xref: /openbsd/lib/libelf/libelf_ar.c (revision e219834f)
1 /*-
2  * Copyright (c) 2006,2008,2010 Joseph Koshy
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <assert.h>
28 #include <ctype.h>
29 #include <libelf.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <stdint.h>
33 
34 #include "_libelf.h"
35 #include "_libelf_ar.h"
36 
37 ELFTC_VCSID("$Id: libelf_ar.c,v 1.2 2019/03/19 02:31:35 jsg Exp $");
38 
39 #define	LIBELF_NALLOC_SIZE	16
40 
41 /*
42  * `ar' archive handling.
43  *
44  * `ar' archives start with signature `ARMAG'.  Each archive member is
45  * preceded by a header containing meta-data for the member.  This
46  * header is described in <ar.h> (struct ar_hdr).  The header always
47  * starts on an even address.  File data is padded with "\n"
48  * characters to keep this invariant.
49  *
50  * Special considerations for `ar' archives:
51  *
52  * There are two variants of the `ar' archive format: traditional BSD
53  * and SVR4.  These differ in the way long file names are treated, and
54  * in the layout of the archive symbol table.
55  *
56  * The `ar' header only has space for a 16 character file name.
57  *
58  * In the SVR4 format, file names are terminated with a '/', so this
59  * effectively leaves 15 characters for the actual file name.  Longer
60  * file names stored in a separate 'string table' and referenced
61  * indirectly from the name field.  The string table itself appears as
62  * an archive member with name "// ".  An `indirect' file name in an
63  * `ar' header matches the pattern "/[0-9]*". The digits form a
64  * decimal number that corresponds to a byte offset into the string
65  * table where the actual file name of the object starts.  Strings in
66  * the string table are padded to start on even addresses.
67  *
68  * In the BSD format, file names can be up to 16 characters.  File
69  * names shorter than 16 characters are padded to 16 characters using
70  * (ASCII) space characters.  File names with embedded spaces and file
71  * names longer than 16 characters are stored immediately after the
72  * archive header and the name field set to a special indirect name
73  * matching the pattern "#1/[0-9]+".  The digits form a decimal number
74  * that corresponds to the actual length of the file name following
75  * the archive header.  The content of the archive member immediately
76  * follows the file name, and the size field of the archive member
77  * holds the sum of the sizes of the member and of the appended file
78  * name.
79  *
80  * Archives may also have a symbol table (see ranlib(1)), mapping
81  * program symbols to object files inside the archive.
82  *
83  * In the SVR4 format, a symbol table uses a file name of "/ " in its
84  * archive header.  The symbol table is structured as:
85  *  - a 4-byte count of entries stored as a binary value, MSB first
86  *  - 'n' 4-byte offsets, stored as binary values, MSB first
87  *  - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded.
88  *
89  * In the BSD format, the symbol table uses a file name of "__.SYMDEF".
90  * It is structured as two parts:
91  *  - The first part is an array of "ranlib" structures preceded by
92  *    the size of the array in bytes.  Each "ranlib" structure
93  *    describes one symbol.  Each structure contains an offset into
94  *    the string table for the symbol name, and a file offset into the
95  *    archive for the member defining the symbol.
96  *  - The second part is a string table containing NUL-terminated
97  *    strings, preceded by the size of the string table in bytes.
98  *
99  * If the symbol table and string table are is present in an archive
100  * they must be the very first objects and in that order.
101  */
102 
103 
104 /*
105  * Retrieve an archive header descriptor.
106  */
107 
108 Elf_Arhdr *
_libelf_ar_gethdr(Elf * e)109 _libelf_ar_gethdr(Elf *e)
110 {
111 	Elf *parent;
112 	Elf_Arhdr *eh;
113 	char *namelen;
114 	size_t n, nlen;
115 	struct ar_hdr *arh;
116 
117 	if ((parent = e->e_parent) == NULL) {
118 		LIBELF_SET_ERROR(ARGUMENT, 0);
119 		return (NULL);
120 	}
121 
122 	assert((e->e_flags & LIBELF_F_AR_HEADER) == 0);
123 
124 	arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr;
125 
126 	assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG);
127 
128 	/*
129 	 * There needs to be enough space remaining in the file for the
130 	 * archive header.
