1 /*-
2 * Copyright (c) 2003-2007 Tim Kientzle
3 * Copyright (c) 2011 Andres Mejia
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26 
27 #include "archive_platform.h"
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #include <time.h>
33 #include <limits.h>
34 #ifdef HAVE_ZLIB_H
35 #include <zlib.h> /* crc32 */
36 #endif
37 
38 #include "archive.h"
39 #ifndef HAVE_ZLIB_H
40 #include "archive_crc32.h"
41 #endif
42 #include "archive_endian.h"
43 #include "archive_entry.h"
44 #include "archive_entry_locale.h"
45 #include "archive_ppmd7_private.h"
46 #include "archive_private.h"
47 #include "archive_read_private.h"
48 
49 /* RAR signature, also known as the mark header */
50 #define RAR_SIGNATURE "\x52\x61\x72\x21\x1A\x07\x00"
51 
52 /* Header types */
53 #define MARK_HEAD    0x72
54 #define MAIN_HEAD    0x73
55 #define FILE_HEAD    0x74
56 #define COMM_HEAD    0x75
57 #define AV_HEAD      0x76
58 #define SUB_HEAD     0x77
59 #define PROTECT_HEAD 0x78
60 #define SIGN_HEAD    0x79
61 #define NEWSUB_HEAD  0x7a
62 #define ENDARC_HEAD  0x7b
63 
64 /* Main Header Flags */
65 #define MHD_VOLUME       0x0001
66 #define MHD_COMMENT      0x0002
67 #define MHD_LOCK         0x0004
68 #define MHD_SOLID        0x0008
69 #define MHD_NEWNUMBERING 0x0010
70 #define MHD_AV           0x0020
71 #define MHD_PROTECT      0x0040
72 #define MHD_PASSWORD     0x0080
73 #define MHD_FIRSTVOLUME  0x0100
74 #define MHD_ENCRYPTVER   0x0200
75 
76 /* Flags common to all headers */
77 #define HD_MARKDELETION     0x4000
78 #define HD_ADD_SIZE_PRESENT 0x8000
79 
80 /* File Header Flags */
81 #define FHD_SPLIT_BEFORE 0x0001
82 #define FHD_SPLIT_AFTER  0x0002
83 #define FHD_PASSWORD     0x0004
84 #define FHD_COMMENT      0x0008
85 #define FHD_SOLID        0x0010
86 #define FHD_LARGE        0x0100
87 #define FHD_UNICODE      0x0200
88 #define FHD_SALT         0x0400
89 #define FHD_VERSION      0x0800
90 #define FHD_EXTTIME      0x1000
91 #define FHD_EXTFLAGS     0x2000
92 
93 /* File dictionary sizes */
94 #define DICTIONARY_SIZE_64   0x00
95 #define DICTIONARY_SIZE_128  0x20
96 #define DICTIONARY_SIZE_256  0x40
97 #define DICTIONARY_SIZE_512  0x60
98 #define DICTIONARY_SIZE_1024 0x80
99 #define DICTIONARY_SIZE_2048 0xA0
100 #define DICTIONARY_SIZE_4096 0xC0
101 #define FILE_IS_DIRECTORY    0xE0
102 #define DICTIONARY_MASK      FILE_IS_DIRECTORY
103 
104 /* OS Flags */
105 #define OS_MSDOS  0
106 #define OS_OS2    1
107 #define OS_WIN32  2
108 #define OS_UNIX   3
109 #define OS_MAC_OS 4
110 #define OS_BEOS   5
111 
112 /* Compression Methods */
113 #define COMPRESS_METHOD_STORE   0x30
114 /* LZSS */
115 #define COMPRESS_METHOD_FASTEST 0x31
116 #define COMPRESS_METHOD_FAST    0x32
117 #define COMPRESS_METHOD_NORMAL  0x33
118 /* PPMd Variant H */
119 #define COMPRESS_METHOD_GOOD    0x34
120 #define COMPRESS_METHOD_BEST    0x35
121 
122 #define CRC_POLYNOMIAL 0xEDB88320
123 
124 #define NS_UNIT 10000000
125 
126 #define DICTIONARY_MAX_SIZE 0x400000
127 
128 #define MAINCODE_SIZE      299
129 #define OFFSETCODE_SIZE    60
130 #define LOWOFFSETCODE_SIZE 17
131 #define LENGTHCODE_SIZE    28
132 #define HUFFMAN_TABLE_SIZE \
133   MAINCODE_SIZE + OFFSETCODE_SIZE + LOWOFFSETCODE_SIZE + LENGTHCODE_SIZE
134 
135 #define MAX_SYMBOL_LENGTH 0xF
136 #define MAX_SYMBOLS       20
137 
138 /*
139  * Considering L1,L2 cache miss and a calling of write system-call,
140  * the best size of the output buffer(uncompressed buffer) is 128K.
141  * If the structure of extracting process is changed, this value
142  * might be researched again.
143  */
144 #define UNP_BUFFER_SIZE   (128 * 1024)
145 
146 /* Define this here for non-Windows platforms */
147 #if !((defined(__WIN32__) || defined(_WIN32) || defined(__WIN32)) && !defined(__CYGWIN__))
148 #define FILE_ATTRIBUTE_DIRECTORY 0x10
149 #endif
150 
151 #undef minimum
152 #define minimum(a, b)	((a)<(b)?(a):(b))
153 
154 /* Stack overflow check */
155 #define MAX_COMPRESS_DEPTH 1024
156 
157 /* Fields common to all headers */
158 struct rar_header
159 {
160   char crc[2];
161   char type;
162   char flags[2];
163   char size[2];
164 };
165 
166 /* Fields common to all file headers */
167 struct rar_file_header
168 {
169   char pack_size[4];
170   char unp_size[4];
171   char host_os;
172   char file_crc[4];
173   char file_time[4];
174   char unp_ver;
175   char method;
176   char name_size[2];
177   char file_attr[4];
178 };
179 
180 struct huffman_tree_node
181 {
182   int branches[2];
183 };
184 
185 struct huffman_table_entry
186 {
187   unsigned int length;
188   int value;
189 };
190 
191 struct huffman_code
192 {
193   struct huffman_tree_node *tree;
194   int numentries;
195   int numallocatedentries;
196   int minlength;
197   int maxlength;
198   int tablesize;
199   struct huffman_table_entry *table;
200 };
201 
202 struct lzss
203 {
204   unsigned char *window;
205   int mask;
206   int64_t position;
207 };
208 
209 struct data_block_offsets
210 {
211   int64_t header_size;
212   int64_t start_offset;
213   int64_t end_offset;
214 };
215 
216 struct rar
217 {
218   /* Entries from main RAR header */
219   unsigned main_flags;
220   unsigned long file_crc;
221   char reserved1[2];
222   char reserved2[4];
223   char encryptver;
224 
225   /* File header entries */
226   char compression_method;
227   unsigned file_flags;
228   int64_t packed_size;
229   int64_t unp_size;
230   time_t mtime;
231   long mnsec;
232   mode_t mode;
233   char *filename;
234   char *filename_save;
235   size_t filename_save_size;
236   size_t filename_allocated;
237 
238   /* File header optional entries */
239   char salt[8];
240   time_t atime;
241   long ansec;
242   time_t ctime;
243   long cnsec;
244   time_t arctime;
245   long arcnsec;
246 
247   /* Fields to help with tracking decompression of files. */
248   int64_t bytes_unconsumed;
249   int64_t bytes_remaining;
250   int64_t bytes_uncopied;
251   int64_t offset;
252   int64_t offset_outgoing;
253   int64_t offset_seek;
254   char valid;
255   unsigned int unp_offset;
256   unsigned int unp_buffer_size;
257   unsigned char *unp_buffer;
258   unsigned int dictionary_size;
259   char start_new_block;
260   char entry_eof;
261   unsigned long crc_calculated;
262   int found_first_header;
263   char has_endarc_header;
264   struct data_block_offsets *dbo;
265   unsigned int cursor;
266   unsigned int nodes;
267   char filename_must_match;
268 
269   /* LZSS members */
270   struct huffman_code maincode;
271   struct huffman_code offsetcode;
272   struct huffman_code lowoffsetcode;
273   struct huffman_code lengthcode;
274   unsigned char lengthtable[HUFFMAN_TABLE_SIZE];
275   struct lzss lzss;
276   char output_last_match;
277   unsigned int lastlength;
278   unsigned int lastoffset;
279   unsigned int oldoffset[4];
280   unsigned int lastlowoffset;
281   unsigned int numlowoffsetrepeats;
282   int64_t filterstart;
283   char start_new_table;
284 
285   /* PPMd Variant H members */
286   char ppmd_valid;
287   char ppmd_eod;
288   char is_ppmd_block;
289   int ppmd_escape;
290   CPpmd7 ppmd7_context;
291   CPpmd7z_RangeDec range_dec;
292   IByteIn bytein;
293 
294   /*
295    * String conversion object.
296    */
297   int init_default_conversion;
298   struct archive_string_conv *sconv_default;
299   struct archive_string_conv *opt_sconv;
300   struct archive_string_conv *sconv_utf8;
301   struct archive_string_conv *sconv_utf16be;
302 
303   /*
304    * Bit stream reader.
305    */
306   struct rar_br {
307 #define CACHE_TYPE	uint64_t
308 #define CACHE_BITS	(8 * sizeof(CACHE_TYPE))
309     /* Cache buffer. */
310     CACHE_TYPE		 cache_buffer;
311     /* Indicates how many bits avail in cache_buffer. */
312     int			 cache_avail;
313     ssize_t		 avail_in;
314     const unsigned char *next_in;
315   } br;
316 
317   /*
318    * Custom field to denote that this archive contains encrypted entries
319    */
320   int has_encrypted_entries;
321 };
322 
323 static int archive_read_support_format_rar_capabilities(struct archive_read *);
324 static int archive_read_format_rar_has_encrypted_entries(struct archive_read *);
325 static int archive_read_format_rar_bid(struct archive_read *, int);
326 static int archive_read_format_rar_options(struct archive_read *,
327     const char *, const char *);
328 static int archive_read_format_rar_read_header(struct archive_read *,
329     struct archive_entry *);
330 static int archive_read_format_rar_read_data(struct archive_read *,
331     const void **, size_t *, int64_t *);
332 static int archive_read_format_rar_read_data_skip(struct archive_read *a);
333 static int64_t archive_read_format_rar_seek_data(struct archive_read *, int64_t,
334     int);
335 static int archive_read_format_rar_cleanup(struct archive_read *);
336 
337 /* Support functions */
338 static int read_header(struct archive_read *, struct archive_entry *, char);
339 static time_t get_time(int);
340 static int read_exttime(const char *, struct rar *, const char *);
341 static int read_symlink_stored(struct archive_read *, struct archive_entry *,
342                                struct archive_string_conv *);
343 static int read_data_stored(struct archive_read *, const void **, size_t *,
344                             int64_t *);
345 static int read_data_compressed(struct archive_read *, const void **, size_t *,
346                           int64_t *, size_t);
347 static int rar_br_preparation(struct archive_read *, struct rar_br *);
348 static int parse_codes(struct archive_read *);
349 static void free_codes(struct archive_read *);
350 static int read_next_symbol(struct archive_read *, struct huffman_code *);
351 static int create_code(struct archive_read *, struct huffman_code *,
352                         unsigned char *, int, char);
353 static int add_value(struct archive_read *, struct huffman_code *, int, int,
354                      int);
355 static int new_node(struct huffman_code *);
356 static int make_table(struct archive_read *, struct huffman_code *);
357 static int make_table_recurse(struct archive_read *, struct huffman_code *, int,
358                               struct huffman_table_entry *, int, int);
359 static int64_t expand(struct archive_read *, int64_t);
360 static int copy_from_lzss_window(struct archive_read *, const void **,
361                                    int64_t, int);
362 static const void *rar_read_ahead(struct archive_read *, size_t, ssize_t *);
363 
364 /*
365  * Bit stream reader.
366  */
367 /* Check that the cache buffer has enough bits. */
368 #define rar_br_has(br, n) ((br)->cache_avail >= n)
369 /* Get compressed data by bit. */
370 #define rar_br_bits(br, n)        \
371   (((uint32_t)((br)->cache_buffer >>    \
372     ((br)->cache_avail - (n)))) & cache_masks[n])
373 #define rar_br_bits_forced(br, n)     \
374   (((uint32_t)((br)->cache_buffer <<    \
375     ((n) - (br)->cache_avail))) & cache_masks[n])
376 /* Read ahead to make sure the cache buffer has enough compressed data we
377  * will use.
378  *  True  : completed, there is enough data in the cache buffer.
