RDH: Block a compromised renderer from reusing request ids

content/browser/bad_message.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_BAD_MESSAGE_H_
 #define CONTENT_BROWSER_BAD_MESSAGE_H_
 
 namespace content {
 class BrowserMessageFilter;
 class RenderProcessHost;
@@ skipping 108 matching lines @@
   RDH_ILLEGAL_ORIGIN = 95,
   RDH_UNAUTHORIZED_HEADER_REQUEST = 96,
   RDH_INVALID_URL = 97,
   BDH_CHARACTERISTIC_ALREADY_SUBSCRIBED = 98,
   RFH_OWNER_PROPERTY = 99,
   BDH_EMPTY_OR_INVALID_FILTERS = 100,
   WC_CONTENT_WITH_CERT_ERRORS_BAD_SECURITY_INFO = 101,
   RFMF_RENDERER_FAKED_ITS_OWN_DEATH = 102,
   DWNLD_INVALID_SAVABLE_RESOURCE_LINKS_RESPONSE = 103,
   DWNLD_INVALID_SERIALIZE_AS_MHTML_RESPONSE = 104,
+  RDH_INVALID_REQUEST_ID = 105,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
   // reason. After making changes, you MUST update histograms.xml by running:
   // "python tools/metrics/histograms/update_bad_message_reasons.py"
   BAD_MESSAGE_MAX
 };
 
 // Called when the browser receives a bad IPC message from a renderer process on
 // the UI thread. Logs the event, records a histogram metric for the |reason|,
 // and terminates the process for |host|.
 void ReceivedBadMessage(RenderProcessHost* host, BadMessageReason reason);
 
 // Called when a browser message filter receives a bad IPC message from a
 // renderer or other child process. Logs the event, records a histogram metric
 // for the |reason|, and terminates the process for |filter|.
 void ReceivedBadMessage(BrowserMessageFilter* filter, BadMessageReason reason);
 
 }  // namespace bad_message
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_BAD_MESSAGE_H_