diff options
author | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-03-02 00:18:35 +0000 |
---|---|---|
committer | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-03-02 00:18:35 +0000 |
commit | 071ee9546b6364b3d5637602e8a35b4c0b79a8b7 (patch) | |
tree | ab1904d7419d9d67c92137ebcaf18bb127659aec | |
parent | 6dedd1c8c8fc35bbcd33bd68cd538b22b9b79c74 (diff) | |
download | chromium_src-071ee9546b6364b3d5637602e8a35b4c0b79a8b7.zip chromium_src-071ee9546b6364b3d5637602e8a35b4c0b79a8b7.tar.gz chromium_src-071ee9546b6364b3d5637602e8a35b4c0b79a8b7.tar.bz2 |
Merge 123920 - Reserve the bottom of the address space to prevent predictable alocations.
BUG=113891
Review URL: http://codereview.chromium.org/9447078
TBR=jschuh@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9562042
git-svn-id: svn://svn.chromium.org/chrome/branches/1025/src@124543 0039d316-1c4b-4281-b951-d872f2087c98
-rw-r--r-- | sandbox/src/target_process.cc | 25 |
1 files changed, 24 insertions, 1 deletions
diff --git a/sandbox/src/target_process.cc b/sandbox/src/target_process.cc index 3f2b156..2710dc0 100644 --- a/sandbox/src/target_process.cc +++ b/sandbox/src/target_process.cc @@ -1,4 +1,4 @@ -// Copyright (c) 2011 The Chromium Authors. All rights reserved. +// Copyright (c) 2012 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. @@ -39,6 +39,27 @@ void CopyPolicyToTarget(const void* source, size_t size, void* dest) { } } +// Reserve a random range at the bottom of the address space in the target +// process to prevent predictable alocations at low addresses. +void PoisonLowerAddressRange(HANDLE process) { + unsigned int limit; + rand_s(&limit); + char* ptr = 0; + const size_t kMask64k = 0xFFFF; + // Random range (512k-4.5mb) in 64k steps. + const char* end = ptr + ((((limit % 4096) + 512) * 1024) & ~kMask64k); + while (ptr < end) { + MEMORY_BASIC_INFORMATION memory_info; + if (!::VirtualQueryEx(process, ptr, &memory_info, sizeof(memory_info))) + break; + size_t size = std::min((memory_info.RegionSize + kMask64k) & ~kMask64k, + static_cast<SIZE_T>(end - ptr)); + if (ptr && memory_info.State == MEM_FREE) + ::VirtualAllocEx(process, ptr, size, MEM_RESERVE, PAGE_NOACCESS); + ptr += size; + } +} + } namespace sandbox { @@ -152,6 +173,8 @@ DWORD TargetProcess::Create(const wchar_t* exe_path, return ::GetLastError(); } + PoisonLowerAddressRange(process_info.hProcess); + DWORD win_result = ERROR_SUCCESS; // Assign the suspended target to the windows job object |