POSIX: Clean up DescriptorSet

chrome/common/ipc_channel_posix.cc

 // Copyright (c) 2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/ipc_channel_posix.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stddef.h>
 #include <sys/types.h>
@@ skipping 465 matching lines @@
       memcpy(&input_overflow_fds_[prev_size], wire_fds,
              num_wire_fds * sizeof(int));
       fds = &input_overflow_fds_[0];
       num_fds = input_overflow_fds_.size();
     }
 
     while (p < end) {
       const char* message_tail = Message::FindNext(p, end);
       if (message_tail) {
         int len = static_cast<int>(message_tail - p);
-        const Message m(p, len);
+        Message m(p, len);
         if (m.header()->num_fds) {
           // the message has file descriptors
+          const char* error = NULL;
           if (m.header()->num_fds > num_fds - fds_i) {
             // the message has been completely received, but we didn't get
             // enough file descriptors.
-            LOG(WARNING) << "Message needs unreceived descriptors"
+            error = "Message needs unreceived descriptors";
+          }
+
+          if (m.header()->num_fds >
+              DescriptorSet::MAX_DESCRIPTORS_PER_MESSAGE) {
+            // There are too many descriptors in this message
+            error = "Message requires an excessive number of descriptors";
+          }
+
+          if (error) {
+            LOG(WARNING) << error
                          << " channel:" << this
                          << " message-type:" << m.type()
                          << " header()->num_fds:" << m.header()->num_fds
                          << " num_fds:" << num_fds
                          << " fds_i:" << fds_i;
             // close the existing file descriptors so that we don't leak them
             for (unsigned i = fds_i; i < num_fds; ++i)
               close(fds[i]);
             input_overflow_fds_.clear();
+            // abort the connection
             return false;
           }
 
           m.descriptor_set()->SetDescriptors(&fds[fds_i], m.header()->num_fds);
           fds_i += m.header()->num_fds;
         }
 #ifdef IPC_MESSAGE_DEBUG_EXTRA
         DLOG(INFO) << "received message on channel @" << this <<
                       " with type " << m.type();
 #endif
@@ skipping 279 matching lines @@
 void Channel::GetClientFileDescriptorMapping(int *src_fd, int *dest_fd) {
   return channel_impl_->GetClientFileDescriptorMapping(src_fd, dest_fd);
 }
 
 void Channel::OnClientConnected() {
   return channel_impl_->OnClientConnected();
 }
 
 
 }  // namespace IPC