diff options
author | robertshield@chromium.org <robertshield@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-12-21 07:50:44 +0000 |
---|---|---|
committer | robertshield@chromium.org <robertshield@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-12-21 07:50:44 +0000 |
commit | ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b (patch) | |
tree | 14865eb81a52add51d7d0c4686e7860d9da9aaed /chrome_elf | |
parent | d0d1c0563afcbe0afa7afd1e64df825624cdf0de (diff) | |
download | chromium_src-ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b.zip chromium_src-ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b.tar.gz chromium_src-ba38880824fe0f56403a3fb09eb13f9ce4d6ec7b.tar.bz2 |
Don't call uninitialized sandbox helper function from blacklist intercepts.
When mapping a section into a different process, the IsSameProcess
function would crash invoking an uninitialized nt export.
BUG=330178
TEST=NONE
Review URL: https://codereview.chromium.org/93513011
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@242272 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome_elf')
-rw-r--r-- | chrome_elf/blacklist/blacklist_interceptions.cc | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/chrome_elf/blacklist/blacklist_interceptions.cc b/chrome_elf/blacklist/blacklist_interceptions.cc index f1e5b30..d0f64ea 100644 --- a/chrome_elf/blacklist/blacklist_interceptions.cc +++ b/chrome_elf/blacklist/blacklist_interceptions.cc @@ -161,6 +161,11 @@ base::string16 GetImageInfoFromLoadedModule(HMODULE module, uint32* flags) { return base::string16(out_name.begin(), out_name.end()); } +bool IsSameAsCurrentProcess(HANDLE process) { + return (NtCurrentProcess == process) || + (::GetProcessId(process) == ::GetCurrentProcessId()); +} + } // namespace namespace blacklist { @@ -195,7 +200,7 @@ SANDBOX_INTERCEPT NTSTATUS WINAPI BlNtMapViewOfSection( commit_size, offset, view_size, inherit, allocation_type, protect); - if (!NT_SUCCESS(ret) || !sandbox::IsSameProcess(process) || + if (!NT_SUCCESS(ret) || !IsSameAsCurrentProcess(process) || !IsModuleValidImageSection(section, base, offset, view_size)) { return ret; } |