1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "mojo/system/transport_data.h"
6
7#include <string.h>
8
9#include "base/compiler_specific.h"
10#include "base/logging.h"
11#include "mojo/system/channel.h"
12#include "mojo/system/constants.h"
13#include "mojo/system/message_in_transit.h"
14
15namespace mojo {
16namespace system {
17
18// The maximum amount of space needed per platform handle.
19// (|{Channel,RawChannel}::GetSerializedPlatformHandleSize()| should always
20// return a value which is at most this. This is only used to calculate
21// |TransportData::kMaxBufferSize|. This value should be a multiple of the
22// alignment in order to simplify calculations, even though the actual amount of
23// space needed need not be a multiple of the alignment.
24const size_t kMaxSizePerPlatformHandle = 8;
25static_assert(kMaxSizePerPlatformHandle % MessageInTransit::kMessageAlignment ==
26                  0,
27              "kMaxSizePerPlatformHandle not a multiple of alignment");
28
29STATIC_CONST_MEMBER_DEFINITION const size_t
30    TransportData::kMaxSerializedDispatcherSize;
31STATIC_CONST_MEMBER_DEFINITION const size_t
32    TransportData::kMaxSerializedDispatcherPlatformHandles;
33
34// static
35const size_t TransportData::kMaxPlatformHandles =
36    kMaxMessageNumHandles * kMaxSerializedDispatcherPlatformHandles;
37
38// In additional to the header, for each attached (Mojo) handle there'll be a
39// handle table entry and serialized dispatcher data.
40// Note: This definition must follow the one for |kMaxPlatformHandles|;
41// otherwise, we get a static initializer with gcc (but not clang).
42// static
43const size_t TransportData::kMaxBufferSize =
44    sizeof(Header) +
45    kMaxMessageNumHandles *
46        (sizeof(HandleTableEntry) + kMaxSerializedDispatcherSize) +
47    kMaxPlatformHandles * kMaxSizePerPlatformHandle;
48
49struct TransportData::PrivateStructForCompileAsserts {
50  static_assert(sizeof(Header) % MessageInTransit::kMessageAlignment == 0,
51                "sizeof(MessageInTransit::Header) not a multiple of alignment");
52  static_assert(kMaxSerializedDispatcherSize %
53                        MessageInTransit::kMessageAlignment ==
54                    0,
55                "kMaxSerializedDispatcherSize not a multiple of alignment");
56  static_assert(sizeof(HandleTableEntry) %
57                        MessageInTransit::kMessageAlignment ==
58                    0,
59                "sizeof(MessageInTransit::HandleTableEntry) not a multiple of "
60                "alignment");
61};
62
63TransportData::TransportData(scoped_ptr<DispatcherVector> dispatchers,
64                             Channel* channel) {
65  DCHECK(dispatchers);
66  DCHECK(channel);
67
68  const size_t num_handles = dispatchers->size();
69  DCHECK_GT(num_handles, 0u);
70
71  // The offset to the start of the (Mojo) handle table.
72  const size_t handle_table_start_offset = sizeof(Header);
73  // The offset to the start of the serialized dispatcher data.
74  const size_t serialized_dispatcher_start_offset =
75      handle_table_start_offset + num_handles * sizeof(HandleTableEntry);
76  // The estimated size of the secondary buffer. We compute this estimate below.
77  // It must be at least as big as the (eventual) actual size.
78  size_t estimated_size = serialized_dispatcher_start_offset;
79  size_t estimated_num_platform_handles = 0;
80#if DCHECK_IS_ON
81  std::vector<size_t> all_max_sizes(num_handles);
82  std::vector<size_t> all_max_platform_handles(num_handles);
83#endif
84  for (size_t i = 0; i < num_handles; i++) {
85    if (Dispatcher* dispatcher = (*dispatchers)[i].get()) {
86      size_t max_size = 0;
87      size_t max_platform_handles = 0;
88      Dispatcher::TransportDataAccess::StartSerialize(
89          dispatcher, channel, &max_size, &max_platform_handles);
90
91      DCHECK_LE(max_size, kMaxSerializedDispatcherSize);
92      estimated_size += MessageInTransit::RoundUpMessageAlignment(max_size);
93      DCHECK_LE(estimated_size, kMaxBufferSize);
94
95      DCHECK_LE(max_platform_handles, kMaxSerializedDispatcherPlatformHandles);
96      estimated_num_platform_handles += max_platform_handles;
97      DCHECK_LE(estimated_num_platform_handles, kMaxPlatformHandles);
98
99#if DCHECK_IS_ON
100      all_max_sizes[i] = max_size;
101      all_max_platform_handles[i] = max_platform_handles;
102#endif
103    }
104  }
105
106  size_t size_per_platform_handle = 0;
107  if (estimated_num_platform_handles > 0) {
108    size_per_platform_handle = channel->GetSerializedPlatformHandleSize();
109    DCHECK_LE(size_per_platform_handle, kMaxSizePerPlatformHandle);
110    estimated_size += estimated_num_platform_handles * size_per_platform_handle;
111    estimated_size = MessageInTransit::RoundUpMessageAlignment(estimated_size);
112    DCHECK_LE(estimated_size, kMaxBufferSize);
113  }
114
115  buffer_.reset(static_cast<char*>(
116      base::AlignedAlloc(estimated_size, MessageInTransit::kMessageAlignment)));
117  // Entirely clear out the secondary buffer, since then we won't have to worry
118  // about clearing padding or unused space (e.g., if a dispatcher fails to
119  // serialize).
