1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 __FBSDID("$FreeBSD$");
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #ifdef HAVE_STDLIB_H
33 #include <stdlib.h>
34 #endif
35 #ifdef HAVE_BZLIB_H
36 #include <bzlib.h>
37 #endif
38 #ifdef HAVE_LZMA_H
39 #include <lzma.h>
40 #endif
41 #ifdef HAVE_ZLIB_H
42 #include <zlib.h>
43 #endif
44 
45 #include "archive.h"
46 #include "archive_entry.h"
47 #include "archive_entry_locale.h"
48 #include "archive_ppmd7_private.h"
49 #include "archive_private.h"
50 #include "archive_read_private.h"
51 #include "archive_endian.h"
52 
53 #ifndef HAVE_ZLIB_H
54 #include "archive_crc32.h"
55 #endif
56 
57 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
58 #define SFX_MIN_ADDR	0x27000
59 #define SFX_MAX_ADDR	0x60000
60 
61 
62 /*
63  * Codec ID
64  */
65 #define _7Z_COPY	0
66 #define _7Z_LZMA	0x030101
67 #define _7Z_LZMA2	0x21
68 #define _7Z_DEFLATE	0x040108
69 #define _7Z_BZ2		0x040202
70 #define _7Z_PPMD	0x030401
71 #define _7Z_DELTA	0x03
72 #define _7Z_CRYPTO	0x06F10701
73 #define _7Z_X86		0x03030103
74 #define _7Z_X86_BCJ2	0x0303011B
75 #define _7Z_POWERPC	0x03030205
76 #define _7Z_IA64	0x03030401
77 #define _7Z_ARM		0x03030501
78 #define _7Z_ARMTHUMB	0x03030701
79 #define _7Z_SPARC	0x03030805
80 
81 /*
82  * 7-Zip header property IDs.
83  */
84 #define kEnd			0x00
85 #define kHeader			0x01
86 #define kArchiveProperties	0x02
87 #define kAdditionalStreamsInfo	0x03
88 #define kMainStreamsInfo	0x04
89 #define kFilesInfo		0x05
90 #define kPackInfo		0x06
91 #define kUnPackInfo		0x07
92 #define kSubStreamsInfo		0x08
93 #define kSize			0x09
94 #define kCRC			0x0A
95 #define kFolder			0x0B
96 #define kCodersUnPackSize	0x0C
97 #define kNumUnPackStream	0x0D
98 #define kEmptyStream		0x0E
99 #define kEmptyFile		0x0F
100 #define kAnti			0x10
101 #define kName			0x11
102 #define kCTime			0x12
103 #define kATime			0x13
104 #define kMTime			0x14
105 #define kAttributes		0x15
106 #define kEncodedHeader		0x17
107 
108 struct _7z_digests {
109 	unsigned char	*defineds;
110 	uint32_t	*digests;
111 };
112 
113 
114 struct _7z_folder {
115 	uint64_t		 numCoders;
116 	struct _7z_coder {
117 		unsigned long	 codec;
118 		uint64_t	 numInStreams;
119 		uint64_t	 numOutStreams;
120 		uint64_t	 propertiesSize;
121 		unsigned char	*properties;
122 	} *coders;
123 	uint64_t		 numBindPairs;
124 	struct {
125 		uint64_t	 inIndex;
126 		uint64_t	 outIndex;
127 	} *bindPairs;
128 	uint64_t		 numPackedStreams;
129 	uint64_t		*packedStreams;
130 	uint64_t		 numInStreams;
131 	uint64_t		 numOutStreams;
132 	uint64_t		*unPackSize;
133 	unsigned char		 digest_defined;
134 	uint32_t		 digest;
135 	uint64_t		 numUnpackStreams;
136 	uint32_t		 packIndex;
137 	/* Unoperated bytes. */
138 	uint64_t		 skipped_bytes;
139 };
140 
141 struct _7z_coders_info {
142 	uint64_t		 numFolders;
143 	struct _7z_folder	*folders;
144 	uint64_t		 dataStreamIndex;
145 };
146 
147 struct _7z_pack_info {
148 	uint64_t		 pos;
149 	uint64_t		 numPackStreams;
150 	uint64_t		*sizes;
151 	struct _7z_digests	 digest;
152 	/* Calculated from pos and numPackStreams. */
153 	uint64_t		*positions;
154 };
155 
156 struct _7z_substream_info {
157 	size_t			 unpack_streams;
158 	uint64_t		*unpackSizes;
159 	unsigned char		*digestsDefined;
160 	uint32_t		*digests;
161 };
162 
163 struct _7z_stream_info {
164 	struct _7z_pack_info	 pi;
165 	struct _7z_coders_info	 ci;
166 	struct _7z_substream_info ss;
167 };
168 
169 struct _7z_header_info {
170 	uint64_t		 dataIndex;
171 
172 	unsigned char		*emptyStreamBools;
173 	unsigned char		*emptyFileBools;
174 	unsigned char		*antiBools;
175 	unsigned char		*attrBools;
176 };
177 
178 struct _7zip_entry {
179 	size_t			 name_len;
180 	unsigned char		*utf16name;
181 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
182 	const wchar_t		*wname;
183 #endif
184 	uint32_t		 folderIndex;
185 	uint32_t		 ssIndex;
186 	unsigned		 flg;
187 #define MTIME_IS_SET	(1<<0)
188 #define ATIME_IS_SET	(1<<1)
189 #define CTIME_IS_SET	(1<<2)
190 #define CRC32_IS_SET	(1<<3)
191 #define HAS_STREAM	(1<<4)
192 
193 	time_t			 mtime;
194 	time_t			 atime;
195 	time_t			 ctime;
196 	long			 mtime_ns;
197 	long			 atime_ns;
198 	long			 ctime_ns;
199 	uint32_t		 mode;
200 	uint32_t		 attr;
201 };
202 
203 struct _7zip {
204 	/* Structural information about the archive. */
205 	struct _7z_stream_info	 si;
206 
207 	int			 header_is_being_read;
208 	int			 header_is_encoded;
209 	uint64_t		 header_bytes_remaining;
210 	unsigned long		 header_crc32;
211 	/* Header offset to check that reading pointes of the file contens
212 	 * will not exceed the header. */
213 	uint64_t		 header_offset;
214 	/* Base offset of the archive file for a seek in case reading SFX. */
215 	uint64_t		 seek_base;
216 
217 	/* List of entries */
218 	size_t			 entries_remaining;
219 	uint64_t		 numFiles;
220 	struct _7zip_entry	*entries;
221 	struct _7zip_entry	*entry;
222 	unsigned char		*entry_names;
223 
224 	/* entry_bytes_remaining is the number of bytes we expect. */
225 	int64_t			 entry_offset;
226 	uint64_t		 entry_bytes_remaining;
227 
228 	/* Running CRC32 of the decompressed data */
229 	unsigned long		 entry_crc32;
230 
231 	/* Flags to mark progress of decompression. */
232 	char			 end_of_entry;
233 
234 	/* Uncompressed buffer control.  */
235 #define UBUFF_SIZE	(64 * 1024)
236 	unsigned char 		*uncompressed_buffer;
237 	unsigned char 		*uncompressed_buffer_pointer;
238 	size_t 			 uncompressed_buffer_size;
239 	size_t			 uncompressed_buffer_bytes_remaining;
240 
241 	/* Offset of the compressed data. */
242 	int64_t			 stream_offset;
243 
244 	/*
245 	 * Decompressing control data.
246 	 */
247 	unsigned		 folder_index;
248 	uint64_t		 folder_outbytes_remaining;
249 	unsigned		 pack_stream_index;
250 	unsigned		 pack_stream_remaining;
251 	uint64_t		 pack_stream_inbytes_remaining;
252 	size_t			 pack_stream_bytes_unconsumed;
253 
254 	/* The codec information of a folder. */
255 	unsigned long		 codec;
256 	unsigned long		 codec2;
257 
258 	/*
259 	 * Decompressor controllers.
