1 /**
2  * Copyright (C) 2020 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "../includes/common.h"
18 #include "../includes/memutils_track.h"
19 #include "hardware/sensors.h"
20 #include "sensor/Sensor.h"
21 #include "stdlib.h"
22 
23 size_t vulnerableSize = 0;
24 
25 using namespace android;
26 char enable_selective_overload = ENABLE_NONE;
27 
is_tracking_required(size_t size)28 bool is_tracking_required(size_t size) { return (size == vulnerableSize); }
29 
getTestSensorT()30 static sensor_t getTestSensorT() {
31   sensor_t hwSensor = {};
32   hwSensor.name = "Test ";
33   hwSensor.vendor = hwSensor.name;
34   hwSensor.version = 1;
35   hwSensor.handle = 2;
36   hwSensor.type = SENSOR_TYPE_ACCELEROMETER;
37   hwSensor.maxRange = 10.f;
38   hwSensor.resolution = 1.f;
39   hwSensor.power = 5.f;
40   hwSensor.minDelay = 1000;
41   hwSensor.fifoReservedEventCount = 50;
42   hwSensor.fifoMaxEventCount = 100;
43   hwSensor.stringType = SENSOR_STRING_TYPE_ACCELEROMETER;
44   hwSensor.requiredPermission = "";
45   hwSensor.maxDelay = 5000;
46   hwSensor.flags = SENSOR_FLAG_CONTINUOUS_MODE;
47   return hwSensor;
48 }
49 
main()50 int main() {
51   sensor_t hwSensor = getTestSensorT();
52   Sensor sensor1(&hwSensor, SENSORS_DEVICE_API_VERSION_1_4);
53   vulnerableSize = sensor1.getFlattenedSize();
54   enable_selective_overload = ENABLE_MALLOC_CHECK;
55   void *buffer = malloc(vulnerableSize);
56   if (!buffer) {
57     return EXIT_FAILURE;
58   }
59   enable_selective_overload = ENABLE_NONE;
60   sensor1.flatten(buffer, vulnerableSize);
61   int status = is_memory_uninitialized();
62   free(buffer);
63   return status;
64 }
65