[mojo-edk] Add some buffer checks and fix UAF on NodeChannel

mojo/edk/system/node_channel.cc

Index: mojo/edk/system/node_channel.cc
diff --git a/mojo/edk/system/node_channel.cc b/mojo/edk/system/node_channel.cc
index d60a2ab3b8f3a11b0198d98c25061d19e00f3ce8..7a0fbb9373c621ad573f807046144c28bba80ca4 100644
--- a/mojo/edk/system/node_channel.cc
+++ b/mojo/edk/system/node_channel.cc
@@ -395,6 +395,11 @@ void NodeChannel::OnChannelMessage(const void* payload,
 
   RequestContext request_context(RequestContext::Source::SYSTEM);
 
+  // Ensure this NodeChannel stays alive through the extent of this method. The
+  // delegate may have the only other reference to this object and it may choose
+  // to drop it here in response to, e.g., a malformed message.
+  scoped_refptr<NodeChannel> keepalive = this;
+
 #if defined(OS_WIN)
   // If we receive handles from a known process, rewrite them to our own
   // process. This can occur when a privileged node receives handles directly
@@ -684,6 +689,9 @@ void NodeChannel::ProcessPendingMessagesWithMachPorts() {
     }
   }
 
+  // Ensure this NodeChannel stays alive while flushing relay messages.
+  scoped_refptr<NodeChannel> keepalive = this;
+
   while (!pending_relays.empty()) {
     ports::NodeName destination = pending_relays.front().first;
     Channel::MessagePtr message = std::move(pending_relays.front().second);