379  *  False : there is no data in the stream. */
380 #define rar_br_read_ahead(a, br, n) \
381   ((rar_br_has(br, (n)) || rar_br_fillup(a, br)) || rar_br_has(br, (n)))
382 /* Notify how many bits we consumed. */
383 #define rar_br_consume(br, n) ((br)->cache_avail -= (n))
384 #define rar_br_consume_unalined_bits(br) ((br)->cache_avail &= ~7)
385 
386 static const uint32_t cache_masks[] = {
387   0x00000000, 0x00000001, 0x00000003, 0x00000007,
388   0x0000000F, 0x0000001F, 0x0000003F, 0x0000007F,
389   0x000000FF, 0x000001FF, 0x000003FF, 0x000007FF,
390   0x00000FFF, 0x00001FFF, 0x00003FFF, 0x00007FFF,
391   0x0000FFFF, 0x0001FFFF, 0x0003FFFF, 0x0007FFFF,
392   0x000FFFFF, 0x001FFFFF, 0x003FFFFF, 0x007FFFFF,
393   0x00FFFFFF, 0x01FFFFFF, 0x03FFFFFF, 0x07FFFFFF,
394   0x0FFFFFFF, 0x1FFFFFFF, 0x3FFFFFFF, 0x7FFFFFFF,
395   0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
396 };
397 
398 /*
399  * Shift away used bits in the cache data and fill it up with following bits.
400  * Call this when cache buffer does not have enough bits you need.
401  *
402  * Returns 1 if the cache buffer is full.
403  * Returns 0 if the cache buffer is not full; input buffer is empty.
404  */
405 static int
406 rar_br_fillup(struct archive_read *a, struct rar_br *br)
407 {
408   struct rar *rar = (struct rar *)(a->format->data);
409   int n = CACHE_BITS - br->cache_avail;
410 
411   for (;;) {
412     switch (n >> 3) {
413     case 8:
414       if (br->avail_in >= 8) {
415         br->cache_buffer =
416             ((uint64_t)br->next_in[0]) << 56 |
417             ((uint64_t)br->next_in[1]) << 48 |
418             ((uint64_t)br->next_in[2]) << 40 |
419             ((uint64_t)br->next_in[3]) << 32 |
420             ((uint32_t)br->next_in[4]) << 24 |
421             ((uint32_t)br->next_in[5]) << 16 |
422             ((uint32_t)br->next_in[6]) << 8 |
423              (uint32_t)br->next_in[7];
424         br->next_in += 8;
425         br->avail_in -= 8;
426         br->cache_avail += 8 * 8;
427         rar->bytes_unconsumed += 8;
428         rar->bytes_remaining -= 8;
429         return (1);
430       }
431       break;
432     case 7:
433       if (br->avail_in >= 7) {
434         br->cache_buffer =
435            (br->cache_buffer << 56) |
436             ((uint64_t)br->next_in[0]) << 48 |
437             ((uint64_t)br->next_in[1]) << 40 |
438             ((uint64_t)br->next_in[2]) << 32 |
439             ((uint32_t)br->next_in[3]) << 24 |
440             ((uint32_t)br->next_in[4]) << 16 |
441             ((uint32_t)br->next_in[5]) << 8 |
442              (uint32_t)br->next_in[6];
443         br->next_in += 7;
444         br->avail_in -= 7;
445         br->cache_avail += 7 * 8;
446         rar->bytes_unconsumed += 7;
447         rar->bytes_remaining -= 7;
448         return (1);
449       }
450       break;
451     case 6:
452       if (br->avail_in >= 6) {
453         br->cache_buffer =
454            (br->cache_buffer << 48) |
455             ((uint64_t)br->next_in[0]) << 40 |
456             ((uint64_t)br->next_in[1]) << 32 |
457             ((uint32_t)br->next_in[2]) << 24 |
458             ((uint32_t)br->next_in[3]) << 16 |
459             ((uint32_t)br->next_in[4]) << 8 |
460              (uint32_t)br->next_in[5];
461         br->next_in += 6;
462         br->avail_in -= 6;
463         br->cache_avail += 6 * 8;
464         rar->bytes_unconsumed += 6;
465         rar->bytes_remaining -= 6;
466         return (1);
467       }
468       break;
469     case 0:
470       /* We have enough compressed data in
471        * the cache buffer.*/
472       return (1);
473     default:
474       break;
475     }
476     if (br->avail_in <= 0) {
477 
478       if (rar->bytes_unconsumed > 0) {
479         /* Consume as much as the decompressor
480          * actually used. */
481         __archive_read_consume(a, rar->bytes_unconsumed);
482         rar->bytes_unconsumed = 0;
483       }
484       br->next_in = rar_read_ahead(a, 1, &(br->avail_in));
485       if (br->next_in == NULL)
486         return (0);
487       if (br->avail_in == 0)
488         return (0);
489     }
490     br->cache_buffer =
491        (br->cache_buffer << 8) | *br->next_in++;
492     br->avail_in--;
493     br->cache_avail += 8;
494     n -= 8;
495     rar->bytes_unconsumed++;
496     rar->bytes_remaining--;
497   }
498 }
499 
500 static int
501 rar_br_preparation(struct archive_read *a, struct rar_br *br)
502 {
503   struct rar *rar = (struct rar *)(a->format->data);
504 
505   if (rar->bytes_remaining > 0) {
506     br->next_in = rar_read_ahead(a, 1, &(br->avail_in));
507     if (br->next_in == NULL) {
508       archive_set_error(&a->archive,
509           ARCHIVE_ERRNO_FILE_FORMAT,
510           "Truncated RAR file data");
511       return (ARCHIVE_FATAL);
512     }
513     if (br->cache_avail == 0)
514       (void)rar_br_fillup(a, br);
515   }
516   return (ARCHIVE_OK);
517 }
518 
519 /* Find last bit set */
520 static inline int
521 rar_fls(unsigned int word)
522 {
523   word |= (word >>  1);
524   word |= (word >>  2);
525   word |= (word >>  4);
526   word |= (word >>  8);
527   word |= (word >> 16);
528   return word - (word >> 1);
529 }
530 
531 /* LZSS functions */
532 static inline int64_t
533 lzss_position(struct lzss *lzss)
534 {
535   return lzss->position;
536 }
537 
538 static inline int
539 lzss_mask(struct lzss *lzss)
540 {
541   return lzss->mask;
542 }
543 
544 static inline int
545 lzss_size(struct lzss *lzss)
546 {
547   return lzss->mask + 1;
548 }
549 
550 static inline int
551 lzss_offset_for_position(struct lzss *lzss, int64_t pos)
552 {
553   return (int)(pos & lzss->mask);
554 }
555 
556 static inline unsigned char *
557 lzss_pointer_for_position(struct lzss *lzss, int64_t pos)
558 {
559   return &lzss->window[lzss_offset_for_position(lzss, pos)];
560 }
561 
562 static inline int
563 lzss_current_offset(struct lzss *lzss)
564 {
565   return lzss_offset_for_position(lzss, lzss->position);
566 }
567 
568 static inline uint8_t *
569 lzss_current_pointer(struct lzss *lzss)
570 {
571   return lzss_pointer_for_position(lzss, lzss->position);
572 }
573 
574 static inline void
575 lzss_emit_literal(struct rar *rar, uint8_t literal)
576 {
577   *lzss_current_pointer(&rar->lzss) = literal;
578   rar->lzss.position++;
579 }
580 
581 static inline void
582 lzss_emit_match(struct rar *rar, int offset, int length)
583 {
584   int dstoffs = lzss_current_offset(&rar->lzss);
585   int srcoffs = (dstoffs - offset) & lzss_mask(&rar->lzss);
586   int l, li, remaining;
587   unsigned char *d, *s;
588 
589   remaining = length;
590   while (remaining > 0) {
591     l = remaining;
592     if (dstoffs > srcoffs) {
593       if (l > lzss_size(&rar->lzss) - dstoffs)
594         l = lzss_size(&rar->lzss) - dstoffs;
595     } else {
596       if (l > lzss_size(&rar->lzss) - srcoffs)
597         l = lzss_size(&rar->lzss) - srcoffs;
598     }
599     d = &(rar->lzss.window[dstoffs]);
600     s = &(rar->lzss.window[srcoffs]);
601     if ((dstoffs + l < srcoffs) || (srcoffs + l < dstoffs))
602       memcpy(d, s, l);
603     else {
604       for (li = 0; li < l; li++)
605         d[li] = s[li];
606     }
607     remaining -= l;
608     dstoffs = (dstoffs + l) & lzss_mask(&(rar->lzss));
609     srcoffs = (srcoffs + l) & lzss_mask(&(rar->lzss));
610   }
611   rar->lzss.position += length;
612 }
613 
614 static Byte
615 ppmd_read(void *p)
616 {
617   struct archive_read *a = ((IByteIn*)p)->a;
618   struct rar *rar = (struct rar *)(a->format->data);
619   struct rar_br *br = &(rar->br);
620   Byte b;
621   if (!rar_br_read_ahead(a, br, 8))
622   {
623     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
624                       "Truncated RAR file data");
625     rar->valid = 0;
626     return 0;
627   }
628   b = rar_br_bits(br, 8);
629   rar_br_consume(br, 8);
630   return b;
631 }
632 
633 int
634 archive_read_support_format_rar(struct archive *_a)
635 {
636   struct archive_read *a = (struct archive_read *)_a;
637   struct rar *rar;
638   int r;
639 
640   archive_check_magic(_a, ARCHIVE_READ_MAGIC, ARCHIVE_STATE_NEW,
641                       "archive_read_support_format_rar");
642 
643   rar = (struct rar *)calloc(sizeof(*rar), 1);
644   if (rar == NULL)
645   {
646     archive_set_error(&a->archive, ENOMEM, "Can't allocate rar data");
647     return (ARCHIVE_FATAL);
648   }
649 
650 	/*
651 	 * Until enough data has been read, we cannot tell about
652 	 * any encrypted entries yet.
653 	 */
654 	rar->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
655 
656   r = __archive_read_register_format(a,
657                                      rar,
658                                      "rar",
659                                      archive_read_format_rar_bid,
660                                      archive_read_format_rar_options,
661                                      archive_read_format_rar_read_header,
662                                      archive_read_format_rar_read_data,
663                                      archive_read_format_rar_read_data_skip,
664                                      archive_read_format_rar_seek_data,
665                                      archive_read_format_rar_cleanup,
666                                      archive_read_support_format_rar_capabilities,
667                                      archive_read_format_rar_has_encrypted_entries);
668 
669   if (r != ARCHIVE_OK)
670     free(rar);
671   return (r);
672 }
673 
674 static int
675 archive_read_support_format_rar_capabilities(struct archive_read * a)
676 {
677 	(void)a; /* UNUSED */
678 	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA
679 			| ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
680 }
681 
682 static int
683 archive_read_format_rar_has_encrypted_entries(struct archive_read *_a)
684 {
685 	if (_a && _a->format) {
686 		struct rar * rar = (struct rar *)_a->format->data;
687 		if (rar) {
688 			return rar->has_encrypted_entries;
689 		}
690 	}
691 	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
692 }
693 
694 
695 static int
696 archive_read_format_rar_bid(struct archive_read *a, int best_bid)
697 {
698   const char *p;
699 
700   /* If there's already a bid > 30, we'll never win. */
701   if (best_bid > 30)
702 	  return (-1);
703 
704   if ((p = __archive_read_ahead(a, 7, NULL)) == NULL)
705     return (-1);
706 
707   if (memcmp(p, RAR_SIGNATURE, 7) == 0)
708     return (30);
709 
710   if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
711     /* This is a PE file */
712     ssize_t offset = 0x10000;
713     ssize_t window = 4096;
714     ssize_t bytes_avail;
715     while (offset + window <= (1024 * 128)) {
716       const char *buff = __archive_read_ahead(a, offset + window, &bytes_avail);
717       if (buff == NULL) {
718         /* Remaining bytes are less than window. */
719         window >>= 1;
720         if (window < 0x40)
721           return (0);
722         continue;
723       }
724       p = buff + offset;
725       while (p + 7 < buff + bytes_avail) {
726         if (memcmp(p, RAR_SIGNATURE, 7) == 0)
727           return (30);
728         p += 0x10;
729       }
730       offset = p - buff;
731     }
732   }
733   return (0);
734 }
735 
736 static int
737 skip_sfx(struct archive_read *a)
738 {
739   const void *h;
740   const char *p, *q;
741   size_t skip, total;
742   ssize_t bytes, window;
743 
744   total = 0;
745   window = 4096;
746   while (total + window <= (1024 * 128)) {
747     h = __archive_read_ahead(a, window, &bytes);
748     if (h == NULL) {
749       /* Remaining bytes are less than window. */
750       window >>= 1;
751       if (window < 0x40)
752       	goto fatal;
753       continue;
754     }
755     if (bytes < 0x40)
756       goto fatal;
757     p = h;
758     q = p + bytes;
759 
760     /*
761      * Scan ahead until we find something that looks
762      * like the RAR header.
