elf_getarhdr.c: Return correct header for archive within an archive

If elf_getarhdr is called on a descriptor that refers to an archive
which is itself a member of another archive, it may return the Elf_Arhdr
of the current member (i.e., the member selected by elf_next or elf_rand)
of the inner archive instead of Elf_Arhdr of the inner archive itself.

This also causes a memory leak: elf_end only attempts to free
Elf_Arhdr fields ar_name and ar_rawname for descriptors that are not
ELF_K_AR.

To fix this, replace the state.elf[32|64] field elf_ar_hdr with new
struct Elf field elf_ar_hdr.  This field stores the Elf_Arhdr for all
descriptors of archive members, including those with kind ELF_K_AR.

Also rename the state.ar field elf_ar_hdr to cur_ar_hdr to clarify that
this is the header of an archive's current member.

Signed-off-by: Aaron Merey <[email protected]>

4 files changed, 232 insertions, 0 deletions

diff --git a/tests/.gitignore b/tests/.gitignore
index 6ae12adb..4681024f 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -11,6 +11,7 @@
 /arextract
 /arls
 /arsymtest
+/ar-extract-ar
 /asm-tst1
 /asm-tst2
 /asm-tst3
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 00ba754d..15c32a85 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -68,6 +68,7 @@ check_PROGRAMS = arextract arsymtest newfile saridx scnnames sectiondump \
 		  cu-dwp-section-info declfiles test-manyfuncs \
 		  eu_search_cfi eu_search_macros \
 		  eu_search_lines eu_search_die \
+		  ar-extract-ar \
 		  $(asm_TESTS)
 
 asm_TESTS = asm-tst1 asm-tst2 asm-tst3 asm-tst4 asm-tst5 \
@@ -774,6 +775,7 @@ libeu = ../lib/libeu.a
 
 arextract_LDADD = $(libelf)
 arsymtest_LDADD = $(libelf)
+ar_extract_ar_LDADD = $(libelf)
 newfile_LDADD = $(libelf)
 saridx_LDADD = $(libeu) $(libelf)
 scnnames_LDADD = $(libelf)
diff --git a/tests/ar-extract-ar.c b/tests/ar-extract-ar.c
new file mode 100644
index 00000000..273f62a3
--- /dev/null
+++ b/tests/ar-extract-ar.c
@@ -0,0 +1,137 @@
+/* Copyright (C) 2025 Red Hat, Inc.
+   This file is part of elfutils.
+
+   This file is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   elfutils is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <assert.h>
+#include <fcntl.h>
+#include <gelf.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <system.h>
+
+#define printf_indent(n, ...)		\
+  do {					\
+    for (int _i = 0; _i < (n); _i++)	\
+      fputs ("    ", stdout);		\
+    printf (__VA_ARGS__);		\
+  } while (0)
+
+static void
+ar_extract (Elf *elf, int indent)
+{
+  Elf *subelf;
+  Elf_Arsym *arsym;
+  size_t narsym;
+  Elf_Cmd cmd = ELF_C_READ;
+
+  assert (elf_kind (elf) == ELF_K_AR);
+
+  arsym = elf_getarsym (elf, &narsym);
+  if (arsym == NULL)
+    {
+      printf_indent (indent, "Cannot get archive index: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  if (narsym != 4)
+    {
+      printf_indent (indent, "Incorrect number of arsyms\n");
+      exit (1);
+    }
+
+  printf_indent (indent, "== symbol names ==\n");
+
+  /* Print symbol names.  Skip the null entry at the end of arsyms.  */
+  for (size_t i = 0; i < narsym - 1; ++i)
+    printf_indent (indent, "%s\n", arsym[i].as_name);
+  putchar ('\n');
+  printf_indent (indent, "== headers ==\n");
+
+  /* Print header names and recursively call this function on member
+     archives.  */
+  while ((subelf = elf_begin (-1, cmd, elf)) != NULL)
+    {
+      /* The the header for this element.  */
+      Elf_Arhdr *arhdr = elf_getarhdr (subelf);
+
+      if (arhdr == NULL)
+	{
+	  printf_indent (indent, "cannot get arhdr: %s\n", elf_errmsg (-1));
+	  exit (1);
+	}
+
+      printf_indent (indent, "%s %s\n", arhdr->ar_name, arhdr->ar_rawname);
+
+      if (elf_kind (subelf) == ELF_K_AR)
+	ar_extract (subelf, indent + 1);
+
+      cmd = elf_next (subelf);
+      elf_end (subelf);
+    }
+
+  putchar ('\n');
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int fd;
+  Elf *elf;
+  Elf_Cmd cmd;
+
+  if (argc < 2)
+    exit (1);
+
+  /* Open the archive.  */
+  fd = open (argv[1], O_RDONLY);
+  if (fd == -1)
+    {
+      printf ("Cannot open input file: %m");
+      exit (1);
+    }
+
+  /* Set the ELF version.  */
+  elf_version (EV_CURRENT);
+
+  /* Create an ELF descriptor.  */
+  cmd = ELF_C_READ;
+  elf = elf_begin (fd, cmd, NULL);
+
+  if (elf == NULL)
+    {
+      printf ("Cannot create ELF descriptor: %s\n", elf_errmsg (-1));
+      exit (1);
+    }
+
+  /* If it is no archive punt.  */
+  if (elf_kind (elf) != ELF_K_AR)
+    {
+      printf ("`%s' is no archive\n", argv[1]);
+      exit (1);
+    }
+
+  ar_extract (elf, 0);
+  elf_end (elf);
+  close (fd);
+
+  return 0;
+}
diff --git a/tests/run-ar.sh b/tests/run-ar.sh
index 656f1d1a..733d810d 100755
--- a/tests/run-ar.sh
+++ b/tests/run-ar.sh
@@ -37,4 +37,96 @@ echo Check new ar file is now empty
 testrun_compare ${abs_top_builddir}/src/ar -t test.ar << EOF
 EOF
 
