1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define ATRACE_TAG ATRACE_TAG_RESOURCES
18 
19 #include "androidfw/LoadedArsc.h"
20 
21 #include <algorithm>
22 #include <cstddef>
23 #include <limits>
24 
25 #include "android-base/logging.h"
26 #include "android-base/stringprintf.h"
27 #include "utils/ByteOrder.h"
28 #include "utils/Trace.h"
29 
30 #ifdef _WIN32
31 #ifdef ERROR
32 #undef ERROR
33 #endif
34 #endif
35 
36 #include "androidfw/ByteBucketArray.h"
37 #include "androidfw/Chunk.h"
38 #include "androidfw/ResourceUtils.h"
39 #include "androidfw/Util.h"
40 
41 using ::android::base::StringPrintf;
42 
43 namespace android {
44 
45 constexpr const static int kAppPackageId = 0x7f;
46 
47 namespace {
48 
49 // Builder that helps accumulate Type structs and then create a single
50 // contiguous block of memory to store both the TypeSpec struct and
51 // the Type structs.
52 class TypeSpecPtrBuilder {
53  public:
TypeSpecPtrBuilder(const ResTable_typeSpec * header,const IdmapEntry_header * idmap_header)54   explicit TypeSpecPtrBuilder(const ResTable_typeSpec* header,
55                               const IdmapEntry_header* idmap_header)
56       : header_(header), idmap_header_(idmap_header) {
57   }
58 
AddType(const ResTable_type * type)59   void AddType(const ResTable_type* type) {
60     types_.push_back(type);
61   }
62 
Build()63   TypeSpecPtr Build() {
64     // Check for overflow.
65     using ElementType = const ResTable_type*;
66     if ((std::numeric_limits<size_t>::max() - sizeof(TypeSpec)) / sizeof(ElementType) <
67         types_.size()) {
68       return {};
69     }
70     TypeSpec* type_spec =
71         (TypeSpec*)::malloc(sizeof(TypeSpec) + (types_.size() * sizeof(ElementType)));
72     type_spec->type_spec = header_;
73     type_spec->idmap_entries = idmap_header_;
74     type_spec->type_count = types_.size();
75     memcpy(type_spec + 1, types_.data(), types_.size() * sizeof(ElementType));
76     return TypeSpecPtr(type_spec);
77   }
78 
79  private:
80   DISALLOW_COPY_AND_ASSIGN(TypeSpecPtrBuilder);
81 
82   const ResTable_typeSpec* header_;
83   const IdmapEntry_header* idmap_header_;
84   std::vector<const ResTable_type*> types_;
85 };
86 
87 }  // namespace
88 
89 LoadedPackage::LoadedPackage() = default;
90 LoadedPackage::~LoadedPackage() = default;
91 
92 // Precondition: The header passed in has already been verified, so reading any fields and trusting
93 // the ResChunk_header is safe.
VerifyResTableType(const ResTable_type * header)94 static bool VerifyResTableType(const ResTable_type* header) {
95   if (header->id == 0) {
96     LOG(ERROR) << "RES_TABLE_TYPE_TYPE has invalid ID 0.";
97     return false;
98   }
99 
100   const size_t entry_count = dtohl(header->entryCount);
101   if (entry_count > std::numeric_limits<uint16_t>::max()) {
102     LOG(ERROR) << "RES_TABLE_TYPE_TYPE has too many entries (" << entry_count << ").";
103     return false;
104   }
105 
106   // Make sure that there is enough room for the entry offsets.
107   const size_t offsets_offset = dtohs(header->header.headerSize);
108   const size_t entries_offset = dtohl(header->entriesStart);
109   const size_t offsets_length = sizeof(uint32_t) * entry_count;
110 
111   if (offsets_offset > entries_offset || entries_offset - offsets_offset < offsets_length) {
112     LOG(ERROR) << "RES_TABLE_TYPE_TYPE entry offsets overlap actual entry data.";
113     return false;
114   }
115 
116   if (entries_offset > dtohl(header->header.size)) {
117     LOG(ERROR) << "RES_TABLE_TYPE_TYPE entry offsets extend beyond chunk.";
118     return false;
119   }
120 
121   if (entries_offset & 0x03) {
122     LOG(ERROR) << "RES_TABLE_TYPE_TYPE entries start at unaligned address.";
123     return false;
124   }
125   return true;
126 }
127 
VerifyResTableEntry(const ResTable_type * type,uint32_t entry_offset)128 static bool VerifyResTableEntry(const ResTable_type* type, uint32_t entry_offset) {
129   // Check that the offset is aligned.