260 	 */
261 	/* Decording LZMA1 and LZMA2 data. */
262 #ifdef HAVE_LZMA_H
263 	lzma_stream		 lzstream;
264 	int			 lzstream_valid;
265 #endif
266 	/* Decording bzip2 data. */
267 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
268 	bz_stream		 bzstream;
269 	int			 bzstream_valid;
270 #endif
271 	/* Decording deflate data. */
272 #ifdef HAVE_ZLIB_H
273 	z_stream		 stream;
274 	int			 stream_valid;
275 #endif
276 	/* Decording PPMd data. */
277 	int			 ppmd7_stat;
278 	CPpmd7			 ppmd7_context;
279 	CPpmd7z_RangeDec	 range_dec;
280 	IByteIn			 bytein;
281 	struct {
282 		const unsigned char	*next_in;
283 		int64_t			 avail_in;
284 		int64_t			 total_in;
285 		unsigned char		*next_out;
286 		int64_t			 avail_out;
287 		int64_t			 total_out;
288 		int			 overconsumed;
289 	} ppstream;
290 	int			 ppmd7_valid;
291 
292 	/* Decoding BCJ and BCJ2 data. */
293 	uint32_t		 bcj_state;
294 	size_t			 odd_bcj_size;
295 	unsigned char		 odd_bcj[4];
296 	/* Decoding BCJ data. */
297 	size_t			 bcj_prevPosT;
298 	uint32_t		 bcj_prevMask;
299 	uint32_t		 bcj_ip;
300 
301 	/* Decoding BCJ2 data. */
302 	size_t			 main_stream_bytes_remaining;
303 	unsigned char		*sub_stream_buff[3];
304 	size_t			 sub_stream_size[3];
305 	size_t			 sub_stream_bytes_remaining[3];
306 	unsigned char		*tmp_stream_buff;
307 	size_t			 tmp_stream_buff_size;
308 	size_t			 tmp_stream_bytes_avail;
309 	size_t			 tmp_stream_bytes_remaining;
310 #ifdef _LZMA_PROB32
311 #define CProb uint32_t
312 #else
313 #define CProb uint16_t
314 #endif
315 	CProb			 bcj2_p[256 + 2];
316 	uint8_t			 bcj2_prevByte;
317 	uint32_t		 bcj2_range;
318 	uint32_t		 bcj2_code;
319 	uint64_t		 bcj2_outPos;
320 
321 	/* Filename character-set conversion data. */
322 	struct archive_string_conv *sconv;
323 
324 	char			 format_name[64];
325 };
326 
327 static int	archive_read_format_7zip_bid(struct archive_read *, int);
328 static int	archive_read_format_7zip_cleanup(struct archive_read *);
329 static int	archive_read_format_7zip_read_data(struct archive_read *,
330 		    const void **, size_t *, int64_t *);
331 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
332 static int	archive_read_format_7zip_read_header(struct archive_read *,
333 		    struct archive_entry *);
334 static int	check_7zip_header_in_sfx(const char *);
335 static unsigned long decode_codec_id(const unsigned char *, size_t);
336 static int	decode_encoded_header_info(struct archive_read *,
337 		    struct _7z_stream_info *);
338 static int	decompress(struct archive_read *, struct _7zip *,
339 		    void *, size_t *, const void *, size_t *);
340 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
341 static void	fileTimeToUtc(uint64_t, time_t *, long *);
342 static uint64_t folder_uncompressed_size(struct _7z_folder *);
343 static void	free_CodersInfo(struct _7z_coders_info *);
344 static void	free_Digest(struct _7z_digests *);
345 static void	free_Folder(struct _7z_folder *);
346 static void	free_Header(struct _7z_header_info *);
347 static void	free_PackInfo(struct _7z_pack_info *);
348 static void	free_StreamsInfo(struct _7z_stream_info *);
349 static void	free_SubStreamsInfo(struct _7z_substream_info *);
350 static int	free_decompression(struct archive_read *, struct _7zip *);
351 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
352 		    size_t, size_t);
353 static const unsigned char * header_bytes(struct archive_read *, size_t);
354 static int	init_decompression(struct archive_read *, struct _7zip *,
355 		    const struct _7z_coder *, const struct _7z_coder *);
356 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
357 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
358 static int	read_CodersInfo(struct archive_read *,
359 		    struct _7z_coders_info *);
360 static int	read_Digests(struct archive_read *, struct _7z_digests *,
361 		    size_t);
362 static int	read_Folder(struct archive_read *, struct _7z_folder *);
363 static int	read_Header(struct archive_read *, struct _7z_header_info *,
364 		    int);
365 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
366 static int	read_StreamsInfo(struct archive_read *,
367 		    struct _7z_stream_info *);
368 static int	read_SubStreamsInfo(struct archive_read *,
369 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
370 static int	read_Times(struct archive_read *, struct _7z_header_info *,
371 		    int);
372 static void	read_consume(struct archive_read *);
373 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
374 		    size_t);
375 static int	seek_pack(struct archive_read *);
376 static int64_t	skip_stream(struct archive_read *, size_t);
377 static int	skip_sfx(struct archive_read *, ssize_t);
378 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
379 		    struct _7z_header_info *);
380 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
381 		    int);
382 static void	x86_Init(struct _7zip *);
383 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
384 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
385 
386 
387 int
388 archive_read_support_format_7zip(struct archive *_a)
389 {
390 	struct archive_read *a = (struct archive_read *)_a;
391 	struct _7zip *zip;
392 	int r;
393 
394 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
395 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
396 
397 	zip = calloc(1, sizeof(*zip));
398 	if (zip == NULL) {
399 		archive_set_error(&a->archive, ENOMEM,
400 		    "Can't allocate 7zip data");
401 		return (ARCHIVE_FATAL);
402 	}
403 
404 	r = __archive_read_register_format(a,
405 	    zip,
406 	    "7zip",
407 	    archive_read_format_7zip_bid,
408 	    NULL,
409 	    archive_read_format_7zip_read_header,
410 	    archive_read_format_7zip_read_data,
411 	    archive_read_format_7zip_read_data_skip,
412 	    NULL,
413 	    archive_read_format_7zip_cleanup);
414 
415 	if (r != ARCHIVE_OK)
416 		free(zip);
417 	return (ARCHIVE_OK);
418 }
419 
420 static int
421 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
422 {
423 	const char *p;
424 
425 	/* If someone has already bid more than 32, then avoid
426 	   trashing the look-ahead buffers with a seek. */
427 	if (best_bid > 32)
428 		return (-1);
429 
430 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
431 		return (0);
432 
433 	/* If first six bytes are the 7-Zip signature,
434 	 * return the bid right now. */
435 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
436 		return (48);
437 
438 	/*
439 	 * It may a 7-Zip SFX archive file. If first two bytes are
440 	 * 'M' and 'Z' available on Windows or first four bytes are
441 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
442 	 * signature. Although we will perform a seek when reading
443 	 * a header, what we do not use __archive_read_seek() here is
444 	 * due to a bidding performance.
445 	 */
446 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
447 		ssize_t offset = SFX_MIN_ADDR;
448 		ssize_t window = 4096;
449 		ssize_t bytes_avail;
450 		while (offset + window <= (SFX_MAX_ADDR)) {
451 			const char *buff = __archive_read_ahead(a,
452 					offset + window, &bytes_avail);
453 			if (buff == NULL) {
454 				/* Remaining bytes are less than window. */
455 				window >>= 1;
456 				if (window < 0x40)
457 					return (0);
458 				continue;
459 			}
460 			p = buff + offset;
461 			while (p + 32 < buff + bytes_avail) {
462 				int step = check_7zip_header_in_sfx(p);
463 				if (step == 0)
464 					return (48);
465 				p += step;
466 			}
467 			offset = p - buff;
468 		}
469 	}
470 	return (0);
471 }
472 
473 static int
474 check_7zip_header_in_sfx(const char *p)
475 {
476 	switch ((unsigned char)p[5]) {
477 	case 0x1C:
478 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
479 			return (6);
480 		/*
481 		 * Test the CRC because its extraction code has 7-Zip
482 		 * Magic Code, so we should do this in order not to
483 		 * make a mis-detection.
484 		 */
485 		if (crc32(0, (const unsigned char *)p + 12, 20)
486 			!= archive_le32dec(p + 8))
487 			return (6);
488 		/* Hit the header! */
489 		return (0);
490 	case 0x37: return (5);
491 	case 0x7A: return (4);
492 	case 0xBC: return (3);
493 	case 0xAF: return (2);
494 	case 0x27: return (1);
495 	default: return (6);
496 	}
497 }
498 
499 static int
500 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
501 {
502 	const void *h;
503 	const char *p, *q;
504 	size_t skip, offset;
505 	ssize_t bytes, window;
506 
507 	/*
508 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
509 	 * __archive_read_seek() at this time since we have
510 	 * alredy had enough data.
511 	 */
512 	if (bytes_avail > SFX_MIN_ADDR)
513 		__archive_read_consume(a, SFX_MIN_ADDR);
514 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
515 		return (ARCHIVE_FATAL);
516 
517 	offset = 0;
518 	window = 1;
519 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
520 		h = __archive_read_ahead(a, window, &bytes);
521 		if (h == NULL) {
522 			/* Remaining bytes are less than window. */
523 			window >>= 1;
524 			if (window < 0x40)
525 				goto fatal;
526 			continue;
527 		}
528 		if (bytes < 6) {
529 			/* This case might happen when window == 1. */
530 			window = 4096;
531 			continue;
532 		}
533 		p = (const char *)h;
534 		q = p + bytes;
535 
536 		/*
537 		 * Scan ahead until we find something that looks
538 		 * like the 7-Zip header.
