Added a new SafeSPrintf() function that implements snprintf() in an async-safe-fashion

sandbox/linux/seccomp-bpf/die.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SECCOMP_BPF_DIE_H__
 #define SANDBOX_LINUX_SECCOMP_BPF_DIE_H__
 
+#include <stdint.h>
+#include <stdlib.h>
+
+#include "base/debug/format.h"
 #include "sandbox/linux/seccomp-bpf/port.h"
 
 
 namespace playground2 {
 
 class Die {
  public:
   // This is the main API for using this file. Prints a error message and
   // exits with a fatal error.
-  #define SANDBOX_DIE(m) playground2::Die::SandboxDie(m, __FILE__, __LINE__)
+  #define SANDBOX_DIE(m, args...)                                             \
+    do {                                                                      \
+      /* The optimizer automatically eliminates one of the branches of the */ \
+      /* "if" statement. This makes sure we only ever allocate a buffer and*/ \
+      /* copy the string, if that is necessary to format the message.      */ \
+      if (*#args) {                                                           \
+        const size_t kInitialSize = 80;                                       \
+        const size_t kMaxSize = 16384;                                        \
+        size_t sz = kInitialSize;                                             \
+        for (;;) {                                                            \
+          /* Allocate a reasonably sized buffer initially. If that wasn't  */ \
+          /* sufficient, reallocate a bigger buffer. But impose an upper   */ \
+          /* limit.                                                        */ \
+          /* This approach maximizes the chances that we will find the full*/ \
+          /* message in a crash dump, without needlessly pushing other     */ \
+          /* valuable data out of the dump.                                */ \
+          char buf[sz];                                                       \
+          sz = base::debug::FormatN(buf, sz, (m), ##args) + 1;                \
+          if (sz > kMaxSize)                                                  \
+            sz = kMaxSize;                                                    \
+          if (sz > sizeof(buf) && kInitialSize == sizeof(buf)) {              \
+            continue;                                                         \
+          } else {                                                            \
+            playground2::Die::SandboxDie(sz >= 0 ? buf : "",                  \
+                                         __FILE__, __LINE__);                 \
+            break;                                                            \
+          }                                                                   \
+        }                                                                     \
+      } else {                                                                \
+        playground2::Die::SandboxDie((m), __FILE__, __LINE__);                \
+      }                                                                       \
+    } while (0)
 
   // Adds an informational message to the log file or stderr as appropriate.
-  #define SANDBOX_INFO(m) playground2::Die::SandboxInfo(m, __FILE__, __LINE__)
+  #define SANDBOX_INFO(m, args...)                                            \
+    do {                                                                      \
+      /* The optimizer automatically eliminates one of the branches of the */ \
+      /* "if" statement. This makes sure we only ever allocate a buffer and*/ \
+      /* copy the string, if that is necessary to format the message.      */ \
+      if (*#args) {                                                           \
+        const size_t kInitialSize = 80;                                       \
+        const size_t kMaxSize = 16384;                                        \
+        size_t sz = kInitialSize;                                             \
+        for (;;) {                                                            \
+          /* Allocate a reasonably sized buffer initially. If that wasn't  */ \
+          /* sufficient, reallocate a bigger buffer. But impose an upper   */ \
+          /* limit.                                                        */ \
+          /* This approach maximizes the chances that we will find the full*/ \
+          /* message in a crash dump, without needlessly pushing other     */ \
+          /* valuable data out of the dump.                                */ \
+          char buf[sz];                                                       \
+          sz = base::debug::FormatN(buf, sz, (m), ##args) + 1;                \
+          if (sz > kMaxSize)                                                  \
+            sz = kMaxSize;                                                    \
+          if (sz > sizeof(buf) && kInitialSize == sizeof(buf)) {              \
+            continue;                                                         \
+          } else {                                                            \
+            playground2::Die::SandboxInfo(sz >= 0 ? buf : "",                 \
+                                          __FILE__, __LINE__);                \
+            break;                                                            \
+          }                                                                   \
+        }                                                                     \
+      } else {                                                                \
+        playground2::Die::SandboxInfo((m), __FILE__, __LINE__);               \
+      }                                                                       \
+    } while (0)
 
   // Terminate the program, even if the current sandbox policy prevents some
   // of the more commonly used functions used for exiting.
   // Most users would want to call SANDBOX_DIE() instead, as it logs extra
   // information. But calling ExitGroup() is correct and in some rare cases
   // preferable. So, we make it part of the public API.
   static void ExitGroup() __attribute__((noreturn));
 
   // This method gets called by SANDBOX_DIE(). There is normally no reason
   // to call it directly unless you are defining your own exiting macro.
@@ skipping 22 matching lines @@
  private:
   static bool simple_exit_;
   static bool suppress_info_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(Die);
 };
 
 }  // namespace
 
 #endif  // SANDBOX_LINUX_SECCOMP_BPF_DIE_H__