[Windows CFG Test] Added unittest for CFG enabling on process.

sandbox/win/tests/integration_tests/cfi_unittest.cc

Index: sandbox/win/tests/integration_tests/cfi_unittest.cc
diff --git a/sandbox/win/tests/integration_tests/cfi_unittest.cc b/sandbox/win/tests/integration_tests/cfi_unittest.cc
new file mode 100644
index 0000000000000000000000000000000000000000..003ec6033d7843cd254628fcf0d6eb5cc3a58629
--- /dev/null
+++ b/sandbox/win/tests/integration_tests/cfi_unittest.cc
@@ -0,0 +1,58 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#include <windows.h>
+
+#include "base/command_line.h"
+#include "base/files/file_util.h"
+#include "base/process/launch.h"
+#include "base/test/test_timeouts.h"
+#include "base/win/windows_version.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+const wchar_t* kExeFilename = L"cfi_unittest_exe.exe";

[Will Harris, 2017/02/10 22:38:47]

Declare variables as close to them being used as possible, so below in the
function. (chromium coding standard...)

[penny, 2017/02/13 18:47:00]

Done.

+const wchar_t* kSysDllTest = L"1";
+
+}  // namespace
+
+namespace sandbox {
+
+// Make sure Microsoft binaries, that are compiled with CFG enabled, catch
+// a hook and throw an exception.
+// - If this test fails, the expected CFG exception did NOT happen.  This
+//   indicates a build system change that has disabled Chrome process-wide CFG.
+TEST(CFGSupportTests, MsIndirectFailure) {
+  // CFG is only supported on >= Win8.1 Update 3.
+  // Not checking for update, since test infra is updated and it would add
+  // a lot of complexity.
+  if (base::win::GetVersion() < base::win::VERSION_WIN8_1)
+    return;
+
+// ASLR must be enabled for CFG to be enabled.  As ASLR is disabled in debug
+// builds, so must be CFG.
+#if !defined(NDEBUG)

[Will Harris, 2017/02/10 22:38:47]

Consider just commenting out the entire test, instead of making it pass on debug
builds?

[penny, 2017/02/13 18:47:00]

Done. I'm fine either way.

+  return;
+#endif  // !defined(NDEBUG)
+
+  base::CommandLine cmd_line = base::CommandLine::FromString(kExeFilename);
+  cmd_line.AppendArgNative(kSysDllTest);
+
+  base::Process proc =
+      base::LaunchProcess(cmd_line, base::LaunchOptionsForTest());
+  ASSERT_TRUE(proc.IsValid());
+
+  int exit_code = 0;
+  if (!proc.WaitForExitWithTimeout(TestTimeouts::action_timeout(),
+                                   &exit_code)) {
+    // Timeout while waiting.  Try to cleanup.
+    proc.Terminate(1, false);
+    ADD_FAILURE();
+    return;
+  }
+
+  // CFG security check failure.
+  ASSERT_EQ(STATUS_STACK_BUFFER_OVERRUN, static_cast<DWORD>(exit_code));
+}
+
+}  // namespace sandbox