1 /* inflate.c -- zlib decompression
2  * Copyright (C) 1995-2005 Mark Adler
3  * For conditions of distribution and use, see copyright notice in zlib.h
4  */
5 
6 /*
7  * Change history:
8  *
9  * 1.2.beta0    24 Nov 2002
10  * - First version -- complete rewrite of inflate to simplify code, avoid
11  *   creation of window when not needed, minimize use of window when it is
12  *   needed, make inffast.c even faster, implement gzip decoding, and to
13  *   improve code readability and style over the previous zlib inflate code
14  *
15  * 1.2.beta1    25 Nov 2002
16  * - Use pointers for available input and output checking in inffast.c
17  * - Remove input and output counters in inffast.c
18  * - Change inffast.c entry and loop from avail_in >= 7 to >= 6
19  * - Remove unnecessary second byte pull from length extra in inffast.c
20  * - Unroll direct copy to three copies per loop in inffast.c
21  *
22  * 1.2.beta2    4 Dec 2002
23  * - Change external routine names to reduce potential conflicts
24  * - Correct filename to inffixed.h for fixed tables in inflate.c
25  * - Make hbuf[] unsigned char to match parameter type in inflate.c
26  * - Change strm->next_out[-state->offset] to *(strm->next_out - state->offset)
27  *   to avoid negation problem on Alphas (64 bit) in inflate.c
28  *
29  * 1.2.beta3    22 Dec 2002
30  * - Add comments on state->bits assertion in inffast.c
31  * - Add comments on op field in inftrees.h
32  * - Fix bug in reuse of allocated window after inflateReset()
33  * - Remove bit fields--back to byte structure for speed
34  * - Remove distance extra == 0 check in inflate_fast()--only helps for lengths
35  * - Change post-increments to pre-increments in inflate_fast(), PPC biased?
36  * - Add compile time option, POSTINC, to use post-increments instead (Intel?)
37  * - Make MATCH copy in inflate() much faster for when inflate_fast() not used
38  * - Use local copies of stream next and avail values, as well as local bit
39  *   buffer and bit count in inflate()--for speed when inflate_fast() not used
40  *
41  * 1.2.beta4    1 Jan 2003
42  * - Split ptr - 257 statements in inflate_table() to avoid compiler warnings
43  * - Move a comment on output buffer sizes from inffast.c to inflate.c
44  * - Add comments in inffast.c to introduce the inflate_fast() routine
45  * - Rearrange window copies in inflate_fast() for speed and simplification
46  * - Unroll last copy for window match in inflate_fast()
47  * - Use local copies of window variables in inflate_fast() for speed
48  * - Pull out common write == 0 case for speed in inflate_fast()
49  * - Make op and len in inflate_fast() unsigned for consistency
50  * - Add FAR to lcode and dcode declarations in inflate_fast()
51  * - Simplified bad distance check in inflate_fast()
52  * - Added inflateBackInit(), inflateBack(), and inflateBackEnd() in new
53  *   source file infback.c to provide a call-back interface to inflate for
54  *   programs like gzip and unzip -- uses window as output buffer to avoid
55  *   window copying
56  *
57  * 1.2.beta5    1 Jan 2003
58  * - Improved inflateBack() interface to allow the caller to provide initial
59  *   input in strm.
60  * - Fixed stored blocks bug in inflateBack()
61  *
62  * 1.2.beta6    4 Jan 2003
63  * - Added comments in inffast.c on effectiveness of POSTINC
64  * - Typecasting all around to reduce compiler warnings
65  * - Changed loops from while (1) or do {} while (1) to for (;;), again to
66  *   make compilers happy
67  * - Changed type of window in inflateBackInit() to unsigned char *
68  *
69  * 1.2.beta7    27 Jan 2003
70  * - Changed many types to unsigned or unsigned short to avoid warnings
71  * - Added inflateCopy() function
72  *
73  * 1.2.0        9 Mar 2003
74  * - Changed inflateBack() interface to provide separate opaque descriptors
75  *   for the in() and out() functions
76  * - Changed inflateBack() argument and in_func typedef to swap the length
77  *   and buffer address return values for the input function
78  * - Check next_in and next_out for Z_NULL on entry to inflate()
79  *
80  * The history for versions after 1.2.0 are in ChangeLog in zlib distribution.
81  */
82 
83 #include "zutil.h"
84 #include "inftrees.h"
85 #include "inflate.h"
86 #include "inffast.h"
87 
88 #ifdef MAKEFIXED
89 #  ifndef BUILDFIXED
90 #    define BUILDFIXED
91 #  endif
92 #endif
93 
94 /* function prototypes */
95 local void fixedtables OF((struct inflate_state FAR *state));
96 local int updatewindow OF((z_streamp strm, unsigned out));
97 #ifdef BUILDFIXED
98    void makefixed OF((void));
99 #endif
100 local unsigned syncsearch OF((unsigned FAR *have, unsigned char FAR *buf,
101                               unsigned len));
102 
inflateReset(strm)103 int ZEXPORT inflateReset(strm)
104 z_streamp strm;
105 {
106     struct inflate_state FAR *state;
107 
108     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
109     state = (struct inflate_state FAR *)strm->state;
110     strm->total_in = strm->total_out = state->total = 0;
111     strm->msg = Z_NULL;
112     strm->adler = 1;        /* to support ill-conceived Java test suite */
113     state->mode = HEAD;
114     state->last = 0;
115     state->havedict = 0;
116     state->flags = 0;
117     state->dmax = 32768U;
118     state->check = 0;
119     state->head = Z_NULL;
120     state->wsize = 0;
121     state->whave = 0;
122     state->write = 0;
123     state->hold = 0;
124     state->bits = 0;
125     state->lencode = state->distcode = state->next = state->codes;
126     Tracev((stderr, "inflate: reset\n"));
127     return Z_OK;
128 }
129 
inflatePrime(strm,bits,value)130 int ZEXPORT inflatePrime(strm, bits, value)
131 z_streamp strm;
132 int bits;
133 int value;
134 {
135     struct inflate_state FAR *state;
136 
137     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
138     state = (struct inflate_state FAR *)strm->state;
139     if (bits > 16 || state->bits + bits > 32) return Z_STREAM_ERROR;
140     value &= (1L << bits) - 1;
141     state->hold += value << state->bits;
142     state->bits += bits;
143     return Z_OK;
144 }
145 
inflateInit2_(strm,windowBits,version,stream_size)146 int ZEXPORT inflateInit2_(strm, windowBits, version, stream_size)
147 z_streamp strm;
148 int windowBits;
149 const char *version;
150 int stream_size;
151 {
