Track which NativeViewIds each render process is allowed to interact with.

chrome/browser/renderer_host/resource_message_filter.cc

Index: chrome/browser/renderer_host/resource_message_filter.cc
===================================================================
--- chrome/browser/renderer_host/resource_message_filter.cc	(revision 14874)
+++ chrome/browser/renderer_host/resource_message_filter.cc	(working copy)
@@ -17,6 +17,7 @@
 #include "chrome/browser/profile.h"
 #include "chrome/browser/renderer_host/audio_renderer_host.h"
 #include "chrome/browser/renderer_host/browser_render_process_host.h"
+#include "chrome/browser/renderer_host/renderer_security_policy.h"
 #include "chrome/browser/renderer_host/render_widget_helper.h"
 #include "chrome/browser/spellchecker.h"
 #include "chrome/browser/worker_host/worker_service.h"
@@ -480,6 +481,12 @@
 #if !defined(OS_LINUX)
 void ResourceMessageFilter::OnGetScreenInfo(gfx::NativeViewId view,
                                             IPC::Message* reply_msg) {
+  RendererSecurityPolicy* policy = RendererSecurityPolicy::GetInstance();
+  if (!policy->HasNativeViewId(GetProcessId(), view)) {
+    NOTREACHED() << "Bad NativeViewId from render process.";
+    return;
+  }
+
   // TODO(darin): Change this into a routed message so that we can eliminate
   // the NativeViewId parameter.
   WebScreenInfo results =
@@ -680,6 +687,12 @@
                                             int cookie,
                                             int expected_pages_count,
                                             IPC::Message* reply_msg) {
+  RendererSecurityPolicy* policy = RendererSecurityPolicy::GetInstance();
+  if (!policy->HasNativeViewId(GetProcessId(), host_window_id)) {
+    NOTREACHED() << "Bad NativeViewId from render process.";
+    return;
+  }
+
   HWND host_window = gfx::NativeViewFromId(host_window_id);
 
   scoped_refptr<printing::PrinterQuery> printer_query;