Changeset 147508 in webkit

Timestamp:

Apr 2, 2013 4:34:22 PM (11 years ago)

Author:

andersca@apple.com

Message:

Be more robust against empty message receiver names in incoming messages
​https://bugs.webkit.org/show_bug.cgi?id=113833
<rdar://problem/13284433>

Reviewed by Beth Dakin.

Turns out that we either send or receive messages whose receiver names are empty. This leads to bad things when we try to look
up the message receiver name in a hash map since the empty name is used to represent an empty hash map value.

• Platform/CoreIPC/Connection.cpp:

(CoreIPC::Connection::addWorkQueueMessageReceiverOnConnectionWorkQueue):
Sprinkle assertions.

(CoreIPC::Connection::processIncomingMessage):
If the message receiver name is not valid, make sure to call didReceiveInvalidMessage on the client thread.

(CoreIPC::Connection::dispatchDidReceiveInvalidMessage):
Add new helper function.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Platform/CoreIPC/Connection.cpp (modified) (4 diffs)
• Platform/CoreIPC/Connection.h (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2013-04-02  Anders Carlsson  <andersca@apple.com>
+
+        Be more robust against empty message receiver names in incoming messages
+        https://bugs.webkit.org/show_bug.cgi?id=113833
+        <rdar://problem/13284433>
+
+        Reviewed by Beth Dakin.
+
+        Turns out that we either send or receive messages whose receiver names are empty. This leads to bad things when we try to look
+        up the message receiver name in a hash map since the empty name is used to represent an empty hash map value.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::addWorkQueueMessageReceiverOnConnectionWorkQueue):
+        Sprinkle assertions.
+
+        (CoreIPC::Connection::processIncomingMessage):
+        If the message receiver name is not valid, make sure to call didReceiveInvalidMessage on the client thread.
+
+        (CoreIPC::Connection::dispatchDidReceiveInvalidMessage):
+        Add new helper function.
+
 2013-04-02  Simon Cooper  <scooper@apple.com>
 

trunk/Source/WebKit2/Platform/CoreIPC/Connection.cpp

@@ -272 +272 @@
 void Connection::addWorkQueueMessageReceiverOnConnectionWorkQueue(StringReference messageReceiverName, WorkQueue* workQueue, WorkQueueMessageReceiver* workQueueMessageReceiver)
 {
+    ASSERT(workQueue);
+    ASSERT(workQueueMessageReceiver);
     ASSERT(!m_workQueueMessageReceivers.contains(messageReceiverName));
+
     m_workQueueMessageReceivers.add(messageReceiverName, std::make_pair(workQueue, workQueueMessageReceiver));
 }
@@ -608 +611 @@
     OwnPtr<MessageDecoder> message = incomingMessage;
 
+    ASSERT(!message->messageReceiverName().isEmpty());
+    ASSERT(!message->messageName().isEmpty());
+
     if (message->messageReceiverName() == "IPC" && message->messageName() == "SyncMessageReply") {
         processIncomingSyncReply(message.release());
@@ -613 +619 @@
     }
 
-    // Check if any work queue message receivers are interested in this message.
+    if (!m_workQueueMessageReceivers.isValidKey(message->messageReceiverName())) {
+        m_clientRunLoop->dispatch(bind(&Connection::dispatchDidReceiveInvalidMessage, this, message->messageReceiverName().toString(), message->messageName().toString()));
+        return;
+    }
+
     HashMap<StringReference, std::pair<RefPtr<WorkQueue>, RefPtr<WorkQueueMessageReceiver> > >::const_iterator it = m_workQueueMessageReceivers.find(message->messageReceiverName());
     if (it != m_workQueueMessageReceivers.end()) {
@@ -735 +745 @@
 }
 
+void Connection::dispatchDidReceiveInvalidMessage(const CString& messageReceiverNameString, const CString& messageNameString)
+{
+    ASSERT(RunLoop::current() == m_clientRunLoop);
+
+    if (!m_client)
+        return;
+
+    m_client->didReceiveInvalidMessage(this, StringReference(messageReceiverNameString.data(), messageReceiverNameString.length()), StringReference(messageNameString.data(), messageNameString.length()));
+}
+
 void Connection::didFailToSendSyncMessage()
 {

trunk/Source/WebKit2/Platform/CoreIPC/Connection.h

@@ -217 +217 @@
     void dispatchMessage(MessageDecoder&);
     void dispatchSyncMessage(MessageDecoder&);
+    void dispatchDidReceiveInvalidMessage(const CString& messageReceiverNameString, const CString& messageNameString);
     void didFailToSendSyncMessage();