131 	 */
132 	if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile +
133 	    (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) {
134 		LIBELF_SET_ERROR(ARCHIVE, 0);
135 		return (NULL);
136 	}
137 
138 	if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) {
139 		LIBELF_SET_ERROR(RESOURCE, 0);
140 		return (NULL);
141 	}
142 
143 	e->e_hdr.e_arhdr = eh;
144 	e->e_flags |= LIBELF_F_AR_HEADER;
145 
146 	eh->ar_name = eh->ar_rawname = NULL;
147 
148 	if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) ==
149 	    NULL)
150 		goto error;
151 
152 	if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10,
153 	    &n) == 0)
154 		goto error;
155 	eh->ar_uid = (uid_t) n;
156 
157 	if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10,
158 	    &n) == 0)
159 		goto error;
160 	eh->ar_gid = (gid_t) n;
161 
162 	if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8,
163 	    &n) == 0)
164 		goto error;
165 	eh->ar_mode = (mode_t) n;
166 
167 	if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
168 	    &n) == 0)
169 		goto error;
170 
171 	/*
172 	 * Get the true size of the member if extended naming is being used.
173 	 */
174 	if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
175 		namelen = arh->ar_name +
176 		    LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
177 		if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
178 		    LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0)
179 			goto error;
180 		n -= nlen;
181 	}
182 
183 	eh->ar_size = n;
184 
185 	if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL)
186 		goto error;
187 
188 	eh->ar_flags = 0;
189 
190 	return (eh);
191 
192  error:
193 	if (eh) {
194 		if (eh->ar_name)
195 			free(eh->ar_name);
196 		if (eh->ar_rawname)
197 			free(eh->ar_rawname);
198 		free(eh);
199 	}
200 
201 	e->e_flags &= ~LIBELF_F_AR_HEADER;
202 	e->e_hdr.e_rawhdr = (unsigned char *) arh;
203 
204 	return (NULL);
205 }
206 
207 Elf *
_libelf_ar_open_member(int fd,Elf_Cmd c,Elf * elf)208 _libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf)
209 {
210 	Elf *e;
211 	size_t nsz, sz;
212 	off_t next, end;
213 	struct ar_hdr *arh;
214 	char *member, *namelen;
215 
216 	assert(elf->e_kind == ELF_K_AR);
217 
218 	next = elf->e_u.e_ar.e_next;
219 
220 	/*
221 	 * `next' is only set to zero by elf_next() when the last
222 	 * member of an archive is processed.
223 	 */
224 	if (next == (off_t) 0)
225 		return (NULL);
226 
227 	assert((next & 1) == 0);
228 
229 	/*
230 	 * There needs to be enough space in the file to contain an
231 	 * ar(1) header.
232 	 */
233 	end = next + (off_t) sizeof(struct ar_hdr);
234 	if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */
235 	    end > (off_t) elf->e_rawsize) {
236 		LIBELF_SET_ERROR(ARCHIVE, 0);
237 		return (NULL);
238 	}
239 
240 	arh = (struct ar_hdr *) (elf->e_rawfile + next);
241 
242 	/*
243 	 * Retrieve the size of the member.
244 	 */
245 	if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
246 	    &sz) == 0) {
247 		LIBELF_SET_ERROR(ARCHIVE, 0);
248 		return (NULL);
249 	}
250 
251 	/*
252 	 * Check if the archive member that follows will fit in the
253 	 * containing archive.
254 	 */
255 	end += (off_t) sz;
256 	if (end < next || /* Overflow. */
257 	    end > (off_t) elf->e_rawsize) {
258 		LIBELF_SET_ERROR(ARCHIVE, 0);
259 		return (NULL);
260 	}
261 
262 	/*
263 	 * Adjust the size field for members in BSD archives using
264 	 * extended naming.
