1 /*-
2 * Copyright (c) 2006,2008,2010 Joseph Koshy
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <assert.h>
28 #include <ctype.h>
29 #include <libelf.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <stdint.h>
33
34 #include "_libelf.h"
35 #include "_libelf_ar.h"
36
37 ELFTC_VCSID("$Id: libelf_ar.c,v 1.2 2019/03/19 02:31:35 jsg Exp $");
38
39 #define LIBELF_NALLOC_SIZE 16
40
41 /*
42 * `ar' archive handling.
43 *
44 * `ar' archives start with signature `ARMAG'. Each archive member is
45 * preceded by a header containing meta-data for the member. This
46 * header is described in <ar.h> (struct ar_hdr). The header always
47 * starts on an even address. File data is padded with "\n"
48 * characters to keep this invariant.
49 *
50 * Special considerations for `ar' archives:
51 *
52 * There are two variants of the `ar' archive format: traditional BSD
53 * and SVR4. These differ in the way long file names are treated, and
54 * in the layout of the archive symbol table.
55 *
56 * The `ar' header only has space for a 16 character file name.
57 *
58 * In the SVR4 format, file names are terminated with a '/', so this
59 * effectively leaves 15 characters for the actual file name. Longer
60 * file names stored in a separate 'string table' and referenced
61 * indirectly from the name field. The string table itself appears as
62 * an archive member with name "// ". An `indirect' file name in an
63 * `ar' header matches the pattern "/[0-9]*". The digits form a
64 * decimal number that corresponds to a byte offset into the string
65 * table where the actual file name of the object starts. Strings in
66 * the string table are padded to start on even addresses.
67 *
68 * In the BSD format, file names can be up to 16 characters. File
69 * names shorter than 16 characters are padded to 16 characters using
70 * (ASCII) space characters. File names with embedded spaces and file
71 * names longer than 16 characters are stored immediately after the
72 * archive header and the name field set to a special indirect name
73 * matching the pattern "#1/[0-9]+". The digits form a decimal number
74 * that corresponds to the actual length of the file name following
75 * the archive header. The content of the archive member immediately
76 * follows the file name, and the size field of the archive member
77 * holds the sum of the sizes of the member and of the appended file
78 * name.
79 *
80 * Archives may also have a symbol table (see ranlib(1)), mapping
81 * program symbols to object files inside the archive.
82 *
83 * In the SVR4 format, a symbol table uses a file name of "/ " in its
84 * archive header. The symbol table is structured as:
85 * - a 4-byte count of entries stored as a binary value, MSB first
86 * - 'n' 4-byte offsets, stored as binary values, MSB first
87 * - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded.
88 *
89 * In the BSD format, the symbol table uses a file name of "__.SYMDEF".
90 * It is structured as two parts:
91 * - The first part is an array of "ranlib" structures preceded by
92 * the size of the array in bytes. Each "ranlib" structure
93 * describes one symbol. Each structure contains an offset into
94 * the string table for the symbol name, and a file offset into the
95 * archive for the member defining the symbol.
96 * - The second part is a string table containing NUL-terminated
97 * strings, preceded by the size of the string table in bytes.
98 *
99 * If the symbol table and string table are is present in an archive
100 * they must be the very first objects and in that order.
101 */
102
103
104 /*
105 * Retrieve an archive header descriptor.
106 */
107
108 Elf_Arhdr *
_libelf_ar_gethdr(Elf * e)109 _libelf_ar_gethdr(Elf *e)
110 {
111 Elf *parent;
112 Elf_Arhdr *eh;
113 char *namelen;
114 size_t n, nlen;
115 struct ar_hdr *arh;
116
117 if ((parent = e->e_parent) == NULL) {
118 LIBELF_SET_ERROR(ARGUMENT, 0);
119 return (NULL);
120 }
121
122 assert((e->e_flags & LIBELF_F_AR_HEADER) == 0);
123
124 arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr;
125
126 assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG);
127
128 /*
129 * There needs to be enough space remaining in the file for the
130 * archive header.
131 */
132 if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile +
133 (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) {
134 LIBELF_SET_ERROR(ARCHIVE, 0);
135 return (NULL);
136 }
137
138 if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) {
139 LIBELF_SET_ERROR(RESOURCE, 0);
140 return (NULL);
141 }
142
143 e->e_hdr.e_arhdr = eh;
144 e->e_flags |= LIBELF_F_AR_HEADER;
145
146 eh->ar_name = eh->ar_rawname = NULL;
147
148 if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) ==
149 NULL)
150 goto error;
151
152 if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10,
153 &n) == 0)
154 goto error;
155 eh->ar_uid = (uid_t) n;
156
157 if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10,
158 &n) == 0)
159 goto error;
160 eh->ar_gid = (gid_t) n;
161
162 if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8,
163 &n) == 0)
164 goto error;
165 eh->ar_mode = (mode_t) n;
166
167 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
168 &n) == 0)
169 goto error;
170
171 /*
172 * Get the true size of the member if extended naming is being used.
