RDH: Block a compromised renderer from reusing request ids

content/browser/loader/resource_dispatcher_host_impl.cc

Index: content/browser/loader/resource_dispatcher_host_impl.cc
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index d671e2b715abefdc166efd1417e480ffc84f137b..6591b88d6dee64f223a9882c57d7078c36fd104f 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc
@@ -1052,6 +1052,10 @@ void ResourceDispatcherHostImpl::DidFinishLoading(ResourceLoader* loader) {
   RemovePendingRequest(info->GetChildID(), info->GetRequestID());
 }
 
+void ResourceDispatcherHostImpl::LoaderDestroyed(ResourceLoader* loader) {
+  request_ids_in_use_.erase(loader->GetRequestInfo()->GetGlobalRequestID());
+}
+
 void ResourceDispatcherHostImpl::OnInit() {
   scheduler_.reset(new ResourceScheduler);
 }
@@ -1254,6 +1258,14 @@ void ResourceDispatcherHostImpl::BeginRequest(
   int process_type = filter_->process_type();
   int child_id = filter_->child_id();
 
+  // Reject request id that's currently in use.
+  if (request_ids_in_use_.count(GlobalRequestID(child_id, request_id))) {
+    bad_message::ReceivedBadMessage(
+        filter_,
+        bad_message::RDH_INVALID_REQUEST_ID);
+    return;
+  }
+
   // PlzNavigate: reject invalid renderer main resource request.
   if (IsBrowserSideNavigationEnabled() &&
       IsResourceTypeFrame(request_data.resource_type) &&
@@ -2291,6 +2303,8 @@ void ResourceDispatcherHostImpl::BeginRequestInternal(
   linked_ptr<ResourceLoader> loader(
       new ResourceLoader(std::move(request), std::move(handler), this));
 
+  request_ids_in_use_.insert(info->GetGlobalRequestID());
+
   GlobalRoutingID id(info->GetGlobalRoutingID());
   BlockedLoadersMap::const_iterator iter = blocked_loaders_map_.find(id);
   if (iter != blocked_loaders_map_.end()) {