130   if (entry_offset & 0x03) {
131     LOG(ERROR) << "Entry at offset " << entry_offset << " is not 4-byte aligned.";
132     return false;
133   }
134 
135   // Check that the offset doesn't overflow.
136   if (entry_offset > std::numeric_limits<uint32_t>::max() - dtohl(type->entriesStart)) {
137     // Overflow in offset.
138     LOG(ERROR) << "Entry at offset " << entry_offset << " is too large.";
139     return false;
140   }
141 
142   const size_t chunk_size = dtohl(type->header.size);
143 
144   entry_offset += dtohl(type->entriesStart);
145   if (entry_offset > chunk_size - sizeof(ResTable_entry)) {
146     LOG(ERROR) << "Entry at offset " << entry_offset
147                << " is too large. No room for ResTable_entry.";
148     return false;
149   }
150 
151   const ResTable_entry* entry = reinterpret_cast<const ResTable_entry*>(
152       reinterpret_cast<const uint8_t*>(type) + entry_offset);
153 
154   const size_t entry_size = dtohs(entry->size);
155   if (entry_size < sizeof(*entry)) {
156     LOG(ERROR) << "ResTable_entry size " << entry_size << " at offset " << entry_offset
157                << " is too small.";
158     return false;
159   }
160 
161   if (entry_size > chunk_size || entry_offset > chunk_size - entry_size) {
162     LOG(ERROR) << "ResTable_entry size " << entry_size << " at offset " << entry_offset
163                << " is too large.";
164     return false;
165   }
166 
167   if (entry_size < sizeof(ResTable_map_entry)) {
168     // There needs to be room for one Res_value struct.
169     if (entry_offset + entry_size > chunk_size - sizeof(Res_value)) {
170       LOG(ERROR) << "No room for Res_value after ResTable_entry at offset " << entry_offset
171                  << " for type " << (int)type->id << ".";
172       return false;
173     }
174 
175     const Res_value* value =
176         reinterpret_cast<const Res_value*>(reinterpret_cast<const uint8_t*>(entry) + entry_size);
177     const size_t value_size = dtohs(value->size);
178     if (value_size < sizeof(Res_value)) {
179       LOG(ERROR) << "Res_value at offset " << entry_offset << " is too small.";
180       return false;
181     }
182 
183     if (value_size > chunk_size || entry_offset + entry_size > chunk_size - value_size) {
184       LOG(ERROR) << "Res_value size " << value_size << " at offset " << entry_offset
185                  << " is too large.";
186       return false;
187     }
188   } else {
189     const ResTable_map_entry* map = reinterpret_cast<const ResTable_map_entry*>(entry);
190     const size_t map_entry_count = dtohl(map->count);
191     size_t map_entries_start = entry_offset + entry_size;
192     if (map_entries_start & 0x03) {
193       LOG(ERROR) << "Map entries at offset " << entry_offset << " start at unaligned offset.";
194       return false;
195     }
196 
197     // Each entry is sizeof(ResTable_map) big.
198     if (map_entry_count > ((chunk_size - map_entries_start) / sizeof(ResTable_map))) {
199       LOG(ERROR) << "Too many map entries in ResTable_map_entry at offset " << entry_offset << ".";
200       return false;
201     }
202   }
203   return true;
204 }
205 
GetEntry(const ResTable_type * type_chunk,uint16_t entry_index)206 const ResTable_entry* LoadedPackage::GetEntry(const ResTable_type* type_chunk,
207                                               uint16_t entry_index) {
208   uint32_t entry_offset = GetEntryOffset(type_chunk, entry_index);
209   if (entry_offset == ResTable_type::NO_ENTRY) {
210     return nullptr;
211   }
212   return GetEntryFromOffset(type_chunk, entry_offset);
213 }
214 
GetEntryOffset(const ResTable_type * type_chunk,uint16_t entry_index)215 uint32_t LoadedPackage::GetEntryOffset(const ResTable_type* type_chunk, uint16_t entry_index) {
216   // The configuration matches and is better than the previous selection.
217   // Find the entry value if it exists for this configuration.
