[Sandbox service resolver hooks] Remove the RET hijacking in ntdll.

sandbox/win/src/service_resolver_64.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/service_resolver.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/win_utils.h"
 
@@ skipping 121 matching lines @@
 namespace sandbox {
 
 NTSTATUS ServiceResolverThunk::Setup(const void* target_module,
                                      const void* interceptor_module,
                                      const char* target_name,
                                      const char* interceptor_name,
                                      const void* interceptor_entry_point,
                                      void* thunk_storage,
                                      size_t storage_bytes,
                                      size_t* storage_used) {
-  NTSTATUS ret = Init(target_module, interceptor_module, target_name,
-                      interceptor_name, interceptor_entry_point,
-                      thunk_storage, storage_bytes);
+  NTSTATUS ret =
+      Init(target_module, interceptor_module, target_name, interceptor_name,
+           interceptor_entry_point, thunk_storage, storage_bytes);
   if (!NT_SUCCESS(ret))
     return ret;
 
   size_t thunk_bytes = GetThunkSize();
   scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]);
   ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(
                                 thunk_buffer.get());
 
   if (!IsFunctionAService(&thunk->original))
     return STATUS_UNSUCCESSFUL;
@@ skipping 51 matching lines @@
   // Save the verified code.
   memcpy(local_thunk, &function_code, sizeof(function_code));
 
   return true;
 }
 
 NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk,
                                             void* remote_thunk) {
   // Patch the original code.
   ServiceEntry local_service;
-  DCHECK_NT(GetInternalThunkSize() >= sizeof(local_service));
+  DCHECK_NT(GetInternalThunkSize() <= sizeof(local_service));

[jschuh, 2015/12/08 01:19:42]

Heh, that's an interesting one.

   if (!SetInternalThunk(&local_service, sizeof(local_service), NULL,
                         interceptor_))
     return STATUS_UNSUCCESSFUL;
 
   // Copy the local thunk buffer to the child.
   SIZE_T actual;
   if (!::WriteProcessMemory(process_, remote_thunk, local_thunk,
                             sizeof(ServiceFullThunk), &actual))
     return STATUS_UNSUCCESSFUL;
 
@@ skipping 14 matching lines @@
 
   return STATUS_SUCCESS;
 }
 
 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const {
   NOTREACHED_NT();
   return false;
 }
 
 }  // namespace sandbox