Add check on invalid file descriptor at both broker and renderer sides.

content/renderer/pepper_plugin_delegate_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper_plugin_delegate_impl.h"
 
 #include <cmath>
 #include <queue>
 
 #include "base/bind.h"
@@ skipping 462 matching lines @@
 
 BrokerDispatcherWrapper::BrokerDispatcherWrapper() {
 }
 
 BrokerDispatcherWrapper::~BrokerDispatcherWrapper() {
 }
 
 bool BrokerDispatcherWrapper::Init(
     base::ProcessHandle broker_process_handle,
     const IPC::ChannelHandle& channel_handle) {
+if (channel_handle.name.empty())

[ddorwin, 2011/11/04 23:10:03]

We also need to make these checks in all
PpapiPluginProcessHost::Client::OnChannelOpened() implementations if they are
not already there.

[xhwang, 2011/11/07 22:00:14]

Done.

+    return false;
+
+#if defined(OS_POSIX)
+  if (channel_handle.socket.fd == -1)
+    return false;
+#endif
+
   dispatcher_delegate_.reset(new DispatcherDelegate);
   dispatcher_.reset(
       new ppapi::proxy::BrokerHostDispatcher(broker_process_handle));
 
   if (!dispatcher_->InitBrokerWithChannel(dispatcher_delegate_.get(),
                                           channel_handle,
-                                          true)) {
+                                          true)) { // is_client
     dispatcher_.reset();
     dispatcher_delegate_.reset();
     return false;
   }
   dispatcher_->channel()->SetRestrictDispatchToSameChannel(true);
   return true;
 }
 
 // Does not take ownership of the local pipe.
 int32_t BrokerDispatcherWrapper::SendHandleToBroker(
@@ skipping 1237 matching lines @@
   if (!context)
     return NULL;
   if (!context->makeContextCurrent() || context->isContextLost())
     return NULL;
 
   RendererGLContext* parent_context = context->context();
   if (!parent_context)
     return NULL;
   return parent_context;
 }