Mojo cpp bindings: validation logic for incoming messages

mojo/public/cpp/bindings/lib/bounds_checker.h

Index: mojo/public/cpp/bindings/lib/bounds_checker.h
diff --git a/mojo/public/cpp/bindings/lib/bounds_checker.h b/mojo/public/cpp/bindings/lib/bounds_checker.h
new file mode 100644
index 0000000000000000000000000000000000000000..7d296fd177ed545998eba57226efc4faaec64876
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/bounds_checker.h
@@ -0,0 +1,74 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_BOUNDS_CHECKER_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_BOUNDS_CHECKER_H_
+
+#include <stdint.h>
+
+#include <vector>
+
+#include "mojo/public/cpp/system/macros.h"
+
+namespace mojo {
+
+class Handle;
+
+namespace internal {
+
+// BoundsChecker is used to validate object sizes, pointers and handle indexes
+// for payload of incoming messages.
+class BoundsChecker {
+ public:
+  // [data, data_num_bytes) specifies the valid memory range.
+  // [0, num_handles) specifies the valid range of handle indexes.
+  BoundsChecker(const void* data, uint32_t data_num_bytes,
+                size_t num_handles);
+
+  ~BoundsChecker();
+
+  // Claims the specified memory range.
+  // The method fails if the range overlaps claimed ranges, or it is not
+  // contained inside the valid memory range, or it is of zero length.
+  bool ClaimMemory(const void* position, uint32_t num_bytes);
+
+  // Claims the specified encoded handle (which is basically a handle index).
+  // The method fails if the handle has already been claimed or it is outside
+  // of the valid range. The method succeeds if |encoded_handle|'s value is
+  // |kEncodedInvalidHandleValue|.
+  bool ClaimHandle(const Handle& encoded_handle);
+
+  // Returns true if the specified range is contained inside the valid memory
+  // range, no matter whether the range overlaps claimed ranges or not.
+  // The method returns false if the range is of zero length.
+  bool IsWithinBounds(const void* position, uint32_t num_bytes) const;
+
+  const std::vector<uintptr_t>& GetClaimedRangesForTesting() const;
+
+ private:
+  void InsertOrMergeClaimedRange(std::vector<uintptr_t>::iterator pos,
+                                 uintptr_t begin, uintptr_t end);
+
+  bool InternalIsWithinBounds(uintptr_t begin, uintptr_t end) const;
+
+  // The valid memory range is [data_begin_, data_end_).
+  uintptr_t data_begin_;
+  uintptr_t data_end_;
+
+  // This vector is sorted in increasing order, with an even number of elements.
+  // The (2*i)-th and (2*i+1)-th element form a claimed range:
+  // [claimed_ranges_[2*i], claimed_ranges_[2*i+1]).
+  // (Please note that |claimed_ranges_[2*i+1]| itself is not included in the
+  // range.)
+  std::vector<uintptr_t> claimed_ranges_;
+
+  std::vector<bool> claimed_handles_;
+
+  MOJO_DISALLOW_COPY_AND_ASSIGN(BoundsChecker);
+};
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_BOUNDS_CHECKER_H_