// aud.drc · AudioToolbox / AudioCodecs · UniDrcSelection · CVE-2026-113912
// DRC decoder path probe
// C twin of the Swift POC: dlopens AudioCodecs, dlsyms the DRC symbols, then drives
// AudioConverterNew with the DRC format id.
// Build: clang -O2 -o cve-2026-113912 CVE-2026-113912.c -framework AudioToolbox -framework CoreFoundation
// Run:   ./cve-2026-113912

#include <stdio.h>
#include <dlfcn.h>
#include <AudioToolbox/AudioToolbox.h>

static void audio_converter(uint32_t format, double rate, uint32_t channels) {
    AudioStreamBasicDescription in = {0};
    in.mSampleRate = rate;
    in.mFormatID = format;
    in.mFramesPerPacket = 1;
    in.mChannelsPerFrame = channels;
    AudioStreamBasicDescription out = {0};
    out.mSampleRate = rate;
    out.mFormatID = kAudioFormatLinearPCM;
    out.mFormatFlags = kAudioFormatFlagIsFloat | kAudioFormatFlagIsPacked;
    out.mBytesPerPacket = 4;
    out.mFramesPerPacket = 1;
    out.mBytesPerFrame = 4;
    out.mChannelsPerFrame = 1;
    out.mBitsPerChannel = 32;
    AudioConverterRef c = NULL;
    OSStatus st = AudioConverterNew(&in, &out, &c);
    if (c) AudioConverterDispose(c);
    char four[5] = {0};
    for (int i = 0; i < 4; i++) {
        uint8_t b = (uint8_t)(format >> (24 - 8 * i));
        four[i] = (b >= 0x20 && b < 0x7f) ? (char)b : '?';
    }
    printf("AudioConverterNew('%s', %.0f Hz, %u ch) = %d\n", four, rate, channels, (int)st);
}

int main(void) {
    void *h = dlopen("/System/Library/Frameworks/AudioToolbox.framework/AudioCodecs", RTLD_NOW);
    if (h) {
        printf("ok AudioCodecs loaded\n");
        const char *syms[] = {"UniDrcSelection", "mpddrc", "selectDownmixMatrix", "getSignalPeakLevel"};
        for (size_t i = 0; i < 4; i++) {
            printf("  %s: %s\n", syms[i], dlsym(h, syms[i]) ? "resolved" : "missing (stripped or hidden)");
        }
    } else {
        printf("x AudioCodecs cannot be dlopened\n");
    }
    audio_converter(0x64726331, 48000, 6);   // 'drc1' 48 kHz 6 ch
    printf("CVE-2026-113912 · DRC path probed\n");
    return 0;
}