Sandbox: Update for Windows 8.1

sandbox/win/src/sandbox_nt_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/sandbox_nt_util.h"
 
 #include "base/win/pe_image.h"
 #include "sandbox/win/src/sandbox_factory.h"
 #include "sandbox/win/src/target_services.h"
 
 namespace sandbox {
 
 // This is the list of all imported symbols from ntdll.dll.
 SANDBOX_INTERCEPT NtExports g_nt = { NULL };
 
-}  // namespace
+}  // namespace sandbox
 
 namespace {
 
 #if defined(_WIN64)
 void* AllocateNearTo(void* source, size_t size) {
   using sandbox::g_nt;
 
   // Start with 1 GB above the source.
-  const unsigned int kOneGB = 0x40000000;
+  const size_t kOneGB = 0x40000000;
   void* base = reinterpret_cast<char*>(source) + kOneGB;
   SIZE_T actual_size = size;
   ULONG_PTR zero_bits = 0;  // Not the correct type if used.
   ULONG type = MEM_RESERVE;
 
-  if (reinterpret_cast<SIZE_T>(source) > 0x7ff80000000) {
-    // We are at the top of the address space. Let's try the highest available
-    // address.
-    base = NULL;
-    type |= MEM_TOP_DOWN;
-  }
-
   NTSTATUS ret;
   int attempts = 0;
-  for (; attempts < 20; attempts++) {
+  for (; attempts < 41; attempts++) {

[cpu_(ooo_6.6-7.5), 2013/09/20 02:40:39]

I thought the answer was 42 :p

[rvargas (doing something else), 2013/09/20 02:42:24]

Better not risk melting down the computer

     ret = g_nt.AllocateVirtualMemory(NtCurrentProcess, &base, zero_bits,
                                      &actual_size, type, PAGE_READWRITE);
     if (NT_SUCCESS(ret)) {
-      if (base < source) {
+      if (base < source ||
+          base >= reinterpret_cast<char*>(source) + 4 * kOneGB) {
         // We won't be able to patch this dll.
         VERIFY_SUCCESS(g_nt.FreeVirtualMemory(NtCurrentProcess, &base, &size,
                                               MEM_RELEASE));
         return NULL;
       }
       break;
     }
 
+    if (attempts == 30) {
+      // Try the first GB.
+      base = reinterpret_cast<char*>(source);
+    } else if (attempts == 40) {
+      // Try the highest available address.
+      base = NULL;
+      type |= MEM_TOP_DOWN;
+    }
+
     // Try 100 MB higher.
     base = reinterpret_cast<char*>(base) + 100 * 0x100000;
   };
 
-  if (attempts == 20)
+  if (attempts == 41)
     return NULL;
 
   ret = g_nt.AllocateVirtualMemory(NtCurrentProcess, &base, zero_bits,
                                    &actual_size, MEM_COMMIT, PAGE_READWRITE);
 
   if (!NT_SUCCESS(ret)) {
     VERIFY_SUCCESS(g_nt.FreeVirtualMemory(NtCurrentProcess, &base, &size,
                                           MEM_RELEASE));
     base = NULL;
   }
@@ skipping 522 matching lines @@
   UNREFERENCED_PARAMETER(type);
   return buffer;
 }
 
 void __cdecl operator delete(void* memory, void* buffer,
                              sandbox::AllocationType type) {
   UNREFERENCED_PARAMETER(memory);
   UNREFERENCED_PARAMETER(buffer);
   UNREFERENCED_PARAMETER(type);
 }