Modified platform bitmap to support GDI being unavailable

skia/ext/bitmap_platform_device_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <windows.h>
 #include <psapi.h>
 
 #include "base/debug/gdi_debug_util_win.h"
+#include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "skia/ext/bitmap_platform_device_win.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/skia/include/core/SkMatrix.h"
 #include "third_party/skia/include/core/SkRefCnt.h"
 #include "third_party/skia/include/core/SkRegion.h"
 #include "third_party/skia/include/core/SkUtils.h"
 
 namespace {
 
+// This file contains an implementation of a Skia platform bitmap for drawing
+// and compositing graphics. The original implementation uses Windows GDI
+// to create the backing bitmap memory, however when using the sandbox security
+// policy win32k lockdown it's not possible to use GDI for security reasons.
+// Therefore this code also implements a fallback mechanism when a process is
+// under this security policy to directly map the shared section as memory
+// instead of using GDI. To catch new code which tries to explicitly rely on
+// this code using GDI some additional DCHECKs have been added to catch that
+// code during development.
+typedef decltype(GetProcessMitigationPolicy)* GetProcessMitigationPolicyType;
+
+// Get win32k lockdown policy using a lazy instance so it's only initialized
+// once and is thread-safe.
+class LazyIsWin32kLockdownEnabled {
+ public:
+  LazyIsWin32kLockdownEnabled()
+      : value_(IsWin32kLockdownEnabled()) {}
+
+  ~LazyIsWin32kLockdownEnabled() {}
+
+  bool value() { return value_; }
+
+ private:
+  static bool IsWin32kLockdownEnabled() {
+    GetProcessMitigationPolicyType get_process_mitigation_policy_func =
+            reinterpret_cast<GetProcessMitigationPolicyType>(
+                                              GetProcAddress(
+                                              GetModuleHandle(L"kernel32.dll"),
+                                              "GetProcessMitigationPolicy"));
+
+    if (!get_process_mitigation_policy_func)
+      return false;
+
+    PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY policy = {0};
+    if (get_process_mitigation_policy_func(GetCurrentProcess(),
+                                           ProcessSystemCallDisablePolicy,
+                                           &policy,
+                                           sizeof(policy)))
+      return policy.DisallowWin32kSystemCalls != 0;
+
+    return false;
+  }
+ 
+  const bool value_;
+
+  DISALLOW_COPY_AND_ASSIGN(LazyIsWin32kLockdownEnabled);
+};
+
+bool IsWin32kLockdownEnabled() {
+  static base::LazyInstance<LazyIsWin32kLockdownEnabled> win32k_lockdown;

[Will Harris, 2015/09/10 17:34:45]

I think this needs a LAZY_INSTANCE_INITIALIZER

+  return win32k_lockdown.Get().value();
+}
+
 HBITMAP CreateHBitmap(int width, int height, bool is_opaque,
                              HANDLE shared_section, void** data) {
   // CreateDIBSection appears to get unhappy if we create an empty bitmap, so
   // just create a minimal bitmap
   if ((width == 0) || (height == 0)) {
     width = 1;
     height = 1;
   }
 
   BITMAPINFOHEADER hdr = {0};
@@ skipping 21 matching lines @@
 
   return hbitmap;
 }
 
 }  // namespace
 
 namespace skia {
 
 void DrawToNativeContext(SkCanvas* canvas, HDC hdc, int x, int y,
                          const RECT* src_rect) {
+  DCHECK(!IsWin32kLockdownEnabled());
   PlatformDevice* platform_device = GetPlatformDevice(GetTopDevice(*canvas));
   if (platform_device)
     platform_device->DrawToHDC(hdc, x, y, src_rect);
 }
 
 void PlatformDevice::DrawToHDC(HDC, int x, int y, const RECT* src_rect) {}
 
 HDC BitmapPlatformDevice::GetBitmapDC() {
+  DCHECK(!IsWin32kLockdownEnabled());
   if (!hdc_) {
     hdc_ = CreateCompatibleDC(NULL);
     InitializeDC(hdc_);
     old_hbitmap_ = static_cast<HBITMAP>(SelectObject(hdc_, hbitmap_));
   }
 
   LoadConfig();
   return hdc_;
 }
 
 void BitmapPlatformDevice::ReleaseBitmapDC() {
-  SkASSERT(hdc_);
-  SelectObject(hdc_, old_hbitmap_);
-  DeleteDC(hdc_);
-  hdc_ = NULL;
-  old_hbitmap_ = NULL;
+  if (!IsWin32kLockdownEnabled()) {
+    SkASSERT(hdc_);
+    SelectObject(hdc_, old_hbitmap_);
+    DeleteDC(hdc_);
+    hdc_ = NULL;
+    old_hbitmap_ = NULL;
+  }
 }
 
 bool BitmapPlatformDevice::IsBitmapDCCreated()
     const {
   return hdc_ != NULL;
 }
 
 
 void BitmapPlatformDevice::SetMatrixClip(
     const SkMatrix& transform,
     const SkRegion& region) {
   transform_ = transform;
   clip_region_ = region;
   config_dirty_ = true;
 }
 
 void BitmapPlatformDevice::LoadConfig() {
   if (!config_dirty_ || !hdc_)
     return;  // Nothing to do.
   config_dirty_ = false;
 
