1/* $NetBSD: libelf_ar.c,v 1.5 2024/03/03 17:37:34 christos Exp $ */ 2 3/*- 4 * Copyright (c) 2006,2008,2010 Joseph Koshy 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#if HAVE_NBTOOL_CONFIG_H 30# include "nbtool_config.h" 31#endif 32 33#include <sys/cdefs.h> 34 35#include <assert.h> 36#include <ctype.h> 37#include <libelf.h> 38#include <stdlib.h> 39#include <string.h> 40 41#include "_libelf.h" 42#include "_libelf_ar.h" 43 44__RCSID("$NetBSD: libelf_ar.c,v 1.5 2024/03/03 17:37:34 christos Exp $"); 45ELFTC_VCSID("Id: libelf_ar.c 3977 2022-05-01 06:45:34Z jkoshy"); 46 47#define LIBELF_NALLOC_SIZE 16 48 49/* 50 * `ar' archive handling. 51 * 52 * `ar' archives start with signature `ARMAG'. Each archive member is 53 * preceded by a header containing meta-data for the member. This 54 * header is described in <ar.h> (struct ar_hdr). The header always 55 * starts on an even address. File data is padded with "\n" 56 * characters to keep this invariant. 57 * 58 * Special considerations for `ar' archives: 59 * 60 * There are two variants of the `ar' archive format: traditional BSD 61 * and SVR4. These differ in the way long file names are treated, and 62 * in the layout of the archive symbol table. 63 * 64 * The `ar' header only has space for a 16 character file name. 65 * 66 * In the SVR4 format, file names are terminated with a '/', so this 67 * effectively leaves 15 characters for the actual file name. Longer 68 * file names stored in a separate 'string table' and referenced 69 * indirectly from the name field. The string table itself appears as 70 * an archive member with name "// ". An `indirect' file name in an 71 * `ar' header matches the pattern "/[0-9]*". The digits form a 72 * decimal number that corresponds to a byte offset into the string 73 * table where the actual file name of the object starts. Strings in 74 * the string table are padded to start on even addresses. 75 * 76 * In the BSD format, file names can be up to 16 characters. File 77 * names shorter than 16 characters are padded to 16 characters using 78 * (ASCII) space characters. File names with embedded spaces and file 79 * names longer than 16 characters are stored immediately after the 80 * archive header and the name field set to a special indirect name 81 * matching the pattern "#1/[0-9]+". The digits form a decimal number 82 * that corresponds to the actual length of the file name following 83 * the archive header. The content of the archive member immediately 84 * follows the file name, and the size field of the archive member 85 * holds the sum of the sizes of the member and of the appended file 86 * name. 87 * 88 * Archives may also have a symbol table (see ranlib(1)), mapping 89 * program symbols to object files inside the archive. 90 * 91 * In the SVR4 format, a symbol table uses a file name of "/ " in its 92 * archive header. The symbol table is structured as: 93 * - a 4-byte count of entries stored as a binary value, MSB first 94 * - 'n' 4-byte offsets, stored as binary values, MSB first 95 * - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded. 96 * 97 * In the BSD format, the symbol table uses a file name of "__.SYMDEF". 98 * It is structured as two parts: 99 * - The first part is an array of "ranlib" structures preceded by 100 * the size of the array in bytes. Each "ranlib" structure 101 * describes one symbol. Each structure contains an offset into 102 * the string table for the symbol name, and a file offset into the 103 * archive for the member defining the symbol. 104 * - The second part is a string table containing NUL-terminated 105 * strings, preceded by the size of the string table in bytes. 106 * 107 * If the symbol table and string table are is present in an archive 108 * they must be the very first objects and in that order. 109 */ 110 111 112/* 113 * Retrieve an archive header descriptor. 114 */ 115 116Elf_Arhdr * 117_libelf_ar_gethdr(Elf *e) 118{ 119 Elf *parent; 120 Elf_Arhdr *eh; 121 char *namelen; 122 size_t n, nlen; 123 struct ar_hdr *arh; 124 125 if ((parent = e->e_parent) == NULL) { 126 LIBELF_SET_ERROR(ARGUMENT, 0); 127 return (NULL); 128 } 129 130 assert((e->e_flags & LIBELF_F_AR_HEADER) == 0); 131 132 arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr; 133 134 assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG); 135 136 /* 137 * There needs to be enough space remaining in the file for the 138 * archive header. 