Added a new SafeSPrintf() function that implements snprintf() in an async-safe-fashion

sandbox/linux/seccomp-bpf/trap.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <errno.h>
 #include <signal.h>
 #include <string.h>
 #include <sys/prctl.h>
 #include <sys/syscall.h>
 
@@ skipping 96 matching lines @@
     SANDBOX_DIE("This can't happen. Found no global singleton instance "
                 "for Trap() handling.");
   }
   global_trap_->SigSys(nr, info, void_context);
 }
 
 void Trap::SigSys(int nr, siginfo_t *info, void *void_context) {
   // Various sanity checks to make sure we actually received a signal
   // triggered by a BPF filter. If something else triggered SIGSYS
   // (e.g. kill()), there is really nothing we can do with this signal.
-  if (nr != SIGSYS || info->si_code != SYS_SECCOMP || !void_context ||
-      info->si_errno <= 0 ||
+  // NOTE: SANDBOX_DIE() can call LOG(FATAL). This is not normally async-signal
+  // safe and can lead to bugs. We should eventually implement a different
+  // logging and reporting mechanism that is safe to be called from
+  // the sigSys() handler.
+  // TODO: If we feel confident that our code otherwise works correctly, we
+  //       could actually make an argument that spurious SIGSYS should
+  //       just get silently ignored. TBD
+  if (nr != SIGSYS) {
+    SANDBOX_DIE("SIGSYS handler called with unexpected signal number %d.", nr);
+  }
+  if (info->si_code != SYS_SECCOMP) {
+    SANDBOX_DIE("SIGSYS handler called with unexpected signal code %x "
+                "(expected %x).", info->si_code, SYS_SECCOMP);
+  }
+  if (!void_context) {
+    SANDBOX_DIE("SIGSYS handler called without a signal context.");
+  }
+  if (info->si_errno <= 0 ||
       static_cast<size_t>(info->si_errno) > trap_array_size_) {
-    // SANDBOX_DIE() can call LOG(FATAL). This is not normally async-signal
-    // safe and can lead to bugs. We should eventually implement a different
-    // logging and reporting mechanism that is safe to be called from
-    // the sigSys() handler.
-    // TODO: If we feel confident that our code otherwise works correctly, we
-    //       could actually make an argument that spurious SIGSYS should
-    //       just get silently ignored. TBD
-    SANDBOX_DIE("Unexpected SIGSYS received.");
+    SANDBOX_DIE("SIGSYS handler called for unexpected trap number %d. We "
+                "expect traps to be bigger than 0 and less or equal to %d.",
+                info->si_errno, trap_array_size_);
   }
 
   // Signal handlers should always preserve "errno". Otherwise, we could
   // trigger really subtle bugs.
   const int old_errno   = errno;
 
   // Obtain the signal context. This, most notably, gives us access to
   // all CPU registers at the time of the signal.
   ucontext_t *ctx = reinterpret_cast<ucontext_t *>(void_context);
 
@@ skipping 197 matching lines @@
   if (global_trap_ && id > 0 && id <= global_trap_->trap_array_size_) {
     return global_trap_->trap_array_[id - 1];
   } else {
     return ErrorCode();
   }
 }
 
 Trap *Trap::global_trap_;
 
 }  // namespace playground2