mac: Don’t leak send rights from ExceptionPorts::GetExceptionPorts()

tools/mac/exception_port_tool.cc

 // Copyright 2014 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 56 matching lines @@
   ~MachSendRightPool() {
     for (mach_port_t send_right : send_rights_) {
       kern_return_t kr = mach_port_deallocate(mach_task_self(), send_right);
       MACH_LOG_IF(ERROR, kr != KERN_SUCCESS, kr) << "mach_port_deallocate";
     }
   }
 
   //! \brief Adds a send right to the pool.
   //!
   //! \param[in] send_right The send right to be added. The pool object takes
-  //!     ownership of the send right, which remains valid until the pool object
-  //!     is destroyed.
+  //!     its own reference to the send right, which remains valid until the
+  //!     pool object is destroyed. The caller remains responsible for its
+  //!     reference to the send right.
   //!
   //! It is possible and in fact likely that one pool will wind up owning the
   //! same send right multiple times. This is acceptable, because send rights
   //! are reference-counted.
   void AddSendRight(mach_port_t send_right) {
+    kern_return_t kr = mach_port_mod_refs(mach_task_self(),
+                                          send_right,
+                                          MACH_PORT_RIGHT_SEND,
+                                          1);
+    MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_port_mod_refs";
+
     send_rights_.push_back(send_right);
   }
 
  private:
   std::vector<mach_port_t> send_rights_;
 
   DISALLOW_COPY_AND_ASSIGN(MachSendRightPool);
 };
 
 struct ExceptionHandlerDescription {
@@ skipping 87 matching lines @@
 // value, which can then be associated with handlers shown by
 // ShowExceptionPorts(). Any send rights obtained by this function are added to
 // |mach_send_right_pool|.
 void ShowBootstrapService(const std::string& service_name,
                           MachSendRightPool* mach_send_right_pool) {
   base::mac::ScopedMachSendRight service_port(BootstrapLookUp(service_name));
   if (service_port == kMachPortNull) {
     return;
   }
 
+  mach_send_right_pool->AddSendRight(service_port);
+
   printf("service %s %#x\n", service_name.c_str(), service_port.get());
-
-  mach_send_right_pool->AddSendRight(service_port.release());
 }
 
 // Prints information about all exception ports known for |exception_ports|. If
 // |numeric| is true, all information is printed in numeric form, otherwise, it
 // will be converted to symbolic constants where possible by
 // SymbolicConstantsMach. If |is_new| is true, information will be presented as
 // “new exception ports”, indicating that they show the state of the exception
 // ports after SetExceptionPort() has been called. Any send rights obtained by
 // this function are added to |mach_send_right_pool|.
 void ShowExceptionPorts(const ExceptionPorts& exception_ports,
                         bool numeric,
                         bool is_new,
                         MachSendRightPool* mach_send_right_pool) {
   const char* target_name = exception_ports.TargetTypeName();
 
-  std::vector<ExceptionPorts::ExceptionHandler> handlers;
+  ExceptionPorts::ExceptionHandlerVector handlers;
   if (!exception_ports.GetExceptionPorts(ExcMaskValid(), &handlers)) {
     return;
   }
 
   const char* age_name = is_new ? "new " : "";
 
-  if (handlers.size() == 0) {
+  if (handlers.empty()) {
     printf("no %s%s exception ports\n", age_name, target_name);
   }
 
   for (size_t port_index = 0; port_index < handlers.size(); ++port_index) {
     mach_send_right_pool->AddSendRight(handlers[port_index].port);
 
     if (numeric) {
       printf(
           "%s%s exception port %zu, mask %#x, port %#x, "
           "behavior %#x, flavor %u\n",
@@ skipping 348 matching lines @@
 
   return kExitSuccess;
 }
 
 }  // namespace
 }  // namespace crashpad
 
 int main(int argc, char* argv[]) {
   return crashpad::ExceptionPortToolMain(argc, argv);
 }