Skip to content

Commit

Permalink
base: Fix shared memory handle leak in IPC serialization
Browse files Browse the repository at this point in the history
PlatformSharedMemoryRegion leaked handles after serializing into the IPC message
on Windows, Mac and Fuchsia. Serialization code incorrectly assumed that
HandleWin, MachPortMac and HandleFuchsia classes take ownership over the handle.

What really happens is that HandleFoo is passed to WriteParam(), which causes
ParamTraits<HandleFoo>::Write() to be invoked, before it returns, creating the
HandleAttachmentFoo, which will duplicate the handle.

By the time we return from WriteParam() the handle should have been duplicated
into the serialized message, so we can safely let the PSMR close the handle when
it goes out of scope.

This CL makes the PlatformSharedMemoryRegion serialization repeat the logic of
the base::SharedMemoryHandle serialization as if the OwnershipPassesToIPC() flag
is always set to true.

Bug: 873313, 873668
Change-Id: I4e98ff9483a48970ebcb2fcf6b150f447af82794
Reviewed-on: https://chromium-review.googlesource.com/1175918
Commit-Queue: Wez <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Reviewed-by: Wez <[email protected]>
Reviewed-by: Ken Rockot <[email protected]>
Cr-Commit-Position: refs/heads/master@{#583434}
  • Loading branch information
Alexandr Ilin authored and Commit Bot committed Aug 15, 2018
1 parent bb4bf04 commit 6544b8a
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions ipc/ipc_message_utils.cc
Original file line number Diff line number Diff line change
Expand Up @@ -891,16 +891,16 @@ void ParamTraits<base::subtle::PlatformSharedMemoryRegion>::Write(

#if defined(OS_WIN)
base::win::ScopedHandle h = const_cast<param_type&>(p).PassPlatformHandle();
HandleWin handle_win(h.Take());
HandleWin handle_win(h.Get());
WriteParam(m, handle_win);
#elif defined(OS_FUCHSIA)
zx::handle h = const_cast<param_type&>(p).PassPlatformHandle();
HandleFuchsia handle_fuchsia(h.release());
HandleFuchsia handle_fuchsia(h.get());
WriteParam(m, handle_fuchsia);
#elif defined(OS_MACOSX) && !defined(OS_IOS)
base::mac::ScopedMachSendRight h =
const_cast<param_type&>(p).PassPlatformHandle();
MachPortMac mach_port_mac(h.release());
MachPortMac mach_port_mac(h.get());
WriteParam(m, mach_port_mac);
#elif defined(OS_ANDROID)
m->WriteAttachment(new internal::PlatformFileAttachment(
Expand Down

0 comments on commit 6544b8a

Please sign in to comment.