1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <stdlib.h>
18 #include <nfc_int.h>
19 #include <rw_int.h>
20 #include <unistd.h>
21 #include "../includes/common.h"
22 #include "../includes/memutils.h"
23
24 char enable_selective_overload = ENABLE_NONE;
25 char *vulnPtr = nullptr;
26
27 bool testInProgress = false;
28 struct sigaction new_action, old_action;
sigsegv_handler(int signum,siginfo_t * info,void * context)29 void sigsegv_handler(int signum, siginfo_t *info, void* context) {
30 if (testInProgress && info->si_signo == SIGSEGV) {
31 size_t pageSize = getpagesize();
32 if (pageSize) {
33 char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & PAGE_MASK) + pageSize;
34 char *faultPage = (char *) ((size_t) info->si_addr & PAGE_MASK);
35 if (faultPage == vulnPtrGuardPage) {
36 (*old_action.sa_sigaction)(signum, info, context);
37 return;
38 }
39 }
40 }
41 _exit(EXIT_FAILURE);
42 }
43
44 extern tRW_CB rw_cb;
45 extern tNFC_CB nfc_cb;
46 tNFC_CONN *p_data;
47 void rw_init(void);
48 tNFC_STATUS rw_t3t_select(uint8_t peer_nfcid2[NCI_RF_F_UID_LEN],
49 uint8_t mrti_check, uint8_t mrti_update);
50
allocate_memory(size_t size)51 void *allocate_memory(size_t size) {
52 void *ptr = memalign(16, size);
53 memset(ptr, 0x0, size);
54 return ptr;
55 }
56
57 /* States */
58 enum {
59 RW_T3T_STATE_NOT_ACTIVATED,
60 RW_T3T_STATE_IDLE,
61 RW_T3T_STATE_COMMAND_PENDING
62 };
63
64 /* Enumeration of API commands */
65 enum {
66 RW_T3T_CMD_DETECT_NDEF,
67 RW_T3T_CMD_CHECK_NDEF,
68 RW_T3T_CMD_UPDATE_NDEF,
69 RW_T3T_CMD_CHECK,
70 RW_T3T_CMD_UPDATE,
71 RW_T3T_CMD_SEND_RAW_FRAME,
72 RW_T3T_CMD_GET_SYSTEM_CODES,
73 RW_T3T_CMD_FORMAT,
74 RW_T3T_CMD_SET_READ_ONLY_SOFT,
75 RW_T3T_CMD_SET_READ_ONLY_HARD,
76 RW_T3T_CMD_MAX
77 };
78
poc_cback(tRW_EVENT event,tRW_DATA * p_rw_data)79 void poc_cback(tRW_EVENT event, tRW_DATA* p_rw_data) {
80 (void)event;
81 (void)p_rw_data;
82 free(p_data->data.p_data);
83 free(p_data);
84 }
85
GKI_start_timer(uint8_t,int32_t,bool)86 void GKI_start_timer(uint8_t, int32_t, bool) {
87 }
88
GKI_stop_timer(uint8_t)89 void GKI_stop_timer(uint8_t) {
90 }
91
main()92 int main() {
93 sigemptyset(&new_action.sa_mask);
94 new_action.sa_flags = SA_SIGINFO;
95 new_action.sa_sigaction = sigsegv_handler;
96 sigaction(SIGSEGV, &new_action, &old_action);
97 tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
98
99 GKI_init();
100 rw_init();
101 rw_cb.p_cback = &poc_cback;
102
103 uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
104 uint8_t mrti_check = 1, mrti_update = 1;
105
106 enable_selective_overload = ENABLE_MEMALIGN_CHECK;
107 FAIL_CHECK((rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK));
108
109 p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
110 FAIL_CHECK(p_data);
111
112 p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 3);
113 enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
114 if (!(p_data->data.p_data)) {
115 free(p_data);
116 FAIL_CHECK(p_data->data.p_data);
117 }
118 vulnPtr = (char *)p_data->data.p_data;
119 p_data->status = NFC_STATUS_OK;
120
121 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
122 p_t3t->cur_cmd = RW_T3T_CMD_DETECT_NDEF;
123
124 NFC_HDR* p_msg = (p_data->data).p_data;;
125 p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
126
127 uint8_t* p_t3t_rsp = (uint8_t*) (p_msg + 1) + (p_msg->offset + 1);
128 p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
129 p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
130
131 tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
132 tNFC_CONN_EVT event = NFC_DATA_CEVT;
133 memcpy(p_t3t->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
134 NCI_NFCID2_LEN);
135 testInProgress = true;
136 p_cb->p_cback(0, event, p_data);
137 testInProgress = false;
138 return EXIT_SUCCESS;
139 }
140