539 		 */
540 		while (p + 32 < q) {
541 			int step = check_7zip_header_in_sfx(p);
542 			if (step == 0) {
543 				struct _7zip *zip =
544 				    (struct _7zip *)a->format->data;
545 				skip = p - (const char *)h;
546 				__archive_read_consume(a, skip);
547 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
548 				return (ARCHIVE_OK);
549 			}
550 			p += step;
551 		}
552 		skip = p - (const char *)h;
553 		__archive_read_consume(a, skip);
554 		offset += skip;
555 		if (window == 1)
556 			window = 4096;
557 	}
558 fatal:
559 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
560 	    "Couldn't find out 7-Zip header");
561 	return (ARCHIVE_FATAL);
562 }
563 
564 static int
565 archive_read_format_7zip_read_header(struct archive_read *a,
566 	struct archive_entry *entry)
567 {
568 	struct _7zip *zip = (struct _7zip *)a->format->data;
569 	struct _7zip_entry *zip_entry;
570 	int r, ret = ARCHIVE_OK;
571 
572 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
573 	if (a->archive.archive_format_name == NULL)
574 		a->archive.archive_format_name = "7-Zip";
575 
576 	if (zip->entries == NULL) {
577 		struct _7z_header_info header;
578 
579 		memset(&header, 0, sizeof(header));
580 		r = slurp_central_directory(a, zip, &header);
581 		free_Header(&header);
582 		if (r != ARCHIVE_OK)
583 			return (r);
584 		zip->entries_remaining = (size_t)zip->numFiles;
585 		zip->entry = zip->entries;
586 	} else {
587 		++zip->entry;
588 	}
589 	zip_entry = zip->entry;
590 
591 	if (zip->entries_remaining <= 0)
592 		return ARCHIVE_EOF;
593 	--zip->entries_remaining;
594 
595 	zip->entry_offset = 0;
596 	zip->end_of_entry = 0;
597 	zip->entry_crc32 = crc32(0, NULL, 0);
598 
599 	/* Setup a string conversion for a filename. */
600 	if (zip->sconv == NULL) {
601 		zip->sconv = archive_string_conversion_from_charset(
602 		    &a->archive, "UTF-16LE", 1);
603 		if (zip->sconv == NULL)
604 			return (ARCHIVE_FATAL);
605 	}
606 
607 	if (archive_entry_copy_pathname_l(entry,
608 	    (const char *)zip_entry->utf16name,
609 	    zip_entry->name_len, zip->sconv) != 0) {
610 		if (errno == ENOMEM) {
611 			archive_set_error(&a->archive, ENOMEM,
612 			    "Can't allocate memory for Pathname");
613 			return (ARCHIVE_FATAL);
614 		}
615 		archive_set_error(&a->archive,
616 		    ARCHIVE_ERRNO_FILE_FORMAT,
617 		    "Pathname cannot be converted "
618 		    "from %s to current locale.",
619 		    archive_string_conversion_charset_name(zip->sconv));
620 		ret = ARCHIVE_WARN;
621 	}
622 
623 	/* Populate some additional entry fields: */
624 	archive_entry_set_mode(entry, zip_entry->mode);
625 	if (zip_entry->flg & MTIME_IS_SET)
626 		archive_entry_set_mtime(entry, zip_entry->mtime,
627 			zip_entry->mtime_ns);
628 	if (zip_entry->flg & CTIME_IS_SET)
629 		archive_entry_set_ctime(entry, zip_entry->ctime,
630 		    zip_entry->ctime_ns);
631 	if (zip_entry->flg & ATIME_IS_SET)
632 		archive_entry_set_atime(entry, zip_entry->atime,
633 		    zip_entry->atime_ns);
634 	if (zip_entry->ssIndex != (uint32_t)-1) {
635 		zip->entry_bytes_remaining =
636 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
637 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
638 	} else {
639 		zip->entry_bytes_remaining = 0;
640 		archive_entry_set_size(entry, 0);
641 	}
642 
643 	/* If there's no body, force read_data() to return EOF immediately. */
644 	if (zip->entry_bytes_remaining < 1)
645 		zip->end_of_entry = 1;
646 
647 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
648 		unsigned char *symname = NULL;
649 		size_t symsize = 0;
650 
651 		/*
652 		 * Symbolic-name is recorded as its contents. We have to
653 		 * read the contents at this time.
654 		 */
655 		while (zip->entry_bytes_remaining > 0) {
656 			const void *buff;
657 			unsigned char *mem;
658 			size_t size;
659 			int64_t offset;
660 
661 			r = archive_read_format_7zip_read_data(a, &buff,
662 				&size, &offset);
663 			if (r < ARCHIVE_WARN) {
664 				free(symname);
665 				return (r);
666 			}
667 			mem = realloc(symname, symsize + size + 1);
668 			if (mem == NULL) {
669 				free(symname);
670 				archive_set_error(&a->archive, ENOMEM,
671 				    "Can't allocate memory for Symname");
672 				return (ARCHIVE_FATAL);
673 			}
674 			symname = mem;
675 			memcpy(symname+symsize, buff, size);
676 			symsize += size;
677 		}
678 		if (symsize == 0) {
679 			/* If there is no synname, handle it as a regular
680 			 * file. */
681 			zip_entry->mode &= ~AE_IFMT;
682 			zip_entry->mode |= AE_IFREG;
683 			archive_entry_set_mode(entry, zip_entry->mode);
684 		} else {
685 			symname[symsize] = '\0';
686 			archive_entry_copy_symlink(entry,
687 			    (const char *)symname);
688 		}
689 		free(symname);
690 		archive_entry_set_size(entry, 0);
691 	}
692 
693 	/* Set up a more descriptive format name. */
694 	sprintf(zip->format_name, "7-Zip");
695 	a->archive.archive_format_name = zip->format_name;
696 
697 	return (ret);
698 }
699 
700 static int
701 archive_read_format_7zip_read_data(struct archive_read *a,
702     const void **buff, size_t *size, int64_t *offset)
703 {
704 	struct _7zip *zip;
705 	ssize_t bytes;
706 	int ret = ARCHIVE_OK;
707 
708 	zip = (struct _7zip *)(a->format->data);
709 
710 	if (zip->pack_stream_bytes_unconsumed)
711 		read_consume(a);
712 
713 	*offset = zip->entry_offset;
714 	*size = 0;
715 	*buff = NULL;
716 	/*
717 	 * If we hit end-of-entry last time, clean up and return
718 	 * ARCHIVE_EOF this time.
719 	 */
720 	if (zip->end_of_entry)
721 		return (ARCHIVE_EOF);
722 
723 	bytes = read_stream(a, buff,
724 		(size_t)zip->entry_bytes_remaining, 0);
725 	if (bytes < 0)
726 		return ((int)bytes);
727 	if (bytes == 0) {
728 		archive_set_error(&a->archive,
729 		    ARCHIVE_ERRNO_FILE_FORMAT,
730 		    "Truncated 7-Zip file body");
731 		return (ARCHIVE_FATAL);
732 	}
733 	zip->entry_bytes_remaining -= bytes;
734 	if (zip->entry_bytes_remaining == 0)
735 		zip->end_of_entry = 1;
736 
737 	/* Update checksum */
738 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
739 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff,
740 		    (unsigned)bytes);
741 
742 	/* If we hit the end, swallow any end-of-data marker. */
743 	if (zip->end_of_entry) {
744 		/* Check computed CRC against file contents. */
745 		if ((zip->entry->flg & CRC32_IS_SET) &&
746 			zip->si.ss.digests[zip->entry->ssIndex] !=
747 		    zip->entry_crc32) {
748 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
749 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
750 			    (unsigned long)zip->entry_crc32,
751 			    (unsigned long)zip->si.ss.digests[
752 			    		zip->entry->ssIndex]);
753 			ret = ARCHIVE_WARN;
754 		}
755 	}
756 
757 	*size = bytes;
758 	*offset = zip->entry_offset;
759 	zip->entry_offset += bytes;
760 
761 	return (ret);
762 }
763 
764 static int
765 archive_read_format_7zip_read_data_skip(struct archive_read *a)
766 {
767 	struct _7zip *zip;
768 	int64_t bytes_skipped;
769 
770 	zip = (struct _7zip *)(a->format->data);
771 
772 	if (zip->pack_stream_bytes_unconsumed)
773 		read_consume(a);
774 
775 	/* If we've already read to end of data, we're done. */
776 	if (zip->end_of_entry)
777 		return (ARCHIVE_OK);
778 
779 	/*
780 	 * If the length is at the beginning, we can skip the
781 	 * compressed data much more quickly.
782 	 */
783 	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
784 	if (bytes_skipped < 0)
785 		return (ARCHIVE_FATAL);
786 	zip->entry_bytes_remaining = 0;
787 
788 	/* This entry is finished and done. */
789 	zip->end_of_entry = 1;
790 	return (ARCHIVE_OK);
791 }
792 
793 static int
794 archive_read_format_7zip_cleanup(struct archive_read *a)
795 {
796 	struct _7zip *zip;
797 
798 	zip = (struct _7zip *)(a->format->data);
799 	free_StreamsInfo(&(zip->si));
800 	free(zip->entries);
801 	free(zip->entry_names);
802 	free_decompression(a, zip);
803 	free(zip->uncompressed_buffer);
804 	free(zip->sub_stream_buff[0]);
805 	free(zip->sub_stream_buff[1]);
806 	free(zip->sub_stream_buff[2]);
807 	free(zip->tmp_stream_buff);
808 	free(zip);
809 	(a->format->data) = NULL;
810 	return (ARCHIVE_OK);
811 }
812 
813 static void
814 read_consume(struct archive_read *a)
815 {
816 	struct _7zip *zip = (struct _7zip *)a->format->data;
817 
818 	if (zip->pack_stream_bytes_unconsumed) {
819 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
820 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
821 		zip->pack_stream_bytes_unconsumed = 0;
822 	}
823 }
824 
825 #ifdef HAVE_LZMA_H
826 
827 /*
828  * Set an error code and choose an error message for liblzma.