152     struct inflate_state FAR *state;
153 
154     if (version == Z_NULL || version[0] != ZLIB_VERSION[0] ||
155         stream_size != (int)(sizeof(z_stream)))
156         return Z_VERSION_ERROR;
157     if (strm == Z_NULL) return Z_STREAM_ERROR;
158     strm->msg = Z_NULL;                 /* in case we return an error */
159     if (strm->zalloc == (alloc_func)0) {
160         strm->zalloc = zcalloc;
161         strm->opaque = (voidpf)0;
162     }
163     if (strm->zfree == (free_func)0) strm->zfree = zcfree;
164     state = (struct inflate_state FAR *)
165             ZALLOC(strm, 1, sizeof(struct inflate_state));
166     if (state == Z_NULL) return Z_MEM_ERROR;
167     Tracev((stderr, "inflate: allocated\n"));
168     strm->state = (struct internal_state FAR *)state;
169     if (windowBits < 0) {
170         state->wrap = 0;
171         windowBits = -windowBits;
172     }
173     else {
174         state->wrap = (windowBits >> 4) + 1;
175 #ifdef GUNZIP
176         if (windowBits < 48) windowBits &= 15;
177 #endif
178     }
179     if (windowBits < 8 || windowBits > 15) {
180         ZFREE(strm, state);
181         strm->state = Z_NULL;
182         return Z_STREAM_ERROR;
183     }
184     state->wbits = (unsigned)windowBits;
185     state->window = Z_NULL;
186     return inflateReset(strm);
187 }
188 
inflateInit_(strm,version,stream_size)189 int ZEXPORT inflateInit_(strm, version, stream_size)
190 z_streamp strm;
191 const char *version;
192 int stream_size;
193 {
194     return inflateInit2_(strm, DEF_WBITS, version, stream_size);
195 }
196 
197 /*
198    Return state with length and distance decoding tables and index sizes set to
199    fixed code decoding.  Normally this returns fixed tables from inffixed.h.
200    If BUILDFIXED is defined, then instead this routine builds the tables the
201    first time it's called, and returns those tables the first time and
202    thereafter.  This reduces the size of the code by about 2K bytes, in
203    exchange for a little execution time.  However, BUILDFIXED should not be
204    used for threaded applications, since the rewriting of the tables and virgin
205    may not be thread-safe.
206  */
fixedtables(state)207 local void fixedtables(state)
208 struct inflate_state FAR *state;
209 {
210 #ifdef BUILDFIXED
211     static int virgin = 1;
212     static code *lenfix, *distfix;
213     static code fixed[544];
214 
215     /* build fixed huffman tables if first call (may not be thread safe) */
216     if (virgin) {
217         unsigned sym, bits;
218         static code *next;
219 
220         /* literal/length table */
221         sym = 0;
222         while (sym < 144) state->lens[sym++] = 8;
223         while (sym < 256) state->lens[sym++] = 9;
224         while (sym < 280) state->lens[sym++] = 7;
225         while (sym < 288) state->lens[sym++] = 8;
226         next = fixed;
227         lenfix = next;
228         bits = 9;
229         inflate_table(LENS, state->lens, 288, &(next), &(bits), state->work);
230 
231         /* distance table */
232         sym = 0;
233         while (sym < 32) state->lens[sym++] = 5;
234         distfix = next;
235         bits = 5;
236         inflate_table(DISTS, state->lens, 32, &(next), &(bits), state->work);
237 
238         /* do this just once */
239         virgin = 0;
240     }
241 #else /* !BUILDFIXED */
242 #   include "inffixed.h"
243 #endif /* BUILDFIXED */
244     state->lencode = lenfix;
245     state->lenbits = 9;
246     state->distcode = distfix;
247     state->distbits = 5;
248 }
249 
250 #ifdef MAKEFIXED
251 #include <stdio.h>
252 
253 /*
254    Write out the inffixed.h that is #include'd above.  Defining MAKEFIXED also
255    defines BUILDFIXED, so the tables are built on the fly.  makefixed() writes
256    those tables to stdout, which would be piped to inffixed.h.  A small program
257    can simply call makefixed to do this:
258 
259     void makefixed(void);
260 
261     int main(void)
262     {
263         makefixed();
264         return 0;
265     }
266 
267    Then that can be linked with zlib built with MAKEFIXED defined and run:
268 
269     a.out > inffixed.h
270  */
makefixed()271 void makefixed()
272 {
273     unsigned low, size;
274     struct inflate_state state;
275 
276     fixedtables(&state);
277     puts("    /* inffixed.h -- table for decoding fixed codes");
278     puts("     * Generated automatically by makefixed().");
279     puts("     */");
280     puts("");
281     puts("    /* WARNING: this file should *not* be used by applications.");
282     puts("       It is part of the implementation of this library and is");
283     puts("       subject to change. Applications should only use zlib.h.");
284     puts("     */");
285     puts("");
286     size = 1U << 9;
287     printf("    static const code lenfix[%u] = {", size);
288     low = 0;
289     for (;;) {
290         if ((low % 7) == 0) printf("\n        ");
291         printf("{%u,%u,%d}", state.lencode[low].op, state.lencode[low].bits,
292                state.lencode[low].val);
293         if (++low == size) break;
294         putchar(',');
295     }
296     puts("\n    };");
297     size = 1U << 5;
298     printf("\n    static const code distfix[%u] = {", size);
299     low = 0;
300     for (;;) {
301         if ((low % 6) == 0) printf("\n        ");
302         printf("{%u,%u,%d}", state.distcode[low].op, state.distcode[low].bits,
303                state.distcode[low].val);
304         if (++low == size) break;
305         putchar(',');
306     }
307     puts("\n    };");
308 }
309 #endif /* MAKEFIXED */
310 
311 /*
312    Update the window with the last wsize (normally 32K) bytes written before
313    returning.  If window does not exist yet, create it.  This is only called
314    when a window is already in use, or when output has been written during this
315    inflate call, but the end of the deflate stream has not been reached yet.
316    It is also called to create a window for dictionary data when a dictionary
317    is loaded.
318 
319    Providing output buffers larger than 32K to inflate() should provide a speed
320    advantage, since only the last 32K of output is copied to the sliding window
321    upon return from inflate(), and since all distances after the first 32K of
322    output will fall in the output data, making match copies simpler and faster.
