hostsidetests/securitybulletin/securityPatch/CVE-2015-6616/poc.cpp

/**
 * Copyright (C) 2019 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <dlfcn.h>
#include <sys/types.h>
#include <media/DataSource.h>
#include <datasource/FileSource.h>
#include <media/stagefright/MediaExtractor.h>
#include <android/IMediaExtractor.h>
#include <media/stagefright/DataSourceBase.h>
#include <media/stagefright/MetaData.h>
#include "../includes/common.h"
#define LIBNAME "/system/lib64/extractors/libmp4extractor.so"
#define LIBNAME_APEX "/apex/com.android.media/lib64/extractors/libmp4extractor.so"

void * operator new(size_t size) {
    if (size > 64 * 1024 * 1024) {
        exit (EXIT_VULNERABLE);
    }
    return malloc(size);
}

using namespace android;

int main(int argc, char **argv) {
    (void) argc;
    (void) argv;
#if _64_BIT
    GetExtractorDef getDef = nullptr;
    if (argc < 2) {
        return EXIT_FAILURE;
    }

    void *libHandle = dlopen(LIBNAME, RTLD_NOW | RTLD_LOCAL);
    if (!libHandle) {
        libHandle = dlopen(LIBNAME_APEX, RTLD_NOW | RTLD_LOCAL);
        if (!libHandle) {
            return EXIT_FAILURE;
        }
    }

    getDef = (GetExtractorDef)dlsym(libHandle, "GETEXTRACTORDEF");
    if (!getDef) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    sp < DataSource > dataSource = new FileSource(argv[1]);
    if (dataSource == nullptr) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    void *meta = nullptr;
    void* creator = nullptr;
    FreeMetaFunc freeMeta = nullptr;
    float confidence;
    if (getDef().def_version == EXTRACTORDEF_VERSION_NDK_V1) {
        creator = (void*) getDef().u.v2.sniff(dataSource->wrap(), &confidence,
                                              &meta, &freeMeta);
    } else if (getDef().def_version == EXTRACTORDEF_VERSION_NDK_V2) {
        creator = (void*) getDef().u.v3.sniff(dataSource->wrap(), &confidence,
                                              &meta, &freeMeta);
    }
    if (!creator) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    CMediaExtractor *ret = ((CreatorFunc) creator)(dataSource->wrap(), meta);
    if (ret == nullptr) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    if (meta != nullptr && freeMeta != nullptr) {
        freeMeta(meta);
    }

    MediaExtractorCUnwrapper *mediaExtractorCUnwrapper =
            new MediaExtractorCUnwrapper(ret);
    MediaTrack* source = mediaExtractorCUnwrapper->getTrack(0);
    if (source == nullptr) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    source->start();

    dlclose(libHandle);
#endif /* _64_BIT */
    return EXIT_SUCCESS;
}