1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 __FBSDID("$FreeBSD$");
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #ifdef HAVE_STDLIB_H
33 #include <stdlib.h>
34 #endif
35 #ifdef HAVE_BZLIB_H
36 #include <bzlib.h>
37 #endif
38 #ifdef HAVE_LZMA_H
39 #include <lzma.h>
40 #endif
41 #ifdef HAVE_ZLIB_H
42 #include <zlib.h>
43 #endif
44 
45 #include "archive.h"
46 #include "archive_entry.h"
47 #include "archive_entry_locale.h"
48 #include "archive_ppmd7_private.h"
49 #include "archive_private.h"
50 #include "archive_read_private.h"
51 #include "archive_endian.h"
52 
53 #ifndef HAVE_ZLIB_H
54 #include "archive_crc32.h"
55 #endif
56 
57 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
58 #define SFX_MIN_ADDR	0x27000
59 #define SFX_MAX_ADDR	0x60000
60 
61 
62 /*
63  * Codec ID
64  */
65 #define _7Z_COPY	0
66 #define _7Z_LZMA	0x030101
67 #define _7Z_LZMA2	0x21
68 #define _7Z_DEFLATE	0x040108
69 #define _7Z_BZ2		0x040202
70 #define _7Z_PPMD	0x030401
71 #define _7Z_DELTA	0x03
72 #define _7Z_CRYPTO	0x06F10701
73 #define _7Z_X86		0x03030103
74 #define _7Z_X86_BCJ2	0x0303011B
75 #define _7Z_POWERPC	0x03030205
76 #define _7Z_IA64	0x03030401
77 #define _7Z_ARM		0x03030501
78 #define _7Z_ARMTHUMB	0x03030701
79 #define _7Z_SPARC	0x03030805
80 
81 /*
82  * 7-Zip header property IDs.
83  */
84 #define kEnd			0x00
85 #define kHeader			0x01
86 #define kArchiveProperties	0x02
87 #define kAdditionalStreamsInfo	0x03
88 #define kMainStreamsInfo	0x04
89 #define kFilesInfo		0x05
90 #define kPackInfo		0x06
91 #define kUnPackInfo		0x07
92 #define kSubStreamsInfo		0x08
93 #define kSize			0x09
94 #define kCRC			0x0A
95 #define kFolder			0x0B
96 #define kCodersUnPackSize	0x0C
97 #define kNumUnPackStream	0x0D
98 #define kEmptyStream		0x0E
99 #define kEmptyFile		0x0F
100 #define kAnti			0x10
101 #define kName			0x11
102 #define kCTime			0x12
103 #define kATime			0x13
104 #define kMTime			0x14
105 #define kAttributes		0x15
106 #define kEncodedHeader		0x17
107 
108 struct _7z_digests {
109 	unsigned char	*defineds;
110 	uint32_t	*digests;
111 };
112 
113 
114 struct _7z_folder {
115 	uint64_t		 numCoders;
116 	struct _7z_coder {
117 		unsigned long	 codec;
118 		uint64_t	 numInStreams;
119 		uint64_t	 numOutStreams;
120 		uint64_t	 propertiesSize;
121 		unsigned char	*properties;
122 	} *coders;
123 	uint64_t		 numBindPairs;
124 	struct {
125 		uint64_t	 inIndex;
126 		uint64_t	 outIndex;
127 	} *bindPairs;
128 	uint64_t		 numPackedStreams;
129 	uint64_t		*packedStreams;
130 	uint64_t		 numInStreams;
131 	uint64_t		 numOutStreams;
132 	uint64_t		*unPackSize;
133 	unsigned char		 digest_defined;
134 	uint32_t		 digest;
135 	uint64_t		 numUnpackStreams;
136 	uint32_t		 packIndex;
137 	/* Unoperated bytes. */
138 	uint64_t		 skipped_bytes;
139 };
140 
141 struct _7z_coders_info {
142 	uint64_t		 numFolders;
143 	struct _7z_folder	*folders;
144 	uint64_t		 dataStreamIndex;
145 };
146 
147 struct _7z_pack_info {
148 	uint64_t		 pos;
149 	uint64_t		 numPackStreams;
150 	uint64_t		*sizes;
151 	struct _7z_digests	 digest;
152 	/* Calculated from pos and numPackStreams. */
153 	uint64_t		*positions;
154 };
155 
156 struct _7z_substream_info {
157 	size_t			 unpack_streams;
158 	uint64_t		*unpackSizes;
159 	unsigned char		*digestsDefined;
160 	uint32_t		*digests;
161 };
162 
163 struct _7z_stream_info {
164 	struct _7z_pack_info	 pi;
165 	struct _7z_coders_info	 ci;
166 	struct _7z_substream_info ss;
167 };
168 
169 struct _7z_header_info {
170 	uint64_t		 dataIndex;
171 
172 	unsigned char		*emptyStreamBools;
173 	unsigned char		*emptyFileBools;
174 	unsigned char		*antiBools;
175 	unsigned char		*attrBools;
176 };
177 
178 struct _7zip_entry {
179 	size_t			 name_len;
180 	unsigned char		*utf16name;
181 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
182 	const wchar_t		*wname;
183 #endif
184 	uint32_t		 folderIndex;
185 	uint32_t		 ssIndex;
186 	unsigned		 flg;
187 #define MTIME_IS_SET	(1<<0)
188 #define ATIME_IS_SET	(1<<1)
189 #define CTIME_IS_SET	(1<<2)
190 #define CRC32_IS_SET	(1<<3)
191 #define HAS_STREAM	(1<<4)
192 
193 	time_t			 mtime;
194 	time_t			 atime;
195 	time_t			 ctime;
196 	long			 mtime_ns;
197 	long			 atime_ns;
198 	long			 ctime_ns;
199 	uint32_t		 mode;
200 	uint32_t		 attr;
201 };
202 
203 struct _7zip {
204 	/* Structural information about the archive. */
205 	struct _7z_stream_info	 si;
206 
207 	int			 header_is_being_read;
208 	int			 header_is_encoded;
209 	uint64_t		 header_bytes_remaining;
210 	unsigned long		 header_crc32;
211 	/* Header offset to check that reading pointes of the file contens
212 	 * will not exceed the header. */
213 	uint64_t		 header_offset;
214 	/* Base offset of the archive file for a seek in case reading SFX. */
215 	uint64_t		 seek_base;
216 
217 	/* List of entries */
218 	size_t			 entries_remaining;
219 	uint64_t		 numFiles;
220 	struct _7zip_entry	*entries;
221 	struct _7zip_entry	*entry;
222 	unsigned char		*entry_names;
223 
224 	/* entry_bytes_remaining is the number of bytes we expect. */
225 	int64_t			 entry_offset;
226 	uint64_t		 entry_bytes_remaining;
227 
228 	/* Running CRC32 of the decompressed data */
229 	unsigned long		 entry_crc32;
230 
231 	/* Flags to mark progress of decompression. */
232 	char			 end_of_entry;
233 
234 	/* Uncompressed buffer control.  */
235 #define UBUFF_SIZE	(64 * 1024)
236 	unsigned char 		*uncompressed_buffer;
237 	unsigned char 		*uncompressed_buffer_pointer;
238 	size_t 			 uncompressed_buffer_size;
239 	size_t			 uncompressed_buffer_bytes_remaining;
240 
241 	/* Offset of the compressed data. */
242 	int64_t			 stream_offset;
243 
244 	/*
245 	 * Decompressing control data.
246 	 */
247 	unsigned		 folder_index;
248 	uint64_t		 folder_outbytes_remaining;
249 	unsigned		 pack_stream_index;
250 	unsigned		 pack_stream_remaining;
251 	uint64_t		 pack_stream_inbytes_remaining;
252 	size_t			 pack_stream_bytes_unconsumed;
253 
254 	/* The codec information of a folder. */
255 	unsigned long		 codec;
256 	unsigned long		 codec2;
257 
258 	/*
259 	 * Decompressor controllers.
260 	 */
261 	/* Decording LZMA1 and LZMA2 data. */
262 #ifdef HAVE_LZMA_H
263 	lzma_stream		 lzstream;
264 	int			 lzstream_valid;
265 #endif
266 	/* Decording bzip2 data. */
267 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
268 	bz_stream		 bzstream;
269 	int			 bzstream_valid;
270 #endif
271 	/* Decording deflate data. */
272 #ifdef HAVE_ZLIB_H
273 	z_stream		 stream;
274 	int			 stream_valid;
275 #endif
276 	/* Decording PPMd data. */
277 	int			 ppmd7_stat;
278 	CPpmd7			 ppmd7_context;
279 	CPpmd7z_RangeDec	 range_dec;
280 	IByteIn			 bytein;
281 	struct {
282 		const unsigned char	*next_in;
283 		int64_t			 avail_in;
284 		int64_t			 total_in;
285 		unsigned char		*next_out;
286 		int64_t			 avail_out;
287 		int64_t			 total_out;
288 		int			 overconsumed;
289 	} ppstream;
290 	int			 ppmd7_valid;
291 
292 	/* Decoding BCJ and BCJ2 data. */
293 	uint32_t		 bcj_state;
294 	size_t			 odd_bcj_size;
295 	unsigned char		 odd_bcj[4];
296 	/* Decoding BCJ data. */
297 	size_t			 bcj_prevPosT;
298 	uint32_t		 bcj_prevMask;
299 	uint32_t		 bcj_ip;
300 
301 	/* Decoding BCJ2 data. */
302 	size_t			 main_stream_bytes_remaining;
303 	unsigned char		*sub_stream_buff[3];
304 	size_t			 sub_stream_size[3];
305 	size_t			 sub_stream_bytes_remaining[3];
306 	unsigned char		*tmp_stream_buff;
307 	size_t			 tmp_stream_buff_size;
308 	size_t			 tmp_stream_bytes_avail;
309 	size_t			 tmp_stream_bytes_remaining;
310 #ifdef _LZMA_PROB32
311 #define CProb uint32_t
312 #else
313 #define CProb uint16_t
314 #endif
315 	CProb			 bcj2_p[256 + 2];
316 	uint8_t			 bcj2_prevByte;
317 	uint32_t		 bcj2_range;
318 	uint32_t		 bcj2_code;
319 	uint64_t		 bcj2_outPos;
320 
321 	/* Filename character-set conversion data. */
322 	struct archive_string_conv *sconv;
323 
324 	char			 format_name[64];
325 };
326 
327 static int	archive_read_format_7zip_bid(struct archive_read *, int);
328 static int	archive_read_format_7zip_cleanup(struct archive_read *);
329 static int	archive_read_format_7zip_read_data(struct archive_read *,
330 		    const void **, size_t *, int64_t *);
331 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
332 static int	archive_read_format_7zip_read_header(struct archive_read *,
333 		    struct archive_entry *);
334 static int	check_7zip_header_in_sfx(const char *);
335 static unsigned long decode_codec_id(const unsigned char *, size_t);
336 static int	decode_encoded_header_info(struct archive_read *,
337 		    struct _7z_stream_info *);
338 static int	decompress(struct archive_read *, struct _7zip *,
339 		    void *, size_t *, const void *, size_t *);
340 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
341 static void	fileTimeToUtc(uint64_t, time_t *, long *);
342 static uint64_t folder_uncompressed_size(struct _7z_folder *);
343 static void	free_CodersInfo(struct _7z_coders_info *);
344 static void	free_Digest(struct _7z_digests *);
345 static void	free_Folder(struct _7z_folder *);
346 static void	free_Header(struct _7z_header_info *);
347 static void	free_PackInfo(struct _7z_pack_info *);
348 static void	free_StreamsInfo(struct _7z_stream_info *);
349 static void	free_SubStreamsInfo(struct _7z_substream_info *);
350 static int	free_decompression(struct archive_read *, struct _7zip *);
351 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
352 		    size_t, size_t);
353 static const unsigned char * header_bytes(struct archive_read *, size_t);
354 static int	init_decompression(struct archive_read *, struct _7zip *,
355 		    const struct _7z_coder *, const struct _7z_coder *);
356 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
357 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
358 static int	read_CodersInfo(struct archive_read *,
359 		    struct _7z_coders_info *);
360 static int	read_Digests(struct archive_read *, struct _7z_digests *,
361 		    size_t);
362 static int	read_Folder(struct archive_read *, struct _7z_folder *);
363 static int	read_Header(struct archive_read *, struct _7z_header_info *,
364 		    int);
365 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
366 static int	read_StreamsInfo(struct archive_read *,
367 		    struct _7z_stream_info *);
368 static int	read_SubStreamsInfo(struct archive_read *,
369 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
370 static int	read_Times(struct archive_read *, struct _7z_header_info *,
371 		    int);
372 static void	read_consume(struct archive_read *);
373 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
374 		    size_t);
375 static int	seek_pack(struct archive_read *);
376 static int64_t	skip_stream(struct archive_read *, size_t);
377 static int	skip_sfx(struct archive_read *, ssize_t);
378 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
379 		    struct _7z_header_info *);
380 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
381 		    int);
382 static void	x86_Init(struct _7zip *);
383 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
384 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
385 
386 
387 int
388 archive_read_support_format_7zip(struct archive *_a)
389 {
390 	struct archive_read *a = (struct archive_read *)_a;
391 	struct _7zip *zip;
392 	int r;
393 
394 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
395 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
396 
397 	zip = calloc(1, sizeof(*zip));
398 	if (zip == NULL) {
399 		archive_set_error(&a->archive, ENOMEM,
400 		    "Can't allocate 7zip data");
401 		return (ARCHIVE_FATAL);
402 	}
403 
404 	r = __archive_read_register_format(a,
405 	    zip,
406 	    "7zip",
407 	    archive_read_format_7zip_bid,
408 	    NULL,
409 	    archive_read_format_7zip_read_header,
410 	    archive_read_format_7zip_read_data,
411 	    archive_read_format_7zip_read_data_skip,
412 	    archive_read_format_7zip_cleanup);
413 
414 	if (r != ARCHIVE_OK)
415 		free(zip);
416 	return (ARCHIVE_OK);
417 }
418 
419 static int
420 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
421 {
422 	const char *p;
423 
424 	/* If someone has already bid more than 32, then avoid
425 	   trashing the look-ahead buffers with a seek. */
426 	if (best_bid > 32)
427 		return (-1);
428 
429 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
430 		return (0);
431 
432 	/* If first six bytes are the 7-Zip signature,
433 	 * return the bid right now. */
434 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
435 		return (48);
436 
437 	/*
438 	 * It may a 7-Zip SFX archive file. If first two bytes are
439 	 * 'M' and 'Z' available on Windows or first four bytes are
440 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
441 	 * signature. Although we will perform a seek when reading
442 	 * a header, what we do not use __archive_read_seek() here is
443 	 * due to a bidding performance.
444 	 */
445 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
446 		ssize_t offset = SFX_MIN_ADDR;
447 		ssize_t window = 4096;
448 		ssize_t bytes_avail;
449 		while (offset + window <= (SFX_MAX_ADDR)) {
450 			const char *buff = __archive_read_ahead(a,
451 					offset + window, &bytes_avail);
452 			if (buff == NULL) {
453 				/* Remaining bytes are less than window. */
454 				window >>= 1;
455 				if (window < 0x40)
456 					return (0);
457 				continue;
458 			}
459 			p = buff + offset;
460 			while (p + 32 < buff + bytes_avail) {
461 				int step = check_7zip_header_in_sfx(p);
462 				if (step == 0)
463 					return (48);
464 				p += step;
465 			}
466 			offset = p - buff;
467 		}
468 	}
469 	return (0);
470 }
471 
472 static int
473 check_7zip_header_in_sfx(const char *p)
474 {
475 	switch ((unsigned char)p[5]) {
476 	case 0x1C:
477 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
478 			return (6);
479 		/*
480 		 * Test the CRC because its extraction code has 7-Zip
481 		 * Magic Code, so we should do this in order not to
482 		 * make a mis-detection.
