Attempt to fix a NULL deref in sandbox::LaunchdInterceptionServer::HandleLookUp().

sandbox/mac/launchd_interception_server.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/launchd_interception_server.h"
 
 #include <servers/bootstrap.h>
 
 #include "base/logging.h"
 #include "base/mac/mach_logging.h"
@@ skipping 37 matching lines @@
 
   message_server_.reset(new MachMessageServer(this, kBufferSize));
   return message_server_->Initialize();
 }
 
 void LaunchdInterceptionServer::DemuxMessage(mach_msg_header_t* request,
                                              mach_msg_header_t* reply) {
   VLOG(3) << "Incoming message #" << request->msgh_id;
 
   pid_t sender_pid = message_server_->GetMessageSenderPID(request);
-  if (sandbox_->PolicyForProcess(sender_pid) == NULL) {
+  const BootstrapSandboxPolicy* policy =
+      sandbox_->PolicyForProcess(sender_pid);
+  if (policy == NULL) {
     // No sandbox policy is in place for the sender of this message, which
     // means it is from the sandbox host process or an unsandboxed child.
     VLOG(3) << "Message from pid " << sender_pid << " forwarded to launchd";
     ForwardMessage(request);
     return;
   }
 
   if (request->msgh_id == compat_shim_.msg_id_look_up2) {
     // Filter messages sent via bootstrap_look_up to enforce the sandbox policy
     // over the bootstrap namespace.
-    HandleLookUp(request, reply, sender_pid);
+    HandleLookUp(request, reply, policy);
   } else if (request->msgh_id == compat_shim_.msg_id_swap_integer) {
     // Ensure that any vproc_swap_integer requests are safe.
-    HandleSwapInteger(request, reply, sender_pid);
+    HandleSwapInteger(request, reply);
   } else {
     // All other messages are not permitted.
     VLOG(1) << "Rejecting unhandled message #" << request->msgh_id;
     message_server_->RejectMessage(reply, MIG_REMOTE_ERROR);
   }
 }
 
-void LaunchdInterceptionServer::HandleLookUp(mach_msg_header_t* request,
-                                             mach_msg_header_t* reply,
-                                             pid_t sender_pid) {
+void LaunchdInterceptionServer::HandleLookUp(
+    mach_msg_header_t* request,
+    mach_msg_header_t* reply,
+    const BootstrapSandboxPolicy* policy) {
   const std::string request_service_name(
       compat_shim_.look_up2_get_request_name(request));
   VLOG(2) << "Incoming look_up2 request for " << request_service_name;
 
-  // Find the Rule for this service. If one is not found, use
-  // a safe default, POLICY_DENY_ERROR.
-  const BootstrapSandboxPolicy* policy = sandbox_->PolicyForProcess(sender_pid);
+  // Find the Rule for this service. If a named rule is not found, use the
+  // default specified by the policy.
   const BootstrapSandboxPolicy::NamedRules::const_iterator it =
       policy->rules.find(request_service_name);
   Rule rule(policy->default_rule);
   if (it != policy->rules.end())
     rule = it->second;
 
   if (rule.result == POLICY_ALLOW) {
     // This service is explicitly allowed, so this message will not be
     // intercepted by the sandbox.
     VLOG(1) << "Permitting and forwarding look_up2: " << request_service_name;
@@ skipping 24 matching lines @@
     // above-inserted right has been moved out of the process, and destroying
     // the message will unref yet another right.
     if (message_server_->SendReply(reply))
       compat_shim_.look_up2_fill_reply(reply, MACH_PORT_NULL);
   } else {
     NOTREACHED();
   }
 }
 
 void LaunchdInterceptionServer::HandleSwapInteger(mach_msg_header_t* request,
-                                                  mach_msg_header_t* reply,
-                                                  pid_t sender_pid) {
+                                                  mach_msg_header_t* reply) {
   // Only allow getting information out of launchd. Do not allow setting
   // values. Two commonly observed values that are retrieved are
   // VPROC_GSK_MGR_PID and VPROC_GSK_TRANSACTIONS_ENABLED.
   if (compat_shim_.swap_integer_is_get_only(request)) {
     VLOG(2) << "Forwarding vproc swap_integer message.";
     ForwardMessage(request);
   } else {
     VLOG(2) << "Rejecting non-read-only swap_integer message.";
     message_server_->RejectMessage(reply, BOOTSTRAP_NOT_PRIVILEGED);
   }
 }
 void LaunchdInterceptionServer::ForwardMessage(mach_msg_header_t* request) {
   message_server_->ForwardMessage(request, sandbox_->real_bootstrap_port());
 }
 
 }  // namespace sandbox