content/common/child_process_sandbox_support_impl_linux.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/common/child_process_sandbox_support_impl_linux.h"
   6
   7 #include <sys/stat.h>
   8
   9 #include "base/debug/trace_event.h"
  10 #include "base/memory/scoped_ptr.h"
  11 #include "base/numerics/safe_conversions.h"
  12 #include "base/pickle.h"
  13 #include "base/posix/eintr_wrapper.h"
  14 #include "base/posix/unix_domain_socket_linux.h"
  15 #include "base/sys_byteorder.h"
  16 #include "content/common/sandbox_linux/sandbox_linux.h"
  17 #include "content/common/zygote_commands_linux.h"
  18 #include "third_party/WebKit/public/platform/linux/WebFontFamily.h"
  19 #include "third_party/WebKit/public/platform/linux/WebFontRenderStyle.h"
  20
  21 namespace content {
  22
  23 void GetFontFamilyForCharacter(int32_t character,
  24                                const char* preferred_locale,
  25                                blink::WebFontFamily* family) {
  26   TRACE_EVENT0("sandbox_ipc", "GetFontFamilyForCharacter");
  27
  28   Pickle request;
  29   request.WriteInt(LinuxSandbox::METHOD_GET_FONT_FAMILY_FOR_CHAR);
  30   request.WriteInt(character);
  31   request.WriteString(preferred_locale);
  32
  33   uint8_t buf[512];
  34   const ssize_t n = UnixDomainSocket::SendRecvMsg(GetSandboxFD(), buf,
  35                                                   sizeof(buf), NULL, request);
  36
  37   std::string family_name;
  38   bool isBold = false;
  39   bool isItalic = false;
  40   if (n != -1) {
  41     Pickle reply(reinterpret_cast<char*>(buf), n);
  42     PickleIterator pickle_iter(reply);
  43     if (reply.ReadString(&pickle_iter, &family_name) &&
  44         reply.ReadBool(&pickle_iter, &isBold) &&
  45         reply.ReadBool(&pickle_iter, &isItalic)) {
  46       family->name = family_name;
  47       family->isBold = isBold;
  48       family->isItalic = isItalic;
  49     }
  50   }
  51 }
  52
  53 void GetRenderStyleForStrike(const char* family, int sizeAndStyle,
  54                              blink::WebFontRenderStyle* out) {
  55   TRACE_EVENT0("sandbox_ipc", "GetRenderStyleForStrike");
  56
  57   Pickle request;
  58   request.WriteInt(LinuxSandbox::METHOD_GET_STYLE_FOR_STRIKE);
  59   request.WriteString(family);
  60   request.WriteInt(sizeAndStyle);
  61
  62   uint8_t buf[512];
  63   const ssize_t n = UnixDomainSocket::SendRecvMsg(GetSandboxFD(), buf,
  64                                                   sizeof(buf), NULL, request);
  65
  66   out->setDefaults();
  67   if (n == -1) {
  68     return;
  69   }
  70
  71   Pickle reply(reinterpret_cast<char*>(buf), n);
  72   PickleIterator pickle_iter(reply);
  73   int useBitmaps, useAutoHint, useHinting, hintStyle, useAntiAlias;
  74   int useSubpixelRendering, useSubpixelPositioning;
  75   if (reply.ReadInt(&pickle_iter, &useBitmaps) &&
  76       reply.ReadInt(&pickle_iter, &useAutoHint) &&
  77       reply.ReadInt(&pickle_iter, &useHinting) &&
  78       reply.ReadInt(&pickle_iter, &hintStyle) &&
  79       reply.ReadInt(&pickle_iter, &useAntiAlias) &&
  80       reply.ReadInt(&pickle_iter, &useSubpixelRendering) &&
  81       reply.ReadInt(&pickle_iter, &useSubpixelPositioning)) {
  82     out->useBitmaps = useBitmaps;
  83     out->useAutoHint = useAutoHint;
  84     out->useHinting = useHinting;
  85     out->hintStyle = hintStyle;
  86     out->useAntiAlias = useAntiAlias;
  87     out->useSubpixelRendering = useSubpixelRendering;
  88     out->useSubpixelPositioning = useSubpixelPositioning;
  89   }
  90 }
  91
  92 int MatchFontWithFallback(const std::string& face,
  93                           bool bold,
  94                           bool italic,
  95                           int charset,
  96                           PP_BrowserFont_Trusted_Family fallback_family) {
  97   TRACE_EVENT0("sandbox_ipc", "MatchFontWithFallback");
  98
  99   Pickle request;
 100   request.WriteInt(LinuxSandbox::METHOD_MATCH_WITH_FALLBACK);
 101   request.WriteString(face);
 102   request.WriteBool(bold);
 103   request.WriteBool(italic);
 104   request.WriteUInt32(charset);
 105   request.WriteUInt32(fallback_family);
 106   uint8_t reply_buf[64];
 107   int fd = -1;
 108   UnixDomainSocket::SendRecvMsg(GetSandboxFD(), reply_buf, sizeof(reply_buf),
 109                                 &fd, request);
 110   return fd;
 111 }
 112
 113 bool GetFontTable(int fd, uint32_t table_tag, off_t offset,
 114                   uint8_t* output, size_t* output_length) {
 115   if (offset < 0)
 116     return false;
 117
 118   size_t data_length = 0;  // the length of the file data.