763      */
764     while (p + 7 < q) {
765       if (memcmp(p, RAR_SIGNATURE, 7) == 0) {
766       	skip = p - (const char *)h;
767       	__archive_read_consume(a, skip);
768       	return (ARCHIVE_OK);
769       }
770       p += 0x10;
771     }
772     skip = p - (const char *)h;
773     __archive_read_consume(a, skip);
774 	total += skip;
775   }
776 fatal:
777   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
778       "Couldn't find out RAR header");
779   return (ARCHIVE_FATAL);
780 }
781 
782 static int
783 archive_read_format_rar_options(struct archive_read *a,
784     const char *key, const char *val)
785 {
786   struct rar *rar;
787   int ret = ARCHIVE_FAILED;
788 
789   rar = (struct rar *)(a->format->data);
790   if (strcmp(key, "hdrcharset")  == 0) {
791     if (val == NULL || val[0] == 0)
792       archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
793           "rar: hdrcharset option needs a character-set name");
794     else {
795       rar->opt_sconv =
796           archive_string_conversion_from_charset(
797               &a->archive, val, 0);
798       if (rar->opt_sconv != NULL)
799         ret = ARCHIVE_OK;
800       else
801         ret = ARCHIVE_FATAL;
802     }
803     return (ret);
804   }
805 
806   /* Note: The "warn" return is just to inform the options
807    * supervisor that we didn't handle it.  It will generate
808    * a suitable error if no one used this option. */
809   return (ARCHIVE_WARN);
810 }
811 
812 static int
813 archive_read_format_rar_read_header(struct archive_read *a,
814                                     struct archive_entry *entry)
815 {
816   const void *h;
817   const char *p;
818   struct rar *rar;
819   size_t skip;
820   char head_type;
821   int ret;
822   unsigned flags;
823   unsigned long crc32_expected;
824 
825   a->archive.archive_format = ARCHIVE_FORMAT_RAR;
826   if (a->archive.archive_format_name == NULL)
827     a->archive.archive_format_name = "RAR";
828 
829   rar = (struct rar *)(a->format->data);
830 
831   /*
832    * It should be sufficient to call archive_read_next_header() for
833    * a reader to determine if an entry is encrypted or not. If the
834    * encryption of an entry is only detectable when calling
835    * archive_read_data(), so be it. We'll do the same check there
836    * as well.
837    */
838   if (rar->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
839 	  rar->has_encrypted_entries = 0;
840   }
841 
842   /* RAR files can be generated without EOF headers, so return ARCHIVE_EOF if
843   * this fails.
844   */
845   if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
846     return (ARCHIVE_EOF);
847 
848   p = h;
849   if (rar->found_first_header == 0 &&
850      ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0)) {
851     /* This is an executable ? Must be self-extracting... */
852     ret = skip_sfx(a);
853     if (ret < ARCHIVE_WARN)
854       return (ret);
855   }
856   rar->found_first_header = 1;
857 
858   while (1)
859   {
860     unsigned long crc32_val;
861 
862     if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
863       return (ARCHIVE_FATAL);
864     p = h;
865 
866     head_type = p[2];
867     switch(head_type)
868     {
869     case MARK_HEAD:
870       if (memcmp(p, RAR_SIGNATURE, 7) != 0) {
871         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
872           "Invalid marker header");
873         return (ARCHIVE_FATAL);
874       }
875       __archive_read_consume(a, 7);
876       break;
877 
878     case MAIN_HEAD:
879       rar->main_flags = archive_le16dec(p + 3);
880       skip = archive_le16dec(p + 5);
881       if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)) {
882         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
883           "Invalid header size");
884         return (ARCHIVE_FATAL);
885       }
886       if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
887         return (ARCHIVE_FATAL);
888       p = h;
889       memcpy(rar->reserved1, p + 7, sizeof(rar->reserved1));
890       memcpy(rar->reserved2, p + 7 + sizeof(rar->reserved1),
891              sizeof(rar->reserved2));
892       if (rar->main_flags & MHD_ENCRYPTVER) {
893         if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)+1) {
894           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
895             "Invalid header size");
896           return (ARCHIVE_FATAL);
897         }
898         rar->encryptver = *(p + 7 + sizeof(rar->reserved1) +
899                             sizeof(rar->reserved2));
900       }
901 
902       /* Main header is password encrypted, so we cannot read any
903          file names or any other info about files from the header. */
904       if (rar->main_flags & MHD_PASSWORD)
905       {
906         archive_entry_set_is_metadata_encrypted(entry, 1);
907         archive_entry_set_is_data_encrypted(entry, 1);
908         rar->has_encrypted_entries = 1;
909          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
910                           "RAR encryption support unavailable.");
911         return (ARCHIVE_FATAL);
912       }
913 
914       crc32_val = crc32(0, (const unsigned char *)p + 2, (unsigned)skip - 2);
915       if ((crc32_val & 0xffff) != archive_le16dec(p)) {
916         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
917           "Header CRC error");
918         return (ARCHIVE_FATAL);
919       }
920       __archive_read_consume(a, skip);
921       break;
922 
923     case FILE_HEAD:
924       return read_header(a, entry, head_type);
925 
926     case COMM_HEAD:
927     case AV_HEAD:
928     case SUB_HEAD:
929     case PROTECT_HEAD:
930     case SIGN_HEAD:
931     case ENDARC_HEAD:
932       flags = archive_le16dec(p + 3);
933       skip = archive_le16dec(p + 5);
934       if (skip < 7) {
935         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
936           "Invalid header size too small");
937         return (ARCHIVE_FATAL);
938       }
939       if (flags & HD_ADD_SIZE_PRESENT)
940       {
941         if (skip < 7 + 4) {
942           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
943             "Invalid header size too small");
944           return (ARCHIVE_FATAL);
945         }
946         if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
947           return (ARCHIVE_FATAL);
948         p = h;
949         skip += archive_le32dec(p + 7);
950       }
951 
952       /* Skip over the 2-byte CRC at the beginning of the header. */
953       crc32_expected = archive_le16dec(p);
954       __archive_read_consume(a, 2);
955       skip -= 2;
956 
957       /* Skim the entire header and compute the CRC. */
958       crc32_val = 0;
959       while (skip > 0) {
960 	      size_t to_read = skip;
961 	      if (to_read > 32 * 1024)
962 		      to_read = 32 * 1024;
963 	      if ((h = __archive_read_ahead(a, to_read, NULL)) == NULL) {
964 		      archive_set_error(&a->archive,  ARCHIVE_ERRNO_FILE_FORMAT,
965 			  "Bad RAR file");
966 		      return (ARCHIVE_FATAL);
967 	      }
968 	      p = h;
969 	      crc32_val = crc32(crc32_val, (const unsigned char *)p, to_read);
970 	      __archive_read_consume(a, to_read);
971 	      skip -= to_read;
972       }
973       if ((crc32_val & 0xffff) != crc32_expected) {
974 	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
975 		  "Header CRC error");
976 	      return (ARCHIVE_FATAL);
977       }
978       if (head_type == ENDARC_HEAD)
979 	      return (ARCHIVE_EOF);
980       break;
981 
982     case NEWSUB_HEAD:
983       if ((ret = read_header(a, entry, head_type)) < ARCHIVE_WARN)
984         return ret;
985       break;
986 
987     default:
988       archive_set_error(&a->archive,  ARCHIVE_ERRNO_FILE_FORMAT,
989                         "Bad RAR file");
990       return (ARCHIVE_FATAL);
991     }
992   }
993 }
994 
995 static int
996 archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
997                                   size_t *size, int64_t *offset)
998 {
999   struct rar *rar = (struct rar *)(a->format->data);
1000   int ret;
1001 
1002   if (rar->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
1003 	  rar->has_encrypted_entries = 0;
1004   }
1005 
1006   if (rar->bytes_unconsumed > 0) {
1007       /* Consume as much as the decompressor actually used. */
1008       __archive_read_consume(a, rar->bytes_unconsumed);
1009       rar->bytes_unconsumed = 0;
1010   }
1011 
1012   *buff = NULL;
1013   if (rar->entry_eof || rar->offset_seek >= rar->unp_size) {
1014     *size = 0;
1015     *offset = rar->offset;
1016     if (*offset < rar->unp_size)
1017       *offset = rar->unp_size;
1018     return (ARCHIVE_EOF);
1019   }
1020 
1021   switch (rar->compression_method)
1022   {
1023   case COMPRESS_METHOD_STORE:
1024     ret = read_data_stored(a, buff, size, offset);
1025     break;
1026 
1027   case COMPRESS_METHOD_FASTEST:
1028   case COMPRESS_METHOD_FAST:
1029   case COMPRESS_METHOD_NORMAL:
1030   case COMPRESS_METHOD_GOOD:
1031   case COMPRESS_METHOD_BEST:
1032     ret = read_data_compressed(a, buff, size, offset, 0);
1033     if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
1034       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1035       rar->start_new_table = 1;
1036       rar->ppmd_valid = 0;
1037     }
1038     break;
1039 
1040   default:
1041     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1042                       "Unsupported compression method for RAR file.");
1043     ret = ARCHIVE_FATAL;
1044     break;
1045   }
1046   return (ret);
1047 }
1048 
1049 static int
1050 archive_read_format_rar_read_data_skip(struct archive_read *a)
1051 {
1052   struct rar *rar;
1053   int64_t bytes_skipped;
1054   int ret;
1055 
1056   rar = (struct rar *)(a->format->data);
1057 
1058   if (rar->bytes_unconsumed > 0) {
1059       /* Consume as much as the decompressor actually used. */
1060       __archive_read_consume(a, rar->bytes_unconsumed);
1061       rar->bytes_unconsumed = 0;
1062   }
1063 
1064   if (rar->bytes_remaining > 0) {
1065     bytes_skipped = __archive_read_consume(a, rar->bytes_remaining);
1066     if (bytes_skipped < 0)
1067       return (ARCHIVE_FATAL);
1068   }
1069 
1070   /* Compressed data to skip must be read from each header in a multivolume
1071    * archive.
1072    */
1073   if (rar->main_flags & MHD_VOLUME && rar->file_flags & FHD_SPLIT_AFTER)
1074   {
1075     ret = archive_read_format_rar_read_header(a, a->entry);
1076     if (ret == (ARCHIVE_EOF))
1077       ret = archive_read_format_rar_read_header(a, a->entry);
1078     if (ret != (ARCHIVE_OK))
1079       return ret;
1080     return archive_read_format_rar_read_data_skip(a);
1081   }
1082 
1083   return (ARCHIVE_OK);
1084 }
1085 
1086 static int64_t
1087 archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
1088     int whence)
1089 {
1090   int64_t client_offset, ret;
1091   unsigned int i;
1092   struct rar *rar = (struct rar *)(a->format->data);
1093 
1094   if (rar->compression_method == COMPRESS_METHOD_STORE)
1095   {
1096     /* Modify the offset for use with SEEK_SET */
1097     switch (whence)
1098     {
1099       case SEEK_CUR:
1100         client_offset = rar->offset_seek;
1101         break;
1102       case SEEK_END:
1103         client_offset = rar->unp_size;
1104         break;
1105       case SEEK_SET:
1106       default:
1107         client_offset = 0;
1108     }
1109     client_offset += offset;
1110     if (client_offset < 0)
1111     {
1112       /* Can't seek past beginning of data block */
1113       return -1;
1114     }
1115     else if (client_offset > rar->unp_size)
1116     {
1117       /*
1118        * Set the returned offset but only seek to the end of
1119        * the data block.
1120        */
1121       rar->offset_seek = client_offset;
1122       client_offset = rar->unp_size;
1123     }
1124 
1125     client_offset += rar->dbo[0].start_offset;
1126     i = 0;
1127     while (i < rar->cursor)
1128     {
1129       i++;
1130       client_offset += rar->dbo[i].start_offset - rar->dbo[i-1].end_offset;
1131     }
1132     if (rar->main_flags & MHD_VOLUME)
1133     {
1134       /* Find the appropriate offset among the multivolume archive */
1135       while (1)
1136       {
1137         if (client_offset < rar->dbo[rar->cursor].start_offset &&
1138           rar->file_flags & FHD_SPLIT_BEFORE)
1139         {
1140           /* Search backwards for the correct data block */
1141           if (rar->cursor == 0)
1142           {
1143             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1144               "Attempt to seek past beginning of RAR data block");
1145             return (ARCHIVE_FAILED);
1146           }
1147           rar->cursor--;
1148           client_offset -= rar->dbo[rar->cursor+1].start_offset -
1149             rar->dbo[rar->cursor].end_offset;
1150           if (client_offset < rar->dbo[rar->cursor].start_offset)
1151             continue;
1152           ret = __archive_read_seek(a, rar->dbo[rar->cursor].start_offset -
1153             rar->dbo[rar->cursor].header_size, SEEK_SET);
1154           if (ret < (ARCHIVE_OK))
1155             return ret;
1156           ret = archive_read_format_rar_read_header(a, a->entry);
1157           if (ret != (ARCHIVE_OK))
1158           {
1159             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1160               "Error during seek of RAR file");
1161             return (ARCHIVE_FAILED);
1162           }
1163           rar->cursor--;
1164           break;
1165         }
1166         else if (client_offset > rar->dbo[rar->cursor].end_offset &&
1167           rar->file_flags & FHD_SPLIT_AFTER)
1168         {
1169           /* Search forward for the correct data block */
1170           rar->cursor++;
1171           if (rar->cursor < rar->nodes &&
1172             client_offset > rar->dbo[rar->cursor].end_offset)
1173           {
1174             client_offset += rar->dbo[rar->cursor].start_offset -
1175               rar->dbo[rar->cursor-1].end_offset;
1176             continue;
1177           }
1178           rar->cursor--;
1179           ret = __archive_read_seek(a, rar->dbo[rar->cursor].end_offset,
1180                                     SEEK_SET);
1181           if (ret < (ARCHIVE_OK))
1182             return ret;
1183           ret = archive_read_format_rar_read_header(a, a->entry);
1184           if (ret == (ARCHIVE_EOF))
1185           {
1186             rar->has_endarc_header = 1;
1187             ret = archive_read_format_rar_read_header(a, a->entry);
1188           }
1189           if (ret != (ARCHIVE_OK))
1190           {
1191             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1192               "Error during seek of RAR file");
1193             return (ARCHIVE_FAILED);
1194           }
1195           client_offset += rar->dbo[rar->cursor].start_offset -
1196             rar->dbo[rar->cursor-1].end_offset;
1197           continue;
1198         }
1199         break;
1200       }
1201     }
1202 
1203     ret = __archive_read_seek(a, client_offset, SEEK_SET);
1204     if (ret < (ARCHIVE_OK))
1205       return ret;
1206     rar->bytes_remaining = rar->dbo[rar->cursor].end_offset - ret;
1207     i = rar->cursor;
1208     while (i > 0)
1209     {
1210       i--;
1211       ret -= rar->dbo[i+1].start_offset - rar->dbo[i].end_offset;
1212     }
1213     ret -= rar->dbo[0].start_offset;
1214 
1215     /* Always restart reading the file after a seek */
1216     __archive_reset_read_data(&a->archive);
1217 
1218     rar->bytes_unconsumed = 0;
1219     rar->offset = 0;
1220 
1221     /*
1222      * If a seek past the end of file was requested, return the requested
1223      * offset.