218   const size_t entry_count = dtohl(type_chunk->entryCount);
219   const size_t offsets_offset = dtohs(type_chunk->header.headerSize);
220 
221   // Check if there is the desired entry in this type.
222 
223   if (type_chunk->flags & ResTable_type::FLAG_SPARSE) {
224     // This is encoded as a sparse map, so perform a binary search.
225     const ResTable_sparseTypeEntry* sparse_indices =
226         reinterpret_cast<const ResTable_sparseTypeEntry*>(
227             reinterpret_cast<const uint8_t*>(type_chunk) + offsets_offset);
228     const ResTable_sparseTypeEntry* sparse_indices_end = sparse_indices + entry_count;
229     const ResTable_sparseTypeEntry* result =
230         std::lower_bound(sparse_indices, sparse_indices_end, entry_index,
231                          [](const ResTable_sparseTypeEntry& entry, uint16_t entry_idx) {
232                            return dtohs(entry.idx) < entry_idx;
233                          });
234 
235     if (result == sparse_indices_end || dtohs(result->idx) != entry_index) {
236       // No entry found.
237       return ResTable_type::NO_ENTRY;
238     }
239 
240     // Extract the offset from the entry. Each offset must be a multiple of 4 so we store it as
241     // the real offset divided by 4.
242     return uint32_t{dtohs(result->offset)} * 4u;
243   }
244 
245   // This type is encoded as a dense array.
246   if (entry_index >= entry_count) {
247     // This entry cannot be here.
248     return ResTable_type::NO_ENTRY;
249   }
250 
251   const uint32_t* entry_offsets = reinterpret_cast<const uint32_t*>(
252       reinterpret_cast<const uint8_t*>(type_chunk) + offsets_offset);
253   return dtohl(entry_offsets[entry_index]);
254 }
255 
GetEntryFromOffset(const ResTable_type * type_chunk,uint32_t offset)256 const ResTable_entry* LoadedPackage::GetEntryFromOffset(const ResTable_type* type_chunk,
257                                                         uint32_t offset) {
258   if (UNLIKELY(!VerifyResTableEntry(type_chunk, offset))) {
259     return nullptr;
260   }
261   return reinterpret_cast<const ResTable_entry*>(reinterpret_cast<const uint8_t*>(type_chunk) +
262                                                  offset + dtohl(type_chunk->entriesStart));
263 }
264 
CollectConfigurations(bool exclude_mipmap,std::set<ResTable_config> * out_configs) const265 void LoadedPackage::CollectConfigurations(bool exclude_mipmap,
266                                           std::set<ResTable_config>* out_configs) const {
267   const static std::u16string kMipMap = u"mipmap";
268   const size_t type_count = type_specs_.size();
269   for (size_t i = 0; i < type_count; i++) {
270     const TypeSpecPtr& type_spec = type_specs_[i];
271     if (type_spec != nullptr) {
272       if (exclude_mipmap) {
273         const int type_idx = type_spec->type_spec->id - 1;
274         size_t type_name_len;
275         const char16_t* type_name16 = type_string_pool_.stringAt(type_idx, &type_name_len);
276         if (type_name16 != nullptr) {
277           if (kMipMap.compare(0, std::u16string::npos, type_name16, type_name_len) == 0) {
278             // This is a mipmap type, skip collection.
279             continue;
280           }
281         }
282         const char* type_name = type_string_pool_.string8At(type_idx, &type_name_len);
283         if (type_name != nullptr) {
284           if (strncmp(type_name, "mipmap", type_name_len) == 0) {
285             // This is a mipmap type, skip collection.