173 */
174 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
175 namelen = arh->ar_name +
176 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
177 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
178 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0)
179 goto error;
180 n -= nlen;
181 }
182
183 eh->ar_size = n;
184
185 if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL)
186 goto error;
187
188 eh->ar_flags = 0;
189
190 return (eh);
191
192 error:
193 if (eh) {
194 if (eh->ar_name)
195 free(eh->ar_name);
196 if (eh->ar_rawname)
197 free(eh->ar_rawname);
198 free(eh);
199 }
200
201 e->e_flags &= ~LIBELF_F_AR_HEADER;
202 e->e_hdr.e_rawhdr = (unsigned char *) arh;
203
204 return (NULL);
205 }
206
207 Elf *
_libelf_ar_open_member(int fd,Elf_Cmd c,Elf * elf)208 _libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf)
209 {
210 Elf *e;
211 size_t nsz, sz;
212 off_t next, end;
213 struct ar_hdr *arh;
214 char *member, *namelen;
215
216 assert(elf->e_kind == ELF_K_AR);
217
218 next = elf->e_u.e_ar.e_next;
219
220 /*
221 * `next' is only set to zero by elf_next() when the last
222 * member of an archive is processed.
223 */
224 if (next == (off_t) 0)
225 return (NULL);
226
227 assert((next & 1) == 0);
228
229 /*
230 * There needs to be enough space in the file to contain an
231 * ar(1) header.
232 */
233 end = next + (off_t) sizeof(struct ar_hdr);
234 if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */
235 end > (off_t) elf->e_rawsize) {
236 LIBELF_SET_ERROR(ARCHIVE, 0);
237 return (NULL);
238 }
239
240 arh = (struct ar_hdr *) (elf->e_rawfile + next);
241
242 /*
243 * Retrieve the size of the member.
244 */
245 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
246 &sz) == 0) {
247 LIBELF_SET_ERROR(ARCHIVE, 0);
248 return (NULL);
249 }
250
251 /*
252 * Check if the archive member that follows will fit in the
253 * containing archive.
254 */
255 end += (off_t) sz;
256 if (end < next || /* Overflow. */
257 end > (off_t) elf->e_rawsize) {
258 LIBELF_SET_ERROR(ARCHIVE, 0);
259 return (NULL);
260 }
261
262 /*
263 * Adjust the size field for members in BSD archives using
264 * extended naming.
265 */
266 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
267 namelen = arh->ar_name +
268 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
269 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
270 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) {
271 LIBELF_SET_ERROR(ARCHIVE, 0);
272 return (NULL);
273 }
274
275 member = (char *) (arh + 1) + nsz;
276 sz -= nsz;
277 } else
278 member = (char *) (arh + 1);
279
280
281 if ((e = elf_memory(member, sz)) == NULL)
282 return (NULL);
283
284 e->e_fd = fd;
285 e->e_cmd = c;
286 e->e_hdr.e_rawhdr = (unsigned char *) arh;
287
288 elf->e_u.e_ar.e_nchildren++;
289 e->e_parent = elf;
290
291 return (e);
292 }
293
294 /*
295 * A BSD-style ar(1) symbol table has the following layout:
296 *
297 * - A count of bytes used by the following array of 'ranlib'
298 * structures, stored as a 'long'.
299 * - An array of 'ranlib' structures. Each array element is
300 * two 'long's in size.
301 * - A count of bytes used for the following symbol table.
302 * - The symbol table itself.
303 */
304
305 /*
306 * A helper macro to read in a 'long' value from the archive.
307 *
308 * We use memcpy() since the source pointer may be misaligned with
309 * respect to the natural alignment for a C 'long'.
310 */
311 #define GET_LONG(P, V)do { \
312 memcpy(&(V), (P), sizeof(long)); \
313 (P) += sizeof(long); \
314 } while (0)
315
316 Elf_Arsym *
_libelf_ar_process_bsd_symtab(Elf * e,size_t * count)317 _libelf_ar_process_bsd_symtab(Elf *e, size_t *count)
318 {
319 Elf_Arsym *symtab, *sym;
320 unsigned int n;
321 size_t nentries;
322 unsigned char *end, *p, *p0, *s, *s0;
323 const size_t entrysize = 2 * sizeof(long);
324 long arraysize, fileoffset, stroffset, strtabsize;
325
326 assert(e != NULL);
327 assert(count != NULL);
328 assert(e->e_u.e_ar.e_symtab == NULL);
329
330 symtab = NULL;
331
332 /*
333 * The BSD symbol table always contains the count fields even
334 * if there are no entries in it.
335 */
336 if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long))
337 goto symtaberror;
338
339 p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
340 end = p0 + e->e_u.e_ar.e_rawsymtabsz;
341
342 /*
343 * Retrieve the size of the array of ranlib descriptors and
344 * check it for validity.
