Keep shadow copies of the `e_shnum', `e_phnum' and `e_shstrndx'

members of the ELF Executable Header inside the library-private
`struct _Elf' descriptor and only update the underlying Elf{32,64}_Ehdr
structure on an elf_update(3) call.  These fields of the Ehdr
structure are technically `out of bounds' for an application program
per the ELF(3) API, but we've seen applications that initialize
a new Ehdr structure using memcpy(), messing up the library's
invariants. [1]

Implement elf_getphnum() and handle ELF objects with more than
64K program header table entries.

Reported by:	jb [1]

1 files changed, 7 insertions, 77 deletions

diff --git a/lib/libelf/elf_shnum.c b/lib/libelf/elf_shnum.c
index 8a53eed..d22a1fc 100644
--- a/lib/libelf/elf_shnum.c
+++ b/lib/libelf/elf_shnum.c
@@ -33,91 +33,21 @@ __FBSDID("$FreeBSD$");
 #include "_libelf.h"
 
 int
-_libelf_getshnum(Elf *e, void *eh, int ec, size_t *shnum)
-{
-	Elf64_Off off;
-	Elf_Scn *scn;
-	void *sh;
-	size_t n;
-
-	if (ec == ELFCLASS32) {
-		n = ((Elf32_Ehdr *) eh)->e_shnum;
-		off = (Elf64_Off) ((Elf32_Ehdr *) eh)->e_shoff;
-	} else {
-		n = ((Elf64_Ehdr *) eh)->e_shnum;
-		off = ((Elf64_Ehdr *) eh)->e_shoff;
-	}
-
-	if (n != 0) {
-		*shnum = n;
-		return (1);
-	}
-
-	if (off == 0L) {
-		*shnum = (size_t) 0;
-		return (1);
-	}
-
-	/*
-	 * If 'e_shnum' is zero and 'e_shoff' is non-zero, the file is
-	 * using extended section numbering, and the true section
-	 * number is kept in the 'sh_size' field of the section header
-	 * at offset SHN_UNDEF.
-	 */
-	if ((scn = elf_getscn(e, (size_t) SHN_UNDEF)) == NULL)
-		return (0);
-	if ((sh = _libelf_getshdr(scn, ec)) == NULL)
-		return (0);
-
-	if (ec == ELFCLASS32)
-		*shnum = ((Elf32_Shdr *) sh)->sh_size;
-	else
-		*shnum = ((Elf64_Shdr *) sh)->sh_size;
-
-	return (1);
-}
-
-int
-_libelf_setshnum(Elf *e, void *eh, int ec, size_t shnum)
-{
-	Elf_Scn *scn;
-	void *sh;
-
-	if (shnum < SHN_LORESERVE) {
-		if (ec == ELFCLASS32)
-			((Elf32_Ehdr *) eh)->e_shnum = shnum;
-		else
-			((Elf64_Ehdr *) eh)->e_shnum = shnum;
-		return (1);
-	}
-
-	if ((scn = elf_getscn(e, (size_t) SHN_UNDEF)) == NULL)
-		return (0);
-	if ((sh = _libelf_getshdr(scn, ec)) == NULL)
-		return (0);
-
-	if (ec == ELFCLASS32)
-		((Elf32_Shdr *) sh)->sh_size = shnum;
-	else
-		((Elf64_Shdr *) sh)->sh_size = shnum;
-
-	(void) elf_flagshdr(scn, ELF_C_SET, ELF_F_DIRTY);
-
-	return (1);
-}
-
-int
 elf_getshnum(Elf *e, size_t *shnum)
 {
 	void *eh;
 	int ec;
 
 	if (e == NULL || e->e_kind != ELF_K_ELF ||
-	    ((ec = e->e_class) != ELFCLASS32 && ec != ELFCLASS64) ||
-	    ((eh = _libelf_ehdr(e, ec, 0)) == NULL)) {
+	    ((ec = e->e_class) != ELFCLASS32 && ec != ELFCLASS64)) {
 		LIBELF_SET_ERROR(ARGUMENT, 0);
 		return (0);
 	}
 
-	return (_libelf_getshnum(e, eh, ec, shnum));
+	if ((eh = _libelf_ehdr(e, ec, 0)) == NULL)
+		return (0);
+
+	*shnum = e->e_u.e_elf.e_nscn;
+
+	return (1);
 }