483 		 */
484 		if (crc32(0, (unsigned char *)p + 12, 20)
485 			!= archive_le32dec(p + 8))
486 			return (6);
487 		/* Hit the header! */
488 		return (0);
489 	case 0x37: return (5);
490 	case 0x7A: return (4);
491 	case 0xBC: return (3);
492 	case 0xAF: return (2);
493 	case 0x27: return (1);
494 	default: return (6);
495 	}
496 }
497 
498 static int
499 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
500 {
501 	const void *h;
502 	const char *p, *q;
503 	size_t skip, offset;
504 	ssize_t bytes, window;
505 
506 	/*
507 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
508 	 * __archive_read_seek() at this time since we have
509 	 * alredy had enough data.
510 	 */
511 	if (bytes_avail > SFX_MIN_ADDR)
512 		__archive_read_consume(a, SFX_MIN_ADDR);
513 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
514 		return (ARCHIVE_FATAL);
515 
516 	offset = 0;
517 	window = 1;
518 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
519 		h = __archive_read_ahead(a, window, &bytes);
520 		if (h == NULL) {
521 			/* Remaining bytes are less than window. */
522 			window >>= 1;
523 			if (window < 0x40)
524 				goto fatal;
525 			continue;
526 		}
527 		if (bytes < 6) {
528 			/* This case might happen when window == 1. */
529 			window = 4096;
530 			continue;
531 		}
532 		p = (const char *)h;
533 		q = p + bytes;
534 
535 		/*
536 		 * Scan ahead until we find something that looks
537 		 * like the 7-Zip header.
538 		 */
539 		while (p + 32 < q) {
540 			int step = check_7zip_header_in_sfx(p);
541 			if (step == 0) {
542 				struct _7zip *zip =
543 				    (struct _7zip *)a->format->data;
544 				skip = p - (const char *)h;
545 				__archive_read_consume(a, skip);
546 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
547 				return (ARCHIVE_OK);
548 			}
549 			p += step;
550 		}
551 		skip = p - (const char *)h;
552 		__archive_read_consume(a, skip);
553 		offset += skip;
554 		if (window == 1)
555 			window = 4096;
556 	}
557 fatal:
558 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
559 	    "Couldn't find out 7-Zip header");
560 	return (ARCHIVE_FATAL);
561 }
562 
563 static int
564 archive_read_format_7zip_read_header(struct archive_read *a,
565 	struct archive_entry *entry)
566 {
567 	struct _7zip *zip = (struct _7zip *)a->format->data;
568 	struct _7zip_entry *zip_entry;
569 	int r, ret = ARCHIVE_OK;
570 
571 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
572 	if (a->archive.archive_format_name == NULL)
573 		a->archive.archive_format_name = "7-Zip";
574 
575 	if (zip->entries == NULL) {
576 		struct _7z_header_info header;
577 
578 		memset(&header, 0, sizeof(header));
579 		r = slurp_central_directory(a, zip, &header);
580 		free_Header(&header);
581 		if (r != ARCHIVE_OK)
582 			return (r);
583 		zip->entries_remaining = zip->numFiles;
584 		zip->entry = zip->entries;
585 	} else {
586 		++zip->entry;
587 	}
588 	zip_entry = zip->entry;
589 
590 	if (zip->entries_remaining <= 0)
591 		return ARCHIVE_EOF;
592 	--zip->entries_remaining;
593 
594 	zip->entry_offset = 0;
595 	zip->end_of_entry = 0;
596 	zip->entry_crc32 = crc32(0, NULL, 0);
597 
598 	/* Setup a string conversion for a filename. */
599 	if (zip->sconv == NULL) {
600 		zip->sconv = archive_string_conversion_from_charset(
601 		    &a->archive, "UTF-16LE", 1);
602 		if (zip->sconv == NULL)
603 			return (ARCHIVE_FATAL);
604 	}
605 
606 	if (archive_entry_copy_pathname_l(entry,
607 	    (const char *)zip_entry->utf16name,
608 	    zip_entry->name_len, zip->sconv) != 0) {
609 		if (errno == ENOMEM) {
610 			archive_set_error(&a->archive, ENOMEM,
611 			    "Can't allocate memory for Pathname");
612 			return (ARCHIVE_FATAL);
613 		}
614 		archive_set_error(&a->archive,
615 		    ARCHIVE_ERRNO_FILE_FORMAT,
616 		    "Pathname cannot be converted "
617 		    "from %s to current locale.",
618 		    archive_string_conversion_charset_name(zip->sconv));
619 		ret = ARCHIVE_WARN;
620 	}
621 
622 	/* Populate some additional entry fields: */
623 	archive_entry_set_mode(entry, zip_entry->mode);
624 	if (zip_entry->flg & MTIME_IS_SET)
625 		archive_entry_set_mtime(entry, zip_entry->mtime,
626 			zip_entry->mtime_ns);
627 	if (zip_entry->flg & CTIME_IS_SET)
628 		archive_entry_set_ctime(entry, zip_entry->ctime,
629 		    zip_entry->ctime_ns);
630 	if (zip_entry->flg & ATIME_IS_SET)
631 		archive_entry_set_atime(entry, zip_entry->atime,
632 		    zip_entry->atime_ns);
633 	if (zip_entry->ssIndex != -1) {
634 		zip->entry_bytes_remaining =
635 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
636 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
637 	} else {
638 		zip->entry_bytes_remaining = 0;
639 		archive_entry_set_size(entry, 0);
640 	}
641 
642 	/* If there's no body, force read_data() to return EOF immediately. */
643 	if (zip->entry_bytes_remaining < 1)
644 		zip->end_of_entry = 1;
645 
646 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
647 		unsigned char *symname = NULL;
648 		size_t symsize = 0;
649 		int r;
650 
651 		/*
652 		 * Symbolic-name is recorded as its contents. We have to
653 		 * read the contents at this time.
654 		 */
655 		while (zip->entry_bytes_remaining > 0) {
656 			const void *buff;
657 			size_t size;
658 			int64_t offset;
659 
660 			r = archive_read_format_7zip_read_data(a, &buff,
661 				&size, &offset);
662 			if (r < ARCHIVE_WARN)
663 				return (r);
664 			symname = realloc(symname, symsize + size + 1);
665 			if (symname == NULL) {
666 				archive_set_error(&a->archive, ENOMEM,
667 				    "Can't allocate memory for Symname");
668 				return (ARCHIVE_FATAL);
669 			}
670 			memcpy(symname+symsize, buff, size);
671 			symsize += size;
672 		}
673 		if (symsize == 0) {
674 			/* If there is no synname, handle it as a regular
675 			 * file. */
676 			zip_entry->mode &= ~AE_IFMT;
677 			zip_entry->mode |= AE_IFREG;
678 			archive_entry_set_mode(entry, zip_entry->mode);
679 		} else {
680 			symname[symsize] = '\0';
681 			archive_entry_copy_symlink(entry,
682 			    (const char *)symname);
683 			free(symname);
684 		}
685 		archive_entry_set_size(entry, 0);
686 	}
687 
688 	/* Set up a more descriptive format name. */
689 	sprintf(zip->format_name, "7-Zip");
690 	a->archive.archive_format_name = zip->format_name;
691 
692 	return (ret);
693 }
694 
695 static int
696 archive_read_format_7zip_read_data(struct archive_read *a,
697     const void **buff, size_t *size, int64_t *offset)
698 {
699 	struct _7zip *zip;
700 	ssize_t bytes;
701 	int ret = ARCHIVE_OK;
702 
703 	zip = (struct _7zip *)(a->format->data);
704 
705 	if (zip->pack_stream_bytes_unconsumed)
706 		read_consume(a);
707 
708 	/*
709 	 * If we hit end-of-entry last time, clean up and return
710 	 * ARCHIVE_EOF this time.
711 	 */
712 	if (zip->end_of_entry) {
713 		*offset = zip->entry_offset;
714 		*size = 0;
715 		*buff = NULL;
716 		return (ARCHIVE_EOF);
717 	}
718 
719 	bytes = read_stream(a, buff, zip->entry_bytes_remaining, 0);
720 	if (bytes < 0)
721 		return ((int)bytes);
722 	if (bytes == 0) {
723 		archive_set_error(&a->archive,
724 		    ARCHIVE_ERRNO_FILE_FORMAT,
725 		    "Truncated 7-Zip file body");
726 		return (ARCHIVE_FATAL);
727 	}
728 	zip->entry_bytes_remaining -= bytes;
729 	if (zip->entry_bytes_remaining == 0)
730 		zip->end_of_entry = 1;
731 
732 	/* Update checksum */
733 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
734 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff, bytes);
735 
736 	/* If we hit the end, swallow any end-of-data marker. */
737 	if (zip->end_of_entry) {
738 		/* Check computed CRC against file contents. */
739 		if ((zip->entry->flg & CRC32_IS_SET) &&
740 			zip->si.ss.digests[zip->entry->ssIndex] !=
741 		    zip->entry_crc32) {
742 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
743 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
744 			    (unsigned long)zip->entry_crc32,
745 			    (unsigned long)zip->si.ss.digests[
746 			    		zip->entry->ssIndex]);
747 			ret = ARCHIVE_WARN;
748 		}
749 	}
750 
751 	*size = bytes;
752 	*offset = zip->entry_offset;
753 	zip->entry_offset += bytes;
754 
755 	return (ret);
756 }
757 
758 static int
759 archive_read_format_7zip_read_data_skip(struct archive_read *a)
760 {
761 	struct _7zip *zip;
762 	int64_t bytes_skipped;
763 
764 	zip = (struct _7zip *)(a->format->data);
765 
766 	if (zip->pack_stream_bytes_unconsumed)
767 		read_consume(a);
768 
769 	/* If we've already read to end of data, we're done. */
770 	if (zip->end_of_entry)
771 		return (ARCHIVE_OK);
772 
773 	/*
774 	 * If the length is at the beginning, we can skip the
775 	 * compressed data much more quickly.
776 	 */
777 	bytes_skipped = skip_stream(a, zip->entry_bytes_remaining);
778 	if (bytes_skipped < 0)
779 		return (ARCHIVE_FATAL);
780 	zip->entry_bytes_remaining = 0;
781 
782 	/* This entry is finished and done. */
783 	zip->end_of_entry = 1;
784 	return (ARCHIVE_OK);
785 }
786 
787 static int
788 archive_read_format_7zip_cleanup(struct archive_read *a)
789 {
790 	struct _7zip *zip;
791 
792 	zip = (struct _7zip *)(a->format->data);
793 	free_StreamsInfo(&(zip->si));
794 	free(zip->entries);
795 	free(zip->entry_names);
796 	free_decompression(a, zip);
797 	free(zip->uncompressed_buffer);
798 	free(zip->sub_stream_buff[0]);
799 	free(zip->sub_stream_buff[1]);
800 	free(zip->sub_stream_buff[2]);
801 	free(zip->tmp_stream_buff);
802 	free(zip);
803 	(a->format->data) = NULL;
804 	return (ARCHIVE_OK);
805 }
806 
807 static void
808 read_consume(struct archive_read *a)
809 {
810 	struct _7zip *zip = (struct _7zip *)a->format->data;
811 
812 	if (zip->pack_stream_bytes_unconsumed) {
813 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
814 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
815 		zip->pack_stream_bytes_unconsumed = 0;
816 	}
817 }
818 
819 #ifdef HAVE_LZMA_H
820 
821 /*
822  * Set an error code and choose an error message for liblzma.
823  */
824 static void
825 set_error(struct archive_read *a, int ret)
826 {
827 
828 	switch (ret) {
829 	case LZMA_STREAM_END: /* Found end of stream. */
830 	case LZMA_OK: /* Decompressor made some progress. */
831 		break;
832 	case LZMA_MEM_ERROR:
833 		archive_set_error(&a->archive, ENOMEM,
834 		    "Lzma library error: Cannot allocate memory");
835 		break;
836 	case LZMA_MEMLIMIT_ERROR:
837 		archive_set_error(&a->archive, ENOMEM,
838 		    "Lzma library error: Out of memory");
839 		break;
840 	case LZMA_FORMAT_ERROR:
841 		archive_set_error(&a->archive,
842 		    ARCHIVE_ERRNO_MISC,
843 		    "Lzma library error: format not recognized");
844 		break;
845 	case LZMA_OPTIONS_ERROR:
846 		archive_set_error(&a->archive,
847 		    ARCHIVE_ERRNO_MISC,
848 		    "Lzma library error: Invalid options");
849 		break;
850 	case LZMA_DATA_ERROR:
851 		archive_set_error(&a->archive,
852 		    ARCHIVE_ERRNO_MISC,
853 		    "Lzma library error: Corrupted input data");
854 		break;
855 	case LZMA_BUF_ERROR:
856 		archive_set_error(&a->archive,
857 		    ARCHIVE_ERRNO_MISC,
858 		    "Lzma library error:  No progress is possible");
859 		break;
860 	default:
861 		/* Return an error. */
862 		archive_set_error(&a->archive,
863 		    ARCHIVE_ERRNO_MISC,
864 		    "Lzma decompression failed:  Unknown error");
865 		break;
866 	}
867 }
868 
869 #endif
870 
871 static unsigned long
872 decode_codec_id(const unsigned char *codecId, size_t id_size)
873 {
874 	unsigned i;
875 	unsigned long id = 0;
876 
877 	for (i = 0; i < id_size; i++) {
878 		id <<= 8;
879 		id += codecId[i];
880 	}
881 	return (id);
882 }
883 
884 static void *
885 ppmd_alloc(void *p, size_t size)
886 {
887 	(void)p;
888 	return malloc(size);
889 }
890 static void
891 ppmd_free(void *p, void *address)
892 {
893 	(void)p;
894 	free(address);
895 }
896 static Byte
897 ppmd_read(void *p)
898 {
899 	struct archive_read *a = ((IByteIn*)p)->a;
900 	struct _7zip *zip = (struct _7zip *)(a->format->data);
901 	Byte b;
902 
903 	if (zip->ppstream.avail_in == 0) {
904 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
905 		    "Truncated RAR file data");
906 		zip->ppstream.overconsumed = 1;
907 		return (0);
908 	}
909 	b = *zip->ppstream.next_in++;
910 	zip->ppstream.avail_in--;
911 	zip->ppstream.total_in++;
912 	return (b);
913 }
914 
915 static ISzAlloc g_szalloc = { ppmd_alloc, ppmd_free };
916 
917 static int
918 init_decompression(struct archive_read *a, struct _7zip *zip,
919     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
920 {
921 	int r;
922 
923 	zip->codec = coder1->codec;
924 	zip->codec2 = -1;
925 
926 	switch (zip->codec) {
927 	case _7Z_COPY:
928 	case _7Z_BZ2:
929 	case _7Z_DEFLATE:
930 	case _7Z_PPMD:
931 		if (coder2 != NULL) {
932 			if (coder2->codec != _7Z_X86 &&
933 			    coder2->codec != _7Z_X86_BCJ2) {
934 				archive_set_error(&a->archive,
935 				    ARCHIVE_ERRNO_MISC,
936 				    "Unsupported filter %lx for %lx",
937 				    coder2->codec, coder1->codec);
938 				return (ARCHIVE_FAILED);
939 			}
940 			zip->codec2 = coder2->codec;
941 			zip->bcj_state = 0;
942 			if (coder2->codec == _7Z_X86)
943 				x86_Init(zip);
944 		}
945 		break;
946 	default:
947 		break;
948 	}
949 
950 	switch (zip->codec) {
951 	case _7Z_COPY:
952 		break;
953 
954 	case _7Z_LZMA: case _7Z_LZMA2:
955 #ifdef HAVE_LZMA_H
956 #if LZMA_VERSION_MAJOR >= 5
957 /* Effectively disable the limiter. */
958 #define LZMA_MEMLIMIT   UINT64_MAX
959 #else
960 /* NOTE: This needs to check memory size which running system has. */
961 #define LZMA_MEMLIMIT   (1U << 30)
962 #endif
963 	{
964 		lzma_options_delta delta_opt;
965 		lzma_filter filters[LZMA_FILTERS_MAX];
966 #if LZMA_VERSION < 50000030
967 		lzma_filter *ff;
968 #endif
969 		int fi = 0;
970 
971 		if (zip->lzstream_valid) {
972 			lzma_end(&(zip->lzstream));
973 			zip->lzstream_valid = 0;
974 		}
975 
976 		/*
977 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
978 		 * data made by 7-Zip because 7-Zip does not add End-Of-
979 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
980 		 * and so liblzma cannot know the end of the compressed data
981 		 * without EOPM. So consequently liblzma will not return last
982 		 * three or four bytes of uncompressed data because
983 		 * LZMA_FILTER_X86 filter does not handle input data if its
984 		 * data size is less than five bytes. If liblzma detect EOPM
985 		 * or know the uncompressed data size, liblzma will flush out
986 		 * the remaining that three or four bytes of uncompressed
987 		 * data. That is why we have to use our converting program
988 		 * for BCJ+LZMA. If we were able to tell the uncompressed
989 		 * size to liblzma when using lzma_raw_decoder() liblzma
990 		 * could correctly deal with BCJ+LZMA. But unfortunately
991 		 * there is no way to do that.