120  memset(buffer_.get(), 0, estimated_size);
121
122  if (estimated_num_platform_handles > 0) {
123    DCHECK(!platform_handles_);
124    platform_handles_.reset(new embedder::PlatformHandleVector());
125  }
126
127  Header* header = reinterpret_cast<Header*>(buffer_.get());
128  header->num_handles = static_cast<uint32_t>(num_handles);
129  // (Okay to leave |platform_handle_table_offset|, |num_platform_handles|, and
130  // |unused| be zero; we'll set the former two later if necessary.)
131
132  HandleTableEntry* handle_table = reinterpret_cast<HandleTableEntry*>(
133      buffer_.get() + handle_table_start_offset);
134  size_t current_offset = serialized_dispatcher_start_offset;
135  for (size_t i = 0; i < num_handles; i++) {
136    Dispatcher* dispatcher = (*dispatchers)[i].get();
137    if (!dispatcher) {
138      static_assert(Dispatcher::kTypeUnknown == 0,
139                    "Value of Dispatcher::kTypeUnknown must be 0");
140      continue;
141    }
142
143#if DCHECK_IS_ON
144    size_t old_platform_handles_size =
145        platform_handles_ ? platform_handles_->size() : 0;
146#endif
147
148    void* destination = buffer_.get() + current_offset;
149    size_t actual_size = 0;
150    if (Dispatcher::TransportDataAccess::EndSerializeAndClose(
151            dispatcher,
152            channel,
153            destination,
154            &actual_size,
155            platform_handles_.get())) {
156      handle_table[i].type = static_cast<int32_t>(dispatcher->GetType());
157      handle_table[i].offset = static_cast<uint32_t>(current_offset);
158      handle_table[i].size = static_cast<uint32_t>(actual_size);
159// (Okay to not set |unused| since we cleared the entire buffer.)
160
161#if DCHECK_IS_ON
162      DCHECK_LE(actual_size, all_max_sizes[i]);
163      DCHECK_LE(platform_handles_
164                    ? (platform_handles_->size() - old_platform_handles_size)
165                    : 0,
166                all_max_platform_handles[i]);
167#endif
168    } else {
169      // Nothing to do on failure, since |buffer_| was cleared, and
170      // |kTypeUnknown| is zero. The handle was simply closed.
171      LOG(ERROR) << "Failed to serialize handle to remote message pipe";
172    }
173
174    current_offset += MessageInTransit::RoundUpMessageAlignment(actual_size);
175    DCHECK_LE(current_offset, estimated_size);
176    DCHECK_LE(platform_handles_ ? platform_handles_->size() : 0,
177              estimated_num_platform_handles);
178  }
179
180  if (platform_handles_ && platform_handles_->size() > 0) {
181    header->platform_handle_table_offset =
182        static_cast<uint32_t>(current_offset);
183    header->num_platform_handles =
184        static_cast<uint32_t>(platform_handles_->size());
185    current_offset += platform_handles_->size() * size_per_platform_handle;
186    current_offset = MessageInTransit::RoundUpMessageAlignment(current_offset);
187  }
188
189  // There's no aligned realloc, so it's no good way to release unused space (if
190  // we overshot our estimated space requirements).
191  buffer_size_ = current_offset;
192
193  // |dispatchers_| will be destroyed as it goes out of scope.
194}
195
196#if defined(OS_POSIX)
197TransportData::TransportData(
198    embedder::ScopedPlatformHandleVectorPtr platform_handles)
199    : buffer_size_(sizeof(Header)), platform_handles_(platform_handles.Pass()) {
200  buffer_.reset(static_cast<char*>(
201      base::AlignedAlloc(buffer_size_, MessageInTransit::kMessageAlignment)));
202  memset(buffer_.get(), 0, buffer_size_);
203}
204#endif  // defined(OS_POSIX)
205
206TransportData::~TransportData() {
207}
208
209// static
210const char* TransportData::ValidateBuffer(
211    size_t serialized_platform_handle_size,
212    const void* buffer,
213    size_t buffer_size) {
214  DCHECK(buffer);
215  DCHECK_GT(buffer_size, 0u);
216
217  // Always make sure that the buffer size is sane; if it's not, someone's
218  // messing with us.
219  if (buffer_size < sizeof(Header) || buffer_size > kMaxBufferSize ||
220      buffer_size % MessageInTransit::kMessageAlignment != 0)
221    return "Invalid message secondary buffer size";
222
223  const Header* header = static_cast<const Header*>(buffer);
224  const size_t num_handles = header->num_handles;
225
226#if !defined(OS_POSIX)
227  // On POSIX, we send control messages with platform handles (but no handles)
228  // attached (see the comments for
229  // |TransportData(embedder::ScopedPlatformHandleVectorPtr)|. (This check isn't
230  // important security-wise anyway.)
