Make IPC::Channel buffers stack based and secure against growth

ipc/ipc_channel_posix.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef IPC_IPC_CHANNEL_POSIX_H_
 #define IPC_IPC_CHANNEL_POSIX_H_
 
 #include "ipc/ipc_channel.h"
 
 #include <sys/socket.h>  // for CMSG macros
@@ skipping 121 matching lines @@
   // Messages to be sent are queued here.
   std::queue<Message*> output_queue_;
 
   // We assume a worst case: kReadBufferSize bytes of messages, where each
   // message has no payload and a full complement of descriptors.
   static const size_t kMaxReadFDs =
       (Channel::kReadBufferSize / sizeof(IPC::Message::Header)) *
       MessageAttachmentSet::kMaxDescriptorsPerMessage;
 
   // Buffer size for file descriptors used for recvmsg. On Mac the CMSG macros
-  // don't seem to be constant so we have to pick a "large enough" value.
+  // are not constant so we have to pick a "large enough" padding for headers.
 #if defined(OS_MACOSX)
-  static const size_t kMaxReadFDBuffer = 1024;
+  static const size_t kMaxReadFDBuffer = 1024 + sizeof(int) * kMaxReadFDs;
 #else
   static const size_t kMaxReadFDBuffer = CMSG_SPACE(sizeof(int) * kMaxReadFDs);
 #endif
-
-  // Temporary buffer used to receive the file descriptors from recvmsg.
-  // Code that writes into this should immediately read them out and save
-  // them to input_fds_, since this buffer will be re-used anytime we call
-  // recvmsg.
-  char input_cmsg_buf_[kMaxReadFDBuffer];
+  static_assert(kMaxReadFDBuffer <= 8192,
+                "kMaxReadFDBuffer too big for a stack buffer");
 
   // File descriptors extracted from messages coming off of the channel. The
   // handles may span messages and come off different channels from the message
   // data (in the case of READWRITE), and are processed in FIFO here.
   // NOTE: The implementation assumes underlying storage here is contiguous, so
   // don't change to something like std::deque<> without changing the
   // implementation!
   std::vector<int> input_fds_;
 
 
@@ skipping 14 matching lines @@
   // If non-zero, overrides the process ID sent in the hello message.
   static int global_pid_;
 #endif  // OS_LINUX
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(ChannelPosix);
 };
 
 }  // namespace IPC
 
 #endif  // IPC_IPC_CHANNEL_POSIX_H_