CSRSS lockdown: destroy CSRSS heap

sandbox/win/src/heap_helper.cc

Index: sandbox/win/src/heap_helper.cc
diff --git a/sandbox/win/src/heap_helper.cc b/sandbox/win/src/heap_helper.cc
new file mode 100644
index 0000000000000000000000000000000000000000..83d648a4d11744fc7a6534e88f51dac7e517096b
--- /dev/null
+++ b/sandbox/win/src/heap_helper.cc
@@ -0,0 +1,51 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/win/src/heap_helper.h"
+
+#include <windows.h>
+
+#include "base/memory/ref_counted.h"
+
+namespace sandbox {
+
+// These are undocumented, but readily found on the internet.
+#define HEAP_CLASS_8 0x00008000  // CSR port heap
+#define HEAP_CLASS_MASK 0x0000f000
+
+// This structure is not documented, but we only care about the flags field.
+struct _HEAP {
+  char reserved[0x70];
+  DWORD flags;
+};
+
+DWORD HeapFlags(HANDLE handle) {
+  _HEAP* heap = reinterpret_cast<_HEAP*>(handle);

[Will Harris, 2017/03/22 19:21:49]

is there any validation that can be done here that the code is actually dealing
with a valid heap handle?

[liamjm (20p), 2017/04/14 17:27:20]

I've added nullptr checks.

We could use ntdll!RtlValidateHeap to check if this a valid heap?

Or we could add a check of the signature (ie magic bytes) (something similiar to
ntdll!RtlpCheckHeapSignature, which is called by ntdll!RtlValidateHeap)

Thoughts?

+  return heap->flags;
+}
+
+HANDLE FindCsrPortHeap() {
+  DWORD number_of_heaps = ::GetProcessHeaps(0, NULL);
+  std::unique_ptr<HANDLE[]> all_heaps(new HANDLE[number_of_heaps]);
+  if (::GetProcessHeaps(number_of_heaps, all_heaps.get()) != number_of_heaps)
+    return nullptr;
+
+  // Let's search for the CSR port heap handle, which we identify purely based

[Will Harris, 2017/03/22 19:21:49]

nit: in chromium convention is to avoid use of 'us' and 'we' and prefer to just
state the operation happening

e.g.

"Search for the CSR port heap handle, identified purely based on flags."

or something like that. (also elsewhere)

[liamjm (20p), 2017/04/14 17:27:20]

Done.

+  // on flags.
+  HANDLE csr_port_heap = nullptr;
+  for (size_t i = 0; i < number_of_heaps; ++i) {
+    HANDLE handle = all_heaps[i];
+    DWORD flags = HeapFlags(handle);
+    if ((flags & HEAP_CLASS_MASK) == HEAP_CLASS_8) {
+      if (nullptr != csr_port_heap) {
+        LOG(ERROR) << "Found multiple suitable CSR Port heaps";
+        return nullptr;
+      }
+      csr_port_heap = handle;
+    }
+  }
+  return csr_port_heap;
+}
+
+}  // namespace sandbox