Track which NativeViewIds each render process is allowed to interact with.

chrome/browser/renderer_host/resource_message_filter_win.cc

Index: chrome/browser/renderer_host/resource_message_filter_win.cc
===================================================================
--- chrome/browser/renderer_host/resource_message_filter_win.cc	(revision 14874)
+++ chrome/browser/renderer_host/resource_message_filter_win.cc	(working copy)
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/resource_message_filter.h"
+#include "chrome/browser/renderer_host/renderer_security_policy.h"
 #include "chrome/common/render_messages.h"
 
 // We get null window_ids passed into the two functions below; please see
@@ -10,6 +11,12 @@
 
 void ResourceMessageFilter::OnGetWindowRect(gfx::NativeViewId window_id,
                                             IPC::Message* reply_msg) {
+  RendererSecurityPolicy* policy = RendererSecurityPolicy::GetInstance();
+  if (!policy->HasNativeViewId(GetProcessId(), window_id)) {
+    NOTREACHED() << "Bad NativeViewId from render process.";
+    return;
+  }
+
   HWND window = gfx::NativeViewFromId(window_id);
   RECT window_rect = {0};
   GetWindowRect(window, &window_rect);
@@ -21,6 +28,12 @@
 
 void ResourceMessageFilter::OnGetRootWindowRect(gfx::NativeViewId window_id,
                                                 IPC::Message* reply_msg) {
+  RendererSecurityPolicy* policy = RendererSecurityPolicy::GetInstance();
+  if (!policy->HasNativeViewId(GetProcessId(), window_id)) {
+    NOTREACHED() << "Bad NativeViewId from render process.";
+    return;
+  }
+
   HWND window = gfx::NativeViewFromId(window_id);
   RECT window_rect = {0};
   HWND root_window = ::GetAncestor(window, GA_ROOT);