commit 503f101d2b1d8dfdd17cc2aa79fc10d79eecd04c
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date: Thu May 11 16:39:02 2017 -0400
Enable some windows hardening features
One (HeapEnableTerminationOnCorruption) is on-by-default since win8;
the other (PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION) supposedly only
affects ATL, which (we think) we don't use. Still, these are good
hygiene. Closes ticket 21953.
---
changes/ticket21953 | 6 ++++++
src/or/main.c | 7 ++++++-
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/changes/ticket21953 b/changes/ticket21953
new file mode 100644
index 000000000..7cc84f506
--- /dev/null
+++ b/changes/ticket21953
@@ -0,0 +1,6 @@
+ o Minor features:
+ - Enable a couple of pieces of Windows hardening: one
+ (HeapEnableTerminationOnCorruption) that has been on-by-default since
+ Windows 8, and unavailable before Windows 7, and one
+ (PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION) which we believe doesn't
+ affect us, but shouldn't do any harm. Closes ticket 21953.
diff --git a/src/or/main.c b/src/or/main.c
index 66a857190..2de8ed29a 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -3426,6 +3426,8 @@ tor_main(int argc, char *argv[])
int result = 0;
#ifdef _WIN32
+ /* On heap corruption, just give up; don't try to play along. */
+ HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0);
/* Call SetProcessDEPPolicy to permanently enable DEP.
The function will not resolve on earlier versions of Windows,
and failure is not dangerous. */
@@ -3434,7 +3436,10 @@ tor_main(int argc, char *argv[])
typedef BOOL (WINAPI *PSETDEP)(DWORD);
PSETDEP setdeppolicy = (PSETDEP)GetProcAddress(hMod,
"SetProcessDEPPolicy");
- if (setdeppolicy) setdeppolicy(1); /* PROCESS_DEP_ENABLE */
+ if (setdeppolicy) {
+ /* PROCESS_DEP_ENABLE | PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION */
+ setdeppolicy(3);
+ }
}
#endif
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits