handler/mac: Log a warning when an exception message has a suspicious

util/mach/notify_server_test.cc

 // Copyright 2014 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 12 matching lines @@
 #include "util/mach/mach_message_server.h"
 #include "util/test/mac/mach_errors.h"
 
 namespace crashpad {
 namespace test {
 namespace {
 
 using testing::AllOf;
 using testing::Eq;
 using testing::Invoke;
-using testing::Ne;
 using testing::Pointee;
 using testing::ResultOf;
 using testing::Return;
 using testing::SetArgPointee;
 using testing::StrictMock;
 using testing::WithArg;
 
 //! \brief Adds a send right to an existing receive right.
 //!
 //! \param[in] receive_right The receive right to add a send right to.
@@ skipping 185 matching lines @@
   //! The server will listen on ServerPort() in persistent nonblocking mode, and
   //! dispatch received messages to the appropriate NotifyServer::Interface
   //! method. gmock expectations check that the proper method, if any, is called
   //! exactly once, and that no undesired methods are called.
   //!
   //! MachMessageServer::Run() is expected to return `MACH_RCV_TIMED_OUT`,
   //! because it runs in persistent nonblocking mode. If it returns anything
   //! else, a gtest assertion is added.
   void RunServer() {
     NotifyServer notify_server(this);
-    mach_msg_return_t mr =
-        MachMessageServer::Run(&notify_server,
-                               ServerPort(),
-                               MACH_MSG_OPTION_NONE,
-                               MachMessageServer::kPersistent,
-                               MachMessageServer::kReceiveLargeError,
-                               kMachMessageTimeoutNonblocking);
+    mach_msg_return_t mr = MachMessageServer::Run(
+        &notify_server,
+        ServerPort(),
+        MACH_RCV_TRAILER_TYPE(MACH_MSG_TRAILER_FORMAT_0) |
+            MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT),

[Robert Sesek, 2015/03/12 16:01:05]

Would it be useful to collapse this expression into a MachMessageServer
constant?

[Mark Mentovai, 2015/03/12 17:50:52]

Robert Sesek wrote:
Good idea, done.

+        MachMessageServer::kPersistent,
+        MachMessageServer::kReceiveLargeError,
+        kMachMessageTimeoutNonblocking);
     ASSERT_EQ(MACH_RCV_TIMED_OUT, mr)
         << MachErrorMessage(mr, "MachMessageServer::Run");
   }
 
   //! \brief Returns the receive right to be used for the server.
   //!
   //! This receive right is created lazily on a per-test basis. It is destroyed
   //! by TearDown() at the conclusion of each test.
   //!
   //! \return The server port receive right, creating it if one has not yet been
@@ skipping 52 matching lines @@
 // a port-deleted notification should be generated.
 TEST_F(NotifyServerTest, MachNotifyPortDeleted) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   base::mac::ScopedMachSendRight send_once_right(
       SendOnceRightFromReceiveRight(receive_right));
   ASSERT_NE(kMachPortNull, send_once_right);
 
-  ASSERT_TRUE(RequestMachPortNotification(
-      send_once_right, MACH_NOTIFY_DEAD_NAME, 0));
+  ASSERT_TRUE(
+      RequestMachPortNotification(send_once_right, MACH_NOTIFY_DEAD_NAME, 0));
 
-  EXPECT_CALL(*this, DoMachNotifyPortDeleted(ServerPort(),
-                                             send_once_right.get(),
-                                             Ne(nullptr)))
+  EXPECT_CALL(
+      *this,
+      DoMachNotifyPortDeleted(ServerPort(),
+                              send_once_right.get(),
+                              ResultOf(AuditPIDFromMachMessageTrailer, 0)))
       .WillOnce(Return(MIG_NO_REPLY))
       .RetiresOnSaturation();
 
   send_once_right.reset();
 
   RunServer();
 }
 
 // When a receive right with a port-destroyed notification request is destroyed,
 // a port-destroyed notification should be generated.
 TEST_F(NotifyServerTest, MachNotifyPortDestroyed) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   ASSERT_TRUE(RequestMachPortNotification(
       receive_right, MACH_NOTIFY_PORT_DESTROYED, 0));
 
-  EXPECT_CALL(*this, DoMachNotifyPortDestroyed(ServerPort(),
-                                               ResultOf(IsReceiveRight, true),
-                                               Ne(nullptr),
-                                               Pointee(Eq(false))))
+  EXPECT_CALL(
+      *this,
+      DoMachNotifyPortDestroyed(ServerPort(),
+                                ResultOf(IsReceiveRight, true),
+                                ResultOf(AuditPIDFromMachMessageTrailer, 0),
+                                Pointee(Eq(false))))
       .WillOnce(DoAll(SetArgPointee<3>(true), Return(MIG_NO_REPLY)))
       .RetiresOnSaturation();
 
   receive_right.reset();
 