1224      */
1225     if (ret == rar->unp_size && rar->offset_seek > rar->unp_size)
1226       return rar->offset_seek;
1227 
1228     /* Return the new offset */
1229     rar->offset_seek = ret;
1230     return rar->offset_seek;
1231   }
1232   else
1233   {
1234     archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1235       "Seeking of compressed RAR files is unsupported");
1236   }
1237   return (ARCHIVE_FAILED);
1238 }
1239 
1240 static int
1241 archive_read_format_rar_cleanup(struct archive_read *a)
1242 {
1243   struct rar *rar;
1244 
1245   rar = (struct rar *)(a->format->data);
1246   free_codes(a);
1247   free(rar->filename);
1248   free(rar->filename_save);
1249   free(rar->dbo);
1250   free(rar->unp_buffer);
1251   free(rar->lzss.window);
1252   __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1253   free(rar);
1254   (a->format->data) = NULL;
1255   return (ARCHIVE_OK);
1256 }
1257 
1258 static int
1259 read_header(struct archive_read *a, struct archive_entry *entry,
1260             char head_type)
1261 {
1262   const void *h;
1263   const char *p, *endp;
1264   struct rar *rar;
1265   struct rar_header rar_header;
1266   struct rar_file_header file_header;
1267   int64_t header_size;
1268   unsigned filename_size, end;
1269   char *filename;
1270   char *strp;
1271   char packed_size[8];
1272   char unp_size[8];
1273   int ttime;
1274   struct archive_string_conv *sconv, *fn_sconv;
1275   unsigned long crc32_val;
1276   int ret = (ARCHIVE_OK), ret2;
1277 
1278   rar = (struct rar *)(a->format->data);
1279 
1280   /* Setup a string conversion object for non-rar-unicode filenames. */
1281   sconv = rar->opt_sconv;
1282   if (sconv == NULL) {
1283     if (!rar->init_default_conversion) {
1284       rar->sconv_default =
1285           archive_string_default_conversion_for_read(
1286             &(a->archive));
1287       rar->init_default_conversion = 1;
1288     }
1289     sconv = rar->sconv_default;
1290   }
1291 
1292 
1293   if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
1294     return (ARCHIVE_FATAL);
1295   p = h;
1296   memcpy(&rar_header, p, sizeof(rar_header));
1297   rar->file_flags = archive_le16dec(rar_header.flags);
1298   header_size = archive_le16dec(rar_header.size);
1299   if (header_size < (int64_t)sizeof(file_header) + 7) {
1300     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1301       "Invalid header size");
1302     return (ARCHIVE_FATAL);
1303   }
1304   crc32_val = crc32(0, (const unsigned char *)p + 2, 7 - 2);
1305   __archive_read_consume(a, 7);
1306 
1307   if (!(rar->file_flags & FHD_SOLID))
1308   {
1309     rar->compression_method = 0;
1310     rar->packed_size = 0;
1311     rar->unp_size = 0;
1312     rar->mtime = 0;
1313     rar->ctime = 0;
1314     rar->atime = 0;
1315     rar->arctime = 0;
1316     rar->mode = 0;
1317     memset(&rar->salt, 0, sizeof(rar->salt));
1318     rar->atime = 0;
1319     rar->ansec = 0;
1320     rar->ctime = 0;
1321     rar->cnsec = 0;
1322     rar->mtime = 0;
1323     rar->mnsec = 0;
1324     rar->arctime = 0;
1325     rar->arcnsec = 0;
1326   }
1327   else
1328   {
1329     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1330                       "RAR solid archive support unavailable.");
1331     return (ARCHIVE_FATAL);
1332   }
1333 
1334   if ((h = __archive_read_ahead(a, (size_t)header_size - 7, NULL)) == NULL)
1335     return (ARCHIVE_FATAL);
1336 
1337   /* File Header CRC check. */
1338   crc32_val = crc32(crc32_val, h, (unsigned)(header_size - 7));
1339   if ((crc32_val & 0xffff) != archive_le16dec(rar_header.crc)) {
1340     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1341       "Header CRC error");
1342     return (ARCHIVE_FATAL);
1343   }
1344   /* If no CRC error, Go on parsing File Header. */
1345   p = h;
1346   endp = p + header_size - 7;
1347   memcpy(&file_header, p, sizeof(file_header));
1348   p += sizeof(file_header);
1349 
1350   rar->compression_method = file_header.method;
1351 
1352   ttime = archive_le32dec(file_header.file_time);
1353   rar->mtime = get_time(ttime);
1354 
1355   rar->file_crc = archive_le32dec(file_header.file_crc);
1356 
1357   if (rar->file_flags & FHD_PASSWORD)
1358   {
1359 	archive_entry_set_is_data_encrypted(entry, 1);
1360 	rar->has_encrypted_entries = 1;
1361     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1362                       "RAR encryption support unavailable.");
1363     /* Since it is only the data part itself that is encrypted we can at least
1364        extract information about the currently processed entry and don't need
1365        to return ARCHIVE_FATAL here. */
1366     /*return (ARCHIVE_FATAL);*/
1367   }
1368 
1369   if (rar->file_flags & FHD_LARGE)
1370   {
1371     memcpy(packed_size, file_header.pack_size, 4);
1372     memcpy(packed_size + 4, p, 4); /* High pack size */
1373     p += 4;
1374     memcpy(unp_size, file_header.unp_size, 4);
1375     memcpy(unp_size + 4, p, 4); /* High unpack size */
1376     p += 4;
1377     rar->packed_size = archive_le64dec(&packed_size);
1378     rar->unp_size = archive_le64dec(&unp_size);
1379   }
1380   else
1381   {
1382     rar->packed_size = archive_le32dec(file_header.pack_size);
1383     rar->unp_size = archive_le32dec(file_header.unp_size);
1384   }
1385 
1386   if (rar->packed_size < 0 || rar->unp_size < 0)
1387   {
1388     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1389                       "Invalid sizes specified.");
1390     return (ARCHIVE_FATAL);
1391   }
1392 
1393   rar->bytes_remaining = rar->packed_size;
1394 
1395   /* TODO: RARv3 subblocks contain comments. For now the complete block is
1396    * consumed at the end.
1397    */
1398   if (head_type == NEWSUB_HEAD) {
1399     size_t distance = p - (const char *)h;
1400     header_size += rar->packed_size;
1401     /* Make sure we have the extended data. */
1402     if ((h = __archive_read_ahead(a, (size_t)header_size - 7, NULL)) == NULL)
1403         return (ARCHIVE_FATAL);
1404     p = h;
1405     endp = p + header_size - 7;
1406     p += distance;
1407   }
1408 
1409   filename_size = archive_le16dec(file_header.name_size);
1410   if (p + filename_size > endp) {
1411     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1412       "Invalid filename size");
1413     return (ARCHIVE_FATAL);
1414   }
1415   if (rar->filename_allocated < filename_size * 2 + 2) {
1416     char *newptr;
1417     size_t newsize = filename_size * 2 + 2;
1418     newptr = realloc(rar->filename, newsize);
1419     if (newptr == NULL) {
1420       archive_set_error(&a->archive, ENOMEM,
1421                         "Couldn't allocate memory.");
1422       return (ARCHIVE_FATAL);
1423     }
1424     rar->filename = newptr;
1425     rar->filename_allocated = newsize;
1426   }
1427   filename = rar->filename;
1428   memcpy(filename, p, filename_size);
1429   filename[filename_size] = '\0';
1430   if (rar->file_flags & FHD_UNICODE)
1431   {
1432     if (filename_size != strlen(filename))
1433     {
1434       unsigned char highbyte, flagbits, flagbyte;
1435       unsigned fn_end, offset;
1436 
1437       end = filename_size;
1438       fn_end = filename_size * 2;
1439       filename_size = 0;
1440       offset = (unsigned)strlen(filename) + 1;
1441       highbyte = *(p + offset++);
1442       flagbits = 0;
1443       flagbyte = 0;
1444       while (offset < end && filename_size < fn_end)
1445       {
1446         if (!flagbits)
1447         {
1448           flagbyte = *(p + offset++);
1449           flagbits = 8;
1450         }
1451 
1452         flagbits -= 2;
1453         switch((flagbyte >> flagbits) & 3)
1454         {
1455           case 0:
1456             filename[filename_size++] = '\0';
1457             filename[filename_size++] = *(p + offset++);
1458             break;
1459           case 1:
1460             filename[filename_size++] = highbyte;
1461             filename[filename_size++] = *(p + offset++);
1462             break;
1463           case 2:
1464             filename[filename_size++] = *(p + offset + 1);
1465             filename[filename_size++] = *(p + offset);
1466             offset += 2;
1467             break;
1468           case 3:
1469           {
1470             char extra, high;
1471             uint8_t length = *(p + offset++);
1472 
1473             if (length & 0x80) {
1474               extra = *(p + offset++);
1475               high = (char)highbyte;
1476             } else
1477               extra = high = 0;
1478             length = (length & 0x7f) + 2;
1479             while (length && filename_size < fn_end) {
1480               unsigned cp = filename_size >> 1;
1481               filename[filename_size++] = high;
1482               filename[filename_size++] = p[cp] + extra;
1483               length--;
1484             }
1485           }
1486           break;
1487         }
1488       }
1489       if (filename_size > fn_end) {
1490         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1491           "Invalid filename");
1492         return (ARCHIVE_FATAL);
1493       }
1494       filename[filename_size++] = '\0';
1495       /*
1496        * Do not increment filename_size here as the computations below
1497        * add the space for the terminating NUL explicitly.
1498        */
1499       filename[filename_size] = '\0';
1500 
1501       /* Decoded unicode form is UTF-16BE, so we have to update a string
1502        * conversion object for it. */
1503       if (rar->sconv_utf16be == NULL) {
1504         rar->sconv_utf16be = archive_string_conversion_from_charset(
1505            &a->archive, "UTF-16BE", 1);
1506         if (rar->sconv_utf16be == NULL)
1507           return (ARCHIVE_FATAL);
1508       }
1509       fn_sconv = rar->sconv_utf16be;
1510 
1511       strp = filename;
1512       while (memcmp(strp, "\x00\x00", 2))
1513       {
1514         if (!memcmp(strp, "\x00\\", 2))
1515           *(strp + 1) = '/';
1516         strp += 2;
1517       }
1518       p += offset;
1519     } else {
1520       /*
1521        * If FHD_UNICODE is set but no unicode data, this file name form
1522        * is UTF-8, so we have to update a string conversion object for
1523        * it accordingly.
