1 /*- 2 * Copyright (c) 2006,2008,2010 Joseph Koshy 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <assert.h> 28 #include <ctype.h> 29 #include <libelf.h> 30 #include <stdlib.h> 31 #include <string.h> 32 33 #include "_libelf.h" 34 #include "_libelf_ar.h" 35 36 ELFTC_VCSID("$Id: libelf_ar.c 3712 2019-03-16 22:23:34Z jkoshy $"); 37 38 #define LIBELF_NALLOC_SIZE 16 39 40 /* 41 * `ar' archive handling. 42 * 43 * `ar' archives start with signature `ARMAG'. Each archive member is 44 * preceded by a header containing meta-data for the member. This 45 * header is described in <ar.h> (struct ar_hdr). The header always 46 * starts on an even address. File data is padded with "\n" 47 * characters to keep this invariant. 48 * 49 * Special considerations for `ar' archives: 50 * 51 * There are two variants of the `ar' archive format: traditional BSD 52 * and SVR4. These differ in the way long file names are treated, and 53 * in the layout of the archive symbol table. 54 * 55 * The `ar' header only has space for a 16 character file name. 56 * 57 * In the SVR4 format, file names are terminated with a '/', so this 58 * effectively leaves 15 characters for the actual file name. Longer 59 * file names stored in a separate 'string table' and referenced 60 * indirectly from the name field. The string table itself appears as 61 * an archive member with name "// ". An `indirect' file name in an 62 * `ar' header matches the pattern "/[0-9]*". The digits form a 63 * decimal number that corresponds to a byte offset into the string 64 * table where the actual file name of the object starts. Strings in 65 * the string table are padded to start on even addresses. 66 * 67 * In the BSD format, file names can be up to 16 characters. File 68 * names shorter than 16 characters are padded to 16 characters using 69 * (ASCII) space characters. File names with embedded spaces and file 70 * names longer than 16 characters are stored immediately after the 71 * archive header and the name field set to a special indirect name 72 * matching the pattern "#1/[0-9]+". The digits form a decimal number 73 * that corresponds to the actual length of the file name following 74 * the archive header. The content of the archive member immediately 75 * follows the file name, and the size field of the archive member 76 * holds the sum of the sizes of the member and of the appended file 77 * name. 78 * 79 * Archives may also have a symbol table (see ranlib(1)), mapping 80 * program symbols to object files inside the archive. 81 * 82 * In the SVR4 format, a symbol table uses a file name of "/ " in its 83 * archive header. The symbol table is structured as: 84 * - a 4-byte count of entries stored as a binary value, MSB first 85 * - 'n' 4-byte offsets, stored as binary values, MSB first 86 * - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded. 87 * 88 * In the BSD format, the symbol table uses a file name of "__.SYMDEF". 89 * It is structured as two parts: 90 * - The first part is an array of "ranlib" structures preceded by 91 * the size of the array in bytes. Each "ranlib" structure 92 * describes one symbol. Each structure contains an offset into 93 * the string table for the symbol name, and a file offset into the 94 * archive for the member defining the symbol. 95 * - The second part is a string table containing NUL-terminated 96 * strings, preceded by the size of the string table in bytes. 97 * 98 * If the symbol table and string table are is present in an archive 99 * they must be the very first objects and in that order. 100 */ 101 102 103 /* 104 * Retrieve an archive header descriptor. 105 */ 106 107 Elf_Arhdr * 108 _libelf_ar_gethdr(Elf *e) 109 { 110 Elf *parent; 111 Elf_Arhdr *eh; 112 char *namelen; 113 size_t n, nlen; 114 struct ar_hdr *arh; 115 116 if ((parent = e->e_parent) == NULL) { 117 LIBELF_SET_ERROR(ARGUMENT, 0); 118 return (NULL); 119 } 120 121 assert((e->e_flags & LIBELF_F_AR_HEADER) == 0); 122 123 arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr; 124 125 assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG); 126 127 /* 128 * There needs to be enough space remaining in the file for the 129 * archive header. 