323    The advantage may be dependent on the size of the processor's data caches.
324  */
updatewindow(strm,out)325 local int updatewindow(strm, out)
326 z_streamp strm;
327 unsigned out;
328 {
329     struct inflate_state FAR *state;
330     unsigned copy, dist;
331 
332     state = (struct inflate_state FAR *)strm->state;
333 
334     /* if it hasn't been done already, allocate space for the window */
335     if (state->window == Z_NULL) {
336         state->window = (unsigned char FAR *)
337                         ZALLOC(strm, 1U << state->wbits,
338                                sizeof(unsigned char));
339         if (state->window == Z_NULL) return 1;
340     }
341 
342     /* if window not in use yet, initialize */
343     if (state->wsize == 0) {
344         state->wsize = 1U << state->wbits;
345         state->write = 0;
346         state->whave = 0;
347     }
348 
349     /* copy state->wsize or less output bytes into the circular window */
350     copy = out - strm->avail_out;
351     if (copy >= state->wsize) {
352         zmemcpy(state->window, strm->next_out - state->wsize, state->wsize);
353         state->write = 0;
354         state->whave = state->wsize;
355     }
356     else {
357         dist = state->wsize - state->write;
358         if (dist > copy) dist = copy;
359         zmemcpy(state->window + state->write, strm->next_out - copy, dist);
360         copy -= dist;
361         if (copy) {
362             zmemcpy(state->window, strm->next_out - copy, copy);
363             state->write = copy;
364             state->whave = state->wsize;
365         }
366         else {
367             state->write += dist;
368             if (state->write == state->wsize) state->write = 0;
369             if (state->whave < state->wsize) state->whave += dist;
370         }
371     }
372     return 0;
373 }
374 
375 /* Macros for inflate(): */
376 
377 /* check function to use adler32() for zlib or crc32() for gzip */
378 #ifdef GUNZIP
379 #  define UPDATE(check, buf, len) \
380     (state->flags ? crc32(check, buf, len) : adler32(check, buf, len))
381 #else
382 #  define UPDATE(check, buf, len) adler32(check, buf, len)
383 #endif
384 
385 /* check macros for header crc */
386 #ifdef GUNZIP
387 #  define CRC2(check, word) \
388     do { \
389         hbuf[0] = (unsigned char)(word); \
390         hbuf[1] = (unsigned char)((word) >> 8); \
391         check = crc32(check, hbuf, 2); \
392     } while (0)
393 
394 #  define CRC4(check, word) \
395     do { \
396         hbuf[0] = (unsigned char)(word); \
397         hbuf[1] = (unsigned char)((word) >> 8); \
398         hbuf[2] = (unsigned char)((word) >> 16); \
399         hbuf[3] = (unsigned char)((word) >> 24); \
400         check = crc32(check, hbuf, 4); \
401     } while (0)
402 #endif
403 
404 /* Load registers with state in inflate() for speed */
405 #define LOAD() \
406     do { \
407         put = strm->next_out; \
408         left = strm->avail_out; \
409         next = strm->next_in; \
410         have = strm->avail_in; \
411         hold = state->hold; \
412         bits = state->bits; \
413     } while (0)
414 
415 /* Restore state from registers in inflate() */
416 #define RESTORE() \
417     do { \
418         strm->next_out = put; \
419         strm->avail_out = left; \
420         strm->next_in = next; \
421         strm->avail_in = have; \
422         state->hold = hold; \
423         state->bits = bits; \
424     } while (0)
425 
426 /* Clear the input bit accumulator */
427 #define INITBITS() \
428     do { \
429         hold = 0; \
430         bits = 0; \
431     } while (0)
432 
433 /* Get a byte of input into the bit accumulator, or return from inflate()
434    if there is no input available. */
435 #define PULLBYTE() \
436     do { \
437         if (have == 0) goto inf_leave; \
438         have--; \
439         hold += (unsigned long)(*next++) << bits; \
440         bits += 8; \
441     } while (0)
442 
443 /* Assure that there are at least n bits in the bit accumulator.  If there is
444    not enough available input to do that, then return from inflate(). */
445 #define NEEDBITS(n) \
446     do { \
447         while (bits < (unsigned)(n)) \
448             PULLBYTE(); \
449     } while (0)
450 
451 /* Return the low n bits of the bit accumulator (n < 16) */
452 #define BITS(n) \
453     ((unsigned)hold & ((1U << (n)) - 1))
454 
455 /* Remove n bits from the bit accumulator */
456 #define DROPBITS(n) \
457     do { \
458         hold >>= (n); \
459         bits -= (unsigned)(n); \
460     } while (0)
461 
462 /* Remove zero to seven bits as needed to go to a byte boundary */
463 #define BYTEBITS() \
464     do { \
465         hold >>= bits & 7; \
466         bits -= bits & 7; \
467     } while (0)
468 
469 /* Reverse the bytes in a 32-bit value */
470 #define REVERSE(q) \
471     ((((q) >> 24) & 0xff) + (((q) >> 8) & 0xff00) + \
472      (((q) & 0xff00) << 8) + (((q) & 0xff) << 24))
473 
474 /*
475    inflate() uses a state machine to process as much input data and generate as
476    much output data as possible before returning.  The state machine is
477    structured roughly as follows:
478 
479     for (;;) switch (state) {
480     ...
481     case STATEn:
482         if (not enough input data or output space to make progress)
483             return;
484         ... make progress ...
485         state = STATEm;
486         break;
487     ...
488     }
489 
490    so when inflate() is called again, the same case is attempted again, and
491    if the appropriate resources are provided, the machine proceeds to the
492    next state.  The NEEDBITS() macro is usually the way the state evaluates
493    whether it can proceed or should return.  NEEDBITS() does the return if
494    the requested bits are not available.  The typical use of the BITS macros
495    is:
496 
497         NEEDBITS(n);
498         ... do something with BITS(n) ...
499         DROPBITS(n);
500 
501    where NEEDBITS(n) either returns from inflate() if there isn't enough
502    input left to load n bits into the accumulator, or it continues.  BITS(n)
503    gives the low n bits in the accumulator.  When done, DROPBITS(n) drops
504    the low n bits off the accumulator.  INITBITS() clears the accumulator
505    and sets the number of available bits to zero.  BYTEBITS() discards just
506    enough bits to put the accumulator on a byte boundary.  After BYTEBITS()
507    and a NEEDBITS(8), then BITS(8) would return the next byte in the stream.
508 
509    NEEDBITS(n) uses PULLBYTE() to get an available byte of input, or to return
510    if there is no input available.  The decoding of variable length codes uses
511    PULLBYTE() directly in order to pull just enough bytes to decode the next
512    code, and no more.