829  */
830 static void
831 set_error(struct archive_read *a, int ret)
832 {
833 
834 	switch (ret) {
835 	case LZMA_STREAM_END: /* Found end of stream. */
836 	case LZMA_OK: /* Decompressor made some progress. */
837 		break;
838 	case LZMA_MEM_ERROR:
839 		archive_set_error(&a->archive, ENOMEM,
840 		    "Lzma library error: Cannot allocate memory");
841 		break;
842 	case LZMA_MEMLIMIT_ERROR:
843 		archive_set_error(&a->archive, ENOMEM,
844 		    "Lzma library error: Out of memory");
845 		break;
846 	case LZMA_FORMAT_ERROR:
847 		archive_set_error(&a->archive,
848 		    ARCHIVE_ERRNO_MISC,
849 		    "Lzma library error: format not recognized");
850 		break;
851 	case LZMA_OPTIONS_ERROR:
852 		archive_set_error(&a->archive,
853 		    ARCHIVE_ERRNO_MISC,
854 		    "Lzma library error: Invalid options");
855 		break;
856 	case LZMA_DATA_ERROR:
857 		archive_set_error(&a->archive,
858 		    ARCHIVE_ERRNO_MISC,
859 		    "Lzma library error: Corrupted input data");
860 		break;
861 	case LZMA_BUF_ERROR:
862 		archive_set_error(&a->archive,
863 		    ARCHIVE_ERRNO_MISC,
864 		    "Lzma library error:  No progress is possible");
865 		break;
866 	default:
867 		/* Return an error. */
868 		archive_set_error(&a->archive,
869 		    ARCHIVE_ERRNO_MISC,
870 		    "Lzma decompression failed:  Unknown error");
871 		break;
872 	}
873 }
874 
875 #endif
876 
877 static unsigned long
878 decode_codec_id(const unsigned char *codecId, size_t id_size)
879 {
880 	unsigned i;
881 	unsigned long id = 0;
882 
883 	for (i = 0; i < id_size; i++) {
884 		id <<= 8;
885 		id += codecId[i];
886 	}
887 	return (id);
888 }
889 
890 static void *
891 ppmd_alloc(void *p, size_t size)
892 {
893 	(void)p;
894 	return malloc(size);
895 }
896 static void
897 ppmd_free(void *p, void *address)
898 {
899 	(void)p;
900 	free(address);
901 }
902 static Byte
903 ppmd_read(void *p)
904 {
905 	struct archive_read *a = ((IByteIn*)p)->a;
906 	struct _7zip *zip = (struct _7zip *)(a->format->data);
907 	Byte b;
908 
909 	if (zip->ppstream.avail_in == 0) {
910 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
911 		    "Truncated RAR file data");
912 		zip->ppstream.overconsumed = 1;
913 		return (0);
914 	}
915 	b = *zip->ppstream.next_in++;
916 	zip->ppstream.avail_in--;
917 	zip->ppstream.total_in++;
918 	return (b);
919 }
920 
921 static ISzAlloc g_szalloc = { ppmd_alloc, ppmd_free };
922 
923 static int
924 init_decompression(struct archive_read *a, struct _7zip *zip,
925     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
926 {
927 	int r;
928 
929 	zip->codec = coder1->codec;
930 	zip->codec2 = -1;
931 
932 	switch (zip->codec) {
933 	case _7Z_COPY:
934 	case _7Z_BZ2:
935 	case _7Z_DEFLATE:
936 	case _7Z_PPMD:
937 		if (coder2 != NULL) {
938 			if (coder2->codec != _7Z_X86 &&
939 			    coder2->codec != _7Z_X86_BCJ2) {
940 				archive_set_error(&a->archive,
941 				    ARCHIVE_ERRNO_MISC,
942 				    "Unsupported filter %lx for %lx",
943 				    coder2->codec, coder1->codec);
944 				return (ARCHIVE_FAILED);
945 			}
946 			zip->codec2 = coder2->codec;
947 			zip->bcj_state = 0;
948 			if (coder2->codec == _7Z_X86)
949 				x86_Init(zip);
950 		}
951 		break;
952 	default:
953 		break;
954 	}
955 
956 	switch (zip->codec) {
957 	case _7Z_COPY:
958 		break;
959 
960 	case _7Z_LZMA: case _7Z_LZMA2:
961 #ifdef HAVE_LZMA_H
962 #if LZMA_VERSION_MAJOR >= 5
963 /* Effectively disable the limiter. */
964 #define LZMA_MEMLIMIT   UINT64_MAX
965 #else
966 /* NOTE: This needs to check memory size which running system has. */
967 #define LZMA_MEMLIMIT   (1U << 30)
968 #endif
969 	{
970 		lzma_options_delta delta_opt;
971 		lzma_filter filters[LZMA_FILTERS_MAX];
972 #if LZMA_VERSION < 50000030
973 		lzma_filter *ff;
974 #endif
975 		int fi = 0;
976 
977 		if (zip->lzstream_valid) {
978 			lzma_end(&(zip->lzstream));
979 			zip->lzstream_valid = 0;
980 		}
981 
982 		/*
983 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
984 		 * data made by 7-Zip because 7-Zip does not add End-Of-
985 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
986 		 * and so liblzma cannot know the end of the compressed data
987 		 * without EOPM. So consequently liblzma will not return last
988 		 * three or four bytes of uncompressed data because
989 		 * LZMA_FILTER_X86 filter does not handle input data if its
990 		 * data size is less than five bytes. If liblzma detect EOPM
991 		 * or know the uncompressed data size, liblzma will flush out
992 		 * the remaining that three or four bytes of uncompressed
993 		 * data. That is why we have to use our converting program
994 		 * for BCJ+LZMA. If we were able to tell the uncompressed
995 		 * size to liblzma when using lzma_raw_decoder() liblzma
996 		 * could correctly deal with BCJ+LZMA. But unfortunately
997 		 * there is no way to do that.
998 		 * Discussion about this can be found at XZ Utils forum.
999 		 */
1000 		if (coder2 != NULL) {
1001 			zip->codec2 = coder2->codec;
1002 
1003 			filters[fi].options = NULL;
1004 			switch (zip->codec2) {
1005 			case _7Z_X86:
1006 				if (zip->codec == _7Z_LZMA2) {
1007 					filters[fi].id = LZMA_FILTER_X86;
1008 					fi++;
1009 				} else
1010 					/* Use our filter. */
1011 					x86_Init(zip);
1012 				break;
1013 			case _7Z_X86_BCJ2:
1014 				/* Use our filter. */
1015 				zip->bcj_state = 0;
1016 				break;
1017 			case _7Z_DELTA:
1018 				filters[fi].id = LZMA_FILTER_DELTA;
1019 				memset(&delta_opt, 0, sizeof(delta_opt));
1020 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1021 				delta_opt.dist = 1;
1022 				filters[fi].options = &delta_opt;
1023 				fi++;
1024 				break;
1025 			/* Following filters have not been tested yet. */
1026 			case _7Z_POWERPC:
1027 				filters[fi].id = LZMA_FILTER_POWERPC;
1028 				fi++;
1029 				break;
1030 			case _7Z_IA64:
1031 				filters[fi].id = LZMA_FILTER_IA64;
1032 				fi++;
1033 				break;
1034 			case _7Z_ARM:
1035 				filters[fi].id = LZMA_FILTER_ARM;
1036 				fi++;
1037 				break;
1038 			case _7Z_ARMTHUMB:
1039 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1040 				fi++;
1041 				break;
1042 			case _7Z_SPARC:
1043 				filters[fi].id = LZMA_FILTER_SPARC;
1044 				fi++;
1045 				break;
1046 			default:
1047 				archive_set_error(&a->archive,
1048 				    ARCHIVE_ERRNO_MISC,
1049 				    "Unexpected codec ID: %lX", zip->codec2);
1050 				return (ARCHIVE_FAILED);
1051 			}
1052 		}
1053 
1054 		if (zip->codec == _7Z_LZMA2)
1055 			filters[fi].id = LZMA_FILTER_LZMA2;
1056 		else
1057 			filters[fi].id = LZMA_FILTER_LZMA1;
1058 		filters[fi].options = NULL;
1059 #if LZMA_VERSION < 50000030
1060 		ff = &filters[fi];
1061 #endif
1062 		r = lzma_properties_decode(&filters[fi], NULL,
1063 		    coder1->properties, (size_t)coder1->propertiesSize);
1064 		if (r != LZMA_OK) {
1065 			set_error(a, r);
1066 			return (ARCHIVE_FAILED);
1067 		}
1068 		fi++;
1069 
1070 		filters[fi].id = LZMA_VLI_UNKNOWN;
1071 		filters[fi].options = NULL;
1072 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1073 #if LZMA_VERSION < 50000030
1074 		free(ff->options);
1075 #endif
1076 		if (r != LZMA_OK) {
1077 			set_error(a, r);
1078 			return (ARCHIVE_FAILED);
1079 		}
1080 		zip->lzstream_valid = 1;
1081 		zip->lzstream.total_in = 0;
1082 		zip->lzstream.total_out = 0;
1083 		break;
1084 	}
1085 #else
1086 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1087 		    "LZMA codec is unsupported");
1088 		return (ARCHIVE_FAILED);
1089 #endif
1090 	case _7Z_BZ2:
1091 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1092 		if (zip->bzstream_valid) {
1093 			BZ2_bzDecompressEnd(&(zip->bzstream));
1094 			zip->bzstream_valid = 0;
1095 		}
1096 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1097 		if (r == BZ_MEM_ERROR)
1098 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1099 		if (r != BZ_OK) {
1100 			int err = ARCHIVE_ERRNO_MISC;
1101 			const char *detail = NULL;
1102 			switch (r) {
1103 			case BZ_PARAM_ERROR:
1104 				detail = "invalid setup parameter";
1105 				break;
1106 			case BZ_MEM_ERROR:
1107 				err = ENOMEM;
1108 				detail = "out of memory";
1109 				break;
1110 			case BZ_CONFIG_ERROR:
1111 				detail = "mis-compiled library";
1112 				break;
1113 			}
1114 			archive_set_error(&a->archive, err,
1115 			    "Internal error initializing decompressor: %s",
1116 			    detail == NULL ? "??" : detail);
1117 			zip->bzstream_valid = 0;
1118 			return (ARCHIVE_FAILED);
1119 		}
1120 		zip->bzstream_valid = 1;
1121 		zip->bzstream.total_in_lo32 = 0;
1122 		zip->bzstream.total_in_hi32 = 0;
1123 		zip->bzstream.total_out_lo32 = 0;
1124 		zip->bzstream.total_out_hi32 = 0;
1125 		break;
1126 #else
1127 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1128 		    "BZ2 codec is unsupported");
1129 		return (ARCHIVE_FAILED);
1130 #endif
1131 	case _7Z_DEFLATE:
1132 #ifdef HAVE_ZLIB_H
1133 		if (zip->stream_valid)
1134 			r = inflateReset(&(zip->stream));
1135 		else
1136 			r = inflateInit2(&(zip->stream),
1137 			    -15 /* Don't check for zlib header */);
1138 		if (r != Z_OK) {
1139 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1140 			    "Couldn't initialize zlib stream.");
1141 			return (ARCHIVE_FAILED);
1142 		}
1143 		zip->stream_valid = 1;
1144 		zip->stream.total_in = 0;
1145 		zip->stream.total_out = 0;
1146 		break;
1147 #else
1148 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1149 		    "DEFLATE codec is unsupported");
1150 		return (ARCHIVE_FAILED);
1151 #endif
1152 	case _7Z_PPMD:
1153 	{
1154 		unsigned order;
1155 		uint32_t msize;
1156 
1157 		if (zip->ppmd7_valid) {
1158 			__archive_ppmd7_functions.Ppmd7_Free(
1159 			    &zip->ppmd7_context, &g_szalloc);
1160 			zip->ppmd7_valid = 0;
1161 		}
1162 
