Ignore DEP and SEHOP flags on Win64

sandbox/win/src/process_mitigations.cc

Index: sandbox/win/src/process_mitigations.cc
===================================================================
--- sandbox/win/src/process_mitigations.cc	(revision 181659)
+++ sandbox/win/src/process_mitigations.cc	(working copy)
@@ -191,6 +191,8 @@
   if (version <= base::win::VERSION_VISTA)
     return;
 
+  // DEP and SEHOP are not valid for 64-bit Windows
+#if !defined(_WIN64)

[cpu_(ooo_6.6-7.5), 2013/02/11 19:05:09]

I don't like the silent ignore. in sandbox_policy_base we return
SBOX_ERROR_BAD_PARAMS in PolicyBase::SetProcessMitigations so we should do that
here.

[jschuh, 2013/02/11 21:26:49]

But it's ignored because the OS is already enforcing the behavior. And I didn't
want the mitigation interface to force the caller to enumerate through the
complicated tree of what OS versions support what mitigations. I designed it to
just encapsulate the logic and do the right thing, failing only when the OS
doesn't support something that it should.

   if (flags & MITIGATION_DEP) {
     *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE;
     if (!(flags & MITIGATION_DEP_NO_ATL_THUNK))
@@ -199,6 +201,7 @@
 
   if (flags & MITIGATION_SEHOP)
     *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE;
+#endif
 
   // Win 7
   if (version < base::win::VERSION_WIN8)