1/*- 2 * Copyright (c) 2006,2008,2010 Joseph Koshy 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27#include <assert.h> 28#include <ctype.h> 29#include <libelf.h> 30#include <stdlib.h> 31#include <string.h> 32#include <stdint.h> 33 34#include "_libelf.h" 35#include "_libelf_ar.h" 36 37ELFTC_VCSID("$Id: libelf_ar.c,v 1.2 2019/03/19 02:31:35 jsg Exp $"); 38 39#define LIBELF_NALLOC_SIZE 16 40 41/* 42 * `ar' archive handling. 43 * 44 * `ar' archives start with signature `ARMAG'. Each archive member is 45 * preceded by a header containing meta-data for the member. This 46 * header is described in <ar.h> (struct ar_hdr). The header always 47 * starts on an even address. File data is padded with "\n" 48 * characters to keep this invariant. 49 * 50 * Special considerations for `ar' archives: 51 * 52 * There are two variants of the `ar' archive format: traditional BSD 53 * and SVR4. These differ in the way long file names are treated, and 54 * in the layout of the archive symbol table. 55 * 56 * The `ar' header only has space for a 16 character file name. 57 * 58 * In the SVR4 format, file names are terminated with a '/', so this 59 * effectively leaves 15 characters for the actual file name. Longer 60 * file names stored in a separate 'string table' and referenced 61 * indirectly from the name field. The string table itself appears as 62 * an archive member with name "// ". An `indirect' file name in an 63 * `ar' header matches the pattern "/[0-9]*". The digits form a 64 * decimal number that corresponds to a byte offset into the string 65 * table where the actual file name of the object starts. Strings in 66 * the string table are padded to start on even addresses. 67 * 68 * In the BSD format, file names can be up to 16 characters. File 69 * names shorter than 16 characters are padded to 16 characters using 70 * (ASCII) space characters. File names with embedded spaces and file 71 * names longer than 16 characters are stored immediately after the 72 * archive header and the name field set to a special indirect name 73 * matching the pattern "#1/[0-9]+". The digits form a decimal number 74 * that corresponds to the actual length of the file name following 75 * the archive header. The content of the archive member immediately 76 * follows the file name, and the size field of the archive member 77 * holds the sum of the sizes of the member and of the appended file 78 * name. 79 * 80 * Archives may also have a symbol table (see ranlib(1)), mapping 81 * program symbols to object files inside the archive. 82 * 83 * In the SVR4 format, a symbol table uses a file name of "/ " in its 84 * archive header. The symbol table is structured as: 85 * - a 4-byte count of entries stored as a binary value, MSB first 86 * - 'n' 4-byte offsets, stored as binary values, MSB first 87 * - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded. 88 * 89 * In the BSD format, the symbol table uses a file name of "__.SYMDEF". 90 * It is structured as two parts: 91 * - The first part is an array of "ranlib" structures preceded by 92 * the size of the array in bytes. Each "ranlib" structure 93 * describes one symbol. Each structure contains an offset into 94 * the string table for the symbol name, and a file offset into the 95 * archive for the member defining the symbol. 96 * - The second part is a string table containing NUL-terminated 97 * strings, preceded by the size of the string table in bytes. 98 * 99 * If the symbol table and string table are is present in an archive 100 * they must be the very first objects and in that order. 101 */ 102 103 104/* 105 * Retrieve an archive header descriptor. 106 */ 107 108Elf_Arhdr * 109_libelf_ar_gethdr(Elf *e) 110{ 111 Elf *parent; 112 Elf_Arhdr *eh; 113 char *namelen; 114 size_t n, nlen; 115 struct ar_hdr *arh; 116 117 if ((parent = e->e_parent) == NULL) { 118 LIBELF_SET_ERROR(ARGUMENT, 0); 119 return (NULL); 120 } 121 122 assert((e->e_flags & LIBELF_F_AR_HEADER) == 0); 123 124 arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr; 125 126 assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG); 127 128 /* 129 * There needs to be enough space remaining in the file for the 130 * archive header. 