513 
514    Some states loop until they get enough input, making sure that enough
515    state information is maintained to continue the loop where it left off
516    if NEEDBITS() returns in the loop.  For example, want, need, and keep
517    would all have to actually be part of the saved state in case NEEDBITS()
518    returns:
519 
520     case STATEw:
521         while (want < need) {
522             NEEDBITS(n);
523             keep[want++] = BITS(n);
524             DROPBITS(n);
525         }
526         state = STATEx;
527     case STATEx:
528 
529    As shown above, if the next state is also the next case, then the break
530    is omitted.
531 
532    A state may also return if there is not enough output space available to
533    complete that state.  Those states are copying stored data, writing a
534    literal byte, and copying a matching string.
535 
536    When returning, a "goto inf_leave" is used to update the total counters,
537    update the check value, and determine whether any progress has been made
538    during that inflate() call in order to return the proper return code.
539    Progress is defined as a change in either strm->avail_in or strm->avail_out.
540    When there is a window, goto inf_leave will update the window with the last
541    output written.  If a goto inf_leave occurs in the middle of decompression
542    and there is no window currently, goto inf_leave will create one and copy
543    output to the window for the next call of inflate().
544 
545    In this implementation, the flush parameter of inflate() only affects the
546    return code (per zlib.h).  inflate() always writes as much as possible to
547    strm->next_out, given the space available and the provided input--the effect
548    documented in zlib.h of Z_SYNC_FLUSH.  Furthermore, inflate() always defers
549    the allocation of and copying into a sliding window until necessary, which
550    provides the effect documented in zlib.h for Z_FINISH when the entire input
551    stream available.  So the only thing the flush parameter actually does is:
552    when flush is set to Z_FINISH, inflate() cannot return Z_OK.  Instead it
553    will return Z_BUF_ERROR if it has not reached the end of the stream.
554  */
555 
inflate(strm,flush)556 int ZEXPORT inflate(strm, flush)
557 z_streamp strm;
558 int flush;
559 {
560     struct inflate_state FAR *state;
561     unsigned char FAR *next;    /* next input */
562     unsigned char FAR *put;     /* next output */
563     unsigned have, left;        /* available input and output */
564     unsigned long hold;         /* bit buffer */
565     unsigned bits;              /* bits in bit buffer */
566     unsigned in, out;           /* save starting available input and output */
567     unsigned copy;              /* number of stored or match bytes to copy */
568     unsigned char FAR *from;    /* where to copy match bytes from */
569     code this;                  /* current decoding table entry */
570     code last;                  /* parent table entry */
571     unsigned len;               /* length to copy for repeats, bits to drop */
572     int ret;                    /* return code */
573 #ifdef GUNZIP
574     unsigned char hbuf[4];      /* buffer for gzip header crc calculation */
575 #endif
576     static const unsigned short order[19] = /* permutation of code lengths */
577         {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
578 
579     if (strm == Z_NULL || strm->state == Z_NULL || strm->next_out == Z_NULL ||
580         (strm->next_in == Z_NULL && strm->avail_in != 0))
581         return Z_STREAM_ERROR;
582 
583     state = (struct inflate_state FAR *)strm->state;
584     if (state->mode == TYPE) state->mode = TYPEDO;      /* skip check */
585     LOAD();
586     in = have;
587     out = left;
588     ret = Z_OK;
589     for (;;)
590         switch (state->mode) {
591         case HEAD:
592             if (state->wrap == 0) {
593                 state->mode = TYPEDO;
594                 break;
595             }
596             NEEDBITS(16);
597 #ifdef GUNZIP
598             if ((state->wrap & 2) && hold == 0x8b1f) {  /* gzip header */
599                 state->check = crc32(0L, Z_NULL, 0);
600                 CRC2(state->check, hold);
601                 INITBITS();
602                 state->mode = FLAGS;
603                 break;
604             }
605             state->flags = 0;           /* expect zlib header */
606             if (state->head != Z_NULL)
607                 state->head->done = -1;
608             if (!(state->wrap & 1) ||   /* check if zlib header allowed */
609 #else
610             if (
611 #endif
612                 ((BITS(8) << 8) + (hold >> 8)) % 31) {
613                 strm->msg = (char *)"incorrect header check";
614                 state->mode = BAD;
615                 break;
616             }
617             if (BITS(4) != Z_DEFLATED) {
618                 strm->msg = (char *)"unknown compression method";
619                 state->mode = BAD;
620                 break;
621             }
622             DROPBITS(4);
623             len = BITS(4) + 8;
624             if (len > state->wbits) {
625                 strm->msg = (char *)"invalid window size";
626                 state->mode = BAD;
627                 break;
628             }
629             state->dmax = 1U << len;
630             Tracev((stderr, "inflate:   zlib header ok\n"));
631             strm->adler = state->check = adler32(0L, Z_NULL, 0);
632             state->mode = (hold & 0x200) ? DICTID : TYPE;
633             INITBITS();
634             break;
635 #ifdef GUNZIP
636         case FLAGS:
637             NEEDBITS(16);
638             state->flags = (int)(hold);
639             if ((state->flags & 0xff) != Z_DEFLATED) {
640                 strm->msg = (char *)"unknown compression method";
641                 state->mode = BAD;
642                 break;
643             }
644             if (state->flags & 0xe000) {
645                 strm->msg = (char *)"unknown header flags set";
646                 state->mode = BAD;
647                 break;
648             }
649             if (state->head != Z_NULL)
650                 state->head->text = (int)((hold >> 8) & 1);
651             if (state->flags & 0x0200) CRC2(state->check, hold);
652             INITBITS();
653             state->mode = TIME;
654             /*-fallthrough*/
655         case TIME:
656             NEEDBITS(32);
657             if (state->head != Z_NULL)
658                 state->head->time = hold;
659             if (state->flags & 0x0200) CRC4(state->check, hold);
660             INITBITS();
661             state->mode = OS;
662             /*-fallthrough*/
663         case OS:
664             NEEDBITS(16);
665             if (state->head != Z_NULL) {
666                 state->head->xflags = (int)(hold & 0xff);
667                 state->head->os = (int)(hold >> 8);
668             }
669             if (state->flags & 0x0200) CRC2(state->check, hold);
670             INITBITS();
671             state->mode = EXLEN;
672             /*-fallthrough*/
673         case EXLEN:
674             if (state->flags & 0x0400) {
675                 NEEDBITS(16);
676                 state->length = (unsigned)(hold);
677                 if (state->head != Z_NULL)
678                     state->head->extra_len = (unsigned)hold;
679                 if (state->flags & 0x0200) CRC2(state->check, hold);
680                 INITBITS();
681             }
682             else if (state->head != Z_NULL)
683                 state->head->extra = Z_NULL;
684             state->mode = EXTRA;
685             /*-fallthrough*/
686         case EXTRA:
687             if (state->flags & 0x0400) {
688                 copy = state->length;
689                 if (copy > have) copy = have;
690                 if (copy) {
691                     if (state->head != Z_NULL &&
692                         state->head->extra != Z_NULL) {
693                         len = state->head->extra_len - state->length;
694                         zmemcpy(state->head->extra + len, next,
695                                 len + copy > state->head->extra_max ?
