You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
2.0 KiB
65 lines
2.0 KiB
/**
|
|
* Copyright (C) 2020 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#include "../includes/common.h"
|
|
#include "../includes/memutils_track.h"
|
|
#include "hardware/sensors.h"
|
|
#include "sensor/Sensor.h"
|
|
#include "stdlib.h"
|
|
|
|
size_t vulnerableSize = 0;
|
|
|
|
using namespace android;
|
|
char enable_selective_overload = ENABLE_NONE;
|
|
|
|
bool is_tracking_required(size_t size) { return (size == vulnerableSize); }
|
|
|
|
static sensor_t getTestSensorT() {
|
|
sensor_t hwSensor = {};
|
|
hwSensor.name = "Test ";
|
|
hwSensor.vendor = hwSensor.name;
|
|
hwSensor.version = 1;
|
|
hwSensor.handle = 2;
|
|
hwSensor.type = SENSOR_TYPE_ACCELEROMETER;
|
|
hwSensor.maxRange = 10.f;
|
|
hwSensor.resolution = 1.f;
|
|
hwSensor.power = 5.f;
|
|
hwSensor.minDelay = 1000;
|
|
hwSensor.fifoReservedEventCount = 50;
|
|
hwSensor.fifoMaxEventCount = 100;
|
|
hwSensor.stringType = SENSOR_STRING_TYPE_ACCELEROMETER;
|
|
hwSensor.requiredPermission = "";
|
|
hwSensor.maxDelay = 5000;
|
|
hwSensor.flags = SENSOR_FLAG_CONTINUOUS_MODE;
|
|
return hwSensor;
|
|
}
|
|
|
|
int main() {
|
|
sensor_t hwSensor = getTestSensorT();
|
|
Sensor sensor1(&hwSensor, SENSORS_DEVICE_API_VERSION_1_4);
|
|
vulnerableSize = sensor1.getFlattenedSize();
|
|
enable_selective_overload = ENABLE_MALLOC_CHECK;
|
|
void *buffer = malloc(vulnerableSize);
|
|
if (!buffer) {
|
|
return EXIT_FAILURE;
|
|
}
|
|
enable_selective_overload = ENABLE_NONE;
|
|
sensor1.flatten(buffer, vulnerableSize);
|
|
int status = is_memory_uninitialized();
|
|
free(buffer);
|
|
return status;
|
|
}
|