1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 __FBSDID("$FreeBSD$");
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #ifdef HAVE_STDLIB_H
33 #include <stdlib.h>
34 #endif
35 #ifdef HAVE_BZLIB_H
36 #include <bzlib.h>
37 #endif
38 #ifdef HAVE_LZMA_H
39 #include <lzma.h>
40 #endif
41 #ifdef HAVE_ZLIB_H
42 #include <zlib.h>
43 #endif
44 
45 #include "archive.h"
46 #include "archive_entry.h"
47 #include "archive_entry_locale.h"
48 #include "archive_ppmd7_private.h"
49 #include "archive_private.h"
50 #include "archive_read_private.h"
51 #include "archive_endian.h"
52 
53 #ifndef HAVE_ZLIB_H
54 #include "archive_crc32.h"
55 #endif
56 
57 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
58 #define SFX_MIN_ADDR	0x27000
59 #define SFX_MAX_ADDR	0x60000
60 
61 
62 /*
63  * Codec ID
64  */
65 #define _7Z_COPY	0
66 #define _7Z_LZMA	0x030101
67 #define _7Z_LZMA2	0x21
68 #define _7Z_DEFLATE	0x040108
69 #define _7Z_BZ2		0x040202
70 #define _7Z_PPMD	0x030401
71 #define _7Z_DELTA	0x03
72 #define _7Z_CRYPTO	0x06F10701
73 #define _7Z_X86		0x03030103
74 #define _7Z_X86_BCJ2	0x0303011B
75 #define _7Z_POWERPC	0x03030205
76 #define _7Z_IA64	0x03030401
77 #define _7Z_ARM		0x03030501
78 #define _7Z_ARMTHUMB	0x03030701
79 #define _7Z_SPARC	0x03030805
80 
81 /*
82  * 7-Zip header property IDs.
83  */
84 #define kEnd			0x00
85 #define kHeader			0x01
86 #define kArchiveProperties	0x02
87 #define kAdditionalStreamsInfo	0x03
88 #define kMainStreamsInfo	0x04
89 #define kFilesInfo		0x05
90 #define kPackInfo		0x06
91 #define kUnPackInfo		0x07
92 #define kSubStreamsInfo		0x08
93 #define kSize			0x09
94 #define kCRC			0x0A
95 #define kFolder			0x0B
96 #define kCodersUnPackSize	0x0C
97 #define kNumUnPackStream	0x0D
98 #define kEmptyStream		0x0E
99 #define kEmptyFile		0x0F
100 #define kAnti			0x10
101 #define kName			0x11
102 #define kCTime			0x12
103 #define kATime			0x13
104 #define kMTime			0x14
105 #define kAttributes		0x15
106 #define kEncodedHeader		0x17
107 
108 struct _7z_digests {
109 	unsigned char	*defineds;
110 	uint32_t	*digests;
111 };
112 
113 
114 struct _7z_folder {
115 	uint64_t		 numCoders;
116 	struct _7z_coder {
117 		unsigned long	 codec;
118 		uint64_t	 numInStreams;
119 		uint64_t	 numOutStreams;
120 		uint64_t	 propertiesSize;
121 		unsigned char	*properties;
122 	} *coders;
123 	uint64_t		 numBindPairs;
124 	struct {
125 		uint64_t	 inIndex;
126 		uint64_t	 outIndex;
127 	} *bindPairs;
128 	uint64_t		 numPackedStreams;
129 	uint64_t		*packedStreams;
130 	uint64_t		 numInStreams;
131 	uint64_t		 numOutStreams;
132 	uint64_t		*unPackSize;
133 	unsigned char		 digest_defined;
134 	uint32_t		 digest;
135 	uint64_t		 numUnpackStreams;
136 	uint32_t		 packIndex;
137 	/* Unoperated bytes. */
138 	uint64_t		 skipped_bytes;
139 };
140 
141 struct _7z_coders_info {
142 	uint64_t		 numFolders;
143 	struct _7z_folder	*folders;
144 	uint64_t		 dataStreamIndex;
145 };
146 
147 struct _7z_pack_info {
148 	uint64_t		 pos;
149 	uint64_t		 numPackStreams;
150 	uint64_t		*sizes;
151 	struct _7z_digests	 digest;
152 	/* Calculated from pos and numPackStreams. */
153 	uint64_t		*positions;
154 };
155 
156 struct _7z_substream_info {
157 	size_t			 unpack_streams;
158 	uint64_t		*unpackSizes;
159 	unsigned char		*digestsDefined;
160 	uint32_t		*digests;
161 };
162 
163 struct _7z_stream_info {
164 	struct _7z_pack_info	 pi;
165 	struct _7z_coders_info	 ci;
166 	struct _7z_substream_info ss;
167 };
168 
169 struct _7z_header_info {
170 	uint64_t		 dataIndex;
171 
172 	unsigned char		*emptyStreamBools;
173 	unsigned char		*emptyFileBools;
174 	unsigned char		*antiBools;
175 	unsigned char		*attrBools;
176 };
177 
178 struct _7zip_entry {
179 	size_t			 name_len;
180 	unsigned char		*utf16name;
181 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
182 	const wchar_t		*wname;
183 #endif
184 	uint32_t		 folderIndex;
185 	uint32_t		 ssIndex;
186 	unsigned		 flg;
187 #define MTIME_IS_SET	(1<<0)
188 #define ATIME_IS_SET	(1<<1)
189 #define CTIME_IS_SET	(1<<2)
190 #define CRC32_IS_SET	(1<<3)
191 #define HAS_STREAM	(1<<4)
192 
193 	time_t			 mtime;
194 	time_t			 atime;
195 	time_t			 ctime;
196 	long			 mtime_ns;
197 	long			 atime_ns;
198 	long			 ctime_ns;
199 	uint32_t		 mode;
200 	uint32_t		 attr;
201 };
202 
203 struct _7zip {
204 	/* Structural information about the archive. */
205 	struct _7z_stream_info	 si;
206 
207 	int			 header_is_being_read;
208 	int			 header_is_encoded;
209 	uint64_t		 header_bytes_remaining;
210 	unsigned long		 header_crc32;
211 	/* Header offset to check that reading pointes of the file contens
212 	 * will not exceed the header. */
213 	uint64_t		 header_offset;
214 	/* Base offset of the archive file for a seek in case reading SFX. */
215 	uint64_t		 seek_base;
216 
217 	/* List of entries */
218 	size_t			 entries_remaining;
219 	uint64_t		 numFiles;
220 	struct _7zip_entry	*entries;
221 	struct _7zip_entry	*entry;
222 	unsigned char		*entry_names;
223 
224 	/* entry_bytes_remaining is the number of bytes we expect. */
225 	int64_t			 entry_offset;
226 	uint64_t		 entry_bytes_remaining;
227 
228 	/* Running CRC32 of the decompressed data */
229 	unsigned long		 entry_crc32;
230 
231 	/* Flags to mark progress of decompression. */
232 	char			 end_of_entry;
233 
234 	/* Uncompressed buffer control.  */
235 #define UBUFF_SIZE	(64 * 1024)
236 	unsigned char 		*uncompressed_buffer;
237 	unsigned char 		*uncompressed_buffer_pointer;
238 	size_t 			 uncompressed_buffer_size;
239 	size_t			 uncompressed_buffer_bytes_remaining;
240 
241 	/* Offset of the compressed data. */
242 	int64_t			 stream_offset;
243 
244 	/*
245 	 * Decompressing control data.
246 	 */
247 	unsigned		 folder_index;
248 	uint64_t		 folder_outbytes_remaining;
249 	unsigned		 pack_stream_index;
250 	unsigned		 pack_stream_remaining;
251 	uint64_t		 pack_stream_inbytes_remaining;
252 	size_t			 pack_stream_bytes_unconsumed;
253 
254 	/* The codec information of a folder. */
255 	unsigned long		 codec;
256 	unsigned long		 codec2;
257 
258 	/*
259 	 * Decompressor controllers.
260 	 */
261 	/* Decording LZMA1 and LZMA2 data. */
262 #ifdef HAVE_LZMA_H
263 	lzma_stream		 lzstream;
264 	int			 lzstream_valid;
265 #endif
266 	/* Decording bzip2 data. */
267 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
268 	bz_stream		 bzstream;
269 	int			 bzstream_valid;
270 #endif
271 	/* Decording deflate data. */
272 #ifdef HAVE_ZLIB_H
273 	z_stream		 stream;
274 	int			 stream_valid;
275 #endif
276 	/* Decording PPMd data. */
277 	int			 ppmd7_stat;
278 	CPpmd7			 ppmd7_context;
279 	CPpmd7z_RangeDec	 range_dec;
280 	IByteIn			 bytein;
281 	struct {
282 		const unsigned char	*next_in;
283 		int64_t			 avail_in;
284 		int64_t			 total_in;
285 		unsigned char		*next_out;
286 		int64_t			 avail_out;
287 		int64_t			 total_out;
288 		int			 overconsumed;
289 	} ppstream;
290 	int			 ppmd7_valid;
291 
292 	/* Decoding BCJ and BCJ2 data. */
293 	uint32_t		 bcj_state;
294 	size_t			 odd_bcj_size;
295 	unsigned char		 odd_bcj[4];
296 	/* Decoding BCJ data. */
297 	size_t			 bcj_prevPosT;
298 	uint32_t		 bcj_prevMask;
299 	uint32_t		 bcj_ip;
300 
301 	/* Decoding BCJ2 data. */
302 	size_t			 main_stream_bytes_remaining;
303 	unsigned char		*sub_stream_buff[3];
304 	size_t			 sub_stream_size[3];
305 	size_t			 sub_stream_bytes_remaining[3];
306 	unsigned char		*tmp_stream_buff;
307 	size_t			 tmp_stream_buff_size;
308 	size_t			 tmp_stream_bytes_avail;
309 	size_t			 tmp_stream_bytes_remaining;
310 #ifdef _LZMA_PROB32
311 #define CProb uint32_t
312 #else
313 #define CProb uint16_t
314 #endif
315 	CProb			 bcj2_p[256 + 2];
316 	uint8_t			 bcj2_prevByte;
317 	uint32_t		 bcj2_range;
318 	uint32_t		 bcj2_code;
319 	uint64_t		 bcj2_outPos;
320 
321 	/* Filename character-set conversion data. */
322 	struct archive_string_conv *sconv;
323 
324 	char			 format_name[64];
325 };
326 
327 static int	archive_read_format_7zip_bid(struct archive_read *, int);
328 static int	archive_read_format_7zip_cleanup(struct archive_read *);
329 static int	archive_read_format_7zip_read_data(struct archive_read *,
330 		    const void **, size_t *, int64_t *);
331 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
332 static int	archive_read_format_7zip_read_header(struct archive_read *,
333 		    struct archive_entry *);
334 static int	check_7zip_header_in_sfx(const char *);
335 static unsigned long decode_codec_id(const unsigned char *, size_t);
336 static int	decode_encoded_header_info(struct archive_read *,
337 		    struct _7z_stream_info *);
338 static int	decompress(struct archive_read *, struct _7zip *,
339 		    void *, size_t *, const void *, size_t *);
340 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
341 static void	fileTimeToUtc(uint64_t, time_t *, long *);
342 static uint64_t folder_uncompressed_size(struct _7z_folder *);
343 static void	free_CodersInfo(struct _7z_coders_info *);
344 static void	free_Digest(struct _7z_digests *);
345 static void	free_Folder(struct _7z_folder *);
346 static void	free_Header(struct _7z_header_info *);
347 static void	free_PackInfo(struct _7z_pack_info *);
348 static void	free_StreamsInfo(struct _7z_stream_info *);
349 static void	free_SubStreamsInfo(struct _7z_substream_info *);
350 static int	free_decompression(struct archive_read *, struct _7zip *);
351 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
352 		    size_t, size_t);
353 static const unsigned char * header_bytes(struct archive_read *, size_t);
354 static int	init_decompression(struct archive_read *, struct _7zip *,
355 		    const struct _7z_coder *, const struct _7z_coder *);
356 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
357 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
358 static int	read_CodersInfo(struct archive_read *,
359 		    struct _7z_coders_info *);
360 static int	read_Digests(struct archive_read *, struct _7z_digests *,
361 		    size_t);
362 static int	read_Folder(struct archive_read *, struct _7z_folder *);
363 static int	read_Header(struct archive_read *, struct _7z_header_info *,
364 		    int);
365 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
366 static int	read_StreamsInfo(struct archive_read *,
367 		    struct _7z_stream_info *);
368 static int	read_SubStreamsInfo(struct archive_read *,
369 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
370 static int	read_Times(struct archive_read *, struct _7z_header_info *,
371 		    int);
372 static void	read_consume(struct archive_read *);
373 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
374 		    size_t);
375 static int	seek_pack(struct archive_read *);
376 static int64_t	skip_stream(struct archive_read *, size_t);
377 static int	skip_sfx(struct archive_read *, ssize_t);
378 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
379 		    struct _7z_header_info *);
380 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
381 		    int);
382 static void	x86_Init(struct _7zip *);
383 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
384 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
385 
386 
387 int
388 archive_read_support_format_7zip(struct archive *_a)
389 {
390 	struct archive_read *a = (struct archive_read *)_a;
391 	struct _7zip *zip;
392 	int r;
393 
394 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
395 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
396 
397 	zip = calloc(1, sizeof(*zip));
398 	if (zip == NULL) {
399 		archive_set_error(&a->archive, ENOMEM,
400 		    "Can't allocate 7zip data");
401 		return (ARCHIVE_FATAL);
402 	}
403 
404 	r = __archive_read_register_format(a,
405 	    zip,
406 	    "7zip",
407 	    archive_read_format_7zip_bid,
408 	    NULL,
409 	    archive_read_format_7zip_read_header,
410 	    archive_read_format_7zip_read_data,
411 	    archive_read_format_7zip_read_data_skip,
412 	    archive_read_format_7zip_cleanup);
413 
414 	if (r != ARCHIVE_OK)
415 		free(zip);
416 	return (ARCHIVE_OK);
417 }
418 
419 static int
420 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
421 {
422 	const char *p;
423 
424 	/* If someone has already bid more than 32, then avoid
425 	   trashing the look-ahead buffers with a seek. */
426 	if (best_bid > 32)
427 		return (-1);
428 
429 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
430 		return (0);
431 
432 	/* If first six bytes are the 7-Zip signature,
433 	 * return the bid right now. */
434 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
435 		return (48);
436 
437 	/*
438 	 * It may a 7-Zip SFX archive file. If first two bytes are
439 	 * 'M' and 'Z' available on Windows or first four bytes are
440 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
441 	 * signature. Although we will perform a seek when reading
442 	 * a header, what we do not use __archive_read_seek() here is
443 	 * due to a bidding performance.
444 	 */
445 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
446 		ssize_t offset = SFX_MIN_ADDR;
447 		ssize_t window = 4096;
448 		ssize_t bytes_avail;
449 		while (offset + window <= (SFX_MAX_ADDR)) {
450 			const char *buff = __archive_read_ahead(a,
451 					offset + window, &bytes_avail);
452 			if (buff == NULL) {
453 				/* Remaining bytes are less than window. */
454 				window >>= 1;
455 				if (window < 0x40)
456 					return (0);
457 				continue;
458 			}
459 			p = buff + offset;
460 			while (p + 32 < buff + bytes_avail) {
461 				int step = check_7zip_header_in_sfx(p);
462 				if (step == 0)
463 					return (48);
464 				p += step;
465 			}
466 			offset = p - buff;
467 		}
468 	}
469 	return (0);
470 }
471 
472 static int
473 check_7zip_header_in_sfx(const char *p)
474 {
475 	switch ((unsigned char)p[5]) {
476 	case 0x1C:
477 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
478 			return (6);
479 		/*
480 		 * Test the CRC because its extraction code has 7-Zip
481 		 * Magic Code, so we should do this in order not to
482 		 * make a mis-detection.
