Add check on invalid file descriptor at both broker and renderer sides.

content/renderer/pepper_plugin_delegate_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper_plugin_delegate_impl.h"
 
 #include <cmath>
 #include <queue>
 
 #include "base/bind.h"
@@ skipping 345 matching lines @@
     : public webkit::ppapi::PluginDelegate::OutOfProcessProxy {
  public:
   HostDispatcherWrapper() {}
   virtual ~HostDispatcherWrapper() {}
 
   bool Init(base::ProcessHandle plugin_process_handle,
             const IPC::ChannelHandle& channel_handle,
             PP_Module pp_module,
             ppapi::proxy::Dispatcher::GetInterfaceFunc local_get_interface,
             const ppapi::Preferences& preferences) {
+    if (channel_handle.name.empty())
+      return false;
+
+#if defined(OS_POSIX)
+    if (channel_handle.socket.fd == -1)
+      return false;
+#endif
+
     dispatcher_delegate_.reset(new DispatcherDelegate);
     dispatcher_.reset(new ppapi::proxy::HostDispatcher(
         plugin_process_handle, pp_module, local_get_interface));
 
-    if (!dispatcher_->InitHostWithChannel(
-            dispatcher_delegate_.get(),
-            channel_handle, true, preferences)) {
+    if (!dispatcher_->InitHostWithChannel(dispatcher_delegate_.get(),
+                                          channel_handle,
+                                          true,  // Client.
+                                          preferences)) {
       dispatcher_.reset();
       dispatcher_delegate_.reset();
       return false;
     }
     dispatcher_->channel()->SetRestrictDispatchToSameChannel(true);
     return true;
   }
 
   // OutOfProcessProxy implementation.
   virtual const void* GetProxiedInterface(const char* name) {
@@ skipping 90 matching lines @@
 
 BrokerDispatcherWrapper::BrokerDispatcherWrapper() {
 }
 
 BrokerDispatcherWrapper::~BrokerDispatcherWrapper() {
 }
 
 bool BrokerDispatcherWrapper::Init(
     base::ProcessHandle broker_process_handle,
     const IPC::ChannelHandle& channel_handle) {
+  if (channel_handle.name.empty())
+    return false;
+
+#if defined(OS_POSIX)
+  if (channel_handle.socket.fd == -1)
+    return false;
+#endif
+
   dispatcher_delegate_.reset(new DispatcherDelegate);
   dispatcher_.reset(
       new ppapi::proxy::BrokerHostDispatcher(broker_process_handle));
 
   if (!dispatcher_->InitBrokerWithChannel(dispatcher_delegate_.get(),
                                           channel_handle,
-                                          true)) {
+                                          true)) {  // Client.
     dispatcher_.reset();
     dispatcher_delegate_.reset();
     return false;
   }
   dispatcher_->channel()->SetRestrictDispatchToSameChannel(true);
   return true;
 }
 
 // Does not take ownership of the local pipe.
 int32_t BrokerDispatcherWrapper::SendHandleToBroker(
@@ skipping 102 matching lines @@
   Release();
 }
 
 void PpapiBrokerImpl::OnBrokerChannelConnected(
     base::ProcessHandle broker_process_handle,
     const IPC::ChannelHandle& channel_handle) {
   scoped_ptr<BrokerDispatcherWrapper> dispatcher(new BrokerDispatcherWrapper);
   if (dispatcher->Init(broker_process_handle, channel_handle)) {
     dispatcher_.reset(dispatcher.release());
 
-    // Process all pending channel requests from the renderers.
+    // Process all pending channel requests from the plugins.
     for (ClientMap::iterator i = pending_connects_.begin();
          i != pending_connects_.end(); ++i) {
       base::WeakPtr<webkit::ppapi::PPB_Broker_Impl>& weak_ptr = i->second;
       if (weak_ptr)
         ConnectPluginToBroker(weak_ptr);
     }
   } else {
     // Report failure to all clients.
     for (ClientMap::iterator i = pending_connects_.begin();
          i != pending_connects_.end(); ++i) {
@@ skipping 1114 matching lines @@
   if (!context)
     return NULL;
   if (!context->makeContextCurrent() || context->isContextLost())
     return NULL;
 
   RendererGLContext* parent_context = context->context();
   if (!parent_context)
     return NULL;
   return parent_context;
 }