Title: [238800] trunk/Source/WebKit
- Revision
- 238800
- Author
- [email protected]
- Date
- 2018-12-03 09:26:38 -0800 (Mon, 03 Dec 2018)
Log Message
[Cocoa] Check message IDs when decoding Mach messages in IPC::Connection
https://bugs.webkit.org/show_bug.cgi?id=192300
rdar://problem/46215523
Reviewed by Chris Dumez.
* Platform/IPC/mac/ConnectionMac.mm:
(IPC::Connection::sendOutgoingMessage): Use message IDs other than 0 and 1 for
the messages, as suggested by an expert at Apple.
(IPC::createMessageDecoder): Update for the new message IDs.
(IPC::Connection::receiveSourceEventHandler): Ignore messages with unexpected
message IDs.
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (238799 => 238800)
--- trunk/Source/WebKit/ChangeLog 2018-12-03 17:18:57 UTC (rev 238799)
+++ trunk/Source/WebKit/ChangeLog 2018-12-03 17:26:38 UTC (rev 238800)
@@ -1,5 +1,20 @@
2018-12-03 Darin Adler <[email protected]>
+ [Cocoa] Check message IDs when decoding Mach messages in IPC::Connection
+ https://bugs.webkit.org/show_bug.cgi?id=192300
+ rdar://problem/46215523
+
+ Reviewed by Chris Dumez.
+
+ * Platform/IPC/mac/ConnectionMac.mm:
+ (IPC::Connection::sendOutgoingMessage): Use message IDs other than 0 and 1 for
+ the messages, as suggested by an expert at Apple.
+ (IPC::createMessageDecoder): Update for the new message IDs.
+ (IPC::Connection::receiveSourceEventHandler): Ignore messages with unexpected
+ message IDs.
+
+2018-12-03 Darin Adler <[email protected]>
+
[Cocoa] Check descriptor types in createMessageDecoder
https://bugs.webkit.org/show_bug.cgi?id=192302
Modified: trunk/Source/WebKit/Platform/IPC/mac/ConnectionMac.mm (238799 => 238800)
--- trunk/Source/WebKit/Platform/IPC/mac/ConnectionMac.mm 2018-12-03 17:18:57 UTC (rev 238799)
+++ trunk/Source/WebKit/Platform/IPC/mac/ConnectionMac.mm 2018-12-03 17:26:38 UTC (rev 238800)
@@ -72,11 +72,10 @@
static const size_t inlineMessageMaxSize = 4096;
-// Message flags.
-enum {
- MessageBodyIsOutOfLine = 1 << 0
-};
-
+// Arbitrary message IDs that do not collide with Mach notification messages (used my initials).
+constexpr mach_msg_id_t inlineBodyMessageID = 0xdba0dba;
+constexpr mach_msg_id_t outOfLineBodyMessageID = 0xdba1dba;
+
// ConnectionTerminationWatchdog does two things:
// 1) It sets a watchdog timer to kill the peered process.
// 2) On iOS, make the process runnable for the duration of the watchdog
@@ -316,7 +315,7 @@
header->msgh_size = messageSize;
header->msgh_remote_port = m_sendPort;
header->msgh_local_port = MACH_PORT_NULL;
- header->msgh_id = 0;
+ header->msgh_id = inlineBodyMessageID;
auto* messageData = reinterpret_cast<uint8_t*>(header + 1);
@@ -343,7 +342,7 @@
}
if (messageBodyIsOOL) {
- header->msgh_id |= MessageBodyIsOutOfLine;
+ header->msgh_id = outOfLineBodyMessageID;
auto* descriptor = getDescriptorAndSkip(messageData);
descriptor->out_of_line.address = encoder->buffer();
@@ -420,7 +419,7 @@
return std::make_unique<Decoder>(body, bodySize, nullptr, Vector<Attachment> { });
}
- bool messageBodyIsOOL = header->msgh_id & MessageBodyIsOutOfLine;
+ bool messageBodyIsOOL = header->msgh_id == outOfLineBodyMessageID;
mach_msg_body_t* body = reinterpret_cast<mach_msg_body_t*>(header + 1);
mach_msg_size_t numDescriptors = body->msgh_descriptor_count;
@@ -517,11 +516,13 @@
connectionDidClose();
return;
+ case inlineBodyMessageID:
+ case outOfLineBodyMessageID:
+ break;
+
case MACH_NOTIFY_SEND_ONCE:
+ default:
return;
-
- default:
- break;
}
std::unique_ptr<Decoder> decoder = createMessageDecoder(header);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
