Ignore DEP and SEHOP flags on Win64

content/common/sandbox_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_policy.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 728 matching lines @@
   if (!in_sandbox) {
     base::ProcessHandle process = 0;
     base::LaunchProcess(*cmd_line, base::LaunchOptions(), &process);
     g_broker_services->AddTargetPeer(process);
     return process;
   }
 
   base::win::ScopedProcessInformation target;
   sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy();
 
-  // TODO(jschuh): Make Win64 work with DEP and SEHOP. crbug.com/147752

[cpu_(ooo_6.6-7.5), 2013/02/11 19:05:09]

in the CL you have bug 158133

[jschuh, 2013/02/11 21:26:49]

Okay... you caught me. I don't know how to read.

   sandbox::MitigationFlags mitigations = sandbox::MITIGATION_HEAP_TERMINATE |
-                                         sandbox::MITIGATION_BOTTOM_UP_ASLR;
-#if !defined(_WIN64)
-  // TODO(jschuh,bsy): Make Win64 work with HIGH_ENTROPY_ASLR. crbug.com/158133
-  mitigations |= sandbox::MITIGATION_DEP |
-                 sandbox::MITIGATION_DEP_NO_ATL_THUNK |
-                 sandbox::MITIGATION_SEHOP |
-                 sandbox::MITIGATION_HIGH_ENTROPY_ASLR;
-#if defined(NDEBUG)
-  mitigations |= sandbox::MITIGATION_RELOCATE_IMAGE |
-                 sandbox::MITIGATION_RELOCATE_IMAGE_REQUIRED;
-#endif
-#endif
+                                         sandbox::MITIGATION_BOTTOM_UP_ASLR |
+                                         sandbox::MITIGATION_DEP |
+                                         sandbox::MITIGATION_DEP_NO_ATL_THUNK |
+                                         sandbox::MITIGATION_SEHOP;
 
   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;
 
   mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS |
                 sandbox::MITIGATION_DLL_SEARCH_ORDER;
-#if defined(_WIN64)
-  mitigations |= sandbox::MITIGATION_DEP |
-                 sandbox::MITIGATION_DEP_NO_ATL_THUNK;
-#endif
 
   if (policy->SetDelayedProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;
 
   SetJobLevel(*cmd_line, sandbox::JOB_LOCKDOWN, 0, policy);
 
   if (type == PROCESS_TYPE_GPU) {
     if (!AddPolicyForGPU(cmd_line, policy))
       return 0;
   } else {
@@ skipping 124 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content