   RunServer();
 }
 
 // When a receive right with a port-destroyed notification request is not
 // destroyed, no port-destroyed notification should be generated.
 TEST_F(NotifyServerTest, MachNotifyPortDestroyed_NoNotification) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   ASSERT_TRUE(RequestMachPortNotification(
       receive_right, MACH_NOTIFY_PORT_DESTROYED, 0));
 
   RunServer();
 }
 
 // When a no-senders notification request is registered for a receive right with
 // no senders, a no-senders notification should be generated.
 TEST_F(NotifyServerTest, MachNotifyNoSenders_NoSendRight) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
-  ASSERT_TRUE(RequestMachPortNotification(
-      receive_right, MACH_NOTIFY_NO_SENDERS, 0));
+  ASSERT_TRUE(
+      RequestMachPortNotification(receive_right, MACH_NOTIFY_NO_SENDERS, 0));
 
-  EXPECT_CALL(*this, DoMachNotifyNoSenders(ServerPort(), 0, Ne(nullptr)))
+  EXPECT_CALL(*this,
+              DoMachNotifyNoSenders(
+                  ServerPort(), 0, ResultOf(AuditPIDFromMachMessageTrailer, 0)))
       .WillOnce(Return(MIG_NO_REPLY))
       .RetiresOnSaturation();
 
   RunServer();
 }
 
 // When the last send right corresponding to a receive right with a no-senders
 // notification request is deallocated, a no-senders notification should be
 // generated.
 TEST_F(NotifyServerTest, MachNotifyNoSenders_SendRightDeallocated) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   base::mac::ScopedMachSendRight send_right(
       SendRightFromReceiveRight(receive_right));
   ASSERT_NE(kMachPortNull, send_right);
 
-  ASSERT_TRUE(RequestMachPortNotification(
-      receive_right, MACH_NOTIFY_NO_SENDERS, 1));
+  ASSERT_TRUE(
+      RequestMachPortNotification(receive_right, MACH_NOTIFY_NO_SENDERS, 1));
 
-  EXPECT_CALL(*this, DoMachNotifyNoSenders(ServerPort(), 1, Ne(nullptr)))
+  EXPECT_CALL(*this,
+              DoMachNotifyNoSenders(
+                  ServerPort(), 1, ResultOf(AuditPIDFromMachMessageTrailer, 0)))
       .WillOnce(Return(MIG_NO_REPLY))
       .RetiresOnSaturation();
 
   send_right.reset();
 
   RunServer();
 }
 
 // When the a receive right with a no-senders notification request never loses
 // all senders, no no-senders notification should be generated.
 TEST_F(NotifyServerTest, MachNotifyNoSenders_NoNotification) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   base::mac::ScopedMachSendRight send_right_0(
       SendRightFromReceiveRight(receive_right));
   ASSERT_NE(kMachPortNull, send_right_0);
 
   base::mac::ScopedMachSendRight send_right_1(
       SendRightFromReceiveRight(receive_right));
   ASSERT_NE(kMachPortNull, send_right_1);
 
-  ASSERT_TRUE(RequestMachPortNotification(
-      receive_right, MACH_NOTIFY_NO_SENDERS, 1));
+  ASSERT_TRUE(
+      RequestMachPortNotification(receive_right, MACH_NOTIFY_NO_SENDERS, 1));
 
   send_right_1.reset();
 
   RunServer();
 
   EXPECT_EQ(1u, RightRefCount(receive_right, MACH_PORT_RIGHT_RECEIVE));
   EXPECT_EQ(1u, RightRefCount(receive_right, MACH_PORT_RIGHT_SEND));
 }
 
 // When a send-once right is deallocated without being used, a send-once
 // notification notification should be sent via the send-once right.
 TEST_F(NotifyServerTest, MachNotifySendOnce_ExplicitDeallocation) {
   base::mac::ScopedMachSendRight send_once_right(
       SendOnceRightFromReceiveRight(ServerPort()));
   ASSERT_NE(kMachPortNull, send_once_right);
 
-  EXPECT_CALL(*this, DoMachNotifySendOnce(ServerPort(), Ne(nullptr)))
+  EXPECT_CALL(*this,
+              DoMachNotifySendOnce(ServerPort(),
+                                   ResultOf(AuditPIDFromMachMessageTrailer, 0)))
       .WillOnce(Return(MIG_NO_REPLY))
       .RetiresOnSaturation();
 
   send_once_right.reset();
 