1163 		if (coder1->propertiesSize < 5) {
1164 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1165 			    "Malformed PPMd parameter");
1166 			return (ARCHIVE_FAILED);
1167 		}
1168 		order = coder1->properties[0];
1169 		msize = archive_le32dec(&(coder1->properties[1]));
1170 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1171 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1172 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1173 			    "Malformed PPMd parameter");
1174 			return (ARCHIVE_FAILED);
1175 		}
1176 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1177 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1178 			&zip->ppmd7_context, msize, &g_szalloc);
1179 		if (r == 0) {
1180 			archive_set_error(&a->archive, ENOMEM,
1181 			    "Coludn't allocate memory for PPMd");
1182 			return (ARCHIVE_FATAL);
1183 		}
1184 		__archive_ppmd7_functions.Ppmd7_Init(
1185 			&zip->ppmd7_context, order);
1186 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1187 			&zip->range_dec);
1188 		zip->ppmd7_valid = 1;
1189 		zip->ppmd7_stat = 0;
1190 		zip->ppstream.overconsumed = 0;
1191 		zip->ppstream.total_in = 0;
1192 		zip->ppstream.total_out = 0;
1193 		break;
1194 	}
1195 	case _7Z_X86:
1196 	case _7Z_X86_BCJ2:
1197 	case _7Z_POWERPC:
1198 	case _7Z_IA64:
1199 	case _7Z_ARM:
1200 	case _7Z_ARMTHUMB:
1201 	case _7Z_SPARC:
1202 	case _7Z_DELTA:
1203 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1204 		    "Unexpected codec ID: %lX", zip->codec);
1205 		return (ARCHIVE_FAILED);
1206 	default:
1207 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1208 		    "Unknown codec ID: %lX", zip->codec);
1209 		return (ARCHIVE_FAILED);
1210 	}
1211 
1212 	return (ARCHIVE_OK);
1213 }
1214 
1215 static int
1216 decompress(struct archive_read *a, struct _7zip *zip,
1217     void *buff, size_t *outbytes, const void *b, size_t *used)
1218 {
1219 	const uint8_t *t_next_in;
1220 	uint8_t *t_next_out;
1221 	size_t o_avail_in, o_avail_out;
1222 	size_t t_avail_in, t_avail_out;
1223 	uint8_t *bcj2_next_out;
1224 	size_t bcj2_avail_out;
1225 	int r, ret = ARCHIVE_OK;
1226 
1227 	t_avail_in = o_avail_in = *used;
1228 	t_avail_out = o_avail_out = *outbytes;
1229 	t_next_in = b;
1230 	t_next_out = buff;
1231 
1232 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1233 		int i;
1234 
1235 		/* Do not copy out the BCJ remaining bytes when the output
1236 		 * buffer size is less than five bytes. */
1237 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1238 			*used = 0;
1239 			*outbytes = 0;
1240 			return (ret);
1241 		}
1242 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1243 			*t_next_out++ = zip->odd_bcj[i];
1244 			t_avail_out--;
1245 			zip->odd_bcj_size--;
1246 		}
1247 		if (o_avail_in == 0 || t_avail_out == 0) {
1248 			*used = o_avail_in - t_avail_in;
1249 			*outbytes = o_avail_out - t_avail_out;
1250 			if (o_avail_in == 0)
1251 				ret = ARCHIVE_EOF;
1252 			return (ret);
1253 		}
1254 	}
1255 
1256 	bcj2_next_out = t_next_out;
1257 	bcj2_avail_out = t_avail_out;
1258 	if (zip->codec2 == _7Z_X86_BCJ2) {
1259 		/*
1260 		 * Decord a remaining decompressed main stream for BCJ2.
1261 		 */
1262 		if (zip->tmp_stream_bytes_remaining) {
1263 			ssize_t bytes;
1264 			size_t remaining = zip->tmp_stream_bytes_remaining;
1265 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1266 			if (bytes < 0) {
1267 				archive_set_error(&(a->archive),
1268 				    ARCHIVE_ERRNO_MISC,
1269 				    "BCJ2 conversion Failed");
1270 				return (ARCHIVE_FAILED);
1271 			}
1272 			zip->main_stream_bytes_remaining -=
1273 			    remaining - zip->tmp_stream_bytes_remaining;
1274 			t_avail_out -= bytes;
1275 			if (o_avail_in == 0 || t_avail_out == 0) {
1276 				*used = 0;
1277 				*outbytes = o_avail_out - t_avail_out;
1278 				if (o_avail_in == 0 &&
1279 				    zip->tmp_stream_bytes_remaining)
1280 					ret = ARCHIVE_EOF;
1281 				return (ret);
1282 			}
1283 			t_next_out += bytes;
1284 			bcj2_next_out = t_next_out;
1285 			bcj2_avail_out = t_avail_out;
1286 		}
1287 		t_next_out = zip->tmp_stream_buff;
1288 		t_avail_out = zip->tmp_stream_buff_size;
1289 	}
1290 
1291 	switch (zip->codec) {
1292 	case _7Z_COPY:
1293 	{
1294 		size_t bytes =
1295 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1296 
1297 		memcpy(t_next_out, t_next_in, bytes);
1298 		t_avail_in -= bytes;
1299 		t_avail_out -= bytes;
1300 		if (o_avail_in == 0)
1301 			ret = ARCHIVE_EOF;
1302 		break;
1303 	}
1304 #ifdef HAVE_LZMA_H
1305 	case _7Z_LZMA: case _7Z_LZMA2:
1306 		zip->lzstream.next_in = t_next_in;
1307 		zip->lzstream.avail_in = t_avail_in;
1308 		zip->lzstream.next_out = t_next_out;
1309 		zip->lzstream.avail_out = t_avail_out;
1310 
1311 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1312 		switch (r) {
1313 		case LZMA_STREAM_END: /* Found end of stream. */
1314 			lzma_end(&(zip->lzstream));
1315 			zip->lzstream_valid = 0;
1316 			ret = ARCHIVE_EOF;
1317 			break;
1318 		case LZMA_OK: /* Decompressor made some progress. */
1319 			break;
1320 		default:
1321 			archive_set_error(&(a->archive),
1322 			    ARCHIVE_ERRNO_MISC,
1323 				"Decompression failed(%d)",
1324 			    r);
1325 			return (ARCHIVE_FAILED);
1326 		}
1327 		t_avail_in = zip->lzstream.avail_in;
1328 		t_avail_out = zip->lzstream.avail_out;
1329 		break;
1330 #endif
1331 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1332 	case _7Z_BZ2:
1333 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1334 		zip->bzstream.avail_in = t_avail_in;
1335 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1336 		zip->bzstream.avail_out = t_avail_out;
1337 		r = BZ2_bzDecompress(&(zip->bzstream));
1338 		switch (r) {
1339 		case BZ_STREAM_END: /* Found end of stream. */
1340 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1341 			case BZ_OK:
1342 				break;
1343 			default:
1344 				archive_set_error(&(a->archive),
1345 				    ARCHIVE_ERRNO_MISC,
1346 				    "Failed to clean up decompressor");
1347 				return (ARCHIVE_FAILED);
1348 			}
1349 			zip->bzstream_valid = 0;
1350 			ret = ARCHIVE_EOF;
1351 			break;
1352 		case BZ_OK: /* Decompressor made some progress. */
1353 			break;
1354 		default:
1355 			archive_set_error(&(a->archive),
1356 			    ARCHIVE_ERRNO_MISC,
1357 			    "bzip decompression failed");
1358 			return (ARCHIVE_FAILED);
1359 		}
1360 		t_avail_in = zip->bzstream.avail_in;
1361 		t_avail_out = zip->bzstream.avail_out;
1362 		break;
1363 #endif
1364 #ifdef HAVE_ZLIB_H
1365 	case _7Z_DEFLATE:
1366 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1367 		zip->stream.avail_in = (uInt)t_avail_in;
1368 		zip->stream.next_out = t_next_out;
1369 		zip->stream.avail_out = (uInt)t_avail_out;
1370 		r = inflate(&(zip->stream), 0);
1371 		switch (r) {
1372 		case Z_STREAM_END: /* Found end of stream. */
1373 			ret = ARCHIVE_EOF;
1374 			break;
1375 		case Z_OK: /* Decompressor made some progress.*/
1376 			break;
1377 		default:
1378 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1379 			    "File decompression failed (%d)", r);
1380 			return (ARCHIVE_FAILED);
1381 		}
1382 		t_avail_in = zip->stream.avail_in;
1383 		t_avail_out = zip->stream.avail_out;
1384 		break;
1385 #endif
1386 	case _7Z_PPMD:
1387 	{
1388 		uint64_t flush_bytes;
1389 
1390 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1391 		    t_avail_out <= 0) {
1392 			archive_set_error(&(a->archive),
1393 			    ARCHIVE_ERRNO_MISC,
1394 			    "Decompression internal error");
1395 			return (ARCHIVE_FAILED);
1396 		}
1397 		zip->ppstream.next_in = t_next_in;
1398 		zip->ppstream.avail_in = t_avail_in;
1399 		zip->ppstream.next_out = t_next_out;
1400 		zip->ppstream.avail_out = t_avail_out;
1401 		if (zip->ppmd7_stat == 0) {
1402 			zip->bytein.a = a;
1403 			zip->bytein.Read = &ppmd_read;
1404 			zip->range_dec.Stream = &zip->bytein;
1405 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1406 				&(zip->range_dec));
1407 			if (r == 0) {
1408 				zip->ppmd7_stat = -1;
1409 				archive_set_error(&a->archive,
1410 				    ARCHIVE_ERRNO_MISC,
1411 				    "Failed to initialize PPMd range decorder");
1412 				return (ARCHIVE_FAILED);
1413 			}
1414 			if (zip->ppstream.overconsumed) {
1415 				zip->ppmd7_stat = -1;
1416 				return (ARCHIVE_FAILED);
1417 			}
1418 			zip->ppmd7_stat = 1;
1419 		}
1420 
1421 		if (t_avail_in == 0)
1422 			/* XXX Flush out remaining decoded data XXX */
1423 			flush_bytes = zip->folder_outbytes_remaining;
1424 		else
1425 			flush_bytes = 0;
1426 
1427 		do {
1428 			int sym;
1429 
1430 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1431 				&(zip->ppmd7_context), &(zip->range_dec.p));
1432 			if (sym < 0) {
1433 				zip->ppmd7_stat = -1;
1434 				archive_set_error(&a->archive,
1435 				    ARCHIVE_ERRNO_FILE_FORMAT,
1436 				    "Failed to decode PPMd");
1437 				return (ARCHIVE_FAILED);
1438 			}
1439 			if (zip->ppstream.overconsumed) {
1440 				zip->ppmd7_stat = -1;
1441 				return (ARCHIVE_FAILED);
1442 			}
1443 			*zip->ppstream.next_out++ = (unsigned char)sym;
1444 			zip->ppstream.avail_out--;
1445 			zip->ppstream.total_out++;
1446 			if (flush_bytes)
1447 				flush_bytes--;
1448 		} while (zip->ppstream.avail_out &&
1449 			(zip->ppstream.avail_in || flush_bytes));
1450 
1451 		t_avail_in = (size_t)zip->ppstream.avail_in;
1452 		t_avail_out = (size_t)zip->ppstream.avail_out;
1453 		break;
1454 	}
1455 	default:
1456 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1457 		    "Decompression internal error");
1458 		return (ARCHIVE_FAILED);
1459 	}
1460 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1461 		return (ret);
1462 
1463 	*used = o_avail_in - t_avail_in;
1464 	*outbytes = o_avail_out - t_avail_out;
1465 
1466 	/*
1467 	 * Decord BCJ.
