1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "ipc/ipc_message_attachment_set.h"
7 #include "base/logging.h"
8 #include "base/posix/eintr_wrapper.h"
11 #include <sys/types.h>
18 MessageAttachmentSet::MessageAttachmentSet()
19 : consumed_descriptor_highwater_(0) {
22 MessageAttachmentSet::~MessageAttachmentSet() {
23 if (consumed_descriptor_highwater_
== size())
26 // We close all the owning descriptors. If this message should have
27 // been transmitted, then closing those with close flags set mirrors
28 // the expected behaviour.
30 // If this message was received with more descriptors than expected
31 // (which could a DOS against the browser by a rogue renderer) then all
32 // the descriptors have their close flag set and we free all the extra
34 LOG(WARNING
) << "MessageAttachmentSet destroyed with unconsumed descriptors: "
35 << consumed_descriptor_highwater_
<< "/" << size();
38 unsigned MessageAttachmentSet::size() const {
40 return descriptors_
.size();
48 bool MessageAttachmentSet::AddToBorrow(base::PlatformFile fd
) {
49 DCHECK_EQ(consumed_descriptor_highwater_
, 0u);
51 if (size() == kMaxDescriptorsPerMessage
) {
52 DLOG(WARNING
) << "Cannot add file descriptor. MessageAttachmentSet full.";
56 descriptors_
.push_back(fd
);
60 bool MessageAttachmentSet::AddToOwn(base::ScopedFD fd
) {
61 DCHECK_EQ(consumed_descriptor_highwater_
, 0u);
63 if (size() == kMaxDescriptorsPerMessage
) {
64 DLOG(WARNING
) << "Cannot add file descriptor. MessageAttachmentSet full.";
68 descriptors_
.push_back(fd
.get());
69 owned_descriptors_
.push_back(new base::ScopedFD(fd
.Pass()));
70 DCHECK(size() <= kMaxDescriptorsPerMessage
);
74 base::PlatformFile
MessageAttachmentSet::TakeDescriptorAt(unsigned index
) {
75 if (index
>= size()) {
76 DLOG(WARNING
) << "Accessing out of bound index:" << index
<< "/" << size();
80 // We should always walk the descriptors in order, so it's reasonable to
81 // enforce this. Consider the case where a compromised renderer sends us
82 // the following message:
85 // num_fds:2 msg:FD(index = 1) control:SCM_RIGHTS {n, m}
87 // Here the renderer sent us a message which should have a descriptor, but
88 // actually sent two in an attempt to fill our fd table and kill us. By
89 // setting the index of the descriptor in the message to 1 (it should be
90 // 0), we would record a highwater of 1 and then consider all the
91 // descriptors to have been used.
93 // So we can either track of the use of each descriptor in a bitset, or we
94 // can enforce that we walk the indexes strictly in order.
96 // There's one more wrinkle: When logging messages, we may reparse them. So
97 // we have an exception: When the consumed_descriptor_highwater_ is at the
98 // end of the array and index 0 is requested, we reset the highwater value.
99 // TODO(morrita): This is absurd. This "wringle" disallow to introduce clearer
100 // ownership model. Only client is NaclIPCAdapter. See crbug.com/415294
101 if (index
== 0 && consumed_descriptor_highwater_
== descriptors_
.size())
102 consumed_descriptor_highwater_
= 0;
104 if (index
!= consumed_descriptor_highwater_
)
107 consumed_descriptor_highwater_
= index
+ 1;
109 base::PlatformFile file
= descriptors_
[index
];
111 // TODO(morrita): In production, descriptors_.size() should be same as
112 // owned_descriptors_.size() as all read descriptors are owned by Message.
113 // We have to do this because unit test breaks this assumption. It should be
114 // changed to exercise with own-able descriptors.
115 for (ScopedVector
<base::ScopedFD
>::const_iterator i
=
116 owned_descriptors_
.begin();
117 i
!= owned_descriptors_
.end(); ++i
) {
118 if ((*i
)->get() == file
) {
119 ignore_result((*i
)->release());
127 void MessageAttachmentSet::PeekDescriptors(base::PlatformFile
* buffer
) const {
128 std::copy(descriptors_
.begin(), descriptors_
.end(), buffer
);
131 bool MessageAttachmentSet::ContainsDirectoryDescriptor() const {
134 for (std::vector
<base::PlatformFile
>::const_iterator i
= descriptors_
.begin();
135 i
!= descriptors_
.end(); ++i
) {
136 if (fstat(*i
, &st
) == 0 && S_ISDIR(st
.st_mode
))
143 void MessageAttachmentSet::CommitAll() {
144 descriptors_
.clear();
145 owned_descriptors_
.clear();
146 consumed_descriptor_highwater_
= 0;
149 void MessageAttachmentSet::ReleaseFDsToClose(
150 std::vector
<base::PlatformFile
>* fds
) {
151 for (ScopedVector
<base::ScopedFD
>::iterator i
= owned_descriptors_
.begin();
152 i
!= owned_descriptors_
.end(); ++i
) {
153 fds
->push_back((*i
)->release());
159 void MessageAttachmentSet::AddDescriptorsToOwn(const base::PlatformFile
* buffer
,
161 DCHECK(count
<= kMaxDescriptorsPerMessage
);
162 DCHECK_EQ(size(), 0u);
163 DCHECK_EQ(consumed_descriptor_highwater_
, 0u);
165 descriptors_
.reserve(count
);
166 owned_descriptors_
.reserve(count
);
167 for (unsigned i
= 0; i
< count
; ++i
) {
168 descriptors_
.push_back(buffer
[i
]);
169 owned_descriptors_
.push_back(new base::ScopedFD(buffer
[i
]));