   RunServer();
 }
 
 // When a send-once right is sent to a receiver that never dequeues the message,
 // the send-once right is destroyed, and a send-once notification should appear
@@ skipping 11 matching lines @@
   message.header.msgh_local_port = ServerPort();
   mach_msg_return_t mr = mach_msg(&message.header,
                                   MACH_SEND_MSG | MACH_SEND_TIMEOUT,
                                   message.header.msgh_size,
                                   0,
                                   MACH_PORT_NULL,
                                   0,
                                   MACH_PORT_NULL);
   ASSERT_EQ(MACH_MSG_SUCCESS, mr) << MachErrorMessage(mr, "mach_msg");
 
-  EXPECT_CALL(*this, DoMachNotifySendOnce(ServerPort(), Ne(nullptr)))
+  EXPECT_CALL(*this,
+              DoMachNotifySendOnce(ServerPort(),
+                                   ResultOf(AuditPIDFromMachMessageTrailer, 0)))
       .WillOnce(Return(MIG_NO_REPLY))
       .RetiresOnSaturation();
 
   receive_right.reset();
 
   RunServer();
 }
 
 // When the receive right corresponding to a send-once right with a dead-name
 // notification request is destroyed, a dead-name notification should be
 // generated.
 TEST_F(NotifyServerTest, MachNotifyDeadName) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   base::mac::ScopedMachSendRight send_once_right(
       SendOnceRightFromReceiveRight(receive_right));
   ASSERT_NE(kMachPortNull, send_once_right);
 
-  ASSERT_TRUE(RequestMachPortNotification(
-      send_once_right, MACH_NOTIFY_DEAD_NAME, 0));
+  ASSERT_TRUE(
+      RequestMachPortNotification(send_once_right, MACH_NOTIFY_DEAD_NAME, 0));
 
   // send_once_right becomes a dead name with the send-once right’s original
   // user reference count of 1, but the dead-name notification increments the
   // dead-name reference count, so it becomes 2. Take care to deallocate that
   // reference. The original reference is managed by send_once_right_owner.
   EXPECT_CALL(*this,
               DoMachNotifyDeadName(ServerPort(),
                                    AllOf(send_once_right.get(),
                                          ResultOf(DeadNameRightRefCount, 2)),
-                                   Ne(nullptr)))
-      .WillOnce(DoAll(WithArg<1>(Invoke(MachPortDeallocate)),
-                      Return(MIG_NO_REPLY)))
+                                   ResultOf(AuditPIDFromMachMessageTrailer, 0)))
+      .WillOnce(
+           DoAll(WithArg<1>(Invoke(MachPortDeallocate)), Return(MIG_NO_REPLY)))
       .RetiresOnSaturation();
 
   receive_right.reset();
 
   RunServer();
 
   EXPECT_TRUE(IsRight(send_once_right, MACH_PORT_TYPE_DEAD_NAME));
 
   EXPECT_EQ(0u, RightRefCount(send_once_right, MACH_PORT_RIGHT_SEND_ONCE));
   EXPECT_EQ(1u, DeadNameRightRefCount(send_once_right));
 }
 
 // When the receive right corresponding to a send-once right with a dead-name
 // notification request is not destroyed, no dead-name notification should be
 // generated.
 TEST_F(NotifyServerTest, MachNotifyDeadName_NoNotification) {
   base::mac::ScopedMachReceiveRight receive_right(
       NewMachPort(MACH_PORT_RIGHT_RECEIVE));
   ASSERT_NE(kMachPortNull, receive_right);
 
   base::mac::ScopedMachSendRight send_once_right(
       SendOnceRightFromReceiveRight(receive_right));
   ASSERT_NE(kMachPortNull, send_once_right);
 
-  ASSERT_TRUE(RequestMachPortNotification(
-      send_once_right, MACH_NOTIFY_DEAD_NAME, 0));
+  ASSERT_TRUE(
+      RequestMachPortNotification(send_once_right, MACH_NOTIFY_DEAD_NAME, 0));
 
   RunServer();
 
   EXPECT_FALSE(IsRight(send_once_right, MACH_PORT_TYPE_DEAD_NAME));
 
   EXPECT_EQ(1u, RightRefCount(send_once_right, MACH_PORT_RIGHT_SEND_ONCE));
   EXPECT_EQ(0u, DeadNameRightRefCount(send_once_right));
 }
 
 }  // namespace
 }  // namespace test
 }  // namespace crashpad