Add check on invalid file descriptor at both broker and renderer sides.

content/renderer/pepper_plugin_delegate_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper_plugin_delegate_impl.h"
 
 #include <cmath>
 #include <queue>
 
 #include "base/bind.h"
@@ skipping 462 matching lines @@
 
 BrokerDispatcherWrapper::BrokerDispatcherWrapper() {
 }
 
 BrokerDispatcherWrapper::~BrokerDispatcherWrapper() {
 }
 
 bool BrokerDispatcherWrapper::Init(
     base::ProcessHandle broker_process_handle,
     const IPC::ChannelHandle& channel_handle) {
+if (channel_handle.name.empty())
+    return false;
+
+#if defined(OS_POSIX)
+  if (channel_handle.socket.fd == -1)
+    return false;
+#endif
+
   dispatcher_delegate_.reset(new DispatcherDelegate);
   dispatcher_.reset(
       new ppapi::proxy::BrokerHostDispatcher(broker_process_handle));
 
   if (!dispatcher_->InitBrokerWithChannel(dispatcher_delegate_.get(),
                                           channel_handle,
-                                          true)) {
+                                          true)) { // is_client
     dispatcher_.reset();
     dispatcher_delegate_.reset();
     return false;
   }
   dispatcher_->channel()->SetRestrictDispatchToSameChannel(true);
   return true;
 }
 
 // Does not take ownership of the local pipe.
 int32_t BrokerDispatcherWrapper::SendHandleToBroker(
@@ skipping 102 matching lines @@
   Release();
 }
 
 void PpapiBrokerImpl::OnBrokerChannelConnected(
     base::ProcessHandle broker_process_handle,
     const IPC::ChannelHandle& channel_handle) {
   scoped_ptr<BrokerDispatcherWrapper> dispatcher(new BrokerDispatcherWrapper);
   if (dispatcher->Init(broker_process_handle, channel_handle)) {
     dispatcher_.reset(dispatcher.release());
 
     // Process all pending channel requests from the renderers.

[ddorwin, 2011/11/07 20:02:28]

Please change "renderers" to "plugins". It's my copy and paste mistake
(apparently from PpapiPluginProcessHost::OnChannelConnected()).

[xhwang, 2011/11/07 22:00:15]

Done.

     for (ClientMap::iterator i = pending_connects_.begin();
          i != pending_connects_.end(); ++i) {
       base::WeakPtr<webkit::ppapi::PPB_Broker_Impl>& weak_ptr = i->second;
       if (weak_ptr)
         ConnectPluginToBroker(weak_ptr);
     }
   } else {
     // Report failure to all clients.
     for (ClientMap::iterator i = pending_connects_.begin();
          i != pending_connects_.end(); ++i) {
@@ skipping 1114 matching lines @@
   if (!context)
     return NULL;
   if (!context->makeContextCurrent() || context->isContextLost())
     return NULL;
 
   RendererGLContext* parent_context = context->context();
   if (!parent_context)
     return NULL;
   return parent_context;
 }