1 /*-
2 * Copyright (c) 2006,2008,2010 Joseph Koshy
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <assert.h>
28 #include <ctype.h>
29 #include <libelf.h>
30 #include <stdlib.h>
31 #include <string.h>
32
33 #include "_libelf.h"
34 #include "_libelf_ar.h"
35
36 ELFTC_VCSID("$Id: libelf_ar.c 3712 2019-03-16 22:23:34Z jkoshy $");
37
38 #define LIBELF_NALLOC_SIZE 16
39
40 /*
41 * `ar' archive handling.
42 *
43 * `ar' archives start with signature `ARMAG'. Each archive member is
44 * preceded by a header containing meta-data for the member. This
45 * header is described in <ar.h> (struct ar_hdr). The header always
46 * starts on an even address. File data is padded with "\n"
47 * characters to keep this invariant.
48 *
49 * Special considerations for `ar' archives:
50 *
51 * There are two variants of the `ar' archive format: traditional BSD
52 * and SVR4. These differ in the way long file names are treated, and
53 * in the layout of the archive symbol table.
54 *
55 * The `ar' header only has space for a 16 character file name.
56 *
57 * In the SVR4 format, file names are terminated with a '/', so this
58 * effectively leaves 15 characters for the actual file name. Longer
59 * file names stored in a separate 'string table' and referenced
60 * indirectly from the name field. The string table itself appears as
61 * an archive member with name "// ". An `indirect' file name in an
62 * `ar' header matches the pattern "/[0-9]*". The digits form a
63 * decimal number that corresponds to a byte offset into the string
64 * table where the actual file name of the object starts. Strings in
65 * the string table are padded to start on even addresses.
66 *
67 * In the BSD format, file names can be up to 16 characters. File
68 * names shorter than 16 characters are padded to 16 characters using
69 * (ASCII) space characters. File names with embedded spaces and file
70 * names longer than 16 characters are stored immediately after the
71 * archive header and the name field set to a special indirect name
72 * matching the pattern "#1/[0-9]+". The digits form a decimal number
73 * that corresponds to the actual length of the file name following
74 * the archive header. The content of the archive member immediately
75 * follows the file name, and the size field of the archive member
76 * holds the sum of the sizes of the member and of the appended file
77 * name.
78 *
79 * Archives may also have a symbol table (see ranlib(1)), mapping
80 * program symbols to object files inside the archive.
81 *
82 * In the SVR4 format, a symbol table uses a file name of "/ " in its
83 * archive header. The symbol table is structured as:
84 * - a 4-byte count of entries stored as a binary value, MSB first
85 * - 'n' 4-byte offsets, stored as binary values, MSB first
86 * - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded.
87 *
88 * In the BSD format, the symbol table uses a file name of "__.SYMDEF".
89 * It is structured as two parts:
90 * - The first part is an array of "ranlib" structures preceded by
91 * the size of the array in bytes. Each "ranlib" structure
92 * describes one symbol. Each structure contains an offset into
93 * the string table for the symbol name, and a file offset into the
94 * archive for the member defining the symbol.
95 * - The second part is a string table containing NUL-terminated
96 * strings, preceded by the size of the string table in bytes.
97 *
98 * If the symbol table and string table are is present in an archive
99 * they must be the very first objects and in that order.
100 */
101
102
103 /*
104 * Retrieve an archive header descriptor.
105 */
106
107 Elf_Arhdr *
_libelf_ar_gethdr(Elf * e)108 _libelf_ar_gethdr(Elf *e)
109 {
110 Elf *parent;
111 Elf_Arhdr *eh;
112 char *namelen;
113 size_t n, nlen;
114 struct ar_hdr *arh;
115
116 if ((parent = e->e_parent) == NULL) {
117 LIBELF_SET_ERROR(ARGUMENT, 0);
118 return (NULL);
119 }
120
121 assert((e->e_flags & LIBELF_F_AR_HEADER) == 0);
122
123 arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr;
124
125 assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG);
126
127 /*
128 * There needs to be enough space remaining in the file for the
129 * archive header.
130 */
131 if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile +
132 (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) {
133 LIBELF_SET_ERROR(ARCHIVE, 0);
134 return (NULL);
135 }
136
137 if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) {
138 LIBELF_SET_ERROR(RESOURCE, 0);
139 return (NULL);
140 }
141
142 e->e_hdr.e_arhdr = eh;
143 e->e_flags |= LIBELF_F_AR_HEADER;
144
145 eh->ar_name = eh->ar_rawname = NULL;
146
147 if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) ==
148 NULL)
149 goto error;
150
151 if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10,
152 &n) == 0)
153 goto error;
154 eh->ar_uid = (uid_t) n;
155
156 if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10,
157 &n) == 0)
158 goto error;
159 eh->ar_gid = (gid_t) n;
160
161 if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8,
162 &n) == 0)
163 goto error;
164 eh->ar_mode = (mode_t) n;
165
166 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
167 &n) == 0)
168 goto error;
169
170 /*
171 * Get the true size of the member if extended naming is being used.
