1 /* $NetBSD: libelf_ar.c,v 1.5 2024/03/03 17:37:34 christos Exp $ */
2
3 /*-
4 * Copyright (c) 2006,2008,2010 Joseph Koshy
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS `AS IS' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #if HAVE_NBTOOL_CONFIG_H
30 # include "nbtool_config.h"
31 #endif
32
33 #include <sys/cdefs.h>
34
35 #include <assert.h>
36 #include <ctype.h>
37 #include <libelf.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 #include "_libelf.h"
42 #include "_libelf_ar.h"
43
44 __RCSID("$NetBSD: libelf_ar.c,v 1.5 2024/03/03 17:37:34 christos Exp $");
45 ELFTC_VCSID("Id: libelf_ar.c 3977 2022-05-01 06:45:34Z jkoshy");
46
47 #define LIBELF_NALLOC_SIZE 16
48
49 /*
50 * `ar' archive handling.
51 *
52 * `ar' archives start with signature `ARMAG'. Each archive member is
53 * preceded by a header containing meta-data for the member. This
54 * header is described in <ar.h> (struct ar_hdr). The header always
55 * starts on an even address. File data is padded with "\n"
56 * characters to keep this invariant.
57 *
58 * Special considerations for `ar' archives:
59 *
60 * There are two variants of the `ar' archive format: traditional BSD
61 * and SVR4. These differ in the way long file names are treated, and
62 * in the layout of the archive symbol table.
63 *
64 * The `ar' header only has space for a 16 character file name.
65 *
66 * In the SVR4 format, file names are terminated with a '/', so this
67 * effectively leaves 15 characters for the actual file name. Longer
68 * file names stored in a separate 'string table' and referenced
69 * indirectly from the name field. The string table itself appears as
70 * an archive member with name "// ". An `indirect' file name in an
71 * `ar' header matches the pattern "/[0-9]*". The digits form a
72 * decimal number that corresponds to a byte offset into the string
73 * table where the actual file name of the object starts. Strings in
74 * the string table are padded to start on even addresses.
75 *
76 * In the BSD format, file names can be up to 16 characters. File
77 * names shorter than 16 characters are padded to 16 characters using
78 * (ASCII) space characters. File names with embedded spaces and file
79 * names longer than 16 characters are stored immediately after the
80 * archive header and the name field set to a special indirect name
81 * matching the pattern "#1/[0-9]+". The digits form a decimal number
82 * that corresponds to the actual length of the file name following
83 * the archive header. The content of the archive member immediately
84 * follows the file name, and the size field of the archive member
85 * holds the sum of the sizes of the member and of the appended file
86 * name.
87 *
88 * Archives may also have a symbol table (see ranlib(1)), mapping
89 * program symbols to object files inside the archive.
90 *
91 * In the SVR4 format, a symbol table uses a file name of "/ " in its
92 * archive header. The symbol table is structured as:
93 * - a 4-byte count of entries stored as a binary value, MSB first
94 * - 'n' 4-byte offsets, stored as binary values, MSB first
95 * - 'n' NUL-terminated strings, for ELF symbol names, stored unpadded.
96 *
97 * In the BSD format, the symbol table uses a file name of "__.SYMDEF".
98 * It is structured as two parts:
99 * - The first part is an array of "ranlib" structures preceded by
100 * the size of the array in bytes. Each "ranlib" structure
101 * describes one symbol. Each structure contains an offset into
102 * the string table for the symbol name, and a file offset into the
103 * archive for the member defining the symbol.
104 * - The second part is a string table containing NUL-terminated
105 * strings, preceded by the size of the string table in bytes.
106 *
107 * If the symbol table and string table are is present in an archive
108 * they must be the very first objects and in that order.
109 */
110
111
112 /*
113 * Retrieve an archive header descriptor.
