1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 /* Following files are taken as reference to come up with this PoC */
18 /* 1. 'system/nfc/src/fuzzers/fuzz_utils.cc' */
19 /* 2. 'system/nfc/src/fuzzers/rw/main.cc' */
20
21 #include <vector>
22 #include "../includes/common.h"
23 #include "fuzz.h"
24 #include "fuzz_cmn.h"
25 extern void Type4_Fuzz(uint8_t SubType, const std::vector<bytes_t> &Packets);
26
27 FILE *file = nullptr;
28 char *vulnPtr = nullptr;
29 bool testInProgress = false;
30
31 struct sigaction new_action, old_action;
sigsegv_handler(int signum,siginfo_t * info,void * context)32 void sigsegv_handler(int signum, siginfo_t *info, void *context) {
33 if (testInProgress && info->si_signo == SIGSEGV) {
34 const size_t page_size = getpagesize();
35 const size_t page_mask = (~(page_size - 1));
36 if (page_size) {
37 char *vulnPtrGuardPage = (char *)((size_t)vulnPtr & page_mask) + page_size;
38 char *faultPage = (char *)((size_t)info->si_addr & page_mask);
39 if (faultPage == vulnPtrGuardPage) {
40 (*old_action.sa_sigaction)(signum, info, context);
41 return;
42 }
43 }
44 }
45 _exit(EXIT_FAILURE);
46 }
47
exit_Handler(void)48 void exit_Handler(void) {
49 if (file) {
50 fclose(file);
51 }
52 }
53
UnpackPackets(const uint8_t * Data,size_t Size)54 static std::vector<bytes_t> UnpackPackets(const uint8_t *Data, size_t Size) {
55 std::vector<bytes_t> result;
56 while (Size > 0) {
57 auto s = *Data++;
58 Size--;
59
60 if (s > Size) {
61 s = Size;
62 }
63
64 if (s > 0) {
65 result.push_back(bytes_t(Data, Data + s));
66 }
67
68 Size -= s;
69 Data += s;
70 }
71
72 return result;
73 }
74
main(int argc,char ** argv)75 int main(int argc, char **argv) {
76 sigemptyset(&new_action.sa_mask);
77 new_action.sa_flags = SA_SIGINFO;
78 new_action.sa_sigaction = sigsegv_handler;
79 sigaction(SIGSEGV, &new_action, &old_action);
80 FAIL_CHECK(argc > 1);
81
82 file = fopen(argv[1], "r");
83 FAIL_CHECK(file);
84
85 fseek(file, 0, SEEK_END);
86 size_t size = ftell(file);
87 fseek(file, 0, SEEK_SET);
88
89 std::vector<uint8_t> bufVector(size);
90 FAIL_CHECK(bufVector.data());
91 FAIL_CHECK(fread(bufVector.data(), 1, size, file) == size);
92
93 const uint8_t *data = (const uint8_t *)bufVector.data();
94 auto Packets = UnpackPackets(data, size);
95 FAIL_CHECK(Packets.size() > 1);
96
97 auto &ctrl = Packets[0];
98 FAIL_CHECK(ctrl.size() > 1);
99
100 Type4_Fuzz(ctrl[1], Packets);
101
102 return EXIT_SUCCESS;
103 }
104