992 		 * Discussion about this can be found at XZ Utils forum.
993 		 */
994 		if (coder2 != NULL) {
995 			zip->codec2 = coder2->codec;
996 
997 			filters[fi].options = NULL;
998 			switch (zip->codec2) {
999 			case _7Z_X86:
1000 				if (zip->codec == _7Z_LZMA2) {
1001 					filters[fi].id = LZMA_FILTER_X86;
1002 					fi++;
1003 				} else
1004 					/* Use our filter. */
1005 					x86_Init(zip);
1006 				break;
1007 			case _7Z_X86_BCJ2:
1008 				/* Use our filter. */
1009 				zip->bcj_state = 0;
1010 				break;
1011 			case _7Z_DELTA:
1012 				filters[fi].id = LZMA_FILTER_DELTA;
1013 				memset(&delta_opt, 0, sizeof(delta_opt));
1014 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1015 				delta_opt.dist = 1;
1016 				filters[fi].options = &delta_opt;
1017 				fi++;
1018 				break;
1019 			/* Following filters have not been tested yet. */
1020 			case _7Z_POWERPC:
1021 				filters[fi].id = LZMA_FILTER_POWERPC;
1022 				fi++;
1023 				break;
1024 			case _7Z_IA64:
1025 				filters[fi].id = LZMA_FILTER_IA64;
1026 				fi++;
1027 				break;
1028 			case _7Z_ARM:
1029 				filters[fi].id = LZMA_FILTER_ARM;
1030 				fi++;
1031 				break;
1032 			case _7Z_ARMTHUMB:
1033 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1034 				fi++;
1035 				break;
1036 			case _7Z_SPARC:
1037 				filters[fi].id = LZMA_FILTER_SPARC;
1038 				fi++;
1039 				break;
1040 			default:
1041 				archive_set_error(&a->archive,
1042 				    ARCHIVE_ERRNO_MISC,
1043 				    "Unexpected codec ID: %lX", zip->codec2);
1044 				return (ARCHIVE_FAILED);
1045 			}
1046 		}
1047 
1048 		if (zip->codec == _7Z_LZMA2)
1049 			filters[fi].id = LZMA_FILTER_LZMA2;
1050 		else
1051 			filters[fi].id = LZMA_FILTER_LZMA1;
1052 		filters[fi].options = NULL;
1053 #if LZMA_VERSION < 50000030
1054 		ff = &filters[fi];
1055 #endif
1056 		r = lzma_properties_decode(&filters[fi], NULL,
1057 		    coder1->properties, coder1->propertiesSize);
1058 		if (r != LZMA_OK) {
1059 			set_error(a, r);
1060 			return (ARCHIVE_FAILED);
1061 		}
1062 		fi++;
1063 
1064 		filters[fi].id = LZMA_VLI_UNKNOWN;
1065 		filters[fi].options = NULL;
1066 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1067 #if LZMA_VERSION < 50000030
1068 		free(ff->options);
1069 #endif
1070 		if (r != LZMA_OK) {
1071 			set_error(a, r);
1072 			return (ARCHIVE_FAILED);
1073 		}
1074 		zip->lzstream_valid = 1;
1075 		zip->lzstream.total_in = 0;
1076 		zip->lzstream.total_out = 0;
1077 		break;
1078 	}
1079 #else
1080 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1081 		    "LZMA codec is unsupported");
1082 		return (ARCHIVE_FAILED);
1083 #endif
1084 	case _7Z_BZ2:
1085 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1086 		if (zip->bzstream_valid) {
1087 			BZ2_bzDecompressEnd(&(zip->bzstream));
1088 			zip->bzstream_valid = 0;
1089 		}
1090 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1091 		if (r == BZ_MEM_ERROR)
1092 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1093 		if (r != BZ_OK) {
1094 			int err = ARCHIVE_ERRNO_MISC;
1095 			const char *detail = NULL;
1096 			switch (r) {
1097 			case BZ_PARAM_ERROR:
1098 				detail = "invalid setup parameter";
1099 				break;
1100 			case BZ_MEM_ERROR:
1101 				err = ENOMEM;
1102 				detail = "out of memory";
1103 				break;
1104 			case BZ_CONFIG_ERROR:
1105 				detail = "mis-compiled library";
1106 				break;
1107 			}
1108 			archive_set_error(&a->archive, err,
1109 			    "Internal error initializing decompressor: %s",
1110 			    detail == NULL ? "??" : detail);
1111 			zip->bzstream_valid = 0;
1112 			return (ARCHIVE_FAILED);
1113 		}
1114 		zip->bzstream_valid = 1;
1115 		zip->bzstream.total_in_lo32 = 0;
1116 		zip->bzstream.total_in_hi32 = 0;
1117 		zip->bzstream.total_out_lo32 = 0;
1118 		zip->bzstream.total_out_hi32 = 0;
1119 		break;
1120 #else
1121 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1122 		    "BZ2 codec is unsupported");
1123 		return (ARCHIVE_FAILED);
1124 #endif
1125 	case _7Z_DEFLATE:
1126 #ifdef HAVE_ZLIB_H
1127 		if (zip->stream_valid)
1128 			r = inflateReset(&(zip->stream));
1129 		else
1130 			r = inflateInit2(&(zip->stream),
1131 			    -15 /* Don't check for zlib header */);
1132 		if (r != Z_OK) {
1133 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1134 			    "Couldn't initialize zlib stream.");
1135 			return (ARCHIVE_FAILED);
1136 		}
1137 		zip->stream_valid = 1;
1138 		zip->stream.total_in = 0;
1139 		zip->stream.total_out = 0;
1140 		break;
1141 #else
1142 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1143 		    "DEFLATE codec is unsupported");
1144 		return (ARCHIVE_FAILED);
1145 #endif
1146 	case _7Z_PPMD:
1147 	{
1148 		unsigned order;
1149 		uint32_t msize;
1150 
1151 		if (zip->ppmd7_valid) {
1152 			__archive_ppmd7_functions.Ppmd7_Free(
1153 			    &zip->ppmd7_context, &g_szalloc);
1154 			zip->ppmd7_valid = 0;
1155 		}
1156 
1157 		if (coder1->propertiesSize < 5) {
1158 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1159 			    "Malformed PPMd parameter");
1160 			return (ARCHIVE_FAILED);
1161 		}
1162 		order = coder1->properties[0];
1163 		msize = archive_le32dec(&(coder1->properties[1]));
1164 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1165 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1166 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1167 			    "Malformed PPMd parameter");
1168 			return (ARCHIVE_FAILED);
1169 		}
1170 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1171 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1172 			&zip->ppmd7_context, msize, &g_szalloc);
1173 		if (r == 0) {
1174 			archive_set_error(&a->archive, ENOMEM,
1175 			    "Coludn't allocate memory for PPMd");
1176 			return (ARCHIVE_FATAL);
1177 		}
1178 		__archive_ppmd7_functions.Ppmd7_Init(
1179 			&zip->ppmd7_context, order);
1180 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1181 			&zip->range_dec);
1182 		zip->ppmd7_valid = 1;
1183 		zip->ppmd7_stat = 0;
1184 		zip->ppstream.overconsumed = 0;
1185 		zip->ppstream.total_in = 0;
1186 		zip->ppstream.total_out = 0;
1187 		break;
1188 	}
1189 	case _7Z_X86:
1190 	case _7Z_X86_BCJ2:
1191 	case _7Z_POWERPC:
1192 	case _7Z_IA64:
1193 	case _7Z_ARM:
1194 	case _7Z_ARMTHUMB:
1195 	case _7Z_SPARC:
1196 	case _7Z_DELTA:
1197 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1198 		    "Unexpected codec ID: %lX", zip->codec);
1199 		return (ARCHIVE_FAILED);
1200 	default:
1201 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1202 		    "Unknown codec ID: %lX", zip->codec);
1203 		return (ARCHIVE_FAILED);
1204 	}
1205 
1206 	return (ARCHIVE_OK);
1207 }
1208 
1209 static int
1210 decompress(struct archive_read *a, struct _7zip *zip,
1211     void *buff, size_t *outbytes, const void *b, size_t *used)
1212 {
1213 	const uint8_t *t_next_in;
1214 	uint8_t *t_next_out;
1215 	size_t o_avail_in, o_avail_out;
1216 	size_t t_avail_in, t_avail_out;
1217 	uint8_t *bcj2_next_out;
1218 	size_t bcj2_avail_out;
1219 	int r, ret = ARCHIVE_OK;
1220 
1221 	t_avail_in = o_avail_in = *used;
1222 	t_avail_out = o_avail_out = *outbytes;
1223 	t_next_in = b;
1224 	t_next_out = buff;
1225 
1226 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1227 		int i;
1228 
1229 		/* Do not copy out the BCJ remaining bytes when the output
1230 		 * buffer size is less than five bytes. */
1231 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1232 			*used = 0;
1233 			*outbytes = 0;
1234 			return (ret);
1235 		}
1236 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1237 			*t_next_out++ = zip->odd_bcj[i];
1238 			t_avail_out--;
1239 			zip->odd_bcj_size--;
1240 		}
1241 		if (o_avail_in == 0 || t_avail_out == 0) {
1242 			*used = o_avail_in - t_avail_in;
1243 			*outbytes = o_avail_out - t_avail_out;
1244 			if (o_avail_in == 0)
1245 				ret = ARCHIVE_EOF;
1246 			return (ret);
1247 		}
1248 	}
1249 
1250 	bcj2_next_out = t_next_out;
1251 	bcj2_avail_out = t_avail_out;
1252 	if (zip->codec2 == _7Z_X86_BCJ2) {
1253 		/*
1254 		 * Decord a remaining decompressed main stream for BCJ2.
1255 		 */
1256 		if (zip->tmp_stream_bytes_remaining) {
1257 			ssize_t bytes;
1258 			size_t remaining = zip->tmp_stream_bytes_remaining;
1259 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1260 			if (bytes < 0) {
1261 				archive_set_error(&(a->archive),
1262 				    ARCHIVE_ERRNO_MISC,
1263 				    "BCJ2 conversion Failed");
1264 				return (ARCHIVE_FAILED);
1265 			}
1266 			zip->main_stream_bytes_remaining -=
1267 			    remaining - zip->tmp_stream_bytes_remaining;
1268 			t_avail_out -= bytes;
1269 			if (o_avail_in == 0 || t_avail_out == 0) {
1270 				*used = 0;
1271 				*outbytes = o_avail_out - t_avail_out;
1272 				if (o_avail_in == 0 &&
1273 				    zip->tmp_stream_bytes_remaining)
1274 					ret = ARCHIVE_EOF;
1275 				return (ret);
1276 			}
1277 			t_next_out += bytes;
1278 			bcj2_next_out = t_next_out;
1279 			bcj2_avail_out = t_avail_out;
1280 		}
1281 		t_next_out = zip->tmp_stream_buff;
1282 		t_avail_out = zip->tmp_stream_buff_size;
1283 	}
1284 
1285 	switch (zip->codec) {
1286 	case _7Z_COPY:
1287 	{
1288 		size_t bytes =
1289 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1290 
1291 		memcpy(t_next_out, t_next_in, bytes);
1292 		t_avail_in -= bytes;
1293 		t_avail_out -= bytes;
1294 		if (o_avail_in == 0)
1295 			ret = ARCHIVE_EOF;
1296 		break;
1297 	}
1298 #ifdef HAVE_LZMA_H
1299 	case _7Z_LZMA: case _7Z_LZMA2:
1300 		zip->lzstream.next_in = t_next_in;
1301 		zip->lzstream.avail_in = t_avail_in;
1302 		zip->lzstream.next_out = t_next_out;
1303 		zip->lzstream.avail_out = t_avail_out;
1304 
1305 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1306 		switch (r) {
1307 		case LZMA_STREAM_END: /* Found end of stream. */
1308 			lzma_end(&(zip->lzstream));
1309 			zip->lzstream_valid = 0;
1310 			ret = ARCHIVE_EOF;
1311 			break;
1312 		case LZMA_OK: /* Decompressor made some progress. */
1313 			break;
1314 		default:
1315 			archive_set_error(&(a->archive),
1316 			    ARCHIVE_ERRNO_MISC,
1317 				"Decompression failed(%d)",
1318 			    r);
1319 			return (ARCHIVE_FAILED);
1320 		}
1321 		t_avail_in = zip->lzstream.avail_in;
1322 		t_avail_out = zip->lzstream.avail_out;
1323 		break;
1324 #endif
1325 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1326 	case _7Z_BZ2:
1327 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1328 		zip->bzstream.avail_in = t_avail_in;
1329 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1330 		zip->bzstream.avail_out = t_avail_out;
1331 		r = BZ2_bzDecompress(&(zip->bzstream));
1332 		switch (r) {
1333 		case BZ_STREAM_END: /* Found end of stream. */
1334 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1335 			case BZ_OK:
1336 				break;
1337 			default:
1338 				archive_set_error(&(a->archive),
1339 				    ARCHIVE_ERRNO_MISC,
1340 				    "Failed to clean up decompressor");
1341 				return (ARCHIVE_FAILED);
1342 			}
1343 			zip->bzstream_valid = 0;
1344 			ret = ARCHIVE_EOF;
1345 			break;
1346 		case BZ_OK: /* Decompressor made some progress. */
1347 			break;
1348 		default:
1349 			archive_set_error(&(a->archive),
1350 			    ARCHIVE_ERRNO_MISC,
1351 			    "bzip decompression failed");
1352 			return (ARCHIVE_FAILED);
1353 		}
1354 		t_avail_in = zip->bzstream.avail_in;
1355 		t_avail_out = zip->bzstream.avail_out;
1356 		break;
1357 #endif
1358 #ifdef HAVE_ZLIB_H
1359 	case _7Z_DEFLATE:
1360 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1361 		zip->stream.avail_in = t_avail_in;
1362 		zip->stream.next_out = t_next_out;
1363 		zip->stream.avail_out = t_avail_out;
1364 		r = inflate(&(zip->stream), 0);
1365 		switch (r) {
1366 		case Z_STREAM_END: /* Found end of stream. */
1367 			ret = ARCHIVE_EOF;
1368 			break;
1369 		case Z_OK: /* Decompressor made some progress.*/
1370 			break;
1371 		default:
1372 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1373 			    "File decompression failed (%d)", r);
1374 			return (ARCHIVE_FAILED);
1375 		}
1376 		t_avail_in = zip->stream.avail_in;
1377 		t_avail_out = zip->stream.avail_out;
1378 		break;
1379 #endif
1380 	case _7Z_PPMD:
1381 	{
1382 		uint64_t flush_bytes;
1383 
1384 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1385 		    t_avail_out <= 0) {
1386 			archive_set_error(&(a->archive),
1387 			    ARCHIVE_ERRNO_MISC,
1388 			    "Decompression internal error");
1389 			return (ARCHIVE_FAILED);
1390 		}
1391 		zip->ppstream.next_in = t_next_in;
1392 		zip->ppstream.avail_in = t_avail_in;
1393 		zip->ppstream.next_out = t_next_out;
1394 		zip->ppstream.avail_out = t_avail_out;
1395 		if (zip->ppmd7_stat == 0) {
1396 			zip->bytein.a = a;
1397 			zip->bytein.Read = &ppmd_read;
1398 			zip->range_dec.Stream = &zip->bytein;
1399 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1400 				&(zip->range_dec));
1401 			if (r == 0) {
1402 				zip->ppmd7_stat = -1;
1403 				archive_set_error(&a->archive,
1404 				    ARCHIVE_ERRNO_MISC,
1405 				    "Failed to initialize PPMd range decorder");
1406 				return (ARCHIVE_FAILED);
1407 			}
1408 			if (zip->ppstream.overconsumed) {
1409 				zip->ppmd7_stat = -1;
1410 				return (ARCHIVE_FAILED);
1411 			}
1412 			zip->ppmd7_stat = 1;
1413 		}
1414 
1415 		if (t_avail_in == 0)
1416 			/* XXX Flush out remaining decoded data XXX */
1417 			flush_bytes = zip->folder_outbytes_remaining;
1418 		else
1419 			flush_bytes = 0;
1420 
1421 		do {
1422 			int sym;
1423 
1424 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1425 				&(zip->ppmd7_context), &(zip->range_dec.p));
1426 			if (sym < 0) {
1427 				zip->ppmd7_stat = -1;
1428 				archive_set_error(&a->archive,
1429 				    ARCHIVE_ERRNO_FILE_FORMAT,
1430 				    "Failed to decode PPMd");
1431 				return (ARCHIVE_FAILED);
1432 			}
1433 			if (zip->ppstream.overconsumed) {
1434 				zip->ppmd7_stat = -1;
1435 				return (ARCHIVE_FAILED);
1436 			}
1437 			*zip->ppstream.next_out++ = (unsigned char)sym;
1438 			zip->ppstream.avail_out--;
1439 			zip->ppstream.total_out++;
1440 			if (flush_bytes)
1441 				flush_bytes--;
1442 		} while (zip->ppstream.avail_out &&
1443 			(zip->ppstream.avail_in || flush_bytes));
1444 
1445 		t_avail_in = zip->ppstream.avail_in;
1446 		t_avail_out = zip->ppstream.avail_out;
1447 		break;
1448 	}
1449 	default:
1450 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1451 		    "Decompression internal error");
1452 		return (ARCHIVE_FAILED);
1453 	}
1454 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1455 		return (ret);
1456 
1457 	*used = o_avail_in - t_avail_in;
1458 	*outbytes = o_avail_out - t_avail_out;
1459 
1460 	/*
1461 	 * Decord BCJ.