286             continue;
287           }
288         }
289       }
290 
291       const auto iter_end = type_spec->types + type_spec->type_count;
292       for (auto iter = type_spec->types; iter != iter_end; ++iter) {
293         ResTable_config config;
294         config.copyFromDtoH((*iter)->config);
295         out_configs->insert(config);
296       }
297     }
298   }
299 }
300 
CollectLocales(bool canonicalize,std::set<std::string> * out_locales) const301 void LoadedPackage::CollectLocales(bool canonicalize, std::set<std::string>* out_locales) const {
302   char temp_locale[RESTABLE_MAX_LOCALE_LEN];
303   const size_t type_count = type_specs_.size();
304   for (size_t i = 0; i < type_count; i++) {
305     const TypeSpecPtr& type_spec = type_specs_[i];
306     if (type_spec != nullptr) {
307       const auto iter_end = type_spec->types + type_spec->type_count;
308       for (auto iter = type_spec->types; iter != iter_end; ++iter) {
309         ResTable_config configuration;
310         configuration.copyFromDtoH((*iter)->config);
311         if (configuration.locale != 0) {
312           configuration.getBcp47Locale(temp_locale, canonicalize);
313           std::string locale(temp_locale);
314           out_locales->insert(std::move(locale));
315         }
316       }
317     }
318   }
319 }
320 
FindEntryByName(const std::u16string & type_name,const std::u16string & entry_name) const321 uint32_t LoadedPackage::FindEntryByName(const std::u16string& type_name,
322                                         const std::u16string& entry_name) const {
323   ssize_t type_idx = type_string_pool_.indexOfString(type_name.data(), type_name.size());
324   if (type_idx < 0) {
325     return 0u;
326   }
327 
328   ssize_t key_idx = key_string_pool_.indexOfString(entry_name.data(), entry_name.size());
329   if (key_idx < 0) {
330     return 0u;
331   }
332 
333   const TypeSpec* type_spec = type_specs_[type_idx].get();
334   if (type_spec == nullptr) {
335     return 0u;
336   }
337 
338   const auto iter_end = type_spec->types + type_spec->type_count;
339   for (auto iter = type_spec->types; iter != iter_end; ++iter) {
340     const ResTable_type* type = *iter;
341     size_t entry_count = dtohl(type->entryCount);
342     for (size_t entry_idx = 0; entry_idx < entry_count; entry_idx++) {
343       const uint32_t* entry_offsets = reinterpret_cast<const uint32_t*>(
344           reinterpret_cast<const uint8_t*>(type) + dtohs(type->header.headerSize));
345       const uint32_t offset = dtohl(entry_offsets[entry_idx]);
346       if (offset != ResTable_type::NO_ENTRY) {
347         const ResTable_entry* entry = reinterpret_cast<const ResTable_entry*>(
348             reinterpret_cast<const uint8_t*>(type) + dtohl(type->entriesStart) + offset);
349         if (dtohl(entry->key.index) == static_cast<uint32_t>(key_idx)) {
350           // The package ID will be overridden by the caller (due to runtime assignment of package
351           // IDs for shared libraries).
352           return make_resid(0x00, type_idx + type_id_offset_ + 1, entry_idx);
353         }
354       }
355     }
356   }
357   return 0u;
358 }
359 
GetPackageById(uint8_t package_id) const360 const LoadedPackage* LoadedArsc::GetPackageById(uint8_t package_id) const {
361   for (const auto& loaded_package : packages_) {
362     if (loaded_package->GetPackageId() == package_id) {
363       return loaded_package.get();
364     }
365   }
366   return nullptr;
367 }
368 
Load(const Chunk & chunk,const LoadedIdmap * loaded_idmap,bool system,bool load_as_shared_library)369 std::unique_ptr<const LoadedPackage> LoadedPackage::Load(const Chunk& chunk,
370                                                          const LoadedIdmap* loaded_idmap,
371                                                          bool system, bool load_as_shared_library) {
372   ATRACE_NAME("LoadedPackage::Load");
373   std::unique_ptr<LoadedPackage> loaded_package(new LoadedPackage());
374 
375   // typeIdOffset was added at some point, but we still must recognize apps built before this
376   // was added.
377   constexpr size_t kMinPackageSize =
378       sizeof(ResTable_package) - sizeof(ResTable_package::typeIdOffset);
379   const ResTable_package* header = chunk.header<ResTable_package, kMinPackageSize>();
380   if (header == nullptr) {
381     LOG(ERROR) << "RES_TABLE_PACKAGE_TYPE too small.";
382     return {};
383   }
384 
385   loaded_package->system_ = system;
386 
387   loaded_package->package_id_ = dtohl(header->id);
388   if (loaded_package->package_id_ == 0 ||
389       (loaded_package->package_id_ == kAppPackageId && load_as_shared_library)) {
390     // Package ID of 0 means this is a shared library.
391     loaded_package->dynamic_ = true;
392   }
393 
394   if (loaded_idmap != nullptr) {
395     // This is an overlay and so it needs to pretend to be the target package.
