linux: Crash browser on too-big messages to zygote.

base/posix/unix_domain_socket.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/posix/unix_domain_socket.h"
 
 #include <errno.h>
 #include <unistd.h>
 #include <sys/uio.h>
 #include <sys/socket.h>
 
 #include "base/eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/pickle.h"
 #include "base/stl_util.h"
 
+const size_t UnixDomainSocket::kMaxFileDescriptors = 16;
+
 // static
 bool UnixDomainSocket::SendMsg(int fd,
                                const void* buf,
                                size_t length,
                                const std::vector<int>& fds) {
   struct msghdr msg;
   memset(&msg, 0, sizeof(msg));
   struct iovec iov = {const_cast<void*>(buf), length};
   msg.msg_iov = &iov;
   msg.msg_iovlen = 1;
@@ skipping 18 matching lines @@
   const bool ret = static_cast<ssize_t>(length) == r;
   delete[] control_buffer;
   return ret;
 }
 
 // static
 ssize_t UnixDomainSocket::RecvMsg(int fd,
                                   void* buf,
                                   size_t length,
                                   std::vector<int>* fds) {
-  static const unsigned kMaxDescriptors = 16;
-
   fds->clear();
 
   struct msghdr msg;
   memset(&msg, 0, sizeof(msg));
   struct iovec iov = {buf, length};
   msg.msg_iov = &iov;
   msg.msg_iovlen = 1;
 
-  char control_buffer[CMSG_SPACE(sizeof(int) * kMaxDescriptors)];
+  char control_buffer[CMSG_SPACE(sizeof(int) * kMaxFileDescriptors)];
   msg.msg_control = control_buffer;
   msg.msg_controllen = sizeof(control_buffer);
 
   const ssize_t r = HANDLE_EINTR(recvmsg(fd, &msg, 0));
   if (r == -1)
     return -1;
 
   int* wire_fds = NULL;
   unsigned wire_fds_len = 0;
 
@@ skipping 61 matching lines @@
     NOTREACHED();
 
     return -1;
   }
 
   if (result_fd)
     *result_fd = fd_vector.empty() ? -1 : fd_vector[0];
 
   return reply_len;
 }