handler/mac: Log a warning when an exception message has a suspicious

util/mach/mach_message.cc

 // Copyright 2014 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
 #include "util/mach/mach_message.h"
 
+#include <AvailabilityMacros.h>
+#include <bsm/libbsm.h>
+
 #include <limits>
 
 #include "base/basictypes.h"
+#include "base/logging.h"
 #include "util/misc/clock.h"
 
 namespace crashpad {
 
 namespace {
 
 const int kNanosecondsPerMillisecond = 1E6;
 
 // TimerRunning() determines whether |deadline| has passed. If |deadline| is
 // kMachMessageDeadlineWaitIndefinitely, |*timeout_options| is set to
@@ skipping 176 matching lines @@
   reinterpret_cast<mig_reply_error_t*>(out_header)->RetCode = error;
 }
 
 const mach_msg_trailer_t* MachMessageTrailerFromHeader(
     const mach_msg_header_t* header) {
   vm_address_t header_address = reinterpret_cast<vm_address_t>(header);
   vm_address_t trailer_address = header_address + round_msg(header->msgh_size);
   return reinterpret_cast<const mach_msg_trailer_t*>(trailer_address);
 }
 
+pid_t AuditPIDFromMachMessageTrailer(const mach_msg_trailer_t* trailer) {
+  if (trailer->msgh_trailer_type != MACH_MSG_TRAILER_FORMAT_0) {
+    LOG(ERROR) << "unexpected msgh_trailer_type " << trailer->msgh_trailer_type;
+    return -1;
+  }
+  if (trailer->msgh_trailer_size <
+      REQUESTED_TRAILER_SIZE(kMachMessageReceiveAuditTrailer)) {
+    LOG(ERROR) << "small msgh_trailer_size " << trailer->msgh_trailer_size;
+    return -1;
+  }
+
+  const mach_msg_audit_trailer_t* audit_trailer =
+      reinterpret_cast<const mach_msg_audit_trailer_t*>(trailer);
+
+#if MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_8
+  pid_t audit_pid;
+  audit_token_to_au32(audit_trailer->msgh_audit,
+                      nullptr,
+                      nullptr,
+                      nullptr,
+                      nullptr,
+                      nullptr,
+                      &audit_pid,
+                      nullptr,
+                      nullptr);
+#else
+  pid_t audit_pid = audit_token_to_pid(audit_trailer->msgh_audit);
+#endif
+
+  return audit_pid;
+}
+
 }  // namespace crashpad