Do not double-unref send rights when using POLICY_SUBSTITUE_PORT.

sandbox/mac/bootstrap_sandbox_unittest.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/bootstrap_sandbox.h"
 
 #include <CoreFoundation/CoreFoundation.h>
 #import <Foundation/Foundation.h>
 #include <mach/mach.h>
 #include <servers/bootstrap.h>
@@ skipping 207 matching lines @@
   char buf[32];
 };
 
 struct SubstitutePortAckRecv : public SubstitutePortAckSend {
   mach_msg_trailer_t trailer;
 };
 
 const char kSubstituteAck[] = "Hello, this is doge!";
 
 TEST_F(BootstrapSandboxTest, PolicySubstitutePort) {
+  mach_port_t task = mach_task_self();
+
   mach_port_t port;
-  ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(mach_task_self(),
-      MACH_PORT_RIGHT_RECEIVE, &port));
+  ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE,
+      &port));
   base::mac::ScopedMachReceiveRight scoped_port(port);
 
+  mach_port_urefs_t send_rights = 0;
+  ASSERT_EQ(KERN_SUCCESS, mach_port_get_refs(task, port, MACH_PORT_RIGHT_SEND,
+      &send_rights));
+  EXPECT_EQ(0u, send_rights);
+
+  ASSERT_EQ(KERN_SUCCESS, mach_port_insert_right(task, port, port,
+      MACH_MSG_TYPE_MAKE_SEND));
+  base::mac::ScopedMachSendRight scoped_port_send(port);
+
+  send_rights = 0;
+  ASSERT_EQ(KERN_SUCCESS, mach_port_get_refs(task, port, MACH_PORT_RIGHT_SEND,
+      &send_rights));
+  EXPECT_EQ(1u, send_rights);
+
   BootstrapSandboxPolicy policy(BaselinePolicy());
   policy[kTestServer] = Rule(port);
   sandbox_->RegisterSandboxPolicy(1, policy);
 
   RunChildWithPolicy(1, "PolicySubstitutePort", NULL);
 
   struct SubstitutePortAckRecv msg;
   bzero(&msg, sizeof(msg));
   msg.header.msgh_size = sizeof(msg);
   msg.header.msgh_local_port = port;
   kern_return_t kr = mach_msg(&msg.header, MACH_RCV_MSG, 0,
       msg.header.msgh_size, port,
       TestTimeouts::tiny_timeout().InMilliseconds(), MACH_PORT_NULL);
   EXPECT_EQ(KERN_SUCCESS, kr);
 
+  send_rights = 0;
+  ASSERT_EQ(KERN_SUCCESS, mach_port_get_refs(task, port, MACH_PORT_RIGHT_SEND,
+      &send_rights));
+  EXPECT_EQ(1u, send_rights);
+
   EXPECT_EQ(0, strncmp(kSubstituteAck, msg.buf, sizeof(msg.buf)));
 }
 
 MULTIPROCESS_TEST_MAIN(PolicySubstitutePort) {
   mach_port_t port = MACH_PORT_NULL;
   kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, &port);
   CHECK_EQ(KERN_SUCCESS, kr);
   CHECK(port != MACH_PORT_NULL);
 
   struct SubstitutePortAckSend msg;
@@ skipping 50 matching lines @@
   EXPECT_EQ(KERN_SUCCESS, bootstrap_look_up(bp, service_name, &service_port));
   base::mac::ScopedMachSendRight scoped_service_port(service_port);
 
   send_rights = 0;
   ASSERT_EQ(KERN_SUCCESS, mach_port_get_refs(task, port, MACH_PORT_RIGHT_SEND,
       &send_rights));
   EXPECT_EQ(2u, send_rights);
 }
 
 }  // namespace sandbox