IPC::ChannelMojo: Make IPC handling robust against bad messages.

ipc/mojo/ipc_mojo_bootstrap.cc

Index: ipc/mojo/ipc_mojo_bootstrap.cc
diff --git a/ipc/mojo/ipc_mojo_bootstrap.cc b/ipc/mojo/ipc_mojo_bootstrap.cc
index 4af4e503a9d27b04efc732b5c6faf935046693a5..91f452f165d5c49e25032d1aacbbb6998b5e21cf 100644
--- a/ipc/mojo/ipc_mojo_bootstrap.cc
+++ b/ipc/mojo/ipc_mojo_bootstrap.cc
@@ -100,9 +100,14 @@ void MojoServerBootstrap::OnChannelConnected(int32 peer_pid) {
 }
 
 bool MojoServerBootstrap::OnMessageReceived(const Message&) {
-  DCHECK_EQ(state(), STATE_WAITING_ACK);
-  set_state(STATE_READY);
+  if (state() != STATE_WAITING_ACK) {
+    set_state(STATE_ERROR);
+    DLOG(ERROR) << "Got inconsistent message from client.";

[viettrungluu, 2014/11/13 21:15:25]

I actually suggested LOG, not DLOG, but I'll leave that up to you.

(The problem is that DLOG isn't likely to actually give any meaningful output in
the field, e.g., if a user encounters malicious content or when being fuzzed.)

+    return false;
+  }
 
+  set_state(STATE_READY);
+  CHECK(server_pipe_.is_valid());
   delegate()->OnPipeAvailable(
       mojo::embedder::ScopedPlatformHandle(server_pipe_.release()));
 
@@ -129,6 +134,12 @@ MojoClientBootstrap::MojoClientBootstrap() {
 }
 
 bool MojoClientBootstrap::OnMessageReceived(const Message& message) {
+  if (state() != STATE_INITIALIZED) {
+    set_state(STATE_ERROR);
+    DLOG(ERROR) << "Got inconsistent message from server.";
+    return false;
+  }
+
   PlatformFileForTransit pipe;
   PickleIterator iter(message);
   if (!ParamTraits<PlatformFileForTransit>::Read(&message, &iter, &pipe)) {