+tempfiles bin* dup* long* inner* outer*
+
+echo Compile files for nested archives.
+
+cat > dup.c <<'EOF'
+int dup_func(void){return 1;}
+EOF
+cat > bin_outer.c <<'EOF'
+int outer_func(void){return 1;}
+EOF
+cat > long_name_long_name_outer.c <<'EOF'
+int long_name_long_name_func(void){return 1;}
+EOF
+cat > bin_inner1.c <<'EOF'
+int inner1_func(void){return 1;}
+EOF
+cat > long_name_long_name_inner1.c <<'EOF'
+int long_name_long_name_func(void){return 1;}
+EOF
+cat > bin_inner2.c <<'EOF'
+int inner2_func(void){return 1;}
+EOF
+cat > long_name_long_name_inner2.c <<'EOF'
+int long_name_long_name_func(void){return 1;}
+EOF
+
+# Compile the source files.
+for src in *.c; do
+  obj=$(echo "$src" | sed 's/\.c$/.o/')
+  gcc -O0 -c "$src" -o "$obj"
+done
+
+echo Create nested archives.
+testrun ${abs_top_builddir}/src/ar -r inner2.ar bin_inner2.o
+testrun ${abs_top_builddir}/src/ar -r inner2.ar dup.o
+testrun ${abs_top_builddir}/src/ar -r inner2.ar long_name_long_name_inner2.o
+
+# inner1.ar contains inner2.ar
+testrun ${abs_top_builddir}/src/ar -r inner1.ar inner2.ar
+testrun ${abs_top_builddir}/src/ar -r inner1.ar bin_inner1.o
+testrun ${abs_top_builddir}/src/ar -r inner1.ar dup.o
+testrun ${abs_top_builddir}/src/ar -r inner1.ar long_name_long_name_inner1.o
+
+# outer.ar contains inner1.ar
+testrun ${abs_top_builddir}/src/ar -r outer.ar inner1.ar
+testrun ${abs_top_builddir}/src/ar -r outer.ar bin_outer.o
+testrun ${abs_top_builddir}/src/ar -r outer.ar dup.o
+testrun ${abs_top_builddir}/src/ar -r outer.ar long_name_long_name_outer.o
+
+echo Check symbol and header names of the nested archives.
+
+testrun_compare ${abs_builddir}/ar-extract-ar outer.ar <<'EOF'
+== symbol names ==
+outer_func
+dup_func
+long_name_long_name_func
+
+== headers ==
+/ /               
+// //              
+inner1.ar inner1.ar/      
+    == symbol names ==
+    inner1_func
+    dup_func
+    long_name_long_name_func
+
+    == headers ==
+    / /               
+    // //              
+    inner2.ar inner2.ar/      
+        == symbol names ==
+        inner2_func
+        dup_func
+        long_name_long_name_func
+
+        == headers ==
+        / /               
+        // //              
+        bin_inner2.o bin_inner2.o/   
+        dup.o dup.o/          
+        long_name_long_name_inner2.o /0              
+
+    bin_inner1.o bin_inner1.o/   
+    dup.o dup.o/          
+    long_name_long_name_inner1.o /0              
+
+bin_outer.o bin_outer.o/    
+dup.o dup.o/          
+long_name_long_name_outer.o /0              
+
+EOF
+
 exit 0