139 */ 140 if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile + 141 (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) { 142 LIBELF_SET_ERROR(ARCHIVE, 0); 143 return (NULL); 144 } 145 146 if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) { 147 LIBELF_SET_ERROR(RESOURCE, 0); 148 return (NULL); 149 } 150 151 e->e_hdr.e_arhdr = eh; 152 e->e_flags |= LIBELF_F_AR_HEADER; 153 154 eh->ar_name = eh->ar_rawname = NULL; 155 156 if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) == 157 NULL) 158 goto error; 159 160 if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10, 161 &n) == 0) 162 goto error; 163 eh->ar_uid = (uid_t) n; 164 165 if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10, 166 &n) == 0) 167 goto error; 168 eh->ar_gid = (gid_t) n; 169 170 if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8, 171 &n) == 0) 172 goto error; 173 eh->ar_mode = (mode_t) n; 174 175 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10, 176 &n) == 0) 177 goto error; 178 179 /* 180 * Get the true size of the member if extended naming is being used. 181 */ 182 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) { 183 namelen = arh->ar_name + 184 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE; 185 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) - 186 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0) 187 goto error; 188 n -= nlen; 189 } 190 191 eh->ar_size = n; 192 193 if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL) 194 goto error; 195 196 eh->ar_flags = 0; 197 198 return (eh); 199 200 error: 201 if (eh) { 202 if (eh->ar_name) 203 free(eh->ar_name); 204 if (eh->ar_rawname) 205 free(eh->ar_rawname); 206 free(eh); 207 } 208 209 e->e_flags &= ~LIBELF_F_AR_HEADER; 210 e->e_hdr.e_rawhdr = (unsigned char *) arh; 211 212 return (NULL); 213} 214 215Elf * 216_libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf) 217{ 218 Elf *e; 219 size_t nsz, sz; 220 off_t next, end; 221 struct ar_hdr *arh; 222 char *member, *namelen; 223 224 assert(elf->e_kind == ELF_K_AR); 225 226 next = elf->e_u.e_ar.e_next; 227 228 /* 229 * `next' is only set to zero by elf_next() when the last 230 * member of an archive is processed. 231 */ 232 if (next == (off_t) 0) 233 return (NULL); 234 235 assert((next & 1) == 0); 236 237 /* 238 * There needs to be enough space in the file to contain an 239 * ar(1) header. 240 */ 241 end = next + (off_t) sizeof(struct ar_hdr); 242 if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */ 243 end > (off_t) elf->e_rawsize) { 244 LIBELF_SET_ERROR(ARCHIVE, 0); 245 return (NULL); 246 } 247 248 arh = (struct ar_hdr *) (elf->e_rawfile + next); 249 250 /* 251 * Retrieve the size of the member. 252 */ 253 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10, 254 &sz) == 0) { 255 LIBELF_SET_ERROR(ARCHIVE, 0); 256 return (NULL); 257 } 258 259 /* 260 * Check if the archive member that follows will fit in the 261 * containing archive. 262 */ 263 end += (off_t) sz; 264 if (end < next || /* Overflow. */ 265 end > (off_t) elf->e_rawsize) { 266 LIBELF_SET_ERROR(ARCHIVE, 0); 267 return (NULL); 268 } 269 270 /* 271 * Adjust the size field for members in BSD archives using 272 * extended naming. 273 */ 274 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) { 275 namelen = arh->ar_name + 276 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE; 277 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) - 278 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) { 279 LIBELF_SET_ERROR(ARCHIVE, 0); 280 return (NULL); 281 } 282 283 member = (char *) (arh + 1) + nsz; 284 sz -= nsz; 285 } else 286 member = (char *) (arh + 1); 287 288 289 if ((e = elf_memory(member, sz)) == NULL) 290 return (NULL); 291 292 e->e_fd = fd; 293 e->e_cmd = c; 294 e->e_hdr.e_rawhdr = (unsigned char *) arh; 295 296 elf->e_u.e_ar.e_nchildren++; 297 e->e_parent = elf; 298 299 return (e); 300} 301 302/* 303 * A BSD-style ar(1) symbol table has the following layout: 304 * 305 * - A count of bytes used by the following array of 'ranlib' 306 * structures, stored as a 'long'. 307 * - An array of 'ranlib' structures. Each array element is 308 * two 'long's in size. 309 * - A count of bytes used for the following symbol table. 310 * - The symbol table itself. 311 */ 312 313/* 314 * A helper macro to read in a 'long' value from the archive. 315 * 316 * We use memcpy() since the source pointer may be misaligned with 317 * respect to the natural alignment for a C 'long'. 