396     loaded_package->package_id_ = loaded_idmap->TargetPackageId();
397     loaded_package->overlay_ = true;
398   }
399 
400   if (header->header.headerSize >= sizeof(ResTable_package)) {
401     uint32_t type_id_offset = dtohl(header->typeIdOffset);
402     if (type_id_offset > std::numeric_limits<uint8_t>::max()) {
403       LOG(ERROR) << "RES_TABLE_PACKAGE_TYPE type ID offset too large.";
404       return {};
405     }
406     loaded_package->type_id_offset_ = static_cast<int>(type_id_offset);
407   }
408 
409   util::ReadUtf16StringFromDevice(header->name, arraysize(header->name),
410                                   &loaded_package->package_name_);
411 
412   // A map of TypeSpec builders, each associated with an type index.
413   // We use these to accumulate the set of Types available for a TypeSpec, and later build a single,
414   // contiguous block of memory that holds all the Types together with the TypeSpec.
415   std::unordered_map<int, std::unique_ptr<TypeSpecPtrBuilder>> type_builder_map;
416 
417   ChunkIterator iter(chunk.data_ptr(), chunk.data_size());
418   while (iter.HasNext()) {
419     const Chunk child_chunk = iter.Next();
420     switch (child_chunk.type()) {
421       case RES_STRING_POOL_TYPE: {
422         const uintptr_t pool_address =
423             reinterpret_cast<uintptr_t>(child_chunk.header<ResChunk_header>());
424         const uintptr_t header_address = reinterpret_cast<uintptr_t>(header);
425         if (pool_address == header_address + dtohl(header->typeStrings)) {
426           // This string pool is the type string pool.
427           status_t err = loaded_package->type_string_pool_.setTo(
428               child_chunk.header<ResStringPool_header>(), child_chunk.size());
429           if (err != NO_ERROR) {
430             LOG(ERROR) << "RES_STRING_POOL_TYPE for types corrupt.";
431             return {};
432           }
433         } else if (pool_address == header_address + dtohl(header->keyStrings)) {
434           // This string pool is the key string pool.
435           status_t err = loaded_package->key_string_pool_.setTo(
436               child_chunk.header<ResStringPool_header>(), child_chunk.size());
437           if (err != NO_ERROR) {
438             LOG(ERROR) << "RES_STRING_POOL_TYPE for keys corrupt.";
439             return {};
440           }
441         } else {
442           LOG(WARNING) << "Too many RES_STRING_POOL_TYPEs found in RES_TABLE_PACKAGE_TYPE.";
443         }
444       } break;
445 
446       case RES_TABLE_TYPE_SPEC_TYPE: {
447         const ResTable_typeSpec* type_spec = child_chunk.header<ResTable_typeSpec>();
448         if (type_spec == nullptr) {
449           LOG(ERROR) << "RES_TABLE_TYPE_SPEC_TYPE too small.";
450           return {};
451         }
452 
453         if (type_spec->id == 0) {
454           LOG(ERROR) << "RES_TABLE_TYPE_SPEC_TYPE has invalid ID 0.";
455           return {};
456         }
457 
458         if (loaded_package->type_id_offset_ + static_cast<int>(type_spec->id) >
459             std::numeric_limits<uint8_t>::max()) {
460           LOG(ERROR) << "RES_TABLE_TYPE_SPEC_TYPE has out of range ID.";
461           return {};
462         }
463 
464         // The data portion of this chunk contains entry_count 32bit entries,
465         // each one representing a set of flags.
466         // Here we only validate that the chunk is well formed.
467         const size_t entry_count = dtohl(type_spec->entryCount);
468 
469         // There can only be 2^16 entries in a type, because that is the ID
470         // space for entries (EEEE) in the resource ID 0xPPTTEEEE.
471         if (entry_count > std::numeric_limits<uint16_t>::max()) {
472           LOG(ERROR) << "RES_TABLE_TYPE_SPEC_TYPE has too many entries (" << entry_count << ").";
473           return {};
474         }
475 
476         if (entry_count * sizeof(uint32_t) > chunk.data_size()) {
477           LOG(ERROR) << "RES_TABLE_TYPE_SPEC_TYPE too small to hold entries.";
478           return {};
479         }
480 
481         // If this is an overlay, associate the mapping of this type to the target type
482         // from the IDMAP.