 119   off_t data_offset = 0;   // the offset of the data in the file.
 120   if (table_tag == 0) {
 121     // Get the entire font file.
 122     struct stat st;
 123     if (fstat(fd, &st) < 0)
 124       return false;
 125     data_length = base::checked_cast<size_t>(st.st_size);
 126   } else {
 127     // Get a font table. Read the header to find its offset in the file.
 128     uint16_t num_tables;
 129     ssize_t n = HANDLE_EINTR(pread(fd, &num_tables, sizeof(num_tables),
 130                              4 /* skip the font type */));
 131     if (n != sizeof(num_tables))
 132       return false;
 133     // Font data is stored in net (big-endian) order.
 134     num_tables = base::NetToHost16(num_tables);
 135
 136     // Read the table directory.
 137     static const size_t kTableEntrySize = 16;
 138     const size_t directory_size = num_tables * kTableEntrySize;
 139     scoped_ptr<uint8_t[]> table_entries(new uint8_t[directory_size]);
 140     n = HANDLE_EINTR(pread(fd, table_entries.get(), directory_size,
 141                            12 /* skip the SFNT header */));
 142     if (n != base::checked_cast<ssize_t>(directory_size))
 143       return false;
 144
 145     for (uint16_t i = 0; i < num_tables; ++i) {
 146       uint8_t* entry = table_entries.get() + i * kTableEntrySize;
 147       uint32_t tag = *reinterpret_cast<uint32_t*>(entry);
 148       if (tag == table_tag) {
 149         // Font data is stored in net (big-endian) order.
 150         data_offset =
 151             base::NetToHost32(*reinterpret_cast<uint32_t*>(entry + 8));
 152         data_length =
 153             base::NetToHost32(*reinterpret_cast<uint32_t*>(entry + 12));
 154         break;
 155       }
 156     }
 157   }
 158
 159   if (!data_length)
 160     return false;
 161   // Clamp |offset| inside the allowable range. This allows the read to succeed
 162   // but return 0 bytes.
 163   offset = std::min(offset, base::checked_cast<off_t>(data_length));
 164   // Make sure it's safe to add the data offset and the caller's logical offset.
 165   // Define the maximum positive offset on 32 bit systems.
 166   static const off_t kMaxPositiveOffset32 = 0x7FFFFFFF;  // 2 GB - 1.
 167   if ((offset > kMaxPositiveOffset32 / 2) ||
 168       (data_offset > kMaxPositiveOffset32 / 2))
 169     return false;
 170   data_offset += offset;
 171   data_length -= offset;
 172
 173   if (output) {
 174     // 'output_length' holds the maximum amount of data the caller can accept.
 175     data_length = std::min(data_length, *output_length);
 176     ssize_t n = HANDLE_EINTR(pread(fd, output, data_length, data_offset));
 177     if (n != base::checked_cast<ssize_t>(data_length))
 178       return false;
 179   }
 180   *output_length = data_length;
 181
 182   return true;
 183 }
 184
 185 bool SendZygoteChildPing(int fd) {
 186   return UnixDomainSocket::SendMsg(fd,
 187                                    kZygoteChildPingMessage,
 188                                    sizeof(kZygoteChildPingMessage),
 189                                    std::vector<int>());
 190 }
 191
 192 }  // namespace content