318 */ 319#define GET_LONG(P, V)do { \ 320 memcpy(&(V), (P), sizeof(long)); \ 321 (P) += sizeof(long); \ 322 } while (/* CONSTCOND */ 0) 323 324Elf_Arsym * 325_libelf_ar_process_bsd_symtab(Elf *e, size_t *count) 326{ 327 Elf_Arsym *symtab, *sym; 328 unsigned int n; 329 size_t nentries; 330 unsigned char *end, *p, *p0, *s, *s0; 331 const size_t entrysize = 2 * sizeof(long); 332 long arraysize, fileoffset, stroffset, strtabsize; 333 334 assert(e != NULL); 335 assert(count != NULL); 336 assert(e->e_u.e_ar.e_symtab == NULL); 337 338 symtab = NULL; 339 340 /* 341 * The BSD symbol table always contains the count fields even 342 * if there are no entries in it. 343 */ 344 if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long)) 345 goto symtaberror; 346 347 p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab; 348 end = p0 + e->e_u.e_ar.e_rawsymtabsz; 349 350 /* 351 * Retrieve the size of the array of ranlib descriptors and 352 * check it for validity. 353 */ 354 GET_LONG(p, arraysize); 355 356 if (arraysize < 0 || p0 + arraysize >= end || 357 ((size_t) arraysize % entrysize != 0)) 358 goto symtaberror; 359 360 /* 361 * Check the value of the string table size. 362 */ 363 s = p + arraysize; 364 GET_LONG(s, strtabsize); 365 366 s0 = s; /* Start of string table. */ 367 if (strtabsize < 0 || s0 + strtabsize > end) 368 goto symtaberror; 369 370 nentries = (size_t) arraysize / entrysize; 371 372 /* 373 * Allocate space for the returned Elf_Arsym array. 374 */ 375 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) { 376 LIBELF_SET_ERROR(RESOURCE, 0); 377 return (NULL); 378 } 379 380 /* Read in symbol table entries. */ 381 for (n = 0, sym = symtab; n < nentries; n++, sym++) { 382 GET_LONG(p, stroffset); 383 GET_LONG(p, fileoffset); 384 385 if (stroffset < 0 || fileoffset < 0 || 386 (off_t) fileoffset >= e->e_rawsize) 387 goto symtaberror; 388 389 s = s0 + stroffset; 390 391 if (s >= end) 392 goto symtaberror; 393 394 sym->as_off = (off_t) fileoffset; 395 sym->as_hash = elf_hash((char *) s); 396 sym->as_name = (char *) s; 397 } 398 399 /* Fill up the sentinel entry. */ 400 sym->as_name = NULL; 401 sym->as_hash = ~0UL; 402 sym->as_off = (off_t) 0; 403 404 /* Remember the processed symbol table. */ 405 e->e_u.e_ar.e_symtab = symtab; 406 407 *count = e->e_u.e_ar.e_symtabsz = nentries + 1; 408 409 return (symtab); 410 411symtaberror: 412 if (symtab) 413 free(symtab); 414 LIBELF_SET_ERROR(ARCHIVE, 0); 415 return (NULL); 416} 417 418/* 419 * An SVR4-style ar(1) symbol table has the following layout: 420 * 421 * - The first 4 bytes are a binary count of the number of entries in the 422 * symbol table, stored MSB-first. 423 * - Then there are 'n' 4-byte binary offsets, also stored MSB first. 424 * - Following this, there are 'n' null-terminated strings. 425 */ 426 427#define GET_WORD(P, V) do { \ 428 (V) = 0; \ 429 (V) = (P)[0]; (V) <<= 8; \ 430 (V) += (P)[1]; (V) <<= 8; \ 431 (V) += (P)[2]; (V) <<= 8; \ 432 (V) += (P)[3]; \ 433 } while (/* CONSTCOND */ 0) 434 435#define INTSZ 4 436 437 438Elf_Arsym * 439_libelf_ar_process_svr4_symtab(Elf *e, size_t *count) 440{ 441 uint32_t off; 442 size_t n, nentries; 443 Elf_Arsym *symtab, *sym; 444 unsigned char *p, *s, *end; 445 446 assert(e != NULL); 447 assert(count != NULL); 448 assert(e->e_u.e_ar.e_symtab == NULL); 449 450 symtab = NULL; 451 452 if (e->e_u.e_ar.e_rawsymtabsz < INTSZ) 453 goto symtaberror; 454 455 p = (unsigned char *) e->e_u.e_ar.e_rawsymtab; 456 end = p + e->e_u.e_ar.e_rawsymtabsz; 457 458 GET_WORD(p, nentries); 459 p += INTSZ; 460 461 if (nentries == 0 || p + nentries * INTSZ >= end) 462 goto symtaberror; 463 464 /* Allocate space for a nentries + a sentinel. */ 465 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) { 466 LIBELF_SET_ERROR(RESOURCE, 0); 467 return (NULL); 468 } 469 470 s = p + (nentries * INTSZ); /* start of the string table. */ 471 472 for (n = nentries, sym = symtab; n > 0; n--) { 473 if (s >= end) 474 goto symtaberror; 475 476 GET_WORD(p, off); 477 if ((off_t) off >= e->e_rawsize) 478 goto symtaberror; 479 480 sym->as_off = (off_t) off; 481 sym->as_hash = elf_hash((char *) s); 482 sym->as_name = (char *) s; 483 484 p += INTSZ; 485 sym++; 486 487 for (; s < end && *s++ != '\0';) /* skip to next string */ 488 ; 489 } 490 491 /* Fill up the sentinel entry. */ 492 sym->as_name = NULL; 493 sym->as_hash = ~0UL; 494 sym->as_off = (off_t) 0; 495 496 *count = e->e_u.e_ar.e_symtabsz = nentries + 1; 497 e->e_u.e_ar.e_symtab = symtab; 498 499 return (symtab); 500 501symtaberror: 502 if (symtab) 503 free(symtab); 504 LIBELF_SET_ERROR(ARCHIVE, 0); 505 return (NULL); 506} 507