Code: bool UnprivilegedProcessDelegate::CreateConnectedIpcChannel(
    const std::string& channel_name,
    IPC::Listener* delegate,
    ScopedHandle* client_out,
    scoped_ptr<IPC::ChannelProxy>* server_out) {
  scoped_ptr<IPC::ChannelProxy> server;
  if (!CreateIpcChannel(channel_name, kDaemonIpcSecurityDescriptor,
                        io_task_runner_, delegate, &server)) {
    return false;
  }
  std::string pipe_name(kChromePipeNamePrefix);
  pipe_name.append(channel_name);
  SECURITY_ATTRIBUTES security_attributes;
  security_attributes.nLength = sizeof(security_attributes);
  security_attributes.lpSecurityDescriptor = NULL;
  security_attributes.bInheritHandle = TRUE;
  ScopedHandle client;
  client.Set(CreateFile(UTF8ToUTF16(pipe_name).c_str(),
                        GENERIC_READ | GENERIC_WRITE,
                        0,
                        &security_attributes,
                        OPEN_EXISTING,
                        SECURITY_SQOS_PRESENT | SECURITY_IDENTIFICATION |
                            FILE_FLAG_OVERLAPPED,
                        NULL));
  if (!client.IsValid())
    return false;
  *client_out = client.Pass();
  *server_out = server.Pass();
  return true;
}

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving PDF fields.
Commit Message: Validate and report peer's PID to WorkerProcessIpcDelegate so it will be able to duplicate handles to and from the worker process.

As a side effect WorkerProcessLauncher::Delegate is now responsible for retrieving the client's PID and deciding whether a launch failed due to a permanent error condition.

BUG=134694


Review URL: https://chromiumcodereview.appspot.com/11143025

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@162778 0039d316-1c4b-4281-b951-d872f2087c98