483 		 */
484 		if (crc32(0, (const unsigned char *)p + 12, 20)
485 			!= archive_le32dec(p + 8))
486 			return (6);
487 		/* Hit the header! */
488 		return (0);
489 	case 0x37: return (5);
490 	case 0x7A: return (4);
491 	case 0xBC: return (3);
492 	case 0xAF: return (2);
493 	case 0x27: return (1);
494 	default: return (6);
495 	}
496 }
497 
498 static int
499 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
500 {
501 	const void *h;
502 	const char *p, *q;
503 	size_t skip, offset;
504 	ssize_t bytes, window;
505 
506 	/*
507 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
508 	 * __archive_read_seek() at this time since we have
509 	 * alredy had enough data.
510 	 */
511 	if (bytes_avail > SFX_MIN_ADDR)
512 		__archive_read_consume(a, SFX_MIN_ADDR);
513 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
514 		return (ARCHIVE_FATAL);
515 
516 	offset = 0;
517 	window = 1;
518 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
519 		h = __archive_read_ahead(a, window, &bytes);
520 		if (h == NULL) {
521 			/* Remaining bytes are less than window. */
522 			window >>= 1;
523 			if (window < 0x40)
524 				goto fatal;
525 			continue;
526 		}
527 		if (bytes < 6) {
528 			/* This case might happen when window == 1. */
529 			window = 4096;
530 			continue;
531 		}
532 		p = (const char *)h;
533 		q = p + bytes;
534 
535 		/*
536 		 * Scan ahead until we find something that looks
537 		 * like the 7-Zip header.
538 		 */
539 		while (p + 32 < q) {
540 			int step = check_7zip_header_in_sfx(p);
541 			if (step == 0) {
542 				struct _7zip *zip =
543 				    (struct _7zip *)a->format->data;
544 				skip = p - (const char *)h;
545 				__archive_read_consume(a, skip);
546 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
547 				return (ARCHIVE_OK);
548 			}
549 			p += step;
550 		}
551 		skip = p - (const char *)h;
552 		__archive_read_consume(a, skip);
553 		offset += skip;
554 		if (window == 1)
555 			window = 4096;
556 	}
557 fatal:
558 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
559 	    "Couldn't find out 7-Zip header");
560 	return (ARCHIVE_FATAL);
561 }
562 
563 static int
564 archive_read_format_7zip_read_header(struct archive_read *a,
565 	struct archive_entry *entry)
566 {
567 	struct _7zip *zip = (struct _7zip *)a->format->data;
568 	struct _7zip_entry *zip_entry;
569 	int r, ret = ARCHIVE_OK;
570 
571 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
572 	if (a->archive.archive_format_name == NULL)
573 		a->archive.archive_format_name = "7-Zip";
574 
575 	if (zip->entries == NULL) {
576 		struct _7z_header_info header;
577 
578 		memset(&header, 0, sizeof(header));
579 		r = slurp_central_directory(a, zip, &header);
580 		free_Header(&header);
581 		if (r != ARCHIVE_OK)
582 			return (r);
583 		zip->entries_remaining = (size_t)zip->numFiles;
584 		zip->entry = zip->entries;
585 	} else {
586 		++zip->entry;
587 	}
588 	zip_entry = zip->entry;
589 
590 	if (zip->entries_remaining <= 0)
591 		return ARCHIVE_EOF;
592 	--zip->entries_remaining;
593 
594 	zip->entry_offset = 0;
595 	zip->end_of_entry = 0;
596 	zip->entry_crc32 = crc32(0, NULL, 0);
597 
598 	/* Setup a string conversion for a filename. */
599 	if (zip->sconv == NULL) {
600 		zip->sconv = archive_string_conversion_from_charset(
601 		    &a->archive, "UTF-16LE", 1);
602 		if (zip->sconv == NULL)
603 			return (ARCHIVE_FATAL);
604 	}
605 
606 	if (archive_entry_copy_pathname_l(entry,
607 	    (const char *)zip_entry->utf16name,
608 	    zip_entry->name_len, zip->sconv) != 0) {
609 		if (errno == ENOMEM) {
610 			archive_set_error(&a->archive, ENOMEM,
611 			    "Can't allocate memory for Pathname");
612 			return (ARCHIVE_FATAL);
613 		}
614 		archive_set_error(&a->archive,
615 		    ARCHIVE_ERRNO_FILE_FORMAT,
616 		    "Pathname cannot be converted "
617 		    "from %s to current locale.",
618 		    archive_string_conversion_charset_name(zip->sconv));
619 		ret = ARCHIVE_WARN;
620 	}
621 
622 	/* Populate some additional entry fields: */
623 	archive_entry_set_mode(entry, zip_entry->mode);
624 	if (zip_entry->flg & MTIME_IS_SET)
625 		archive_entry_set_mtime(entry, zip_entry->mtime,
626 			zip_entry->mtime_ns);
627 	if (zip_entry->flg & CTIME_IS_SET)
628 		archive_entry_set_ctime(entry, zip_entry->ctime,
629 		    zip_entry->ctime_ns);
630 	if (zip_entry->flg & ATIME_IS_SET)
631 		archive_entry_set_atime(entry, zip_entry->atime,
632 		    zip_entry->atime_ns);
633 	if (zip_entry->ssIndex != (uint32_t)-1) {
634 		zip->entry_bytes_remaining =
635 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
636 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
637 	} else {
638 		zip->entry_bytes_remaining = 0;
639 		archive_entry_set_size(entry, 0);
640 	}
641 
642 	/* If there's no body, force read_data() to return EOF immediately. */
643 	if (zip->entry_bytes_remaining < 1)
644 		zip->end_of_entry = 1;
645 
646 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
647 		unsigned char *symname = NULL;
648 		size_t symsize = 0;
649 
650 		/*
651 		 * Symbolic-name is recorded as its contents. We have to
652 		 * read the contents at this time.
653 		 */
654 		while (zip->entry_bytes_remaining > 0) {
655 			const void *buff;
656 			unsigned char *mem;
657 			size_t size;
658 			int64_t offset;
659 
660 			r = archive_read_format_7zip_read_data(a, &buff,
661 				&size, &offset);
662 			if (r < ARCHIVE_WARN) {
663 				free(symname);
664 				return (r);
665 			}
666 			mem = realloc(symname, symsize + size + 1);
667 			if (mem == NULL) {
668 				free(symname);
669 				archive_set_error(&a->archive, ENOMEM,
670 				    "Can't allocate memory for Symname");
671 				return (ARCHIVE_FATAL);
672 			}
673 			symname = mem;
674 			memcpy(symname+symsize, buff, size);
675 			symsize += size;
676 		}
677 		if (symsize == 0) {
678 			/* If there is no synname, handle it as a regular
679 			 * file. */
680 			zip_entry->mode &= ~AE_IFMT;
681 			zip_entry->mode |= AE_IFREG;
682 			archive_entry_set_mode(entry, zip_entry->mode);
683 		} else {
684 			symname[symsize] = '\0';
685 			archive_entry_copy_symlink(entry,
686 			    (const char *)symname);
687 			free(symname);
688 		}
689 		archive_entry_set_size(entry, 0);
690 	}
691 
692 	/* Set up a more descriptive format name. */
693 	sprintf(zip->format_name, "7-Zip");
694 	a->archive.archive_format_name = zip->format_name;
695 
696 	return (ret);
697 }
698 
699 static int
700 archive_read_format_7zip_read_data(struct archive_read *a,
701     const void **buff, size_t *size, int64_t *offset)
702 {
703 	struct _7zip *zip;
704 	ssize_t bytes;
705 	int ret = ARCHIVE_OK;
706 
707 	zip = (struct _7zip *)(a->format->data);
708 
709 	if (zip->pack_stream_bytes_unconsumed)
710 		read_consume(a);
711 
712 	/*
713 	 * If we hit end-of-entry last time, clean up and return
714 	 * ARCHIVE_EOF this time.
715 	 */
716 	if (zip->end_of_entry) {
717 		*offset = zip->entry_offset;
718 		*size = 0;
719 		*buff = NULL;
720 		return (ARCHIVE_EOF);
721 	}
722 
723 	bytes = read_stream(a, buff,
724 		(size_t)zip->entry_bytes_remaining, 0);
725 	if (bytes < 0)
726 		return ((int)bytes);
727 	if (bytes == 0) {
728 		archive_set_error(&a->archive,
729 		    ARCHIVE_ERRNO_FILE_FORMAT,
730 		    "Truncated 7-Zip file body");
731 		return (ARCHIVE_FATAL);
732 	}
733 	zip->entry_bytes_remaining -= bytes;
734 	if (zip->entry_bytes_remaining == 0)
735 		zip->end_of_entry = 1;
736 
737 	/* Update checksum */
738 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
739 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff, bytes);
740 
741 	/* If we hit the end, swallow any end-of-data marker. */
742 	if (zip->end_of_entry) {
743 		/* Check computed CRC against file contents. */
744 		if ((zip->entry->flg & CRC32_IS_SET) &&
745 			zip->si.ss.digests[zip->entry->ssIndex] !=
746 		    zip->entry_crc32) {
747 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
748 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
749 			    (unsigned long)zip->entry_crc32,
750 			    (unsigned long)zip->si.ss.digests[
751 			    		zip->entry->ssIndex]);
752 			ret = ARCHIVE_WARN;
753 		}
754 	}
755 
756 	*size = bytes;
757 	*offset = zip->entry_offset;
758 	zip->entry_offset += bytes;
759 
760 	return (ret);
761 }
762 
763 static int
764 archive_read_format_7zip_read_data_skip(struct archive_read *a)
765 {
766 	struct _7zip *zip;
767 	int64_t bytes_skipped;
768 
769 	zip = (struct _7zip *)(a->format->data);
770 
771 	if (zip->pack_stream_bytes_unconsumed)
772 		read_consume(a);
773 
774 	/* If we've already read to end of data, we're done. */
775 	if (zip->end_of_entry)
776 		return (ARCHIVE_OK);
777 
778 	/*
779 	 * If the length is at the beginning, we can skip the
780 	 * compressed data much more quickly.
781 	 */
782 	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
783 	if (bytes_skipped < 0)
784 		return (ARCHIVE_FATAL);
785 	zip->entry_bytes_remaining = 0;
786 
787 	/* This entry is finished and done. */
788 	zip->end_of_entry = 1;
789 	return (ARCHIVE_OK);
790 }
791 
792 static int
793 archive_read_format_7zip_cleanup(struct archive_read *a)
794 {
795 	struct _7zip *zip;
796 
797 	zip = (struct _7zip *)(a->format->data);
798 	free_StreamsInfo(&(zip->si));
799 	free(zip->entries);
800 	free(zip->entry_names);
801 	free_decompression(a, zip);
802 	free(zip->uncompressed_buffer);
803 	free(zip->sub_stream_buff[0]);
804 	free(zip->sub_stream_buff[1]);
805 	free(zip->sub_stream_buff[2]);
806 	free(zip->tmp_stream_buff);
807 	free(zip);
808 	(a->format->data) = NULL;
809 	return (ARCHIVE_OK);
810 }
811 
812 static void
813 read_consume(struct archive_read *a)
814 {
815 	struct _7zip *zip = (struct _7zip *)a->format->data;
816 
817 	if (zip->pack_stream_bytes_unconsumed) {
818 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
819 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
820 		zip->pack_stream_bytes_unconsumed = 0;
821 	}
822 }
823 
824 #ifdef HAVE_LZMA_H
825 
826 /*
827  * Set an error code and choose an error message for liblzma.
828  */
829 static void
830 set_error(struct archive_read *a, int ret)
831 {
832 
833 	switch (ret) {
834 	case LZMA_STREAM_END: /* Found end of stream. */
835 	case LZMA_OK: /* Decompressor made some progress. */
836 		break;
837 	case LZMA_MEM_ERROR:
838 		archive_set_error(&a->archive, ENOMEM,
839 		    "Lzma library error: Cannot allocate memory");
840 		break;
841 	case LZMA_MEMLIMIT_ERROR:
842 		archive_set_error(&a->archive, ENOMEM,
843 		    "Lzma library error: Out of memory");
844 		break;
845 	case LZMA_FORMAT_ERROR:
846 		archive_set_error(&a->archive,
847 		    ARCHIVE_ERRNO_MISC,
848 		    "Lzma library error: format not recognized");
849 		break;
850 	case LZMA_OPTIONS_ERROR:
851 		archive_set_error(&a->archive,
852 		    ARCHIVE_ERRNO_MISC,
853 		    "Lzma library error: Invalid options");
854 		break;
855 	case LZMA_DATA_ERROR:
856 		archive_set_error(&a->archive,
857 		    ARCHIVE_ERRNO_MISC,
858 		    "Lzma library error: Corrupted input data");
859 		break;
860 	case LZMA_BUF_ERROR:
861 		archive_set_error(&a->archive,
862 		    ARCHIVE_ERRNO_MISC,
863 		    "Lzma library error:  No progress is possible");
864 		break;
865 	default:
866 		/* Return an error. */
867 		archive_set_error(&a->archive,
868 		    ARCHIVE_ERRNO_MISC,
869 		    "Lzma decompression failed:  Unknown error");
870 		break;
871 	}
872 }
873 
874 #endif
875 
876 static unsigned long
877 decode_codec_id(const unsigned char *codecId, size_t id_size)
878 {
879 	unsigned i;
880 	unsigned long id = 0;
881 
882 	for (i = 0; i < id_size; i++) {
883 		id <<= 8;
884 		id += codecId[i];
885 	}
886 	return (id);
887 }
888 
889 static void *
890 ppmd_alloc(void *p, size_t size)
891 {
892 	(void)p;
893 	return malloc(size);
894 }
895 static void
896 ppmd_free(void *p, void *address)
897 {
898 	(void)p;
899 	free(address);
900 }
901 static Byte
902 ppmd_read(void *p)
903 {
904 	struct archive_read *a = ((IByteIn*)p)->a;
905 	struct _7zip *zip = (struct _7zip *)(a->format->data);
906 	Byte b;
907 
908 	if (zip->ppstream.avail_in == 0) {
909 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
910 		    "Truncated RAR file data");
911 		zip->ppstream.overconsumed = 1;
912 		return (0);
913 	}
914 	b = *zip->ppstream.next_in++;
915 	zip->ppstream.avail_in--;
916 	zip->ppstream.total_in++;
917 	return (b);
918 }
919 
920 static ISzAlloc g_szalloc = { ppmd_alloc, ppmd_free };
921 
922 static int
923 init_decompression(struct archive_read *a, struct _7zip *zip,
924     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
925 {
926 	int r;
927 
928 	zip->codec = coder1->codec;
929 	zip->codec2 = -1;
930 
931 	switch (zip->codec) {
932 	case _7Z_COPY:
933 	case _7Z_BZ2:
934 	case _7Z_DEFLATE:
935 	case _7Z_PPMD:
936 		if (coder2 != NULL) {
937 			if (coder2->codec != _7Z_X86 &&
938 			    coder2->codec != _7Z_X86_BCJ2) {
939 				archive_set_error(&a->archive,
940 				    ARCHIVE_ERRNO_MISC,
941 				    "Unsupported filter %lx for %lx",
942 				    coder2->codec, coder1->codec);
943 				return (ARCHIVE_FAILED);
944 			}
945 			zip->codec2 = coder2->codec;
946 			zip->bcj_state = 0;
947 			if (coder2->codec == _7Z_X86)
948 				x86_Init(zip);
949 		}
950 		break;
951 	default:
952 		break;
953 	}
954 
955 	switch (zip->codec) {
956 	case _7Z_COPY:
957 		break;
958 
959 	case _7Z_LZMA: case _7Z_LZMA2:
960 #ifdef HAVE_LZMA_H
961 #if LZMA_VERSION_MAJOR >= 5
962 /* Effectively disable the limiter. */
963 #define LZMA_MEMLIMIT   UINT64_MAX
964 #else
965 /* NOTE: This needs to check memory size which running system has. */
966 #define LZMA_MEMLIMIT   (1U << 30)
967 #endif
968 	{
969 		lzma_options_delta delta_opt;
970 		lzma_filter filters[LZMA_FILTERS_MAX];
971 #if LZMA_VERSION < 50000030
972 		lzma_filter *ff;
973 #endif
974 		int fi = 0;
975 
976 		if (zip->lzstream_valid) {
977 			lzma_end(&(zip->lzstream));
978 			zip->lzstream_valid = 0;
979 		}
980 
981 		/*
982 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
983 		 * data made by 7-Zip because 7-Zip does not add End-Of-
984 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
985 		 * and so liblzma cannot know the end of the compressed data
986 		 * without EOPM. So consequently liblzma will not return last
987 		 * three or four bytes of uncompressed data because
988 		 * LZMA_FILTER_X86 filter does not handle input data if its
989 		 * data size is less than five bytes. If liblzma detect EOPM
990 		 * or know the uncompressed data size, liblzma will flush out
991 		 * the remaining that three or four bytes of uncompressed
992 		 * data. That is why we have to use our converting program
993 		 * for BCJ+LZMA. If we were able to tell the uncompressed
994 		 * size to liblzma when using lzma_raw_decoder() liblzma
995 		 * could correctly deal with BCJ+LZMA. But unfortunately
996 		 * there is no way to do that.