130 */ 131 if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile + 132 (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) { 133 LIBELF_SET_ERROR(ARCHIVE, 0); 134 return (NULL); 135 } 136 137 if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) { 138 LIBELF_SET_ERROR(RESOURCE, 0); 139 return (NULL); 140 } 141 142 e->e_hdr.e_arhdr = eh; 143 e->e_flags |= LIBELF_F_AR_HEADER; 144 145 eh->ar_name = eh->ar_rawname = NULL; 146 147 if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) == 148 NULL) 149 goto error; 150 151 if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10, 152 &n) == 0) 153 goto error; 154 eh->ar_uid = (uid_t) n; 155 156 if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10, 157 &n) == 0) 158 goto error; 159 eh->ar_gid = (gid_t) n; 160 161 if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8, 162 &n) == 0) 163 goto error; 164 eh->ar_mode = (mode_t) n; 165 166 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10, 167 &n) == 0) 168 goto error; 169 170 /* 171 * Get the true size of the member if extended naming is being used. 172 */ 173 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) { 174 namelen = arh->ar_name + 175 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE; 176 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) - 177 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0) 178 goto error; 179 n -= nlen; 180 } 181 182 eh->ar_size = n; 183 184 if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL) 185 goto error; 186 187 eh->ar_flags = 0; 188 189 return (eh); 190 191 error: 192 if (eh) { 193 if (eh->ar_name) 194 free(eh->ar_name); 195 if (eh->ar_rawname) 196 free(eh->ar_rawname); 197 free(eh); 198 } 199 200 e->e_flags &= ~LIBELF_F_AR_HEADER; 201 e->e_hdr.e_rawhdr = (unsigned char *) arh; 202 203 return (NULL); 204 } 205 206 Elf * 207 _libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf) 208 { 209 Elf *e; 210 size_t nsz, sz; 211 off_t next, end; 212 struct ar_hdr *arh; 213 char *member, *namelen; 214 215 assert(elf->e_kind == ELF_K_AR); 216 217 next = elf->e_u.e_ar.e_next; 218 219 /* 220 * `next' is only set to zero by elf_next() when the last 221 * member of an archive is processed. 222 */ 223 if (next == (off_t) 0) 224 return (NULL); 225 226 assert((next & 1) == 0); 227 228 /* 229 * There needs to be enough space in the file to contain an 230 * ar(1) header. 231 */ 232 end = next + (off_t) sizeof(struct ar_hdr); 233 if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */ 234 end > (off_t) elf->e_rawsize) { 235 LIBELF_SET_ERROR(ARCHIVE, 0); 236 return (NULL); 237 } 238 239 arh = (struct ar_hdr *) (elf->e_rawfile + next); 240 241 /* 242 * Retrieve the size of the member. 243 */ 244 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10, 245 &sz) == 0) { 246 LIBELF_SET_ERROR(ARCHIVE, 0); 247 return (NULL); 248 } 249 250 /* 251 * Check if the archive member that follows will fit in the 252 * containing archive. 253 */ 254 end += (off_t) sz; 255 if (end < next || /* Overflow. */ 256 end > (off_t) elf->e_rawsize) { 257 LIBELF_SET_ERROR(ARCHIVE, 0); 258 return (NULL); 259 } 260 261 /* 262 * Adjust the size field for members in BSD archives using 263 * extended naming. 264 */ 265 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) { 266 namelen = arh->ar_name + 267 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE; 268 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) - 269 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) { 270 LIBELF_SET_ERROR(ARCHIVE, 0); 271 return (NULL); 272 } 273 274 member = (char *) (arh + 1) + nsz; 275 sz -= nsz; 276 } else 277 member = (char *) (arh + 1); 278 279 280 if ((e = elf_memory(member, sz)) == NULL) 281 return (NULL); 282 283 e->e_fd = fd; 284 e->e_cmd = c; 285 e->e_hdr.e_rawhdr = (unsigned char *) arh; 286 287 elf->e_u.e_ar.e_nchildren++; 288 e->e_parent = elf; 289 290 return (e); 291 } 292 293 /* 294 * A BSD-style ar(1) symbol table has the following layout: 295 * 296 * - A count of bytes used by the following array of 'ranlib' 297 * structures, stored as a 'long'. 298 * - An array of 'ranlib' structures. Each array element is 299 * two 'long's in size. 300 * - A count of bytes used for the following symbol table. 301 * - The symbol table itself. 302 */ 303 304 /* 305 * A helper macro to read in a 'long' value from the archive. 306 * 307 * We use memcpy() since the source pointer may be misaligned with 308 * respect to the natural alignment for a C 'long'. 