[Backport] Security bug 378917565 (2/2)

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6037431:
ipcz: Validate introduction transport

Gracefully handle (reject) an introduction containing an invalid
transport object.

This is not really an issue in production since these messages are only
accepted from brokers; but the fuzzer can trip over this.

Bug: 378917565
Change-Id: I8237bc1ae1da4318fa007bea3c6e6f21a6912b3e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6037431
Reviewed-by: Alex Gough <[email protected]>
Commit-Queue: Ken Rockot <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1385948}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/624501
Reviewed-by: Anu Aliyas <[email protected]>

Author: krockot

chromium/third_party/ipcz/src/ipcz/node_link.cc

@@ -459,8 +459,12 @@ bool NodeLink::OnAcceptIntroduction(msg::AcceptIntroduction& accept) {
     return false;
   }
 
-  auto transport = MakeRefCounted<DriverTransport>(
-      accept.TakeDriverObject(accept.params().transport));
+  DriverObject transport_object =
+      accept.TakeDriverObject(accept.params().transport);
+  if (!transport_object.is_valid()) {
+    return false;
+  }
+  auto transport = MakeRefCounted<DriverTransport>(std::move(transport_object));
   node()->AcceptIntroduction(
       *this, accept.params().name, accept.params().link_side,
       accept.params().remote_node_type, accept.params().remote_protocol_version,