1468 	 */
1469 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1470 		size_t l = x86_Convert(zip, buff, *outbytes);
1471 		zip->odd_bcj_size = *outbytes - l;
1472 		if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1473 		    o_avail_in && ret != ARCHIVE_EOF) {
1474 			memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1475 			    zip->odd_bcj_size);
1476 			*outbytes = l;
1477 		} else
1478 			zip->odd_bcj_size = 0;
1479 	}
1480 
1481 	/*
1482 	 * Decord BCJ2 with a decompressed main stream.
1483 	 */
1484 	if (zip->codec2 == _7Z_X86_BCJ2) {
1485 		ssize_t bytes;
1486 
1487 		zip->tmp_stream_bytes_avail =
1488 		    zip->tmp_stream_buff_size - t_avail_out;
1489 		if (zip->tmp_stream_bytes_avail >
1490 		      zip->main_stream_bytes_remaining)
1491 			zip->tmp_stream_bytes_avail =
1492 			    zip->main_stream_bytes_remaining;
1493 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1494 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1495 		if (bytes < 0) {
1496 			archive_set_error(&(a->archive),
1497 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1498 			return (ARCHIVE_FAILED);
1499 		}
1500 		zip->main_stream_bytes_remaining -=
1501 		    zip->tmp_stream_bytes_avail
1502 		      - zip->tmp_stream_bytes_remaining;
1503 		bcj2_avail_out -= bytes;
1504 		*outbytes = o_avail_out - bcj2_avail_out;
1505 	}
1506 
1507 	return (ret);
1508 }
1509 
1510 static int
1511 free_decompression(struct archive_read *a, struct _7zip *zip)
1512 {
1513 	int r = ARCHIVE_OK;
1514 
1515 #if !defined(HAVE_ZLIB_H) &&\
1516 	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1517 	(void)a;/* UNUSED */
1518 #endif
1519 #ifdef HAVE_LZMA_H
1520 	if (zip->lzstream_valid)
1521 		lzma_end(&(zip->lzstream));
1522 #endif
1523 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1524 	if (zip->bzstream_valid) {
1525 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1526 			archive_set_error(&a->archive,
1527 			    ARCHIVE_ERRNO_MISC,
1528 			    "Failed to clean up bzip2 decompressor");
1529 			r = ARCHIVE_FATAL;
1530 		}
1531 		zip->bzstream_valid = 0;
1532 	}
1533 #endif
1534 #ifdef HAVE_ZLIB_H
1535 	if (zip->stream_valid) {
1536 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1537 			archive_set_error(&a->archive,
1538 			    ARCHIVE_ERRNO_MISC,
1539 			    "Failed to clean up zlib decompressor");
1540 			r = ARCHIVE_FATAL;
1541 		}
1542 		zip->stream_valid = 0;
1543 	}
1544 #endif
1545 	if (zip->ppmd7_valid) {
1546 		__archive_ppmd7_functions.Ppmd7_Free(
1547 			&zip->ppmd7_context, &g_szalloc);
1548 		zip->ppmd7_valid = 0;
1549 	}
1550 	return (r);
1551 }
1552 
1553 static int
1554 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1555 {
1556 	const unsigned char *p;
1557 	unsigned char avail, mask;
1558 	int i;
1559 
1560 	if ((p = header_bytes(a, 1)) == NULL)
1561 		return (-1);
1562 	avail = *p;
1563 	mask = 0x80;
1564 	*val = 0;
1565 	for (i = 0; i < 8; i++) {
1566 		if (avail & mask) {
1567 			if ((p = header_bytes(a, 1)) == NULL)
1568 				return (-1);
1569 			*val |= ((uint64_t)*p) << (8 * i);
1570 			mask >>= 1;
1571 			continue;
1572 		}
1573 		*val += (avail & (mask -1)) << (8 * i);
1574 		break;
1575 	}
1576 	return (0);
1577 }
1578 
1579 static int
1580 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1581 {
1582 	const unsigned char *p;
1583 	unsigned i, mask = 0, avail = 0;
1584 
1585 	for (i = 0; i < num; i++) {
1586 		if (mask == 0) {
1587 			if ((p = header_bytes(a, 1)) == NULL)
1588 				return (-1);
1589 			avail = *p;
1590 			mask = 0x80;
1591 		}
1592 		data[i] = (avail & mask)?1:0;
1593 		mask >>= 1;
1594 	}
1595 	return (0);
1596 }
1597 
1598 static void
1599 free_Digest(struct _7z_digests *d)
1600 {
1601 	free(d->defineds);
1602 	free(d->digests);
1603 }
1604 
1605 static int
1606 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1607 {
1608 	const unsigned char *p;
1609 	unsigned i;
1610 
1611 	if (num == 0)
1612 		return (-1);
1613 	memset(d, 0, sizeof(*d));
1614 
1615 	d->defineds = malloc(num);
1616 	if (d->defineds == NULL)
1617 		return (-1);
1618 	/*
1619 	 * Read Bools.
1620 	 */
1621 	if ((p = header_bytes(a, 1)) == NULL)
1622 		return (-1);
1623 	if (*p == 0) {
1624 		if (read_Bools(a, d->defineds, num) < 0)
1625 			return (-1);
1626 	} else
1627 		/* All are defined */
1628 		memset(d->defineds, 1, num);
1629 
1630 	d->digests = calloc(num, sizeof(*d->digests));
1631 	if (d->digests == NULL)
1632 		return (-1);
1633 	for (i = 0; i < num; i++) {
1634 		if (d->defineds[i]) {
1635 			if ((p = header_bytes(a, 4)) == NULL)
1636 				return (-1);
1637 			d->digests[i] = archive_le32dec(p);
1638 		}
1639 	}
1640 
1641 	return (0);
1642 }
1643 
1644 static void
1645 free_PackInfo(struct _7z_pack_info *pi)
1646 {
1647 	free(pi->sizes);
1648 	free(pi->positions);
1649 	free_Digest(&(pi->digest));
1650 }
1651 
1652 static int
1653 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1654 {
1655 	const unsigned char *p;
1656 	unsigned i;
1657 
1658 	memset(pi, 0, sizeof(*pi));
1659 
1660 	/*
1661 	 * Read PackPos.
1662 	 */
1663 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1664 		return (-1);
1665 
1666 	/*
1667 	 * Read NumPackStreams.
1668 	 */
1669 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1670 		return (-1);
1671 	if (pi->numPackStreams == 0)
1672 		return (-1);
1673 	if (1000000 < pi->numPackStreams)
1674 		return (-1);
1675 
1676 	/*
1677 	 * Read PackSizes[num]
1678 	 */
1679 	if ((p = header_bytes(a, 1)) == NULL)
1680 		return (-1);
1681 	if (*p == kEnd)
1682 		/* PackSizes[num] are not present. */
1683 		return (0);
1684 	if (*p != kSize)
1685 		return (-1);
1686 	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1687 	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1688 	if (pi->sizes == NULL || pi->positions == NULL)
1689 		return (-1);
1690 
1691 	for (i = 0; i < pi->numPackStreams; i++) {
1692 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1693 			return (-1);
1694 	}
1695 
1696 	/*
1697 	 * Read PackStreamDigests[num]
1698 	 */
1699 	if ((p = header_bytes(a, 1)) == NULL)
1700 		return (-1);
1701 	if (*p == kEnd) {
1702 		/* PackStreamDigests[num] are not present. */
1703 		pi->digest.defineds =
1704 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1705 		pi->digest.digests =
1706 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1707 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1708 			return (-1);
1709 		return (0);
1710 	}
1711 
1712 	if (*p != kSize)
1713 		return (-1);
1714 
1715 	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1716 		return (-1);
1717 
1718 	/*
1719 	 *  Must be marked by kEnd.
