Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(137)

Unified Diff: Source/WebCore/rendering/RenderArena.cpp

Issue 12334103: Merge 143811 (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/1364/
Patch Set: Created 7 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/WebCore/rendering/RenderArena.cpp
===================================================================
--- Source/WebCore/rendering/RenderArena.cpp (revision 144105)
+++ Source/WebCore/rendering/RenderArena.cpp (working copy)
@@ -36,9 +36,11 @@
#include "config.h"
#include "RenderArena.h"
+#include <limits>
#include <stdlib.h>
#include <string.h>
#include <wtf/Assertions.h>
+#include <wtf/CryptographicallyRandomNumber.h>
#define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
@@ -89,10 +91,8 @@
// should immediately crash on the first invalid vtable access for a stale
// RenderObject pointer.
// See http://download.crowdstrike.com/papers/hes-exploiting-a-coalmine.pdf.
-
- // The bottom bits are predictable because the binary is loaded on a
- // boundary. This just shifts most of those predictable bits out.
- m_mask = ~(reinterpret_cast<uintptr_t>(WTF::fastMalloc) >> 13);
+ WTF::cryptographicallyRandomValues(&m_mask, sizeof(m_mask));
+ m_mask |= (static_cast<uintptr_t>(3) << (std::numeric_limits<uintptr_t>::digits - 2)) | 1;
}
RenderArena::~RenderArena()
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698