265 	 */
266 	if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
267 		namelen = arh->ar_name +
268 		    LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
269 		if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
270 		    LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) {
271 			LIBELF_SET_ERROR(ARCHIVE, 0);
272 			return (NULL);
273 		}
274 
275 		member = (char *) (arh + 1) + nsz;
276 		sz -= nsz;
277 	} else
278 		member = (char *) (arh + 1);
279 
280 
281 	if ((e = elf_memory(member, sz)) == NULL)
282 		return (NULL);
283 
284 	e->e_fd = fd;
285 	e->e_cmd = c;
286 	e->e_hdr.e_rawhdr = (unsigned char *) arh;
287 
288 	elf->e_u.e_ar.e_nchildren++;
289 	e->e_parent = elf;
290 
291 	return (e);
292 }
293 
294 /*
295  * A BSD-style ar(1) symbol table has the following layout:
296  *
297  * - A count of bytes used by the following array of 'ranlib'
298  *   structures, stored as a 'long'.
299  * - An array of 'ranlib' structures.  Each array element is
300  *   two 'long's in size.
301  * - A count of bytes used for the following symbol table.
302  * - The symbol table itself.
303  */
304 
305 /*
306  * A helper macro to read in a 'long' value from the archive.
307  *
308  * We use memcpy() since the source pointer may be misaligned with
309  * respect to the natural alignment for a C 'long'.
310  */
311 #define	GET_LONG(P, V)do {				\
312 		memcpy(&(V), (P), sizeof(long));	\
313 		(P) += sizeof(long);			\
314 	} while (0)
315 
316 Elf_Arsym *
_libelf_ar_process_bsd_symtab(Elf * e,size_t * count)317 _libelf_ar_process_bsd_symtab(Elf *e, size_t *count)
318 {
319 	Elf_Arsym *symtab, *sym;
320 	unsigned int n;
321 	size_t nentries;
322 	unsigned char *end, *p, *p0, *s, *s0;
323 	const size_t entrysize = 2 * sizeof(long);
324 	long arraysize, fileoffset, stroffset, strtabsize;
325 
326 	assert(e != NULL);
327 	assert(count != NULL);
328 	assert(e->e_u.e_ar.e_symtab == NULL);
329 
330 	symtab = NULL;
331 
332 	/*
333 	 * The BSD symbol table always contains the count fields even
334 	 * if there are no entries in it.
335 	 */
336 	if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long))
337 		goto symtaberror;
338 
339 	p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
340 	end = p0 + e->e_u.e_ar.e_rawsymtabsz;
341 
342 	/*
343 	 * Retrieve the size of the array of ranlib descriptors and
344 	 * check it for validity.
345 	 */
346 	GET_LONG(p, arraysize);
347 
348 	if (arraysize < 0 || p0 + arraysize >= end ||
349 	    ((size_t) arraysize % entrysize != 0))
350 		goto symtaberror;
351 
352 	/*
353 	 * Check the value of the string table size.
354 	 */
355 	s = p + arraysize;
356 	GET_LONG(s, strtabsize);
357 
358 	s0 = s;			/* Start of string table. */
359 	if (strtabsize < 0 || s0 + strtabsize > end)
360 		goto symtaberror;
361 
362 	nentries = (size_t) arraysize / entrysize;
363 
364 	/*
365 	 * Allocate space for the returned Elf_Arsym array.
