PPAPI/NaCl: Restrict ppapi messages to unblock only ppapi

chrome/renderer/pepper/ppb_nacl_private_impl.cc

Index: chrome/renderer/pepper/ppb_nacl_private_impl.cc
diff --git a/chrome/renderer/pepper/ppb_nacl_private_impl.cc b/chrome/renderer/pepper/ppb_nacl_private_impl.cc
index f094f6590b35116d436f5cd93b1933ebca428136..6ca26a80baf40e5e767fa697981ba536392f09ae 100644
--- a/chrome/renderer/pepper/ppb_nacl_private_impl.cc
+++ b/chrome/renderer/pepper/ppb_nacl_private_impl.cc
@@ -23,6 +23,7 @@
 #include "content/public/common/sandbox_init.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/render_view.h"
+#include "content/public/renderer/renderer_restrict_dispatch_group.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "ppapi/c/private/ppb_nacl_private.h"
 #include "ppapi/native_client/src/trusted/plugin/nacl_entry_points.h"
@@ -175,6 +176,10 @@ class OutOfProcessProxy : public PluginDelegate::OutOfProcessProxy {
       return false;
     }
 
+    // Make sure that incoming plugin->renderer "unblock" messages can ONLY
+    // unblock other pepper messages.
+    dispatcher_->channel()->SetRestrictDispatchChannelGroup(
+        content::kRendererRestrictDispatchGroup_Pepper);
     return true;
   }