114 */
115
116 Elf_Arhdr *
_libelf_ar_gethdr(Elf * e)117 _libelf_ar_gethdr(Elf *e)
118 {
119 Elf *parent;
120 Elf_Arhdr *eh;
121 char *namelen;
122 size_t n, nlen;
123 struct ar_hdr *arh;
124
125 if ((parent = e->e_parent) == NULL) {
126 LIBELF_SET_ERROR(ARGUMENT, 0);
127 return (NULL);
128 }
129
130 assert((e->e_flags & LIBELF_F_AR_HEADER) == 0);
131
132 arh = (struct ar_hdr *) (uintptr_t) e->e_hdr.e_rawhdr;
133
134 assert((uintptr_t) arh >= (uintptr_t) parent->e_rawfile + SARMAG);
135
136 /*
137 * There needs to be enough space remaining in the file for the
138 * archive header.
139 */
140 if ((uintptr_t) arh > (uintptr_t) parent->e_rawfile +
141 (uintptr_t) parent->e_rawsize - sizeof(struct ar_hdr)) {
142 LIBELF_SET_ERROR(ARCHIVE, 0);
143 return (NULL);
144 }
145
146 if ((eh = malloc(sizeof(Elf_Arhdr))) == NULL) {
147 LIBELF_SET_ERROR(RESOURCE, 0);
148 return (NULL);
149 }
150
151 e->e_hdr.e_arhdr = eh;
152 e->e_flags |= LIBELF_F_AR_HEADER;
153
154 eh->ar_name = eh->ar_rawname = NULL;
155
156 if ((eh->ar_name = _libelf_ar_get_translated_name(arh, parent)) ==
157 NULL)
158 goto error;
159
160 if (_libelf_ar_get_number(arh->ar_uid, sizeof(arh->ar_uid), 10,
161 &n) == 0)
162 goto error;
163 eh->ar_uid = (uid_t) n;
164
165 if (_libelf_ar_get_number(arh->ar_gid, sizeof(arh->ar_gid), 10,
166 &n) == 0)
167 goto error;
168 eh->ar_gid = (gid_t) n;
169
170 if (_libelf_ar_get_number(arh->ar_mode, sizeof(arh->ar_mode), 8,
171 &n) == 0)
172 goto error;
173 eh->ar_mode = (mode_t) n;
174
175 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
176 &n) == 0)
177 goto error;
178
179 /*
180 * Get the true size of the member if extended naming is being used.
181 */
182 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
183 namelen = arh->ar_name +
184 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
185 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
186 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nlen) == 0)
187 goto error;
188 n -= nlen;
189 }
190
191 eh->ar_size = n;
192
193 if ((eh->ar_rawname = _libelf_ar_get_raw_name(arh)) == NULL)
194 goto error;
195
196 eh->ar_flags = 0;
197
198 return (eh);
199
200 error:
201 if (eh) {
202 if (eh->ar_name)
203 free(eh->ar_name);
204 if (eh->ar_rawname)
205 free(eh->ar_rawname);
206 free(eh);
207 }
208
209 e->e_flags &= ~LIBELF_F_AR_HEADER;
210 e->e_hdr.e_rawhdr = (unsigned char *) arh;
211
212 return (NULL);
213 }
214
215 Elf *
_libelf_ar_open_member(int fd,Elf_Cmd c,Elf * elf)216 _libelf_ar_open_member(int fd, Elf_Cmd c, Elf *elf)
217 {
218 Elf *e;
219 size_t nsz, sz;
220 off_t next, end;
221 struct ar_hdr *arh;
222 char *member, *namelen;
223
224 assert(elf->e_kind == ELF_K_AR);
225
226 next = elf->e_u.e_ar.e_next;
227
228 /*
229 * `next' is only set to zero by elf_next() when the last
230 * member of an archive is processed.
231 */
232 if (next == (off_t) 0)
233 return (NULL);
234
235 assert((next & 1) == 0);
236
237 /*
238 * There needs to be enough space in the file to contain an
239 * ar(1) header.
240 */
241 end = next + (off_t) sizeof(struct ar_hdr);
242 if ((uintmax_t) end < (uintmax_t) next || /* Overflow. */
243 end > (off_t) elf->e_rawsize) {
244 LIBELF_SET_ERROR(ARCHIVE, 0);
245 return (NULL);
246 }
247
248 arh = (struct ar_hdr *) (elf->e_rawfile + next);
249
250 /*
251 * Retrieve the size of the member.
252 */
253 if (_libelf_ar_get_number(arh->ar_size, sizeof(arh->ar_size), 10,
254 &sz) == 0) {
255 LIBELF_SET_ERROR(ARCHIVE, 0);
256 return (NULL);
257 }
258
259 /*
260 * Check if the archive member that follows will fit in the
261 * containing archive.