   // Transform.
   LoadTransformToDC(hdc_, transform_);
   LoadClippingRegionToDC(hdc_, clip_region_, transform_);
 }
 
 static void DeleteHBitmapCallback(void* addr, void* context) {
-  DeleteObject(static_cast<HBITMAP>(context));
+  // If context is not NULL then it's a valid HBITMAP to delete.
+  // Otherwise we just unmap the pixel memory.
+  if (context)
+    DeleteObject(static_cast<HBITMAP>(context));
+  else
+    UnmapViewOfFile(addr);
 }
 
 static bool InstallHBitmapPixels(SkBitmap* bitmap, int width, int height,
                                  bool is_opaque, void* data, HBITMAP hbitmap) {
   const SkAlphaType at = is_opaque ? kOpaque_SkAlphaType : kPremul_SkAlphaType;
   const SkImageInfo info = SkImageInfo::MakeN32(width, height, at);
   const size_t rowBytes = info.minRowBytes();
   SkColorTable* color_table = NULL;
   return bitmap->installPixels(info, data, rowBytes, color_table,
                                DeleteHBitmapCallback, hbitmap);
 }
 
 // We use this static factory function instead of the regular constructor so
 // that we can create the pixel data before calling the constructor. This is
 // required so that we can call the base class' constructor with the pixel
 // data.
 BitmapPlatformDevice* BitmapPlatformDevice::Create(
     int width,
     int height,
     bool is_opaque,
     HANDLE shared_section,
     bool do_clear) {
 
   void* data;
-  HBITMAP hbitmap = CreateHBitmap(width, height, is_opaque, shared_section,
+
+  HBITMAP hbitmap = NULL;
+
+  if (IsWin32kLockdownEnabled()) {
+    CHECK(shared_section != NULL);
+    data = MapViewOfFile(shared_section, FILE_MAP_WRITE,
+        0, 0, width * height * 4);
+    DCHECK(data != NULL);
+    if (!data)
+      return NULL;
+  } else {
+    hbitmap = CreateHBitmap(width, height, is_opaque, shared_section,
                                   &data);
-  if (!hbitmap)
-    return NULL;
+    if (!hbitmap)
+      return NULL;
+  }
 
   SkBitmap bitmap;
   if (!InstallHBitmapPixels(&bitmap, width, height, is_opaque, data, hbitmap))
     return NULL;
 
   if (do_clear)
     bitmap.eraseColor(0);
 
 #ifndef NDEBUG
   // If we were given data, then don't clobber it!
@@ skipping 23 matching lines @@
     const SkBitmap& bitmap)
     : SkBitmapDevice(bitmap),
       hbitmap_(hbitmap),
       old_hbitmap_(NULL),
       hdc_(NULL),
       config_dirty_(true),  // Want to load the config next time.
       transform_(SkMatrix::I()) {
   // The data object is already ref'ed for us by create().
   SkDEBUGCODE(begin_paint_count_ = 0);
   SetPlatformDevice(this, this);
-  // Initialize the clip region to the entire bitmap.
-  BITMAP bitmap_data;
-  if (GetObject(hbitmap_, sizeof(BITMAP), &bitmap_data)) {
-    SkIRect rect;
-    rect.set(0, 0, bitmap_data.bmWidth, bitmap_data.bmHeight);
-    clip_region_ = SkRegion(rect);
+  if (hbitmap) {
+    // Initialize the clip region to the entire bitmap.
+    BITMAP bitmap_data;
+    if (GetObject(hbitmap_, sizeof(BITMAP), &bitmap_data)) {
+      SkIRect rect;
+      rect.set(0, 0, bitmap_data.bmWidth, bitmap_data.bmHeight);
+      clip_region_ = SkRegion(rect);
+    }
   }
 }
 
 BitmapPlatformDevice::~BitmapPlatformDevice() {
   SkASSERT(begin_paint_count_ == 0);
   if (hdc_)
     ReleaseBitmapDC();
 }
 
 HDC BitmapPlatformDevice::BeginPlatformPaint() {
   SkDEBUGCODE(begin_paint_count_++);
   return GetBitmapDC();
 }
 
 void BitmapPlatformDevice::EndPlatformPaint() {
   SkASSERT(begin_paint_count_--);
   PlatformDevice::EndPlatformPaint();
 }
 
 void BitmapPlatformDevice::setMatrixClip(const SkMatrix& transform,
                                          const SkRegion& region,
                                          const SkClipStack&) {
   SetMatrixClip(transform, region);
 }
 
 void BitmapPlatformDevice::DrawToHDC(HDC dc, int x, int y,
                                      const RECT* src_rect) {
+  DCHECK(!IsWin32kLockdownEnabled());
+
   bool created_dc = !IsBitmapDCCreated();
   HDC source_dc = BeginPlatformPaint();
 
   RECT temp_rect;
   if (!src_rect) {
     temp_rect.left = 0;
     temp_rect.right = width();
     temp_rect.top = 0;
     temp_rect.bottom = height();
     src_rect = &temp_rect;
@@ skipping 72 matching lines @@
 
 PlatformBitmap::~PlatformBitmap() {
   if (surface_) {
     if (platform_extra_)
       SelectObject(surface_, reinterpret_cast<HGDIOBJ>(platform_extra_));
     DeleteDC(surface_);
   }
 }
 
 bool PlatformBitmap::Allocate(int width, int height, bool is_opaque) {
+  DCHECK(!IsWin32kLockdownEnabled());
   void* data;
   HBITMAP hbitmap = CreateHBitmap(width, height, is_opaque, 0, &data);
   if (!hbitmap)
     return false;
 
   surface_ = CreateCompatibleDC(NULL);
   InitializeDC(surface_);
   // When the memory DC is created, its display surface is exactly one
   // monochrome pixel wide and one monochrome pixel high. Save this object
   // off, we'll restore it just before deleting the memory DC.
   HGDIOBJ stock_bitmap = SelectObject(surface_, hbitmap);
   platform_extra_ = reinterpret_cast<intptr_t>(stock_bitmap);
 
   if (!InstallHBitmapPixels(&bitmap_, width, height, is_opaque, data, hbitmap))
     return false;
   bitmap_.lockPixels();
 
   return true;
 }
 
 }  // namespace skia