345 */
346 GET_LONG(p, arraysize);
347
348 if (arraysize < 0 || p0 + arraysize >= end ||
349 ((size_t) arraysize % entrysize != 0))
350 goto symtaberror;
351
352 /*
353 * Check the value of the string table size.
354 */
355 s = p + arraysize;
356 GET_LONG(s, strtabsize);
357
358 s0 = s; /* Start of string table. */
359 if (strtabsize < 0 || s0 + strtabsize > end)
360 goto symtaberror;
361
362 nentries = (size_t) arraysize / entrysize;
363
364 /*
365 * Allocate space for the returned Elf_Arsym array.
366 */
367 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) {
368 LIBELF_SET_ERROR(RESOURCE, 0);
369 return (NULL);
370 }
371
372 /* Read in symbol table entries. */
373 for (n = 0, sym = symtab; n < nentries; n++, sym++) {
374 GET_LONG(p, stroffset);
375 GET_LONG(p, fileoffset);
376
377 if (stroffset < 0 || fileoffset < 0 ||
378 (off_t) fileoffset >= e->e_rawsize)
379 goto symtaberror;
380
381 s = s0 + stroffset;
382
383 if (s >= end)
384 goto symtaberror;
385
386 sym->as_off = (off_t) fileoffset;
387 sym->as_hash = elf_hash((char *) s);
388 sym->as_name = (char *) s;
389 }
390
391 /* Fill up the sentinel entry. */
392 sym->as_name = NULL;
393 sym->as_hash = ~0UL;
394 sym->as_off = (off_t) 0;
395
396 /* Remember the processed symbol table. */
397 e->e_u.e_ar.e_symtab = symtab;
398
399 *count = e->e_u.e_ar.e_symtabsz = nentries + 1;
400
401 return (symtab);
402
403 symtaberror:
404 if (symtab)
405 free(symtab);
406 LIBELF_SET_ERROR(ARCHIVE, 0);
407 return (NULL);
408 }
409
410 /*
411 * An SVR4-style ar(1) symbol table has the following layout:
412 *
413 * - The first 4 bytes are a binary count of the number of entries in the
414 * symbol table, stored MSB-first.
415 * - Then there are 'n' 4-byte binary offsets, also stored MSB first.
416 * - Following this, there are 'n' null-terminated strings.
417 */
418
419 #define GET_WORD(P, V) do { \
420 (V) = 0; \
421 (V) = (P)[0]; (V) <<= 8; \
422 (V) += (P)[1]; (V) <<= 8; \
423 (V) += (P)[2]; (V) <<= 8; \
424 (V) += (P)[3]; \
425 } while (0)
426
427 #define INTSZ 4
428
429
430 Elf_Arsym *
_libelf_ar_process_svr4_symtab(Elf * e,size_t * count)431 _libelf_ar_process_svr4_symtab(Elf *e, size_t *count)
432 {
433 uint32_t off;
434 size_t n, nentries;
435 Elf_Arsym *symtab, *sym;
436 unsigned char *p, *s, *end;
437
438 assert(e != NULL);
439 assert(count != NULL);
440 assert(e->e_u.e_ar.e_symtab == NULL);
441
442 symtab = NULL;
443
444 if (e->e_u.e_ar.e_rawsymtabsz < INTSZ)
445 goto symtaberror;
446
447 p = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
448 end = p + e->e_u.e_ar.e_rawsymtabsz;
449
450 GET_WORD(p, nentries);
451 p += INTSZ;
452
453 if (nentries == 0 || p + nentries * INTSZ >= end)
454 goto symtaberror;
455
456 /* Allocate space for a nentries + a sentinel. */
457 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) {
458 LIBELF_SET_ERROR(RESOURCE, 0);
459 return (NULL);
460 }
461
462 s = p + (nentries * INTSZ); /* start of the string table. */
463
464 for (n = nentries, sym = symtab; n > 0; n--) {
465 if (s >= end)
466 goto symtaberror;
467
468 GET_WORD(p, off);
469 if (off >= e->e_rawsize)
470 goto symtaberror;
471
472 sym->as_off = (off_t) off;
473 sym->as_hash = elf_hash((char *) s);
474 sym->as_name = (char *) s;
475
476 p += INTSZ;
477 sym++;
478
479 for (; s < end && *s++ != '\0';) /* skip to next string */
480 ;
481 }
482
483 /* Fill up the sentinel entry. */
484 sym->as_name = NULL;
485 sym->as_hash = ~0UL;
486 sym->as_off = (off_t) 0;
487
488 *count = e->e_u.e_ar.e_symtabsz = nentries + 1;
489 e->e_u.e_ar.e_symtab = symtab;
490
491 return (symtab);
492
493 symtaberror:
494 if (symtab)
495 free(symtab);
496 LIBELF_SET_ERROR(ARCHIVE, 0);
497 return (NULL);
498 }
499