696                                 state->head->extra_max - len : copy);
697                     }
698                     if (state->flags & 0x0200)
699                         state->check = crc32(state->check, next, copy);
700                     have -= copy;
701                     next += copy;
702                     state->length -= copy;
703                 }
704                 if (state->length) goto inf_leave;
705             }
706             state->length = 0;
707             state->mode = NAME;
708             /*-fallthrough*/
709         case NAME:
710             if (state->flags & 0x0800) {
711                 if (have == 0) goto inf_leave;
712                 copy = 0;
713                 do {
714                     len = (unsigned)(next[copy++]);
715                     if (state->head != Z_NULL &&
716                             state->head->name != Z_NULL &&
717                             state->length < state->head->name_max)
718                         state->head->name[state->length++] = len;
719                 } while (len && copy < have);
720                 if (state->flags & 0x0200)
721                     state->check = crc32(state->check, next, copy);
722                 have -= copy;
723                 next += copy;
724                 if (len) goto inf_leave;
725             }
726             else if (state->head != Z_NULL)
727                 state->head->name = Z_NULL;
728             state->length = 0;
729             state->mode = COMMENT;
730             /*-fallthrough*/
731         case COMMENT:
732             if (state->flags & 0x1000) {
733                 if (have == 0) goto inf_leave;
734                 copy = 0;
735                 do {
736                     len = (unsigned)(next[copy++]);
737                     if (state->head != Z_NULL &&
738                             state->head->comment != Z_NULL &&
739                             state->length < state->head->comm_max)
740                         state->head->comment[state->length++] = len;
741                 } while (len && copy < have);
742                 if (state->flags & 0x0200)
743                     state->check = crc32(state->check, next, copy);
744                 have -= copy;
745                 next += copy;
746                 if (len) goto inf_leave;
747             }
748             else if (state->head != Z_NULL)
749                 state->head->comment = Z_NULL;
750             state->mode = HCRC;
751             /*-fallthrough*/
752         case HCRC:
753             if (state->flags & 0x0200) {
754                 NEEDBITS(16);
755                 if (hold != (state->check & 0xffff)) {
756                     strm->msg = (char *)"header crc mismatch";
757                     state->mode = BAD;
758                     break;
759                 }
760                 INITBITS();
761             }
762             if (state->head != Z_NULL) {
763                 state->head->hcrc = (int)((state->flags >> 9) & 1);
764                 state->head->done = 1;
765             }
766             strm->adler = state->check = crc32(0L, Z_NULL, 0);
767             state->mode = TYPE;
768             break;
769 #endif
770         case DICTID:
771             NEEDBITS(32);
772             strm->adler = state->check = REVERSE(hold);
773             INITBITS();
774             state->mode = DICT;
775             /*-fallthrough*/
776         case DICT:
777             if (state->havedict == 0) {
778                 RESTORE();
779                 return Z_NEED_DICT;
780             }
781             strm->adler = state->check = adler32(0L, Z_NULL, 0);
782             state->mode = TYPE;
783             /*-fallthrough*/
784         case TYPE:
785             if (flush == Z_BLOCK) goto inf_leave;
786             /*-fallthrough*/
787         case TYPEDO:
788             if (state->last) {
789                 BYTEBITS();
790                 state->mode = CHECK;
791                 break;
792             }
793             NEEDBITS(3);
794             state->last = BITS(1);
795             DROPBITS(1);
796             switch (BITS(2)) {
797             case 0:                             /* stored block */
798                 Tracev((stderr, "inflate:     stored block%s\n",
799                         state->last ? " (last)" : ""));
800                 state->mode = STORED;
801                 break;
802             case 1:                             /* fixed block */
803                 fixedtables(state);
804                 Tracev((stderr, "inflate:     fixed codes block%s\n",
805                         state->last ? " (last)" : ""));
806                 state->mode = LEN;              /* decode codes */
807                 break;
808             case 2:                             /* dynamic block */
809                 Tracev((stderr, "inflate:     dynamic codes block%s\n",
810                         state->last ? " (last)" : ""));
811                 state->mode = TABLE;
812                 break;
813             case 3:
814                 strm->msg = (char *)"invalid block type";
815                 state->mode = BAD;
816             }
817             DROPBITS(2);
818             break;
819         case STORED:
820             BYTEBITS();                         /* go to byte boundary */
821             NEEDBITS(32);
822             if ((hold & 0xffff) != ((hold >> 16) ^ 0xffff)) {
823                 strm->msg = (char *)"invalid stored block lengths";
824                 state->mode = BAD;
825                 break;
826             }
827             state->length = (unsigned)hold & 0xffff;
828             Tracev((stderr, "inflate:       stored length %u\n",
829                     state->length));
830             INITBITS();
831             state->mode = COPY;
832             /*-fallthrough*/
833         case COPY:
834             copy = state->length;
835             if (copy) {
836                 if (copy > have) copy = have;
837                 if (copy > left) copy = left;
838                 if (copy == 0) goto inf_leave;
839                 zmemcpy(put, next, copy);
840                 have -= copy;
841                 next += copy;
842                 left -= copy;
843                 put += copy;
