Add eight more bits of entropy to the sandbox intercept trampoline

sandbox/src/target_process.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/src/target_process.h"
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/win/pe_image.h"
 #include "base/win/windows_version.h"
@@ skipping 29 matching lines @@
   }
 }
 
 // Reserve a random range at the bottom of the address space in the target
 // process to prevent predictable alocations at low addresses.
 void PoisonLowerAddressRange(HANDLE process) {
   unsigned int limit;
   rand_s(&limit);
   char* ptr = 0;
   const size_t kMask64k = 0xFFFF;
-  // Random range (512k-4.5mb) in 64k steps.
-  const char* end = ptr + ((((limit % 4096) + 512) * 1024) & ~kMask64k);
+  // Random range (512k-16.5mb) in 64k steps.
+  const char* end = ptr + ((((limit % 16384) + 512) * 1024) & ~kMask64k);
   while (ptr < end) {
     MEMORY_BASIC_INFORMATION memory_info;
     if (!::VirtualQueryEx(process, ptr, &memory_info, sizeof(memory_info)))
       break;
     size_t size = std::min((memory_info.RegionSize + kMask64k) & ~kMask64k,
                            static_cast<SIZE_T>(end - ptr));
     if (ptr && memory_info.State == MEM_FREE)
       ::VirtualAllocEx(process, ptr, size, MEM_RESERVE, PAGE_NOACCESS);
     ptr += size;
   }
@@ skipping 288 matching lines @@
 
 
 TargetProcess* MakeTestTargetProcess(HANDLE process, HMODULE base_address) {
   TargetProcess* target = new TargetProcess(NULL, NULL, NULL, NULL);
   target->sandbox_process_ = process;
   target->base_address_ = base_address;
   return target;
 }
 
 }  // namespace sandbox