997 		 * Discussion about this can be found at XZ Utils forum.
998 		 */
999 		if (coder2 != NULL) {
1000 			zip->codec2 = coder2->codec;
1001 
1002 			filters[fi].options = NULL;
1003 			switch (zip->codec2) {
1004 			case _7Z_X86:
1005 				if (zip->codec == _7Z_LZMA2) {
1006 					filters[fi].id = LZMA_FILTER_X86;
1007 					fi++;
1008 				} else
1009 					/* Use our filter. */
1010 					x86_Init(zip);
1011 				break;
1012 			case _7Z_X86_BCJ2:
1013 				/* Use our filter. */
1014 				zip->bcj_state = 0;
1015 				break;
1016 			case _7Z_DELTA:
1017 				filters[fi].id = LZMA_FILTER_DELTA;
1018 				memset(&delta_opt, 0, sizeof(delta_opt));
1019 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1020 				delta_opt.dist = 1;
1021 				filters[fi].options = &delta_opt;
1022 				fi++;
1023 				break;
1024 			/* Following filters have not been tested yet. */
1025 			case _7Z_POWERPC:
1026 				filters[fi].id = LZMA_FILTER_POWERPC;
1027 				fi++;
1028 				break;
1029 			case _7Z_IA64:
1030 				filters[fi].id = LZMA_FILTER_IA64;
1031 				fi++;
1032 				break;
1033 			case _7Z_ARM:
1034 				filters[fi].id = LZMA_FILTER_ARM;
1035 				fi++;
1036 				break;
1037 			case _7Z_ARMTHUMB:
1038 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1039 				fi++;
1040 				break;
1041 			case _7Z_SPARC:
1042 				filters[fi].id = LZMA_FILTER_SPARC;
1043 				fi++;
1044 				break;
1045 			default:
1046 				archive_set_error(&a->archive,
1047 				    ARCHIVE_ERRNO_MISC,
1048 				    "Unexpected codec ID: %lX", zip->codec2);
1049 				return (ARCHIVE_FAILED);
1050 			}
1051 		}
1052 
1053 		if (zip->codec == _7Z_LZMA2)
1054 			filters[fi].id = LZMA_FILTER_LZMA2;
1055 		else
1056 			filters[fi].id = LZMA_FILTER_LZMA1;
1057 		filters[fi].options = NULL;
1058 #if LZMA_VERSION < 50000030
1059 		ff = &filters[fi];
1060 #endif
1061 		r = lzma_properties_decode(&filters[fi], NULL,
1062 		    coder1->properties, (size_t)coder1->propertiesSize);
1063 		if (r != LZMA_OK) {
1064 			set_error(a, r);
1065 			return (ARCHIVE_FAILED);
1066 		}
1067 		fi++;
1068 
1069 		filters[fi].id = LZMA_VLI_UNKNOWN;
1070 		filters[fi].options = NULL;
1071 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1072 #if LZMA_VERSION < 50000030
1073 		free(ff->options);
1074 #endif
1075 		if (r != LZMA_OK) {
1076 			set_error(a, r);
1077 			return (ARCHIVE_FAILED);
1078 		}
1079 		zip->lzstream_valid = 1;
1080 		zip->lzstream.total_in = 0;
1081 		zip->lzstream.total_out = 0;
1082 		break;
1083 	}
1084 #else
1085 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1086 		    "LZMA codec is unsupported");
1087 		return (ARCHIVE_FAILED);
1088 #endif
1089 	case _7Z_BZ2:
1090 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1091 		if (zip->bzstream_valid) {
1092 			BZ2_bzDecompressEnd(&(zip->bzstream));
1093 			zip->bzstream_valid = 0;
1094 		}
1095 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1096 		if (r == BZ_MEM_ERROR)
1097 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1098 		if (r != BZ_OK) {
1099 			int err = ARCHIVE_ERRNO_MISC;
1100 			const char *detail = NULL;
1101 			switch (r) {
1102 			case BZ_PARAM_ERROR:
1103 				detail = "invalid setup parameter";
1104 				break;
1105 			case BZ_MEM_ERROR:
1106 				err = ENOMEM;
1107 				detail = "out of memory";
1108 				break;
1109 			case BZ_CONFIG_ERROR:
1110 				detail = "mis-compiled library";
1111 				break;
1112 			}
1113 			archive_set_error(&a->archive, err,
1114 			    "Internal error initializing decompressor: %s",
1115 			    detail == NULL ? "??" : detail);
1116 			zip->bzstream_valid = 0;
1117 			return (ARCHIVE_FAILED);
1118 		}
1119 		zip->bzstream_valid = 1;
1120 		zip->bzstream.total_in_lo32 = 0;
1121 		zip->bzstream.total_in_hi32 = 0;
1122 		zip->bzstream.total_out_lo32 = 0;
1123 		zip->bzstream.total_out_hi32 = 0;
1124 		break;
1125 #else
1126 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1127 		    "BZ2 codec is unsupported");
1128 		return (ARCHIVE_FAILED);
1129 #endif
1130 	case _7Z_DEFLATE:
1131 #ifdef HAVE_ZLIB_H
1132 		if (zip->stream_valid)
1133 			r = inflateReset(&(zip->stream));
1134 		else
1135 			r = inflateInit2(&(zip->stream),
1136 			    -15 /* Don't check for zlib header */);
1137 		if (r != Z_OK) {
1138 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1139 			    "Couldn't initialize zlib stream.");
1140 			return (ARCHIVE_FAILED);
1141 		}
1142 		zip->stream_valid = 1;
1143 		zip->stream.total_in = 0;
1144 		zip->stream.total_out = 0;
1145 		break;
1146 #else
1147 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1148 		    "DEFLATE codec is unsupported");
1149 		return (ARCHIVE_FAILED);
1150 #endif
1151 	case _7Z_PPMD:
1152 	{
1153 		unsigned order;
1154 		uint32_t msize;
1155 
1156 		if (zip->ppmd7_valid) {
1157 			__archive_ppmd7_functions.Ppmd7_Free(
1158 			    &zip->ppmd7_context, &g_szalloc);
1159 			zip->ppmd7_valid = 0;
1160 		}
1161 
1162 		if (coder1->propertiesSize < 5) {
1163 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1164 			    "Malformed PPMd parameter");
1165 			return (ARCHIVE_FAILED);
1166 		}
1167 		order = coder1->properties[0];
1168 		msize = archive_le32dec(&(coder1->properties[1]));
1169 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1170 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1171 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1172 			    "Malformed PPMd parameter");
1173 			return (ARCHIVE_FAILED);
1174 		}
1175 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1176 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1177 			&zip->ppmd7_context, msize, &g_szalloc);
1178 		if (r == 0) {
1179 			archive_set_error(&a->archive, ENOMEM,
1180 			    "Coludn't allocate memory for PPMd");
1181 			return (ARCHIVE_FATAL);
1182 		}
1183 		__archive_ppmd7_functions.Ppmd7_Init(
1184 			&zip->ppmd7_context, order);
1185 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1186 			&zip->range_dec);
1187 		zip->ppmd7_valid = 1;
1188 		zip->ppmd7_stat = 0;
1189 		zip->ppstream.overconsumed = 0;
1190 		zip->ppstream.total_in = 0;
1191 		zip->ppstream.total_out = 0;
1192 		break;
1193 	}
1194 	case _7Z_X86:
1195 	case _7Z_X86_BCJ2:
1196 	case _7Z_POWERPC:
1197 	case _7Z_IA64:
1198 	case _7Z_ARM:
1199 	case _7Z_ARMTHUMB:
1200 	case _7Z_SPARC:
1201 	case _7Z_DELTA:
1202 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1203 		    "Unexpected codec ID: %lX", zip->codec);
1204 		return (ARCHIVE_FAILED);
1205 	default:
1206 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1207 		    "Unknown codec ID: %lX", zip->codec);
1208 		return (ARCHIVE_FAILED);
1209 	}
1210 
1211 	return (ARCHIVE_OK);
1212 }
1213 
1214 static int
1215 decompress(struct archive_read *a, struct _7zip *zip,
1216     void *buff, size_t *outbytes, const void *b, size_t *used)
1217 {
1218 	const uint8_t *t_next_in;
1219 	uint8_t *t_next_out;
1220 	size_t o_avail_in, o_avail_out;
1221 	size_t t_avail_in, t_avail_out;
1222 	uint8_t *bcj2_next_out;
1223 	size_t bcj2_avail_out;
1224 	int r, ret = ARCHIVE_OK;
1225 
1226 	t_avail_in = o_avail_in = *used;
1227 	t_avail_out = o_avail_out = *outbytes;
1228 	t_next_in = b;
1229 	t_next_out = buff;
1230 
1231 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1232 		int i;
1233 
1234 		/* Do not copy out the BCJ remaining bytes when the output
1235 		 * buffer size is less than five bytes. */
1236 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1237 			*used = 0;
1238 			*outbytes = 0;
1239 			return (ret);
1240 		}
1241 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1242 			*t_next_out++ = zip->odd_bcj[i];
1243 			t_avail_out--;
1244 			zip->odd_bcj_size--;
1245 		}
1246 		if (o_avail_in == 0 || t_avail_out == 0) {
1247 			*used = o_avail_in - t_avail_in;
1248 			*outbytes = o_avail_out - t_avail_out;
1249 			if (o_avail_in == 0)
1250 				ret = ARCHIVE_EOF;
1251 			return (ret);
1252 		}
1253 	}
1254 
1255 	bcj2_next_out = t_next_out;
1256 	bcj2_avail_out = t_avail_out;
1257 	if (zip->codec2 == _7Z_X86_BCJ2) {
1258 		/*
1259 		 * Decord a remaining decompressed main stream for BCJ2.
1260 		 */
1261 		if (zip->tmp_stream_bytes_remaining) {
1262 			ssize_t bytes;
1263 			size_t remaining = zip->tmp_stream_bytes_remaining;
1264 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1265 			if (bytes < 0) {
1266 				archive_set_error(&(a->archive),
1267 				    ARCHIVE_ERRNO_MISC,
1268 				    "BCJ2 conversion Failed");
1269 				return (ARCHIVE_FAILED);
1270 			}
1271 			zip->main_stream_bytes_remaining -=
1272 			    remaining - zip->tmp_stream_bytes_remaining;
1273 			t_avail_out -= bytes;
1274 			if (o_avail_in == 0 || t_avail_out == 0) {
1275 				*used = 0;
1276 				*outbytes = o_avail_out - t_avail_out;
1277 				if (o_avail_in == 0 &&
1278 				    zip->tmp_stream_bytes_remaining)
1279 					ret = ARCHIVE_EOF;
1280 				return (ret);
1281 			}
1282 			t_next_out += bytes;
1283 			bcj2_next_out = t_next_out;
1284 			bcj2_avail_out = t_avail_out;
1285 		}
1286 		t_next_out = zip->tmp_stream_buff;
1287 		t_avail_out = zip->tmp_stream_buff_size;
1288 	}
1289 
1290 	switch (zip->codec) {
1291 	case _7Z_COPY:
1292 	{
1293 		size_t bytes =
1294 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1295 
1296 		memcpy(t_next_out, t_next_in, bytes);
1297 		t_avail_in -= bytes;
1298 		t_avail_out -= bytes;
1299 		if (o_avail_in == 0)
1300 			ret = ARCHIVE_EOF;
1301 		break;
1302 	}
1303 #ifdef HAVE_LZMA_H
1304 	case _7Z_LZMA: case _7Z_LZMA2:
1305 		zip->lzstream.next_in = t_next_in;
1306 		zip->lzstream.avail_in = t_avail_in;
1307 		zip->lzstream.next_out = t_next_out;
1308 		zip->lzstream.avail_out = t_avail_out;
1309 
1310 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1311 		switch (r) {
1312 		case LZMA_STREAM_END: /* Found end of stream. */
1313 			lzma_end(&(zip->lzstream));
1314 			zip->lzstream_valid = 0;
1315 			ret = ARCHIVE_EOF;
1316 			break;
1317 		case LZMA_OK: /* Decompressor made some progress. */
1318 			break;
1319 		default:
1320 			archive_set_error(&(a->archive),
1321 			    ARCHIVE_ERRNO_MISC,
1322 				"Decompression failed(%d)",
1323 			    r);
1324 			return (ARCHIVE_FAILED);
1325 		}
1326 		t_avail_in = zip->lzstream.avail_in;
1327 		t_avail_out = zip->lzstream.avail_out;
1328 		break;
1329 #endif
1330 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1331 	case _7Z_BZ2:
1332 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1333 		zip->bzstream.avail_in = t_avail_in;
1334 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1335 		zip->bzstream.avail_out = t_avail_out;
1336 		r = BZ2_bzDecompress(&(zip->bzstream));
1337 		switch (r) {
1338 		case BZ_STREAM_END: /* Found end of stream. */
1339 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1340 			case BZ_OK:
1341 				break;
1342 			default:
1343 				archive_set_error(&(a->archive),
1344 				    ARCHIVE_ERRNO_MISC,
1345 				    "Failed to clean up decompressor");
1346 				return (ARCHIVE_FAILED);
1347 			}
1348 			zip->bzstream_valid = 0;
1349 			ret = ARCHIVE_EOF;
1350 			break;
1351 		case BZ_OK: /* Decompressor made some progress. */
1352 			break;
1353 		default:
1354 			archive_set_error(&(a->archive),
1355 			    ARCHIVE_ERRNO_MISC,
1356 			    "bzip decompression failed");
1357 			return (ARCHIVE_FAILED);
1358 		}
1359 		t_avail_in = zip->bzstream.avail_in;
1360 		t_avail_out = zip->bzstream.avail_out;
1361 		break;
1362 #endif
1363 #ifdef HAVE_ZLIB_H
1364 	case _7Z_DEFLATE:
1365 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1366 		zip->stream.avail_in = t_avail_in;
1367 		zip->stream.next_out = t_next_out;
1368 		zip->stream.avail_out = t_avail_out;
1369 		r = inflate(&(zip->stream), 0);
1370 		switch (r) {
1371 		case Z_STREAM_END: /* Found end of stream. */
1372 			ret = ARCHIVE_EOF;
1373 			break;
1374 		case Z_OK: /* Decompressor made some progress.*/
1375 			break;
1376 		default:
1377 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1378 			    "File decompression failed (%d)", r);
1379 			return (ARCHIVE_FAILED);
1380 		}
1381 		t_avail_in = zip->stream.avail_in;
1382 		t_avail_out = zip->stream.avail_out;
1383 		break;
1384 #endif
1385 	case _7Z_PPMD:
1386 	{
1387 		uint64_t flush_bytes;
1388 
1389 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1390 		    t_avail_out <= 0) {
1391 			archive_set_error(&(a->archive),
1392 			    ARCHIVE_ERRNO_MISC,
1393 			    "Decompression internal error");
1394 			return (ARCHIVE_FAILED);
1395 		}
1396 		zip->ppstream.next_in = t_next_in;
1397 		zip->ppstream.avail_in = t_avail_in;
1398 		zip->ppstream.next_out = t_next_out;
1399 		zip->ppstream.avail_out = t_avail_out;
1400 		if (zip->ppmd7_stat == 0) {
1401 			zip->bytein.a = a;
1402 			zip->bytein.Read = &ppmd_read;
1403 			zip->range_dec.Stream = &zip->bytein;
1404 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1405 				&(zip->range_dec));
1406 			if (r == 0) {
1407 				zip->ppmd7_stat = -1;
1408 				archive_set_error(&a->archive,
1409 				    ARCHIVE_ERRNO_MISC,
1410 				    "Failed to initialize PPMd range decorder");
1411 				return (ARCHIVE_FAILED);
1412 			}
1413 			if (zip->ppstream.overconsumed) {
1414 				zip->ppmd7_stat = -1;
1415 				return (ARCHIVE_FAILED);
1416 			}
1417 			zip->ppmd7_stat = 1;
1418 		}
1419 
1420 		if (t_avail_in == 0)
1421 			/* XXX Flush out remaining decoded data XXX */
1422 			flush_bytes = zip->folder_outbytes_remaining;
1423 		else
1424 			flush_bytes = 0;
1425 
1426 		do {
1427 			int sym;
1428 
1429 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1430 				&(zip->ppmd7_context), &(zip->range_dec.p));
1431 			if (sym < 0) {
1432 				zip->ppmd7_stat = -1;
1433 				archive_set_error(&a->archive,
1434 				    ARCHIVE_ERRNO_FILE_FORMAT,
1435 				    "Failed to decode PPMd");
1436 				return (ARCHIVE_FAILED);
1437 			}
1438 			if (zip->ppstream.overconsumed) {
1439 				zip->ppmd7_stat = -1;
1440 				return (ARCHIVE_FAILED);
1441 			}
1442 			*zip->ppstream.next_out++ = (unsigned char)sym;
1443 			zip->ppstream.avail_out--;
1444 			zip->ppstream.total_out++;
1445 			if (flush_bytes)
1446 				flush_bytes--;
1447 		} while (zip->ppstream.avail_out &&
1448 			(zip->ppstream.avail_in || flush_bytes));
1449 
1450 		t_avail_in = (size_t)zip->ppstream.avail_in;
1451 		t_avail_out = (size_t)zip->ppstream.avail_out;
1452 		break;
1453 	}
1454 	default:
1455 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1456 		    "Decompression internal error");
1457 		return (ARCHIVE_FAILED);
1458 	}
1459 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1460 		return (ret);
1461 
1462 	*used = o_avail_in - t_avail_in;
1463 	*outbytes = o_avail_out - t_avail_out;
1464 
1465 	/*
1466 	 * Decord BCJ.
