Merge 129583 - Mask RenderArena freelist entries.

Source/WebCore/rendering/RenderArena.cpp

 /*
  * Copyright (C) 2003 Apple Computer, Inc.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
@@ skipping 24 matching lines @@
 
 #include "config.h"
 #include "RenderArena.h"
 
 #include <stdlib.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 
 #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
 
+#ifdef NDEBUG
+// Mask freelist pointers to detect corruption and prevent freelist spraying.
+// We use an arbitray function and rely on ASLR to randomize it.
+// The first value in RenderObject (or any class) is a vtable pointer, which always
+// overlaps with the next pointer. This change guarantees that the masked vtable/next
+// pointer will never point to valid memory. So, we should immediately crash on the
+// first invalid vtable access for a stale RenderObject pointer.
+// See http://download.crowdstrike.com/papers/hes-exploiting-a-coalmine.pdf.
+static void* MaskPtr(void* p)
+{
+    // The bottom bits are predictable because the binary is loaded on a boundary.
+    // This just shifts most of those predictable bits out.
+    const uintptr_t mask = ~(reinterpret_cast<uintptr_t>(WTF::fastMalloc) >> 13);
+    return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(p) ^ mask);
+}
+#endif
+
 namespace WebCore {
 
 #ifndef NDEBUG
 
 const int signature = 0xDBA00AEA;
 const int signatureDead = 0xDBA00AED;
 
 typedef struct {
     RenderArena* arena;
     size_t size;
@@ skipping 41 matching lines @@
     // Ensure we have correct alignment for pointers.  Important for Tru64
     size = ROUNDUP(size, sizeof(void*));
 
     // Check recyclers first
     if (size < gMaxRecycledSize) {
         const int index = size >> 2;
 
         result = m_recyclers[index];
         if (result) {
             // Need to move to the next object
-            void* next = *((void**)result);
+            void* next = MaskPtr(*((void**)result));
             m_recyclers[index] = next;
         }
     }
 
     if (!result) {
         // Allocate a new chunk from the arena
         unsigned bytesAllocated = 0;
         ARENA_ALLOCATE(result, &m_pool, size, &bytesAllocated);
         m_totalAllocated += bytesAllocated;
     }
@@ skipping 19 matching lines @@
     ::free(block);
 #else
     // Ensure we have correct alignment for pointers.  Important for Tru64
     size = ROUNDUP(size, sizeof(void*));
 
     // See if it's a size that we recycle
     if (size < gMaxRecycledSize) {
         const int index = size >> 2;
         void* currentTop = m_recyclers[index];
         m_recyclers[index] = ptr;
-        *((void**)ptr) = currentTop;
+        *((void**)ptr) = MaskPtr(currentTop);
     }
 #endif
 }
 
 } // namespace WebCore