Validate in-process plugin instance messages.

content/browser/renderer_host/pepper/pepper_renderer_connection.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/pepper/pepper_renderer_connection.h"
 
 #include <stddef.h>
 #include <stdint.h>
 #include <utility>
 
@@ skipping 214 matching lines @@
   // Note: All of the pending host IDs that were added as part of this
   // operation will automatically be sent to the plugin when |creator| is
   // released. This may happen immediately, or (if there are asynchronous
   // requests to create resource hosts), once all of them complete.
 }
 
 void PepperRendererConnection::OnMsgDidCreateInProcessInstance(
     PP_Instance instance,
     const PepperRendererInstanceData& instance_data) {
   PepperRendererInstanceData data = instance_data;
+  // It's important that we supply the render process ID ourselves since the
+  // message may be coming from a compromised renderer.
   data.render_process_id = render_process_id_;
+  // 'instance' is possibly invalid. The host must be careful not to trust it.
   in_process_host_->AddInstance(instance, data);
 }
 
 void PepperRendererConnection::OnMsgDidDeleteInProcessInstance(
     PP_Instance instance) {
+  // 'instance' is possibly invalid. The host must be careful not to trust it.
   in_process_host_->DeleteInstance(instance);
 }
 
 }  // namespace content