Added a new SafeSPrintf() function that implements snprintf() in an async-safe-fashion

base/debug/format.h

Index: base/debug/format.h
diff --git a/base/debug/format.h b/base/debug/format.h
new file mode 100644
index 0000000000000000000000000000000000000000..78c8152f9fabe1c85f01dbd453bf5b4ac6249bbc
--- /dev/null
+++ b/base/debug/format.h
@@ -0,0 +1,396 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_DEBUG_FORMAT_H_
+#define BASE_DEBUG_FORMAT_H_
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#if defined(__unix__)
+// For ssize_t
+#include <unistd.h>
+#endif
+
+#include "base/base_export.h"
+#include "base/basictypes.h"
+
+namespace base {
+namespace debug {
+
+#if defined(_MSC_VER)
+// Define ssize_t inside of our namespace.
+typedef long ssize_t;
+#endif
+
+// Format() is a type-safe and async-signal-safe version of snprintf().
+//
+// FormatN() is an alternative function signature that can be used when
+// not dealing with fixed-sized buffers. When possible, Format() should always
+// be used in favor of FormatN()
+//
+// These functions allow for formatting complicated messages from contexts that
+// require strict async-signal-safety. In fact, it is safe to call them from
+// any low-level execution context; even from contexts that have stricter
+// requirements than just async-signal-safety.
+//
+// The code currently only supports a subset of format characters:
+//   %c, %d, %x, %X, %p, and %s.

[Jeffrey Yasskin, 2013/07/30 23:13:53]

Do you require %c to match characters or can it take any integer? Do you require
%d to match signed integers or can it convert unsigned to signed? Do you require
%{x,X} to match unsigned integers, or can they convert signed integers?

+//
+// All format characters take an optional width parameter. This must be a
+// positive integer. For %d, %x, %X and %p, if the width starts with
+// a leading '0', padding is done with '0' instead of ' ' characters.
+//
+// Returns the number of bytes needed to store the untruncated output. This
+// does not include the terminating NUL byte.
+//
+// Returns -1, iff a fatal error happened. This typically can only happen, if
+// the buffer size is a) negative, b) zero (i.e. not even the NUL byte can be
+// written), or c) bigger than MAXINT.
+//
+// While the code supports type checking and while it is generally very careful
+// to avoid printing incorrect values, it tends to be conservative in printing
+// as much as possible, even when given incorrect parameters. Typically, in
+// case of an error, the format string will not be expanded. (i.e. something
+// like Format(buf, "%p %d", 1, 2) results in "%p 2").
+//
+// The pre-C++11 version cannot handle more than ten arguments.
+//
+// Basic example:
+//   char buf[20];
+//   base::debug::Format(buf, "The answer: %2d", 42);
+//
+// Example with dynamically sized buffer (async-signal-safe); this code won't
+// work on Visual studio, as it requires dynamically allocating arrays on the
+// stack:
+//   const size_t kInitialSize = 128;
+//   size_t sz = kInitialSize-1;
+//   for (;;) {
+//     char buf[sz+1];
+//     sz = FormatN(buf, sz, "Error message \"%s\"\n", err);

[Jeffrey Yasskin, 2013/07/30 23:13:53]

The argument should be sz+1, right? (This interface seems hard to use. Yes, it
matches snprintf, but why not return the length you actually need to allocate?)

+//     if (sz >= sizeof(buf))
+//       continue;
+//     write(2, buf, sz);
+//     break;
+//   }
+
+namespace internal {
+  // Helpers that use C++ overloading, templates, and specializations to deduce
+  // and record type information from function arguments. This allows us to
+  // later write a type-safe version of snprintf().
+
+  struct Arg {
+    // Any integer-like value.
+    Arg(signed char c)        : i_(c), width_(sizeof(char)),  type_(INT)  { }
+    Arg(unsigned char c)      : i_(c), width_(sizeof(char)),  type_(UINT) { }
+    Arg(signed short i)       : i_(i), width_(sizeof(short)), type_(INT)  { }
+    Arg(unsigned short i)     : i_(i), width_(sizeof(short)), type_(UINT) { }
+    Arg(signed int i)         : i_(i), width_(sizeof(int)),   type_(INT)  { }
+    Arg(unsigned int i)       : i_(i), width_(sizeof(int)),   type_(UINT) { }
+    Arg(signed long i)        : i_(i), width_(sizeof(long)),  type_(INT)  { }
+    Arg(unsigned long i)      : i_(i), width_(sizeof(long)),  type_(UINT) { }
+    Arg(signed long long i)   : i_(i), width_(sizeof(long long)),
+                                                              type_(INT)  { }
+    Arg(unsigned long long i) : i_(i), width_(sizeof(long long)),
+                                                              type_(UINT) { }
+
+    // A C-style text string.
+    Arg(const char* s) : s_(s), type_(STRING) { }
+    Arg(char* s)       : s_(s), type_(STRING) { }
+
+    // Any pointer value that can be cast to a "void*".
+    template<class T> Arg(T* ptr) : ptr_((void*)ptr), type_(POINTER) { }
+
+    union {
+      // An integer-like value.
+      struct {
+        int64_t       i_;
+        unsigned char width_;
+      };
+
+      // A C-style text string.
+      const char* s_;
+
+      // A pointer to an arbitrary object.
+      const void* ptr_;
+    };
+    const enum { INT, UINT, STRING, POINTER } type_;
+  };
+
+  // This is the internal function that performs the actual formatting of
+  // an snprintf()-style format string.
+  BASE_EXPORT ssize_t FormatN(char* buf, size_t sz, const char* fmt,
+                              const Arg* args, size_t max_args);
+}  // namespace internal
+
+#if __cplusplus >= 201103  // C++11
+
+template<typename... Args>
+ssize_t FormatN(char* buf, size_t N, const char* fmt, Args... args) {

[Jeffrey Yasskin, 2013/07/30 23:13:53]

You may want to attach the gcc format attribute
(http://gcc.gnu.org/onlinedocs/gcc-4.8.1/gcc/Function-Attributes.html#index-Wf...)
so the compiler can catch mistakes in the format string.