1462 	 */
1463 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1464 		size_t l = x86_Convert(zip, buff, *outbytes);
1465 		zip->odd_bcj_size = *outbytes - l;
1466 		if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1467 		    o_avail_in && ret != ARCHIVE_EOF) {
1468 			memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1469 			    zip->odd_bcj_size);
1470 			*outbytes = l;
1471 		} else
1472 			zip->odd_bcj_size = 0;
1473 	}
1474 
1475 	/*
1476 	 * Decord BCJ2 with a decompressed main stream.
1477 	 */
1478 	if (zip->codec2 == _7Z_X86_BCJ2) {
1479 		ssize_t bytes;
1480 
1481 		zip->tmp_stream_bytes_avail =
1482 		    zip->tmp_stream_buff_size - t_avail_out;
1483 		if (zip->tmp_stream_bytes_avail >
1484 		      zip->main_stream_bytes_remaining)
1485 			zip->tmp_stream_bytes_avail =
1486 			    zip->main_stream_bytes_remaining;
1487 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1488 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1489 		if (bytes < 0) {
1490 			archive_set_error(&(a->archive),
1491 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1492 			return (ARCHIVE_FAILED);
1493 		}
1494 		zip->main_stream_bytes_remaining -=
1495 		    zip->tmp_stream_bytes_avail
1496 		      - zip->tmp_stream_bytes_remaining;
1497 		bcj2_avail_out -= bytes;
1498 		*outbytes = o_avail_out - bcj2_avail_out;
1499 	}
1500 
1501 	return (ret);
1502 }
1503 
1504 static int
1505 free_decompression(struct archive_read *a, struct _7zip *zip)
1506 {
1507 	int r = ARCHIVE_OK;
1508 
1509 #ifdef HAVE_LZMA_H
1510 	if (zip->lzstream_valid)
1511 		lzma_end(&(zip->lzstream));
1512 #endif
1513 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1514 	if (zip->bzstream_valid) {
1515 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1516 			archive_set_error(&a->archive,
1517 			    ARCHIVE_ERRNO_MISC,
1518 			    "Failed to clean up bzip2 decompressor");
1519 			r = ARCHIVE_FATAL;
1520 		}
1521 		zip->bzstream_valid = 0;
1522 	}
1523 #endif
1524 #ifdef HAVE_ZLIB_H
1525 	if (zip->stream_valid) {
1526 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1527 			archive_set_error(&a->archive,
1528 			    ARCHIVE_ERRNO_MISC,
1529 			    "Failed to clean up zlib decompressor");
1530 			r = ARCHIVE_FATAL;
1531 		}
1532 		zip->stream_valid = 0;
1533 	}
1534 #endif
1535 	if (zip->ppmd7_valid) {
1536 		__archive_ppmd7_functions.Ppmd7_Free(
1537 			&zip->ppmd7_context, &g_szalloc);
1538 		zip->ppmd7_valid = 0;
1539 	}
1540 	return (r);
1541 }
1542 
1543 static int
1544 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1545 {
1546 	const unsigned char *p;
1547 	unsigned char avail, mask;
1548 	int i;
1549 
1550 	if ((p = header_bytes(a, 1)) == NULL)
1551 		return (-1);
1552 	avail = *p;
1553 	mask = 0x80;
1554 	*val = 0;
1555 	for (i = 0; i < 8; i++) {
1556 		if (avail & mask) {
1557 			if ((p = header_bytes(a, 1)) == NULL)
1558 				return (-1);
1559 			*val |= ((uint64_t)*p) << (8 * i);
1560 			mask >>= 1;
1561 			continue;
1562 		}
1563 		*val += (avail & (mask -1)) << (8 * i);
1564 		break;
1565 	}
1566 	return (0);
1567 }
1568 
1569 static int
1570 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1571 {
1572 	const unsigned char *p;
1573 	unsigned i, mask = 0, avail = 0;
1574 
1575 	for (i = 0; i < num; i++) {
1576 		if (mask == 0) {
1577 			if ((p = header_bytes(a, 1)) == NULL)
1578 				return (-1);
1579 			avail = *p;
1580 			mask = 0x80;
1581 		}
1582 		data[i] = (avail & mask)?1:0;
1583 		mask >>= 1;
1584 	}
1585 	return (0);
1586 }
1587 
1588 static void
1589 free_Digest(struct _7z_digests *d)
1590 {
1591 	free(d->defineds);
1592 	free(d->digests);
1593 }
1594 
1595 static int
1596 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1597 {
1598 	const unsigned char *p;
1599 	unsigned i;
1600 
1601 	memset(d, 0, sizeof(*d));
1602 
1603 
1604 	d->defineds = malloc(num);
1605 	if (d->defineds == NULL)
1606 		return (-1);
1607 	/*
1608 	 * Read Bools.
1609 	 */
1610 	if ((p = header_bytes(a, 1)) == NULL)
1611 		return (-1);
1612 	if (*p == 0) {
1613 		if (read_Bools(a, d->defineds, num) < 0)
1614 			return (-1);
1615 	} else
1616 		/* All are defined */
1617 		memset(d->defineds, 1, num);
1618 
1619 	d->digests = calloc(num, sizeof(*d->digests));
1620 	if (d->digests == NULL)
1621 		return (-1);
1622 	for (i = 0; i < num; i++) {
1623 		if (d->defineds[i]) {
1624 			if ((p = header_bytes(a, 4)) == NULL)
1625 				return (-1);
1626 			d->digests[i] = archive_le32dec(p);
1627 		}
1628 	}
1629 
1630 	return (0);
1631 }
1632 
1633 static void
1634 free_PackInfo(struct _7z_pack_info *pi)
1635 {
1636 	free(pi->sizes);
1637 	free(pi->positions);
1638 	free_Digest(&(pi->digest));
1639 }
1640 
1641 static int
1642 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1643 {
1644 	const unsigned char *p;
1645 	unsigned i;
1646 
1647 	memset(pi, 0, sizeof(*pi));
1648 
1649 	/*
1650 	 * Read PackPos.
1651 	 */
1652 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1653 		return (-1);
1654 
1655 	/*
1656 	 * Read NumPackStreams.
1657 	 */
1658 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1659 		return (-1);
1660 	if (pi->numPackStreams == 0)
1661 		return (-1);
1662 	if (1000000 < pi->numPackStreams)
1663 		return (-1);
1664 
1665 	/*
1666 	 * Read PackSizes[num]
1667 	 */
1668 	if ((p = header_bytes(a, 1)) == NULL)
1669 		return (-1);
1670 	if (*p == kEnd)
1671 		/* PackSizes[num] are not present. */
1672 		return (0);
1673 	if (*p != kSize)
1674 		return (-1);
1675 	pi->sizes = calloc(pi->numPackStreams, sizeof(uint64_t));
1676 	pi->positions = calloc(pi->numPackStreams, sizeof(uint64_t));
1677 	if (pi->sizes == NULL || pi->positions == NULL)
1678 		return (-1);
1679 
1680 	for (i = 0; i < pi->numPackStreams; i++) {
1681 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1682 			return (-1);
1683 	}
1684 
1685 	/*
1686 	 * Read PackStreamDigests[num]
1687 	 */
1688 	if ((p = header_bytes(a, 1)) == NULL)
1689 		return (-1);
1690 	if (*p == kEnd) {
1691 		/* PackStreamDigests[num] are not present. */
1692 		pi->digest.defineds =
1693 		    calloc(pi->numPackStreams, sizeof(*pi->digest.defineds));
1694 		pi->digest.digests =
1695 		    calloc(pi->numPackStreams, sizeof(*pi->digest.digests));
1696 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1697 			return (-1);
1698 		return (0);
1699 	}
1700 
1701 	if (*p != kSize)
1702 		return (-1);
1703 
1704 	if (read_Digests(a, &(pi->digest), pi->numPackStreams) < 0)
1705 		return (-1);
1706 
1707 	/*
1708 	 *  Must be marked by kEnd.
1709 	 */
1710 	if ((p = header_bytes(a, 1)) == NULL)
1711 		return (-1);
1712 	if (*p != kEnd)
1713 		return (-1);
1714 	return (0);
1715 }
1716 
1717 static void
1718 free_Folder(struct _7z_folder *f)
1719 {
1720 	unsigned i;
1721 
1722 	if (f->coders) {
1723 		for (i = 0; i< f->numCoders; i++) {
1724 			free(f->coders[i].properties);
1725 		}
1726 		free(f->coders);
1727 	}
1728 	free(f->bindPairs);
1729 	free(f->packedStreams);
1730 	free(f->unPackSize);
1731 }
1732 
1733 static int
1734 read_Folder(struct archive_read *a, struct _7z_folder *f)
1735 {
1736 	struct _7zip *zip = (struct _7zip *)a->format->data;
1737 	const unsigned char *p;
1738 	uint64_t numInStreamsTotal = 0;
1739 	uint64_t numOutStreamsTotal = 0;
1740 	unsigned i;
1741 
1742 	memset(f, 0, sizeof(*f));
1743 
1744 	/*
1745 	 * Read NumCoders.
1746 	 */
1747 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1748 		return (-1);
1749 	if (f->numCoders > 4)
1750 		/* Too many coders. */
1751 		return (-1);
1752 
1753 	f->coders = calloc(f->numCoders, sizeof(*f->coders));
1754 	if (f->coders == NULL)
1755 		return (-1);
1756 	for (i = 0; i< f->numCoders; i++) {
1757 		size_t codec_size;
1758 		int simple, attr;
1759 
1760 		if ((p = header_bytes(a, 1)) == NULL)
1761 			return (-1);
1762 		/*
1763 		 * 0:3 CodecIdSize
1764 		 * 4:  0 - IsSimple
1765 		 *     1 - Is not Simple
1766 		 * 5:  0 - No Attributes
1767 		 *     1 - There are Attributes;
1768 		 * 7:  Must be zero.
1769 		 */
1770 		codec_size = *p & 0xf;
1771 		simple = (*p & 0x10)?0:1;
1772 		attr = *p & 0x20;
1773 		if (*p & 0x80)
1774 			return (-1);/* Not supported. */
1775 
1776 		/*
1777 		 * Read Decompression Method IDs.
1778 		 */
1779 		if ((p = header_bytes(a, codec_size)) == NULL)
1780 			return (-1);
1781 
1782 		f->coders[i].codec = decode_codec_id(p, codec_size);
1783 
1784 		if (simple) {
1785 			f->coders[i].numInStreams = 1;
1786 			f->coders[i].numOutStreams = 1;
1787 		} else {
1788 			if (parse_7zip_uint64(
1789 			    a, &(f->coders[i].numInStreams)) < 0)
1790 				return (-1);
1791 			if (1000000 < f->coders[i].numInStreams)
1792 				return (-1);
1793 			if (parse_7zip_uint64(
1794 			    a, &(f->coders[i].numOutStreams)) < 0)
1795 				return (-1);
1796 			if (1000000 < f->coders[i].numOutStreams)
1797 				return (-1);
1798 		}
1799 
1800 		if (attr) {
1801 			if (parse_7zip_uint64(
1802 			    a, &(f->coders[i].propertiesSize)) < 0)
1803 				return (-1);
1804 			if ((p = header_bytes(
1805 			    a, f->coders[i].propertiesSize)) == NULL)
1806 				return (-1);
1807 			f->coders[i].properties =
1808 			    malloc(f->coders[i].propertiesSize);
1809 			if (f->coders[i].properties == NULL)
1810 				return (-1);
1811 			memcpy(f->coders[i].properties, p,
1812 			    f->coders[i].propertiesSize);
1813 		}
1814 
1815 		numInStreamsTotal += f->coders[i].numInStreams;
1816 		numOutStreamsTotal += f->coders[i].numOutStreams;
1817 	}
1818 
1819 	if (numOutStreamsTotal == 0 ||
1820 	    numInStreamsTotal < numOutStreamsTotal-1)
1821 		return (-1);
1822 
1823 	f->numBindPairs = numOutStreamsTotal - 1;
1824 	if (zip->header_bytes_remaining < f->numBindPairs)
1825 			return (-1);
1826 	f->bindPairs = calloc(f->numBindPairs, sizeof(*f->bindPairs));
1827 	if (f->bindPairs == NULL)
1828 		return (-1);
1829 	for (i = 0; i < f->numBindPairs; i++) {
1830 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
1831 			return (-1);
1832 		if (1000000 < f->bindPairs[i].inIndex)
1833 			return (-1);
1834 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
1835 			return (-1);
1836 		if (1000000 < f->bindPairs[i].outIndex)
1837 			return (-1);
1838 	}
1839 
1840 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
1841 	f->packedStreams =
1842 	    calloc(f->numPackedStreams, sizeof(*f->packedStreams));
1843 	if (f->packedStreams == NULL)
1844 		return (-1);
1845 	if (f->numPackedStreams == 1) {
1846 		for (i = 0; i < numInStreamsTotal; i++) {
1847 			unsigned j;
1848 			for (j = 0; j < f->numBindPairs; j++) {
1849 				if (f->bindPairs[j].inIndex == i)
1850 					break;
1851 			}
1852 			if (j == f->numBindPairs)
1853 				break;
1854 		}
1855 		if (i == numInStreamsTotal)
1856 			return (-1);
1857 		f->packedStreams[0] = i;
1858 	} else {
1859 		for (i = 0; i < f->numPackedStreams; i++) {
1860 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
1861 				return (-1);
1862 			if (1000000 < f->packedStreams[i])
1863 				return (-1);
1864 		}
1865 	}
1866 	f->numInStreams = numInStreamsTotal;
1867 	f->numOutStreams = numOutStreamsTotal;
1868 
1869 	return (0);
1870 }
1871 
1872 static void
1873 free_CodersInfo(struct _7z_coders_info *ci)
1874 {
1875 	unsigned i;
1876 
1877 	if (ci->folders) {
1878 		for (i = 0; i < ci->numFolders; i++)
1879 			free_Folder(&(ci->folders[i]));
1880 		free(ci->folders);
1881 	}
1882 }
1883 
1884 static int
1885 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
1886 {
1887 	const unsigned char *p;
1888 	struct _7z_digests digest;
1889 	unsigned i;
1890 
1891 	memset(ci, 0, sizeof(*ci));
1892 	memset(&digest, 0, sizeof(digest));
1893 
1894 	if ((p = header_bytes(a, 1)) == NULL)
1895 		goto failed;
1896 	if (*p != kFolder)
1897 		goto failed;
1898 
1899 	/*
1900 	 * Read NumFolders.
