RDH: Block a compromised renderer from reusing request ids

content/browser/loader/resource_dispatcher_host_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This is the browser side of the resource dispatcher, it receives requests
 // from the child process (i.e. [Renderer, Plugin, Worker]ProcessHost), and
 // dispatches them to URLRequests. It then forwards the messages from the
 // URLRequests back to the correct process for handling.
 //
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
@@ skipping 404 matching lines @@
                                       int route_id,
                                       bool cancel_requests);
 
   void OnRequestResource(int routing_id,
                          int request_id,
                          const ResourceHostMsg_Request& request_data);
   void OnSyncLoad(int request_id,
                   const ResourceHostMsg_Request& request_data,
                   IPC::Message* sync_result);
 
+  bool IsRequestIDInUse(const GlobalRequestID& id) const;
+
   // Update the ResourceRequestInfo and internal maps when a request is
   // transferred from one process to another.
   void UpdateRequestForTransfer(int child_id,
                                 int route_id,
                                 int request_id,
                                 const ResourceHostMsg_Request& request_data,
                                 LoaderMap::iterator iter);
 
   void BeginRequest(int request_id,
                     const ResourceHostMsg_Request& request_data,
@@ skipping 163 matching lines @@
   DelegateMap delegate_map_;
 
   scoped_ptr<ResourceScheduler> scheduler_;
 
   DISALLOW_COPY_AND_ASSIGN(ResourceDispatcherHostImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_LOADER_RESOURCE_DISPATCHER_HOST_IMPL_H_