Index: content/browser/renderer_host/render_message_filter.cc |
diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc |
index aa971df62b281432d35dba2dfc1ed9d3c4bce12a..46522c0059d557eacf4466d5959c68a39f8fa2b7 100644 |
--- a/content/browser/renderer_host/render_message_filter.cc |
+++ b/content/browser/renderer_host/render_message_filter.cc |
@@ -363,6 +363,10 @@ bool RenderMessageFilter::OnMessageReceived(const IPC::Message& message, |
OnOpenChannelToPlugin) |
IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_OpenChannelToPepperPlugin, |
OnOpenChannelToPepperPlugin) |
+ IPC_MESSAGE_HANDLER(ViewHostMsg_DidCreateOutOfProcessPepperInstance, |
+ OnDidCreateOutOfProcessPepperInstance) |
+ IPC_MESSAGE_HANDLER(ViewHostMsg_DidDeleteOutOfProcessPepperInstance, |
+ OnDidDeleteOutOfProcessPepperInstance) |
IPC_MESSAGE_HANDLER(ViewHostMsg_OpenChannelToPpapiBroker, |
OnOpenChannelToPpapiBroker) |
IPC_MESSAGE_HANDLER_GENERIC(ViewHostMsg_UpdateRect, |
@@ -675,6 +679,27 @@ void RenderMessageFilter::OnOpenChannelToPepperPlugin( |
this, resource_context_, reply_msg)); |
} |
+void RenderMessageFilter::OnDidCreateOutOfProcessPepperInstance( |
+ int plugin_child_id, |
+ int32 pp_instance, |
+ int render_view_id) { |
+ // It's important that we supply the render process ID ourselves based on the |
+ // channel the message arrived on. We use the |
+ // PP_Instance -> (process id, view id) |
+ // mapping to decide how to handle messages received from the (untrusted) |
+ // plugin, so an exploited renderer must not be able to insert fake mappings |
+ // that may allow it access to other render processes. |
+ PpapiPluginProcessHost::DidCreateOutOfProcessInstance( |
+ plugin_child_id, pp_instance, render_process_id_, render_view_id); |
+} |
+ |
+void RenderMessageFilter::OnDidDeleteOutOfProcessPepperInstance( |
+ int plugin_child_id, |
+ int32 pp_instance) { |
+ PpapiPluginProcessHost::DidDeleteOutOfProcessInstance( |
+ plugin_child_id, pp_instance); |
+} |
+ |
void RenderMessageFilter::OnOpenChannelToPpapiBroker(int routing_id, |
int request_id, |
const FilePath& path) { |