Merge 143811

Source/WebCore/rendering/RenderArena.cpp

 /*
  * Copyright (C) 2003 Apple Computer, Inc.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
@@ skipping 18 matching lines @@
  * version of this file under the LGPL, indicate your decision by
  * deletingthe provisions above and replace them with the notice and
  * other provisions required by the MPL or the GPL, as the case may be.
  * If you do not delete the provisions above, a recipient may use your
  * version of this file under any of the LGPL, the MPL or the GPL.
  */
 
 #include "config.h"
 #include "RenderArena.h"
 
+#include <limits>
 #include <stdlib.h>
 #include <string.h>
 #include <wtf/Assertions.h>
+#include <wtf/CryptographicallyRandomNumber.h>
 
 #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
 
 #ifdef NDEBUG
 static void* MaskPtr(void* p, uintptr_t mask)
 {
     return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(p) ^ mask);
 }
 #endif
 
@@ skipping 30 matching lines @@
     memset(m_recyclers, 0, sizeof(m_recyclers));
 
     // Mask freelist pointers to detect corruption and stop freelist spraying.
     // We use an arbitray function and rely on ASLR to randomize it.
     // The first value in RenderObject (or any class) is a vtable pointer, which
     // always overlaps with the next pointer. This change guarantees that the
     // masked vtable/next pointer will never point to valid memory. So, we
     // should immediately crash on the first invalid vtable access for a stale
     // RenderObject pointer.
     // See http://download.crowdstrike.com/papers/hes-exploiting-a-coalmine.pdf.
-
-    // The bottom bits are predictable because the binary is loaded on a
-    // boundary. This just shifts most of those predictable bits out.
-    m_mask = ~(reinterpret_cast<uintptr_t>(WTF::fastMalloc) >> 13);
+    WTF::cryptographicallyRandomValues(&m_mask, sizeof(m_mask));
+    m_mask |= (static_cast<uintptr_t>(3) << (std::numeric_limits<uintptr_t>::digits - 2)) | 1;
 }
 
 RenderArena::~RenderArena()
 {
     FinishArenaPool(&m_pool);
 }
 
 void* RenderArena::allocate(size_t size)
 {
     ASSERT(size <= gMaxRecycledSize - 32);
@@ skipping 55 matching lines @@
     size = ROUNDUP(size, sizeof(void*));
 
     const size_t index = size >> kRecyclerShift;
     void* currentTop = m_recyclers[index];
     m_recyclers[index] = ptr;
     *((void**)ptr) = MaskPtr(currentTop, m_mask);
 #endif
 }
 
 } // namespace WebCore