Changeset 144106 in webkit

Timestamp:

Feb 26, 2013, 2:13:51 PM (12 years ago)

Author:

jschuh@chromium.org

Message:

Merge 143811
BUG=webkit.org/b/110394
TBR=​jschuh@chromium.org
Review URL: ​https://codereview.chromium.org/12334103

File:

• branches/chromium/1364/Source/WebCore/rendering/RenderArena.cpp (modified) (2 diffs)

branches/chromium/1364/Source/WebCore/rendering/RenderArena.cpp

@@ -37 +37 @@
 #include "RenderArena.h"
 
+#include <limits>
 #include <stdlib.h>
 #include <string.h>
 #include <wtf/Assertions.h>
+#include <wtf/CryptographicallyRandomNumber.h>
 
 #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
@@ -90 +92 @@
     // RenderObject pointer.
     // See http://download.crowdstrike.com/papers/hes-exploiting-a-coalmine.pdf.
-
-    // The bottom bits are predictable because the binary is loaded on a
-    // boundary. This just shifts most of those predictable bits out.
-    m_mask = ~(reinterpret_cast<uintptr_t>(WTF::fastMalloc) >> 13);
+    WTF::cryptographicallyRandomValues(&m_mask, sizeof(m_mask));
+    m_mask |= (static_cast<uintptr_t>(3) << (std::numeric_limits<uintptr_t>::digits - 2)) | 1;
 }