Add a size parameter to SharedMemoryHandle.

sandbox/win/src/process_mitigations_win32k_dispatcher.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/process_mitigations_win32k_dispatcher.h"
 
 #include <algorithm>
 
 #include "base/memory/shared_memory.h"
 #include "base/strings/string16.h"
 #include "base/unguessable_token.h"
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/interception.h"
 #include "sandbox/win/src/interceptors.h"
 #include "sandbox/win/src/ipc_tags.h"
 #include "sandbox/win/src/process_mitigations_win32k_interception.h"
 #include "sandbox/win/src/process_mitigations_win32k_policy.h"
 
 namespace sandbox {
 
 namespace {
 
 base::SharedMemoryHandle GetSharedMemoryHandle(const ClientInfo& client_info,
-                                               HANDLE handle) {
+                                               HANDLE handle,
+                                               size_t size) {
   HANDLE result_handle = nullptr;
   intptr_t handle_int = reinterpret_cast<intptr_t>(handle);
   if (handle_int <= 0 ||
       !::DuplicateHandle(client_info.process, handle, ::GetCurrentProcess(),
                          &result_handle, 0, FALSE, DUPLICATE_SAME_ACCESS)) {
     result_handle = nullptr;
   }
-  return base::SharedMemoryHandle(result_handle,
+  return base::SharedMemoryHandle(result_handle, size,
                                   base::UnguessableToken::Create());
 }
 
 }  // namespace
 
 ProtectedVideoOutput::~ProtectedVideoOutput() {
   ProcessMitigationsWin32KLockdownPolicy::DestroyOPMProtectedOutputAction(
       handle_);
 }
 
@@ skipping 361 matching lines @@
     uint32_t shared_buffer_size) {
   if (!policy_base_->GetEnableOPMRedirection()) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   // Don't let caller map an arbitrarily large buffer into memory.
   if (shared_buffer_size > kProtectedVideoOutputSectionSize) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
-  base::SharedMemoryHandle handle =
-      GetSharedMemoryHandle(*ipc->client_info, shared_buffer_handle);
+  base::SharedMemoryHandle handle = GetSharedMemoryHandle(
+      *ipc->client_info, shared_buffer_handle, shared_buffer_size);
   if (!handle.IsValid()) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   base::SharedMemory cert_data(handle, false);
   if (!cert_data.Map(shared_buffer_size)) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   NTSTATUS status = STATUS_INVALID_PARAMETER;
@@ skipping 83 matching lines @@
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   scoped_refptr<ProtectedVideoOutput> output =
       GetProtectedVideoOutput(protected_output, false);
   if (!output) {
     ipc->return_info.nt_status = STATUS_INVALID_HANDLE;
     return true;
   };
   base::SharedMemoryHandle handle =
-      GetSharedMemoryHandle(*ipc->client_info, shared_buffer_handle);
+      GetSharedMemoryHandle(*ipc->client_info, shared_buffer_handle,
+                            sizeof(DXGKMDT_OPM_CONFIGURE_PARAMETERS));
   if (!handle.IsValid()) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   base::SharedMemory buffer(handle, false);
   if (!buffer.Map(sizeof(DXGKMDT_OPM_CONFIGURE_PARAMETERS))) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   NTSTATUS status =
@@ skipping 10 matching lines @@
   if (!policy_base_->GetEnableOPMRedirection()) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   scoped_refptr<ProtectedVideoOutput> output =
       GetProtectedVideoOutput(protected_output, false);
   if (!output) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
-  base::SharedMemoryHandle handle =
-      GetSharedMemoryHandle(*ipc->client_info, shared_buffer_handle);
+  size_t shared_buffer_size =
+      std::max(sizeof(DXGKMDT_OPM_GET_INFO_PARAMETERS),
+               sizeof(DXGKMDT_OPM_REQUESTED_INFORMATION));
+
+  base::SharedMemoryHandle handle = GetSharedMemoryHandle(
+      *ipc->client_info, shared_buffer_handle, shared_buffer_size);
   if (!handle.IsValid()) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   base::SharedMemory buffer(handle, false);
 
-  size_t shared_buffer_size =
-      std::max(sizeof(DXGKMDT_OPM_GET_INFO_PARAMETERS),
-               sizeof(DXGKMDT_OPM_REQUESTED_INFORMATION));
   if (!buffer.Map(shared_buffer_size)) {
     ipc->return_info.nt_status = STATUS_ACCESS_DENIED;
     return true;
   }
   DXGKMDT_OPM_REQUESTED_INFORMATION requested_info = {};
   NTSTATUS status =
       ProcessMitigationsWin32KLockdownPolicy::GetOPMInformationAction(
           *ipc->client_info, output.get()->handle(), buffer.memory(),
           &requested_info);
   if (!status) {
     memcpy(buffer.memory(), &requested_info,
            sizeof(DXGKMDT_OPM_REQUESTED_INFORMATION));
   }
   ipc->return_info.nt_status = status;
   return true;
 }
 
 }  // namespace sandbox