1 /** 2 * Copyright (C) 2020 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include "../includes/common.h" 18 #include "../includes/memutils_track.h" 19 #include "hardware/sensors.h" 20 #include "sensor/Sensor.h" 21 #include "stdlib.h" 22 23 size_t vulnerableSize = 0; 24 25 using namespace android; 26 char enable_selective_overload = ENABLE_NONE; 27 is_tracking_required(size_t size)28bool is_tracking_required(size_t size) { return (size == vulnerableSize); } 29 getTestSensorT()30static sensor_t getTestSensorT() { 31 sensor_t hwSensor = {}; 32 hwSensor.name = "Test "; 33 hwSensor.vendor = hwSensor.name; 34 hwSensor.version = 1; 35 hwSensor.handle = 2; 36 hwSensor.type = SENSOR_TYPE_ACCELEROMETER; 37 hwSensor.maxRange = 10.f; 38 hwSensor.resolution = 1.f; 39 hwSensor.power = 5.f; 40 hwSensor.minDelay = 1000; 41 hwSensor.fifoReservedEventCount = 50; 42 hwSensor.fifoMaxEventCount = 100; 43 hwSensor.stringType = SENSOR_STRING_TYPE_ACCELEROMETER; 44 hwSensor.requiredPermission = ""; 45 hwSensor.maxDelay = 5000; 46 hwSensor.flags = SENSOR_FLAG_CONTINUOUS_MODE; 47 return hwSensor; 48 } 49 main()50int main() { 51 sensor_t hwSensor = getTestSensorT(); 52 Sensor sensor1(&hwSensor, SENSORS_DEVICE_API_VERSION_1_4); 53 vulnerableSize = sensor1.getFlattenedSize(); 54 enable_selective_overload = ENABLE_MALLOC_CHECK; 55 void *buffer = malloc(vulnerableSize); 56 if (!buffer) { 57 return EXIT_FAILURE; 58 } 59 enable_selective_overload = ENABLE_NONE; 60 sensor1.flatten(buffer, vulnerableSize); 61 int status = is_memory_uninitialized(); 62 free(buffer); 63 return status; 64 } 65