1720 	 */
1721 	if ((p = header_bytes(a, 1)) == NULL)
1722 		return (-1);
1723 	if (*p != kEnd)
1724 		return (-1);
1725 	return (0);
1726 }
1727 
1728 static void
1729 free_Folder(struct _7z_folder *f)
1730 {
1731 	unsigned i;
1732 
1733 	if (f->coders) {
1734 		for (i = 0; i< f->numCoders; i++) {
1735 			free(f->coders[i].properties);
1736 		}
1737 		free(f->coders);
1738 	}
1739 	free(f->bindPairs);
1740 	free(f->packedStreams);
1741 	free(f->unPackSize);
1742 }
1743 
1744 static int
1745 read_Folder(struct archive_read *a, struct _7z_folder *f)
1746 {
1747 	struct _7zip *zip = (struct _7zip *)a->format->data;
1748 	const unsigned char *p;
1749 	uint64_t numInStreamsTotal = 0;
1750 	uint64_t numOutStreamsTotal = 0;
1751 	unsigned i;
1752 
1753 	memset(f, 0, sizeof(*f));
1754 
1755 	/*
1756 	 * Read NumCoders.
1757 	 */
1758 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1759 		return (-1);
1760 	if (f->numCoders > 4)
1761 		/* Too many coders. */
1762 		return (-1);
1763 
1764 	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1765 	if (f->coders == NULL)
1766 		return (-1);
1767 	for (i = 0; i< f->numCoders; i++) {
1768 		size_t codec_size;
1769 		int simple, attr;
1770 
1771 		if ((p = header_bytes(a, 1)) == NULL)
1772 			return (-1);
1773 		/*
1774 		 * 0:3 CodecIdSize
1775 		 * 4:  0 - IsSimple
1776 		 *     1 - Is not Simple
1777 		 * 5:  0 - No Attributes
1778 		 *     1 - There are Attributes;
1779 		 * 7:  Must be zero.
1780 		 */
1781 		codec_size = *p & 0xf;
1782 		simple = (*p & 0x10)?0:1;
1783 		attr = *p & 0x20;
1784 		if (*p & 0x80)
1785 			return (-1);/* Not supported. */
1786 
1787 		/*
1788 		 * Read Decompression Method IDs.
1789 		 */
1790 		if ((p = header_bytes(a, codec_size)) == NULL)
1791 			return (-1);
1792 
1793 		f->coders[i].codec = decode_codec_id(p, codec_size);
1794 
1795 		if (simple) {
1796 			f->coders[i].numInStreams = 1;
1797 			f->coders[i].numOutStreams = 1;
1798 		} else {
1799 			if (parse_7zip_uint64(
1800 			    a, &(f->coders[i].numInStreams)) < 0)
1801 				return (-1);
1802 			if (1000000 < f->coders[i].numInStreams)
1803 				return (-1);
1804 			if (parse_7zip_uint64(
1805 			    a, &(f->coders[i].numOutStreams)) < 0)
1806 				return (-1);
1807 			if (1000000 < f->coders[i].numOutStreams)
1808 				return (-1);
1809 		}
1810 
1811 		if (attr) {
1812 			if (parse_7zip_uint64(
1813 			    a, &(f->coders[i].propertiesSize)) < 0)
1814 				return (-1);
1815 			if ((p = header_bytes(
1816 			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
1817 				return (-1);
1818 			f->coders[i].properties =
1819 			    malloc((size_t)f->coders[i].propertiesSize);
1820 			if (f->coders[i].properties == NULL)
1821 				return (-1);
1822 			memcpy(f->coders[i].properties, p,
1823 			    (size_t)f->coders[i].propertiesSize);
1824 		}
1825 
1826 		numInStreamsTotal += f->coders[i].numInStreams;
1827 		numOutStreamsTotal += f->coders[i].numOutStreams;
1828 	}
1829 
1830 	if (numOutStreamsTotal == 0 ||
1831 	    numInStreamsTotal < numOutStreamsTotal-1)
1832 		return (-1);
1833 
1834 	f->numBindPairs = numOutStreamsTotal - 1;
1835 	if (zip->header_bytes_remaining < f->numBindPairs)
1836 			return (-1);
1837 	if (f->numBindPairs > 0) {
1838 		f->bindPairs =
1839 			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
1840 		if (f->bindPairs == NULL)
1841 			return (-1);
1842 	} else
1843 		f->bindPairs = NULL;
1844 	for (i = 0; i < f->numBindPairs; i++) {
1845 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
1846 			return (-1);
1847 		if (1000000 < f->bindPairs[i].inIndex)
1848 			return (-1);
1849 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
1850 			return (-1);
1851 		if (1000000 < f->bindPairs[i].outIndex)
1852 			return (-1);
1853 	}
1854 
1855 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
1856 	f->packedStreams =
1857 	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
1858 	if (f->packedStreams == NULL)
1859 		return (-1);
1860 	if (f->numPackedStreams == 1) {
1861 		for (i = 0; i < numInStreamsTotal; i++) {
1862 			unsigned j;
1863 			for (j = 0; j < f->numBindPairs; j++) {
1864 				if (f->bindPairs[j].inIndex == i)
1865 					break;
1866 			}
1867 			if (j == f->numBindPairs)
1868 				break;
1869 		}
1870 		if (i == numInStreamsTotal)
1871 			return (-1);
1872 		f->packedStreams[0] = i;
1873 	} else {
1874 		for (i = 0; i < f->numPackedStreams; i++) {
1875 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
1876 				return (-1);
1877 			if (1000000 < f->packedStreams[i])
1878 				return (-1);
1879 		}
1880 	}
1881 	f->numInStreams = numInStreamsTotal;
1882 	f->numOutStreams = numOutStreamsTotal;
1883 
1884 	return (0);
1885 }
1886 
1887 static void
1888 free_CodersInfo(struct _7z_coders_info *ci)
1889 {
1890 	unsigned i;
1891 
1892 	if (ci->folders) {
1893 		for (i = 0; i < ci->numFolders; i++)
1894 			free_Folder(&(ci->folders[i]));
1895 		free(ci->folders);
1896 	}
1897 }
1898 
1899 static int
1900 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
1901 {
1902 	const unsigned char *p;
1903 	struct _7z_digests digest;
1904 	unsigned i;
1905 
1906 	memset(ci, 0, sizeof(*ci));
1907 	memset(&digest, 0, sizeof(digest));
1908 
1909 	if ((p = header_bytes(a, 1)) == NULL)
1910 		goto failed;
1911 	if (*p != kFolder)
1912 		goto failed;
1913 
1914 	/*
1915 	 * Read NumFolders.
1916 	 */
1917 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
1918 		goto failed;
1919 	if (1000000 < ci->numFolders)
1920 			return (-1);
1921 
1922 	/*
1923 	 * Read External.
1924 	 */
1925 	if ((p = header_bytes(a, 1)) == NULL)
1926 		goto failed;
1927 	switch (*p) {
1928 	case 0:
1929 		ci->folders =
1930 			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
1931 		if (ci->folders == NULL)
1932 			return (-1);
1933 		for (i = 0; i < ci->numFolders; i++) {
1934 			if (read_Folder(a, &(ci->folders[i])) < 0)
1935 				goto failed;
1936 		}
1937 		break;
1938 	case 1:
1939 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
1940 			return (-1);
1941 		if (1000000 < ci->dataStreamIndex)
1942 			return (-1);
1943 		break;
1944 	}
1945 
1946 	if ((p = header_bytes(a, 1)) == NULL)
1947 		goto failed;
1948 	if (*p != kCodersUnPackSize)
1949 		goto failed;
1950 
1951 	for (i = 0; i < ci->numFolders; i++) {
1952 		struct _7z_folder *folder = &(ci->folders[i]);
1953 		unsigned j;
1954 
1955 		folder->unPackSize =
1956 		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
1957 		if (folder->unPackSize == NULL)
1958 			goto failed;
1959 		for (j = 0; j < folder->numOutStreams; j++) {
1960 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
1961 				goto failed;
1962 		}
1963 	}
1964 
1965 	/*
1966 	 * Read CRCs.
1967 	 */
1968 	if ((p = header_bytes(a, 1)) == NULL)
1969 		goto failed;
1970 	if (*p == kEnd)
1971 		return (0);
1972 	if (*p != kCRC)
1973 		goto failed;
1974 	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
1975 		goto failed;
1976 	for (i = 0; i < ci->numFolders; i++) {
1977 		ci->folders[i].digest_defined = digest.defineds[i];
1978 		ci->folders[i].digest = digest.digests[i];
1979 	}
1980 
1981 	/*
1982 	 *  Must be kEnd.