172 */
173 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
174 namelen = arh->ar_name +
175 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
176 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
177 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0)
178 goto error;
179 n -= nlen;
180 }
181
182 eh->ar_size = n;
183
184 if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL)
185 goto error;
186
187 eh->ar_flags = 0;
188
189 return (eh);
190
191 error:
192 if (eh) {
193 if (eh->ar_name)
194 free(eh->ar_name);
195 if (eh->ar_rawname)
196 free(eh->ar_rawname);
197 free(eh);
198 }
199
200 e->e_flags &= ~LIBELF_F_AR_HEADER;
201 e->e_hdr.e_rawhdr = (unsigned char *) arh;
202
203 return (NULL);
204 }
205
206 Elf *
_libelf_ar_open_member(int fd,Elf_Cmd c,Elf * elf)207 _libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf)
208 {
209 Elf *e;
210 size_t nsz, sz;
211 off_t next, end;
212 struct ar_hdr *arh;
213 char *member, *namelen;
214
215 assert(elf->e_kind == ELF_K_AR);
216
217 next = elf->e_u.e_ar.e_next;
218
219 /*
220 * `next' is only set to zero by elf_next() when the last
221 * member of an archive is processed.
222 */
223 if (next == (off_t) 0)
224 return (NULL);
225
226 assert((next & 1) == 0);
227
228 /*
229 * There needs to be enough space in the file to contain an
230 * ar(1) header.
231 */
232 end = next + (off_t) sizeof(struct ar_hdr);
233 if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */
234 end > (off_t) elf->e_rawsize) {
235 LIBELF_SET_ERROR(ARCHIVE, 0);
236 return (NULL);
237 }
238
239 arh = (struct ar_hdr *) (elf->e_rawfile + next);
240
241 /*
242 * Retrieve the size of the member.
243 */
244 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
245 &sz) == 0) {
246 LIBELF_SET_ERROR(ARCHIVE, 0);
247 return (NULL);
248 }
249
250 /*
251 * Check if the archive member that follows will fit in the
252 * containing archive.
253 */
254 end += (off_t) sz;
255 if (end < next || /* Overflow. */
256 end > (off_t) elf->e_rawsize) {
257 LIBELF_SET_ERROR(ARCHIVE, 0);
258 return (NULL);
259 }
260
261 /*
262 * Adjust the size field for members in BSD archives using
263 * extended naming.
264 */
265 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
266 namelen = arh->ar_name +
267 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
268 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
269 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) {
270 LIBELF_SET_ERROR(ARCHIVE, 0);
271 return (NULL);
272 }
273
274 member = (char *) (arh + 1) + nsz;
275 sz -= nsz;
276 } else
277 member = (char *) (arh + 1);
278
279
280 if ((e = elf_memory(member, sz)) == NULL)
281 return (NULL);
282
283 e->e_fd = fd;
284 e->e_cmd = c;
285 e->e_hdr.e_rawhdr = (unsigned char *) arh;
286
287 elf->e_u.e_ar.e_nchildren++;
288 e->e_parent = elf;
289
290 return (e);
291 }
292
293 /*
294 * A BSD-style ar(1) symbol table has the following layout:
295 *
296 * - A count of bytes used by the following array of 'ranlib'
297 * structures, stored as a 'long'.
298 * - An array of 'ranlib' structures. Each array element is
299 * two 'long's in size.
300 * - A count of bytes used for the following symbol table.
301 * - The symbol table itself.
302 */
303
304 /*
305 * A helper macro to read in a 'long' value from the archive.
306 *
307 * We use memcpy() since the source pointer may be misaligned with
308 * respect to the natural alignment for a C 'long'.
309 */
310 #define GET_LONG(P, V)do { \
311 memcpy(&(V), (P), sizeof(long)); \
312 (P) += sizeof(long); \
313 } while (0)
314
315 Elf_Arsym *
_libelf_ar_process_bsd_symtab(Elf * e,size_t * count)316 _libelf_ar_process_bsd_symtab(Elf *e, size_t *count)
317 {
318 Elf_Arsym *symtab, *sym;
319 unsigned int n;
320 size_t nentries;
321 unsigned char *end, *p, *p0, *s, *s0;
322 const size_t entrysize = 2 * sizeof(long);
323 long arraysize, fileoffset, stroffset, strtabsize;
324
325 assert(e != NULL);
326 assert(count != NULL);
327 assert(e->e_u.e_ar.e_symtab == NULL);
328
329 symtab = NULL;
330
331 /*
332 * The BSD symbol table always contains the count fields even
333 * if there are no entries in it.
334 */
335 if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long))
336 goto symtaberror;
337
338 p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
339 end = p0 + e->e_u.e_ar.e_rawsymtabsz;
340
341 /*
342 * Retrieve the size of the array of ranlib descriptors and
343 * check it for validity.
