Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add feature to support compressed archives #31

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ panic = 'abort' # Abort on panic
clap = {version = "4.0.14", features = ["cargo"]}
colored = {version = "2.0.0", optional = true}
colored_json = {version = "3.0.1", optional = true}
compress-tools = {version = "0.14.0", optional = true}
either = "1.8.1"
glob = "0.3.0"
goblin = "0.6.0"
Expand Down Expand Up @@ -66,6 +67,7 @@ name = "checksec"
path = "src/main.rs"

[features]
archives = ["compress-tools"]
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would prefer non-plural "archive" for feature instead.

color = ["colored", "colored_json", "xattr"]
default = ["elf", "macho", "pe", "color", "maps", "disassembly"]
disassembly = ["iced-x86"]
Expand Down
57 changes: 57 additions & 0 deletions src/main.rs
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ use std::collections::HashMap;
#[cfg(all(target_os = "linux", feature = "elf"))]
use std::collections::HashSet;
use std::ffi::OsStr;
#[cfg(feature = "archives")]
use std::io::Cursor;
use std::io::ErrorKind;
#[cfg(all(feature = "color", not(target_os = "windows")))]
use std::os::unix::fs::PermissionsExt;
Expand All @@ -46,6 +48,8 @@ use colored::{ColoredString, Colorize};

#[cfg(feature = "color")]
use colored_json::to_colored_json_auto;
#[cfg(feature = "archives")]
use compress_tools::{ArchiveContents, ArchiveIterator};

mod binary;
mod proc;
Expand Down Expand Up @@ -269,6 +273,8 @@ enum ParseError {
IO(std::io::Error),
#[cfg(all(target_os = "linux", feature = "elf"))]
LdSo(LdSoError),
#[cfg(feature = "archives")]
Decompress(compress_tools::Error),
#[allow(dead_code)]
Unimplemented(&'static str),
}
Expand All @@ -282,6 +288,8 @@ impl fmt::Display for ParseError {
Self::LdSo(e) => {
write!(f, "Failed to initialize library lookup: {e}")
}
#[cfg(feature = "archives")]
Self::Decompress(e) => e.fmt(f),
Self::Unimplemented(str) => {
write!(f, "Support for files of type {str} not implemented")
}
Expand All @@ -308,6 +316,13 @@ impl From<LdSoError> for ParseError {
}
}

#[cfg(feature = "archives")]
impl From<compress_tools::Error> for ParseError {
fn from(err: compress_tools::Error) -> ParseError {
ParseError::Decompress(err)
}
}

type Cache = Arc<Mutex<HashMap<PathBuf, Vec<Binary>>>>;

fn parse(
Expand Down Expand Up @@ -424,6 +439,48 @@ fn parse_bytes(bytes: &[u8], file: &Path) -> Result<Vec<Binary>, ParseError> {
#[cfg(not(feature = "macho"))]
Object::Mach(_) => Err(ParseError::Unimplemented("MachO")),
Object::Archive(archive) => Ok(parse_archive(&archive, file, bytes)),
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Object::Archive should be under new feature as well.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should it though?
The reason for guarding the archive extraction code under a new and by default disabled feature is the underlying usage of the C written library libarchive. This has two consequences: The shared library needs to be installed at runtime (also at compile time, buts that's irrelevant for users) and the code might contain memory corruption bugs (potentially resulting in code execution) due to being written in C. libarchive is fuzzed by OSS-Fuzz, which limits the risks a bit though.
The unix archive code from goblin is written in pure Rust and thus does not have these disadvantages and does not introduce new dependencies.
So I would argue the unix archive support should be always enabled, independent from whether compressed archive support is enabled.

#[cfg(feature = "archives")]
Object::Unknown(magic) => {
let mut results = Vec::new();
let mut handled = false;

let mut name = String::default();
let mut buffer = Vec::new();

for content in ArchiveIterator::from_read(Cursor::new(bytes))? {
match content {
ArchiveContents::StartOfEntry(s, _) => {
name = s;
buffer.clear();
}
ArchiveContents::DataChunk(v) => buffer.extend(v),
ArchiveContents::EndOfEntry => {
if buffer != bytes {
handled = true;

if let Ok(mut res) = parse_bytes(
&buffer,
Path::new(&format!(
"{}\u{2794}{}",
file.display(),
name
)),
) {
results.append(&mut res);
}
}
}
ArchiveContents::Err(e) => Err(e)?,
}
}

if handled {
Ok(results)
} else {
Err(ParseError::Goblin(Error::BadMagic(magic)))
}
}
#[cfg(not(feature = "archives"))]
Object::Unknown(magic) => {
Err(ParseError::Goblin(Error::BadMagic(magic)))
}
Expand Down