Make IPC::Channel buffers stack based and secure against growth

ipc/ipc_channel_posix.cc

Index: ipc/ipc_channel_posix.cc
diff --git a/ipc/ipc_channel_posix.cc b/ipc/ipc_channel_posix.cc
index aac7e795257a4f0933e3ede563b5b989eedd01cd..6d8fdec70bef757e289a437f6b997c18d1be2f70 100644
--- a/ipc/ipc_channel_posix.cc
+++ b/ipc/ipc_channel_posix.cc
@@ -192,7 +192,6 @@ ChannelPosix::ChannelPosix(const IPC::ChannelHandle& channel_handle,
       pipe_name_(channel_handle.name),
       in_dtor_(false),
       must_unlink_(false) {
-  memset(input_cmsg_buf_, 0, sizeof(input_cmsg_buf_));
   if (!CreatePipe(channel_handle)) {
     // The pipe may have been closed already.
     const char *modestr = (mode_ & MODE_SERVER_FLAG) ? "server" : "client";
@@ -824,7 +823,8 @@ ChannelPosix::ReadState ChannelPosix::ReadData(
   msg.msg_iov = &iov;
   msg.msg_iovlen = 1;
 
-  msg.msg_control = input_cmsg_buf_;
+  char input_cmsg_buf[kMaxReadFDBuffer];
+  msg.msg_control = input_cmsg_buf;
 
   // recvmsg() returns 0 if the connection has closed or EAGAIN if no data
   // is waiting on the pipe.
@@ -835,7 +835,7 @@ ChannelPosix::ReadState ChannelPosix::ReadData(
   } else
 #endif  // IPC_USES_READWRITE
   {
-    msg.msg_controllen = sizeof(input_cmsg_buf_);
+    msg.msg_controllen = sizeof(input_cmsg_buf);
     *bytes_read = HANDLE_EINTR(recvmsg(pipe_.get(), &msg, MSG_DONTWAIT));
   }
   if (*bytes_read < 0) {
@@ -876,8 +876,9 @@ bool ChannelPosix::ReadFileDescriptorsFromFDPipe() {
   struct msghdr msg = { 0 };
   msg.msg_iov = &fd_pipe_iov;
   msg.msg_iovlen = 1;
-  msg.msg_control = input_cmsg_buf_;
-  msg.msg_controllen = sizeof(input_cmsg_buf_);
+  char input_cmsg_buf[kMaxReadFDBuffer];
+  msg.msg_control = input_cmsg_buf;
+  msg.msg_controllen = sizeof(input_cmsg_buf);
   ssize_t bytes_received =
       HANDLE_EINTR(recvmsg(fd_pipe_.get(), &msg, MSG_DONTWAIT));