131 */ 132 if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile + 133 (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) { 134 LIBELF_SET_ERROR(ARCHIVE, 0); 135 return (NULL); 136 } 137 138 if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) { 139 LIBELF_SET_ERROR(RESOURCE, 0); 140 return (NULL); 141 } 142 143 e->e_hdr.e_arhdr = eh; 144 e->e_flags |= LIBELF_F_AR_HEADER; 145 146 eh->ar_name = eh->ar_rawname = NULL; 147 148 if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) == 149 NULL) 150 goto error; 151 152 if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10, 153 &n) == 0) 154 goto error; 155 eh->ar_uid = (uid_t) n; 156 157 if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10, 158 &n) == 0) 159 goto error; 160 eh->ar_gid = (gid_t) n; 161 162 if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8, 163 &n) == 0) 164 goto error; 165 eh->ar_mode = (mode_t) n; 166 167 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10, 168 &n) == 0) 169 goto error; 170 171 /* 172 * Get the true size of the member if extended naming is being used. 173 */ 174 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) { 175 namelen = arh->ar_name + 176 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE; 177 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) - 178 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0) 179 goto error; 180 n -= nlen; 181 } 182 183 eh->ar_size = n; 184 185 if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL) 186 goto error; 187 188 eh->ar_flags = 0; 189 190 return (eh); 191 192 error: 193 if (eh) { 194 if (eh->ar_name) 195 free(eh->ar_name); 196 if (eh->ar_rawname) 197 free(eh->ar_rawname); 198 free(eh); 199 } 200 201 e->e_flags &= ~LIBELF_F_AR_HEADER; 202 e->e_hdr.e_rawhdr = (unsigned char *) arh; 203 204 return (NULL); 205} 206 207Elf * 208_libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf) 209{ 210 Elf *e; 211 size_t nsz, sz; 212 off_t next, end; 213 struct ar_hdr *arh; 214 char *member, *namelen; 215 216 assert(elf->e_kind == ELF_K_AR); 217 218 next = elf->e_u.e_ar.e_next; 219 220 /* 221 * `next' is only set to zero by elf_next() when the last 222 * member of an archive is processed. 223 */ 224 if (next == (off_t) 0) 225 return (NULL); 226 227 assert((next & 1) == 0); 228 229 /* 230 * There needs to be enough space in the file to contain an 231 * ar(1) header. 232 */ 233 end = next + (off_t) sizeof(struct ar_hdr); 234 if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */ 235 end > (off_t) elf->e_rawsize) { 236 LIBELF_SET_ERROR(ARCHIVE, 0); 237 return (NULL); 238 } 239 240 arh = (struct ar_hdr *) (elf->e_rawfile + next); 241 242 /* 243 * Retrieve the size of the member. 244 */ 245 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10, 246 &sz) == 0) { 247 LIBELF_SET_ERROR(ARCHIVE, 0); 248 return (NULL); 249 } 250 251 /* 252 * Check if the archive member that follows will fit in the 253 * containing archive. 254 */ 255 end += (off_t) sz; 256 if (end < next || /* Overflow. */ 257 end > (off_t) elf->e_rawsize) { 258 LIBELF_SET_ERROR(ARCHIVE, 0); 259 return (NULL); 260 } 261 262 /* 263 * Adjust the size field for members in BSD archives using 264 * extended naming. 265 */ 266 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) { 267 namelen = arh->ar_name + 268 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE; 269 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) - 270 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) { 271 LIBELF_SET_ERROR(ARCHIVE, 0); 272 return (NULL); 273 } 274 275 member = (char *) (arh + 1) + nsz; 276 sz -= nsz; 277 } else 278 member = (char *) (arh + 1); 279 280 281 if ((e = elf_memory(member, sz)) == NULL) 282 return (NULL); 283 284 e->e_fd = fd; 285 e->e_cmd = c; 286 e->e_hdr.e_rawhdr = (unsigned char *) arh; 287 288 elf->e_u.e_ar.e_nchildren++; 289 e->e_parent = elf; 290 291 return (e); 292} 293 294/* 295 * A BSD-style ar(1) symbol table has the following layout: 296 * 297 * - A count of bytes used by the following array of 'ranlib' 298 * structures, stored as a 'long'. 299 * - An array of 'ranlib' structures. Each array element is 300 * two 'long's in size. 301 * - A count of bytes used for the following symbol table. 302 * - The symbol table itself. 303 */ 304 305/* 306 * A helper macro to read in a 'long' value from the archive. 307 * 308 * We use memcpy() since the source pointer may be misaligned with 309 * respect to the natural alignment for a C 'long'. 