1524        */
1525       if (rar->sconv_utf8 == NULL) {
1526         rar->sconv_utf8 = archive_string_conversion_from_charset(
1527            &a->archive, "UTF-8", 1);
1528         if (rar->sconv_utf8 == NULL)
1529           return (ARCHIVE_FATAL);
1530       }
1531       fn_sconv = rar->sconv_utf8;
1532       while ((strp = strchr(filename, '\\')) != NULL)
1533         *strp = '/';
1534       p += filename_size;
1535     }
1536   }
1537   else
1538   {
1539     fn_sconv = sconv;
1540     while ((strp = strchr(filename, '\\')) != NULL)
1541       *strp = '/';
1542     p += filename_size;
1543   }
1544 
1545   /* Split file in multivolume RAR. No more need to process header. */
1546   if (rar->filename_save &&
1547     filename_size == rar->filename_save_size &&
1548     !memcmp(rar->filename, rar->filename_save, filename_size + 1))
1549   {
1550     __archive_read_consume(a, header_size - 7);
1551     rar->cursor++;
1552     if (rar->cursor >= rar->nodes)
1553     {
1554       rar->nodes++;
1555       if ((rar->dbo =
1556         realloc(rar->dbo, sizeof(*rar->dbo) * rar->nodes)) == NULL)
1557       {
1558         archive_set_error(&a->archive, ENOMEM, "Couldn't allocate memory.");
1559         return (ARCHIVE_FATAL);
1560       }
1561       rar->dbo[rar->cursor].header_size = header_size;
1562       rar->dbo[rar->cursor].start_offset = -1;
1563       rar->dbo[rar->cursor].end_offset = -1;
1564     }
1565     if (rar->dbo[rar->cursor].start_offset < 0)
1566     {
1567       rar->dbo[rar->cursor].start_offset = a->filter->position;
1568       rar->dbo[rar->cursor].end_offset = rar->dbo[rar->cursor].start_offset +
1569         rar->packed_size;
1570     }
1571     return ret;
1572   }
1573   else if (rar->filename_must_match)
1574   {
1575     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1576       "Mismatch of file parts split across multi-volume archive");
1577     return (ARCHIVE_FATAL);
1578   }
1579 
1580   rar->filename_save = (char*)realloc(rar->filename_save,
1581                                       filename_size + 1);
1582   memcpy(rar->filename_save, rar->filename, filename_size + 1);
1583   rar->filename_save_size = filename_size;
1584 
1585   /* Set info for seeking */
1586   free(rar->dbo);
1587   if ((rar->dbo = calloc(1, sizeof(*rar->dbo))) == NULL)
1588   {
1589     archive_set_error(&a->archive, ENOMEM, "Couldn't allocate memory.");
1590     return (ARCHIVE_FATAL);
1591   }
1592   rar->dbo[0].header_size = header_size;
1593   rar->dbo[0].start_offset = -1;
1594   rar->dbo[0].end_offset = -1;
1595   rar->cursor = 0;
1596   rar->nodes = 1;
1597 
1598   if (rar->file_flags & FHD_SALT)
1599   {
1600     if (p + 8 > endp) {
1601       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1602         "Invalid header size");
1603       return (ARCHIVE_FATAL);
1604     }
1605     memcpy(rar->salt, p, 8);
1606     p += 8;
1607   }
1608 
1609   if (rar->file_flags & FHD_EXTTIME) {
1610     if (read_exttime(p, rar, endp) < 0) {
1611       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1612         "Invalid header size");
1613       return (ARCHIVE_FATAL);
1614     }
1615   }
1616 
1617   __archive_read_consume(a, header_size - 7);
1618   rar->dbo[0].start_offset = a->filter->position;
1619   rar->dbo[0].end_offset = rar->dbo[0].start_offset + rar->packed_size;
1620 
1621   switch(file_header.host_os)
1622   {
1623   case OS_MSDOS:
1624   case OS_OS2:
1625   case OS_WIN32:
1626     rar->mode = archive_le32dec(file_header.file_attr);
1627     if (rar->mode & FILE_ATTRIBUTE_DIRECTORY)
1628       rar->mode = AE_IFDIR | S_IXUSR | S_IXGRP | S_IXOTH;
1629     else
1630       rar->mode = AE_IFREG;
1631     rar->mode |= S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
1632     break;
1633 
1634   case OS_UNIX:
1635   case OS_MAC_OS:
1636   case OS_BEOS:
1637     rar->mode = archive_le32dec(file_header.file_attr);
1638     break;
1639 
1640   default:
1641     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1642                       "Unknown file attributes from RAR file's host OS");
1643     return (ARCHIVE_FATAL);
1644   }
1645 
1646   rar->bytes_uncopied = rar->bytes_unconsumed = 0;
1647   rar->lzss.position = rar->offset = 0;
1648   rar->offset_seek = 0;
1649   rar->dictionary_size = 0;
1650   rar->offset_outgoing = 0;
1651   rar->br.cache_avail = 0;
1652   rar->br.avail_in = 0;
1653   rar->crc_calculated = 0;
1654   rar->entry_eof = 0;
1655   rar->valid = 1;
1656   rar->is_ppmd_block = 0;
1657   rar->start_new_table = 1;
1658   free(rar->unp_buffer);
1659   rar->unp_buffer = NULL;
1660   rar->unp_offset = 0;
1661   rar->unp_buffer_size = UNP_BUFFER_SIZE;
1662   memset(rar->lengthtable, 0, sizeof(rar->lengthtable));
1663   __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1664   rar->ppmd_valid = rar->ppmd_eod = 0;
1665 
1666   /* Don't set any archive entries for non-file header types */
1667   if (head_type == NEWSUB_HEAD)
1668     return ret;
1669 
1670   archive_entry_set_mtime(entry, rar->mtime, rar->mnsec);
1671   archive_entry_set_ctime(entry, rar->ctime, rar->cnsec);
1672   archive_entry_set_atime(entry, rar->atime, rar->ansec);
1673   archive_entry_set_size(entry, rar->unp_size);
1674   archive_entry_set_mode(entry, rar->mode);
1675 
1676   if (archive_entry_copy_pathname_l(entry, filename, filename_size, fn_sconv))
1677   {
1678     if (errno == ENOMEM)
1679     {
1680       archive_set_error(&a->archive, ENOMEM,
1681                         "Can't allocate memory for Pathname");
1682       return (ARCHIVE_FATAL);
1683     }
1684     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1685                       "Pathname cannot be converted from %s to current locale.",
1686                       archive_string_conversion_charset_name(fn_sconv));
1687     ret = (ARCHIVE_WARN);
1688   }
1689 
1690   if (((rar->mode) & AE_IFMT) == AE_IFLNK)
1691   {
1692     /* Make sure a symbolic-link file does not have its body. */
1693     rar->bytes_remaining = 0;
1694     archive_entry_set_size(entry, 0);
1695 
1696     /* Read a symbolic-link name. */
1697     if ((ret2 = read_symlink_stored(a, entry, sconv)) < (ARCHIVE_WARN))
1698       return ret2;
1699     if (ret > ret2)
1700       ret = ret2;
1701   }
1702 
1703   if (rar->bytes_remaining == 0)
1704     rar->entry_eof = 1;
1705 
1706   return ret;
1707 }
1708 
1709 static time_t
1710 get_time(int ttime)
1711 {
1712   struct tm tm;
1713   tm.tm_sec = 2 * (ttime & 0x1f);
1714   tm.tm_min = (ttime >> 5) & 0x3f;
1715   tm.tm_hour = (ttime >> 11) & 0x1f;
1716   tm.tm_mday = (ttime >> 16) & 0x1f;
1717   tm.tm_mon = ((ttime >> 21) & 0x0f) - 1;
1718   tm.tm_year = ((ttime >> 25) & 0x7f) + 80;
1719   tm.tm_isdst = -1;
1720   return mktime(&tm);
1721 }
1722 
1723 static int
1724 read_exttime(const char *p, struct rar *rar, const char *endp)
1725 {
1726   unsigned rmode, flags, rem, j, count;
1727   int ttime, i;
1728   struct tm *tm;
1729   time_t t;
1730   long nsec;
1731 #if defined(HAVE_LOCALTIME_R) || defined(HAVE__LOCALTIME64_S)
1732   struct tm tmbuf;
1733 #endif
1734 #if defined(HAVE__LOCALTIME64_S)
1735   errno_t terr;
1736   __time64_t tmptime;
1737 #endif
1738 
1739   if (p + 2 > endp)
1740     return (-1);
1741   flags = archive_le16dec(p);
1742   p += 2;
1743 
1744   for (i = 3; i >= 0; i--)
1745   {
1746     t = 0;
1747     if (i == 3)
1748       t = rar->mtime;
1749     rmode = flags >> i * 4;
1750     if (rmode & 8)
1751     {
1752       if (!t)
1753       {
1754         if (p + 4 > endp)
1755           return (-1);
1756         ttime = archive_le32dec(p);
1757         t = get_time(ttime);
1758         p += 4;
1759       }
1760       rem = 0;
1761       count = rmode & 3;
1762       if (p + count > endp)
1763         return (-1);
1764       for (j = 0; j < count; j++)
1765       {
1766         rem = (((unsigned)(unsigned char)*p) << 16) | (rem >> 8);
1767         p++;
1768       }
1769 #if defined(HAVE_LOCALTIME_R)
1770       tm = localtime_r(&t, &tmbuf);
1771 #elif defined(HAVE__LOCALTIME64_S)
1772       tmptime = t;
1773       terr = _localtime64_s(&tmbuf, &tmptime);
1774       if (terr)
1775         tm = NULL;
1776       else
1777         tm = &tmbuf;
1778 #else
1779       tm = localtime(&t);
1780 #endif
1781       nsec = tm->tm_sec + rem / NS_UNIT;
1782       if (rmode & 4)
1783       {
1784         tm->tm_sec++;
1785         t = mktime(tm);
1786       }
1787       if (i == 3)
1788       {
1789         rar->mtime = t;
1790         rar->mnsec = nsec;
1791       }
1792       else if (i == 2)
1793       {
1794         rar->ctime = t;
1795         rar->cnsec = nsec;
1796       }
1797       else if (i == 1)
1798       {
1799         rar->atime = t;
1800         rar->ansec = nsec;
1801       }
1802       else
1803       {
1804         rar->arctime = t;
1805         rar->arcnsec = nsec;
1806       }
1807     }
1808   }
1809   return (0);
1810 }
1811 
1812 static int
1813 read_symlink_stored(struct archive_read *a, struct archive_entry *entry,
1814                     struct archive_string_conv *sconv)
1815 {
1816   const void *h;
1817   const char *p;
1818   struct rar *rar;
1819   int ret = (ARCHIVE_OK);
1820 
1821   rar = (struct rar *)(a->format->data);
1822   if ((h = rar_read_ahead(a, (size_t)rar->packed_size, NULL)) == NULL)
1823     return (ARCHIVE_FATAL);
1824   p = h;
1825 
1826   if (archive_entry_copy_symlink_l(entry,
1827       p, (size_t)rar->packed_size, sconv))
1828   {
1829     if (errno == ENOMEM)
1830     {
1831       archive_set_error(&a->archive, ENOMEM,
1832                         "Can't allocate memory for link");
1833       return (ARCHIVE_FATAL);
1834     }
1835     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1836                       "link cannot be converted from %s to current locale.",
1837                       archive_string_conversion_charset_name(sconv));
1838     ret = (ARCHIVE_WARN);
1839   }
1840   __archive_read_consume(a, rar->packed_size);
1841   return ret;
1842 }
1843 
1844 static int
1845 read_data_stored(struct archive_read *a, const void **buff, size_t *size,
1846                  int64_t *offset)
1847 {
1848   struct rar *rar;
1849   ssize_t bytes_avail;
1850 
1851   rar = (struct rar *)(a->format->data);
1852   if (rar->bytes_remaining == 0 &&
1853     !(rar->main_flags & MHD_VOLUME && rar->file_flags & FHD_SPLIT_AFTER))
1854   {
1855     *buff = NULL;
1856     *size = 0;
1857     *offset = rar->offset;
1858     if (rar->file_crc != rar->crc_calculated) {
1859       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1860                         "File CRC error");
1861       return (ARCHIVE_FATAL);
1862     }
1863     rar->entry_eof = 1;
1864     return (ARCHIVE_EOF);
1865   }
1866 
1867   *buff = rar_read_ahead(a, 1, &bytes_avail);
1868   if (bytes_avail <= 0)
1869   {
1870     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1871                       "Truncated RAR file data");
1872     return (ARCHIVE_FATAL);
1873   }
1874 
1875   *size = bytes_avail;
1876   *offset = rar->offset;
1877   rar->offset += bytes_avail;
1878   rar->offset_seek += bytes_avail;
1879   rar->bytes_remaining -= bytes_avail;
1880   rar->bytes_unconsumed = bytes_avail;
1881   /* Calculate File CRC. */
1882   rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1883     (unsigned)bytes_avail);
1884   return (ARCHIVE_OK);
1885 }
1886 
1887 static int
1888 read_data_compressed(struct archive_read *a, const void **buff, size_t *size,
1889                int64_t *offset, size_t looper)
1890 {
1891   if (looper++ > MAX_COMPRESS_DEPTH)
1892     return (ARCHIVE_FATAL);
1893 
1894   struct rar *rar;
1895   int64_t start, end, actualend;
1896   size_t bs;
1897   int ret = (ARCHIVE_OK), sym, code, lzss_offset, length, i;
1898 
1899   rar = (struct rar *)(a->format->data);
1900 
1901   do {
1902     if (!rar->valid)
1903       return (ARCHIVE_FATAL);
1904     if (rar->ppmd_eod ||
1905        (rar->dictionary_size && rar->offset >= rar->unp_size))
1906     {
1907       if (rar->unp_offset > 0) {
1908         /*
1909          * We have unprocessed extracted data. write it out.
