Code: static SharedMemorySupport DoQuerySharedMemorySupport(Display* dpy) {
  int dummy;
  Bool pixmaps_supported;
  if (!XShmQueryVersion(dpy, &dummy, &dummy, &pixmaps_supported))
    return SHARED_MEMORY_NONE;

#if defined(OS_FREEBSD)
  int allow_removed;
  size_t length = sizeof(allow_removed);

  if ((sysctlbyname("kern.ipc.shm_allow_removed", &allow_removed, &length,
      NULL, 0) < 0) || allow_removed < 1) {
    return SHARED_MEMORY_NONE;
  }
 #endif
 
  int shmkey = shmget(IPC_PRIVATE, 1, 0666);
  if (shmkey == -1)
     return SHARED_MEMORY_NONE;
   void* address = shmat(shmkey, NULL, 0);
   shmctl(shmkey, IPC_RMID, NULL);

  XShmSegmentInfo shminfo;
  memset(&shminfo, 0, sizeof(shminfo));
  shminfo.shmid = shmkey;
 
   gdk_error_trap_push();
   bool result = XShmAttach(dpy, &shminfo);
   XSync(dpy, False);
   if (gdk_error_trap_pop())
     result = false;
   shmdt(address);
  if (!result)
     return SHARED_MEMORY_NONE;
 
   XShmDetach(dpy, &shminfo);
   return pixmaps_supported ? SHARED_MEMORY_PIXMAP : SHARED_MEMORY_PUTIMAGE;
}

Vulnerability Type: 
CWE ID: CWE-264
Summary: Google Chrome before 24.0.1312.52 on Linux uses weak permissions for shared memory segments, which has unspecified impact and attack vectors.
Commit Message: Make shared memory segments writable only by their rightful owners.

BUG=143859
TEST=Chrome's UI still works on Linux and Chrome OS
Review URL: https://chromiumcodereview.appspot.com/10854242

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@158289 0039d316-1c4b-4281-b951-d872f2087c98