Reserve the bottom of the address space to prevent predictable alocations.

sandbox/src/target_process.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/src/target_process.h"
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/win/pe_image.h"
 #include "sandbox/src/crosscall_server.h"
@@ skipping 21 matching lines @@
 
   for (size_t i = 0; i < sandbox::kMaxServiceCount; i++) {
     size_t buffer = reinterpret_cast<size_t>(policy->entry[i]);
     if (buffer) {
       buffer -= offset;
       policy->entry[i] = reinterpret_cast<sandbox::PolicyBuffer*>(buffer);
     }
   }
 }
 
+// Reserve a random range at the bottom of the address space in the target
+// process to prevent predictable alocations at low addresses.
+void PoisonLowerAddressRange(HANDLE process) {
+  unsigned int limit;
+  rand_s(&limit);
+  char* ptr = 0;
+  const size_t kMask64k = 0xFFFF;
+  // Random range (512k-4.5mb) in 64k steps.
+  const char* end = ptr + ((((limit % 4096) + 512) * 1024) & ~kMask64k);
+  while (ptr < end) {
+    MEMORY_BASIC_INFORMATION memory_info;
+    if (!::VirtualQueryEx(process, ptr, &memory_info, sizeof(memory_info)))
+      break;
+    size_t size = std::min((memory_info.RegionSize + kMask64k) & ~kMask64k,
+                           static_cast<SIZE_T>(end - ptr));
+    if (ptr && memory_info.State == MEM_FREE)
+      ::VirtualAllocEx(process, ptr, size, MEM_RESERVE, PAGE_NOACCESS);
+    ptr += size;
+  }
+}
+
 }
 
 namespace sandbox {
 
 SANDBOX_INTERCEPT HANDLE g_shared_section;
 SANDBOX_INTERCEPT size_t g_shared_IPC_size;
 SANDBOX_INTERCEPT size_t g_shared_policy_size;
 
 // Returns the address of the main exe module in memory taking in account
 // address space layout randomization.
@@ skipping 93 matching lines @@
                               NULL,   // No thread attribute.
                               FALSE,  // Do not inherit handles.
                               flags,
                               NULL,   // Use the environment of the caller.
                               NULL,   // Use current directory of the caller.
                               &startup_info,
                               &process_info)) {
     return ::GetLastError();
   }
 
+  PoisonLowerAddressRange(process_info.hProcess);
+
   DWORD win_result = ERROR_SUCCESS;
 
   // Assign the suspended target to the windows job object
   if (!::AssignProcessToJobObject(job_, process_info.hProcess)) {
     win_result = ::GetLastError();
     // It might be a security breach if we let the target run outside the job
     // so kill it before it causes damage
     TerminateTarget(&process_info);
     return win_result;
   }
@@ skipping 155 matching lines @@
 
 
 TargetProcess* MakeTestTargetProcess(HANDLE process, HMODULE base_address) {
   TargetProcess* target = new TargetProcess(NULL, NULL, NULL, NULL);
   target->sandbox_process_ = process;
   target->base_address_ = base_address;
   return target;
 }
 
 }  // namespace sandbox