Mojo: (Theoretically) implement the read side of platform handle passing.

mojo/system/transport_data.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/system/transport_data.h"
 
 #include <string.h>
 
 #include "base/compiler_specific.h"
 #include "base/logging.h"
@@ skipping 183 matching lines @@
 }
 
 TransportData::~TransportData() {
   if (platform_handles_) {
     for (size_t i = 0; i < platform_handles_->size(); i++)
       (*platform_handles_)[i].CloseIfNecessary();
   }
 }
 
 // static
-const char* TransportData::ValidateBuffer(const void* buffer,
-                                          size_t buffer_size) {
+const char* TransportData::ValidateBuffer(
+    size_t serialized_platform_handle_size,
+    const void* buffer,
+    size_t buffer_size) {
   DCHECK(buffer);
   DCHECK_GT(buffer_size, 0u);
 
   // Always make sure that the buffer size is sane; if it's not, someone's
   // messing with us.
   if (buffer_size < sizeof(Header) || buffer_size > kMaxBufferSize ||
       buffer_size % MessageInTransit::kMessageAlignment != 0)
     return "Invalid message secondary buffer size";
 
   const Header* header = static_cast<const Header*>(buffer);
   const size_t num_handles = header->num_handles;
   if (num_handles == 0)
     return "Message has no handles attached, but secondary buffer present";
 
   // Sanity-check |num_handles| (before multiplying it against anything).
   if (num_handles > kMaxMessageNumHandles)
     return "Message handle payload too large";
 
   if (buffer_size < sizeof(Header) + num_handles * sizeof(HandleTableEntry))
     return "Message secondary buffer too small";
 
-  // TODO(vtl): Check |platform_handle_table_offset| and |num_platform_handles|
-  // once they're used.
-  if (header->platform_handle_table_offset != 0 ||
-      header->num_platform_handles != 0)
-    return "Bad message secondary buffer header values";
+  if (header->num_platform_handles == 0) {
+    // Then |platform_handle_table_offset| should also be zero.
+    if (header->platform_handle_table_offset != 0) {
+      return
+          "Message has no handles attached, but platform handle table present";
+    }
+  } else {
+    // |num_handles| has already been validated, so the multiplication is okay.
+    if (header->num_platform_handles >
+            num_handles * kMaxSerializedDispatcherPlatformHandles)
+      return "Message has too many platform handles attached";
+
+    static const char kInvalidPlatformHandleTableOffset[] =
+        "Message has invalid platform handle table offset";
+    // This doesn't check that the platform handle table doesn't alias other
+    // stuff, but it doesn't matter, since it's all read-only.
+    if (header->platform_handle_table_offset %
+            MessageInTransit::kMessageAlignment != 0)
+      return kInvalidPlatformHandleTableOffset;
+
+    // ">" instead of ">=" since the size per handle may be zero.
+    if (header->platform_handle_table_offset > buffer_size)
+      return kInvalidPlatformHandleTableOffset;
+
+    // We already checked |platform_handle_table_offset| and
+    // |num_platform_handles|, so the addition and multiplication are okay.
+    if (header->platform_handle_table_offset +
+            header->num_platform_handles * serialized_platform_handle_size >
+            buffer_size)
+      return kInvalidPlatformHandleTableOffset;
+  }
 
   const HandleTableEntry* handle_table =
       reinterpret_cast<const HandleTableEntry*>(
           static_cast<const char*>(buffer) + sizeof(Header));
   static const char kInvalidSerializedDispatcher[] =
       "Message contains invalid serialized dispatcher";
   for (size_t i = 0; i < num_handles; i++) {
     size_t offset = handle_table[i].offset;
     if (offset % MessageInTransit::kMessageAlignment != 0)
       return kInvalidSerializedDispatcher;
 
     size_t size = handle_table[i].size;
     if (size > kMaxSerializedDispatcherSize || size > buffer_size)
       return kInvalidSerializedDispatcher;
 
     // Note: This is an overflow-safe check for |offset + size > buffer_size|
     // (we know that |size <= buffer_size| from the previous check).
     if (offset > buffer_size - size)
       return kInvalidSerializedDispatcher;
   }
 
   return NULL;
 }
 
 // static
+void TransportData::GetPlatformHandleTable(const void* transport_data_buffer,
+                                           size_t* num_platform_handles,
+                                           const void** platform_handle_table) {
+  DCHECK(transport_data_buffer);
+  DCHECK(num_platform_handles);
+  DCHECK(platform_handle_table);
+
+  const Header* header = static_cast<const Header*>(transport_data_buffer);
+  *num_platform_handles = header->num_platform_handles;
+  *platform_handle_table = static_cast<const char*>(transport_data_buffer) +
+      header->platform_handle_table_offset;
+}
+
+// static
 scoped_ptr<DispatcherVector> TransportData::DeserializeDispatchersFromBuffer(
     const void* buffer,
     size_t buffer_size,
     Channel* channel) {
   DCHECK(buffer);
   DCHECK_GT(buffer_size, 0u);
   DCHECK(channel);
 
   const Header* header = static_cast<const Header*>(buffer);
   const size_t num_handles = header->num_handles;
@@ skipping 13 matching lines @@
     const void* source = static_cast<const char*>(buffer) + offset;
     (*dispatchers)[i] = Dispatcher::TransportDataAccess::Deserialize(
         channel, handle_table[i].type, source, size);
   }
 
   return dispatchers.Pass();
 }
 
 }  // namespace system
 }  // namespace mojo