Implement off-the-wire validation scheme for enum types.

ipc/ipc_message_macros.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Defining IPC Messages
 //
 // Your IPC messages will be defined by macros inside of an XXX_messages.h
 // header file.  Most of the time, the system can automatically generate all
 // of messaging mechanism from these definitions, but sometimes some manual
 // coding is required.  In these cases, you will also have an XXX_messages.cc
@@ skipping 124 matching lines @@
 // Externally-defined structs are registered with IPC_STRUCT_TRAITS_BEGIN(),
 // IPC_STRUCT_TRAITS_MEMBER(), and IPC_STRUCT_TRAITS_END() macros. These
 // cause registration of the types with message generation only.
 // There's also IPC_STRUCT_TRAITS_PARENT, which is used to register a parent
 // class (whose own traits are already defined). Note that
 // IPC_STRUCT_TRAITS_MEMBER() and IPC_STRUCT_TRAITS_PARENT are only permitted
 // inside matching calls to IPC_STRUCT_TRAITS_BEGIN() /
 // IPC_STRUCT_TRAITS_END().
 //
 // Enum types are registered with a single IPC_ENUM_TRAITS() macro.  There
-// is no need to enumerate each value to the IPC mechanism.
+// is no need to enumerate each value to the IPC mechanism. By default, enums
+// are not range-checked when they are read from the wire, and callers must
+// not trust values received from less privileged processes. In order for
+// IPC to perform validaion, enum authors must provide a specialization for

[aedla, 2013/05/31 08:35:15]

nit: 'validaion' typo

+// the function template declared in base/enum_validator.h. If such a
+// specialization exists for the enum type, then IPC will reject messages
+// that fail this validation. For example:
+//
+//     #include "base/enum_validator.h"
+//     enum Color { RED, GREEN, BLUE };
+//     template <> inline bool IsIntValidForEnum<Color>(int x) {
+//       return x >= RED && x <= BLUE;
+//     }
 //
 // Do not place semicolons following these IPC_ macro invocations.  There
 // is no reason to expect that their expansion corresponds one-to-one with
 // C++ statements.
 //
 // Once the types have been declared / registered, message definitions follow.
 // "Sync" messages are just synchronous calls, the Send() call doesn't return
 // until a reply comes back.  To declare a sync message, use the IPC_SYNC_
 // macros.  The numbers at the end show how many input/output parameters there
 // are (i.e. 1_2 is 1 in, 2 out).  Input parameters are first, followed by
@@ skipping 838 matching lines @@
 // This corresponds to an enum value from IPCMessageStart.
 #define IPC_MESSAGE_CLASS(message) \
   IPC_MESSAGE_ID_CLASS(message.type())
 
 #endif  // IPC_IPC_MESSAGE_MACROS_H_
 
 // Clean up IPC_MESSAGE_START in this unguarded section so that the
 // XXX_messages.h files need not do so themselves.  This makes the
 // XXX_messages.h files easier to write.
 #undef IPC_MESSAGE_START