[LUD] Use ThreadLocalRandomBitGenerator in RandomEvictionQuarantineBase
On Windows, the deallocation hook may be executed after the BoringSSL
thread-local state has been destroyed, which can lead to crashes.
The change replaces calls to `base::RandGenerator`, which uses BoringSSL,
with our own non-cryptographically secure PRNG. This PRNG is already
used in the same hook and doesn't have this issue.
Bug: 328129298
Change-Id: Ied965721fcc5957ccdfc91d73cf359235687bd0a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5343960
Reviewed-by: Matthew Denton <mpdenton@chromium.org>
Commit-Queue: Sergei Glazunov <glazunov@google.com>
Cr-Commit-Position: refs/heads/main@{#1268948}
diff --git a/components/gwp_asan/client/lightweight_detector/random_eviction_quarantine.cc b/components/gwp_asan/client/lightweight_detector/random_eviction_quarantine.cc
index a3ebe38..cf2e30e 100644
--- a/components/gwp_asan/client/lightweight_detector/random_eviction_quarantine.cc
+++ b/components/gwp_asan/client/lightweight_detector/random_eviction_quarantine.cc
@@ -3,7 +3,9 @@
// found in the LICENSE file.
#include "components/gwp_asan/client/lightweight_detector/random_eviction_quarantine.h"
+
#include "base/check_is_test.h"
+#include "components/gwp_asan/client/thread_local_random_bit_generator.h"
namespace gwp_asan::internal::lud {
@@ -56,7 +58,10 @@
RecordAndZap(new_allocation.address, new_allocation.size);
// Pick an index to potentially replace before we acquire the lock.
- size_t idx = base::RandGenerator(max_allocation_count_);
+ std::uniform_int_distribution<size_t> distribution(0,
+ max_allocation_count_ - 1);
+ ThreadLocalRandomBitGenerator generator;
+ size_t idx = distribution(generator);
AllocationInfo evicted_allocation;
bool update_succeeded = false;
@@ -90,7 +95,10 @@
std::vector<AllocationInfo> allocations_to_evict;
allocations_to_evict.reserve(eviction_chunk_size_);
- size_t evict_start_idx = base::RandGenerator(max_allocation_count_);
+ std::uniform_int_distribution<size_t> distribution(0,
+ max_allocation_count_ - 1);
+ ThreadLocalRandomBitGenerator generator;
+ size_t evict_start_idx = distribution(generator);
{
base::AutoLock lock(lock_);