Change UnixDomainSocket::RecvMsg to return ScopedVector<base::ScopedFD>

content/browser/renderer_host/sandbox_ipc_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/sandbox_ipc_linux.h"
 
 #include <fcntl.h>
 #include <fontconfig/fontconfig.h>
 #include <sys/poll.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 
 #include "base/command_line.h"
+#include "base/files/scoped_file.h"
 #include "base/linux_util.h"
+#include "base/memory/scoped_vector.h"
 #include "base/memory/shared_memory.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/posix/unix_domain_socket_linux.h"
 #include "base/process/launch.h"
 #include "base/strings/string_number_conversions.h"
 #include "content/common/font_config_ipc_linux.h"
 #include "content/common/sandbox_linux/sandbox_linux.h"
 #include "content/common/set_process_title.h"
 #include "content/public/common/content_switches.h"
 #include "ppapi/c/trusted/ppb_browser_font_trusted.h"
@@ skipping 154 matching lines @@
       _exit(0);
     }
 
     if (pfds[1].revents) {
       HandleRequestFromRenderer(browser_socket_);
     }
   }
 }
 
 void SandboxIPCProcess::HandleRequestFromRenderer(int fd) {
-  std::vector<int> fds;
+  ScopedVector<base::ScopedFD> fds;
 
   // A FontConfigIPC::METHOD_MATCH message could be kMaxFontFamilyLength
   // bytes long (this is the largest message type).
   // 128 bytes padding are necessary so recvmsg() does not return MSG_TRUNC
   // error for a maximum length message.
   char buf[FontConfigIPC::kMaxFontFamilyLength + 128];
 
   const ssize_t len = UnixDomainSocket::RecvMsg(fd, buf, sizeof(buf), &fds);
   if (len == -1) {
     // TODO: should send an error reply, or the sender might block forever.
     NOTREACHED() << "Sandbox host message is larger than kMaxFontFamilyLength";
     return;
   }
   if (fds.empty())
     return;
 
   Pickle pickle(buf, len);
   PickleIterator iter(pickle);
 
   int kind;
   if (!pickle.ReadInt(&iter, &kind))
-    goto error;
+    return;
 
   if (kind == FontConfigIPC::METHOD_MATCH) {
-    HandleFontMatchRequest(fd, pickle, iter, fds);
+    HandleFontMatchRequest(fd, pickle, iter, fds.get());
   } else if (kind == FontConfigIPC::METHOD_OPEN) {
-    HandleFontOpenRequest(fd, pickle, iter, fds);
+    HandleFontOpenRequest(fd, pickle, iter, fds.get());
   } else if (kind == LinuxSandbox::METHOD_GET_FONT_FAMILY_FOR_CHAR) {
-    HandleGetFontFamilyForChar(fd, pickle, iter, fds);
+    HandleGetFontFamilyForChar(fd, pickle, iter, fds.get());
   } else if (kind == LinuxSandbox::METHOD_LOCALTIME) {
-    HandleLocaltime(fd, pickle, iter, fds);
+    HandleLocaltime(fd, pickle, iter, fds.get());
   } else if (kind == LinuxSandbox::METHOD_GET_CHILD_WITH_INODE) {
-    HandleGetChildWithInode(fd, pickle, iter, fds);
+    HandleGetChildWithInode(fd, pickle, iter, fds.get());
   } else if (kind == LinuxSandbox::METHOD_GET_STYLE_FOR_STRIKE) {
-    HandleGetStyleForStrike(fd, pickle, iter, fds);
+    HandleGetStyleForStrike(fd, pickle, iter, fds.get());
   } else if (kind == LinuxSandbox::METHOD_MAKE_SHARED_MEMORY_SEGMENT) {
-    HandleMakeSharedMemorySegment(fd, pickle, iter, fds);
+    HandleMakeSharedMemorySegment(fd, pickle, iter, fds.get());
   } else if (kind == LinuxSandbox::METHOD_MATCH_WITH_FALLBACK) {
-    HandleMatchWithFallback(fd, pickle, iter, fds);
-  }
-
-error:
-  for (std::vector<int>::const_iterator i = fds.begin(); i != fds.end(); ++i) {
-    close(*i);
+    HandleMatchWithFallback(fd, pickle, iter, fds.get());
   }
 }
 
 int SandboxIPCProcess::FindOrAddPath(const SkString& path) {
   int count = paths_.count();
   for (int i = 0; i < count; ++i) {
     if (path == *paths_[i])
       return i;
   }
   *paths_.append() = new SkString(path);
   return count;
 }
 
-void SandboxIPCProcess::HandleFontMatchRequest(int fd,
-                                               const Pickle& pickle,
-                                               PickleIterator iter,
-                                               std::vector<int>& fds) {
+void SandboxIPCProcess::HandleFontMatchRequest(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   uint32_t requested_style;
   std::string family;
   if (!pickle.ReadString(&iter, &family) ||
       !pickle.ReadUInt32(&iter, &requested_style))
     return;
 