483         const IdmapEntry_header* idmap_entry_header = nullptr;
484         if (loaded_idmap != nullptr) {
485           idmap_entry_header = loaded_idmap->GetEntryMapForType(type_spec->id);
486         }
487 
488         std::unique_ptr<TypeSpecPtrBuilder>& builder_ptr = type_builder_map[type_spec->id - 1];
489         if (builder_ptr == nullptr) {
490           builder_ptr = util::make_unique<TypeSpecPtrBuilder>(type_spec, idmap_entry_header);
491         } else {
492           LOG(WARNING) << StringPrintf("RES_TABLE_TYPE_SPEC_TYPE already defined for ID %02x",
493                                        type_spec->id);
494         }
495       } break;
496 
497       case RES_TABLE_TYPE_TYPE: {
498         const ResTable_type* type = child_chunk.header<ResTable_type, kResTableTypeMinSize>();
499         if (type == nullptr) {
500           LOG(ERROR) << "RES_TABLE_TYPE_TYPE too small.";
501           return {};
502         }
503 
504         if (!VerifyResTableType(type)) {
505           return {};
506         }
507 
508         // Type chunks must be preceded by their TypeSpec chunks.
509         std::unique_ptr<TypeSpecPtrBuilder>& builder_ptr = type_builder_map[type->id - 1];
510         if (builder_ptr != nullptr) {
511           builder_ptr->AddType(type);
512         } else {
513           LOG(ERROR) << StringPrintf(
514               "RES_TABLE_TYPE_TYPE with ID %02x found without preceding RES_TABLE_TYPE_SPEC_TYPE.",
515               type->id);
516           return {};
517         }
518       } break;
519 
520       case RES_TABLE_LIBRARY_TYPE: {
521         const ResTable_lib_header* lib = child_chunk.header<ResTable_lib_header>();
522         if (lib == nullptr) {
523           LOG(ERROR) << "RES_TABLE_LIBRARY_TYPE too small.";
524           return {};
525         }
526 
527         if (child_chunk.data_size() / sizeof(ResTable_lib_entry) < dtohl(lib->count)) {
528           LOG(ERROR) << "RES_TABLE_LIBRARY_TYPE too small to hold entries.";
529           return {};
530         }
531 
532         loaded_package->dynamic_package_map_.reserve(dtohl(lib->count));
533 
534         const ResTable_lib_entry* const entry_begin =
535             reinterpret_cast<const ResTable_lib_entry*>(child_chunk.data_ptr());
536         const ResTable_lib_entry* const entry_end = entry_begin + dtohl(lib->count);
537         for (auto entry_iter = entry_begin; entry_iter != entry_end; ++entry_iter) {
538           std::string package_name;
539           util::ReadUtf16StringFromDevice(entry_iter->packageName,
540                                           arraysize(entry_iter->packageName), &package_name);
541 
542           if (dtohl(entry_iter->packageId) >= std::numeric_limits<uint8_t>::max()) {
543             LOG(ERROR) << StringPrintf(
544                 "Package ID %02x in RES_TABLE_LIBRARY_TYPE too large for package '%s'.",
545                 dtohl(entry_iter->packageId), package_name.c_str());
546             return {};
547           }
548 
549           loaded_package->dynamic_package_map_.emplace_back(std::move(package_name),
550                                                             dtohl(entry_iter->packageId));
551         }
552 
553       } break;
554 
555       default:
556         LOG(WARNING) << StringPrintf("Unknown chunk type '%02x'.", chunk.type());
557         break;
558     }
559   }
560 
561   if (iter.HadError()) {
562     LOG(ERROR) << iter.GetLastError();
563     if (iter.HadFatalError()) {
564       return {};
565     }
566   }
567 
568   // Flatten and construct the TypeSpecs.
569   for (auto& entry : type_builder_map) {
570     uint8_t type_idx = static_cast<uint8_t>(entry.first);
571     TypeSpecPtr type_spec_ptr = entry.second->Build();
572     if (type_spec_ptr == nullptr) {
573       LOG(ERROR) << "Too many type configurations, overflow detected.";
574       return {};
575     }
576 
577     // We only add the type to the package if there is no IDMAP, or if the type is
578     // overlaying something.
579     if (loaded_idmap == nullptr || type_spec_ptr->idmap_entries != nullptr) {
580       // If this is an overlay, insert it at the target type ID.
