Verified Commit 629f8c06 authored by Nika Layzell's avatar Nika Layzell Committed by ma1
Browse files

Bug 1987977 - Add extra fd validation to ChannelPosix, r=ipc-reviewers,jld 

Every attached FD has a guaranteed 4 bytes of payload, so this check
should be redundant unless a message payload is manually constructed or
corrupted.

Differential Revision: https://phabricator.services.mozilla.com/D265038
parent 35a291da

ipc/chromium/src/chrome/common/ipc_channel_posix.cc

+6 −4
Original line number Diff line number Diff line
@@ -419,8 +419,9 @@ bool Channel::ChannelImpl::ProcessIncomingMessages() { 
          error = "Message needs unreceived descriptors";

        }



        if (m.header()->num_handles >

            IPC::Message::MAX_DESCRIPTORS_PER_MESSAGE) {

        size_t maxHandles = std::min<size_t>(

            m.size(), IPC::Message::MAX_DESCRIPTORS_PER_MESSAGE);

        if (m.header()->num_handles > maxHandles) {

          // There are too many descriptors in this message

          error = "Message requires an excessive number of descriptors";

        }
@@ -536,8 +537,9 @@ bool Channel::ChannelImpl::ProcessOutgoingMessages() { 
      }

#endif



      if (msg->attached_handles_.Length() >

          IPC::Message::MAX_DESCRIPTORS_PER_MESSAGE) {

      size_t maxHandles = std::min<size_t>(

          msg->size(), IPC::Message::MAX_DESCRIPTORS_PER_MESSAGE);

      if (msg->attached_handles_.Length() > maxHandles) {

        MOZ_DIAGNOSTIC_CRASH("Too many file descriptors!");

        CHROMIUM_LOG(FATAL) << "Too many file descriptors!";

        // This should not be reached.