[mojo-edk] Add some buffer checks and fix UAF on NodeChannel

mojo/edk/system/node_channel.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/node_channel.h"
 
 #include <cstring>
 #include <limits>
 #include <sstream>
 
@@ skipping 377 matching lines @@
   ShutDown();
 }
 
 void NodeChannel::OnChannelMessage(const void* payload,
                                    size_t payload_size,
                                    ScopedPlatformHandleVectorPtr handles) {
   DCHECK(io_task_runner_->RunsTasksOnCurrentThread());
 
   RequestContext request_context(RequestContext::Source::SYSTEM);
 
+  // Ensure this NodeChannel stays alive through the extent of this method. The
+  // delegate may have the only other reference to this object and it may choose
+  // to drop it here in response to, e.g., a malformed message.
+  scoped_refptr<NodeChannel> keepalive = this;
+
 #if defined(OS_WIN)
   // If we receive handles from a known process, rewrite them to our own
   // process. This can occur when a privileged node receives handles directly
   // from a privileged descendant.
   {
     base::AutoLock lock(remote_process_handle_lock_);
     if (handles && remote_process_handle_ != base::kNullProcessHandle) {
       // Note that we explicitly mark the handles as being owned by the sending
       // process before rewriting them, in order to accommodate RewriteHandles'
       // internal sanity checks.
@@ skipping 269 matching lines @@
 
     base::AutoLock lock(channel_lock_);
     if (!channel_) {
       DLOG(ERROR) << "Dropping message on closed channel.";
       break;
     } else {
       channel_->Write(std::move(message));
     }
   }
 
+  // Ensure this NodeChannel stays alive while flushing relay messages.
+  scoped_refptr<NodeChannel> keepalive = this;
+
   while (!pending_relays.empty()) {
     ports::NodeName destination = pending_relays.front().first;
     Channel::MessagePtr message = std::move(pending_relays.front().second);
     pending_relays.pop();
     delegate_->OnRelayPortsMessage(remote_node_name_, remote_process_handle,
                                    destination, std::move(message));
   }
 }
 #endif
 
@@ skipping 58 matching lines @@
 
   base::AutoLock lock(channel_lock_);
   if (!channel_)
     DLOG(ERROR) << "Dropping message on closed channel.";
   else
     channel_->Write(std::move(message));
 }
 
 }  // namespace edk
 }  // namespace mojo