344 */
345 GET_LONG(p, arraysize);
346
347 if (arraysize < 0 || p0 + arraysize >= end ||
348 ((size_t) arraysize % entrysize != 0))
349 goto symtaberror;
350
351 /*
352 * Check the value of the string table size.
353 */
354 s = p + arraysize;
355 GET_LONG(s, strtabsize);
356
357 s0 = s; /* Start of string table. */
358 if (strtabsize < 0 || s0 + strtabsize > end)
359 goto symtaberror;
360
361 nentries = (size_t) arraysize / entrysize;
362
363 /*
364 * Allocate space for the returned Elf_Arsym array.
365 */
366 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) {
367 LIBELF_SET_ERROR(RESOURCE, 0);
368 return (NULL);
369 }
370
371 /* Read in symbol table entries. */
372 for (n = 0, sym = symtab; n < nentries; n++, sym++) {
373 GET_LONG(p, stroffset);
374 GET_LONG(p, fileoffset);
375
376 if (stroffset < 0 || fileoffset < 0 ||
377 (off_t) fileoffset >= e->e_rawsize)
378 goto symtaberror;
379
380 s = s0 + stroffset;
381
382 if (s >= end)
383 goto symtaberror;
384
385 sym->as_off = (off_t) fileoffset;
386 sym->as_hash = elf_hash((char *) s);
387 sym->as_name = (char *) s;
388 }
389
390 /* Fill up the sentinel entry. */
391 sym->as_name = NULL;
392 sym->as_hash = ~0UL;
393 sym->as_off = (off_t) 0;
394
395 /* Remember the processed symbol table. */
396 e->e_u.e_ar.e_symtab = symtab;
397
398 *count = e->e_u.e_ar.e_symtabsz = nentries + 1;
399
400 return (symtab);
401
402 symtaberror:
403 if (symtab)
404 free(symtab);
405 LIBELF_SET_ERROR(ARCHIVE, 0);
406 return (NULL);
407 }
408
409 /*
410 * An SVR4-style ar(1) symbol table has the following layout:
411 *
412 * - The first 4 bytes are a binary count of the number of entries in the
413 * symbol table, stored MSB-first.
414 * - Then there are 'n' 4-byte binary offsets, also stored MSB first.
415 * - Following this, there are 'n' null-terminated strings.
416 */
417
418 #define GET_WORD(P, V) do { \
419 (V) = 0; \
420 (V) = (P)[0]; (V) <<= 8; \
421 (V) += (P)[1]; (V) <<= 8; \
422 (V) += (P)[2]; (V) <<= 8; \
423 (V) += (P)[3]; \
424 } while (0)
425
426 #define INTSZ 4
427
428
429 Elf_Arsym *
_libelf_ar_process_svr4_symtab(Elf * e,size_t * count)430 _libelf_ar_process_svr4_symtab(Elf *e, size_t *count)
431 {
432 uint32_t off;
433 size_t n, nentries;
434 Elf_Arsym *symtab, *sym;
435 unsigned char *p, *s, *end;
436
437 assert(e != NULL);
438 assert(count != NULL);
439 assert(e->e_u.e_ar.e_symtab == NULL);
440
441 symtab = NULL;
442
443 if (e->e_u.e_ar.e_rawsymtabsz < INTSZ)
444 goto symtaberror;
445
446 p = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
447 end = p + e->e_u.e_ar.e_rawsymtabsz;
448
449 GET_WORD(p, nentries);
450 p += INTSZ;
451
452 if (nentries == 0 || p + nentries * INTSZ >= end)
453 goto symtaberror;
454
455 /* Allocate space for a nentries + a sentinel. */
456 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) {
457 LIBELF_SET_ERROR(RESOURCE, 0);
458 return (NULL);
459 }
460
461 s = p + (nentries * INTSZ); /* start of the string table. */
462
463 for (n = nentries, sym = symtab; n > 0; n--) {
464 if (s >= end)
465 goto symtaberror;
466
467 GET_WORD(p, off);
468 if (off >= e->e_rawsize)
469 goto symtaberror;
470
471 sym->as_off = (off_t) off;
472 sym->as_hash = elf_hash((char *) s);
473 sym->as_name = (char *) s;
474
475 p += INTSZ;
476 sym++;
477
478 for (; s < end && *s++ != '\0';) /* skip to next string */
479 ;
480 }
481
482 /* Fill up the sentinel entry. */
483 sym->as_name = NULL;
484 sym->as_hash = ~0UL;
485 sym->as_off = (off_t) 0;
486
487 *count = e->e_u.e_ar.e_symtabsz = nentries + 1;
488 e->e_u.e_ar.e_symtab = symtab;
489
490 return (symtab);
491
492 symtaberror:
493 if (symtab)
494 free(symtab);
495 LIBELF_SET_ERROR(ARCHIVE, 0);
496 return (NULL);
497 }
498