summaryrefslogtreecommitdiffstats
path: root/chrome_elf
diff options
context:
space:
mode:
authorrobertshield@chromium.org <robertshield@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2013-12-21 07:50:44 +0000
committerrobertshield@chromium.org <robertshield@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2013-12-21 07:50:44 +0000
commitba38880824fe0f56403a3fb09eb13f9ce4d6ec7b (patch)
tree14865eb81a52add51d7d0c4686e7860d9da9aaed /chrome_elf
parentd0d1c0563afcbe0afa7afd1e64df825624cdf0de (diff)
downloadchromium_src-ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b.zip
chromium_src-ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b.tar.gz
chromium_src-ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b.tar.bz2
Don't call uninitialized sandbox helper function from blacklist intercepts.
When mapping a section into a different process, the IsSameProcess function would crash invoking an uninitialized nt export. BUG=330178 TEST=NONE Review URL: https://codereview.chromium.org/93513011 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@242272 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome_elf')
-rw-r--r--chrome_elf/blacklist/blacklist_interceptions.cc7
1 files changed, 6 insertions, 1 deletions
diff --git a/chrome_elf/blacklist/blacklist_interceptions.cc b/chrome_elf/blacklist/blacklist_interceptions.cc
index f1e5b30..d0f64ea 100644
--- a/chrome_elf/blacklist/blacklist_interceptions.cc
+++ b/chrome_elf/blacklist/blacklist_interceptions.cc
@@ -161,6 +161,11 @@ base::string16 GetImageInfoFromLoadedModule(HMODULE module, uint32* flags) {
return base::string16(out_name.begin(), out_name.end());
}
+bool IsSameAsCurrentProcess(HANDLE process) {
+ return (NtCurrentProcess == process) ||
+ (::GetProcessId(process) == ::GetCurrentProcessId());
+}
+
} // namespace
namespace blacklist {
@@ -195,7 +200,7 @@ SANDBOX_INTERCEPT NTSTATUS WINAPI BlNtMapViewOfSection(
commit_size, offset, view_size, inherit,
allocation_type, protect);
- if (!NT_SUCCESS(ret) || !sandbox::IsSameProcess(process) ||
+ if (!NT_SUCCESS(ret) || !IsSameAsCurrentProcess(process) ||
!IsModuleValidImageSection(section, base, offset, view_size)) {
return ret;
}