I'm investigating how to make the IPC transfer a bit more secure on the

src/core/SkOrderedReadBuffer.cpp

 
 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
@@ skipping 270 matching lines @@
         factory = fFactoryArray[index];
     } else if (fFactoryTDArray) {
         int32_t index = fReader.readU32();
         if (0 == index) {
             return NULL; // writer failed to give us the flattenable
         }
         index -= 1;     // we stored the index-base-1
         factory = (*fFactoryTDArray)[index];
     } else {
         factory = (SkFlattenable::Factory)readFunctionPtr();
-        if (NULL == factory) {
-            return NULL; // writer failed to give us the flattenable
+        if (NULL == factory || NULL == SkFlattenable::FactoryToName(factory)) {

[sugoi, 2013/08/16 20:58:46]

I quickly realized that using SkFlattenable::FactoryToName() wasn't going to
work since not all flattenable objects use the Registrar interface, but I think
we need some way of not simply reading and calling a function pointer, for
security reasons.

+            return NULL; // writer failed to give us a valid factory
         }
     }
 

[sugoi, 2013/08/13 15:20:26]

At this point, if possible, I'd like to be able to reset the factory to NULL if
the factory isn't of the right "type". For example, this function could have
some sort of mask or filter as input which only allows certain factory functions
to be used. That may be overkill, but why read objects if we know we're going to
discard them later ?

     // if we get here, factory may still be null, but if that is the case, the
     // failure was ours, not the writer.
     SkFlattenable* obj = NULL;
     uint32_t sizeRecorded = fReader.readU32();
     if (factory) {
         uint32_t offset = fReader.offset();
         obj = (*factory)(*this);
         // check that we read the amount we expected
         uint32_t sizeRead = fReader.offset() - offset;
         if (sizeRecorded != sizeRead) {
             // we could try to fix up the offset...
             sk_throw();
         }
     } else {
         // we must skip the remaining data
         fReader.skip(sizeRecorded);
     }
     return obj;
 }