1910          */
1911         *buff = rar->unp_buffer;
1912         *size = rar->unp_offset;
1913         *offset = rar->offset_outgoing;
1914         rar->offset_outgoing += *size;
1915         /* Calculate File CRC. */
1916         rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1917           (unsigned)*size);
1918         rar->unp_offset = 0;
1919         return (ARCHIVE_OK);
1920       }
1921       *buff = NULL;
1922       *size = 0;
1923       *offset = rar->offset;
1924       if (rar->file_crc != rar->crc_calculated) {
1925         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1926                           "File CRC error");
1927         return (ARCHIVE_FATAL);
1928       }
1929       rar->entry_eof = 1;
1930       return (ARCHIVE_EOF);
1931     }
1932 
1933     if (!rar->is_ppmd_block && rar->dictionary_size && rar->bytes_uncopied > 0)
1934     {
1935       if (rar->bytes_uncopied > (rar->unp_buffer_size - rar->unp_offset))
1936         bs = rar->unp_buffer_size - rar->unp_offset;
1937       else
1938         bs = (size_t)rar->bytes_uncopied;
1939       ret = copy_from_lzss_window(a, buff, rar->offset, (int)bs);
1940       if (ret != ARCHIVE_OK)
1941         return (ret);
1942       rar->offset += bs;
1943       rar->bytes_uncopied -= bs;
1944       if (*buff != NULL) {
1945         rar->unp_offset = 0;
1946         *size = rar->unp_buffer_size;
1947         *offset = rar->offset_outgoing;
1948         rar->offset_outgoing += *size;
1949         /* Calculate File CRC. */
1950         rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1951           (unsigned)*size);
1952         return (ret);
1953       }
1954       continue;
1955     }
1956 
1957     if (!rar->br.next_in &&
1958       (ret = rar_br_preparation(a, &(rar->br))) < ARCHIVE_WARN)
1959       return (ret);
1960     if (rar->start_new_table && ((ret = parse_codes(a)) < (ARCHIVE_WARN)))
1961       return (ret);
1962 
1963     if (rar->is_ppmd_block)
1964     {
1965       if ((sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1966         &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1967       {
1968         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1969                           "Invalid symbol");
1970         return (ARCHIVE_FATAL);
1971       }
1972       if(sym != rar->ppmd_escape)
1973       {
1974         lzss_emit_literal(rar, sym);
1975         rar->bytes_uncopied++;
1976       }
1977       else
1978       {
1979         if ((code = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1980           &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1981         {
1982           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1983                             "Invalid symbol");
1984           return (ARCHIVE_FATAL);
1985         }
1986 
1987         switch(code)
1988         {
1989           case 0:
1990             rar->start_new_table = 1;
1991             return read_data_compressed(a, buff, size, offset, looper);
1992 
1993           case 2:
1994             rar->ppmd_eod = 1;/* End Of ppmd Data. */
1995             continue;
1996 
1997           case 3:
1998             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1999                               "Parsing filters is unsupported.");
2000             return (ARCHIVE_FAILED);
2001 
2002           case 4:
2003             lzss_offset = 0;
2004             for (i = 2; i >= 0; i--)
2005             {
2006               if ((code = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
2007                 &rar->ppmd7_context, &rar->range_dec.p)) < 0)
2008               {
2009                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2010                                   "Invalid symbol");
2011                 return (ARCHIVE_FATAL);
2012               }
2013               lzss_offset |= code << (i * 8);
2014             }
2015             if ((length = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
2016               &rar->ppmd7_context, &rar->range_dec.p)) < 0)
2017             {
2018               archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2019                                 "Invalid symbol");
2020               return (ARCHIVE_FATAL);
2021             }
2022             lzss_emit_match(rar, lzss_offset + 2, length + 32);
2023             rar->bytes_uncopied += length + 32;
2024             break;
2025 
2026           case 5:
2027             if ((length = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
2028               &rar->ppmd7_context, &rar->range_dec.p)) < 0)
2029             {
2030               archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2031                                 "Invalid symbol");
2032               return (ARCHIVE_FATAL);
2033             }
2034             lzss_emit_match(rar, 1, length + 4);
2035             rar->bytes_uncopied += length + 4;
2036             break;
2037 
2038          default:
2039            lzss_emit_literal(rar, sym);
2040            rar->bytes_uncopied++;
2041         }
2042       }
2043     }
2044     else
2045     {
2046       start = rar->offset;
2047       end = start + rar->dictionary_size;
2048       rar->filterstart = INT64_MAX;
2049 
2050       if ((actualend = expand(a, end)) < 0)
2051         return ((int)actualend);
2052 
2053       rar->bytes_uncopied = actualend - start;
2054       if (rar->bytes_uncopied == 0) {
2055           /* Broken RAR files cause this case.
2056           * NOTE: If this case were possible on a normal RAR file
2057           * we would find out where it was actually bad and
2058           * what we would do to solve it. */
2059           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2060                             "Internal error extracting RAR file");
2061           return (ARCHIVE_FATAL);
2062       }
2063     }
2064     if (rar->bytes_uncopied > (rar->unp_buffer_size - rar->unp_offset))
2065       bs = rar->unp_buffer_size - rar->unp_offset;
2066     else
2067       bs = (size_t)rar->bytes_uncopied;
2068     ret = copy_from_lzss_window(a, buff, rar->offset, (int)bs);
2069     if (ret != ARCHIVE_OK)
2070       return (ret);
2071     rar->offset += bs;
2072     rar->bytes_uncopied -= bs;
2073     /*
2074      * If *buff is NULL, it means unp_buffer is not full.
2075      * So we have to continue extracting a RAR file.
2076      */
2077   } while (*buff == NULL);
2078 
2079   rar->unp_offset = 0;
2080   *size = rar->unp_buffer_size;
2081   *offset = rar->offset_outgoing;
2082   rar->offset_outgoing += *size;
2083   /* Calculate File CRC. */
2084   rar->crc_calculated = crc32(rar->crc_calculated, *buff, (unsigned)*size);
2085   return ret;
2086 }
2087 
2088 static int
2089 parse_codes(struct archive_read *a)
2090 {
2091   int i, j, val, n, r;
2092   unsigned char bitlengths[MAX_SYMBOLS], zerocount, ppmd_flags;
2093   unsigned int maxorder;
2094   struct huffman_code precode;
2095   struct rar *rar = (struct rar *)(a->format->data);
2096   struct rar_br *br = &(rar->br);
2097 
2098   free_codes(a);
2099 
2100   /* Skip to the next byte */
2101   rar_br_consume_unalined_bits(br);
2102 
2103   /* PPMd block flag */
2104   if (!rar_br_read_ahead(a, br, 1))
2105     goto truncated_data;
2106   if ((rar->is_ppmd_block = rar_br_bits(br, 1)) != 0)
2107   {
2108     rar_br_consume(br, 1);
2109     if (!rar_br_read_ahead(a, br, 7))
2110       goto truncated_data;
2111     ppmd_flags = rar_br_bits(br, 7);
2112     rar_br_consume(br, 7);
2113 
2114     /* Memory is allocated in MB */
2115     if (ppmd_flags & 0x20)
2116     {
2117       if (!rar_br_read_ahead(a, br, 8))
2118         goto truncated_data;
2119       rar->dictionary_size = (rar_br_bits(br, 8) + 1) << 20;
2120       rar_br_consume(br, 8);
2121     }
2122 
2123     if (ppmd_flags & 0x40)
2124     {
2125       if (!rar_br_read_ahead(a, br, 8))
2126         goto truncated_data;
2127       rar->ppmd_escape = rar->ppmd7_context.InitEsc = rar_br_bits(br, 8);
2128       rar_br_consume(br, 8);
2129     }
2130     else
2131       rar->ppmd_escape = 2;
2132 
2133     if (ppmd_flags & 0x20)
2134     {
2135       maxorder = (ppmd_flags & 0x1F) + 1;
2136       if(maxorder > 16)
2137         maxorder = 16 + (maxorder - 16) * 3;
2138 
2139       if (maxorder == 1)
2140       {
2141         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2142                           "Truncated RAR file data");
2143         return (ARCHIVE_FATAL);
2144       }
2145 
2146       /* Make sure ppmd7_contest is freed before Ppmd7_Construct
2147        * because reading a broken file cause this abnormal sequence. */
2148       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
2149 
2150       rar->bytein.a = a;
2151       rar->bytein.Read = &ppmd_read;
2152       __archive_ppmd7_functions.PpmdRAR_RangeDec_CreateVTable(&rar->range_dec);
2153       rar->range_dec.Stream = &rar->bytein;
2154       __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);
2155 
2156       if (rar->dictionary_size == 0) {
2157 	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2158                           "Invalid zero dictionary size");
2159 	      return (ARCHIVE_FATAL);
2160       }
2161 
2162       if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,
2163         rar->dictionary_size))
2164       {
2165         archive_set_error(&a->archive, ENOMEM,
2166                           "Out of memory");
2167         return (ARCHIVE_FATAL);
2168       }
2169       if (!__archive_ppmd7_functions.PpmdRAR_RangeDec_Init(&rar->range_dec))
2170       {
2171         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2172                           "Unable to initialize PPMd range decoder");
2173         return (ARCHIVE_FATAL);
2174       }
2175       __archive_ppmd7_functions.Ppmd7_Init(&rar->ppmd7_context, maxorder);
2176       rar->ppmd_valid = 1;
2177     }
2178     else
2179     {
2180       if (!rar->ppmd_valid) {
2181         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2182                           "Invalid PPMd sequence");
2183         return (ARCHIVE_FATAL);
2184       }
2185       if (!__archive_ppmd7_functions.PpmdRAR_RangeDec_Init(&rar->range_dec))
2186       {
2187         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2188                           "Unable to initialize PPMd range decoder");
2189         return (ARCHIVE_FATAL);
2190       }
2191     }
2192   }
2193   else
2194   {
2195     rar_br_consume(br, 1);
2196 
2197     /* Keep existing table flag */
2198     if (!rar_br_read_ahead(a, br, 1))
2199       goto truncated_data;
2200     if (!rar_br_bits(br, 1))
2201       memset(rar->lengthtable, 0, sizeof(rar->lengthtable));
2202     rar_br_consume(br, 1);
2203 
2204     memset(&bitlengths, 0, sizeof(bitlengths));
2205     for (i = 0; i < MAX_SYMBOLS;)
2206     {
2207       if (!rar_br_read_ahead(a, br, 4))
2208         goto truncated_data;
2209       bitlengths[i++] = rar_br_bits(br, 4);
2210       rar_br_consume(br, 4);
2211       if (bitlengths[i-1] == 0xF)
2212       {
2213         if (!rar_br_read_ahead(a, br, 4))
2214           goto truncated_data;
2215         zerocount = rar_br_bits(br, 4);
2216         rar_br_consume(br, 4);
2217         if (zerocount)
2218         {
2219           i--;
2220           for (j = 0; j < zerocount + 2 && i < MAX_SYMBOLS; j++)
2221             bitlengths[i++] = 0;
2222         }
2223       }
2224     }
2225 
2226     memset(&precode, 0, sizeof(precode));
2227     r = create_code(a, &precode, bitlengths, MAX_SYMBOLS, MAX_SYMBOL_LENGTH);
2228     if (r != ARCHIVE_OK) {
2229       free(precode.tree);
2230       free(precode.table);
2231       return (r);
2232     }
2233 
2234     for (i = 0; i < HUFFMAN_TABLE_SIZE;)
2235     {
2236       if ((val = read_next_symbol(a, &precode)) < 0) {
2237         free(precode.tree);
2238         free(precode.table);
2239         return (ARCHIVE_FATAL);
2240       }
2241       if (val < 16)
2242       {
2243         rar->lengthtable[i] = (rar->lengthtable[i] + val) & 0xF;
2244         i++;
2245       }
2246       else if (val < 18)
2247       {
2248         if (i == 0)
2249         {
2250           free(precode.tree);
2251           free(precode.table);
2252           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2253                             "Internal error extracting RAR file.");
2254           return (ARCHIVE_FATAL);
2255         }
2256 
2257         if(val == 16) {
2258           if (!rar_br_read_ahead(a, br, 3)) {
2259             free(precode.tree);
2260             free(precode.table);
2261             goto truncated_data;
2262           }
2263           n = rar_br_bits(br, 3) + 3;
2264           rar_br_consume(br, 3);
2265         } else {
2266           if (!rar_br_read_ahead(a, br, 7)) {
2267             free(precode.tree);
2268             free(precode.table);
2269             goto truncated_data;
2270           }
2271           n = rar_br_bits(br, 7) + 11;
2272           rar_br_consume(br, 7);
2273         }
2274 
2275         for (j = 0; j < n && i < HUFFMAN_TABLE_SIZE; j++)
2276         {
2277           rar->lengthtable[i] = rar->lengthtable[i-1];
2278           i++;
2279         }
2280       }
2281       else
2282       {
2283         if(val == 18) {
2284           if (!rar_br_read_ahead(a, br, 3)) {
2285             free(precode.tree);
2286             free(precode.table);
2287             goto truncated_data;
2288           }
2289           n = rar_br_bits(br, 3) + 3;
2290           rar_br_consume(br, 3);
2291         } else {
2292           if (!rar_br_read_ahead(a, br, 7)) {
2293             free(precode.tree);
2294             free(precode.table);
2295             goto truncated_data;
2296           }
2297           n = rar_br_bits(br, 7) + 11;
2298           rar_br_consume(br, 7);
2299         }
2300 
2301         for(j = 0; j < n && i < HUFFMAN_TABLE_SIZE; j++)
2302           rar->lengthtable[i++] = 0;
2303       }
2304     }
2305     free(precode.tree);
2306     free(precode.table);
2307 
2308     r = create_code(a, &rar->maincode, &rar->lengthtable[0], MAINCODE_SIZE,
2309                 MAX_SYMBOL_LENGTH);
2310     if (r != ARCHIVE_OK)
2311       return (r);
2312     r = create_code(a, &rar->offsetcode, &rar->lengthtable[MAINCODE_SIZE],
2313                 OFFSETCODE_SIZE, MAX_SYMBOL_LENGTH);
2314     if (r != ARCHIVE_OK)
2315       return (r);
2316     r = create_code(a, &rar->lowoffsetcode,
2317                 &rar->lengthtable[MAINCODE_SIZE + OFFSETCODE_SIZE],
2318                 LOWOFFSETCODE_SIZE, MAX_SYMBOL_LENGTH);
2319     if (r != ARCHIVE_OK)
2320       return (r);
2321     r = create_code(a, &rar->lengthcode,
2322                 &rar->lengthtable[MAINCODE_SIZE + OFFSETCODE_SIZE +
2323                 LOWOFFSETCODE_SIZE], LENGTHCODE_SIZE, MAX_SYMBOL_LENGTH);
2324     if (r != ARCHIVE_OK)
2325       return (r);
2326   }
2327 
2328   if (!rar->dictionary_size || !rar->lzss.window)
2329   {
2330     /* Seems as though dictionary sizes are not used. Even so, minimize
2331      * memory usage as much as possible.