1901 	 */
1902 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
1903 		goto failed;
1904 	if (1000000 < ci->numFolders)
1905 			return (-1);
1906 
1907 	/*
1908 	 * Read External.
1909 	 */
1910 	if ((p = header_bytes(a, 1)) == NULL)
1911 		goto failed;
1912 	switch (*p) {
1913 	case 0:
1914 		ci->folders = calloc(ci->numFolders, sizeof(*ci->folders));
1915 		if (ci->folders == NULL)
1916 			return (-1);
1917 		for (i = 0; i < ci->numFolders; i++) {
1918 			if (read_Folder(a, &(ci->folders[i])) < 0)
1919 				goto failed;
1920 		}
1921 		break;
1922 	case 1:
1923 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
1924 			return (-1);
1925 		if (1000000 < ci->dataStreamIndex)
1926 			return (-1);
1927 		break;
1928 	}
1929 
1930 	if ((p = header_bytes(a, 1)) == NULL)
1931 		goto failed;
1932 	if (*p != kCodersUnPackSize)
1933 		goto failed;
1934 
1935 	for (i = 0; i < ci->numFolders; i++) {
1936 		struct _7z_folder *folder = &(ci->folders[i]);
1937 		unsigned j;
1938 
1939 		folder->unPackSize =
1940 		    calloc(folder->numOutStreams, sizeof(*folder->unPackSize));
1941 		if (folder->unPackSize == NULL)
1942 			goto failed;
1943 		for (j = 0; j < folder->numOutStreams; j++) {
1944 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
1945 				goto failed;
1946 		}
1947 	}
1948 
1949 	/*
1950 	 * Read CRCs.
1951 	 */
1952 	if ((p = header_bytes(a, 1)) == NULL)
1953 		goto failed;
1954 	if (*p == kEnd)
1955 		return (0);
1956 	if (*p != kCRC)
1957 		goto failed;
1958 	if (read_Digests(a, &digest, ci->numFolders) < 0)
1959 		goto failed;
1960 	for (i = 0; i < ci->numFolders; i++) {
1961 		ci->folders[i].digest_defined = digest.defineds[i];
1962 		ci->folders[i].digest = digest.digests[i];
1963 	}
1964 
1965 	/*
1966 	 *  Must be kEnd.
1967 	 */
1968 	if ((p = header_bytes(a, 1)) == NULL)
1969 		goto failed;
1970 	if (*p != kEnd)
1971 		goto failed;
1972 	free_Digest(&digest);
1973 	return (0);
1974 failed:
1975 	free_Digest(&digest);
1976 	return (-1);
1977 }
1978 
1979 static uint64_t
1980 folder_uncompressed_size(struct _7z_folder *f)
1981 {
1982 	int n = f->numOutStreams;
1983 	unsigned pairs = f->numBindPairs;
1984 
1985 	while (--n >= 0) {
1986 		unsigned i;
1987 		for (i = 0; i < pairs; i++) {
1988 			if (f->bindPairs[i].outIndex == n)
1989 				break;
1990 		}
1991 		if (i >= pairs)
1992 			return (f->unPackSize[n]);
1993 	}
1994 	return (0);
1995 }
1996 
1997 static void
1998 free_SubStreamsInfo(struct _7z_substream_info *ss)
1999 {
2000 	free(ss->unpackSizes);
2001 	free(ss->digestsDefined);
2002 	free(ss->digests);
2003 }
2004 
2005 static int
2006 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2007     struct _7z_folder *f, size_t numFolders)
2008 {
2009 	const unsigned char *p;
2010 	uint64_t *usizes;
2011 	size_t unpack_streams;
2012 	int type;
2013 	unsigned i;
2014 	uint32_t numDigests;
2015 
2016 	memset(ss, 0, sizeof(*ss));
2017 
2018 	for (i = 0; i < numFolders; i++)
2019 		f[i].numUnpackStreams = 1;
2020 
2021 	if ((p = header_bytes(a, 1)) == NULL)
2022 		return (-1);
2023 	type = *p;
2024 
2025 	if (type == kNumUnPackStream) {
2026 		unpack_streams = 0;
2027 		for (i = 0; i < numFolders; i++) {
2028 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2029 				return (-1);
2030 			if (1000000 < f[i].numUnpackStreams)
2031 				return (-1);
2032 			unpack_streams += f[i].numUnpackStreams;
2033 		}
2034 		if ((p = header_bytes(a, 1)) == NULL)
2035 			return (-1);
2036 		type = *p;
2037 	} else
2038 		unpack_streams = numFolders;
2039 
2040 	ss->unpack_streams = unpack_streams;
2041 	if (unpack_streams) {
2042 		ss->unpackSizes = calloc(unpack_streams,
2043 		    sizeof(*ss->unpackSizes));
2044 		ss->digestsDefined = calloc(unpack_streams,
2045 		    sizeof(*ss->digestsDefined));
2046 		ss->digests = calloc(unpack_streams,
2047 		    sizeof(*ss->digests));
2048 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2049 		    ss->digests == NULL)
2050 			return (-1);
2051 	}
2052 
2053 	usizes = ss->unpackSizes;
2054 	for (i = 0; i < numFolders; i++) {
2055 		unsigned pack;
2056 		uint64_t sum;
2057 
2058 		if (f[i].numUnpackStreams == 0)
2059 			continue;
2060 
2061 		sum = 0;
2062 		if (type == kSize) {
2063 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2064 				if (parse_7zip_uint64(a, usizes) < 0)
2065 					return (-1);
2066 				sum += *usizes++;
2067 			}
2068 		}
2069 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2070 	}
2071 
2072 	if (type == kSize) {
2073 		if ((p = header_bytes(a, 1)) == NULL)
2074 			return (-1);
2075 		type = *p;
2076 	}
2077 
2078 	for (i = 0; i < unpack_streams; i++) {
2079 		ss->digestsDefined[i] = 0;
2080 		ss->digests[i] = 0;
2081 	}
2082 
2083 	numDigests = 0;
2084 	for (i = 0; i < numFolders; i++) {
2085 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2086 			numDigests += f[i].numUnpackStreams;
2087 	}
2088 
2089 	if (type == kCRC) {
2090 		struct _7z_digests tmpDigests;
2091 		unsigned char *digestsDefined = ss->digestsDefined;
2092 		uint32_t * digests = ss->digests;
2093 		int di = 0;
2094 
2095 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2096 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2097 			free_Digest(&tmpDigests);
2098 			return (-1);
2099 		}
2100 		for (i = 0; i < numFolders; i++) {
2101 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2102 				*digestsDefined++ = 1;
2103 				*digests++ = f[i].digest;
2104 			} else {
2105 				unsigned j;
2106 
2107 				for (j = 0; j < f[i].numUnpackStreams;
2108 				    j++, di++) {
2109 					*digestsDefined++ =
2110 					    tmpDigests.defineds[di];
2111 					*digests++ =
2112 					    tmpDigests.digests[di];
2113 				}
2114 			}
2115 		}
2116 		free_Digest(&tmpDigests);
2117 		if ((p = header_bytes(a, 1)) == NULL)
2118 			return (-1);
2119 		type = *p;
2120 	}
2121 
2122 	/*
2123 	 *  Must be kEnd.
2124 	 */
2125 	if (type != kEnd)
2126 		return (-1);
2127 	return (0);
2128 }
2129 
2130 static void
2131 free_StreamsInfo(struct _7z_stream_info *si)
2132 {
2133 	free_PackInfo(&(si->pi));
2134 	free_CodersInfo(&(si->ci));
2135 	free_SubStreamsInfo(&(si->ss));
2136 }
2137 
2138 static int
2139 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2140 {
2141 	struct _7zip *zip = (struct _7zip *)a->format->data;
2142 	const unsigned char *p;
2143 	unsigned i;
2144 
2145 	memset(si, 0, sizeof(*si));
2146 
2147 	if ((p = header_bytes(a, 1)) == NULL)
2148 		return (-1);
2149 	if (*p == kPackInfo) {
2150 		uint64_t packPos;
2151 
2152 		if (read_PackInfo(a, &(si->pi)) < 0)
2153 			return (-1);
2154 
2155 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2156 			return (-1);
2157 		/*
2158 		 * Calculate packed stream positions.
2159 		 */
2160 		packPos = si->pi.pos;
2161 		for (i = 0; i < si->pi.numPackStreams; i++) {
2162 			si->pi.positions[i] = packPos;
2163 			packPos += si->pi.sizes[i];
2164 			if (packPos > zip->header_offset)
2165 				return (-1);
2166 		}
2167 		if ((p = header_bytes(a, 1)) == NULL)
2168 			return (-1);
2169 	}
2170 	if (*p == kUnPackInfo) {
2171 		uint32_t packIndex;
2172 		struct _7z_folder *f;
2173 
2174 		if (read_CodersInfo(a, &(si->ci)) < 0)
2175 			return (-1);
2176 
2177 		/*
2178 		 * Calculate packed stream indexes.
2179 		 */
2180 		packIndex = 0;
2181 		f = si->ci.folders;
2182 		for (i = 0; i < si->ci.numFolders; i++) {
2183 			f[i].packIndex = packIndex;
2184 			packIndex += f[i].numPackedStreams;
2185 			if (packIndex > si->pi.numPackStreams)
2186 				return (-1);
2187 		}
2188 		if ((p = header_bytes(a, 1)) == NULL)
2189 			return (-1);
2190 	}
2191 
2192 	if (*p == kSubStreamsInfo) {
2193 		if (read_SubStreamsInfo(a, &(si->ss),
2194 		    si->ci.folders, si->ci.numFolders) < 0)
2195 			return (-1);
2196 		if ((p = header_bytes(a, 1)) == NULL)
2197 			return (-1);
2198 	}
2199 
2200 	/*
2201 	 *  Must be kEnd.
2202 	 */
2203 	if (*p != kEnd)
2204 		return (-1);
2205 	return (0);
2206 }
2207 
2208 static void
2209 free_Header(struct _7z_header_info *h)
2210 {
2211 	free(h->emptyStreamBools);
2212 	free(h->emptyFileBools);
2213 	free(h->antiBools);
2214 	free(h->attrBools);
2215 }
2216 
2217 static int
2218 read_Header(struct archive_read *a, struct _7z_header_info *h,
2219     int check_header_id)
2220 {
2221 	struct _7zip *zip = (struct _7zip *)a->format->data;
2222 	const unsigned char *p;
2223 	struct _7z_folder *folders;
2224 	struct _7z_stream_info *si = &(zip->si);
2225 	struct _7zip_entry *entries;
2226 	uint32_t folderIndex, indexInFolder;
2227 	unsigned i;
2228 	int eindex, empty_streams, sindex;
2229 
2230 	if (check_header_id) {
2231 		/*
2232 		 * Read Header.
2233 		 */
2234 		if ((p = header_bytes(a, 1)) == NULL)
2235 			return (-1);
2236 		if (*p != kHeader)
2237 			return (-1);
2238 	}
2239 
2240 	/*
2241 	 * Read ArchiveProperties.
2242 	 */
2243 	if ((p = header_bytes(a, 1)) == NULL)
2244 		return (-1);
2245 	if (*p == kArchiveProperties) {
2246 		for (;;) {
2247 			uint64_t size;
2248 			if ((p = header_bytes(a, 1)) == NULL)
2249 				return (-1);
2250 			if (*p == 0)
2251 				break;
2252 			if (parse_7zip_uint64(a, &size) < 0)
2253 				return (-1);
2254 		}
2255 		if ((p = header_bytes(a, 1)) == NULL)
2256 			return (-1);
2257 	}
2258 
2259 	/*
2260 	 * Read MainStreamsInfo.
2261 	 */
2262 	if (*p == kMainStreamsInfo) {
2263 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2264 			return (-1);
2265 		if ((p = header_bytes(a, 1)) == NULL)
2266 			return (-1);
2267 	}
2268 	if (*p == kEnd)
2269 		return (0);
2270 
2271 	/*
2272 	 * Read FilesInfo.
2273 	 */
2274 	if (*p != kFilesInfo)
2275 		return (-1);
2276 
2277 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2278 		return (-1);
2279 	if (1000000 < zip->numFiles)
2280 			return (-1);
2281 
2282 	zip->entries = calloc(zip->numFiles, sizeof(*zip->entries));
2283 	if (zip->entries == NULL)
2284 		return (-1);
2285 	entries = zip->entries;
2286 
2287 	empty_streams = 0;
2288 	for (;;) {
2289 		int type;
2290 		uint64_t size;
2291 		size_t ll;
2292 
2293 		if ((p = header_bytes(a, 1)) == NULL)
2294 			return (-1);
2295 		type = *p;
2296 		if (type == kEnd)
2297 			break;
2298 
2299 		if (parse_7zip_uint64(a, &size) < 0)
2300 			return (-1);
2301 		if (zip->header_bytes_remaining < size)
2302 			return (-1);
2303 		ll = (size_t)size;
2304 
2305 		switch (type) {
2306 		case kEmptyStream:
2307 			h->emptyStreamBools = calloc(zip->numFiles,
2308 			    sizeof(*h->emptyStreamBools));
2309 			if (h->emptyStreamBools == NULL)
2310 				return (-1);
2311 			if (read_Bools(
2312 			    a, h->emptyStreamBools, zip->numFiles) < 0)
2313 				return (-1);
2314 			empty_streams = 0;
2315 			for (i = 0; i < zip->numFiles; i++) {
2316 				if (h->emptyStreamBools[i])
2317 					empty_streams++;
2318 			}
2319 			break;
2320 		case kEmptyFile:
2321 			h->emptyFileBools = calloc(empty_streams,
2322 			    sizeof(*h->emptyFileBools));
2323 			if (h->emptyFileBools == NULL)
2324 				return (-1);
2325 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2326 				return (-1);
2327 			break;
2328 		case kAnti:
2329 			h->antiBools = calloc(empty_streams,
2330 			    sizeof(*h->antiBools));
2331 			if (h->antiBools == NULL)
2332 				return (-1);
2333 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2334 				return (-1);
2335 			break;
2336 		case kCTime:
2337 		case kATime:
2338 		case kMTime:
2339 			if (read_Times(a, h, type) < 0)
2340 				return (-1);
2341 			break;
2342 		case kName:
2343 		{
2344 			unsigned char *np;
2345 			size_t nl, nb;
2346 
2347 			/* Skip one byte. */
2348 			if ((p = header_bytes(a, 1)) == NULL)
2349 				return (-1);
2350 			ll--;
2351 
2352 			if ((ll & 1) || ll < zip->numFiles * 4)
2353 				return (-1);
2354 
2355 			zip->entry_names = malloc(ll);
2356 			if (zip->entry_names == NULL)
2357 				return (-1);
2358 			np = zip->entry_names;
2359 			nb = ll;
2360 			/*
2361 			 * Copy whole file names.
2362 			 * NOTE: This loop prevents from expanding
2363 			 * the uncompressed buffer in order not to
2364 			 * use extra memory resource.