581       if (type_spec_ptr->idmap_entries != nullptr) {
582         type_idx = dtohs(type_spec_ptr->idmap_entries->target_type_id) - 1;
583       }
584       loaded_package->type_specs_.editItemAt(type_idx) = std::move(type_spec_ptr);
585     }
586   }
587 
588   return std::move(loaded_package);
589 }
590 
LoadTable(const Chunk & chunk,const LoadedIdmap * loaded_idmap,bool load_as_shared_library)591 bool LoadedArsc::LoadTable(const Chunk& chunk, const LoadedIdmap* loaded_idmap,
592                            bool load_as_shared_library) {
593   const ResTable_header* header = chunk.header<ResTable_header>();
594   if (header == nullptr) {
595     LOG(ERROR) << "RES_TABLE_TYPE too small.";
596     return false;
597   }
598 
599   const size_t package_count = dtohl(header->packageCount);
600   size_t packages_seen = 0;
601 
602   packages_.reserve(package_count);
603 
604   ChunkIterator iter(chunk.data_ptr(), chunk.data_size());
605   while (iter.HasNext()) {
606     const Chunk child_chunk = iter.Next();
607     switch (child_chunk.type()) {
608       case RES_STRING_POOL_TYPE:
609         // Only use the first string pool. Ignore others.
610         if (global_string_pool_.getError() == NO_INIT) {
611           status_t err = global_string_pool_.setTo(child_chunk.header<ResStringPool_header>(),
612                                                    child_chunk.size());
613           if (err != NO_ERROR) {
614             LOG(ERROR) << "RES_STRING_POOL_TYPE corrupt.";
615             return false;
616           }
617         } else {
618           LOG(WARNING) << "Multiple RES_STRING_POOL_TYPEs found in RES_TABLE_TYPE.";
619         }
620         break;
621 
622       case RES_TABLE_PACKAGE_TYPE: {
623         if (packages_seen + 1 > package_count) {
624           LOG(ERROR) << "More package chunks were found than the " << package_count
625                      << " declared in the header.";
626           return false;
627         }
628         packages_seen++;
629 
630         std::unique_ptr<const LoadedPackage> loaded_package =
631             LoadedPackage::Load(child_chunk, loaded_idmap, system_, load_as_shared_library);
632         if (!loaded_package) {
633           return false;
634         }
635         packages_.push_back(std::move(loaded_package));
636       } break;
637 
638       default:
639         LOG(WARNING) << StringPrintf("Unknown chunk type '%02x'.", chunk.type());
640         break;
641     }
642   }
643 
644   if (iter.HadError()) {
645     LOG(ERROR) << iter.GetLastError();
646     if (iter.HadFatalError()) {
647       return false;
648     }
649   }
650   return true;
651 }
652 
Load(const StringPiece & data,const LoadedIdmap * loaded_idmap,bool system,bool load_as_shared_library)653 std::unique_ptr<const LoadedArsc> LoadedArsc::Load(const StringPiece& data,
654                                                    const LoadedIdmap* loaded_idmap, bool system,
655                                                    bool load_as_shared_library) {
656   ATRACE_NAME("LoadedArsc::LoadTable");
657 
658   // Not using make_unique because the constructor is private.
659   std::unique_ptr<LoadedArsc> loaded_arsc(new LoadedArsc());
660   loaded_arsc->system_ = system;
661 
662   ChunkIterator iter(data.data(), data.size());
663   while (iter.HasNext()) {
664     const Chunk chunk = iter.Next();
665     switch (chunk.type()) {
666       case RES_TABLE_TYPE:
667         if (!loaded_arsc->LoadTable(chunk, loaded_idmap, load_as_shared_library)) {
668           return {};
669         }
670         break;
671 
672       default:
673         LOG(WARNING) << StringPrintf("Unknown chunk type '%02x'.", chunk.type());
674         break;
675     }
676   }
677 
678   if (iter.HadError()) {
679     LOG(ERROR) << iter.GetLastError();
680     if (iter.HadFatalError()) {
681       return {};
682     }
683   }
684 
685   // Need to force a move for mingw32.
686   return std::move(loaded_arsc);
687 }
688 
CreateEmpty()689 std::unique_ptr<const LoadedArsc> LoadedArsc::CreateEmpty() {
690   return std::unique_ptr<LoadedArsc>(new LoadedArsc());
691 }
692 
693 }  // namespace android
694