xref: /aosp_15_r20/cts/hostsidetests/securitybulletin/securityPatch/CVE-2021-39623/poc.cpp (revision b7c941bb3fa97aba169d73cee0bed2de8ac964bf)
1 /*
2  * Copyright (C) 2022 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "../includes/common.h"
18 #include <datasource/DataSourceFactory.h>
19 #include <dlfcn.h>
20 #include <gui/SurfaceComposerClient.h>
21 #include <media/IMediaHTTPService.h>
22 #include <media/stagefright/InterfaceUtils.h>
23 #include <media/stagefright/MediaCodecList.h>
24 #include <media/stagefright/MediaExtractorFactory.h>
25 #include <media/stagefright/SimpleDecodingSource.h>
26 #include <sys/mman.h>
27 
28 typedef void *(*mmap_t)(void *, size_t, int, int, int, off_t);
29 mmap_t real_mmap = nullptr;
30 
31 using namespace android;
32 
33 bool testInProgress = false;
34 constexpr size_t kTargetBufferSize = 32768;
35 struct sigaction new_action, old_action;
sigsegv_handler(int signum,siginfo_t * info,void * context)36 void sigsegv_handler(int signum, siginfo_t *info, void *context) {
37   if (testInProgress && info->si_signo == SIGSEGV) {
38     (*old_action.sa_sigaction)(signum, info, context);
39     return;
40   }
41   exit(EXIT_FAILURE);
42 }
43 
mmap(void * addr,size_t length,int prot,int flags,int fd,off_t offset)44 void *mmap(void *addr, size_t length, int prot, int flags, int fd,
45            off_t offset) {
46   const size_t page_size = getpagesize();
47   real_mmap = (mmap_t)dlsym(RTLD_NEXT, "mmap");
48   if (!real_mmap) {
49     exit(EXIT_FAILURE);
50   }
51   if (length == kTargetBufferSize) {
52     char *tmp_ptr = (char *)real_mmap(addr, length + page_size, prot,
53                                       flags | MAP_ANONYMOUS, -1, offset);
54     mprotect(tmp_ptr + length, page_size, PROT_NONE);
55     return tmp_ptr;
56   }
57   return real_mmap(addr, length, prot, flags, fd, offset);
58 }
59 
main(int argc,char ** argv)60 int main(int argc, char **argv) {
61   FAIL_CHECK(argc > 1);
62   sigemptyset(&new_action.sa_mask);
63   new_action.sa_flags = SA_SIGINFO;
64   new_action.sa_sigaction = sigsegv_handler;
65   sigaction(SIGSEGV, &new_action, &old_action);
66 
67   sp<DataSource> dataSource = DataSourceFactory::getInstance()->CreateFromURI(
68       nullptr /* httpService */, argv[1]);
69   FAIL_CHECK(dataSource);
70 
71   sp<IMediaExtractor> extractor = MediaExtractorFactory::Create(dataSource);
72   FAIL_CHECK(extractor);
73 
74   sp<MediaSource> mediaSource =
75       CreateMediaSourceFromIMediaSource(extractor->getTrack(0));
76   FAIL_CHECK(mediaSource);
77 
78   sp<MediaSource> rawSource = SimpleDecodingSource::Create(
79       mediaSource, MediaCodecList::kPreferSoftwareCodecs, nullptr, nullptr,
80       false);
81   FAIL_CHECK(rawSource);
82 
83   status_t err = rawSource->start();
84   FAIL_CHECK(err == OK);
85 
86   MediaSource::ReadOptions options = {};
87   MediaBufferBase *buffer = nullptr;
88 
89   testInProgress = true;
90   rawSource->read(&buffer, &options);
91   testInProgress = false;
92   if (buffer) {
93     buffer->release();
94     buffer = nullptr;
95   }
96   options.clearSeekTo();
97   options.setSeekTo(0);
98   rawSource->stop();
99   return EXIT_SUCCESS;
100 }
101