2365 			 */
2366 			while (nb) {
2367 				size_t b;
2368 				if (nb > UBUFF_SIZE)
2369 					b = UBUFF_SIZE;
2370 				else
2371 					b = nb;
2372 				if ((p = header_bytes(a, b)) == NULL)
2373 					return (-1);
2374 				memcpy(np, p, b);
2375 				np += b;
2376 				nb -= b;
2377 			}
2378 			np = zip->entry_names;
2379 			nl = ll;
2380 
2381 			for (i = 0; i < zip->numFiles; i++) {
2382 				entries[i].utf16name = np;
2383 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2384 				entries[i].wname = (wchar_t *)np;
2385 #endif
2386 
2387 				/* Find a terminator. */
2388 				while (nl >= 2 && (np[0] || np[1])) {
2389 					np += 2;
2390 					nl -= 2;
2391 				}
2392 				if (nl < 2)
2393 					return (-1);/* Terminator not found */
2394 				entries[i].name_len = np - entries[i].utf16name;
2395 				np += 2;
2396 				nl -= 2;
2397 			}
2398 			break;
2399 		}
2400 		case kAttributes:
2401 		{
2402 			int allAreDefined;
2403 
2404 			if ((p = header_bytes(a, 2)) == NULL)
2405 				return (-1);
2406 			allAreDefined = *p;
2407 			h->attrBools = calloc(zip->numFiles,
2408 			    sizeof(*h->attrBools));
2409 			if (h->attrBools == NULL)
2410 				return (-1);
2411 			if (allAreDefined)
2412 				memset(h->attrBools, 1, zip->numFiles);
2413 			else {
2414 				if (read_Bools(a, h->attrBools,
2415 				      zip->numFiles) < 0)
2416 					return (-1);
2417 			}
2418 			for (i = 0; i < zip->numFiles; i++) {
2419 				if (h->attrBools[i]) {
2420 					if ((p = header_bytes(a, 4)) == NULL)
2421 						return (-1);
2422 					entries[i].attr = archive_le32dec(p);
2423 				}
2424 			}
2425 			break;
2426 		}
2427 		default:
2428 			if (header_bytes(a, ll) == NULL)
2429 				return (-1);
2430 			break;
2431 		}
2432 	}
2433 
2434 	/*
2435 	 * Set up entry's attributes.
2436 	 */
2437 	folders = si->ci.folders;
2438 	eindex = sindex = 0;
2439 	folderIndex = indexInFolder = 0;
2440 	for (i = 0; i < zip->numFiles; i++) {
2441 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2442 			entries[i].flg |= HAS_STREAM;
2443 		/* The high 16 bits of attributes is a posix file mode. */
2444 		entries[i].mode = entries[i].attr >> 16;
2445 		if (entries[i].flg & HAS_STREAM) {
2446 			if ((size_t)sindex >= si->ss.unpack_streams)
2447 				return (-1);
2448 			if (entries[i].mode == 0)
2449 				entries[i].mode = AE_IFREG | 0777;
2450 			if (si->ss.digestsDefined[sindex])
2451 				entries[i].flg |= CRC32_IS_SET;
2452 			entries[i].ssIndex = sindex;
2453 			sindex++;
2454 		} else {
2455 			int dir;
2456 			if (h->emptyFileBools == NULL)
2457 				dir = 1;
2458 			else {
2459 				if (h->emptyFileBools[eindex])
2460 					dir = 0;
2461 				else
2462 					dir = 1;
2463 				eindex++;
2464 			}
2465 			if (entries[i].mode == 0) {
2466 				if (dir)
2467 					entries[i].mode = AE_IFDIR | 0777;
2468 				else
2469 					entries[i].mode = AE_IFREG | 0777;
2470 			} else if (dir &&
2471 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2472 				entries[i].mode &= ~AE_IFMT;
2473 				entries[i].mode |= AE_IFDIR;
2474 			}
2475 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2476 			    entries[i].name_len >= 2 &&
2477 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2478 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2479 				entries[i].utf16name[entries[i].name_len] = '/';
2480 				entries[i].utf16name[entries[i].name_len+1] = 0;
2481 				entries[i].name_len += 2;
2482 			}
2483 			entries[i].ssIndex = -1;
2484 		}
2485 		if (entries[i].attr & 0x01)
2486 			entries[i].mode &= ~0222;/* Read only. */
2487 
2488 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2489 			/*
2490 			 * The entry is an empty file or a directory file,
2491 			 * those both have no contents.
2492 			 */
2493 			entries[i].folderIndex = -1;
2494 			continue;
2495 		}
2496 		if (indexInFolder == 0) {
2497 			for (;;) {
2498 				if (folderIndex >= si->ci.numFolders)
2499 					return (-1);
2500 				if (folders[folderIndex].numUnpackStreams)
2501 					break;
2502 				folderIndex++;
2503 			}
2504 		}
2505 		entries[i].folderIndex = folderIndex;
2506 		if ((entries[i].flg & HAS_STREAM) == 0)
2507 			continue;
2508 		indexInFolder++;
2509 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2510 			folderIndex++;
2511 			indexInFolder = 0;
2512 		}
2513 	}
2514 
2515 	return (0);
2516 }
2517 
2518 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2519 static void
2520 fileTimeToUtc(uint64_t fileTime, time_t *time, long *ns)
2521 {
2522 
2523 	if (fileTime >= EPOC_TIME) {
2524 		fileTime -= EPOC_TIME;
2525 		/* milli seconds base */
2526 		*time = (time_t)(fileTime / 10000000);
2527 		/* nano seconds base */
2528 		*ns = (long)(fileTime % 10000000) * 100;
2529 	} else {
2530 		*time = 0;
2531 		*ns = 0;
2532 	}
2533 }
2534 
2535 static int
2536 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2537 {
2538 	struct _7zip *zip = (struct _7zip *)a->format->data;
2539 	const unsigned char *p;
2540 	struct _7zip_entry *entries = zip->entries;
2541 	unsigned char *timeBools;
2542 	int allAreDefined;
2543 	unsigned i;
2544 
2545 	timeBools = calloc(zip->numFiles, sizeof(*timeBools));
2546 	if (timeBools == NULL)
2547 		return (-1);
2548 
2549 	/* Read allAreDefined. */
2550 	if ((p = header_bytes(a, 1)) == NULL)
2551 		goto failed;
2552 	allAreDefined = *p;
2553 	if (allAreDefined)
2554 		memset(timeBools, 1, zip->numFiles);
2555 	else {
2556 		if (read_Bools(a, timeBools, zip->numFiles) < 0)
2557 			goto failed;
2558 	}
2559 
2560 	/* Read external. */
2561 	if ((p = header_bytes(a, 1)) == NULL)
2562 		goto failed;
2563 	if (*p) {
2564 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2565 			goto failed;
2566 		if (1000000 < h->dataIndex)
2567 			return (-1);
2568 	}
2569 
2570 	for (i = 0; i < zip->numFiles; i++) {
2571 		if (!timeBools[i])
2572 			continue;
2573 		if ((p = header_bytes(a, 8)) == NULL)
2574 			goto failed;
2575 		switch (type) {
2576 		case kCTime:
2577 			fileTimeToUtc(archive_le64dec(p),
2578 			    &(entries[i].ctime),
2579 			    &(entries[i].ctime_ns));
2580 			entries[i].flg |= CTIME_IS_SET;
2581 			break;
2582 		case kATime:
2583 			fileTimeToUtc(archive_le64dec(p),
2584 			    &(entries[i].atime),
2585 			    &(entries[i].atime_ns));
2586 			entries[i].flg |= ATIME_IS_SET;
2587 			break;
2588 		case kMTime:
2589 			fileTimeToUtc(archive_le64dec(p),
2590 			    &(entries[i].mtime),
2591 			    &(entries[i].mtime_ns));
2592 			entries[i].flg |= MTIME_IS_SET;
2593 			break;
2594 		}
2595 	}
2596 
2597 	free(timeBools);
2598 	return (0);
2599 failed:
2600 	free(timeBools);
2601 	return (-1);
2602 }
2603 
2604 static int
2605 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2606 {
2607 	struct _7zip *zip = (struct _7zip *)a->format->data;
2608 
2609 	errno = 0;
2610 	if (read_StreamsInfo(a, si) < 0) {
2611 		if (errno == ENOMEM)
2612 			archive_set_error(&a->archive, -1,
2613 			    "Couldn't allocate memory");
2614 		else
2615 			archive_set_error(&a->archive, -1,
2616 			    "Malformed 7-Zip archive");
2617 		return (ARCHIVE_FATAL);
2618 	}
2619 
2620 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2621 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2622 		return (ARCHIVE_FATAL);
2623 	}
2624 
2625 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2626 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2627 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2628 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2629 		return (ARCHIVE_FATAL);
2630 	}
2631 
2632 	return (ARCHIVE_OK);
2633 }
2634 
2635 static const unsigned char *
2636 header_bytes(struct archive_read *a, size_t rbytes)
2637 {
2638 	struct _7zip *zip = (struct _7zip *)a->format->data;
2639 	const unsigned char *p;
2640 
2641 	if (zip->header_bytes_remaining < rbytes)
2642 		return (NULL);
2643 	if (zip->pack_stream_bytes_unconsumed)
2644 		read_consume(a);
2645 
2646 	if (zip->header_is_encoded == 0) {
2647 		p = __archive_read_ahead(a, rbytes, NULL);
2648 		if (p == NULL)
2649 			return (NULL);
2650 		zip->header_bytes_remaining -= rbytes;
2651 		zip->pack_stream_bytes_unconsumed = rbytes;
2652 	} else {
2653 		const void *buff;
2654 		ssize_t bytes;
2655 
2656 		bytes = read_stream(a, &buff, rbytes, rbytes);
2657 		if (bytes <= 0)
2658 			return (NULL);
2659 		zip->header_bytes_remaining -= bytes;
2660 		p = buff;
2661 	}
2662 
2663 	/* Update checksum */
2664 	zip->header_crc32 = crc32(zip->header_crc32, p, rbytes);
2665 	return (p);
2666 }
2667 
2668 static int
2669 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2670     struct _7z_header_info *header)
2671 {
2672 	const unsigned char *p;
2673 	uint64_t next_header_offset;
2674 	uint64_t next_header_size;
2675 	uint32_t next_header_crc;
2676 	ssize_t bytes_avail;
2677 	int check_header_crc, r;
2678 
2679 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2680 		return (ARCHIVE_FATAL);
2681 
2682 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2683 		/* This is an executable ? Must be self-extracting... */
2684 		r = skip_sfx(a, bytes_avail);
2685 		if (r < ARCHIVE_WARN)
2686 			return (r);
2687 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2688 			return (ARCHIVE_FATAL);
2689 	}
2690 	zip->seek_base += 32;
2691 
2692 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2693 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2694 		return (ARCHIVE_FATAL);
2695 	}
2696 
2697 	/* CRC check. */
2698 	if (crc32(0, (unsigned char *)p + 12, 20) != archive_le32dec(p + 8)) {
2699 		archive_set_error(&a->archive, -1, "Header CRC error");
2700 		return (ARCHIVE_FATAL);
2701 	}
2702 
2703 	next_header_offset = archive_le64dec(p + 12);
2704 	next_header_size = archive_le64dec(p + 20);
2705 	next_header_crc = archive_le32dec(p + 28);
2706 
2707 	if (next_header_size == 0)
2708 		/* There is no entry in an archive file. */
2709 		return (ARCHIVE_EOF);
2710 
2711 	if (((int64_t)next_header_offset) < 0) {
2712 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2713 		return (ARCHIVE_FATAL);
2714 	}
2715 	__archive_read_consume(a, 32);
2716 	if (next_header_offset != 0) {
2717 		if (bytes_avail >= next_header_offset)
2718 			__archive_read_consume(a, next_header_offset);
2719 		else if (__archive_read_seek(a,
2720 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
2721 			return (ARCHIVE_FATAL);
2722 	}
2723 	zip->stream_offset = next_header_offset;
2724 	zip->header_offset = next_header_offset;
2725 	zip->header_bytes_remaining = next_header_size;
2726 	zip->header_crc32 = 0;
2727 	zip->header_is_encoded = 0;
2728 	zip->header_is_being_read = 1;
2729 	check_header_crc = 1;
2730 
2731 	if ((p = header_bytes(a, 1)) == NULL) {
2732 		archive_set_error(&a->archive,
2733 		    ARCHIVE_ERRNO_FILE_FORMAT,
2734 		    "Truncated 7-Zip file body");
2735 		return (ARCHIVE_FATAL);
2736 	}
2737 	/* Parse ArchiveProperties. */
2738 	switch (p[0]) {
2739 	case kEncodedHeader:
2740 		/*
2741 		 * The archive has an encoded header and we have to decode it
2742 		 * in order to parse the header correctly.
2743 		 */
2744 		r = decode_encoded_header_info(a, &(zip->si));
2745 
2746 		/* Check the EncodedHeader CRC.*/
2747 		if (r == 0 && zip->header_crc32 != next_header_crc) {
2748 			archive_set_error(&a->archive, -1,
2749 			    "Damaged 7-Zip archive");
2750 			r = -1;
2751 		}
2752 		if (r == 0) {
2753 			if (zip->si.ci.folders[0].digest_defined)
2754 				next_header_crc = zip->si.ci.folders[0].digest;
2755 			else
2756 				check_header_crc = 0;
2757 			if (zip->pack_stream_bytes_unconsumed)
2758 				read_consume(a);
2759 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
2760 			if (r == 0) {
2761 				zip->header_bytes_remaining =
2762 					zip->folder_outbytes_remaining;
2763 				r = seek_pack(a);
2764 			}
2765 		}
2766 		/* Clean up StreamsInfo. */
2767 		free_StreamsInfo(&(zip->si));
2768 		memset(&(zip->si), 0, sizeof(zip->si));
2769 		if (r < 0)
2770 			return (ARCHIVE_FATAL);
2771 		zip->header_is_encoded = 1;
2772 		zip->header_crc32 = 0;
2773 		/* FALL THROUGH */
2774 	case kHeader:
2775 		/*
2776 		 * Parse the header.
2777 		 */
2778 		errno = 0;
2779 		r = read_Header(a, header, zip->header_is_encoded);
2780 		if (r < 0) {
2781 			if (errno == ENOMEM)
2782 				archive_set_error(&a->archive, -1,
2783 				    "Couldn't allocate memory");
2784 			else
2785 				archive_set_error(&a->archive, -1,
2786 				    "Damaged 7-Zip archive");
2787 			return (ARCHIVE_FATAL);
2788 		}
2789 
2790 		/*
2791 		 *  Must be kEnd.
2792 		 */
2793 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
2794 			archive_set_error(&a->archive, -1,
2795 			    "Malformed 7-Zip archive");
2796 			return (ARCHIVE_FATAL);
2797 		}
2798 
2799 		/* Check the Header CRC.*/
2800 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
2801 			archive_set_error(&a->archive, -1,
2802 			    "Malformed 7-Zip archive");
2803 			return (ARCHIVE_FATAL);
2804 		}
2805 		break;
2806 	default:
2807 		archive_set_error(&a->archive, -1,
2808 		    "Unexpected Property ID = %X", p[0]);
2809 		return (ARCHIVE_FATAL);
2810 	}
2811 
2812 	/* Clean up variables be used for decoding the archive header */
2813 	zip->pack_stream_remaining = 0;
2814 	zip->pack_stream_index = 0;
2815 	zip->folder_outbytes_remaining = 0;
2816 	zip->uncompressed_buffer_bytes_remaining = 0;
2817 	zip->pack_stream_bytes_unconsumed = 0;
2818 	zip->header_is_being_read = 0;
2819 
2820 	return (ARCHIVE_OK);
2821 }
2822 
2823 static ssize_t
2824 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
2825     size_t minimum)
2826 {
2827 	struct _7zip *zip = (struct _7zip *)a->format->data;
2828 	ssize_t bytes_avail;
2829 
2830 	if (zip->codec == _7Z_COPY && zip->codec2 == -1) {
2831 		/* Copy mode. */
2832 
2833 		/*
2834 		 * Note: '1' here is a performance optimization.
2835 		 * Recall that the decompression layer returns a count of
2836 		 * available bytes; asking for more than that forces the
2837 		 * decompressor to combine reads by copying data.