+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { args... };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N, typename... Args>
+ssize_t Format(char (&buf)[N], const char* fmt, Args... args) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { args... };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+#else  // Pre-C++11
+
+// TODO(markus): C++11 has a much more concise and readable solution for
+//   expressing what we are doing here. Delete the fall-back code for older
+//   compilers as soon as we have fully switched to C++11
+
+template<class T0, class T1, class T2, class T3, class T4,
+         class T5, class T6, class T7, class T8, class T9>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+                T5 arg5, T6 arg6, T7 arg7, T8 arg8, T9 arg9) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N,
+         class T0, class T1, class T2, class T3, class T4,
+         class T5, class T6, class T7, class T8, class T9>
+ssize_t Format(char (&buf)[N], const char* fmt,
+               T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+               T5 arg5, T6 arg6, T7 arg7, T8 arg8, T9 arg9) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1, class T2, class T3, class T4,
+         class T5, class T6, class T7, class T8>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+                T5 arg5, T6 arg6, T7 arg7, T8 arg8) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N,
+         class T0, class T1, class T2, class T3, class T4, class T5,
+         class T6, class T7, class T8>
+ssize_t Format(char (&buf)[N], const char* fmt,
+               T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+               T5 arg5, T6 arg6, T7 arg7, T8 arg8) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));

[Jeffrey Yasskin, 2013/07/30 23:13:53]

arraysize(arg_array) should work, since internal::Arg has linkage.

+}
+
+template<class T0, class T1, class T2, class T3, class T4, class T5,
+         class T6, class T7>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+                T5 arg5, T6 arg6, T7 arg7) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N,
+         class T0, class T1, class T2, class T3, class T4, class T5,
+         class T6, class T7>
+ssize_t Format(char (&buf)[N], const char* fmt,
+               T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+               T5 arg5, T6 arg6, T7 arg7) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1, class T2, class T3, class T4, class T5,
+         class T6>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4,
+                T5 arg5, T6 arg6) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N,
+         class T0, class T1, class T2, class T3, class T4, class T5,
+         class T6>
+ssize_t Format(char (&buf)[N], const char* fmt,
+               T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, T5 arg5, T6 arg6) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = {
+    arg0, arg1, arg2, arg3, arg4, arg5, arg6
+  };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1, class T2, class T3, class T4, class T5>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, T5 arg5) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4, arg5 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N,
+         class T0, class T1, class T2, class T3, class T4, class T5>
+ssize_t Format(char (&buf)[N], const char* fmt,
+               T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4, T5 arg5) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4, arg5 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1, class T2, class T3, class T4>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3, T4 arg4) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N, class T0, class T1, class T2, class T3, class T4>
+ssize_t Format(char (&buf)[N], const char* fmt, T0 arg0, T1 arg1,
+               T2 arg2, T3 arg3, T4 arg4) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3, arg4 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1, class T2, class T3>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2, T3 arg3) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N, class T0, class T1, class T2, class T3>
+ssize_t Format(char (&buf)[N], const char* fmt,
+               T0 arg0, T1 arg1, T2 arg2, T3 arg3) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2, arg3 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1, class T2>
+ssize_t FormatN(char* buf, size_t N, const char* fmt,
+                T0 arg0, T1 arg1, T2 arg2) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N, class T0, class T1, class T2>
+ssize_t Format(char (&buf)[N], const char* fmt, T0 arg0, T1 arg1, T2 arg2) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1, arg2 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0, class T1>
+ssize_t FormatN(char* buf, size_t N, const char* fmt, T0 arg0, T1 arg1) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N, class T0, class T1>
+ssize_t Format(char (&buf)[N], const char* fmt, T0 arg0, T1 arg1) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0, arg1 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<class T0>
+ssize_t FormatN(char* buf, size_t N, const char* fmt, T0 arg0) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+
+template<size_t N, class T0>
+ssize_t Format(char (&buf)[N], const char* fmt, T0 arg0) {
+  // Use Arg() object to record type information and then copy arguments to an
+  // array to make it easier to iterate over them.
+  const internal::Arg arg_array[] = { arg0 };
+  return internal::FormatN(buf, N, fmt, arg_array,
+                           ARRAYSIZE_UNSAFE(arg_array));
+}
+#endif
+
+// Fast-path when we don't actually need to substitute any arguments.
+BASE_EXPORT ssize_t FormatN(char* buf, size_t N, const char* fmt);
+template<size_t N>
+inline ssize_t Format(char (&buf)[N], const char* fmt) {
+  return FormatN(buf, N, fmt);
+}
+
+}  // namespace debug
+}  // namespace base
+
+#endif  // BASE_DEBUG_FORMAT_H_