1467 	 */
1468 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1469 		size_t l = x86_Convert(zip, buff, *outbytes);
1470 		zip->odd_bcj_size = *outbytes - l;
1471 		if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1472 		    o_avail_in && ret != ARCHIVE_EOF) {
1473 			memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1474 			    zip->odd_bcj_size);
1475 			*outbytes = l;
1476 		} else
1477 			zip->odd_bcj_size = 0;
1478 	}
1479 
1480 	/*
1481 	 * Decord BCJ2 with a decompressed main stream.
1482 	 */
1483 	if (zip->codec2 == _7Z_X86_BCJ2) {
1484 		ssize_t bytes;
1485 
1486 		zip->tmp_stream_bytes_avail =
1487 		    zip->tmp_stream_buff_size - t_avail_out;
1488 		if (zip->tmp_stream_bytes_avail >
1489 		      zip->main_stream_bytes_remaining)
1490 			zip->tmp_stream_bytes_avail =
1491 			    zip->main_stream_bytes_remaining;
1492 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1493 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1494 		if (bytes < 0) {
1495 			archive_set_error(&(a->archive),
1496 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1497 			return (ARCHIVE_FAILED);
1498 		}
1499 		zip->main_stream_bytes_remaining -=
1500 		    zip->tmp_stream_bytes_avail
1501 		      - zip->tmp_stream_bytes_remaining;
1502 		bcj2_avail_out -= bytes;
1503 		*outbytes = o_avail_out - bcj2_avail_out;
1504 	}
1505 
1506 	return (ret);
1507 }
1508 
1509 static int
1510 free_decompression(struct archive_read *a, struct _7zip *zip)
1511 {
1512 	int r = ARCHIVE_OK;
1513 
1514 #if !defined(HAVE_ZLIB_H) &&\
1515 	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1516 	(void)a;/* UNUSED */
1517 #endif
1518 #ifdef HAVE_LZMA_H
1519 	if (zip->lzstream_valid)
1520 		lzma_end(&(zip->lzstream));
1521 #endif
1522 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1523 	if (zip->bzstream_valid) {
1524 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1525 			archive_set_error(&a->archive,
1526 			    ARCHIVE_ERRNO_MISC,
1527 			    "Failed to clean up bzip2 decompressor");
1528 			r = ARCHIVE_FATAL;
1529 		}
1530 		zip->bzstream_valid = 0;
1531 	}
1532 #endif
1533 #ifdef HAVE_ZLIB_H
1534 	if (zip->stream_valid) {
1535 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1536 			archive_set_error(&a->archive,
1537 			    ARCHIVE_ERRNO_MISC,
1538 			    "Failed to clean up zlib decompressor");
1539 			r = ARCHIVE_FATAL;
1540 		}
1541 		zip->stream_valid = 0;
1542 	}
1543 #endif
1544 	if (zip->ppmd7_valid) {
1545 		__archive_ppmd7_functions.Ppmd7_Free(
1546 			&zip->ppmd7_context, &g_szalloc);
1547 		zip->ppmd7_valid = 0;
1548 	}
1549 	return (r);
1550 }
1551 
1552 static int
1553 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1554 {
1555 	const unsigned char *p;
1556 	unsigned char avail, mask;
1557 	int i;
1558 
1559 	if ((p = header_bytes(a, 1)) == NULL)
1560 		return (-1);
1561 	avail = *p;
1562 	mask = 0x80;
1563 	*val = 0;
1564 	for (i = 0; i < 8; i++) {
1565 		if (avail & mask) {
1566 			if ((p = header_bytes(a, 1)) == NULL)
1567 				return (-1);
1568 			*val |= ((uint64_t)*p) << (8 * i);
1569 			mask >>= 1;
1570 			continue;
1571 		}
1572 		*val += (avail & (mask -1)) << (8 * i);
1573 		break;
1574 	}
1575 	return (0);
1576 }
1577 
1578 static int
1579 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1580 {
1581 	const unsigned char *p;
1582 	unsigned i, mask = 0, avail = 0;
1583 
1584 	for (i = 0; i < num; i++) {
1585 		if (mask == 0) {
1586 			if ((p = header_bytes(a, 1)) == NULL)
1587 				return (-1);
1588 			avail = *p;
1589 			mask = 0x80;
1590 		}
1591 		data[i] = (avail & mask)?1:0;
1592 		mask >>= 1;
1593 	}
1594 	return (0);
1595 }
1596 
1597 static void
1598 free_Digest(struct _7z_digests *d)
1599 {
1600 	free(d->defineds);
1601 	free(d->digests);
1602 }
1603 
1604 static int
1605 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1606 {
1607 	const unsigned char *p;
1608 	unsigned i;
1609 
1610 	memset(d, 0, sizeof(*d));
1611 
1612 
1613 	d->defineds = malloc(num);
1614 	if (d->defineds == NULL)
1615 		return (-1);
1616 	/*
1617 	 * Read Bools.
1618 	 */
1619 	if ((p = header_bytes(a, 1)) == NULL)
1620 		return (-1);
1621 	if (*p == 0) {
1622 		if (read_Bools(a, d->defineds, num) < 0)
1623 			return (-1);
1624 	} else
1625 		/* All are defined */
1626 		memset(d->defineds, 1, num);
1627 
1628 	d->digests = calloc(num, sizeof(*d->digests));
1629 	if (d->digests == NULL)
1630 		return (-1);
1631 	for (i = 0; i < num; i++) {
1632 		if (d->defineds[i]) {
1633 			if ((p = header_bytes(a, 4)) == NULL)
1634 				return (-1);
1635 			d->digests[i] = archive_le32dec(p);
1636 		}
1637 	}
1638 
1639 	return (0);
1640 }
1641 
1642 static void
1643 free_PackInfo(struct _7z_pack_info *pi)
1644 {
1645 	free(pi->sizes);
1646 	free(pi->positions);
1647 	free_Digest(&(pi->digest));
1648 }
1649 
1650 static int
1651 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1652 {
1653 	const unsigned char *p;
1654 	unsigned i;
1655 
1656 	memset(pi, 0, sizeof(*pi));
1657 
1658 	/*
1659 	 * Read PackPos.
1660 	 */
1661 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1662 		return (-1);
1663 
1664 	/*
1665 	 * Read NumPackStreams.
1666 	 */
1667 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1668 		return (-1);
1669 	if (pi->numPackStreams == 0)
1670 		return (-1);
1671 	if (1000000 < pi->numPackStreams)
1672 		return (-1);
1673 
1674 	/*
1675 	 * Read PackSizes[num]
1676 	 */
1677 	if ((p = header_bytes(a, 1)) == NULL)
1678 		return (-1);
1679 	if (*p == kEnd)
1680 		/* PackSizes[num] are not present. */
1681 		return (0);
1682 	if (*p != kSize)
1683 		return (-1);
1684 	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1685 	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1686 	if (pi->sizes == NULL || pi->positions == NULL)
1687 		return (-1);
1688 
1689 	for (i = 0; i < pi->numPackStreams; i++) {
1690 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1691 			return (-1);
1692 	}
1693 
1694 	/*
1695 	 * Read PackStreamDigests[num]
1696 	 */
1697 	if ((p = header_bytes(a, 1)) == NULL)
1698 		return (-1);
1699 	if (*p == kEnd) {
1700 		/* PackStreamDigests[num] are not present. */
1701 		pi->digest.defineds =
1702 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1703 		pi->digest.digests =
1704 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1705 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1706 			return (-1);
1707 		return (0);
1708 	}
1709 
1710 	if (*p != kSize)
1711 		return (-1);
1712 
1713 	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1714 		return (-1);
1715 
1716 	/*
1717 	 *  Must be marked by kEnd.
1718 	 */
1719 	if ((p = header_bytes(a, 1)) == NULL)
1720 		return (-1);
1721 	if (*p != kEnd)
1722 		return (-1);
1723 	return (0);
1724 }
1725 
1726 static void
1727 free_Folder(struct _7z_folder *f)
1728 {
1729 	unsigned i;
1730 
1731 	if (f->coders) {
1732 		for (i = 0; i< f->numCoders; i++) {
1733 			free(f->coders[i].properties);
1734 		}
1735 		free(f->coders);
1736 	}
1737 	free(f->bindPairs);
1738 	free(f->packedStreams);
1739 	free(f->unPackSize);
1740 }
1741 
1742 static int
1743 read_Folder(struct archive_read *a, struct _7z_folder *f)
1744 {
1745 	struct _7zip *zip = (struct _7zip *)a->format->data;
1746 	const unsigned char *p;
1747 	uint64_t numInStreamsTotal = 0;
1748 	uint64_t numOutStreamsTotal = 0;
1749 	unsigned i;
1750 
1751 	memset(f, 0, sizeof(*f));
1752 
1753 	/*
1754 	 * Read NumCoders.
1755 	 */
1756 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1757 		return (-1);
1758 	if (f->numCoders > 4)
1759 		/* Too many coders. */
1760 		return (-1);
1761 
1762 	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1763 	if (f->coders == NULL)
1764 		return (-1);
1765 	for (i = 0; i< f->numCoders; i++) {
1766 		size_t codec_size;
1767 		int simple, attr;
1768 
1769 		if ((p = header_bytes(a, 1)) == NULL)
1770 			return (-1);
1771 		/*
1772 		 * 0:3 CodecIdSize
1773 		 * 4:  0 - IsSimple
1774 		 *     1 - Is not Simple
1775 		 * 5:  0 - No Attributes
1776 		 *     1 - There are Attributes;
1777 		 * 7:  Must be zero.
1778 		 */
1779 		codec_size = *p & 0xf;
1780 		simple = (*p & 0x10)?0:1;
1781 		attr = *p & 0x20;
1782 		if (*p & 0x80)
1783 			return (-1);/* Not supported. */
1784 
1785 		/*
1786 		 * Read Decompression Method IDs.
1787 		 */
1788 		if ((p = header_bytes(a, codec_size)) == NULL)
1789 			return (-1);
1790 
1791 		f->coders[i].codec = decode_codec_id(p, codec_size);
1792 
1793 		if (simple) {
1794 			f->coders[i].numInStreams = 1;
1795 			f->coders[i].numOutStreams = 1;
1796 		} else {
1797 			if (parse_7zip_uint64(
1798 			    a, &(f->coders[i].numInStreams)) < 0)
1799 				return (-1);
1800 			if (1000000 < f->coders[i].numInStreams)
1801 				return (-1);
1802 			if (parse_7zip_uint64(
1803 			    a, &(f->coders[i].numOutStreams)) < 0)
1804 				return (-1);
1805 			if (1000000 < f->coders[i].numOutStreams)
1806 				return (-1);
1807 		}
1808 
1809 		if (attr) {
1810 			if (parse_7zip_uint64(
1811 			    a, &(f->coders[i].propertiesSize)) < 0)
1812 				return (-1);
1813 			if ((p = header_bytes(
1814 			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
1815 				return (-1);
1816 			f->coders[i].properties =
1817 			    malloc((size_t)f->coders[i].propertiesSize);
1818 			if (f->coders[i].properties == NULL)
1819 				return (-1);
1820 			memcpy(f->coders[i].properties, p,
1821 			    (size_t)f->coders[i].propertiesSize);
1822 		}
1823 
1824 		numInStreamsTotal += f->coders[i].numInStreams;
1825 		numOutStreamsTotal += f->coders[i].numOutStreams;
1826 	}
1827 
1828 	if (numOutStreamsTotal == 0 ||
1829 	    numInStreamsTotal < numOutStreamsTotal-1)
1830 		return (-1);
1831 
1832 	f->numBindPairs = numOutStreamsTotal - 1;
1833 	if (zip->header_bytes_remaining < f->numBindPairs)
1834 			return (-1);
1835 	if (f->numBindPairs > 0) {
1836 		f->bindPairs =
1837 			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
1838 		if (f->bindPairs == NULL)
1839 			return (-1);
1840 	} else
1841 		f->bindPairs = NULL;
1842 	for (i = 0; i < f->numBindPairs; i++) {
1843 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
1844 			return (-1);
1845 		if (1000000 < f->bindPairs[i].inIndex)
1846 			return (-1);
1847 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
1848 			return (-1);
1849 		if (1000000 < f->bindPairs[i].outIndex)
1850 			return (-1);
1851 	}
1852 
1853 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
1854 	f->packedStreams =
1855 	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
1856 	if (f->packedStreams == NULL)
1857 		return (-1);
1858 	if (f->numPackedStreams == 1) {
1859 		for (i = 0; i < numInStreamsTotal; i++) {
1860 			unsigned j;
1861 			for (j = 0; j < f->numBindPairs; j++) {
1862 				if (f->bindPairs[j].inIndex == i)
1863 					break;
1864 			}
1865 			if (j == f->numBindPairs)
1866 				break;
1867 		}
1868 		if (i == numInStreamsTotal)
1869 			return (-1);
1870 		f->packedStreams[0] = i;
1871 	} else {
1872 		for (i = 0; i < f->numPackedStreams; i++) {
1873 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
1874 				return (-1);
1875 			if (1000000 < f->packedStreams[i])
1876 				return (-1);
1877 		}
1878 	}
1879 	f->numInStreams = numInStreamsTotal;
1880 	f->numOutStreams = numOutStreamsTotal;
1881 
1882 	return (0);
1883 }
1884 
1885 static void
1886 free_CodersInfo(struct _7z_coders_info *ci)
1887 {
1888 	unsigned i;
1889 
1890 	if (ci->folders) {
1891 		for (i = 0; i < ci->numFolders; i++)
1892 			free_Folder(&(ci->folders[i]));
1893 		free(ci->folders);
1894 	}
1895 }
1896 
1897 static int
1898 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
1899 {
1900 	const unsigned char *p;
1901 	struct _7z_digests digest;
1902 	unsigned i;
1903 
1904 	memset(ci, 0, sizeof(*ci));
1905 	memset(&digest, 0, sizeof(digest));
1906 
1907 	if ((p = header_bytes(a, 1)) == NULL)
1908 		goto failed;
1909 	if (*p != kFolder)
1910 		goto failed;
1911 
1912 	/*
1913 	 * Read NumFolders.
