[mojo-edk] Better validation of untrusted message data

mojo/edk/system/channel.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MOJO_EDK_SYSTEM_CHANNEL_H_
 #define MOJO_EDK_SYSTEM_CHANNEL_H_
 
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ skipping 229 matching lines @@
   bool OnReadComplete(size_t bytes_read, size_t* next_read_size_hint);
 
   // Called by the implementation when something goes horribly wrong. It is NOT
   // OK to call this synchronously from any public interface methods.
   void OnError();
 
   // Retrieves the set of platform handles read for a given message.
   // |extra_header| and |extra_header_size| correspond to the extra header data.
   // Depending on the Channel implementation, this body may encode platform
   // handles, or handles may be stored and managed elsewhere by the
-  // implementation.  If |num_handles| handles cannot be returned, this must
-  // return null.
-  virtual ScopedPlatformHandleVectorPtr GetReadPlatformHandles(
+  // implementation.
+  //
+  // Returns |false| on unrecoverable error (i.e. the Channel should be closed).
+  // Returns |true| otherwise. Note that it is possible on some platforms for an
+  // insufficient number of handles to be available when this call is made, but
+  // this is not necessarily an error condition. In such cases this returns
+  // |true| but |*handles| will also be reset to null.
+  virtual bool GetReadPlatformHandles(
       size_t num_handles,
       const void* extra_header,
-      size_t extra_header_size) = 0;
+      size_t extra_header_size,
+      ScopedPlatformHandleVectorPtr* handles) = 0;
 
-  virtual void OnControlMessage(Message::Header::MessageType message_type,
+  // Handles a received control message. Returns |true| if the message is
+  // accepted, or |false| otherwise.
+  virtual bool OnControlMessage(Message::Header::MessageType message_type,
                                 const void* payload,
                                 size_t payload_size,
-                                ScopedPlatformHandleVectorPtr handles) {}
+                                ScopedPlatformHandleVectorPtr handles);
 
  private:
   friend class base::RefCountedThreadSafe<Channel>;
 
   class ReadBuffer;
 
   Delegate* delegate_;
   const std::unique_ptr<ReadBuffer> read_buffer_;
 
   DISALLOW_COPY_AND_ASSIGN(Channel);
 };
 
 }  // namespace edk
 }  // namespace mojo
 
 #endif  // MOJO_EDK_SYSTEM_CHANNEL_H_