2838 		 */
2839 		*buff = __archive_read_ahead(a, 1, &bytes_avail);
2840 		if (bytes_avail <= 0) {
2841 			archive_set_error(&a->archive,
2842 			    ARCHIVE_ERRNO_FILE_FORMAT,
2843 			    "Truncated 7-Zip file data");
2844 			return (ARCHIVE_FATAL);
2845 		}
2846 		if ((size_t)bytes_avail >
2847 		    zip->uncompressed_buffer_bytes_remaining)
2848 			bytes_avail = (ssize_t)
2849 			    zip->uncompressed_buffer_bytes_remaining;
2850 		if ((size_t)bytes_avail > size)
2851 			bytes_avail = (ssize_t)size;
2852 
2853 		zip->pack_stream_bytes_unconsumed = bytes_avail;
2854 	} else if (zip->uncompressed_buffer_pointer == NULL) {
2855 		/* Decompression has failed. */
2856 		archive_set_error(&(a->archive),
2857 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
2858 		return (ARCHIVE_FATAL);
2859 	} else {
2860 		/* Packed mode. */
2861 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
2862 			/*
2863 			 * If remaining uncompressed data size is less than
2864 			 * the minimum size, fill the buffer up to the
2865 			 * minimum size.
2866 			 */
2867 			if (extract_pack_stream(a, minimum) < 0)
2868 				return (ARCHIVE_FATAL);
2869 		}
2870 		if (size > zip->uncompressed_buffer_bytes_remaining)
2871 			bytes_avail = (ssize_t)
2872 			    zip->uncompressed_buffer_bytes_remaining;
2873 		else
2874 			bytes_avail = (ssize_t)size;
2875 		*buff = zip->uncompressed_buffer_pointer;
2876 		zip->uncompressed_buffer_pointer += bytes_avail;
2877 	}
2878 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
2879 	return (bytes_avail);
2880 }
2881 
2882 static ssize_t
2883 extract_pack_stream(struct archive_read *a, size_t minimum)
2884 {
2885 	struct _7zip *zip = (struct _7zip *)a->format->data;
2886 	ssize_t bytes_avail;
2887 	int r;
2888 
2889 	if (zip->codec == _7Z_COPY && zip->codec2 == -1) {
2890 		if (minimum == 0)
2891 			minimum = 1;
2892 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
2893 		    || bytes_avail <= 0) {
2894 			archive_set_error(&a->archive,
2895 			    ARCHIVE_ERRNO_FILE_FORMAT,
2896 			    "Truncated 7-Zip file body");
2897 			return (ARCHIVE_FATAL);
2898 		}
2899 		if (bytes_avail > zip->pack_stream_inbytes_remaining)
2900 			bytes_avail = zip->pack_stream_inbytes_remaining;
2901 		zip->pack_stream_inbytes_remaining -= bytes_avail;
2902 		if (bytes_avail > zip->folder_outbytes_remaining)
2903 			bytes_avail = zip->folder_outbytes_remaining;
2904 		zip->folder_outbytes_remaining -= bytes_avail;
2905 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
2906 		return (ARCHIVE_OK);
2907 	}
2908 
2909 	/* If the buffer hasn't been allocated, allocate it now. */
2910 	if (zip->uncompressed_buffer == NULL) {
2911 		zip->uncompressed_buffer_size = UBUFF_SIZE;
2912 		if (zip->uncompressed_buffer_size < minimum) {
2913 			zip->uncompressed_buffer_size = minimum + 1023;
2914 			zip->uncompressed_buffer_size &= ~0x3ff;
2915 		}
2916 		zip->uncompressed_buffer =
2917 		    malloc(zip->uncompressed_buffer_size);
2918 		if (zip->uncompressed_buffer == NULL) {
2919 			archive_set_error(&a->archive, ENOMEM,
2920 			    "No memory for 7-Zip decompression");
2921 			return (ARCHIVE_FATAL);
2922 		}
2923 		zip->uncompressed_buffer_bytes_remaining = 0;
2924 	} else if (zip->uncompressed_buffer_size < minimum ||
2925 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
2926 		/*
2927 		 * Make sure the uncompressed buffer can have bytes
2928 		 * at least `minimum' bytes.
2929 		 * NOTE: This case happen when reading the header.
2930 		 */
2931 		size_t used;
2932 		if (zip->uncompressed_buffer_pointer != 0)
2933 			used = zip->uncompressed_buffer_pointer -
2934 				zip->uncompressed_buffer;
2935 		else
2936 			used = 0;
2937 		if (zip->uncompressed_buffer_size < minimum) {
2938 			/*
2939 			 * Expand the uncompressed buffer up to
2940 			 * the minimum size.
2941 			 */
2942 			zip->uncompressed_buffer_size = minimum + 1023;
2943 			zip->uncompressed_buffer_size &= ~0x3ff;
2944 			zip->uncompressed_buffer =
2945 			    realloc(zip->uncompressed_buffer,
2946 				zip->uncompressed_buffer_size);
2947 			if (zip->uncompressed_buffer == NULL) {
2948 				archive_set_error(&a->archive, ENOMEM,
2949 				    "No memory for 7-Zip decompression");
2950 				return (ARCHIVE_FATAL);
2951 			}
2952 		}
2953 		/*
2954 		 * Move unconsumed bytes to the head.
2955 		 */
2956 		if (used) {
2957 			memmove(zip->uncompressed_buffer,
2958 				zip->uncompressed_buffer + used,
2959 				zip->uncompressed_buffer_bytes_remaining);
2960 		}
2961 	} else
2962 		zip->uncompressed_buffer_bytes_remaining = 0;
2963 	zip->uncompressed_buffer_pointer = NULL;
2964 	for (;;) {
2965 		size_t bytes_in, bytes_out;
2966 		const void *buff_in;
2967 		unsigned char *buff_out;
2968 		int eof;
2969 
2970 		/*
2971 		 * Note: '1' here is a performance optimization.
2972 		 * Recall that the decompression layer returns a count of
2973 		 * available bytes; asking for more than that forces the
2974 		 * decompressor to combine reads by copying data.
2975 		 */
2976 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
2977 		if (bytes_avail <= 0) {
2978 			archive_set_error(&a->archive,
2979 			    ARCHIVE_ERRNO_FILE_FORMAT,
2980 			    "Truncated 7-Zip file body");
2981 			return (ARCHIVE_FATAL);
2982 		}
2983 
2984 		buff_out = zip->uncompressed_buffer
2985 			+ zip->uncompressed_buffer_bytes_remaining;
2986 		bytes_out = zip->uncompressed_buffer_size
2987 			- zip->uncompressed_buffer_bytes_remaining;
2988 		bytes_in = bytes_avail;
2989 		if (bytes_in > zip->pack_stream_inbytes_remaining)
2990 			bytes_in = zip->pack_stream_inbytes_remaining;
2991 		/* Drive decompression. */
2992 		r = decompress(a, zip, buff_out, &bytes_out,
2993 			buff_in, &bytes_in);
2994 		switch (r) {
2995 		case ARCHIVE_OK:
2996 			eof = 0;
2997 			break;
2998 		case ARCHIVE_EOF:
2999 			eof = 1;
3000 			break;
3001 		default:
3002 			return (ARCHIVE_FATAL);
3003 		}
3004 		zip->pack_stream_inbytes_remaining -= bytes_in;
3005 		if (bytes_out > zip->folder_outbytes_remaining)
3006 			bytes_out = zip->folder_outbytes_remaining;
3007 		zip->folder_outbytes_remaining -= bytes_out;
3008 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3009 		zip->pack_stream_bytes_unconsumed = bytes_in;
3010 
3011 		/*
3012 		 * Continue decompression until uncompressed_buffer is full.
3013 		 */
3014 		if (zip->uncompressed_buffer_bytes_remaining ==
3015 		    zip->uncompressed_buffer_size)
3016 			break;
3017 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3018 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3019 		    zip->uncompressed_buffer_size)
3020 			break;
3021 		if (zip->pack_stream_inbytes_remaining == 0 &&
3022 		    zip->folder_outbytes_remaining == 0)
3023 			break;
3024 		if (eof || (bytes_in == 0 && bytes_out == 0)) {
3025 			archive_set_error(&(a->archive),
3026 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3027 			return (ARCHIVE_FATAL);
3028 		}
3029 		read_consume(a);
3030 	}
3031 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3032 		archive_set_error(&(a->archive),
3033 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3034 		return (ARCHIVE_FATAL);
3035 	}
3036 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3037 	return (ARCHIVE_OK);
3038 }
3039 
3040 static int
3041 seek_pack(struct archive_read *a)
3042 {
3043 	struct _7zip *zip = (struct _7zip *)a->format->data;
3044 	uint64_t pack_offset;
3045 
3046 	if (zip->pack_stream_remaining <= 0) {
3047 		archive_set_error(&(a->archive),
3048 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3049 		return (ARCHIVE_FATAL);
3050 	}
3051 	zip->pack_stream_inbytes_remaining =
3052 	    zip->si.pi.sizes[zip->pack_stream_index];
3053 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3054 	if (zip->stream_offset != pack_offset) {
3055 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3056 		    SEEK_SET))
3057 			return (ARCHIVE_FATAL);
3058 		zip->stream_offset = pack_offset;
3059 	}
3060 	zip->pack_stream_index++;
3061 	zip->pack_stream_remaining--;
3062 	return (ARCHIVE_OK);
3063 }
3064 
3065 static ssize_t
3066 read_stream(struct archive_read *a, const void **buff, size_t size,
3067     size_t minimum)
3068 {
3069 	struct _7zip *zip = (struct _7zip *)a->format->data;
3070 	uint64_t skip_bytes = 0;
3071 	int r;
3072 
3073 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3074 		if (zip->pack_stream_inbytes_remaining > 0) {
3075 			r = extract_pack_stream(a, 0);
3076 			if (r < 0)
3077 				return (r);
3078 			return (get_uncompressed_data(a, buff, size, minimum));
3079 		} else if (zip->folder_outbytes_remaining > 0) {
3080 			/* Extract a remaining pack stream. */
3081 			r = extract_pack_stream(a, 0);
3082 			if (r < 0)
3083 				return (r);
3084 			return (get_uncompressed_data(a, buff, size, minimum));
3085 		}
3086 	} else
3087 		return (get_uncompressed_data(a, buff, size, minimum));
3088 
3089 	/*
3090 	 * Current pack stream has been consumed.
3091 	 */
3092 	if (zip->pack_stream_remaining == 0) {
3093 		if (zip->header_is_being_read) {
3094 			/* Invalid sequence. This might happen when
3095 			 * reading a malformed archive. */
3096 			archive_set_error(&(a->archive),
3097 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3098 			return (ARCHIVE_FATAL);
3099 		}
3100 
3101 		/*
3102 		 * All current folder's pack streams have been
3103 		 * consumed. Switch to next folder.
3104 		 */
3105 		if (zip->folder_index == 0 &&
3106 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3107 		     || zip->folder_index != zip->entry->folderIndex)) {
3108 			zip->folder_index = zip->entry->folderIndex;
3109 			skip_bytes =
3110 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3111 		}
3112 
3113 		if (zip->folder_index >= zip->si.ci.numFolders) {
3114 			/*
3115 			 * We have consumed all folders and its pack streams.
3116 			 */
3117 			*buff = NULL;
3118 			return (0);
3119 		}
3120 		r = setup_decode_folder(a,
3121 			&(zip->si.ci.folders[zip->folder_index]), 0);
3122 		if (r != ARCHIVE_OK)
3123 			return (ARCHIVE_FATAL);
3124 
3125 		zip->folder_index++;
3126 	}
3127 
3128 	/*
3129 	 * Switch to next pack stream.
3130 	 */
3131 	r = seek_pack(a);
3132 	if (r < 0)
3133 		return (r);
3134 
3135 	/* Extract a new pack stream. */
3136 	r = extract_pack_stream(a, 0);
3137 	if (r < 0)
3138 		return (r);
3139 
3140 	/*
3141 	 * Skip the bytes we alrady has skipped in skip_stream().
3142 	 */
3143 	while (skip_bytes) {
3144 		ssize_t skipped;
3145 
3146 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3147 			if (zip->pack_stream_inbytes_remaining > 0) {
3148 				r = extract_pack_stream(a, 0);
3149 				if (r < 0)
3150 					return (r);
3151 			} else if (zip->folder_outbytes_remaining > 0) {
3152 				/* Extract a remaining pack stream. */
3153 				r = extract_pack_stream(a, 0);
3154 				if (r < 0)
3155 					return (r);
3156 			} else {
3157 				archive_set_error(&a->archive,
3158 				    ARCHIVE_ERRNO_FILE_FORMAT,
3159 				    "Truncated 7-Zip file body");
3160 				return (ARCHIVE_FATAL);
3161 			}
3162 		}
3163 		skipped = get_uncompressed_data(a, buff, skip_bytes, 0);
3164 		if (skipped < 0)
3165 			return (skipped);
3166 		skip_bytes -= skipped;
3167 		if (zip->pack_stream_bytes_unconsumed)
3168 			read_consume(a);
3169 	}
3170 
3171 	return (get_uncompressed_data(a, buff, size, minimum));
3172 }
3173 
3174 static int
3175 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3176     int header)
3177 {
3178 	struct _7zip *zip = (struct _7zip *)a->format->data;
3179 	const struct _7z_coder *coder1, *coder2;
3180 	const char *cname = (header)?"archive header":"file content";
3181 	unsigned i;
3182 	int r, found_bcj2 = 0;
3183 
3184 	/*
3185 	 * Release the memory which the previous folder used for BCJ2.
3186 	 */
3187 	for (i = 0; i < 3; i++) {
3188 		if (zip->sub_stream_buff[i] != NULL)
3189 			free(zip->sub_stream_buff[i]);
3190 		zip->sub_stream_buff[i] = NULL;
3191 	}
3192 
3193 	/*
3194 	 * Initialize a stream reader.
3195 	 */
3196 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3197 	zip->pack_stream_index = (unsigned)folder->packIndex;
3198 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3199 	zip->uncompressed_buffer_bytes_remaining = 0;
3200 
3201 	/*
3202 	 * Check coder types.
3203 	 */
3204 	for (i = 0; i < folder->numCoders; i++) {
3205 		if (folder->coders[i].codec == _7Z_CRYPTO) {
3206 			archive_set_error(&(a->archive),
3207 			    ARCHIVE_ERRNO_MISC,
3208 			    "The %s is encrypted, "
3209 			    "but currently not supported", cname);
3210 			return (ARCHIVE_FATAL);
3211 		}
3212 		if (folder->coders[i].codec == _7Z_X86_BCJ2)
3213 			found_bcj2++;
3214 	}
3215 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3216 		archive_set_error(&(a->archive),
3217 		    ARCHIVE_ERRNO_MISC,
3218 		    "The %s is encoded with many filters, "
3219 		    "but currently not supported", cname);
3220 		return (ARCHIVE_FATAL);
3221 	}
3222 	coder1 = &(folder->coders[0]);
3223 	if (folder->numCoders == 2)
3224 		coder2 = &(folder->coders[1]);
3225 	else
3226 		coder2 = NULL;
3227 
3228 	if (found_bcj2) {
3229 		/*
3230 		 * Preparation to decode BCJ2.
3231 		 * Decoding BCJ2 requires four sources. Those are at least,
3232 		 * as far as I know, two types of the storage form.
3233 		 */
3234 		const struct _7z_coder *fc = folder->coders;
3235 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3236 		const struct _7z_coder *scoder[3] =
3237 			{&coder_copy, &coder_copy, &coder_copy};
3238 		const void *buff;
3239 		ssize_t bytes;
3240 		unsigned char *b[3] = {NULL, NULL, NULL};
3241 		uint64_t sunpack[3] ={-1, -1, -1};
3242 		size_t s[3] = {0, 0, 0};
3243 		int idx[3] = {0, 1, 2};
3244 
3245 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3246 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3247 		    zip->pack_stream_remaining == 4) {
3248 			/* Source type 1 made by 7zr or 7z with -m options. */
3249 			if (folder->bindPairs[0].inIndex == 5) {
3250 				/* The form made by 7zr */
3251 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3252 				scoder[1] = &(fc[1]);
3253 				scoder[2] = &(fc[0]);
3254 				sunpack[1] = folder->unPackSize[1];
3255 				sunpack[2] = folder->unPackSize[0];
3256 				coder1 = &(fc[2]);
3257 			} else {
3258 				/*
3259 				 * NOTE: Some patterns do not work.