1914 	 */
1915 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
1916 		goto failed;
1917 	if (1000000 < ci->numFolders)
1918 			return (-1);
1919 
1920 	/*
1921 	 * Read External.
1922 	 */
1923 	if ((p = header_bytes(a, 1)) == NULL)
1924 		goto failed;
1925 	switch (*p) {
1926 	case 0:
1927 		ci->folders =
1928 			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
1929 		if (ci->folders == NULL)
1930 			return (-1);
1931 		for (i = 0; i < ci->numFolders; i++) {
1932 			if (read_Folder(a, &(ci->folders[i])) < 0)
1933 				goto failed;
1934 		}
1935 		break;
1936 	case 1:
1937 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
1938 			return (-1);
1939 		if (1000000 < ci->dataStreamIndex)
1940 			return (-1);
1941 		break;
1942 	}
1943 
1944 	if ((p = header_bytes(a, 1)) == NULL)
1945 		goto failed;
1946 	if (*p != kCodersUnPackSize)
1947 		goto failed;
1948 
1949 	for (i = 0; i < ci->numFolders; i++) {
1950 		struct _7z_folder *folder = &(ci->folders[i]);
1951 		unsigned j;
1952 
1953 		folder->unPackSize =
1954 		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
1955 		if (folder->unPackSize == NULL)
1956 			goto failed;
1957 		for (j = 0; j < folder->numOutStreams; j++) {
1958 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
1959 				goto failed;
1960 		}
1961 	}
1962 
1963 	/*
1964 	 * Read CRCs.
1965 	 */
1966 	if ((p = header_bytes(a, 1)) == NULL)
1967 		goto failed;
1968 	if (*p == kEnd)
1969 		return (0);
1970 	if (*p != kCRC)
1971 		goto failed;
1972 	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
1973 		goto failed;
1974 	for (i = 0; i < ci->numFolders; i++) {
1975 		ci->folders[i].digest_defined = digest.defineds[i];
1976 		ci->folders[i].digest = digest.digests[i];
1977 	}
1978 
1979 	/*
1980 	 *  Must be kEnd.
1981 	 */
1982 	if ((p = header_bytes(a, 1)) == NULL)
1983 		goto failed;
1984 	if (*p != kEnd)
1985 		goto failed;
1986 	free_Digest(&digest);
1987 	return (0);
1988 failed:
1989 	free_Digest(&digest);
1990 	return (-1);
1991 }
1992 
1993 static uint64_t
1994 folder_uncompressed_size(struct _7z_folder *f)
1995 {
1996 	int n = (int)f->numOutStreams;
1997 	unsigned pairs = (unsigned)f->numBindPairs;
1998 
1999 	while (--n >= 0) {
2000 		unsigned i;
2001 		for (i = 0; i < pairs; i++) {
2002 			if (f->bindPairs[i].outIndex == (uint64_t)n)
2003 				break;
2004 		}
2005 		if (i >= pairs)
2006 			return (f->unPackSize[n]);
2007 	}
2008 	return (0);
2009 }
2010 
2011 static void
2012 free_SubStreamsInfo(struct _7z_substream_info *ss)
2013 {
2014 	free(ss->unpackSizes);
2015 	free(ss->digestsDefined);
2016 	free(ss->digests);
2017 }
2018 
2019 static int
2020 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2021     struct _7z_folder *f, size_t numFolders)
2022 {
2023 	const unsigned char *p;
2024 	uint64_t *usizes;
2025 	size_t unpack_streams;
2026 	int type;
2027 	unsigned i;
2028 	uint32_t numDigests;
2029 
2030 	memset(ss, 0, sizeof(*ss));
2031 
2032 	for (i = 0; i < numFolders; i++)
2033 		f[i].numUnpackStreams = 1;
2034 
2035 	if ((p = header_bytes(a, 1)) == NULL)
2036 		return (-1);
2037 	type = *p;
2038 
2039 	if (type == kNumUnPackStream) {
2040 		unpack_streams = 0;
2041 		for (i = 0; i < numFolders; i++) {
2042 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2043 				return (-1);
2044 			if (1000000 < f[i].numUnpackStreams)
2045 				return (-1);
2046 			unpack_streams += (size_t)f[i].numUnpackStreams;
2047 		}
2048 		if ((p = header_bytes(a, 1)) == NULL)
2049 			return (-1);
2050 		type = *p;
2051 	} else
2052 		unpack_streams = numFolders;
2053 
2054 	ss->unpack_streams = unpack_streams;
2055 	if (unpack_streams) {
2056 		ss->unpackSizes = calloc(unpack_streams,
2057 		    sizeof(*ss->unpackSizes));
2058 		ss->digestsDefined = calloc(unpack_streams,
2059 		    sizeof(*ss->digestsDefined));
2060 		ss->digests = calloc(unpack_streams,
2061 		    sizeof(*ss->digests));
2062 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2063 		    ss->digests == NULL)
2064 			return (-1);
2065 	}
2066 
2067 	usizes = ss->unpackSizes;
2068 	for (i = 0; i < numFolders; i++) {
2069 		unsigned pack;
2070 		uint64_t sum;
2071 
2072 		if (f[i].numUnpackStreams == 0)
2073 			continue;
2074 
2075 		sum = 0;
2076 		if (type == kSize) {
2077 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2078 				if (parse_7zip_uint64(a, usizes) < 0)
2079 					return (-1);
2080 				sum += *usizes++;
2081 			}
2082 		}
2083 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2084 	}
2085 
2086 	if (type == kSize) {
2087 		if ((p = header_bytes(a, 1)) == NULL)
2088 			return (-1);
2089 		type = *p;
2090 	}
2091 
2092 	for (i = 0; i < unpack_streams; i++) {
2093 		ss->digestsDefined[i] = 0;
2094 		ss->digests[i] = 0;
2095 	}
2096 
2097 	numDigests = 0;
2098 	for (i = 0; i < numFolders; i++) {
2099 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2100 			numDigests += (uint32_t)f[i].numUnpackStreams;
2101 	}
2102 
2103 	if (type == kCRC) {
2104 		struct _7z_digests tmpDigests;
2105 		unsigned char *digestsDefined = ss->digestsDefined;
2106 		uint32_t * digests = ss->digests;
2107 		int di = 0;
2108 
2109 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2110 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2111 			free_Digest(&tmpDigests);
2112 			return (-1);
2113 		}
2114 		for (i = 0; i < numFolders; i++) {
2115 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2116 				*digestsDefined++ = 1;
2117 				*digests++ = f[i].digest;
2118 			} else {
2119 				unsigned j;
2120 
2121 				for (j = 0; j < f[i].numUnpackStreams;
2122 				    j++, di++) {
2123 					*digestsDefined++ =
2124 					    tmpDigests.defineds[di];
2125 					*digests++ =
2126 					    tmpDigests.digests[di];
2127 				}
2128 			}
2129 		}
2130 		free_Digest(&tmpDigests);
2131 		if ((p = header_bytes(a, 1)) == NULL)
2132 			return (-1);
2133 		type = *p;
2134 	}
2135 
2136 	/*
2137 	 *  Must be kEnd.
2138 	 */
2139 	if (type != kEnd)
2140 		return (-1);
2141 	return (0);
2142 }
2143 
2144 static void
2145 free_StreamsInfo(struct _7z_stream_info *si)
2146 {
2147 	free_PackInfo(&(si->pi));
2148 	free_CodersInfo(&(si->ci));
2149 	free_SubStreamsInfo(&(si->ss));
2150 }
2151 
2152 static int
2153 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2154 {
2155 	struct _7zip *zip = (struct _7zip *)a->format->data;
2156 	const unsigned char *p;
2157 	unsigned i;
2158 
2159 	memset(si, 0, sizeof(*si));
2160 
2161 	if ((p = header_bytes(a, 1)) == NULL)
2162 		return (-1);
2163 	if (*p == kPackInfo) {
2164 		uint64_t packPos;
2165 
2166 		if (read_PackInfo(a, &(si->pi)) < 0)
2167 			return (-1);
2168 
2169 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2170 			return (-1);
2171 		/*
2172 		 * Calculate packed stream positions.
2173 		 */
2174 		packPos = si->pi.pos;
2175 		for (i = 0; i < si->pi.numPackStreams; i++) {
2176 			si->pi.positions[i] = packPos;
2177 			packPos += si->pi.sizes[i];
2178 			if (packPos > zip->header_offset)
2179 				return (-1);
2180 		}
2181 		if ((p = header_bytes(a, 1)) == NULL)
2182 			return (-1);
2183 	}
2184 	if (*p == kUnPackInfo) {
2185 		uint32_t packIndex;
2186 		struct _7z_folder *f;
2187 
2188 		if (read_CodersInfo(a, &(si->ci)) < 0)
2189 			return (-1);
2190 
2191 		/*
2192 		 * Calculate packed stream indexes.
2193 		 */
2194 		packIndex = 0;
2195 		f = si->ci.folders;
2196 		for (i = 0; i < si->ci.numFolders; i++) {
2197 			f[i].packIndex = packIndex;
2198 			packIndex += (uint32_t)f[i].numPackedStreams;
2199 			if (packIndex > si->pi.numPackStreams)
2200 				return (-1);
2201 		}
2202 		if ((p = header_bytes(a, 1)) == NULL)
2203 			return (-1);
2204 	}
2205 
2206 	if (*p == kSubStreamsInfo) {
2207 		if (read_SubStreamsInfo(a, &(si->ss),
2208 		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2209 			return (-1);
2210 		if ((p = header_bytes(a, 1)) == NULL)
2211 			return (-1);
2212 	}
2213 
2214 	/*
2215 	 *  Must be kEnd.
2216 	 */
2217 	if (*p != kEnd)
2218 		return (-1);
2219 	return (0);
2220 }
2221 
2222 static void
2223 free_Header(struct _7z_header_info *h)
2224 {
2225 	free(h->emptyStreamBools);
2226 	free(h->emptyFileBools);
2227 	free(h->antiBools);
2228 	free(h->attrBools);
2229 }
2230 
2231 static int
2232 read_Header(struct archive_read *a, struct _7z_header_info *h,
2233     int check_header_id)
2234 {
2235 	struct _7zip *zip = (struct _7zip *)a->format->data;
2236 	const unsigned char *p;
2237 	struct _7z_folder *folders;
2238 	struct _7z_stream_info *si = &(zip->si);
2239 	struct _7zip_entry *entries;
2240 	uint32_t folderIndex, indexInFolder;
2241 	unsigned i;
2242 	int eindex, empty_streams, sindex;
2243 
2244 	if (check_header_id) {
2245 		/*
2246 		 * Read Header.
2247 		 */
2248 		if ((p = header_bytes(a, 1)) == NULL)
2249 			return (-1);
2250 		if (*p != kHeader)
2251 			return (-1);
2252 	}
2253 
2254 	/*
2255 	 * Read ArchiveProperties.
2256 	 */
2257 	if ((p = header_bytes(a, 1)) == NULL)
2258 		return (-1);
2259 	if (*p == kArchiveProperties) {
2260 		for (;;) {
2261 			uint64_t size;
2262 			if ((p = header_bytes(a, 1)) == NULL)
2263 				return (-1);
2264 			if (*p == 0)
2265 				break;
2266 			if (parse_7zip_uint64(a, &size) < 0)
2267 				return (-1);
2268 		}
2269 		if ((p = header_bytes(a, 1)) == NULL)
2270 			return (-1);
2271 	}
2272 
2273 	/*
2274 	 * Read MainStreamsInfo.
2275 	 */
2276 	if (*p == kMainStreamsInfo) {
2277 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2278 			return (-1);
2279 		if ((p = header_bytes(a, 1)) == NULL)
2280 			return (-1);
2281 	}
2282 	if (*p == kEnd)
2283 		return (0);
2284 
2285 	/*
2286 	 * Read FilesInfo.
2287 	 */
2288 	if (*p != kFilesInfo)
2289 		return (-1);
2290 
2291 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2292 		return (-1);
2293 	if (1000000 < zip->numFiles)
2294 			return (-1);
2295 
2296 	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2297 	if (zip->entries == NULL)
2298 		return (-1);
2299 	entries = zip->entries;
2300 
2301 	empty_streams = 0;
2302 	for (;;) {
2303 		int type;
2304 		uint64_t size;
2305 		size_t ll;
2306 
2307 		if ((p = header_bytes(a, 1)) == NULL)
2308 			return (-1);
2309 		type = *p;
2310 		if (type == kEnd)
2311 			break;
2312 
2313 		if (parse_7zip_uint64(a, &size) < 0)
2314 			return (-1);
2315 		if (zip->header_bytes_remaining < size)
2316 			return (-1);
2317 		ll = (size_t)size;
2318 
2319 		switch (type) {
2320 		case kEmptyStream:
2321 			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2322 			    sizeof(*h->emptyStreamBools));
2323 			if (h->emptyStreamBools == NULL)
2324 				return (-1);
2325 			if (read_Bools(
2326 			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2327 				return (-1);
2328 			empty_streams = 0;
2329 			for (i = 0; i < zip->numFiles; i++) {
2330 				if (h->emptyStreamBools[i])
2331 					empty_streams++;
2332 			}
2333 			break;
2334 		case kEmptyFile:
2335 			if (empty_streams <= 0) {
2336 				/* Unexcepted sequence. Skip this. */
2337 				if (header_bytes(a, ll) == NULL)
2338 					return (-1);
2339 				break;
2340 			}
2341 			h->emptyFileBools = calloc(empty_streams,
2342 			    sizeof(*h->emptyFileBools));
2343 			if (h->emptyFileBools == NULL)
2344 				return (-1);
2345 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2346 				return (-1);
2347 			break;
2348 		case kAnti:
2349 			if (empty_streams <= 0) {
2350 				/* Unexcepted sequence. Skip this. */
2351 				if (header_bytes(a, ll) == NULL)
2352 					return (-1);
2353 				break;
2354 			}
2355 			h->antiBools = calloc(empty_streams,
2356 			    sizeof(*h->antiBools));
2357 			if (h->antiBools == NULL)
2358 				return (-1);
2359 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2360 				return (-1);
2361 			break;
2362 		case kCTime:
2363 		case kATime:
2364 		case kMTime:
2365 			if (read_Times(a, h, type) < 0)
2366 				return (-1);
2367 			break;
2368 		case kName:
2369 		{
2370 			unsigned char *np;
2371 			size_t nl, nb;
2372 
2373 			/* Skip one byte. */
2374 			if ((p = header_bytes(a, 1)) == NULL)
2375 				return (-1);
2376 			ll--;
2377 
2378 			if ((ll & 1) || ll < zip->numFiles * 4)
2379 				return (-1);
2380 
2381 			zip->entry_names = malloc(ll);
2382 			if (zip->entry_names == NULL)
2383 				return (-1);
2384 			np = zip->entry_names;
2385 			nb = ll;
2386 			/*
2387 			 * Copy whole file names.
2388 			 * NOTE: This loop prevents from expanding
2389 			 * the uncompressed buffer in order not to
2390 			 * use extra memory resource.