310 */ 311#define GET_LONG(P, V)do { \ 312 memcpy(&(V), (P), sizeof(long)); \ 313 (P) += sizeof(long); \ 314 } while (0) 315 316Elf_Arsym * 317_libelf_ar_process_bsd_symtab(Elf *e, size_t *count) 318{ 319 Elf_Arsym *symtab, *sym; 320 unsigned int n; 321 size_t nentries; 322 unsigned char *end, *p, *p0, *s, *s0; 323 const size_t entrysize = 2 * sizeof(long); 324 long arraysize, fileoffset, stroffset, strtabsize; 325 326 assert(e != NULL); 327 assert(count != NULL); 328 assert(e->e_u.e_ar.e_symtab == NULL); 329 330 symtab = NULL; 331 332 /* 333 * The BSD symbol table always contains the count fields even 334 * if there are no entries in it. 335 */ 336 if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long)) 337 goto symtaberror; 338 339 p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab; 340 end = p0 + e->e_u.e_ar.e_rawsymtabsz; 341 342 /* 343 * Retrieve the size of the array of ranlib descriptors and 344 * check it for validity. 345 */ 346 GET_LONG(p, arraysize); 347 348 if (arraysize < 0 || p0 + arraysize >= end || 349 ((size_t) arraysize % entrysize != 0)) 350 goto symtaberror; 351 352 /* 353 * Check the value of the string table size. 354 */ 355 s = p + arraysize; 356 GET_LONG(s, strtabsize); 357 358 s0 = s; /* Start of string table. */ 359 if (strtabsize < 0 || s0 + strtabsize > end) 360 goto symtaberror; 361 362 nentries = (size_t) arraysize / entrysize; 363 364 /* 365 * Allocate space for the returned Elf_Arsym array. 366 */ 367 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) { 368 LIBELF_SET_ERROR(RESOURCE, 0); 369 return (NULL); 370 } 371 372 /* Read in symbol table entries. */ 373 for (n = 0, sym = symtab; n < nentries; n++, sym++) { 374 GET_LONG(p, stroffset); 375 GET_LONG(p, fileoffset); 376 377 if (stroffset < 0 || fileoffset < 0 || 378 (off_t) fileoffset >= e->e_rawsize) 379 goto symtaberror; 380 381 s = s0 + stroffset; 382 383 if (s >= end) 384 goto symtaberror; 385 386 sym->as_off = (off_t) fileoffset; 387 sym->as_hash = elf_hash((char *) s); 388 sym->as_name = (char *) s; 389 } 390 391 /* Fill up the sentinel entry. */ 392 sym->as_name = NULL; 393 sym->as_hash = ~0UL; 394 sym->as_off = (off_t) 0; 395 396 /* Remember the processed symbol table. */ 397 e->e_u.e_ar.e_symtab = symtab; 398 399 *count = e->e_u.e_ar.e_symtabsz = nentries + 1; 400 401 return (symtab); 402 403symtaberror: 404 if (symtab) 405 free(symtab); 406 LIBELF_SET_ERROR(ARCHIVE, 0); 407 return (NULL); 408} 409 410/* 411 * An SVR4-style ar(1) symbol table has the following layout: 412 * 413 * - The first 4 bytes are a binary count of the number of entries in the 414 * symbol table, stored MSB-first. 415 * - Then there are 'n' 4-byte binary offsets, also stored MSB first. 416 * - Following this, there are 'n' null-terminated strings. 417 */ 418 419#define GET_WORD(P, V) do { \ 420 (V) = 0; \ 421 (V) = (P)[0]; (V) <<= 8; \ 422 (V) += (P)[1]; (V) <<= 8; \ 423 (V) += (P)[2]; (V) <<= 8; \ 424 (V) += (P)[3]; \ 425 } while (0) 426 427#define INTSZ 4 428 429 430Elf_Arsym * 431_libelf_ar_process_svr4_symtab(Elf *e, size_t *count) 432{ 433 uint32_t off; 434 size_t n, nentries; 435 Elf_Arsym *symtab, *sym; 436 unsigned char *p, *s, *end; 437 438 assert(e != NULL); 439 assert(count != NULL); 440 assert(e->e_u.e_ar.e_symtab == NULL); 441 442 symtab = NULL; 443 444 if (e->e_u.e_ar.e_rawsymtabsz < INTSZ) 445 goto symtaberror; 446 447 p = (unsigned char *) e->e_u.e_ar.e_rawsymtab; 448 end = p + e->e_u.e_ar.e_rawsymtabsz; 449 450 GET_WORD(p, nentries); 451 p += INTSZ; 452 453 if (nentries == 0 || p + nentries * INTSZ >= end) 454 goto symtaberror; 455 456 /* Allocate space for a nentries + a sentinel. */ 457 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) { 458 LIBELF_SET_ERROR(RESOURCE, 0); 459 return (NULL); 460 } 461 462 s = p + (nentries * INTSZ); /* start of the string table. */ 463 464 for (n = nentries, sym = symtab; n > 0; n--) { 465 if (s >= end) 466 goto symtaberror; 467 468 GET_WORD(p, off); 469 if (off >= e->e_rawsize) 470 goto symtaberror; 471 472 sym->as_off = (off_t) off; 473 sym->as_hash = elf_hash((char *) s); 474 sym->as_name = (char *) s; 475 476 p += INTSZ; 477 sym++; 478 479 for (; s < end && *s++ != '\0';) /* skip to next string */ 480 ; 481 } 482 483 /* Fill up the sentinel entry. */ 484 sym->as_name = NULL; 485 sym->as_hash = ~0UL; 486 sym->as_off = (off_t) 0; 487 488 *count = e->e_u.e_ar.e_symtabsz = nentries + 1; 489 e->e_u.e_ar.e_symtab = symtab; 490 491 return (symtab); 492 493symtaberror: 494 if (symtab) 495 free(symtab); 496 LIBELF_SET_ERROR(ARCHIVE, 0); 497 return (NULL); 498} 499