2332      */
2333     void *new_window;
2334     unsigned int new_size;
2335 
2336     if (rar->unp_size >= DICTIONARY_MAX_SIZE)
2337       new_size = DICTIONARY_MAX_SIZE;
2338     else
2339       new_size = rar_fls((unsigned int)rar->unp_size) << 1;
2340     if (new_size == 0) {
2341       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2342                         "Zero window size is invalid.");
2343       return (ARCHIVE_FATAL);
2344     }
2345     new_window = realloc(rar->lzss.window, new_size);
2346     if (new_window == NULL) {
2347       archive_set_error(&a->archive, ENOMEM,
2348                         "Unable to allocate memory for uncompressed data.");
2349       return (ARCHIVE_FATAL);
2350     }
2351     rar->lzss.window = (unsigned char *)new_window;
2352     rar->dictionary_size = new_size;
2353     memset(rar->lzss.window, 0, rar->dictionary_size);
2354     rar->lzss.mask = rar->dictionary_size - 1;
2355   }
2356 
2357   rar->start_new_table = 0;
2358   return (ARCHIVE_OK);
2359 truncated_data:
2360   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2361                     "Truncated RAR file data");
2362   rar->valid = 0;
2363   return (ARCHIVE_FATAL);
2364 }
2365 
2366 static void
2367 free_codes(struct archive_read *a)
2368 {
2369   struct rar *rar = (struct rar *)(a->format->data);
2370   free(rar->maincode.tree);
2371   free(rar->offsetcode.tree);
2372   free(rar->lowoffsetcode.tree);
2373   free(rar->lengthcode.tree);
2374   free(rar->maincode.table);
2375   free(rar->offsetcode.table);
2376   free(rar->lowoffsetcode.table);
2377   free(rar->lengthcode.table);
2378   memset(&rar->maincode, 0, sizeof(rar->maincode));
2379   memset(&rar->offsetcode, 0, sizeof(rar->offsetcode));
2380   memset(&rar->lowoffsetcode, 0, sizeof(rar->lowoffsetcode));
2381   memset(&rar->lengthcode, 0, sizeof(rar->lengthcode));
2382 }
2383 
2384 
2385 static int
2386 read_next_symbol(struct archive_read *a, struct huffman_code *code)
2387 {
2388   unsigned char bit;
2389   unsigned int bits;
2390   int length, value, node;
2391   struct rar *rar;
2392   struct rar_br *br;
2393 
2394   if (!code->table)
2395   {
2396     if (make_table(a, code) != (ARCHIVE_OK))
2397       return -1;
2398   }
2399 
2400   rar = (struct rar *)(a->format->data);
2401   br = &(rar->br);
2402 
2403   /* Look ahead (peek) at bits */
2404   if (!rar_br_read_ahead(a, br, code->tablesize)) {
2405     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2406                       "Truncated RAR file data");
2407     rar->valid = 0;
2408     return -1;
2409   }
2410   bits = rar_br_bits(br, code->tablesize);
2411 
2412   length = code->table[bits].length;
2413   value = code->table[bits].value;
2414 
2415   if (length < 0)
2416   {
2417     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2418                       "Invalid prefix code in bitstream");
2419     return -1;
2420   }
2421 
2422   if (length <= code->tablesize)
2423   {
2424     /* Skip length bits */
2425     rar_br_consume(br, length);
2426     return value;
2427   }
2428 
2429   /* Skip tablesize bits */
2430   rar_br_consume(br, code->tablesize);
2431 
2432   node = value;
2433   while (!(code->tree[node].branches[0] ==
2434     code->tree[node].branches[1]))
2435   {
2436     if (!rar_br_read_ahead(a, br, 1)) {
2437       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2438                         "Truncated RAR file data");
2439       rar->valid = 0;
2440       return -1;
2441     }
2442     bit = rar_br_bits(br, 1);
2443     rar_br_consume(br, 1);
2444 
2445     if (code->tree[node].branches[bit] < 0)
2446     {
2447       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2448                         "Invalid prefix code in bitstream");
2449       return -1;
2450     }
2451     node = code->tree[node].branches[bit];
2452   }
2453 
2454   return code->tree[node].branches[0];
2455 }
2456 
2457 static int
2458 create_code(struct archive_read *a, struct huffman_code *code,
2459             unsigned char *lengths, int numsymbols, char maxlength)
2460 {
2461   int i, j, codebits = 0, symbolsleft = numsymbols;
2462 
2463   code->numentries = 0;
2464   code->numallocatedentries = 0;
2465   if (new_node(code) < 0) {
2466     archive_set_error(&a->archive, ENOMEM,
2467                       "Unable to allocate memory for node data.");
2468     return (ARCHIVE_FATAL);
2469   }
2470   code->numentries = 1;
2471   code->minlength = INT_MAX;
2472   code->maxlength = INT_MIN;
2473   codebits = 0;
2474   for(i = 1; i <= maxlength; i++)
2475   {
2476     for(j = 0; j < numsymbols; j++)
2477     {
2478       if (lengths[j] != i) continue;
2479       if (add_value(a, code, j, codebits, i) != ARCHIVE_OK)
2480         return (ARCHIVE_FATAL);
2481       codebits++;
2482       if (--symbolsleft <= 0)
2483         break;
2484     }
2485     if (symbolsleft <= 0)
2486       break;
2487     codebits <<= 1;
2488   }
2489   return (ARCHIVE_OK);
2490 }
2491 
2492 static int
2493 add_value(struct archive_read *a, struct huffman_code *code, int value,
2494           int codebits, int length)
2495 {
2496   int lastnode, bitpos, bit;
2497   /* int repeatpos, repeatnode, nextnode; */
2498 
2499   free(code->table);
2500   code->table = NULL;
2501 
2502   if(length > code->maxlength)
2503     code->maxlength = length;
2504   if(length < code->minlength)
2505     code->minlength = length;
2506 
2507   /*
2508    * Dead code, repeatpos was is -1
2509    *
2510   repeatpos = -1;
2511   if (repeatpos == 0 || (repeatpos >= 0
2512     && (((codebits >> (repeatpos - 1)) & 3) == 0
2513     || ((codebits >> (repeatpos - 1)) & 3) == 3)))
2514   {
2515     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2516                       "Invalid repeat position");
2517     return (ARCHIVE_FATAL);
2518   }
2519   */
2520 
2521   lastnode = 0;
2522   for (bitpos = length - 1; bitpos >= 0; bitpos--)
2523   {
2524     bit = (codebits >> bitpos) & 1;
2525 
2526     /* Leaf node check */
2527     if (code->tree[lastnode].branches[0] ==
2528       code->tree[lastnode].branches[1])
2529     {
2530       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2531                         "Prefix found");
2532       return (ARCHIVE_FATAL);
2533     }
2534 
2535     /*
2536      * Dead code, repeatpos was -1, bitpos >=0
2537      *
2538     if (bitpos == repeatpos)
2539     {
2540       * Open branch check *
2541       if (!(code->tree[lastnode].branches[bit] < 0))
2542       {
2543         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2544                           "Invalid repeating code");
2545         return (ARCHIVE_FATAL);
2546       }
2547 
2548       if ((repeatnode = new_node(code)) < 0) {
2549         archive_set_error(&a->archive, ENOMEM,
2550                           "Unable to allocate memory for node data.");
2551         return (ARCHIVE_FATAL);
2552       }
2553       if ((nextnode = new_node(code)) < 0) {
2554         archive_set_error(&a->archive, ENOMEM,
2555                           "Unable to allocate memory for node data.");
2556         return (ARCHIVE_FATAL);
2557       }
2558 
2559       * Set branches *
2560       code->tree[lastnode].branches[bit] = repeatnode;
2561       code->tree[repeatnode].branches[bit] = repeatnode;
2562       code->tree[repeatnode].branches[bit^1] = nextnode;
2563       lastnode = nextnode;
2564 
2565       bitpos++; * terminating bit already handled, skip it *
2566     }
2567     else
2568     {
2569     */
2570       /* Open branch check */
2571       if (code->tree[lastnode].branches[bit] < 0)
2572       {
2573         if (new_node(code) < 0) {
2574           archive_set_error(&a->archive, ENOMEM,
2575                             "Unable to allocate memory for node data.");
2576           return (ARCHIVE_FATAL);
2577         }
2578         code->tree[lastnode].branches[bit] = code->numentries++;
2579       }
2580 
2581       /* set to branch */
2582       lastnode = code->tree[lastnode].branches[bit];
2583  /* } */
2584   }
2585 
2586   if (!(code->tree[lastnode].branches[0] == -1
2587     && code->tree[lastnode].branches[1] == -2))
2588   {
2589     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2590                       "Prefix found");
2591     return (ARCHIVE_FATAL);
2592   }
2593 
2594   /* Set leaf value */
2595   code->tree[lastnode].branches[0] = value;
2596   code->tree[lastnode].branches[1] = value;
2597 
2598   return (ARCHIVE_OK);
2599 }
2600 
2601 static int
2602 new_node(struct huffman_code *code)
2603 {
2604   void *new_tree;
2605   if (code->numallocatedentries == code->numentries) {
2606     int new_num_entries = 256;
2607     if (code->numentries > 0) {
2608         new_num_entries = code->numentries * 2;
2609     }
2610     new_tree = realloc(code->tree, new_num_entries * sizeof(*code->tree));
2611     if (new_tree == NULL)
2612         return (-1);
2613     code->tree = (struct huffman_tree_node *)new_tree;
2614     code->numallocatedentries = new_num_entries;
2615   }
2616   code->tree[code->numentries].branches[0] = -1;
2617   code->tree[code->numentries].branches[1] = -2;
2618   return 1;
2619 }
2620 
2621 static int
2622 make_table(struct archive_read *a, struct huffman_code *code)
2623 {
2624   if (code->maxlength < code->minlength || code->maxlength > 10)
2625     code->tablesize = 10;
2626   else
2627     code->tablesize = code->maxlength;
2628 
2629   code->table =
2630     (struct huffman_table_entry *)calloc(1, sizeof(*code->table)
2631     * ((size_t)1 << code->tablesize));
2632 
2633   return make_table_recurse(a, code, 0, code->table, 0, code->tablesize);
2634 }
2635 
2636 static int
2637 make_table_recurse(struct archive_read *a, struct huffman_code *code, int node,
2638                    struct huffman_table_entry *table, int depth,
2639                    int maxdepth)
2640 {
2641   int currtablesize, i, ret = (ARCHIVE_OK);
2642 
2643   if (!code->tree)
2644   {
2645     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2646                       "Huffman tree was not created.");
2647     return (ARCHIVE_FATAL);
2648   }
2649   if (node < 0 || node >= code->numentries)
2650   {
2651     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2652                       "Invalid location to Huffman tree specified.");
2653     return (ARCHIVE_FATAL);
2654   }
2655 
2656   currtablesize = 1 << (maxdepth - depth);
2657 
2658   if (code->tree[node].branches[0] ==
2659     code->tree[node].branches[1])
2660   {
2661     for(i = 0; i < currtablesize; i++)
2662     {
2663       table[i].length = depth;
2664       table[i].value = code->tree[node].branches[0];
2665     }
2666   }
2667   /*
2668    * Dead code, node >= 0
2669    *
2670   else if (node < 0)
2671   {
2672     for(i = 0; i < currtablesize; i++)
2673       table[i].length = -1;
2674   }
2675    */
2676   else
2677   {
2678     if(depth == maxdepth)
2679     {
2680       table[0].length = maxdepth + 1;
2681       table[0].value = node;
2682     }
2683     else
2684     {
2685       ret |= make_table_recurse(a, code, code->tree[node].branches[0], table,
2686                                 depth + 1, maxdepth);
2687       ret |= make_table_recurse(a, code, code->tree[node].branches[1],
2688                          table + currtablesize / 2, depth + 1, maxdepth);
