handler/mac: Log a warning when an exception message has a suspicious

util/mach/mach_message.cc

Index: util/mach/mach_message.cc
diff --git a/util/mach/mach_message.cc b/util/mach/mach_message.cc
index 4d23eb25d3535a1f31fe4221e0841867d5bf2b52..ca435c2689973bceab6c4079620f9eff664ddf27 100644
--- a/util/mach/mach_message.cc
+++ b/util/mach/mach_message.cc
@@ -14,9 +14,13 @@
 
 #include "util/mach/mach_message.h"
 
+#include <AvailabilityMacros.h>
+#include <bsm/libbsm.h>
+
 #include <limits>
 
 #include "base/basictypes.h"
+#include "base/logging.h"
 #include "util/misc/clock.h"
 
 namespace crashpad {
@@ -213,4 +217,38 @@ const mach_msg_trailer_t* MachMessageTrailerFromHeader(
   return reinterpret_cast<const mach_msg_trailer_t*>(trailer_address);
 }
 
+pid_t AuditPIDFromMachMessageTrailer(const mach_msg_trailer_t* trailer) {
+  if (trailer->msgh_trailer_type != MACH_MSG_TRAILER_FORMAT_0) {
+    LOG(ERROR) << "unexpected msgh_trailer_type " << trailer->msgh_trailer_type;
+    return -1;
+  }
+  if (trailer->msgh_trailer_size <
+      REQUESTED_TRAILER_SIZE(
+          MACH_RCV_TRAILER_TYPE(MACH_MSG_TRAILER_FORMAT_0) |
+          MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT))) {
+    LOG(ERROR) << "small msgh_trailer_size " << trailer->msgh_trailer_size;
+    return -1;
+  }
+
+  const mach_msg_audit_trailer_t* audit_trailer =
+      reinterpret_cast<const mach_msg_audit_trailer_t*>(trailer);
+
+#if MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_8
+  pid_t audit_pid;
+  audit_token_to_au32(audit_trailer->msgh_audit,
+                      nullptr,
+                      nullptr,
+                      nullptr,
+                      nullptr,
+                      nullptr,
+                      &audit_pid,
+                      nullptr,
+                      nullptr);
+#else
+  pid_t audit_pid = audit_token_to_pid(audit_trailer->msgh_audit);
+#endif
+
+  return audit_pid;
+}
+
 }  // namespace crashpad