Limit Mojo messages recursion depth

mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl

Index: mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl
diff --git a/mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl b/mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl
index 374b0976b1831b66b13f96b0674ba0b07fd5a538..38dbde1e4aff90f6945d6171ee39512888709972 100644
--- a/mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl
+++ b/mojo/public/tools/bindings/generators/cpp_templates/struct_definition.tmpl
@@ -5,6 +5,15 @@
 bool {{class_name}}::Validate(
     const void* data,
     mojo::internal::ValidationContext* validation_context) {
+  mojo::internal::ValidationContext::ScopedDepthTracker depth_tracker(

[yzshen1, 2016/09/06 17:03:10]

This is not the only place: we need to consider things like:

EXAMPLE:
Union A {
  B b;
};

Struct B {
  A a;
};

EXAMPLE 2:
Struct A {
  array<array<array<A>>> a;
};

This will result in a 4-time deeper stack than we expect.


I think the best place to insert these checks is probably in validation_util.h:
- ValidateContainer
- ValidateStruct
- Validate{Inlined, NonInlined}Union

What do you think?

[tibell, 2016/09/07 05:41:20]

Done.

I was aware of this. The reason I didn't do it for unions etc is that an
attacker can only increase the recursion depth by a small constant factor,
dependent on the message definition rather than the runtime message, even if we
don't check unions/arrays/maps (unless unions can be recursive?). The limit
(100) times the stack frame size is still quite small compare to e.g. a O(1MB)
total stack size limit.

In either case, it's cleaner to do it everywhere and the functions you listed
above gives us a nice place to do so.

+      validation_context);
+  if (validation_context->ExceedsMaxDepth()) {
+    ReportValidationError(
+        validation_context,
+        mojo::internal::VALIDATION_ERROR_MAX_RECURSION_DEPTH);
+    return false;
+  }
+
   if (!data)
     return true;