2689     }
2690   }
2691   return ret;
2692 }
2693 
2694 static int64_t
2695 expand(struct archive_read *a, int64_t end)
2696 {
2697   static const unsigned char lengthbases[] =
2698     {   0,   1,   2,   3,   4,   5,   6,
2699         7,   8,  10,  12,  14,  16,  20,
2700        24,  28,  32,  40,  48,  56,  64,
2701        80,  96, 112, 128, 160, 192, 224 };
2702   static const unsigned char lengthbits[] =
2703     { 0, 0, 0, 0, 0, 0, 0,
2704       0, 1, 1, 1, 1, 2, 2,
2705       2, 2, 3, 3, 3, 3, 4,
2706       4, 4, 4, 5, 5, 5, 5 };
2707   static const int lengthb_min = minimum(
2708     (int)(sizeof(lengthbases)/sizeof(lengthbases[0])),
2709     (int)(sizeof(lengthbits)/sizeof(lengthbits[0]))
2710   );
2711   static const unsigned int offsetbases[] =
2712     {       0,       1,       2,       3,       4,       6,
2713             8,      12,      16,      24,      32,      48,
2714            64,      96,     128,     192,     256,     384,
2715           512,     768,    1024,    1536,    2048,    3072,
2716          4096,    6144,    8192,   12288,   16384,   24576,
2717         32768,   49152,   65536,   98304,  131072,  196608,
2718        262144,  327680,  393216,  458752,  524288,  589824,
2719        655360,  720896,  786432,  851968,  917504,  983040,
2720       1048576, 1310720, 1572864, 1835008, 2097152, 2359296,
2721       2621440, 2883584, 3145728, 3407872, 3670016, 3932160 };
2722   static const unsigned char offsetbits[] =
2723     {  0,  0,  0,  0,  1,  1,  2,  2,  3,  3,  4,  4,
2724        5,  5,  6,  6,  7,  7,  8,  8,  9,  9, 10, 10,
2725       11, 11, 12, 12, 13, 13, 14, 14, 15, 15, 16, 16,
2726       16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16,
2727       18, 18, 18, 18, 18, 18, 18, 18, 18, 18, 18, 18 };
2728   static const int offsetb_min = minimum(
2729     (int)(sizeof(offsetbases)/sizeof(offsetbases[0])),
2730     (int)(sizeof(offsetbits)/sizeof(offsetbits[0]))
2731   );
2732   static const unsigned char shortbases[] =
2733     { 0, 4, 8, 16, 32, 64, 128, 192 };
2734   static const unsigned char shortbits[] =
2735     { 2, 2, 3, 4, 5, 6, 6, 6 };
2736 
2737   int symbol, offs, len, offsindex, lensymbol, i, offssymbol, lowoffsetsymbol;
2738   unsigned char newfile;
2739   struct rar *rar = (struct rar *)(a->format->data);
2740   struct rar_br *br = &(rar->br);
2741 
2742   if (rar->filterstart < end)
2743     end = rar->filterstart;
2744 
2745   while (1)
2746   {
2747     if (rar->output_last_match &&
2748       lzss_position(&rar->lzss) + rar->lastlength <= end)
2749     {
2750       lzss_emit_match(rar, rar->lastoffset, rar->lastlength);
2751       rar->output_last_match = 0;
2752     }
2753 
2754     if(rar->is_ppmd_block || rar->output_last_match ||
2755       lzss_position(&rar->lzss) >= end)
2756       return lzss_position(&rar->lzss);
2757 
2758     if ((symbol = read_next_symbol(a, &rar->maincode)) < 0)
2759       return (ARCHIVE_FATAL);
2760     rar->output_last_match = 0;
2761 
2762     if (symbol < 256)
2763     {
2764       lzss_emit_literal(rar, symbol);
2765       continue;
2766     }
2767     else if (symbol == 256)
2768     {
2769       if (!rar_br_read_ahead(a, br, 1))
2770         goto truncated_data;
2771       newfile = !rar_br_bits(br, 1);
2772       rar_br_consume(br, 1);
2773 
2774       if(newfile)
2775       {
2776         rar->start_new_block = 1;
2777         if (!rar_br_read_ahead(a, br, 1))
2778           goto truncated_data;
2779         rar->start_new_table = rar_br_bits(br, 1);
2780         rar_br_consume(br, 1);
2781         return lzss_position(&rar->lzss);
2782       }
2783       else
2784       {
2785         if (parse_codes(a) != ARCHIVE_OK)
2786           return (ARCHIVE_FATAL);
2787         continue;
2788       }
2789     }
2790     else if(symbol==257)
2791     {
2792       archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2793                         "Parsing filters is unsupported.");
2794       return (ARCHIVE_FAILED);
2795     }
2796     else if(symbol==258)
2797     {
2798       if(rar->lastlength == 0)
2799         continue;
2800 
2801       offs = rar->lastoffset;
2802       len = rar->lastlength;
2803     }
2804     else if (symbol <= 262)
2805     {
2806       offsindex = symbol - 259;
2807       offs = rar->oldoffset[offsindex];
2808 
2809       if ((lensymbol = read_next_symbol(a, &rar->lengthcode)) < 0)
2810         goto bad_data;
2811       if (lensymbol > lengthb_min)
2812         goto bad_data;
2813       len = lengthbases[lensymbol] + 2;
2814       if (lengthbits[lensymbol] > 0) {
2815         if (!rar_br_read_ahead(a, br, lengthbits[lensymbol]))
2816           goto truncated_data;
2817         len += rar_br_bits(br, lengthbits[lensymbol]);
2818         rar_br_consume(br, lengthbits[lensymbol]);
2819       }
2820 
2821       for (i = offsindex; i > 0; i--)
2822         rar->oldoffset[i] = rar->oldoffset[i-1];
2823       rar->oldoffset[0] = offs;
2824     }
2825     else if(symbol<=270)
2826     {
2827       offs = shortbases[symbol-263] + 1;
2828       if(shortbits[symbol-263] > 0) {
2829         if (!rar_br_read_ahead(a, br, shortbits[symbol-263]))
2830           goto truncated_data;
2831         offs += rar_br_bits(br, shortbits[symbol-263]);
2832         rar_br_consume(br, shortbits[symbol-263]);
2833       }
2834 
2835       len = 2;
2836 
2837       for(i = 3; i > 0; i--)
2838         rar->oldoffset[i] = rar->oldoffset[i-1];
2839       rar->oldoffset[0] = offs;
2840     }
2841     else
2842     {
2843       if (symbol-271 > lengthb_min)
2844         goto bad_data;
2845       len = lengthbases[symbol-271]+3;
2846       if(lengthbits[symbol-271] > 0) {
2847         if (!rar_br_read_ahead(a, br, lengthbits[symbol-271]))
2848           goto truncated_data;
2849         len += rar_br_bits(br, lengthbits[symbol-271]);
2850         rar_br_consume(br, lengthbits[symbol-271]);
2851       }
2852 
2853       if ((offssymbol = read_next_symbol(a, &rar->offsetcode)) < 0)
2854         goto bad_data;
2855       if (offssymbol > offsetb_min)
2856         goto bad_data;
2857       offs = offsetbases[offssymbol]+1;
2858       if(offsetbits[offssymbol] > 0)
2859       {
2860         if(offssymbol > 9)
2861         {
2862           if(offsetbits[offssymbol] > 4) {
2863             if (!rar_br_read_ahead(a, br, offsetbits[offssymbol] - 4))
2864               goto truncated_data;
2865             offs += rar_br_bits(br, offsetbits[offssymbol] - 4) << 4;
2866             rar_br_consume(br, offsetbits[offssymbol] - 4);
2867 	  }
2868 
2869           if(rar->numlowoffsetrepeats > 0)
2870           {
2871             rar->numlowoffsetrepeats--;
2872             offs += rar->lastlowoffset;
2873           }
2874           else
2875           {
2876             if ((lowoffsetsymbol =
2877               read_next_symbol(a, &rar->lowoffsetcode)) < 0)
2878               return (ARCHIVE_FATAL);
2879             if(lowoffsetsymbol == 16)
2880             {
2881               rar->numlowoffsetrepeats = 15;
2882               offs += rar->lastlowoffset;
2883             }
2884             else
2885             {
2886               offs += lowoffsetsymbol;
2887               rar->lastlowoffset = lowoffsetsymbol;
2888             }
2889           }
2890         }
2891         else {
2892           if (!rar_br_read_ahead(a, br, offsetbits[offssymbol]))
2893             goto truncated_data;
2894           offs += rar_br_bits(br, offsetbits[offssymbol]);
2895           rar_br_consume(br, offsetbits[offssymbol]);
2896         }
2897       }
2898 
2899       if (offs >= 0x40000)
2900         len++;
2901       if (offs >= 0x2000)
2902         len++;
2903 
2904       for(i = 3; i > 0; i--)
2905         rar->oldoffset[i] = rar->oldoffset[i-1];
2906       rar->oldoffset[0] = offs;
2907     }
2908 
2909     rar->lastoffset = offs;
2910     rar->lastlength = len;
2911     rar->output_last_match = 1;
2912   }
2913 truncated_data:
2914   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2915                     "Truncated RAR file data");
2916   rar->valid = 0;
2917   return (ARCHIVE_FATAL);
2918 bad_data:
2919   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2920                     "Bad RAR file data");
2921   return (ARCHIVE_FATAL);
2922 }
2923 
2924 static int
2925 copy_from_lzss_window(struct archive_read *a, const void **buffer,
2926                         int64_t startpos, int length)
2927 {
2928   int windowoffs, firstpart;
2929   struct rar *rar = (struct rar *)(a->format->data);
2930 
2931   if (!rar->unp_buffer)
2932   {
2933     if ((rar->unp_buffer = malloc(rar->unp_buffer_size)) == NULL)
2934     {
2935       archive_set_error(&a->archive, ENOMEM,
2936                         "Unable to allocate memory for uncompressed data.");
2937       return (ARCHIVE_FATAL);
2938     }
2939   }
2940 
2941   windowoffs = lzss_offset_for_position(&rar->lzss, startpos);
2942   if(windowoffs + length <= lzss_size(&rar->lzss)) {
2943     memcpy(&rar->unp_buffer[rar->unp_offset], &rar->lzss.window[windowoffs],
2944            length);
2945   } else if (length <= lzss_size(&rar->lzss)) {
2946     firstpart = lzss_size(&rar->lzss) - windowoffs;
2947     if (firstpart < 0) {
2948       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2949                         "Bad RAR file data");
2950       return (ARCHIVE_FATAL);
2951     }
2952     if (firstpart < length) {
2953       memcpy(&rar->unp_buffer[rar->unp_offset],
2954              &rar->lzss.window[windowoffs], firstpart);
2955       memcpy(&rar->unp_buffer[rar->unp_offset + firstpart],
2956              &rar->lzss.window[0], length - firstpart);
2957     } else {
2958       memcpy(&rar->unp_buffer[rar->unp_offset],
2959              &rar->lzss.window[windowoffs], length);
2960     }
2961   } else {
2962       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2963                         "Bad RAR file data");
2964       return (ARCHIVE_FATAL);
2965   }
2966   rar->unp_offset += length;
2967   if (rar->unp_offset >= rar->unp_buffer_size)
2968     *buffer = rar->unp_buffer;
2969   else
2970     *buffer = NULL;
2971   return (ARCHIVE_OK);
2972 }
2973 
2974 static const void *
2975 rar_read_ahead(struct archive_read *a, size_t min, ssize_t *avail)
2976 {
2977   struct rar *rar = (struct rar *)(a->format->data);
2978   const void *h = __archive_read_ahead(a, min, avail);
2979   int ret;
2980   if (avail)
2981   {
2982     if (a->archive.read_data_is_posix_read && *avail > (ssize_t)a->archive.read_data_requested)
2983       *avail = a->archive.read_data_requested;
2984     if (*avail > rar->bytes_remaining)
2985       *avail = (ssize_t)rar->bytes_remaining;
2986     if (*avail < 0)
2987       return NULL;
2988     else if (*avail == 0 && rar->main_flags & MHD_VOLUME &&
2989       rar->file_flags & FHD_SPLIT_AFTER)
2990     {
2991       rar->filename_must_match = 1;
2992       ret = archive_read_format_rar_read_header(a, a->entry);
2993       if (ret == (ARCHIVE_EOF))
2994       {
2995         rar->has_endarc_header = 1;
2996         ret = archive_read_format_rar_read_header(a, a->entry);
2997       }
2998       rar->filename_must_match = 0;
2999       if (ret != (ARCHIVE_OK))
3000         return NULL;
3001       return rar_read_ahead(a, min, avail);
3002     }
3003   }
3004   return h;
3005 }
3006