844                 state->length -= copy;
845                 break;
846             }
847             Tracev((stderr, "inflate:       stored end\n"));
848             state->mode = TYPE;
849             break;
850         case TABLE:
851             NEEDBITS(14);
852             state->nlen = BITS(5) + 257;
853             DROPBITS(5);
854             state->ndist = BITS(5) + 1;
855             DROPBITS(5);
856             state->ncode = BITS(4) + 4;
857             DROPBITS(4);
858 #ifndef PKZIP_BUG_WORKAROUND
859             if (state->nlen > 286 || state->ndist > 30) {
860                 strm->msg = (char *)"too many length or distance symbols";
861                 state->mode = BAD;
862                 break;
863             }
864 #endif
865             Tracev((stderr, "inflate:       table sizes ok\n"));
866             state->have = 0;
867             state->mode = LENLENS;
868             /*-fallthrough*/
869         case LENLENS:
870             while (state->have < state->ncode) {
871                 NEEDBITS(3);
872                 state->lens[order[state->have++]] = (unsigned short)BITS(3);
873                 DROPBITS(3);
874             }
875             while (state->have < 19)
876                 state->lens[order[state->have++]] = 0;
877             state->next = state->codes;
878             state->lencode = (code const FAR *)(state->next);
879             state->lenbits = 7;
880             ret = inflate_table(CODES, state->lens, 19, &(state->next),
881                                 &(state->lenbits), state->work);
882             if (ret) {
883                 strm->msg = (char *)"invalid code lengths set";
884                 state->mode = BAD;
885                 break;
886             }
887             Tracev((stderr, "inflate:       code lengths ok\n"));
888             state->have = 0;
889             state->mode = CODELENS;
890             /*-fallthrough*/
891         case CODELENS:
892             while (state->have < state->nlen + state->ndist) {
893                 for (;;) {
894                     this = state->lencode[BITS(state->lenbits)];
895                     if ((unsigned)(this.bits) <= bits) break;
896                     PULLBYTE();
897                 }
898                 if (this.val < 16) {
899                     NEEDBITS(this.bits);
900                     DROPBITS(this.bits);
901                     state->lens[state->have++] = this.val;
902                 }
903                 else {
904                     if (this.val == 16) {
905                         NEEDBITS(this.bits + 2);
906                         DROPBITS(this.bits);
907                         if (state->have == 0) {
908                             strm->msg = (char *)"invalid bit length repeat";
909                             state->mode = BAD;
910                             break;
911                         }
912                         len = state->lens[state->have - 1];
913                         copy = 3 + BITS(2);
914                         DROPBITS(2);
915                     }
916                     else if (this.val == 17) {
917                         NEEDBITS(this.bits + 3);
918                         DROPBITS(this.bits);
919                         len = 0;
920                         copy = 3 + BITS(3);
921                         DROPBITS(3);
922                     }
923                     else {
924                         NEEDBITS(this.bits + 7);
925                         DROPBITS(this.bits);
926                         len = 0;
927                         copy = 11 + BITS(7);
928                         DROPBITS(7);
929                     }
930                     if (state->have + copy > state->nlen + state->ndist) {
931                         strm->msg = (char *)"invalid bit length repeat";
932                         state->mode = BAD;
933                         break;
934                     }
935                     while (copy--)
936                         state->lens[state->have++] = (unsigned short)len;
937                 }
938             }
939 
940             /* handle error breaks in while */
941             if (state->mode == BAD) break;
942 
943             /* build code tables */
944             state->next = state->codes;
945             state->lencode = (code const FAR *)(state->next);
946             state->lenbits = 9;
947             ret = inflate_table(LENS, state->lens, state->nlen, &(state->next),
948                                 &(state->lenbits), state->work);
949             if (ret) {
950                 strm->msg = (char *)"invalid literal/lengths set";
951                 state->mode = BAD;
952                 break;
953             }
954             state->distcode = (code const FAR *)(state->next);
955             state->distbits = 6;
956             ret = inflate_table(DISTS, state->lens + state->nlen, state->ndist,
957                             &(state->next), &(state->distbits), state->work);
958             if (ret) {
959                 strm->msg = (char *)"invalid distances set";
960                 state->mode = BAD;
961                 break;
962             }
963             Tracev((stderr, "inflate:       codes ok\n"));
964             state->mode = LEN;
965             /*-fallthrough*/
966         case LEN:
967             if (have >= 6 && left >= 258) {
968                 RESTORE();
969                 inflate_fast(strm, out);
970                 LOAD();
971                 break;
972             }
973             for (;;) {
974                 this = state->lencode[BITS(state->lenbits)];
975                 if ((unsigned)(this.bits) <= bits) break;
976                 PULLBYTE();
977             }
978             if (this.op && (this.op & 0xf0) == 0) {
979                 last = this;
980                 for (;;) {
981                     this = state->lencode[last.val +
982                             (BITS(last.bits + last.op) >> last.bits)];
983                     if ((unsigned)(last.bits + this.bits) <= bits) break;
984                     PULLBYTE();
985                 }
986                 DROPBITS(last.bits);
987             }
988             DROPBITS(this.bits);
989             state->length = (unsigned)this.val;