2391 			 */
2392 			while (nb) {
2393 				size_t b;
2394 				if (nb > UBUFF_SIZE)
2395 					b = UBUFF_SIZE;
2396 				else
2397 					b = nb;
2398 				if ((p = header_bytes(a, b)) == NULL)
2399 					return (-1);
2400 				memcpy(np, p, b);
2401 				np += b;
2402 				nb -= b;
2403 			}
2404 			np = zip->entry_names;
2405 			nl = ll;
2406 
2407 			for (i = 0; i < zip->numFiles; i++) {
2408 				entries[i].utf16name = np;
2409 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2410 				entries[i].wname = (wchar_t *)np;
2411 #endif
2412 
2413 				/* Find a terminator. */
2414 				while (nl >= 2 && (np[0] || np[1])) {
2415 					np += 2;
2416 					nl -= 2;
2417 				}
2418 				if (nl < 2)
2419 					return (-1);/* Terminator not found */
2420 				entries[i].name_len = np - entries[i].utf16name;
2421 				np += 2;
2422 				nl -= 2;
2423 			}
2424 			break;
2425 		}
2426 		case kAttributes:
2427 		{
2428 			int allAreDefined;
2429 
2430 			if ((p = header_bytes(a, 2)) == NULL)
2431 				return (-1);
2432 			allAreDefined = *p;
2433 			h->attrBools = calloc((size_t)zip->numFiles,
2434 			    sizeof(*h->attrBools));
2435 			if (h->attrBools == NULL)
2436 				return (-1);
2437 			if (allAreDefined)
2438 				memset(h->attrBools, 1, (size_t)zip->numFiles);
2439 			else {
2440 				if (read_Bools(a, h->attrBools,
2441 				      (size_t)zip->numFiles) < 0)
2442 					return (-1);
2443 			}
2444 			for (i = 0; i < zip->numFiles; i++) {
2445 				if (h->attrBools[i]) {
2446 					if ((p = header_bytes(a, 4)) == NULL)
2447 						return (-1);
2448 					entries[i].attr = archive_le32dec(p);
2449 				}
2450 			}
2451 			break;
2452 		}
2453 		default:
2454 			if (header_bytes(a, ll) == NULL)
2455 				return (-1);
2456 			break;
2457 		}
2458 	}
2459 
2460 	/*
2461 	 * Set up entry's attributes.
2462 	 */
2463 	folders = si->ci.folders;
2464 	eindex = sindex = 0;
2465 	folderIndex = indexInFolder = 0;
2466 	for (i = 0; i < zip->numFiles; i++) {
2467 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2468 			entries[i].flg |= HAS_STREAM;
2469 		/* The high 16 bits of attributes is a posix file mode. */
2470 		entries[i].mode = entries[i].attr >> 16;
2471 		if (entries[i].flg & HAS_STREAM) {
2472 			if ((size_t)sindex >= si->ss.unpack_streams)
2473 				return (-1);
2474 			if (entries[i].mode == 0)
2475 				entries[i].mode = AE_IFREG | 0666;
2476 			if (si->ss.digestsDefined[sindex])
2477 				entries[i].flg |= CRC32_IS_SET;
2478 			entries[i].ssIndex = sindex;
2479 			sindex++;
2480 		} else {
2481 			int dir;
2482 			if (h->emptyFileBools == NULL)
2483 				dir = 1;
2484 			else {
2485 				if (h->emptyFileBools[eindex])
2486 					dir = 0;
2487 				else
2488 					dir = 1;
2489 				eindex++;
2490 			}
2491 			if (entries[i].mode == 0) {
2492 				if (dir)
2493 					entries[i].mode = AE_IFDIR | 0777;
2494 				else
2495 					entries[i].mode = AE_IFREG | 0666;
2496 			} else if (dir &&
2497 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2498 				entries[i].mode &= ~AE_IFMT;
2499 				entries[i].mode |= AE_IFDIR;
2500 			}
2501 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2502 			    entries[i].name_len >= 2 &&
2503 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2504 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2505 				entries[i].utf16name[entries[i].name_len] = '/';
2506 				entries[i].utf16name[entries[i].name_len+1] = 0;
2507 				entries[i].name_len += 2;
2508 			}
2509 			entries[i].ssIndex = -1;
2510 		}
2511 		if (entries[i].attr & 0x01)
2512 			entries[i].mode &= ~0222;/* Read only. */
2513 
2514 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2515 			/*
2516 			 * The entry is an empty file or a directory file,
2517 			 * those both have no contents.
2518 			 */
2519 			entries[i].folderIndex = -1;
2520 			continue;
2521 		}
2522 		if (indexInFolder == 0) {
2523 			for (;;) {
2524 				if (folderIndex >= si->ci.numFolders)
2525 					return (-1);
2526 				if (folders[folderIndex].numUnpackStreams)
2527 					break;
2528 				folderIndex++;
2529 			}
2530 		}
2531 		entries[i].folderIndex = folderIndex;
2532 		if ((entries[i].flg & HAS_STREAM) == 0)
2533 			continue;
2534 		indexInFolder++;
2535 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2536 			folderIndex++;
2537 			indexInFolder = 0;
2538 		}
2539 	}
2540 
2541 	return (0);
2542 }
2543 
2544 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2545 static void
2546 fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2547 {
2548 
2549 	if (fileTime >= EPOC_TIME) {
2550 		fileTime -= EPOC_TIME;
2551 		/* milli seconds base */
2552 		*timep = (time_t)(fileTime / 10000000);
2553 		/* nano seconds base */
2554 		*ns = (long)(fileTime % 10000000) * 100;
2555 	} else {
2556 		*timep = 0;
2557 		*ns = 0;
2558 	}
2559 }
2560 
2561 static int
2562 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2563 {
2564 	struct _7zip *zip = (struct _7zip *)a->format->data;
2565 	const unsigned char *p;
2566 	struct _7zip_entry *entries = zip->entries;
2567 	unsigned char *timeBools;
2568 	int allAreDefined;
2569 	unsigned i;
2570 
2571 	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2572 	if (timeBools == NULL)
2573 		return (-1);
2574 
2575 	/* Read allAreDefined. */
2576 	if ((p = header_bytes(a, 1)) == NULL)
2577 		goto failed;
2578 	allAreDefined = *p;
2579 	if (allAreDefined)
2580 		memset(timeBools, 1, (size_t)zip->numFiles);
2581 	else {
2582 		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2583 			goto failed;
2584 	}
2585 
2586 	/* Read external. */
2587 	if ((p = header_bytes(a, 1)) == NULL)
2588 		goto failed;
2589 	if (*p) {
2590 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2591 			goto failed;
2592 		if (1000000 < h->dataIndex)
2593 			goto failed;
2594 	}
2595 
2596 	for (i = 0; i < zip->numFiles; i++) {
2597 		if (!timeBools[i])
2598 			continue;
2599 		if ((p = header_bytes(a, 8)) == NULL)
2600 			goto failed;
2601 		switch (type) {
2602 		case kCTime:
2603 			fileTimeToUtc(archive_le64dec(p),
2604 			    &(entries[i].ctime),
2605 			    &(entries[i].ctime_ns));
2606 			entries[i].flg |= CTIME_IS_SET;
2607 			break;
2608 		case kATime:
2609 			fileTimeToUtc(archive_le64dec(p),
2610 			    &(entries[i].atime),
2611 			    &(entries[i].atime_ns));
2612 			entries[i].flg |= ATIME_IS_SET;
2613 			break;
2614 		case kMTime:
2615 			fileTimeToUtc(archive_le64dec(p),
2616 			    &(entries[i].mtime),
2617 			    &(entries[i].mtime_ns));
2618 			entries[i].flg |= MTIME_IS_SET;
2619 			break;
2620 		}
2621 	}
2622 
2623 	free(timeBools);
2624 	return (0);
2625 failed:
2626 	free(timeBools);
2627 	return (-1);
2628 }
2629 
2630 static int
2631 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2632 {
2633 	struct _7zip *zip = (struct _7zip *)a->format->data;
2634 
2635 	errno = 0;
2636 	if (read_StreamsInfo(a, si) < 0) {
2637 		if (errno == ENOMEM)
2638 			archive_set_error(&a->archive, -1,
2639 			    "Couldn't allocate memory");
2640 		else
2641 			archive_set_error(&a->archive, -1,
2642 			    "Malformed 7-Zip archive");
2643 		return (ARCHIVE_FATAL);
2644 	}
2645 
2646 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2647 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2648 		return (ARCHIVE_FATAL);
2649 	}
2650 
2651 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2652 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2653 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2654 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2655 		return (ARCHIVE_FATAL);
2656 	}
2657 
2658 	return (ARCHIVE_OK);
2659 }
2660 
2661 static const unsigned char *
2662 header_bytes(struct archive_read *a, size_t rbytes)
2663 {
2664 	struct _7zip *zip = (struct _7zip *)a->format->data;
2665 	const unsigned char *p;
2666 
2667 	if (zip->header_bytes_remaining < rbytes)
2668 		return (NULL);
2669 	if (zip->pack_stream_bytes_unconsumed)
2670 		read_consume(a);
2671 
2672 	if (zip->header_is_encoded == 0) {
2673 		p = __archive_read_ahead(a, rbytes, NULL);
2674 		if (p == NULL)
2675 			return (NULL);
2676 		zip->header_bytes_remaining -= rbytes;
2677 		zip->pack_stream_bytes_unconsumed = rbytes;
2678 	} else {
2679 		const void *buff;
2680 		ssize_t bytes;
2681 
2682 		bytes = read_stream(a, &buff, rbytes, rbytes);
2683 		if (bytes <= 0)
2684 			return (NULL);
2685 		zip->header_bytes_remaining -= bytes;
2686 		p = buff;
2687 	}
2688 
2689 	/* Update checksum */
2690 	zip->header_crc32 = crc32(zip->header_crc32, p, rbytes);
2691 	return (p);
2692 }
2693 
2694 static int
2695 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2696     struct _7z_header_info *header)
2697 {
2698 	const unsigned char *p;
2699 	uint64_t next_header_offset;
2700 	uint64_t next_header_size;
2701 	uint32_t next_header_crc;
2702 	ssize_t bytes_avail;
2703 	int check_header_crc, r;
2704 
2705 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2706 		return (ARCHIVE_FATAL);
2707 
2708 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2709 		/* This is an executable ? Must be self-extracting... */
2710 		r = skip_sfx(a, bytes_avail);
2711 		if (r < ARCHIVE_WARN)
2712 			return (r);
2713 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2714 			return (ARCHIVE_FATAL);
2715 	}
2716 	zip->seek_base += 32;
2717 
2718 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2719 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2720 		return (ARCHIVE_FATAL);
2721 	}
2722 
2723 	/* CRC check. */
2724 	if (crc32(0, (const unsigned char *)p + 12, 20)
2725 	    != archive_le32dec(p + 8)) {
2726 		archive_set_error(&a->archive, -1, "Header CRC error");
2727 		return (ARCHIVE_FATAL);
2728 	}
2729 
2730 	next_header_offset = archive_le64dec(p + 12);
2731 	next_header_size = archive_le64dec(p + 20);
2732 	next_header_crc = archive_le32dec(p + 28);
2733 
2734 	if (next_header_size == 0)
2735 		/* There is no entry in an archive file. */
2736 		return (ARCHIVE_EOF);
2737 
2738 	if (((int64_t)next_header_offset) < 0) {
2739 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2740 		return (ARCHIVE_FATAL);
2741 	}
2742 	__archive_read_consume(a, 32);
2743 	if (next_header_offset != 0) {
2744 		if (bytes_avail >= (ssize_t)next_header_offset)
2745 			__archive_read_consume(a, next_header_offset);
2746 		else if (__archive_read_seek(a,
2747 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
2748 			return (ARCHIVE_FATAL);
2749 	}
2750 	zip->stream_offset = next_header_offset;
2751 	zip->header_offset = next_header_offset;
2752 	zip->header_bytes_remaining = next_header_size;
2753 	zip->header_crc32 = 0;
2754 	zip->header_is_encoded = 0;
2755 	zip->header_is_being_read = 1;
2756 	check_header_crc = 1;
2757 
2758 	if ((p = header_bytes(a, 1)) == NULL) {
2759 		archive_set_error(&a->archive,
2760 		    ARCHIVE_ERRNO_FILE_FORMAT,
2761 		    "Truncated 7-Zip file body");
2762 		return (ARCHIVE_FATAL);
2763 	}
2764 	/* Parse ArchiveProperties. */
2765 	switch (p[0]) {
2766 	case kEncodedHeader:
2767 		/*
2768 		 * The archive has an encoded header and we have to decode it
2769 		 * in order to parse the header correctly.
2770 		 */
2771 		r = decode_encoded_header_info(a, &(zip->si));
2772 
2773 		/* Check the EncodedHeader CRC.*/
2774 		if (r == 0 && zip->header_crc32 != next_header_crc) {
2775 			archive_set_error(&a->archive, -1,
2776 			    "Damaged 7-Zip archive");
2777 			r = -1;
2778 		}
2779 		if (r == 0) {
2780 			if (zip->si.ci.folders[0].digest_defined)
2781 				next_header_crc = zip->si.ci.folders[0].digest;
2782 			else
2783 				check_header_crc = 0;
2784 			if (zip->pack_stream_bytes_unconsumed)
2785 				read_consume(a);
2786 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
2787 			if (r == 0) {
2788 				zip->header_bytes_remaining =
2789 					zip->folder_outbytes_remaining;
2790 				r = seek_pack(a);
2791 			}
2792 		}
2793 		/* Clean up StreamsInfo. */
2794 		free_StreamsInfo(&(zip->si));
2795 		memset(&(zip->si), 0, sizeof(zip->si));
2796 		if (r < 0)
2797 			return (ARCHIVE_FATAL);
2798 		zip->header_is_encoded = 1;
2799 		zip->header_crc32 = 0;
2800 		/* FALL THROUGH */
2801 	case kHeader:
2802 		/*
2803 		 * Parse the header.
2804 		 */
2805 		errno = 0;
2806 		r = read_Header(a, header, zip->header_is_encoded);
2807 		if (r < 0) {
2808 			if (errno == ENOMEM)
2809 				archive_set_error(&a->archive, -1,
2810 				    "Couldn't allocate memory");
2811 			else
2812 				archive_set_error(&a->archive, -1,
2813 				    "Damaged 7-Zip archive");
2814 			return (ARCHIVE_FATAL);
2815 		}
2816 
2817 		/*
2818 		 *  Must be kEnd.
2819 		 */
2820 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
2821 			archive_set_error(&a->archive, -1,
2822 			    "Malformed 7-Zip archive");
2823 			return (ARCHIVE_FATAL);
2824 		}
2825 
2826 		/* Check the Header CRC.*/
2827 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
2828 			archive_set_error(&a->archive, -1,
2829 			    "Malformed 7-Zip archive");
2830 			return (ARCHIVE_FATAL);
2831 		}
2832 		break;
2833 	default:
2834 		archive_set_error(&a->archive, -1,
2835 		    "Unexpected Property ID = %X", p[0]);
2836 		return (ARCHIVE_FATAL);
2837 	}
2838 
2839 	/* Clean up variables be used for decoding the archive header */
2840 	zip->pack_stream_remaining = 0;
2841 	zip->pack_stream_index = 0;
2842 	zip->folder_outbytes_remaining = 0;
2843 	zip->uncompressed_buffer_bytes_remaining = 0;
2844 	zip->pack_stream_bytes_unconsumed = 0;
2845 	zip->header_is_being_read = 0;
2846 
2847 	return (ARCHIVE_OK);
2848 }
2849 
2850 static ssize_t
2851 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
2852     size_t minimum)
2853 {
2854 	struct _7zip *zip = (struct _7zip *)a->format->data;
2855 	ssize_t bytes_avail;
2856 
2857 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2858 		/* Copy mode. */
2859 
2860 		/*
2861 		 * Note: '1' here is a performance optimization.
2862 		 * Recall that the decompression layer returns a count of
2863 		 * available bytes; asking for more than that forces the
2864 		 * decompressor to combine reads by copying data.