3260 				 * work:
3261 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3262 				 *       -m3=(any)
3263 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3264 				 *       -m3=COPY
3265 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3266 				 *       -m3=COPY
3267 				 * not work:
3268 				 *  other patterns.
3269 				 *
3270 				 * We have to handle this like `pipe' or
3271 				 * our libarchive7s filter frame work,
3272 				 * decoding the BCJ2 main stream sequentially,
3273 				 * m3 -> m2 -> m1 -> BCJ2.
3274 				 *
3275 				 */
3276 				if (fc[0].codec == _7Z_COPY &&
3277 				    fc[1].codec == _7Z_COPY)
3278 					coder1 = &(folder->coders[2]);
3279 				else if (fc[0].codec == _7Z_COPY &&
3280 				    fc[2].codec == _7Z_COPY)
3281 					coder1 = &(folder->coders[1]);
3282 				else if (fc[1].codec == _7Z_COPY &&
3283 				    fc[2].codec == _7Z_COPY)
3284 					coder1 = &(folder->coders[0]);
3285 				else {
3286 					archive_set_error(&(a->archive),
3287 					    ARCHIVE_ERRNO_MISC,
3288 					    "Unsupported form of "
3289 					    "BCJ2 streams");
3290 					return (ARCHIVE_FATAL);
3291 				}
3292 			}
3293 			coder2 = &(fc[3]);
3294 			zip->main_stream_bytes_remaining =
3295 				folder->unPackSize[2];
3296 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3297 		    zip->pack_stream_remaining == 4 &&
3298 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3299 			/* Source type 0 made by 7z */
3300 			zip->main_stream_bytes_remaining =
3301 				folder->unPackSize[0];
3302 		} else {
3303 			/* We got an unexpected form. */
3304 			archive_set_error(&(a->archive),
3305 			    ARCHIVE_ERRNO_MISC,
3306 			    "Unsupported form of BCJ2 streams");
3307 			return (ARCHIVE_FATAL);
3308 		}
3309 
3310 		/* Skip the main stream at this time. */
3311 		if ((r = seek_pack(a)) < 0)
3312 			return (r);
3313 		zip->pack_stream_bytes_unconsumed =
3314 		    zip->pack_stream_inbytes_remaining;
3315 		read_consume(a);
3316 
3317 		/* Read following three sub streams. */
3318 		for (i = 0; i < 3; i++) {
3319 			const struct _7z_coder *coder = scoder[i];
3320 
3321 			if ((r = seek_pack(a)) < 0)
3322 				return (r);
3323 
3324 			if (sunpack[i] == -1)
3325 				zip->folder_outbytes_remaining =
3326 				    zip->pack_stream_inbytes_remaining;
3327 			else
3328 				zip->folder_outbytes_remaining = sunpack[i];
3329 
3330 			r = init_decompression(a, zip, coder, NULL);
3331 			if (r != ARCHIVE_OK)
3332 				return (ARCHIVE_FATAL);
3333 
3334 			/* Allocate memory for the decorded data of a sub
3335 			 * stream. */
3336 			b[i] = malloc(zip->folder_outbytes_remaining);
3337 			if (b[i] == NULL) {
3338 				archive_set_error(&a->archive, ENOMEM,
3339 				    "No memory for 7-Zip decompression");
3340 				return (ARCHIVE_FATAL);
3341 			}
3342 
3343 			/* Extract a sub stream. */
3344 			while (zip->pack_stream_inbytes_remaining > 0) {
3345 				r = extract_pack_stream(a, 0);
3346 				if (r < 0)
3347 					return (r);
3348 				bytes = get_uncompressed_data(a, &buff,
3349 				    zip->uncompressed_buffer_bytes_remaining,
3350 				    0);
3351 				if (bytes < 0)
3352 					return ((int)bytes);
3353 				memcpy(b[i]+s[i], buff, bytes);
3354 				s[i] += bytes;
3355 				if (zip->pack_stream_bytes_unconsumed)
3356 					read_consume(a);
3357 			}
3358 		}
3359 
3360 		/* Set the sub streams to the right place. */
3361 		for (i = 0; i < 3; i++) {
3362 			zip->sub_stream_buff[i] = b[idx[i]];
3363 			zip->sub_stream_size[i] = s[idx[i]];
3364 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3365 		}
3366 
3367 		/* Allocate memory used for decoded main stream bytes. */
3368 		if (zip->tmp_stream_buff == NULL) {
3369 			zip->tmp_stream_buff_size = 32 * 1024;
3370 			zip->tmp_stream_buff =
3371 			    malloc(zip->tmp_stream_buff_size);
3372 			if (zip->tmp_stream_buff == NULL) {
3373 				archive_set_error(&a->archive, ENOMEM,
3374 				    "No memory for 7-Zip decompression");
3375 				return (ARCHIVE_FATAL);
3376 			}
3377 		}
3378 		zip->tmp_stream_bytes_avail = 0;
3379 		zip->tmp_stream_bytes_remaining = 0;
3380 		zip->odd_bcj_size = 0;
3381 		zip->bcj2_outPos = 0;
3382 
3383 		/*
3384 		 * Reset a stream reader in order to read the main stream
3385 		 * of BCJ2.
3386 		 */
3387 		zip->pack_stream_remaining = 1;
3388 		zip->pack_stream_index = (unsigned)folder->packIndex;
3389 		zip->folder_outbytes_remaining =
3390 		    folder_uncompressed_size(folder);
3391 		zip->uncompressed_buffer_bytes_remaining = 0;
3392 	}
3393 
3394 	/*
3395 	 * Initialize the decompressor for the new folder's pack streams.
3396 	 */
3397 	r = init_decompression(a, zip, coder1, coder2);
3398 	if (r != ARCHIVE_OK)
3399 		return (ARCHIVE_FATAL);
3400 	return (ARCHIVE_OK);
3401 }
3402 
3403 static int64_t
3404 skip_stream(struct archive_read *a, size_t skip_bytes)
3405 {
3406 	struct _7zip *zip = (struct _7zip *)a->format->data;
3407 	const void *p;
3408 	int64_t skipped_bytes;
3409 	size_t bytes = skip_bytes;
3410 
3411 	if (zip->folder_index == 0) {
3412 		/*
3413 		 * Optimization for a list mode.
3414 		 * Avoid unncecessary decoding operations.
3415 		 */
3416 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3417 		    += skip_bytes;
3418 		return (skip_bytes);
3419 	}
3420 
3421 	while (bytes) {
3422 		skipped_bytes = read_stream(a, &p, bytes, 0);
3423 		if (skipped_bytes < 0)
3424 			return (skipped_bytes);
3425 		if (skipped_bytes == 0) {
3426 			archive_set_error(&a->archive,
3427 			    ARCHIVE_ERRNO_FILE_FORMAT,
3428 			    "Truncated 7-Zip file body");
3429 			return (ARCHIVE_FATAL);
3430 		}
3431 		bytes -= skipped_bytes;
3432 		if (zip->pack_stream_bytes_unconsumed)
3433 			read_consume(a);
3434 	}
3435 	return (skip_bytes);
3436 }
3437 
3438 /*
3439  * Brought from LZMA SDK.
3440  *
3441  * Bra86.c -- Converter for x86 code (BCJ)
3442  * 2008-10-04 : Igor Pavlov : Public domain
3443  *
3444  */
3445 
3446 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3447 
3448 static void
3449 x86_Init(struct _7zip *zip)
3450 {
3451 	zip->bcj_state = 0;
3452 	zip->bcj_prevPosT = (size_t)0 - 1;
3453 	zip->bcj_prevMask = 0;
3454 	zip->bcj_ip = 5;
3455 }
3456 
3457 static size_t
3458 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3459 {
3460 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3461 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3462 	size_t bufferPos, prevPosT;
3463 	uint32_t ip, prevMask;
3464 
3465 	if (size < 5)
3466 		return 0;
3467 
3468 	bufferPos = 0;
3469 	prevPosT = zip->bcj_prevPosT;
3470 	prevMask = zip->bcj_prevMask;
3471 	ip = zip->bcj_ip;
3472 
3473 	for (;;) {
3474 		uint8_t *p = data + bufferPos;
3475 		uint8_t *limit = data + size - 4;
3476 
3477 		for (; p < limit; p++)
3478 			if ((*p & 0xFE) == 0xE8)
3479 				break;
3480 		bufferPos = (size_t)(p - data);
3481 		if (p >= limit)
3482 			break;
3483 		prevPosT = bufferPos - prevPosT;
3484 		if (prevPosT > 3)
3485 			prevMask = 0;
3486 		else {
3487 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3488 			if (prevMask != 0) {
3489 				unsigned char b =
3490 					p[4 - kMaskToBitNumber[prevMask]];
3491 				if (!kMaskToAllowedStatus[prevMask] ||
3492 				    Test86MSByte(b)) {
3493 					prevPosT = bufferPos;
3494 					prevMask = ((prevMask << 1) & 0x7) | 1;
3495 					bufferPos++;
3496 					continue;
3497 				}
3498 			}
3499 		}
3500 		prevPosT = bufferPos;
3501 
3502 		if (Test86MSByte(p[4])) {
3503 			uint32_t src = ((uint32_t)p[4] << 24) |
3504 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3505 				((uint32_t)p[1]);
3506 			uint32_t dest;
3507 			for (;;) {
3508 				uint8_t b;
3509 				int index;
3510 
3511 				dest = src - (ip + (uint32_t)bufferPos);
3512 				if (prevMask == 0)
3513 					break;
3514 				index = kMaskToBitNumber[prevMask] * 8;
3515 				b = (uint8_t)(dest >> (24 - index));
3516 				if (!Test86MSByte(b))
3517 					break;
3518 				src = dest ^ ((1 << (32 - index)) - 1);
3519 			}
3520 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3521 			p[3] = (uint8_t)(dest >> 16);
3522 			p[2] = (uint8_t)(dest >> 8);
3523 			p[1] = (uint8_t)dest;
3524 			bufferPos += 5;
3525 		} else {
3526 			prevMask = ((prevMask << 1) & 0x7) | 1;
3527 			bufferPos++;
3528 		}
3529 	}
3530 	zip->bcj_prevPosT = prevPosT;
3531 	zip->bcj_prevMask = prevMask;
3532 	zip->bcj_ip += bufferPos;
3533 	return (bufferPos);
3534 }
3535 
3536 /*
3537  * Brought from LZMA SDK.
3538  *
3539  * Bcj2.c -- Converter for x86 code (BCJ2)
3540  * 2008-10-04 : Igor Pavlov : Public domain
3541  *
3542  */
3543 
3544 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3545 
3546 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3547 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3548 
3549 #define kNumTopBits 24
3550 #define kTopValue ((uint32_t)1 << kNumTopBits)
3551 
3552 #define kNumBitModelTotalBits 11
3553 #define kBitModelTotal (1 << kNumBitModelTotalBits)
3554 #define kNumMoveBits 5
3555 
3556 #define RC_READ_BYTE (*buffer++)
3557 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
3558 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
3559   { int i; for (i = 0; i < 5; i++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
3560 
3561 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
3562 
3563 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
3564 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
3565 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
3566 
3567 static ssize_t
3568 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
3569 {
3570 	size_t inPos = 0, outPos = 0;
3571 	const uint8_t *buf0, *buf1, *buf2, *buf3;
3572 	size_t size0, size1, size2, size3;
3573 	const uint8_t *buffer, *bufferLim;
3574 	unsigned int i, j;
3575 
3576 	size0 = zip->tmp_stream_bytes_remaining;
3577 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
3578 	size1 = zip->sub_stream_bytes_remaining[0];
3579 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
3580 	size2 = zip->sub_stream_bytes_remaining[1];
3581 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
3582 	size3 = zip->sub_stream_bytes_remaining[2];
3583 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
3584 
3585 	buffer = buf3;
3586 	bufferLim = buffer + size3;
3587 
3588 	if (zip->bcj_state == 0) {
3589 		/*
3590 		 * Initialize.
3591 		 */
3592 		zip->bcj2_prevByte = 0;
3593 		for (i = 0;
3594 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
3595 			zip->bcj2_p[i] = kBitModelTotal >> 1;
3596 		RC_INIT2;
3597 		zip->bcj_state = 1;
3598 	}
3599 
3600 	/*
3601 	 * Gather the odd bytes of a previous call.
3602 	 */
3603 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
3604 		outBuf[outPos++] = zip->odd_bcj[i];
3605 		zip->odd_bcj_size--;
3606 	}
3607 
3608 	if (outSize == 0) {
3609 		zip->bcj2_outPos += outPos;
3610 		return (outPos);
3611 	}
3612 
3613 	for (;;) {
3614 		uint8_t b;
3615 		CProb *prob;
3616 		uint32_t bound;
3617 		uint32_t ttt;
3618 
3619 		size_t limit = size0 - inPos;
3620 		if (outSize - outPos < limit)
3621 			limit = outSize - outPos;
3622 
3623 		if (zip->bcj_state == 1) {
3624 			while (limit != 0) {
3625 				uint8_t b = buf0[inPos];
3626 				outBuf[outPos++] = b;
3627 				if (IsJ(zip->bcj2_prevByte, b)) {
3628 					zip->bcj_state = 2;
3629 					break;
3630 				}
3631 				inPos++;
3632 				zip->bcj2_prevByte = b;
3633 				limit--;
3634 			}
3635 		}
3636 
3637 		if (limit == 0 || outPos == outSize)
3638 			break;
3639 		zip->bcj_state = 1;
3640 
3641 		b = buf0[inPos++];
3642 
3643 		if (b == 0xE8)
3644 			prob = zip->bcj2_p + zip->bcj2_prevByte;
3645 		else if (b == 0xE9)
3646 			prob = zip->bcj2_p + 256;
3647 		else
3648 			prob = zip->bcj2_p + 257;
3649 
3650 		IF_BIT_0(prob) {
3651 			UPDATE_0(prob)
3652 			zip->bcj2_prevByte = b;
3653 		} else {
3654 			uint32_t dest;
3655 			const uint8_t *v;
3656 			uint8_t out[4];
3657 
3658 			UPDATE_1(prob)
3659 			if (b == 0xE8) {
3660 				v = buf1;
3661 				if (size1 < 4)
3662 					return SZ_ERROR_DATA;
3663 				buf1 += 4;
3664 				size1 -= 4;
3665 			} else {
3666 				v = buf2;
3667 				if (size2 < 4)
3668 					return SZ_ERROR_DATA;
3669 				buf2 += 4;
3670 				size2 -= 4;
3671 			}
3672 			dest = (((uint32_t)v[0] << 24) |
3673 			    ((uint32_t)v[1] << 16) |
3674 			    ((uint32_t)v[2] << 8) |
3675 			    ((uint32_t)v[3])) -
3676 			    ((uint32_t)zip->bcj2_outPos + outPos + 4);
3677 			out[0] = (uint8_t)dest;
3678 			out[1] = (uint8_t)(dest >> 8);
3679 			out[2] = (uint8_t)(dest >> 16);
3680 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
3681 
3682 			for (i = 0; i < 4 && outPos < outSize; i++)
3683 				outBuf[outPos++] = out[i];
3684 			if (i < 4) {
3685 				/*
3686 				 * Save odd bytes which we could not add into
3687 				 * the output buffer because of out of space.
3688 				 */
3689 				zip->odd_bcj_size = 4 -i;
3690 				for (; i < 4; i++) {
3691 					j = i - 4 + zip->odd_bcj_size;
3692 					zip->odd_bcj[j] = out[i];
3693 				}
3694 				break;
3695 			}
3696 		}
3697 	}
3698 	zip->tmp_stream_bytes_remaining -= inPos;
3699 	zip->sub_stream_bytes_remaining[0] = size1;
3700 	zip->sub_stream_bytes_remaining[1] = size2;
3701 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
3702 	zip->bcj2_outPos += outPos;
3703 
3704 	return ((ssize_t)outPos);
3705 }
3706 
3707