309 */ 310 #define GET_LONG(P, V)do { \ 311 memcpy(&(V), (P), sizeof(long)); \ 312 (P) += sizeof(long); \ 313 } while (0) 314 315 Elf_Arsym * 316 _libelf_ar_process_bsd_symtab(Elf *e, size_t *count) 317 { 318 Elf_Arsym *symtab, *sym; 319 unsigned int n; 320 size_t nentries; 321 unsigned char *end, *p, *p0, *s, *s0; 322 const size_t entrysize = 2 * sizeof(long); 323 long arraysize, fileoffset, stroffset, strtabsize; 324 325 assert(e != NULL); 326 assert(count != NULL); 327 assert(e->e_u.e_ar.e_symtab == NULL); 328 329 symtab = NULL; 330 331 /* 332 * The BSD symbol table always contains the count fields even 333 * if there are no entries in it. 334 */ 335 if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long)) 336 goto symtaberror; 337 338 p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab; 339 end = p0 + e->e_u.e_ar.e_rawsymtabsz; 340 341 /* 342 * Retrieve the size of the array of ranlib descriptors and 343 * check it for validity. 344 */ 345 GET_LONG(p, arraysize); 346 347 if (arraysize < 0 || p0 + arraysize >= end || 348 ((size_t) arraysize % entrysize != 0)) 349 goto symtaberror; 350 351 /* 352 * Check the value of the string table size. 353 */ 354 s = p + arraysize; 355 GET_LONG(s, strtabsize); 356 357 s0 = s; /* Start of string table. */ 358 if (strtabsize < 0 || s0 + strtabsize > end) 359 goto symtaberror; 360 361 nentries = (size_t) arraysize / entrysize; 362 363 /* 364 * Allocate space for the returned Elf_Arsym array. 365 */ 366 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) { 367 LIBELF_SET_ERROR(RESOURCE, 0); 368 return (NULL); 369 } 370 371 /* Read in symbol table entries. */ 372 for (n = 0, sym = symtab; n < nentries; n++, sym++) { 373 GET_LONG(p, stroffset); 374 GET_LONG(p, fileoffset); 375 376 if (stroffset < 0 || fileoffset < 0 || 377 (off_t) fileoffset >= e->e_rawsize) 378 goto symtaberror; 379 380 s = s0 + stroffset; 381 382 if (s >= end) 383 goto symtaberror; 384 385 sym->as_off = (off_t) fileoffset; 386 sym->as_hash = elf_hash((char *) s); 387 sym->as_name = (char *) s; 388 } 389 390 /* Fill up the sentinel entry. */ 391 sym->as_name = NULL; 392 sym->as_hash = ~0UL; 393 sym->as_off = (off_t) 0; 394 395 /* Remember the processed symbol table. */ 396 e->e_u.e_ar.e_symtab = symtab; 397 398 *count = e->e_u.e_ar.e_symtabsz = nentries + 1; 399 400 return (symtab); 401 402 symtaberror: 403 if (symtab) 404 free(symtab); 405 LIBELF_SET_ERROR(ARCHIVE, 0); 406 return (NULL); 407 } 408 409 /* 410 * An SVR4-style ar(1) symbol table has the following layout: 411 * 412 * - The first 4 bytes are a binary count of the number of entries in the 413 * symbol table, stored MSB-first. 414 * - Then there are 'n' 4-byte binary offsets, also stored MSB first. 415 * - Following this, there are 'n' null-terminated strings. 416 */ 417 418 #define GET_WORD(P, V) do { \ 419 (V) = 0; \ 420 (V) = (P)[0]; (V) <<= 8; \ 421 (V) += (P)[1]; (V) <<= 8; \ 422 (V) += (P)[2]; (V) <<= 8; \ 423 (V) += (P)[3]; \ 424 } while (0) 425 426 #define INTSZ 4 427 428 429 Elf_Arsym * 430 _libelf_ar_process_svr4_symtab(Elf *e, size_t *count) 431 { 432 uint32_t off; 433 size_t n, nentries; 434 Elf_Arsym *symtab, *sym; 435 unsigned char *p, *s, *end; 436 437 assert(e != NULL); 438 assert(count != NULL); 439 assert(e->e_u.e_ar.e_symtab == NULL); 440 441 symtab = NULL; 442 443 if (e->e_u.e_ar.e_rawsymtabsz < INTSZ) 444 goto symtaberror; 445 446 p = (unsigned char *) e->e_u.e_ar.e_rawsymtab; 447 end = p + e->e_u.e_ar.e_rawsymtabsz; 448 449 GET_WORD(p, nentries); 450 p += INTSZ; 451 452 if (nentries == 0 || p + nentries * INTSZ >= end) 453 goto symtaberror; 454 455 /* Allocate space for a nentries + a sentinel. */ 456 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) { 457 LIBELF_SET_ERROR(RESOURCE, 0); 458 return (NULL); 459 } 460 461 s = p + (nentries * INTSZ); /* start of the string table. */ 462 463 for (n = nentries, sym = symtab; n > 0; n--) { 464 if (s >= end) 465 goto symtaberror; 466 467 GET_WORD(p, off); 468 if (off >= e->e_rawsize) 469 goto symtaberror; 470 471 sym->as_off = (off_t) off; 472 sym->as_hash = elf_hash((char *) s); 473 sym->as_name = (char *) s; 474 475 p += INTSZ; 476 sym++; 477 478 for (; s < end && *s++ != '\0';) /* skip to next string */ 479 ; 480 } 481 482 /* Fill up the sentinel entry. */ 483 sym->as_name = NULL; 484 sym->as_hash = ~0UL; 485 sym->as_off = (off_t) 0; 486 487 *count = e->e_u.e_ar.e_symtabsz = nentries + 1; 488 e->e_u.e_ar.e_symtab = symtab; 489 490 return (symtab); 491 492 symtaberror: 493 if (symtab) 494 free(symtab); 495 LIBELF_SET_ERROR(ARCHIVE, 0); 496 return (NULL); 497 } 498