2865 		 */
2866 		*buff = __archive_read_ahead(a, 1, &bytes_avail);
2867 		if (bytes_avail <= 0) {
2868 			archive_set_error(&a->archive,
2869 			    ARCHIVE_ERRNO_FILE_FORMAT,
2870 			    "Truncated 7-Zip file data");
2871 			return (ARCHIVE_FATAL);
2872 		}
2873 		if ((size_t)bytes_avail >
2874 		    zip->uncompressed_buffer_bytes_remaining)
2875 			bytes_avail = (ssize_t)
2876 			    zip->uncompressed_buffer_bytes_remaining;
2877 		if ((size_t)bytes_avail > size)
2878 			bytes_avail = (ssize_t)size;
2879 
2880 		zip->pack_stream_bytes_unconsumed = bytes_avail;
2881 	} else if (zip->uncompressed_buffer_pointer == NULL) {
2882 		/* Decompression has failed. */
2883 		archive_set_error(&(a->archive),
2884 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
2885 		return (ARCHIVE_FATAL);
2886 	} else {
2887 		/* Packed mode. */
2888 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
2889 			/*
2890 			 * If remaining uncompressed data size is less than
2891 			 * the minimum size, fill the buffer up to the
2892 			 * minimum size.
2893 			 */
2894 			if (extract_pack_stream(a, minimum) < 0)
2895 				return (ARCHIVE_FATAL);
2896 		}
2897 		if (size > zip->uncompressed_buffer_bytes_remaining)
2898 			bytes_avail = (ssize_t)
2899 			    zip->uncompressed_buffer_bytes_remaining;
2900 		else
2901 			bytes_avail = (ssize_t)size;
2902 		*buff = zip->uncompressed_buffer_pointer;
2903 		zip->uncompressed_buffer_pointer += bytes_avail;
2904 	}
2905 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
2906 	return (bytes_avail);
2907 }
2908 
2909 static ssize_t
2910 extract_pack_stream(struct archive_read *a, size_t minimum)
2911 {
2912 	struct _7zip *zip = (struct _7zip *)a->format->data;
2913 	ssize_t bytes_avail;
2914 	int r;
2915 
2916 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2917 		if (minimum == 0)
2918 			minimum = 1;
2919 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
2920 		    || bytes_avail <= 0) {
2921 			archive_set_error(&a->archive,
2922 			    ARCHIVE_ERRNO_FILE_FORMAT,
2923 			    "Truncated 7-Zip file body");
2924 			return (ARCHIVE_FATAL);
2925 		}
2926 		if (bytes_avail > (ssize_t)zip->pack_stream_inbytes_remaining)
2927 			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
2928 		zip->pack_stream_inbytes_remaining -= bytes_avail;
2929 		if (bytes_avail > (ssize_t)zip->folder_outbytes_remaining)
2930 			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
2931 		zip->folder_outbytes_remaining -= bytes_avail;
2932 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
2933 		return (ARCHIVE_OK);
2934 	}
2935 
2936 	/* If the buffer hasn't been allocated, allocate it now. */
2937 	if (zip->uncompressed_buffer == NULL) {
2938 		zip->uncompressed_buffer_size = UBUFF_SIZE;
2939 		if (zip->uncompressed_buffer_size < minimum) {
2940 			zip->uncompressed_buffer_size = minimum + 1023;
2941 			zip->uncompressed_buffer_size &= ~0x3ff;
2942 		}
2943 		zip->uncompressed_buffer =
2944 		    malloc(zip->uncompressed_buffer_size);
2945 		if (zip->uncompressed_buffer == NULL) {
2946 			archive_set_error(&a->archive, ENOMEM,
2947 			    "No memory for 7-Zip decompression");
2948 			return (ARCHIVE_FATAL);
2949 		}
2950 		zip->uncompressed_buffer_bytes_remaining = 0;
2951 	} else if (zip->uncompressed_buffer_size < minimum ||
2952 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
2953 		/*
2954 		 * Make sure the uncompressed buffer can have bytes
2955 		 * at least `minimum' bytes.
2956 		 * NOTE: This case happen when reading the header.
2957 		 */
2958 		size_t used;
2959 		if (zip->uncompressed_buffer_pointer != 0)
2960 			used = zip->uncompressed_buffer_pointer -
2961 				zip->uncompressed_buffer;
2962 		else
2963 			used = 0;
2964 		if (zip->uncompressed_buffer_size < minimum) {
2965 			/*
2966 			 * Expand the uncompressed buffer up to
2967 			 * the minimum size.
2968 			 */
2969 			zip->uncompressed_buffer_size = minimum + 1023;
2970 			zip->uncompressed_buffer_size &= ~0x3ff;
2971 			zip->uncompressed_buffer =
2972 			    realloc(zip->uncompressed_buffer,
2973 				zip->uncompressed_buffer_size);
2974 			if (zip->uncompressed_buffer == NULL) {
2975 				archive_set_error(&a->archive, ENOMEM,
2976 				    "No memory for 7-Zip decompression");
2977 				return (ARCHIVE_FATAL);
2978 			}
2979 		}
2980 		/*
2981 		 * Move unconsumed bytes to the head.
2982 		 */
2983 		if (used) {
2984 			memmove(zip->uncompressed_buffer,
2985 				zip->uncompressed_buffer + used,
2986 				zip->uncompressed_buffer_bytes_remaining);
2987 		}
2988 	} else
2989 		zip->uncompressed_buffer_bytes_remaining = 0;
2990 	zip->uncompressed_buffer_pointer = NULL;
2991 	for (;;) {
2992 		size_t bytes_in, bytes_out;
2993 		const void *buff_in;
2994 		unsigned char *buff_out;
2995 		int end_of_data;
2996 
2997 		/*
2998 		 * Note: '1' here is a performance optimization.
2999 		 * Recall that the decompression layer returns a count of
3000 		 * available bytes; asking for more than that forces the
3001 		 * decompressor to combine reads by copying data.
3002 		 */
3003 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3004 		if (bytes_avail <= 0) {
3005 			archive_set_error(&a->archive,
3006 			    ARCHIVE_ERRNO_FILE_FORMAT,
3007 			    "Truncated 7-Zip file body");
3008 			return (ARCHIVE_FATAL);
3009 		}
3010 
3011 		buff_out = zip->uncompressed_buffer
3012 			+ zip->uncompressed_buffer_bytes_remaining;
3013 		bytes_out = zip->uncompressed_buffer_size
3014 			- zip->uncompressed_buffer_bytes_remaining;
3015 		bytes_in = bytes_avail;
3016 		if (bytes_in > zip->pack_stream_inbytes_remaining)
3017 			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3018 		/* Drive decompression. */
3019 		r = decompress(a, zip, buff_out, &bytes_out,
3020 			buff_in, &bytes_in);
3021 		switch (r) {
3022 		case ARCHIVE_OK:
3023 			end_of_data = 0;
3024 			break;
3025 		case ARCHIVE_EOF:
3026 			end_of_data = 1;
3027 			break;
3028 		default:
3029 			return (ARCHIVE_FATAL);
3030 		}
3031 		zip->pack_stream_inbytes_remaining -= bytes_in;
3032 		if (bytes_out > zip->folder_outbytes_remaining)
3033 			bytes_out = (size_t)zip->folder_outbytes_remaining;
3034 		zip->folder_outbytes_remaining -= bytes_out;
3035 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3036 		zip->pack_stream_bytes_unconsumed = bytes_in;
3037 
3038 		/*
3039 		 * Continue decompression until uncompressed_buffer is full.
3040 		 */
3041 		if (zip->uncompressed_buffer_bytes_remaining ==
3042 		    zip->uncompressed_buffer_size)
3043 			break;
3044 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3045 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3046 		    zip->uncompressed_buffer_size)
3047 			break;
3048 		if (zip->pack_stream_inbytes_remaining == 0 &&
3049 		    zip->folder_outbytes_remaining == 0)
3050 			break;
3051 		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3052 			archive_set_error(&(a->archive),
3053 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3054 			return (ARCHIVE_FATAL);
3055 		}
3056 		read_consume(a);
3057 	}
3058 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3059 		archive_set_error(&(a->archive),
3060 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3061 		return (ARCHIVE_FATAL);
3062 	}
3063 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3064 	return (ARCHIVE_OK);
3065 }
3066 
3067 static int
3068 seek_pack(struct archive_read *a)
3069 {
3070 	struct _7zip *zip = (struct _7zip *)a->format->data;
3071 	int64_t pack_offset;
3072 
3073 	if (zip->pack_stream_remaining <= 0) {
3074 		archive_set_error(&(a->archive),
3075 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3076 		return (ARCHIVE_FATAL);
3077 	}
3078 	zip->pack_stream_inbytes_remaining =
3079 	    zip->si.pi.sizes[zip->pack_stream_index];
3080 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3081 	if (zip->stream_offset != pack_offset) {
3082 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3083 		    SEEK_SET))
3084 			return (ARCHIVE_FATAL);
3085 		zip->stream_offset = pack_offset;
3086 	}
3087 	zip->pack_stream_index++;
3088 	zip->pack_stream_remaining--;
3089 	return (ARCHIVE_OK);
3090 }
3091 
3092 static ssize_t
3093 read_stream(struct archive_read *a, const void **buff, size_t size,
3094     size_t minimum)
3095 {
3096 	struct _7zip *zip = (struct _7zip *)a->format->data;
3097 	uint64_t skip_bytes = 0;
3098 	int r;
3099 
3100 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3101 		if (zip->pack_stream_inbytes_remaining > 0) {
3102 			r = extract_pack_stream(a, 0);
3103 			if (r < 0)
3104 				return (r);
3105 			return (get_uncompressed_data(a, buff, size, minimum));
3106 		} else if (zip->folder_outbytes_remaining > 0) {
3107 			/* Extract a remaining pack stream. */
3108 			r = extract_pack_stream(a, 0);
3109 			if (r < 0)
3110 				return (r);
3111 			return (get_uncompressed_data(a, buff, size, minimum));
3112 		}
3113 	} else
3114 		return (get_uncompressed_data(a, buff, size, minimum));
3115 
3116 	/*
3117 	 * Current pack stream has been consumed.
3118 	 */
3119 	if (zip->pack_stream_remaining == 0) {
3120 		if (zip->header_is_being_read) {
3121 			/* Invalid sequence. This might happen when
3122 			 * reading a malformed archive. */
3123 			archive_set_error(&(a->archive),
3124 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3125 			return (ARCHIVE_FATAL);
3126 		}
3127 
3128 		/*
3129 		 * All current folder's pack streams have been
3130 		 * consumed. Switch to next folder.
3131 		 */
3132 		if (zip->folder_index == 0 &&
3133 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3134 		     || zip->folder_index != zip->entry->folderIndex)) {
3135 			zip->folder_index = zip->entry->folderIndex;
3136 			skip_bytes =
3137 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3138 		}
3139 
3140 		if (zip->folder_index >= zip->si.ci.numFolders) {
3141 			/*
3142 			 * We have consumed all folders and its pack streams.
3143 			 */
3144 			*buff = NULL;
3145 			return (0);
3146 		}
3147 		r = setup_decode_folder(a,
3148 			&(zip->si.ci.folders[zip->folder_index]), 0);
3149 		if (r != ARCHIVE_OK)
3150 			return (ARCHIVE_FATAL);
3151 
3152 		zip->folder_index++;
3153 	}
3154 
3155 	/*
3156 	 * Switch to next pack stream.
3157 	 */
3158 	r = seek_pack(a);
3159 	if (r < 0)
3160 		return (r);
3161 
3162 	/* Extract a new pack stream. */
3163 	r = extract_pack_stream(a, 0);
3164 	if (r < 0)
3165 		return (r);
3166 
3167 	/*
3168 	 * Skip the bytes we alrady has skipped in skip_stream().
3169 	 */
3170 	while (skip_bytes) {
3171 		ssize_t skipped;
3172 
3173 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3174 			if (zip->pack_stream_inbytes_remaining > 0) {
3175 				r = extract_pack_stream(a, 0);
3176 				if (r < 0)
3177 					return (r);
3178 			} else if (zip->folder_outbytes_remaining > 0) {
3179 				/* Extract a remaining pack stream. */
3180 				r = extract_pack_stream(a, 0);
3181 				if (r < 0)
3182 					return (r);
3183 			} else {
3184 				archive_set_error(&a->archive,
3185 				    ARCHIVE_ERRNO_FILE_FORMAT,
3186 				    "Truncated 7-Zip file body");
3187 				return (ARCHIVE_FATAL);
3188 			}
3189 		}
3190 		skipped = get_uncompressed_data(
3191 			a, buff, (size_t)skip_bytes, 0);
3192 		if (skipped < 0)
3193 			return (skipped);
3194 		skip_bytes -= skipped;
3195 		if (zip->pack_stream_bytes_unconsumed)
3196 			read_consume(a);
3197 	}
3198 
3199 	return (get_uncompressed_data(a, buff, size, minimum));
3200 }
3201 
3202 static int
3203 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3204     int header)
3205 {
3206 	struct _7zip *zip = (struct _7zip *)a->format->data;
3207 	const struct _7z_coder *coder1, *coder2;
3208 	const char *cname = (header)?"archive header":"file content";
3209 	unsigned i;
3210 	int r, found_bcj2 = 0;
3211 
3212 	/*
3213 	 * Release the memory which the previous folder used for BCJ2.
3214 	 */
3215 	for (i = 0; i < 3; i++) {
3216 		if (zip->sub_stream_buff[i] != NULL)
3217 			free(zip->sub_stream_buff[i]);
3218 		zip->sub_stream_buff[i] = NULL;
3219 	}
3220 
3221 	/*
3222 	 * Initialize a stream reader.
3223 	 */
3224 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3225 	zip->pack_stream_index = (unsigned)folder->packIndex;
3226 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3227 	zip->uncompressed_buffer_bytes_remaining = 0;
3228 
3229 	/*
3230 	 * Check coder types.
3231 	 */
3232 	for (i = 0; i < folder->numCoders; i++) {
3233 		if (folder->coders[i].codec == _7Z_CRYPTO) {
3234 			archive_set_error(&(a->archive),
3235 			    ARCHIVE_ERRNO_MISC,
3236 			    "The %s is encrypted, "
3237 			    "but currently not supported", cname);
3238 			return (ARCHIVE_FATAL);
3239 		}
3240 		if (folder->coders[i].codec == _7Z_X86_BCJ2)
3241 			found_bcj2++;
3242 	}
3243 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3244 		archive_set_error(&(a->archive),
3245 		    ARCHIVE_ERRNO_MISC,
3246 		    "The %s is encoded with many filters, "
3247 		    "but currently not supported", cname);
3248 		return (ARCHIVE_FATAL);
3249 	}
3250 	coder1 = &(folder->coders[0]);
3251 	if (folder->numCoders == 2)
3252 		coder2 = &(folder->coders[1]);
3253 	else
3254 		coder2 = NULL;
3255 
3256 	if (found_bcj2) {
3257 		/*
3258 		 * Preparation to decode BCJ2.
3259 		 * Decoding BCJ2 requires four sources. Those are at least,
3260 		 * as far as I know, two types of the storage form.
3261 		 */
3262 		const struct _7z_coder *fc = folder->coders;
3263 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3264 		const struct _7z_coder *scoder[3] =
3265 			{&coder_copy, &coder_copy, &coder_copy};
3266 		const void *buff;
3267 		ssize_t bytes;
3268 		unsigned char *b[3] = {NULL, NULL, NULL};
3269 		uint64_t sunpack[3] ={-1, -1, -1};
3270 		size_t s[3] = {0, 0, 0};
3271 		int idx[3] = {0, 1, 2};
3272 
3273 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3274 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3275 		    zip->pack_stream_remaining == 4) {
3276 			/* Source type 1 made by 7zr or 7z with -m options. */
3277 			if (folder->bindPairs[0].inIndex == 5) {
3278 				/* The form made by 7zr */
3279 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3280 				scoder[1] = &(fc[1]);
3281 				scoder[2] = &(fc[0]);
3282 				sunpack[1] = folder->unPackSize[1];
3283 				sunpack[2] = folder->unPackSize[0];
3284 				coder1 = &(fc[2]);
3285 			} else {
3286 				/*
3287 				 * NOTE: Some patterns do not work.