990             if ((int)(this.op) == 0) {
991                 Tracevv((stderr, this.val >= 0x20 && this.val < 0x7f ?
992                         "inflate:         literal '%c'\n" :
993                         "inflate:         literal 0x%02x\n", this.val));
994                 state->mode = LIT;
995                 break;
996             }
997             if (this.op & 32) {
998                 Tracevv((stderr, "inflate:         end of block\n"));
999                 state->mode = TYPE;
1000                 break;
1001             }
1002             if (this.op & 64) {
1003                 strm->msg = (char *)"invalid literal/length code";
1004                 state->mode = BAD;
1005                 break;
1006             }
1007             state->extra = (unsigned)(this.op) & 15;
1008             state->mode = LENEXT;
1009             /*-fallthrough*/
1010         case LENEXT:
1011             if (state->extra) {
1012                 NEEDBITS(state->extra);
1013                 state->length += BITS(state->extra);
1014                 DROPBITS(state->extra);
1015             }
1016             Tracevv((stderr, "inflate:         length %u\n", state->length));
1017             state->mode = DIST;
1018             /*-fallthrough*/
1019         case DIST:
1020             for (;;) {
1021                 this = state->distcode[BITS(state->distbits)];
1022                 if ((unsigned)(this.bits) <= bits) break;
1023                 PULLBYTE();
1024             }
1025             if ((this.op & 0xf0) == 0) {
1026                 last = this;
1027                 for (;;) {
1028                     this = state->distcode[last.val +
1029                             (BITS(last.bits + last.op) >> last.bits)];
1030                     if ((unsigned)(last.bits + this.bits) <= bits) break;
1031                     PULLBYTE();
1032                 }
1033                 DROPBITS(last.bits);
1034             }
1035             DROPBITS(this.bits);
1036             if (this.op & 64) {
1037                 strm->msg = (char *)"invalid distance code";
1038                 state->mode = BAD;
1039                 break;
1040             }
1041             state->offset = (unsigned)this.val;
1042             state->extra = (unsigned)(this.op) & 15;
1043             state->mode = DISTEXT;
1044             /*-fallthrough*/
1045         case DISTEXT:
1046             if (state->extra) {
1047                 NEEDBITS(state->extra);
1048                 state->offset += BITS(state->extra);
1049                 DROPBITS(state->extra);
1050             }
1051 #ifdef INFLATE_STRICT
1052             if (state->offset > state->dmax) {
1053                 strm->msg = (char *)"invalid distance too far back";
1054                 state->mode = BAD;
1055                 break;
1056             }
1057 #endif
1058             if (state->offset > state->whave + out - left) {
1059                 strm->msg = (char *)"invalid distance too far back";
1060                 state->mode = BAD;
1061                 break;
1062             }
1063             Tracevv((stderr, "inflate:         distance %u\n", state->offset));
1064             state->mode = MATCH;
1065             /*-fallthrough*/
1066         case MATCH:
1067             if (left == 0) goto inf_leave;
1068             copy = out - left;
1069             if (state->offset > copy) {         /* copy from window */
1070                 copy = state->offset - copy;
1071                 if (copy > state->write) {
1072                     copy -= state->write;
1073                     from = state->window + (state->wsize - copy);
1074                 }
1075                 else
1076                     from = state->window + (state->write - copy);
1077                 if (copy > state->length) copy = state->length;
1078             }
1079             else {                              /* copy from output */
1080                 from = put - state->offset;
1081                 copy = state->length;
1082             }
1083             if (copy > left) copy = left;
1084             left -= copy;
1085             state->length -= copy;
1086             do {
1087                 *put++ = *from++;
1088             } while (--copy);
1089             if (state->length == 0) state->mode = LEN;
1090             break;
1091         case LIT:
1092             if (left == 0) goto inf_leave;
1093             *put++ = (unsigned char)(state->length);
1094             left--;
1095             state->mode = LEN;
1096             break;
1097         case CHECK:
1098             if (state->wrap) {
1099                 NEEDBITS(32);
1100                 out -= left;
1101                 strm->total_out += out;
1102                 state->total += out;
1103                 if (out)
1104                     strm->adler = state->check =
1105                         UPDATE(state->check, put - out, out);
1106                 out = left;
1107                 if ((
1108 #ifdef GUNZIP
1109                      state->flags ? hold :
1110 #endif
1111                      REVERSE(hold)) != state->check) {
1112                     strm->msg = (char *)"incorrect data check";
1113                     state->mode = BAD;
1114                     break;
1115                 }
1116                 INITBITS();
1117                 Tracev((stderr, "inflate:   check matches trailer\n"));
1118             }
1119 #ifdef GUNZIP
1120             state->mode = LENGTH;
1121             /*-fallthrough*/
1122         case LENGTH:
1123             if (state->wrap && state->flags) {
1124                 NEEDBITS(32);
1125                 if (hold != (state->total & 0xffffffffUL)) {
1126                     strm->msg = (char *)"incorrect length check";
1127                     state->mode = BAD;
1128                     break;
1129                 }
1130                 INITBITS();
1131                 Tracev((stderr, "inflate:   length matches trailer\n"));
1132             }
1133 #endif
1134             state->mode = DONE;
1135             /*-fallthrough*/
1136         case DONE:
1137             ret = Z_STREAM_END;
1138             goto inf_leave;
1139         case BAD:
1140             ret = Z_DATA_ERROR;
1141             goto inf_leave;
1142         case MEM:
1143             return Z_MEM_ERROR;
1144         case SYNC:
1145         default:
1146             return Z_STREAM_ERROR;
1147         }
1148 
1149     /*
1150        Return from inflate(), updating the total counts and the check value.
1151        If there was no progress during the inflate() call, return a buffer
1152        error.  Call updatewindow() to create and/or update the window state.
1153        Note: a memory error from inflate() is non-recoverable.
1154      */
1155   inf_leave:
1156     RESTORE();
1157     if (state->wsize || (state->mode < CHECK && out != strm->avail_out))
1158         if (updatewindow(strm, out)) {
1159             state->mode = MEM;
1160             return Z_MEM_ERROR;
1161         }
1162     in -= strm->avail_in;
1163     out -= strm->avail_out;
1164     strm->total_in += in;
1165     strm->total_out += out;
1166     state->total += out;
1167     if (state->wrap && out)
1168         strm->adler = state->check =
1169             UPDATE(state->check, strm->next_out - out, out);
1170     strm->data_type = state->bits + (state->last ? 64 : 0) +
1171                       (state->mode == TYPE ? 128 : 0);
1172     if (((in == 0 && out == 0) || flush == Z_FINISH) && ret == Z_OK)
1173         ret = Z_BUF_ERROR;
1174     return ret;
1175 }
1176 
inflateEnd(strm)1177 int ZEXPORT inflateEnd(strm)
1178 z_streamp strm;
1179 {
1180     struct inflate_state FAR *state;
1181     if (strm == Z_NULL || strm->state == Z_NULL || strm->zfree == (free_func)0)
1182         return Z_STREAM_ERROR;
1183     state = (struct inflate_state FAR *)strm->state;
1184     if (state->window != Z_NULL) ZFREE(strm, state->window);
1185     ZFREE(strm, strm->state);
1186     strm->state = Z_NULL;
1187     Tracev((stderr, "inflate: end\n"));
1188     return Z_OK;
1189 }
1190 
inflateSetDictionary(strm,dictionary,dictLength)1191 int ZEXPORT inflateSetDictionary(strm, dictionary, dictLength)
1192 z_streamp strm;
1193 const Bytef *dictionary;
1194 uInt dictLength;
1195 {
1196     struct inflate_state FAR *state;
1197     unsigned long id;
1198 
1199     /* check state */
1200     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
1201     state = (struct inflate_state FAR *)strm->state;
1202     if (state->wrap != 0 && state->mode != DICT)
1203         return Z_STREAM_ERROR;
1204 
1205     /* check for correct dictionary id */
1206     if (state->mode == DICT) {
1207         id = adler32(0L, Z_NULL, 0);
1208         id = adler32(id, dictionary, dictLength);
1209         if (id != state->check)
1210             return Z_DATA_ERROR;
1211     }
1212 
1213     /* copy dictionary to window */
1214     if (updatewindow(strm, strm->avail_out)) {
1215         state->mode = MEM;
1216         return Z_MEM_ERROR;
1217     }
1218     if (dictLength > state->wsize) {
1219         zmemcpy(state->window, dictionary + dictLength - state->wsize,
1220                 state->wsize);
1221         state->whave = state->wsize;
1222     }
1223     else {
1224         zmemcpy(state->window + state->wsize - dictLength, dictionary,
1225                 dictLength);
1226         state->whave = dictLength;
1227     }
1228     state->havedict = 1;
1229     Tracev((stderr, "inflate:   dictionary set\n"));
1230     return Z_OK;
1231 }
1232 
inflateGetHeader(strm,head)1233 int ZEXPORT inflateGetHeader(strm, head)
1234 z_streamp strm;
1235 gz_headerp head;
1236 {
1237     struct inflate_state FAR *state;
1238 
1239     /* check state */
1240     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
1241     state = (struct inflate_state FAR *)strm->state;
1242     if ((state->wrap & 2) == 0) return Z_STREAM_ERROR;
1243 
1244     /* save header structure */
1245     state->head = head;
1246     head->done = 0;
1247     return Z_OK;
1248 }
1249 
1250 /*
1251    Search buf[0..len-1] for the pattern: 0, 0, 0xff, 0xff.  Return when found
1252    or when out of input.  When called, *have is the number of pattern bytes
1253    found in order so far, in 0..3.  On return *have is updated to the new
1254    state.  If on return *have equals four, then the pattern was found and the
1255    return value is how many bytes were read including the last byte of the
1256    pattern.  If *have is less than four, then the pattern has not been found
1257    yet and the return value is len.  In the latter case, syncsearch() can be
1258    called again with more data and the *have state.  *have is initialized to
1259    zero for the first call.
