Add sandbox support for process memory limits

sandbox/win/src/broker_services.cc

Index: sandbox/win/src/broker_services.cc
diff --git a/sandbox/win/src/broker_services.cc b/sandbox/win/src/broker_services.cc
index 54d87c44750e6d4e3b8b7474c90dfe807be036dc..aefd8793515341ab67433394b02837b5314c8647 100644
--- a/sandbox/win/src/broker_services.cc
+++ b/sandbox/win/src/broker_services.cc
@@ -137,7 +137,7 @@ BrokerServicesBase::~BrokerServicesBase() {
   JobTrackerList::iterator it;
   for (it = tracker_list_.begin(); it != tracker_list_.end(); ++it) {
     JobTracker* tracker = (*it);
-    FreeResources(tracker);
+    FreeResources(tracker, SBOX_ALL_OK);
     delete tracker;
   }
   ::CloseHandle(job_thread_);
@@ -161,9 +161,9 @@ TargetPolicy* BrokerServicesBase::CreatePolicy() {
   return new PolicyBase;
 }
 
-void BrokerServicesBase::FreeResources(JobTracker* tracker) {
+void BrokerServicesBase::FreeResources(JobTracker* tracker, UINT exit_code) {
   if (NULL != tracker->policy) {
-    BOOL res = ::TerminateJobObject(tracker->job, SBOX_ALL_OK);
+    BOOL res = ::TerminateJobObject(tracker->job, exit_code);
     DCHECK(res);
     // Closing the job causes the target process to be destroyed so this
     // needs to happen before calling OnJobEmpty().
@@ -216,7 +216,7 @@ DWORD WINAPI BrokerServicesBase::TargetEventsThread(PVOID param) {
           // to appear out of thin air in this job, it safe to assume that
           // we can tell the policy to destroy the target object, and for
           // us to release our reference to the policy object.
-          FreeResources(tracker);
+          FreeResources(tracker, SBOX_ALL_OK);
           break;
         }
 
@@ -246,6 +246,12 @@ DWORD WINAPI BrokerServicesBase::TargetEventsThread(PVOID param) {
           break;
         }
 
+        case JOB_OBJECT_MSG_PROCESS_MEMORY_LIMIT: {
+          if(tracker->policy->WillTerminateOnJobMemoryLimit())
+            FreeResources(tracker, SBOX_FATAL_MEMORY_EXCEEDED);

[cpu_(ooo_6.6-7.5), 2014/06/06 19:44:05]

The code seems structured such that FreeResources() is only called once, that is
don't we also get JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO after this?

[jschuh, 2014/06/06 20:13:14]

Calling FreeResources here terminates the process without generating another
JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO event. That seemed cleaner than terminating
the process and then firing the event and doing the cleanup in another handler.

+          break;
+        }
+
         default: {
           NOTREACHED();
           break;