Replace handles that the handle closer closes with dummy Events.

sandbox/win/src/handle_closer_agent.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/handle_closer_agent.h"
 
 #include "base/logging.h"
 #include "sandbox/win/src/nt_internals.h"
 #include "sandbox/win/src/win_utils.h"
 
@@ skipping 23 matching lines @@
 
 namespace sandbox {
 
 // Memory buffer mapped from the parent, with the list of handles.
 SANDBOX_INTERCEPT HandleCloserInfo* g_handles_to_close = NULL;
 
 bool HandleCloserAgent::NeedsHandlesClosed() {
   return g_handles_to_close != NULL;
 }
 
+HandleCloserAgent::HandleCloserAgent()
+    : dummy_handle_(::CreateEvent(NULL, FALSE, FALSE, NULL)) {
+}
+

[cpu_(ooo_6.6-7.5), 2015/02/19 00:10:02]

write a comment here about the technique including the dup with 0 access.

+bool HandleCloserAgent::AttemptToStuffHandleSlot(HANDLE closed_handle,
+                                                 const base::string16& type) {
+  // Only attempt to stuff Files and Events at the moment.
+  if (type != L"Event" && type != L"File") {
+    return true;
+  }
+
+  if (!dummy_handle_.IsValid())
+    return false;
+
+  // This should never happen, as g_dummy is created before closing to_stuff.
+  DCHECK(dummy_handle_.Get() != closed_handle);
+
+  std::vector<HANDLE> to_close;
+  HANDLE dup_dummy = NULL;
+  size_t count = 16;
+
+  do {
+    if (!::DuplicateHandle(::GetCurrentProcess(), dummy_handle_.Get(),
+                           ::GetCurrentProcess(), &dup_dummy, 0, FALSE, 0))
+      break;
+    if (dup_dummy != closed_handle)
+      to_close.push_back(dup_dummy);
+  } while (count-- &&
+           reinterpret_cast<uintptr_t>(dup_dummy) <
+               reinterpret_cast<uintptr_t>(closed_handle));
+
+  for (auto h : to_close)
+    ::CloseHandle(h);
+
+  // Useful to know when we're not able to stuff handles.
+  DCHECK(dup_dummy == closed_handle);
+
+  return dup_dummy == closed_handle;
+}
+
 // Reads g_handles_to_close and creates the lookup map.
 void HandleCloserAgent::InitializeHandlesToClose() {
   CHECK(g_handles_to_close != NULL);
 
   // Grab the header.
   HandleListEntry* entry = g_handles_to_close->handle_entries;
   for (size_t i = 0; i < g_handles_to_close->num_handle_types; ++i) {
     // Set the type name.
     base::char16* input = entry->handle_type;
     HandleMap::mapped_type& handle_names = handles_to_close_[input];
@@ skipping 75 matching lines @@
       if (!names.empty()) {
         // Move on to the next handle if this name doesn't match.
         if (!GetHandleName(handle, &handle_name) || !names.count(handle_name))
           continue;
       }
 
       if (!::SetHandleInformation(handle, HANDLE_FLAG_PROTECT_FROM_CLOSE, 0))
         return false;
       if (!::CloseHandle(handle))
         return false;
+      // Attempt to stuff this handle with a new dummy Event.
+      AttemptToStuffHandleSlot(handle, result->first);
     }
   }
 
   return true;
 }
 
 }  // namespace sandbox