1260  */
syncsearch(have,buf,len)1261 local unsigned syncsearch(have, buf, len)
1262 unsigned FAR *have;
1263 unsigned char FAR *buf;
1264 unsigned len;
1265 {
1266     unsigned got;
1267     unsigned next;
1268 
1269     got = *have;
1270     next = 0;
1271     while (next < len && got < 4) {
1272         if ((int)(buf[next]) == (got < 2 ? 0 : 0xff))
1273             got++;
1274         else if (buf[next])
1275             got = 0;
1276         else
1277             got = 4 - got;
1278         next++;
1279     }
1280     *have = got;
1281     return next;
1282 }
1283 
inflateSync(strm)1284 int ZEXPORT inflateSync(strm)
1285 z_streamp strm;
1286 {
1287     unsigned len;               /* number of bytes to look at or looked at */
1288     unsigned long in, out;      /* temporary to save total_in and total_out */
1289     unsigned char buf[4];       /* to restore bit buffer to byte string */
1290     struct inflate_state FAR *state;
1291 
1292     /* check parameters */
1293     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
1294     state = (struct inflate_state FAR *)strm->state;
1295     if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR;
1296 
1297     /* if first time, start search in bit buffer */
1298     if (state->mode != SYNC) {
1299         state->mode = SYNC;
1300         state->hold <<= state->bits & 7;
1301         state->bits -= state->bits & 7;
1302         len = 0;
1303         while (state->bits >= 8) {
1304             buf[len++] = (unsigned char)(state->hold);
1305             state->hold >>= 8;
1306             state->bits -= 8;
1307         }
1308         state->have = 0;
1309         syncsearch(&(state->have), buf, len);
1310     }
1311 
1312     /* search available input */
1313     len = syncsearch(&(state->have), strm->next_in, strm->avail_in);
1314     strm->avail_in -= len;
1315     strm->next_in += len;
1316     strm->total_in += len;
1317 
1318     /* return no joy or set up to restart inflate() on a new block */
1319     if (state->have != 4) return Z_DATA_ERROR;
1320     in = strm->total_in;  out = strm->total_out;
1321     inflateReset(strm);
1322     strm->total_in = in;  strm->total_out = out;
1323     state->mode = TYPE;
1324     return Z_OK;
1325 }
1326 
1327 /*
1328    Returns true if inflate is currently at the end of a block generated by
1329    Z_SYNC_FLUSH or Z_FULL_FLUSH. This function is used by one PPP
1330    implementation to provide an additional safety check. PPP uses
1331    Z_SYNC_FLUSH but removes the length bytes of the resulting empty stored
1332    block. When decompressing, PPP checks that at the end of input packet,
1333    inflate is waiting for these length bytes.
1334  */
inflateSyncPoint(strm)1335 int ZEXPORT inflateSyncPoint(strm)
1336 z_streamp strm;
1337 {
1338     struct inflate_state FAR *state;
1339 
1340     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
1341     state = (struct inflate_state FAR *)strm->state;
1342     return state->mode == STORED && state->bits == 0;
1343 }
1344 
inflateCopy(dest,source)1345 int ZEXPORT inflateCopy(dest, source)
1346 z_streamp dest;
1347 z_streamp source;
1348 {
1349     struct inflate_state FAR *state;
1350     struct inflate_state FAR *copy;
1351     unsigned char FAR *window;
1352     unsigned wsize;
1353 
1354     /* check input */
1355     if (dest == Z_NULL || source == Z_NULL || source->state == Z_NULL ||
1356         source->zalloc == (alloc_func)0 || source->zfree == (free_func)0)
1357         return Z_STREAM_ERROR;
1358     state = (struct inflate_state FAR *)source->state;
1359 
1360     /* allocate space */
1361     copy = (struct inflate_state FAR *)
1362            ZALLOC(source, 1, sizeof(struct inflate_state));
1363     if (copy == Z_NULL) return Z_MEM_ERROR;
1364     window = Z_NULL;
1365     if (state->window != Z_NULL) {
1366         window = (unsigned char FAR *)
1367                  ZALLOC(source, 1U << state->wbits, sizeof(unsigned char));
1368         if (window == Z_NULL) {
1369             ZFREE(source, copy);
1370             return Z_MEM_ERROR;
1371         }
1372     }
1373 
1374     /* copy state */
1375     zmemcpy(dest, source, sizeof(z_stream));
1376     zmemcpy(copy, state, sizeof(struct inflate_state));
1377     if (state->lencode >= state->codes &&
1378         state->lencode <= state->codes + ENOUGH - 1) {
1379         copy->lencode = copy->codes + (state->lencode - state->codes);
1380         copy->distcode = copy->codes + (state->distcode - state->codes);
1381     }
1382     copy->next = copy->codes + (state->next - state->codes);
1383     if (window != Z_NULL) {
1384         wsize = 1U << state->wbits;
1385         zmemcpy(window, state->window, wsize);
1386     }
1387     copy->window = window;
1388     dest->state = (struct internal_state FAR *)copy;
1389     return Z_OK;
1390 }
1391