Mojo cpp bindings: validation logic for incoming messages

mojo/public/cpp/bindings/lib/bounds_checker.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_BOUNDS_CHECKER_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_BOUNDS_CHECKER_H_
+
+#include <stdint.h>
+
+#include "mojo/public/cpp/system/macros.h"
+
+namespace mojo {
+
+class Handle;
+
+namespace internal {
+
+// BoundsChecker is used to validate object sizes, pointers and handle indices
+// for payload of incoming messages.
+class BoundsChecker {
+ public:
+  // [data, data + data_num_bytes) specifies the valid memory range.
+  // [0, num_handles) specifies the valid range of handle indices.
+  BoundsChecker(const void* data, uint32_t data_num_bytes,
+                size_t num_handles);
+
+  ~BoundsChecker();
+
+  // Claims the specified memory range.
+  // The method succeeds if the range is within the unclaimed range. (Please see
+  // the comments for IsWithinUnclaimedRange().)
+  bool ClaimMemory(const void* position, uint32_t num_bytes);
+
+  // Claims the specified encoded handle (which is basically a handle index).
+  // The method succeeds if:
+  // - |encoded_handle|'s value is |kEncodedInvalidHandleValue|, or
+  // - the handle is contained inside the valid range of handle indices, and
+  //   greater than the max handle index that has been claimed.
+  bool ClaimHandle(const Handle& encoded_handle);
+
+  // Returns true if:
+  // - the specified range is not empty, and
+  // - the range is contained inside the valid memory range, and
+  // - |position| is greater than the max address that has been claimed.
+  bool IsWithinUnclaimedRange(const void* position, uint32_t num_bytes) const;

[Tom Sepez, 2014/05/28 17:12:52]

nit: Looks like when this is used outside of tests, its in a "if (!...)" clause,
and there's an implied "not" in the term "unclaimed". Maybe inverting it to be 
IsWithinClaimedRange() gets rid of some double or triple negatives.   

[yzshen1, 2014/05/28 17:27:52]

One issue is that the opposite of "within unclaimed range" is not "within
claimed range": it could be:
- contained inside / overlapping the claimed range.
- not entirely contained inside the valid memory range (the range that we passed
into the constructor).

One nice thing about IsWithinUnclaimedRange() is that it is more consistent with
ClaimMemory(). (If a call to the former returns true, a call to the latter will
succeed.)

What do you think? Thanks!

+
+ private:
+  bool InternalIsWithinUnclaimedRange(uintptr_t begin, uintptr_t end) const;
+
+  // [unclaimed_data_begin_, data_end_) is the unclaimed memory range.
+  uintptr_t unclaimed_data_begin_;
+  uintptr_t data_end_;
+
+  // [unclaimed_handle_begin_, handle_end_) is the unclaimed handle index range.
+  uint32_t unclaimed_handle_begin_;
+  uint32_t handle_end_;
+
+  MOJO_DISALLOW_COPY_AND_ASSIGN(BoundsChecker);
+};
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_BOUNDS_CHECKER_H_