   SkFontConfigInterface::FontIdentity result_identity;
   SkString result_family;
   SkTypeface::Style result_style;
   SkFontConfigInterface* fc =
@@ skipping 15 matching lines @@
     result_identity.fID = static_cast<uint32_t>(index);
 
     reply.WriteBool(true);
     skia::WriteSkString(&reply, result_family);
     skia::WriteSkFontIdentity(&reply, result_identity);
     reply.WriteUInt32(result_style);
   }
   SendRendererReply(fds, reply, -1);
 }
 
-void SandboxIPCProcess::HandleFontOpenRequest(int fd,
-                                              const Pickle& pickle,
-                                              PickleIterator iter,
-                                              std::vector<int>& fds) {
+void SandboxIPCProcess::HandleFontOpenRequest(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   uint32_t index;
   if (!pickle.ReadUInt32(&iter, &index))
     return;
   if (index >= static_cast<uint32_t>(paths_.count()))
     return;
   const int result_fd = open(paths_[index]->c_str(), O_RDONLY);
 
   Pickle reply;
   if (result_fd == -1) {
     reply.WriteBool(false);
   } else {
     reply.WriteBool(true);
   }
 
   // The receiver will have its own access to the file, so we will close it
   // after this send.
   SendRendererReply(fds, reply, result_fd);
 
   if (result_fd >= 0) {
     int err = IGNORE_EINTR(close(result_fd));
     DCHECK(!err);
   }
 }
 
-void SandboxIPCProcess::HandleGetFontFamilyForChar(int fd,
-                                                   const Pickle& pickle,
-                                                   PickleIterator iter,
-                                                   std::vector<int>& fds) {
+void SandboxIPCProcess::HandleGetFontFamilyForChar(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   // The other side of this call is
   // chrome/renderer/renderer_sandbox_support_linux.cc
 
   EnsureWebKitInitialized();
   WebUChar32 c;
   if (!pickle.ReadInt(&iter, &c))
     return;
 
   std::string preferred_locale;
   if (!pickle.ReadString(&iter, &preferred_locale))
     return;
 
   blink::WebFontFamily family;
   WebFontInfo::familyForChar(c, preferred_locale.c_str(), &family);
 
   Pickle reply;
   if (family.name.data()) {
     reply.WriteString(family.name.data());
   } else {
     reply.WriteString(std::string());
   }
   reply.WriteBool(family.isBold);
   reply.WriteBool(family.isItalic);
   SendRendererReply(fds, reply, -1);
 }
 
-void SandboxIPCProcess::HandleGetStyleForStrike(int fd,
-                                                const Pickle& pickle,
-                                                PickleIterator iter,
-                                                std::vector<int>& fds) {
+void SandboxIPCProcess::HandleGetStyleForStrike(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   std::string family;
   int sizeAndStyle;
 
   if (!pickle.ReadString(&iter, &family) ||
       !pickle.ReadInt(&iter, &sizeAndStyle)) {
     return;
   }
 
   EnsureWebKitInitialized();
   blink::WebFontRenderStyle style;
   WebFontInfo::renderStyleForStrike(family.c_str(), sizeAndStyle, &style);
 
   Pickle reply;
   reply.WriteInt(style.useBitmaps);
   reply.WriteInt(style.useAutoHint);
   reply.WriteInt(style.useHinting);
   reply.WriteInt(style.hintStyle);
   reply.WriteInt(style.useAntiAlias);
   reply.WriteInt(style.useSubpixelRendering);
   reply.WriteInt(style.useSubpixelPositioning);
 
   SendRendererReply(fds, reply, -1);
 }
 
-void SandboxIPCProcess::HandleLocaltime(int fd,
-                                        const Pickle& pickle,
-                                        PickleIterator iter,
-                                        std::vector<int>& fds) {
+void SandboxIPCProcess::HandleLocaltime(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   // The other side of this call is in zygote_main_linux.cc
 
   std::string time_string;
   if (!pickle.ReadString(&iter, &time_string) ||
       time_string.size() != sizeof(time_t)) {
     return;
   }
 
   time_t time;
   memcpy(&time, time_string.data(), sizeof(time));
   // We use localtime here because we need the tm_zone field to be filled
   // out. Since we are a single-threaded process, this is safe.
   const struct tm* expanded_time = localtime(&time);
 
   std::string result_string;
   const char* time_zone_string = "";
   if (expanded_time != NULL) {
     result_string = std::string(reinterpret_cast<const char*>(expanded_time),
                                 sizeof(struct tm));
     time_zone_string = expanded_time->tm_zone;
   }
 
   Pickle reply;
   reply.WriteString(result_string);
   reply.WriteString(time_zone_string);
   SendRendererReply(fds, reply, -1);
 }
 