262 */
263 end += (off_t) sz;
264 if (end < next || /* Overflow. */
265 end > (off_t) elf->e_rawsize) {
266 LIBELF_SET_ERROR(ARCHIVE, 0);
267 return (NULL);
268 }
269
270 /*
271 * Adjust the size field for members in BSD archives using
272 * extended naming.
273 */
274 if (IS_EXTENDED_BSD_NAME(arh->ar_name)) {
275 namelen = arh->ar_name +
276 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE;
277 if (_libelf_ar_get_number(namelen, sizeof(arh->ar_name) -
278 LIBELF_AR_BSD_EXTENDED_NAME_PREFIX_SIZE, 10, &nsz) == 0) {
279 LIBELF_SET_ERROR(ARCHIVE, 0);
280 return (NULL);
281 }
282
283 member = (char *) (arh + 1) + nsz;
284 sz -= nsz;
285 } else
286 member = (char *) (arh + 1);
287
288
289 if ((e = elf_memory(member, sz)) == NULL)
290 return (NULL);
291
292 e->e_fd = fd;
293 e->e_cmd = c;
294 e->e_hdr.e_rawhdr = (unsigned char *) arh;
295
296 elf->e_u.e_ar.e_nchildren++;
297 e->e_parent = elf;
298
299 return (e);
300 }
301
302 /*
303 * A BSD-style ar(1) symbol table has the following layout:
304 *
305 * - A count of bytes used by the following array of 'ranlib'
306 * structures, stored as a 'long'.
307 * - An array of 'ranlib' structures. Each array element is
308 * two 'long's in size.
309 * - A count of bytes used for the following symbol table.
310 * - The symbol table itself.
311 */
312
313 /*
314 * A helper macro to read in a 'long' value from the archive.
315 *
316 * We use memcpy() since the source pointer may be misaligned with
317 * respect to the natural alignment for a C 'long'.
318 */
319 #define GET_LONG(P, V)do { \
320 memcpy(&(V), (P), sizeof(long)); \
321 (P) += sizeof(long); \
322 } while (/* CONSTCOND */ 0)
323
324 Elf_Arsym *
_libelf_ar_process_bsd_symtab(Elf * e,size_t * count)325 _libelf_ar_process_bsd_symtab(Elf *e, size_t *count)
326 {
327 Elf_Arsym *symtab, *sym;
328 unsigned int n;
329 size_t nentries;
330 unsigned char *end, *p, *p0, *s, *s0;
331 const size_t entrysize = 2 * sizeof(long);
332 long arraysize, fileoffset, stroffset, strtabsize;
333
334 assert(e != NULL);
335 assert(count != NULL);
336 assert(e->e_u.e_ar.e_symtab == NULL);
337
338 symtab = NULL;
339
340 /*
341 * The BSD symbol table always contains the count fields even
342 * if there are no entries in it.
343 */
344 if (e->e_u.e_ar.e_rawsymtabsz < 2 * sizeof(long))
345 goto symtaberror;
346
347 p = p0 = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
348 end = p0 + e->e_u.e_ar.e_rawsymtabsz;
349
350 /*
351 * Retrieve the size of the array of ranlib descriptors and
352 * check it for validity.
353 */
354 GET_LONG(p, arraysize);
355
356 if (arraysize < 0 || p0 + arraysize >= end ||
357 ((size_t) arraysize % entrysize != 0))
358 goto symtaberror;
359
360 /*
361 * Check the value of the string table size.
362 */
363 s = p + arraysize;
364 GET_LONG(s, strtabsize);
365
366 s0 = s; /* Start of string table. */
367 if (strtabsize < 0 || s0 + strtabsize > end)
368 goto symtaberror;
369
370 nentries = (size_t) arraysize / entrysize;
371
372 /*
373 * Allocate space for the returned Elf_Arsym array.
