The Tor Browser / file comparison
comparison: security/sandbox/win/src/handle_closer_agent.cc
security/sandbox/win/src/handle_closer_agent.cc
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:d0f8637daf23 |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sandbox/win/src/handle_closer_agent.h" | |
| 6 | |
| 7 #include "base/logging.h" | |
| 8 #include "sandbox/win/src/nt_internals.h" | |
| 9 #include "sandbox/win/src/win_utils.h" | |
| 10 | |
| 11 namespace { | |
| 12 | |
| 13 // Returns type infomation for an NT object. This routine is expected to be | |
| 14 // called for invalid handles so it catches STATUS_INVALID_HANDLE exceptions | |
| 15 // that can be generated when handle tracing is enabled. | |
| 16 NTSTATUS QueryObjectTypeInformation(HANDLE handle, | |
| 17 void* buffer, | |
| 18 ULONG* size) { | |
| 19 static NtQueryObject QueryObject = NULL; | |
| 20 if (!QueryObject) | |
| 21 ResolveNTFunctionPtr("NtQueryObject", &QueryObject); | |
| 22 | |
| 23 NTSTATUS status = STATUS_UNSUCCESSFUL; | |
| 24 __try { | |
| 25 status = QueryObject(handle, ObjectTypeInformation, buffer, *size, size); | |
| 26 } __except(GetExceptionCode() == STATUS_INVALID_HANDLE ? | |
| 27 EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) { | |
| 28 status = STATUS_INVALID_HANDLE; | |
| 29 } | |
| 30 return status; | |
| 31 } | |
| 32 | |
| 33 } // namespace | |
| 34 | |
| 35 namespace sandbox { | |
| 36 | |
| 37 // Memory buffer mapped from the parent, with the list of handles. | |
| 38 SANDBOX_INTERCEPT HandleCloserInfo* g_handles_to_close = NULL; | |
| 39 | |
| 40 bool HandleCloserAgent::NeedsHandlesClosed() { | |
| 41 return g_handles_to_close != NULL; | |
| 42 } | |
| 43 | |
| 44 // Reads g_handles_to_close and creates the lookup map. | |
| 45 void HandleCloserAgent::InitializeHandlesToClose() { | |
| 46 CHECK(g_handles_to_close != NULL); | |
| 47 | |
| 48 // Grab the header. | |
| 49 HandleListEntry* entry = g_handles_to_close->handle_entries; | |
| 50 for (size_t i = 0; i < g_handles_to_close->num_handle_types; ++i) { | |
| 51 // Set the type name. | |
| 52 char16* input = entry->handle_type; | |
| 53 HandleMap::mapped_type& handle_names = handles_to_close_[input]; | |
| 54 input = reinterpret_cast<char16*>(reinterpret_cast<char*>(entry) | |
| 55 + entry->offset_to_names); | |
| 56 // Grab all the handle names. | |
| 57 for (size_t j = 0; j < entry->name_count; ++j) { | |
| 58 std::pair<HandleMap::mapped_type::iterator, bool> name | |
| 59 = handle_names.insert(input); | |
| 60 CHECK(name.second); | |
| 61 input += name.first->size() + 1; | |
| 62 } | |
| 63 | |
| 64 // Move on to the next entry. | |
| 65 entry = reinterpret_cast<HandleListEntry*>(reinterpret_cast<char*>(entry) | |
| 66 + entry->record_bytes); | |
| 67 | |
| 68 DCHECK(reinterpret_cast<char16*>(entry) >= input); | |
| 69 DCHECK(reinterpret_cast<char16*>(entry) - input < | |
| 70 sizeof(size_t) / sizeof(char16)); | |
| 71 } | |
| 72 | |
| 73 // Clean up the memory we copied over. | |
| 74 ::VirtualFree(g_handles_to_close, 0, MEM_RELEASE); | |
| 75 g_handles_to_close = NULL; | |
| 76 } | |
| 77 | |
| 78 bool HandleCloserAgent::CloseHandles() { | |
| 79 DWORD handle_count = UINT_MAX; | |
| 80 const int kInvalidHandleThreshold = 100; | |
| 81 const size_t kHandleOffset = sizeof(HANDLE); | |
| 82 | |
| 83 if (!::GetProcessHandleCount(::GetCurrentProcess(), &handle_count)) | |
| 84 return false; | |
| 85 | |
| 86 // Set up buffers for the type info and the name. | |
| 87 std::vector<BYTE> type_info_buffer(sizeof(OBJECT_TYPE_INFORMATION) + | |
| 88 32 * sizeof(wchar_t)); | |
| 89 OBJECT_TYPE_INFORMATION* type_info = | |
| 90 reinterpret_cast<OBJECT_TYPE_INFORMATION*>(&(type_info_buffer[0])); | |
| 91 string16 handle_name; | |
| 92 HANDLE handle = NULL; | |
| 93 int invalid_count = 0; | |
| 94 | |
| 95 // Keep incrementing until we hit the number of handles reported by | |
| 96 // GetProcessHandleCount(). If we hit a very long sequence of invalid | |
| 97 // handles we assume that we've run past the end of the table. | |
| 98 while (handle_count && invalid_count < kInvalidHandleThreshold) { | |
| 99 reinterpret_cast<size_t&>(handle) += kHandleOffset; | |
| 100 NTSTATUS rc; | |
| 101 | |
| 102 // Get the type name, reusing the buffer. | |
| 103 ULONG size = static_cast<ULONG>(type_info_buffer.size()); | |
| 104 rc = QueryObjectTypeInformation(handle, type_info, &size); | |
| 105 while (rc == STATUS_INFO_LENGTH_MISMATCH || | |
| 106 rc == STATUS_BUFFER_OVERFLOW) { | |
| 107 type_info_buffer.resize(size + sizeof(wchar_t)); | |
| 108 type_info = reinterpret_cast<OBJECT_TYPE_INFORMATION*>( | |
| 109 &(type_info_buffer[0])); | |
| 110 rc = QueryObjectTypeInformation(handle, type_info, &size); | |
| 111 // Leave padding for the nul terminator. | |
| 112 if (NT_SUCCESS(rc) && size == type_info_buffer.size()) | |
| 113 rc = STATUS_INFO_LENGTH_MISMATCH; | |
| 114 } | |
| 115 if (!NT_SUCCESS(rc) || !type_info->Name.Buffer) { | |
| 116 ++invalid_count; | |
| 117 continue; | |
| 118 } | |
| 119 | |
| 120 --handle_count; | |
| 121 type_info->Name.Buffer[type_info->Name.Length / sizeof(wchar_t)] = L'\0'; | |
| 122 | |
| 123 // Check if we're looking for this type of handle. | |
| 124 HandleMap::iterator result = | |
| 125 handles_to_close_.find(type_info->Name.Buffer); | |
| 126 if (result != handles_to_close_.end()) { | |
| 127 HandleMap::mapped_type& names = result->second; | |
| 128 // Empty set means close all handles of this type; otherwise check name. | |
| 129 if (!names.empty()) { | |
| 130 // Move on to the next handle if this name doesn't match. | |
| 131 if (!GetHandleName(handle, &handle_name) || !names.count(handle_name)) | |
| 132 continue; | |
| 133 } | |
| 134 | |
| 135 if (!::SetHandleInformation(handle, HANDLE_FLAG_PROTECT_FROM_CLOSE, 0)) | |
| 136 return false; | |
| 137 if (!::CloseHandle(handle)) | |
| 138 return false; | |
| 139 } | |
| 140 } | |
| 141 | |
| 142 return true; | |
| 143 } | |
| 144 | |
| 145 } // namespace sandbox |
