     21     const std::vector<scoped_refptr<MessageAttachment>>& attachments,
     22     MessageAttachment::Type type) {
     23   unsigned count = 0;
     24   for (const scoped_refptr<MessageAttachment>& attachment : attachments) {
     25     if (attachment->GetType() == type)
     26       ++count;
     27   }
     28   return count;
     29 }
     30 
     31 }  // namespace
     32 
     33 MessageAttachmentSet::MessageAttachmentSet()
     34     : consumed_descriptor_highwater_(0) {
     35 }
     36 
     37 MessageAttachmentSet::~MessageAttachmentSet() {
     38   if (consumed_descriptor_highwater_ == size())
     39     return;
     40 
     41   // We close all the owning descriptors. If this message should have
     42   // been transmitted, then closing those with close flags set mirrors
     43   // the expected behaviour.
     44   //
     45   // If this message was received with more descriptors than expected
     46   // (which could a DOS against the browser by a rogue renderer) then all
     47   // the descriptors have their close flag set and we free all the extra
     48   // kernel resources.
     49   LOG(WARNING) << "MessageAttachmentSet destroyed with unconsumed attachments: "
     50                << consumed_descriptor_highwater_ << "/" << size();
     51 }
     52 
     53 unsigned MessageAttachmentSet::num_descriptors() const {
     54   return count_attachments_of_type(attachments_,
     55                                    MessageAttachment::Type::PLATFORM_FILE);
     56 }
     57 
     58 unsigned MessageAttachmentSet::size() const {
     59   return static_cast<unsigned>(attachments_.size());
     60 }
     61 
     62 bool MessageAttachmentSet::AddAttachment(
     63     scoped_refptr<MessageAttachment> attachment,
     64     size_t* index) {
     65 #if defined(OS_POSIX) || defined(OS_FUCHSIA)
     66   if (attachment->GetType() == MessageAttachment::Type::PLATFORM_FILE &&
     67       num_descriptors() == kMaxDescriptorsPerMessage) {
     68     DLOG(WARNING) << "Cannot add file descriptor. MessageAttachmentSet full.";
     69     return false;
     70   }
     71 #endif
     72 
     73   switch (attachment->GetType()) {
     74     case MessageAttachment::Type::PLATFORM_FILE:
     75     case MessageAttachment::Type::MOJO_HANDLE:
     76     case MessageAttachment::Type::WIN_HANDLE:
     77     case MessageAttachment::Type::MACH_PORT:
     78     case MessageAttachment::Type::FUCHSIA_HANDLE:
     79       attachments_.push_back(attachment);
     80       *index = attachments_.size() - 1;
     81       return true;
     82   }
     83   return false;
     84 }
     85 
     86 bool MessageAttachmentSet::AddAttachment(
     87     scoped_refptr<MessageAttachment> attachment) {
     88   size_t index;
     89   return AddAttachment(attachment, &index);
     90 }
     91 
     92 scoped_refptr<MessageAttachment> MessageAttachmentSet::GetAttachmentAt(
     93     unsigned index) {
     94   if (index >= size()) {
     95     DLOG(WARNING) << "Accessing out of bound index:" << index << "/" << size();
     96     return scoped_refptr<MessageAttachment>();
     97   }
     98 
     99   // We should always walk the descriptors in order, so it's reasonable to
    100   // enforce this. Consider the case where a compromised renderer sends us
    101   // the following message:
    102   //
    103   //   ExampleMsg:
    104   //     num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
    105   //
    106   // Here the renderer sent us a message which should have a descriptor, but
    107   // actually sent two in an attempt to fill our fd table and kill us. By
    108   // setting the index of the descriptor in the message to 1 (it should be
    109   // 0), we would record a highwater of 1 and then consider all the
    110   // descriptors to have been used.
    111   //
    112   // So we can either track of the use of each descriptor in a bitset, or we
    113   // can enforce that we walk the indexes strictly in order.
    114   if (index == 0 && consumed_descriptor_highwater_ == size()) {
    115     DLOG(WARNING) << "Attempted to double-read a message attachment, "
    116                      "returning a nullptr";
    117   }
    118 
    119   if (index != consumed_descriptor_highwater_)
    120     return scoped_refptr<MessageAttachment>();
    121 
    122   consumed_descriptor_highwater_ = index + 1;
    123 
    124   return attachments_[index];
    125 }
    126 
    127 void MessageAttachmentSet::CommitAllDescriptors() {
    128   attachments_.clear();
    129   consumed_descriptor_highwater_ = 0;
    130 }
    131 
    132 }  // namespace IPC
    133