374 */
375 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries + 1))) == NULL) {
376 LIBELF_SET_ERROR(RESOURCE, 0);
377 return (NULL);
378 }
379
380 /* Read in symbol table entries. */
381 for (n = 0, sym = symtab; n < nentries; n++, sym++) {
382 GET_LONG(p, stroffset);
383 GET_LONG(p, fileoffset);
384
385 if (stroffset < 0 || fileoffset < 0 ||
386 (off_t) fileoffset >= e->e_rawsize)
387 goto symtaberror;
388
389 s = s0 + stroffset;
390
391 if (s >= end)
392 goto symtaberror;
393
394 sym->as_off = (off_t) fileoffset;
395 sym->as_hash = elf_hash((char *) s);
396 sym->as_name = (char *) s;
397 }
398
399 /* Fill up the sentinel entry. */
400 sym->as_name = NULL;
401 sym->as_hash = ~0UL;
402 sym->as_off = (off_t) 0;
403
404 /* Remember the processed symbol table. */
405 e->e_u.e_ar.e_symtab = symtab;
406
407 *count = e->e_u.e_ar.e_symtabsz = nentries + 1;
408
409 return (symtab);
410
411 symtaberror:
412 if (symtab)
413 free(symtab);
414 LIBELF_SET_ERROR(ARCHIVE, 0);
415 return (NULL);
416 }
417
418 /*
419 * An SVR4-style ar(1) symbol table has the following layout:
420 *
421 * - The first 4 bytes are a binary count of the number of entries in the
422 * symbol table, stored MSB-first.
423 * - Then there are 'n' 4-byte binary offsets, also stored MSB first.
424 * - Following this, there are 'n' null-terminated strings.
425 */
426
427 #define GET_WORD(P, V) do { \
428 (V) = 0; \
429 (V) = (P)[0]; (V) <<= 8; \
430 (V) += (P)[1]; (V) <<= 8; \
431 (V) += (P)[2]; (V) <<= 8; \
432 (V) += (P)[3]; \
433 } while (/* CONSTCOND */ 0)
434
435 #define INTSZ 4
436
437
438 Elf_Arsym *
_libelf_ar_process_svr4_symtab(Elf * e,size_t * count)439 _libelf_ar_process_svr4_symtab(Elf *e, size_t *count)
440 {
441 uint32_t off;
442 size_t n, nentries;
443 Elf_Arsym *symtab, *sym;
444 unsigned char *p, *s, *end;
445
446 assert(e != NULL);
447 assert(count != NULL);
448 assert(e->e_u.e_ar.e_symtab == NULL);
449
450 symtab = NULL;
451
452 if (e->e_u.e_ar.e_rawsymtabsz < INTSZ)
453 goto symtaberror;
454
455 p = (unsigned char *) e->e_u.e_ar.e_rawsymtab;
456 end = p + e->e_u.e_ar.e_rawsymtabsz;
457
458 GET_WORD(p, nentries);
459 p += INTSZ;
460
461 if (nentries == 0 || p + nentries * INTSZ >= end)
462 goto symtaberror;
463
464 /* Allocate space for a nentries + a sentinel. */
465 if ((symtab = malloc(sizeof(Elf_Arsym) * (nentries+1))) == NULL) {
466 LIBELF_SET_ERROR(RESOURCE, 0);
467 return (NULL);
468 }
469
470 s = p + (nentries * INTSZ); /* start of the string table. */
471
472 for (n = nentries, sym = symtab; n > 0; n--) {
473 if (s >= end)
474 goto symtaberror;
475
476 GET_WORD(p, off);
477 if ((off_t) off >= e->e_rawsize)
478 goto symtaberror;
479
480 sym->as_off = (off_t) off;
481 sym->as_hash = elf_hash((char *) s);
482 sym->as_name = (char *) s;
483
484 p += INTSZ;
485 sym++;
486
487 for (; s < end && *s++ != '\0';) /* skip to next string */
488 ;
489 }
490
491 /* Fill up the sentinel entry. */
492 sym->as_name = NULL;
493 sym->as_hash = ~0UL;
494 sym->as_off = (off_t) 0;
495
496 *count = e->e_u.e_ar.e_symtabsz = nentries + 1;
497 e->e_u.e_ar.e_symtab = symtab;
498
499 return (symtab);
500
501 symtaberror:
502 if (symtab)
503 free(symtab);
504 LIBELF_SET_ERROR(ARCHIVE, 0);
505 return (NULL);
506 }
507