NaCl: Stop sending resource FDs with NaClProcessMsg_Start

components/nacl/browser/nacl_host_message_filter.cc

Index: components/nacl/browser/nacl_host_message_filter.cc
diff --git a/components/nacl/browser/nacl_host_message_filter.cc b/components/nacl/browser/nacl_host_message_filter.cc
index 2090e10263e20709192e88e7a4ce189b21dc0b9b..75d4558eb9ee56ab00cb727fa30e2a33af5b9ea1 100644
--- a/components/nacl/browser/nacl_host_message_filter.cc
+++ b/components/nacl/browser/nacl_host_message_filter.cc
@@ -14,7 +14,6 @@
 #include "content/public/browser/plugin_service.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
-#include "ipc/ipc_message_attachment_set.h"
 #include "ipc/ipc_platform_file.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
@@ -25,19 +24,6 @@ namespace nacl {
 
 namespace {
 
-// The maximum number of resource file handles NaClProcessMsg_Start message
-// can have. Currently IPC::MessageAttachmentSet::kMaxDescriptorsPerMessage
-// is 7 and NaCl sends 5 handles for other purposes, hence 2.
-// TODO(yusukes): Remove |kMaxPreOpenResourceFiles|. Instead, send an arbitrary
-// number of FDs to the NaCl loader process with separate IPC messages.
-const size_t kMaxPreOpenResourceFiles = 2;
-
-#if defined(OS_POSIX)
-static_assert(kMaxPreOpenResourceFiles ==
-              IPC::MessageAttachmentSet::kMaxDescriptorsPerMessage - 5,
-              "kMaxPreOpenResourceFiles is not up to date");
-#endif
-
 ppapi::PpapiPermissions GetNaClPermissions(
     uint32 permission_bits,
     content::BrowserContext* browser_context,
@@ -230,9 +216,6 @@ void NaClHostMessageFilter::BatchOpenResourceFiles(
         IPC::TakeFileHandleForProcess(file.Pass(), PeerHandle()),
         file_path_metadata,
         request_list[i].file_key));
-
-    if (prefetched_resource_files.size() >= kMaxPreOpenResourceFiles)

[Mark Seaborn, 2015/05/08 00:35:36]

I think it would be prudent to keep some limit on the number of FDs/handles, as
a sanity check.  Otherwise, untrusted code could attempt to prefetch hundreds or
thousands of files, which would definitely exhaust the FD/handle table, which
could expose error handling bugs.

Especially because you're open()ing all the files and then Send()ing them,
rather than open()ing and Send()ing each file in turn.

[Yusuke Sato, 2015/05/08 15:12:34]

Done.

-      break;
   }
 
   content::BrowserThread::PostTask(