handler/mac: Log a warning when an exception message has a suspicious

handler/mac/crash_report_exception_handler.cc

 // Copyright 2015 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 11 matching lines @@
 #include "base/mac/mach_logging.h"
 #include "base/strings/stringprintf.h"
 #include "client/settings.h"
 #include "minidump/minidump_file_writer.h"
 #include "snapshot/mac/crashpad_info_client_options.h"
 #include "snapshot/mac/process_snapshot_mac.h"
 #include "util/file/file_writer.h"
 #include "util/mach/exc_client_variants.h"
 #include "util/mach/exception_behaviors.h"
 #include "util/mach/mach_extensions.h"
+#include "util/mach/mach_message.h"
 #include "util/mach/scoped_task_suspend.h"
 #include "util/misc/tri_state.h"
 #include "util/misc/uuid.h"
 
 namespace crashpad {
 
 namespace {
 
 // Calls CrashReportDatabase::ErrorWritingCrashReport() upon destruction unless
 // disarmed by calling Disarm(). Armed upon construction.
@@ skipping 70 matching lines @@
     return KERN_FAILURE;
   }
 
   ScopedTaskSuspend suspend(task);
 
   ProcessSnapshotMac process_snapshot;
   if (!process_snapshot.Initialize(task)) {
     return KERN_FAILURE;
   }
 
+  // Check for suspicious message sources. A suspicious exception message comes
+  // from a source other than the kernel or the process that the exception
+  // purportedly occurred in.
+  //
+  // TODO(mark): Consider exceptions outside of the range (0, 32) from the
+  // kernel to be suspicious, and exceptions other than kMachExceptionSimulated
+  // from the process itself to be suspicious.
+  pid_t audit_pid = AuditPIDFromMachMessageTrailer(trailer);
+  if (audit_pid != -1 && audit_pid != 0) {
+    pid_t exception_pid = process_snapshot.ProcessID();
+    if (exception_pid != audit_pid) {
+      LOG(WARNING) << "exception for pid " << exception_pid << " sent by pid "
+                   << audit_pid;
+    }
+  }
+
   CrashpadInfoClientOptions client_options;
   process_snapshot.GetCrashpadOptions(&client_options);
 
   if (client_options.crashpad_handler_behavior != TriState::kDisabled) {
     if (!process_snapshot.InitializeException(thread,
                                               exception,
                                               code,
                                               code_count,
                                               *flavor,
                                               old_state,
@@ skipping 94 matching lines @@
           &new_state_forward_count);
       MACH_LOG_IF(WARNING, kr != KERN_SUCCESS, kr)
           << "UniversalExceptionRaise " << kSystemCrashReporterServiceName;
     }
   }
 
   return ExcServerSuccessfulReturnValue(behavior, false);
 }
 
 }  // namespace crashpad