Randomize mach_override_ptr trampoline addresses on 32-bit

third_party/mach_override/mach_override.c

 /*******************************************************************************
         mach_override.c
                 Copyright (c) 2003-2009 Jonathan 'Wolf' Rentzsch: <http://rentzsch.com>
                 Some rights reserved: <http://opensource.org/licenses/mit-license.php>
 
         ***************************************************************************/
 
 #include "mach_override.h"
 
 #include <mach-o/dyld.h>
 #include <mach/mach_host.h>
 #include <mach/mach_init.h>
 #include <mach/vm_map.h>
+#include <mach/vm_statistics.h>
 #include <sys/mman.h>
 
 #include <CoreServices/CoreServices.h>
 
 /**************************
 *       
 *       Constants
 *       
 **************************/
 #pragma mark    -
@@ skipping 348 matching lines @@
         ***************************************************************************/
 
         mach_error_t
 allocateBranchIsland(
                 BranchIsland    **island,
                 void *originalFunctionAddress)
 {
         assert( island );
         
         assert( sizeof( BranchIsland ) <= kPageSize );
+#if defined(__i386__)
+        vm_address_t page = 0;
+        mach_error_t err = vm_allocate( mach_task_self(), &page, kPageSize, VM_FLAGS_ANYWHERE );
+        if( err == err_none ) {
+                *island = (BranchIsland*) page;
+                return err_none;
+        }
+        return err;
+#else
+
 #if defined(__ppc__) || defined(__POWERPC__)
         vm_address_t first = 0xfeffffff;
         vm_address_t last = 0xfe000000 + kPageSize;
 #elif defined(__x86_64__)
         vm_address_t first = ((uint64_t)originalFunctionAddress & ~(uint64_t)(((uint64_t)1 << 31) - 1)) | ((uint64_t)1 << 31); // start in the middle of the page?
         vm_address_t last = 0x0;
-#else
-        vm_address_t first = 0xffc00000;
-        vm_address_t last = 0xfffe0000;
 #endif
 
         vm_address_t page = first;
         vm_map_t task_self = mach_task_self();
 
         while( page != last ) {
                 mach_error_t err = vm_allocate( task_self, &page, kPageSize, 0 );
                 if( err == err_none ) {
                         *island = (BranchIsland*) page;
                         return err_none;
                 }
                 if( err != KERN_NO_SPACE )
                         return err;
 #if defined(__x86_64__)
                 page -= kPageSize;
 #else
                 page += kPageSize;
 #endif
                 err = err_none;
         }
 
         return KERN_NO_SPACE;
+#endif
 }
 
 /***************************************************************************//**
         Implementation: Deallocates memory for a branch island.
         
         @param  island  ->      The island to deallocate.
         @result                 <-      mach_error_t
 
         ***************************************************************************/
 
@@ skipping 296 matching lines @@
 );
 #elif defined(__x86_64__)
 void atomic_mov64(
                 uint64_t *targetAddress,
                 uint64_t value )
 {
     *targetAddress = value;
 }
 #endif
 #endif