Add eight more bits of entropy to the sandbox intercept trampoline

sandbox/src/interception.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // For information about interceptions as a whole see
 // http://dev.chromium.org/developers/design-documents/sandbox .
 
 #include <set>
 
 #include "sandbox/src/interception.h"
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/win/pe_image.h"
 #include "base/win/windows_version.h"
 #include "sandbox/src/interception_internal.h"
 #include "sandbox/src/interceptors.h"
 #include "sandbox/src/sandbox.h"
 #include "sandbox/src/sandbox_utils.h"
 #include "sandbox/src/service_resolver.h"
 #include "sandbox/src/target_interceptions.h"
 #include "sandbox/src/target_process.h"
 #include "sandbox/src/wow64.h"
 
 namespace {
 
 const char kMapViewOfSectionName[] = "NtMapViewOfSection";
 const char kUnmapViewOfSectionName[] = "NtUnmapViewOfSection";
 
+// Standard allocation granularity and page size for Windows.
+const size_t kAllocGranularity = 65536;
+const size_t kPageSize = 4096;
+
+// Find a random offset within 64k and aligned to ceil(log2(size)).
+size_t GetGranularAlignedRandomOffset(size_t size) {
+  CHECK_LE(size, kAllocGranularity);
+  unsigned int offset;
+
+  do {
+    rand_s(&offset);
+    offset &= (kAllocGranularity - 1);
+  } while (offset > (kAllocGranularity - size));
+
+  // Find an alignment between 64 and the page size (4096).
+  size_t align_size = kPageSize;
+  for (size_t new_size = align_size / 2;  new_size >= size; new_size /= 2) {
+    align_size = new_size;
+  }
+  return offset & ~(align_size - 1);
+}
+
 }  // namespace
 
 namespace sandbox {
 
 SANDBOX_INTERCEPT SharedMemory* g_interceptions;
 
 // Table of the unpatched functions that we intercept. Mapped from the parent.
 SANDBOX_INTERCEPT OriginalFunctions g_originals = { NULL };
 
 // Magic constant that identifies that this function is not to be patched.
@@ skipping 313 matching lines @@
     #pragma comment(linker, "/include:TargetNtUnmapViewOfSection64")
 #else
     #pragma comment(linker, "/include:_TargetNtMapViewOfSection@44")
     #pragma comment(linker, "/include:_TargetNtUnmapViewOfSection@12")
 #endif
 #endif
     ADD_NT_INTERCEPTION(NtMapViewOfSection, MAP_VIEW_OF_SECTION_ID, 44);
     ADD_NT_INTERCEPTION(NtUnmapViewOfSection, UNMAP_VIEW_OF_SECTION_ID, 12);
   }
 
+  // Reserve a full 64k memory range in the child process.
+  HANDLE child = child_->Process();
+  BYTE* thunk_base = reinterpret_cast<BYTE*>(
+                         ::VirtualAllocEx(child, NULL, kAllocGranularity,
+                                          MEM_RESERVE, PAGE_NOACCESS));
+
+  // Find an aligned, random location within the reserved range.
   size_t thunk_bytes = interceptions_.size() * sizeof(ThunkData) +
                        sizeof(DllInterceptionData);
+  size_t thunk_offset = GetGranularAlignedRandomOffset(thunk_bytes);
 
-  // Allocate memory on the child, without specifying the desired address
-  HANDLE child = child_->Process();
+  // Split the base and offset along page boundaries.
+  thunk_base += thunk_offset & ~(kPageSize - 1);
+  thunk_offset &= kPageSize - 1;
+
+  // Make an aligned, padded allocation, and move the pointer to our chunk.
+  size_t thunk_bytes_padded = (thunk_bytes + kPageSize - 1) & kPageSize;
+  thunk_base = reinterpret_cast<BYTE*>(
+                   ::VirtualAllocEx(child, thunk_base, thunk_bytes_padded,
+                                    MEM_COMMIT, PAGE_EXECUTE_READWRITE));
+  CHECK(thunk_base);  // If this fails we'd crash anyway on an invalid access.
   DllInterceptionData* thunks = reinterpret_cast<DllInterceptionData*>(
-                                    ::VirtualAllocEx(child, NULL, thunk_bytes,
-                                                     MEM_COMMIT,
-                                                     PAGE_EXECUTE_READWRITE));
+                                    thunk_base + thunk_offset);
 
   DllInterceptionData dll_data;
   dll_data.data_bytes = thunk_bytes;
   dll_data.num_thunks = 0;
   dll_data.used_bytes = offsetof(DllInterceptionData, thunks);
 
   // Reset all helpers for a new child.
   memset(g_originals, 0, sizeof(g_originals));
 
   // this should write all the individual thunks to the child's memory
@@ skipping 124 matching lines @@
     ::FreeLibrary(local_interceptor);
 #endif
 
   if (it != interceptions_.end())
     return false;
 
   return true;
 }
 
 }  // namespace sandbox