366 	 */
367 	if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) {
368 		LIBELF_SET_ERROR(RESOURCE, 0);
369 		return (NULL);
370 	}
371 
372 	/* Read in symbol table entries. */
373 	for (n = 0, sym = symtab; n < nentries; n++, sym++) {
374 		GET_LONG(p, stroffset);
375 		GET_LONG(p, fileoffset);
376 
377 		if (stroffset < 0 || fileoffset <  0 ||
378 		    (off_t) fileoffset >= e->e_rawsize)
379 			goto symtaberror;
380 
381 		s = s0 + stroffset;
382 
383 		if (s >= end)
384 			goto symtaberror;
385 
386 		sym->as_off = (off_t) fileoffset;
387 		sym->as_hash = elf_hash((char *) s);
388 		sym->as_name = (char *) s;
389 	}
390 
391 	/* Fill up the sentinel entry. */
392 	sym->as_name = NULL;
393 	sym->as_hash = ~0UL;
394 	sym->as_off = (off_t) 0;
395 
396 	/* Remember the processed symbol table. */
397 	e->e_u.e_ar.e_symtab = symtab;
398 
399 	*count = e->e_u.e_ar.e_symtabsz = nentries + 1;
400 
401 	return (symtab);
402 
403 symtaberror:
404 	if (symtab)
405 		free(symtab);
406 	LIBELF_SET_ERROR(ARCHIVE, 0);
407 	return (NULL);
408 }
409 
410 /*
411  * An SVR4-style ar(1) symbol table has the following layout:
412  *
413  * - The first 4 bytes are a binary count of the number of entries in the
414  *   symbol table, stored MSB-first.
415  * - Then there are 'n' 4-byte binary offsets, also stored MSB first.
416  * - Following this, there are 'n' null-terminated strings.
417  */
418 
419 #define	GET_WORD(P, V) do {			\
420 		(V) = 0;			\
421 		(V) = (P)[0]; (V) <<= 8;	\
422 		(V) += (P)[1]; (V) <<= 8;	\
423 		(V) += (P)[2]; (V) <<= 8;	\
424 		(V) += (P)[3];			\
425 	} while (0)
426 
427 #define	INTSZ	4
428 
429 
430 Elf_Arsym *
_libelf_ar_process_svr4_symtab(Elf * e,size_t * count)431 _libelf_ar_process_svr4_symtab(Elf *e, size_t *count)
432 {
433 	uint32_t off;
434 	size_t n, nentries;
435 	Elf_Arsym *symtab, *sym;
436 	unsigned char *p, *s, *end;
437 
438 	assert(e != NULL);
439 	assert(count != NULL);
440 	assert(e->e_u.e_ar.e_symtab == NULL);
441 
442 	symtab = NULL;
443 
444 	if (e->e_u.e_ar.e_rawsymtabsz < INTSZ)
445 		goto symtaberror;
446 
447 	p = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
448 	end = p + e->e_u.e_ar.e_rawsymtabsz;
449 
450 	GET_WORD(p, nentries);
451 	p += INTSZ;
452 
453 	if (nentries == 0 || p + nentries * INTSZ >= end)
454 		goto symtaberror;
455 
456 	/* Allocate space for a nentries + a sentinel. */
457 	if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) {
458 		LIBELF_SET_ERROR(RESOURCE, 0);
459 		return (NULL);
460 	}
461 
462 	s = p + (nentries * INTSZ); /* start of the string table. */
463 
464 	for (n = nentries, sym = symtab; n > 0; n--) {
465 		if (s >= end)
466 			goto symtaberror;
467 
468 		GET_WORD(p, off);
469 		if (off >= e->e_rawsize)
470 			goto symtaberror;
471 
472 		sym->as_off = (off_t) off;
473 		sym->as_hash = elf_hash((char *) s);
474 		sym->as_name = (char *) s;
475 
476 		p += INTSZ;
477 		sym++;
478 
479 		for (; s < end && *s++ != '\0';) /* skip to next string */
480 			;
481 	}
482 
483 	/* Fill up the sentinel entry. */
484 	sym->as_name = NULL;
485 	sym->as_hash = ~0UL;
486 	sym->as_off = (off_t) 0;
487 
488 	*count = e->e_u.e_ar.e_symtabsz = nentries + 1;
489 	e->e_u.e_ar.e_symtab = symtab;
490 
491 	return (symtab);
492 
493 symtaberror:
494 	if (symtab)
495 		free(symtab);
496 	LIBELF_SET_ERROR(ARCHIVE, 0);
497 	return (NULL);
498 }
499