[Chromecast] Make SIGTERM/SIGINT handler safer

chromecast/browser/cast_browser_main_parts.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromecast/browser/cast_browser_main_parts.h"
 
 #include <stddef.h>
+#include <string.h>
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/files/file_util.h"
 #include "base/macros.h"
 #include "base/message_loop/message_loop.h"
 #include "base/path_service.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/run_loop.h"
@@ skipping 51 matching lines @@
 #if defined(USE_AURA)
 #include "chromecast/graphics/cast_screen.h"
 #include "ui/aura/env.h"
 #include "ui/gfx/screen.h"
 #endif
 
 namespace {
 
 #if !defined(OS_ANDROID)
 int kSignalsToRunClosure[] = { SIGTERM, SIGINT, };
-
 // Closure to run on SIGTERM and SIGINT.
-base::Closure* g_signal_closure = NULL;
+base::Closure* g_signal_closure = nullptr;
+base::PlatformThreadId g_main_thread_id;
 
 void RunClosureOnSignal(int signum) {
-  LOG(ERROR) << "Got signal " << signum;
+  if (base::PlatformThread::CurrentId() != g_main_thread_id) {
+    RAW_LOG(INFO, "Received signal on non-main thread\n");
+    return;
+  }
+
+  char message[48] = "Received close signal: ";
+  strncat(message, sys_siglist[signum], sizeof(message) - strlen(message) - 1);

[maclellant, 2015/12/29 18:36:14]

I was about to reply that string library functions aren't async-safe, but it
seems in almost all implementations they are, but haven't yet been added to the
signal-safe list.

+  RAW_LOG(INFO, message);
+
   DCHECK(g_signal_closure);
-  // Expect main thread got this signal. Otherwise, weak_ptr of run_loop will
-  // crash the process.
   g_signal_closure->Run();
 }
 
 void RegisterClosureOnSignal(const base::Closure& closure) {
   DCHECK(!g_signal_closure);
   DCHECK_GT(arraysize(kSignalsToRunClosure), 0U);
 
-  // Allow memory leak by intention.
+  // Memory leak on purpose, since |g_signal_closure| should live until
+  // process exit.
   g_signal_closure = new base::Closure(closure);
+  g_main_thread_id = base::PlatformThread::CurrentId();
 
   struct sigaction sa_new;
   memset(&sa_new, 0, sizeof(sa_new));
   sa_new.sa_handler = RunClosureOnSignal;
   sigfillset(&sa_new.sa_mask);
   sa_new.sa_flags = SA_RESTART;
 
-  for (size_t i = 0; i < arraysize(kSignalsToRunClosure); i++) {
+  for (int sig : kSignalsToRunClosure) {
     struct sigaction sa_old;
-    if (sigaction(kSignalsToRunClosure[i], &sa_new, &sa_old) == -1) {
+    if (sigaction(sig, &sa_new, &sa_old) == -1) {
       NOTREACHED();
     } else {
       DCHECK_EQ(sa_old.sa_handler, SIG_DFL);
     }
   }
 
   // Get the first signal to exit when the parent process dies.
   prctl(PR_SET_PDEATHSIG, kSignalsToRunClosure[0]);
 }
 
@@ skipping 309 matching lines @@
 #if defined(USE_AURA)
   aura::Env::DeleteInstance();
 #endif
 
   DeregisterKillOnAlarm();
 #endif
 }
 
 }  // namespace shell
 }  // namespace chromecast