Added protection against mapping image sections between processes.

sandbox/win/src/target_process.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/target_process.h"
 
 #include "base/basictypes.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/win/pe_image.h"
@@ skipping 266 matching lines @@
   // We use this single memory pool for IPC and for policy.
   DWORD shared_mem_size = static_cast<DWORD>(shared_IPC_size +
                                              shared_policy_size);
   shared_section_.Set(::CreateFileMappingW(INVALID_HANDLE_VALUE, NULL,
                                            PAGE_READWRITE | SEC_COMMIT,
                                            0, shared_mem_size, NULL));
   if (!shared_section_.IsValid()) {
     return ::GetLastError();
   }
 
-  DWORD access = FILE_MAP_READ | FILE_MAP_WRITE;
+  DWORD access = FILE_MAP_READ | FILE_MAP_WRITE | SECTION_QUERY;
   HANDLE target_shared_section;
   if (!::DuplicateHandle(::GetCurrentProcess(), shared_section_.Get(),
                          sandbox_process_info_.process_handle(),
                          &target_shared_section, access, FALSE, 0)) {
     return ::GetLastError();
   }
 
   void* shared_memory = ::MapViewOfFile(shared_section_.Get(),
                                         FILE_MAP_WRITE|FILE_MAP_READ,
                                         0, 0, 0);
@@ skipping 57 matching lines @@
       new TargetProcess(base::win::ScopedHandle(), base::win::ScopedHandle(),
                         base::win::ScopedHandle(), NULL, NULL);
   PROCESS_INFORMATION process_info = {};
   process_info.hProcess = process;
   target->sandbox_process_info_.Set(process_info);
   target->base_address_ = base_address;
   return target;
 }
 
 }  // namespace sandbox