-void SandboxIPCProcess::HandleGetChildWithInode(int fd,
-                                                const Pickle& pickle,
-                                                PickleIterator iter,
-                                                std::vector<int>& fds) {
+void SandboxIPCProcess::HandleGetChildWithInode(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   // The other side of this call is in zygote_main_linux.cc
   if (sandbox_cmd_.empty()) {
     LOG(ERROR) << "Not in the sandbox, this should not be called";
     return;
   }
 
   uint64_t inode;
   if (!pickle.ReadUInt64(&iter, &inode))
     return;
 
@@ skipping 10 matching lines @@
     // Even though the pid is invalid, we still need to reply to the zygote
     // and not just return here.
     LOG(ERROR) << "Could not get pid";
   }
 
   Pickle reply;
   reply.WriteInt(pid);
   SendRendererReply(fds, reply, -1);
 }
 
-void SandboxIPCProcess::HandleMakeSharedMemorySegment(int fd,
-                                                      const Pickle& pickle,
-                                                      PickleIterator iter,
-                                                      std::vector<int>& fds) {
+void SandboxIPCProcess::HandleMakeSharedMemorySegment(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   base::SharedMemoryCreateOptions options;
   uint32_t size;
   if (!pickle.ReadUInt32(&iter, &size))
     return;
   options.size = size;
   if (!pickle.ReadBool(&iter, &options.executable))
     return;
   int shm_fd = -1;
   base::SharedMemory shm;
   if (shm.Create(options))
     shm_fd = shm.handle().fd;
   Pickle reply;
   SendRendererReply(fds, reply, shm_fd);
 }
 
-void SandboxIPCProcess::HandleMatchWithFallback(int fd,
-                                                const Pickle& pickle,
-                                                PickleIterator iter,
-                                                std::vector<int>& fds) {
+void SandboxIPCProcess::HandleMatchWithFallback(
+    int fd,
+    const Pickle& pickle,
+    PickleIterator iter,
+    const std::vector<base::ScopedFD*>& fds) {
   // Unlike the other calls, for which we are an indirection in front of
   // WebKit or Skia, this call is always made via this sandbox helper
   // process. Therefore the fontconfig code goes in here directly.
 
   std::string face;
   bool is_bold, is_italic;
   uint32 charset, fallback_family;
 
   if (!pickle.ReadString(&iter, &face) || face.empty() ||
       !pickle.ReadBool(&iter, &is_bold) ||
@@ skipping 135 matching lines @@
 
   Pickle reply;
   SendRendererReply(fds, reply, font_fd);
 
   if (font_fd >= 0) {
     if (IGNORE_EINTR(close(font_fd)) < 0)
       PLOG(ERROR) << "close";
   }
 }
 
-void SandboxIPCProcess::SendRendererReply(const std::vector<int>& fds,
-                                          const Pickle& reply,
-                                          int reply_fd) {
+void SandboxIPCProcess::SendRendererReply(
+    const std::vector<base::ScopedFD*>& fds,
+    const Pickle& reply,
+    int reply_fd) {
   struct msghdr msg;
   memset(&msg, 0, sizeof(msg));
   struct iovec iov = {const_cast<void*>(reply.data()), reply.size()};
   msg.msg_iov = &iov;
   msg.msg_iovlen = 1;
 
   char control_buffer[CMSG_SPACE(sizeof(int))];
 
   if (reply_fd != -1) {
     struct stat st;
     if (fstat(reply_fd, &st) == 0 && S_ISDIR(st.st_mode)) {
       LOG(FATAL) << "Tried to send a directory descriptor over sandbox IPC";
       // We must never send directory descriptors to a sandboxed process
       // because they can use openat with ".." elements in the path in order
       // to escape the sandbox and reach the real filesystem.
     }
 
     struct cmsghdr* cmsg;
     msg.msg_control = control_buffer;
     msg.msg_controllen = sizeof(control_buffer);
     cmsg = CMSG_FIRSTHDR(&msg);
     cmsg->cmsg_level = SOL_SOCKET;
     cmsg->cmsg_type = SCM_RIGHTS;
     cmsg->cmsg_len = CMSG_LEN(sizeof(int));
     memcpy(CMSG_DATA(cmsg), &reply_fd, sizeof(reply_fd));
     msg.msg_controllen = cmsg->cmsg_len;
   }
 
-  if (HANDLE_EINTR(sendmsg(fds[0], &msg, MSG_DONTWAIT)) < 0)
+  if (HANDLE_EINTR(sendmsg(fds[0]->get(), &msg, MSG_DONTWAIT)) < 0)
     PLOG(ERROR) << "sendmsg";
 }
 
 SandboxIPCProcess::~SandboxIPCProcess() {
   paths_.deleteAll();
   if (webkit_platform_support_)
     blink::shutdownWithoutV8();
 }
 
 void SandboxIPCProcess::EnsureWebKitInitialized() {
   if (webkit_platform_support_)
     return;
   webkit_platform_support_.reset(new BlinkPlatformImpl);
   blink::initializeWithoutV8(webkit_platform_support_.get());
 }
 
 }  // namespace content