231  if (num_handles == 0)
232    return "Message has no handles attached, but secondary buffer present";
233#endif
234
235  // Sanity-check |num_handles| (before multiplying it against anything).
236  if (num_handles > kMaxMessageNumHandles)
237    return "Message handle payload too large";
238
239  if (buffer_size < sizeof(Header) + num_handles * sizeof(HandleTableEntry))
240    return "Message secondary buffer too small";
241
242  if (header->num_platform_handles == 0) {
243    // Then |platform_handle_table_offset| should also be zero.
244    if (header->platform_handle_table_offset != 0) {
245      return "Message has no handles attached, but platform handle table "
246             "present";
247    }
248  } else {
249    // |num_handles| has already been validated, so the multiplication is okay.
250    if (header->num_platform_handles >
251        num_handles * kMaxSerializedDispatcherPlatformHandles)
252      return "Message has too many platform handles attached";
253
254    static const char kInvalidPlatformHandleTableOffset[] =
255        "Message has invalid platform handle table offset";
256    // This doesn't check that the platform handle table doesn't alias other
257    // stuff, but it doesn't matter, since it's all read-only.
258    if (header->platform_handle_table_offset %
259            MessageInTransit::kMessageAlignment !=
260        0)
261      return kInvalidPlatformHandleTableOffset;
262
263    // ">" instead of ">=" since the size per handle may be zero.
264    if (header->platform_handle_table_offset > buffer_size)
265      return kInvalidPlatformHandleTableOffset;
266
267    // We already checked |platform_handle_table_offset| and
268    // |num_platform_handles|, so the addition and multiplication are okay.
269    if (header->platform_handle_table_offset +
270            header->num_platform_handles * serialized_platform_handle_size >
271        buffer_size)
272      return kInvalidPlatformHandleTableOffset;
273  }
274
275  const HandleTableEntry* handle_table =
276      reinterpret_cast<const HandleTableEntry*>(
277          static_cast<const char*>(buffer) + sizeof(Header));
278  static const char kInvalidSerializedDispatcher[] =
279      "Message contains invalid serialized dispatcher";
280  for (size_t i = 0; i < num_handles; i++) {
281    size_t offset = handle_table[i].offset;
282    if (offset % MessageInTransit::kMessageAlignment != 0)
283      return kInvalidSerializedDispatcher;
284
285    size_t size = handle_table[i].size;
286    if (size > kMaxSerializedDispatcherSize || size > buffer_size)
287      return kInvalidSerializedDispatcher;
288
289    // Note: This is an overflow-safe check for |offset + size > buffer_size|
290    // (we know that |size <= buffer_size| from the previous check).
291    if (offset > buffer_size - size)
292      return kInvalidSerializedDispatcher;
293  }
294
295  return nullptr;
296}
297
298// static
299void TransportData::GetPlatformHandleTable(const void* transport_data_buffer,
300                                           size_t* num_platform_handles,
301                                           const void** platform_handle_table) {
302  DCHECK(transport_data_buffer);
303  DCHECK(num_platform_handles);
304  DCHECK(platform_handle_table);
305
306  const Header* header = static_cast<const Header*>(transport_data_buffer);
307  *num_platform_handles = header->num_platform_handles;
308  *platform_handle_table = static_cast<const char*>(transport_data_buffer) +
309                           header->platform_handle_table_offset;
310}
311
312// static
313scoped_ptr<DispatcherVector> TransportData::DeserializeDispatchers(
314    const void* buffer,
315    size_t buffer_size,
316    embedder::ScopedPlatformHandleVectorPtr platform_handles,
317    Channel* channel) {
318  DCHECK(buffer);
319  DCHECK_GT(buffer_size, 0u);
320  DCHECK(channel);
321
322  const Header* header = static_cast<const Header*>(buffer);
323  const size_t num_handles = header->num_handles;
324  scoped_ptr<DispatcherVector> dispatchers(new DispatcherVector(num_handles));
325
326  const HandleTableEntry* handle_table =
327      reinterpret_cast<const HandleTableEntry*>(
328          static_cast<const char*>(buffer) + sizeof(Header));
329  for (size_t i = 0; i < num_handles; i++) {
330    size_t offset = handle_table[i].offset;
331    size_t size = handle_table[i].size;
332    // Should already have been checked by |ValidateBuffer()|:
333    DCHECK_EQ(offset % MessageInTransit::kMessageAlignment, 0u);
334    DCHECK_LE(offset, buffer_size);
335    DCHECK_LE(offset + size, buffer_size);
336
337    const void* source = static_cast<const char*>(buffer) + offset;
338    (*dispatchers)[i] = Dispatcher::TransportDataAccess::Deserialize(
339        channel, handle_table[i].type, source, size, platform_handles.get());
340  }
341
342  return dispatchers.Pass();
343}
344
345}  // namespace system
346}  // namespace mojo
347