Prevent ProcessProxy from passing bad fds to ProcessOutputWatcher

chromeos/process_proxy/process_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/process_proxy/process_proxy.h"
 
 #include <stdlib.h>
 #include <sys/ioctl.h>
 
 #include "base/bind.h"
@@ skipping 52 matching lines @@
   }
   return process_launched_;
 }
 
 bool ProcessProxy::StartWatchingOnThread(
     base::Thread* watch_thread,
     const ProcessOutputCallback& callback) {
   DCHECK(process_launched_);
   if (watcher_started_)
     return false;
-  if (pipe(shutdown_pipe_))
+  if (pipe(shutdown_pipe_) ||
+      !ProcessOutputWatcher::VerifyFileDescriptor(
+          shutdown_pipe_[PIPE_END_READ])) {
     return false;
+  }
 
   // We give ProcessOutputWatcher a copy of master to make life easier during
   // tear down.
   // TODO(tbarzic): improve fd managment.
   int master_copy = HANDLE_EINTR(dup(pt_pair_[PT_MASTER_FD]));
-  if (master_copy == -1)
+  if (!ProcessOutputWatcher::VerifyFileDescriptor(master_copy))
     return false;
 
   callback_set_ = true;
   callback_ = callback;
   callback_runner_ = base::MessageLoopProxy::current();
 
   // This object will delete itself once watching is stopped.
   // It also takes ownership of the passed fds.
   ProcessOutputWatcher* output_watcher =
       new ProcessOutputWatcher(master_copy,
@@ skipping 171 matching lines @@
   ClearFdPair(pt_pair_);
   ClearFdPair(shutdown_pipe_);
 }
 
 void ProcessProxy::ClearFdPair(int* pipe) {
   pipe[PIPE_END_READ] = kInvalidFd;
   pipe[PIPE_END_WRITE] = kInvalidFd;
 }
 
 }  // namespace chromeos