hostsidetests/securitybulletin/securityPatch/CVE-2015-6616/poc.cpp

/**
 * Copyright (C) 2019 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <MediaExtractor.h>
#include <MediaDefs.h>
#include "../includes/common.h"

void * operator new(size_t size) {
    if (size > 64 * 1024 * 1024) {
        exit (EXIT_VULNERABLE);
    }
    return malloc(size);
}

using namespace android;

int main(int argc, char **argv) {
    if (argc < 2) {
        return EXIT_FAILURE;
    }

    int32_t fd = open(argv[1], O_RDONLY);
    if(fd < 0) {
        return EXIT_FAILURE;
    }

    int64_t fileSize = lseek(fd, 0, SEEK_END);
    lseek(fd, 0, SEEK_SET);
    sp<DataSource> dataSource = DataSource::CreateFromFd(fd, 0, fileSize);
    if (dataSource == nullptr) {
        return EXIT_FAILURE;
    }

    sp<IMediaExtractor> ret =
            MediaExtractor::CreateFromService(dataSource, MEDIA_MIMETYPE_CONTAINER_MPEG4);
    if (ret == nullptr) {
        return EXIT_FAILURE;
    }

    sp < IMediaSource > source = ret->getTrack(0);
    if (source == nullptr) {
        return EXIT_FAILURE;
    }

    source->start(NULL);
    return EXIT_SUCCESS;
}