3288 				 * work:
3289 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3290 				 *       -m3=(any)
3291 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3292 				 *       -m3=COPY
3293 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3294 				 *       -m3=COPY
3295 				 * not work:
3296 				 *  other patterns.
3297 				 *
3298 				 * We have to handle this like `pipe' or
3299 				 * our libarchive7s filter frame work,
3300 				 * decoding the BCJ2 main stream sequentially,
3301 				 * m3 -> m2 -> m1 -> BCJ2.
3302 				 *
3303 				 */
3304 				if (fc[0].codec == _7Z_COPY &&
3305 				    fc[1].codec == _7Z_COPY)
3306 					coder1 = &(folder->coders[2]);
3307 				else if (fc[0].codec == _7Z_COPY &&
3308 				    fc[2].codec == _7Z_COPY)
3309 					coder1 = &(folder->coders[1]);
3310 				else if (fc[1].codec == _7Z_COPY &&
3311 				    fc[2].codec == _7Z_COPY)
3312 					coder1 = &(folder->coders[0]);
3313 				else {
3314 					archive_set_error(&(a->archive),
3315 					    ARCHIVE_ERRNO_MISC,
3316 					    "Unsupported form of "
3317 					    "BCJ2 streams");
3318 					return (ARCHIVE_FATAL);
3319 				}
3320 			}
3321 			coder2 = &(fc[3]);
3322 			zip->main_stream_bytes_remaining =
3323 				(size_t)folder->unPackSize[2];
3324 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3325 		    zip->pack_stream_remaining == 4 &&
3326 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3327 			/* Source type 0 made by 7z */
3328 			zip->main_stream_bytes_remaining =
3329 				(size_t)folder->unPackSize[0];
3330 		} else {
3331 			/* We got an unexpected form. */
3332 			archive_set_error(&(a->archive),
3333 			    ARCHIVE_ERRNO_MISC,
3334 			    "Unsupported form of BCJ2 streams");
3335 			return (ARCHIVE_FATAL);
3336 		}
3337 
3338 		/* Skip the main stream at this time. */
3339 		if ((r = seek_pack(a)) < 0)
3340 			return (r);
3341 		zip->pack_stream_bytes_unconsumed =
3342 		    (size_t)zip->pack_stream_inbytes_remaining;
3343 		read_consume(a);
3344 
3345 		/* Read following three sub streams. */
3346 		for (i = 0; i < 3; i++) {
3347 			const struct _7z_coder *coder = scoder[i];
3348 
3349 			if ((r = seek_pack(a)) < 0)
3350 				return (r);
3351 
3352 			if (sunpack[i] == (uint64_t)-1)
3353 				zip->folder_outbytes_remaining =
3354 				    zip->pack_stream_inbytes_remaining;
3355 			else
3356 				zip->folder_outbytes_remaining = sunpack[i];
3357 
3358 			r = init_decompression(a, zip, coder, NULL);
3359 			if (r != ARCHIVE_OK)
3360 				return (ARCHIVE_FATAL);
3361 
3362 			/* Allocate memory for the decorded data of a sub
3363 			 * stream. */
3364 			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3365 			if (b[i] == NULL) {
3366 				archive_set_error(&a->archive, ENOMEM,
3367 				    "No memory for 7-Zip decompression");
3368 				return (ARCHIVE_FATAL);
3369 			}
3370 
3371 			/* Extract a sub stream. */
3372 			while (zip->pack_stream_inbytes_remaining > 0) {
3373 				r = extract_pack_stream(a, 0);
3374 				if (r < 0)
3375 					return (r);
3376 				bytes = get_uncompressed_data(a, &buff,
3377 				    zip->uncompressed_buffer_bytes_remaining,
3378 				    0);
3379 				if (bytes < 0)
3380 					return ((int)bytes);
3381 				memcpy(b[i]+s[i], buff, bytes);
3382 				s[i] += bytes;
3383 				if (zip->pack_stream_bytes_unconsumed)
3384 					read_consume(a);
3385 			}
3386 		}
3387 
3388 		/* Set the sub streams to the right place. */
3389 		for (i = 0; i < 3; i++) {
3390 			zip->sub_stream_buff[i] = b[idx[i]];
3391 			zip->sub_stream_size[i] = s[idx[i]];
3392 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3393 		}
3394 
3395 		/* Allocate memory used for decoded main stream bytes. */
3396 		if (zip->tmp_stream_buff == NULL) {
3397 			zip->tmp_stream_buff_size = 32 * 1024;
3398 			zip->tmp_stream_buff =
3399 			    malloc(zip->tmp_stream_buff_size);
3400 			if (zip->tmp_stream_buff == NULL) {
3401 				archive_set_error(&a->archive, ENOMEM,
3402 				    "No memory for 7-Zip decompression");
3403 				return (ARCHIVE_FATAL);
3404 			}
3405 		}
3406 		zip->tmp_stream_bytes_avail = 0;
3407 		zip->tmp_stream_bytes_remaining = 0;
3408 		zip->odd_bcj_size = 0;
3409 		zip->bcj2_outPos = 0;
3410 
3411 		/*
3412 		 * Reset a stream reader in order to read the main stream
3413 		 * of BCJ2.
3414 		 */
3415 		zip->pack_stream_remaining = 1;
3416 		zip->pack_stream_index = (unsigned)folder->packIndex;
3417 		zip->folder_outbytes_remaining =
3418 		    folder_uncompressed_size(folder);
3419 		zip->uncompressed_buffer_bytes_remaining = 0;
3420 	}
3421 
3422 	/*
3423 	 * Initialize the decompressor for the new folder's pack streams.
3424 	 */
3425 	r = init_decompression(a, zip, coder1, coder2);
3426 	if (r != ARCHIVE_OK)
3427 		return (ARCHIVE_FATAL);
3428 	return (ARCHIVE_OK);
3429 }
3430 
3431 static int64_t
3432 skip_stream(struct archive_read *a, size_t skip_bytes)
3433 {
3434 	struct _7zip *zip = (struct _7zip *)a->format->data;
3435 	const void *p;
3436 	int64_t skipped_bytes;
3437 	size_t bytes = skip_bytes;
3438 
3439 	if (zip->folder_index == 0) {
3440 		/*
3441 		 * Optimization for a list mode.
3442 		 * Avoid unncecessary decoding operations.
3443 		 */
3444 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3445 		    += skip_bytes;
3446 		return (skip_bytes);
3447 	}
3448 
3449 	while (bytes) {
3450 		skipped_bytes = read_stream(a, &p, bytes, 0);
3451 		if (skipped_bytes < 0)
3452 			return (skipped_bytes);
3453 		if (skipped_bytes == 0) {
3454 			archive_set_error(&a->archive,
3455 			    ARCHIVE_ERRNO_FILE_FORMAT,
3456 			    "Truncated 7-Zip file body");
3457 			return (ARCHIVE_FATAL);
3458 		}
3459 		bytes -= (size_t)skipped_bytes;
3460 		if (zip->pack_stream_bytes_unconsumed)
3461 			read_consume(a);
3462 	}
3463 	return (skip_bytes);
3464 }
3465 
3466 /*
3467  * Brought from LZMA SDK.
3468  *
3469  * Bra86.c -- Converter for x86 code (BCJ)
3470  * 2008-10-04 : Igor Pavlov : Public domain
3471  *
3472  */
3473 
3474 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3475 
3476 static void
3477 x86_Init(struct _7zip *zip)
3478 {
3479 	zip->bcj_state = 0;
3480 	zip->bcj_prevPosT = (size_t)0 - 1;
3481 	zip->bcj_prevMask = 0;
3482 	zip->bcj_ip = 5;
3483 }
3484 
3485 static size_t
3486 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3487 {
3488 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3489 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3490 	size_t bufferPos, prevPosT;
3491 	uint32_t ip, prevMask;
3492 
3493 	if (size < 5)
3494 		return 0;
3495 
3496 	bufferPos = 0;
3497 	prevPosT = zip->bcj_prevPosT;
3498 	prevMask = zip->bcj_prevMask;
3499 	ip = zip->bcj_ip;
3500 
3501 	for (;;) {
3502 		uint8_t *p = data + bufferPos;
3503 		uint8_t *limit = data + size - 4;
3504 
3505 		for (; p < limit; p++)
3506 			if ((*p & 0xFE) == 0xE8)
3507 				break;
3508 		bufferPos = (size_t)(p - data);
3509 		if (p >= limit)
3510 			break;
3511 		prevPosT = bufferPos - prevPosT;
3512 		if (prevPosT > 3)
3513 			prevMask = 0;
3514 		else {
3515 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3516 			if (prevMask != 0) {
3517 				unsigned char b =
3518 					p[4 - kMaskToBitNumber[prevMask]];
3519 				if (!kMaskToAllowedStatus[prevMask] ||
3520 				    Test86MSByte(b)) {
3521 					prevPosT = bufferPos;
3522 					prevMask = ((prevMask << 1) & 0x7) | 1;
3523 					bufferPos++;
3524 					continue;
3525 				}
3526 			}
3527 		}
3528 		prevPosT = bufferPos;
3529 
3530 		if (Test86MSByte(p[4])) {
3531 			uint32_t src = ((uint32_t)p[4] << 24) |
3532 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3533 				((uint32_t)p[1]);
3534 			uint32_t dest;
3535 			for (;;) {
3536 				uint8_t b;
3537 				int b_index;
3538 
3539 				dest = src - (ip + (uint32_t)bufferPos);
3540 				if (prevMask == 0)
3541 					break;
3542 				b_index = kMaskToBitNumber[prevMask] * 8;
3543 				b = (uint8_t)(dest >> (24 - b_index));
3544 				if (!Test86MSByte(b))
3545 					break;
3546 				src = dest ^ ((1 << (32 - b_index)) - 1);
3547 			}
3548 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3549 			p[3] = (uint8_t)(dest >> 16);
3550 			p[2] = (uint8_t)(dest >> 8);
3551 			p[1] = (uint8_t)dest;
3552 			bufferPos += 5;
3553 		} else {
3554 			prevMask = ((prevMask << 1) & 0x7) | 1;
3555 			bufferPos++;
3556 		}
3557 	}
3558 	zip->bcj_prevPosT = prevPosT;
3559 	zip->bcj_prevMask = prevMask;
3560 	zip->bcj_ip += bufferPos;
3561 	return (bufferPos);
3562 }
3563 
3564 /*
3565  * Brought from LZMA SDK.
3566  *
3567  * Bcj2.c -- Converter for x86 code (BCJ2)
3568  * 2008-10-04 : Igor Pavlov : Public domain
3569  *
3570  */
3571 
3572 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3573 
3574 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3575 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3576 
3577 #define kNumTopBits 24
3578 #define kTopValue ((uint32_t)1 << kNumTopBits)
3579 
3580 #define kNumBitModelTotalBits 11
3581 #define kBitModelTotal (1 << kNumBitModelTotalBits)
3582 #define kNumMoveBits 5
3583 
3584 #define RC_READ_BYTE (*buffer++)
3585 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
3586 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
3587   { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
3588 
3589 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
3590 
3591 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
3592 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
3593 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
3594 
3595 static ssize_t
3596 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
3597 {
3598 	size_t inPos = 0, outPos = 0;
3599 	const uint8_t *buf0, *buf1, *buf2, *buf3;
3600 	size_t size0, size1, size2, size3;
3601 	const uint8_t *buffer, *bufferLim;
3602 	unsigned int i, j;
3603 
3604 	size0 = zip->tmp_stream_bytes_remaining;
3605 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
3606 	size1 = zip->sub_stream_bytes_remaining[0];
3607 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
3608 	size2 = zip->sub_stream_bytes_remaining[1];
3609 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
3610 	size3 = zip->sub_stream_bytes_remaining[2];
3611 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
3612 
3613 	buffer = buf3;
3614 	bufferLim = buffer + size3;
3615 
3616 	if (zip->bcj_state == 0) {
3617 		/*
3618 		 * Initialize.
3619 		 */
3620 		zip->bcj2_prevByte = 0;
3621 		for (i = 0;
3622 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
3623 			zip->bcj2_p[i] = kBitModelTotal >> 1;
3624 		RC_INIT2;
3625 		zip->bcj_state = 1;
3626 	}
3627 
3628 	/*
3629 	 * Gather the odd bytes of a previous call.
3630 	 */
3631 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
3632 		outBuf[outPos++] = zip->odd_bcj[i];
3633 		zip->odd_bcj_size--;
3634 	}
3635 
3636 	if (outSize == 0) {
3637 		zip->bcj2_outPos += outPos;
3638 		return (outPos);
3639 	}
3640 
3641 	for (;;) {
3642 		uint8_t b;
3643 		CProb *prob;
3644 		uint32_t bound;
3645 		uint32_t ttt;
3646 
3647 		size_t limit = size0 - inPos;
3648 		if (outSize - outPos < limit)
3649 			limit = outSize - outPos;
3650 
3651 		if (zip->bcj_state == 1) {
3652 			while (limit != 0) {
3653 				uint8_t bb = buf0[inPos];
3654 				outBuf[outPos++] = bb;
3655 				if (IsJ(zip->bcj2_prevByte, bb)) {
3656 					zip->bcj_state = 2;
3657 					break;
3658 				}
3659 				inPos++;
3660 				zip->bcj2_prevByte = bb;
3661 				limit--;
3662 			}
3663 		}
3664 
3665 		if (limit == 0 || outPos == outSize)
3666 			break;
3667 		zip->bcj_state = 1;
3668 
3669 		b = buf0[inPos++];
3670 
3671 		if (b == 0xE8)
3672 			prob = zip->bcj2_p + zip->bcj2_prevByte;
3673 		else if (b == 0xE9)
3674 			prob = zip->bcj2_p + 256;
3675 		else
3676 			prob = zip->bcj2_p + 257;
3677 
3678 		IF_BIT_0(prob) {
3679 			UPDATE_0(prob)
3680 			zip->bcj2_prevByte = b;
3681 		} else {
3682 			uint32_t dest;
3683 			const uint8_t *v;
3684 			uint8_t out[4];
3685 
3686 			UPDATE_1(prob)
3687 			if (b == 0xE8) {
3688 				v = buf1;
3689 				if (size1 < 4)
3690 					return SZ_ERROR_DATA;
3691 				buf1 += 4;
3692 				size1 -= 4;
3693 			} else {
3694 				v = buf2;
3695 				if (size2 < 4)
3696 					return SZ_ERROR_DATA;
3697 				buf2 += 4;
3698 				size2 -= 4;
3699 			}
3700 			dest = (((uint32_t)v[0] << 24) |
3701 			    ((uint32_t)v[1] << 16) |
3702 			    ((uint32_t)v[2] << 8) |
3703 			    ((uint32_t)v[3])) -
3704 			    ((uint32_t)zip->bcj2_outPos + outPos + 4);
3705 			out[0] = (uint8_t)dest;
3706 			out[1] = (uint8_t)(dest >> 8);
3707 			out[2] = (uint8_t)(dest >> 16);
3708 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
3709 
3710 			for (i = 0; i < 4 && outPos < outSize; i++)
3711 				outBuf[outPos++] = out[i];
3712 			if (i < 4) {
3713 				/*
3714 				 * Save odd bytes which we could not add into
3715 				 * the output buffer because of out of space.
3716 				 */
3717 				zip->odd_bcj_size = 4 -i;
3718 				for (; i < 4; i++) {
3719 					j = i - 4 + zip->odd_bcj_size;
3720 					zip->odd_bcj[j] = out[i];
3721 				}
3722 				break;
3723 			}
3724 		}
3725 	}
3726 	zip->tmp_stream_bytes_remaining -= inPos;
3727 	zip->sub_stream_bytes_remaining[0] = size1;
3728 	zip->sub_stream_bytes_remaining[1] = size2;
3729 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
3730 	zip->bcj2_outPos += outPos;
3731 
3732 	return ((ssize_t)outPos);
3733 }
3734 
3735