1983 	 */
1984 	if ((p = header_bytes(a, 1)) == NULL)
1985 		goto failed;
1986 	if (*p != kEnd)
1987 		goto failed;
1988 	free_Digest(&digest);
1989 	return (0);
1990 failed:
1991 	free_Digest(&digest);
1992 	return (-1);
1993 }
1994 
1995 static uint64_t
1996 folder_uncompressed_size(struct _7z_folder *f)
1997 {
1998 	int n = (int)f->numOutStreams;
1999 	unsigned pairs = (unsigned)f->numBindPairs;
2000 
2001 	while (--n >= 0) {
2002 		unsigned i;
2003 		for (i = 0; i < pairs; i++) {
2004 			if (f->bindPairs[i].outIndex == (uint64_t)n)
2005 				break;
2006 		}
2007 		if (i >= pairs)
2008 			return (f->unPackSize[n]);
2009 	}
2010 	return (0);
2011 }
2012 
2013 static void
2014 free_SubStreamsInfo(struct _7z_substream_info *ss)
2015 {
2016 	free(ss->unpackSizes);
2017 	free(ss->digestsDefined);
2018 	free(ss->digests);
2019 }
2020 
2021 static int
2022 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2023     struct _7z_folder *f, size_t numFolders)
2024 {
2025 	const unsigned char *p;
2026 	uint64_t *usizes;
2027 	size_t unpack_streams;
2028 	int type;
2029 	unsigned i;
2030 	uint32_t numDigests;
2031 
2032 	memset(ss, 0, sizeof(*ss));
2033 
2034 	for (i = 0; i < numFolders; i++)
2035 		f[i].numUnpackStreams = 1;
2036 
2037 	if ((p = header_bytes(a, 1)) == NULL)
2038 		return (-1);
2039 	type = *p;
2040 
2041 	if (type == kNumUnPackStream) {
2042 		unpack_streams = 0;
2043 		for (i = 0; i < numFolders; i++) {
2044 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2045 				return (-1);
2046 			if (1000000 < f[i].numUnpackStreams)
2047 				return (-1);
2048 			unpack_streams += (size_t)f[i].numUnpackStreams;
2049 		}
2050 		if ((p = header_bytes(a, 1)) == NULL)
2051 			return (-1);
2052 		type = *p;
2053 	} else
2054 		unpack_streams = numFolders;
2055 
2056 	ss->unpack_streams = unpack_streams;
2057 	if (unpack_streams) {
2058 		ss->unpackSizes = calloc(unpack_streams,
2059 		    sizeof(*ss->unpackSizes));
2060 		ss->digestsDefined = calloc(unpack_streams,
2061 		    sizeof(*ss->digestsDefined));
2062 		ss->digests = calloc(unpack_streams,
2063 		    sizeof(*ss->digests));
2064 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2065 		    ss->digests == NULL)
2066 			return (-1);
2067 	}
2068 
2069 	usizes = ss->unpackSizes;
2070 	for (i = 0; i < numFolders; i++) {
2071 		unsigned pack;
2072 		uint64_t sum;
2073 
2074 		if (f[i].numUnpackStreams == 0)
2075 			continue;
2076 
2077 		sum = 0;
2078 		if (type == kSize) {
2079 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2080 				if (parse_7zip_uint64(a, usizes) < 0)
2081 					return (-1);
2082 				sum += *usizes++;
2083 			}
2084 		}
2085 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2086 	}
2087 
2088 	if (type == kSize) {
2089 		if ((p = header_bytes(a, 1)) == NULL)
2090 			return (-1);
2091 		type = *p;
2092 	}
2093 
2094 	for (i = 0; i < unpack_streams; i++) {
2095 		ss->digestsDefined[i] = 0;
2096 		ss->digests[i] = 0;
2097 	}
2098 
2099 	numDigests = 0;
2100 	for (i = 0; i < numFolders; i++) {
2101 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2102 			numDigests += (uint32_t)f[i].numUnpackStreams;
2103 	}
2104 
2105 	if (type == kCRC) {
2106 		struct _7z_digests tmpDigests;
2107 		unsigned char *digestsDefined = ss->digestsDefined;
2108 		uint32_t * digests = ss->digests;
2109 		int di = 0;
2110 
2111 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2112 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2113 			free_Digest(&tmpDigests);
2114 			return (-1);
2115 		}
2116 		for (i = 0; i < numFolders; i++) {
2117 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2118 				*digestsDefined++ = 1;
2119 				*digests++ = f[i].digest;
2120 			} else {
2121 				unsigned j;
2122 
2123 				for (j = 0; j < f[i].numUnpackStreams;
2124 				    j++, di++) {
2125 					*digestsDefined++ =
2126 					    tmpDigests.defineds[di];
2127 					*digests++ =
2128 					    tmpDigests.digests[di];
2129 				}
2130 			}
2131 		}
2132 		free_Digest(&tmpDigests);
2133 		if ((p = header_bytes(a, 1)) == NULL)
2134 			return (-1);
2135 		type = *p;
2136 	}
2137 
2138 	/*
2139 	 *  Must be kEnd.
2140 	 */
2141 	if (type != kEnd)
2142 		return (-1);
2143 	return (0);
2144 }
2145 
2146 static void
2147 free_StreamsInfo(struct _7z_stream_info *si)
2148 {
2149 	free_PackInfo(&(si->pi));
2150 	free_CodersInfo(&(si->ci));
2151 	free_SubStreamsInfo(&(si->ss));
2152 }
2153 
2154 static int
2155 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2156 {
2157 	struct _7zip *zip = (struct _7zip *)a->format->data;
2158 	const unsigned char *p;
2159 	unsigned i;
2160 
2161 	memset(si, 0, sizeof(*si));
2162 
2163 	if ((p = header_bytes(a, 1)) == NULL)
2164 		return (-1);
2165 	if (*p == kPackInfo) {
2166 		uint64_t packPos;
2167 
2168 		if (read_PackInfo(a, &(si->pi)) < 0)
2169 			return (-1);
2170 
2171 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2172 			return (-1);
2173 		/*
2174 		 * Calculate packed stream positions.
2175 		 */
2176 		packPos = si->pi.pos;
2177 		for (i = 0; i < si->pi.numPackStreams; i++) {
2178 			si->pi.positions[i] = packPos;
2179 			packPos += si->pi.sizes[i];
2180 			if (packPos > zip->header_offset)
2181 				return (-1);
2182 		}
2183 		if ((p = header_bytes(a, 1)) == NULL)
2184 			return (-1);
2185 	}
2186 	if (*p == kUnPackInfo) {
2187 		uint32_t packIndex;
2188 		struct _7z_folder *f;
2189 
2190 		if (read_CodersInfo(a, &(si->ci)) < 0)
2191 			return (-1);
2192 
2193 		/*
2194 		 * Calculate packed stream indexes.
2195 		 */
2196 		packIndex = 0;
2197 		f = si->ci.folders;
2198 		for (i = 0; i < si->ci.numFolders; i++) {
2199 			f[i].packIndex = packIndex;
2200 			packIndex += (uint32_t)f[i].numPackedStreams;
2201 			if (packIndex > si->pi.numPackStreams)
2202 				return (-1);
2203 		}
2204 		if ((p = header_bytes(a, 1)) == NULL)
2205 			return (-1);
2206 	}
2207 
2208 	if (*p == kSubStreamsInfo) {
2209 		if (read_SubStreamsInfo(a, &(si->ss),
2210 		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2211 			return (-1);
2212 		if ((p = header_bytes(a, 1)) == NULL)
2213 			return (-1);
2214 	}
2215 
2216 	/*
2217 	 *  Must be kEnd.
2218 	 */
2219 	if (*p != kEnd)
2220 		return (-1);
2221 	return (0);
2222 }
2223 
2224 static void
2225 free_Header(struct _7z_header_info *h)
2226 {
2227 	free(h->emptyStreamBools);
2228 	free(h->emptyFileBools);
2229 	free(h->antiBools);
2230 	free(h->attrBools);
2231 }
2232 
2233 static int
2234 read_Header(struct archive_read *a, struct _7z_header_info *h,
2235     int check_header_id)
2236 {
2237 	struct _7zip *zip = (struct _7zip *)a->format->data;
2238 	const unsigned char *p;
2239 	struct _7z_folder *folders;
2240 	struct _7z_stream_info *si = &(zip->si);
2241 	struct _7zip_entry *entries;
2242 	uint32_t folderIndex, indexInFolder;
2243 	unsigned i;
2244 	int eindex, empty_streams, sindex;
2245 
2246 	if (check_header_id) {
2247 		/*
2248 		 * Read Header.
2249 		 */
2250 		if ((p = header_bytes(a, 1)) == NULL)
2251 			return (-1);
2252 		if (*p != kHeader)
2253 			return (-1);
2254 	}
2255 
2256 	/*
2257 	 * Read ArchiveProperties.
2258 	 */
2259 	if ((p = header_bytes(a, 1)) == NULL)
2260 		return (-1);
2261 	if (*p == kArchiveProperties) {
2262 		for (;;) {
2263 			uint64_t size;
2264 			if ((p = header_bytes(a, 1)) == NULL)
2265 				return (-1);
2266 			if (*p == 0)
2267 				break;
2268 			if (parse_7zip_uint64(a, &size) < 0)
2269 				return (-1);
2270 		}
2271 		if ((p = header_bytes(a, 1)) == NULL)
2272 			return (-1);
2273 	}
2274 
2275 	/*
2276 	 * Read MainStreamsInfo.
2277 	 */
2278 	if (*p == kMainStreamsInfo) {
2279 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2280 			return (-1);
2281 		if ((p = header_bytes(a, 1)) == NULL)
2282 			return (-1);
2283 	}
2284 	if (*p == kEnd)
2285 		return (0);
2286 
2287 	/*
2288 	 * Read FilesInfo.
2289 	 */
2290 	if (*p != kFilesInfo)
2291 		return (-1);
2292 
2293 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2294 		return (-1);
2295 	if (1000000 < zip->numFiles)
2296 			return (-1);
2297 
2298 	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2299 	if (zip->entries == NULL)
2300 		return (-1);
2301 	entries = zip->entries;
2302 
2303 	empty_streams = 0;
2304 	for (;;) {
2305 		int type;
2306 		uint64_t size;
2307 		size_t ll;
2308 
2309 		if ((p = header_bytes(a, 1)) == NULL)
2310 			return (-1);
2311 		type = *p;
2312 		if (type == kEnd)
2313 			break;
2314 
2315 		if (parse_7zip_uint64(a, &size) < 0)
2316 			return (-1);
2317 		if (zip->header_bytes_remaining < size)
2318 			return (-1);
2319 		ll = (size_t)size;
2320 
2321 		switch (type) {
2322 		case kEmptyStream:
2323 			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2324 			    sizeof(*h->emptyStreamBools));
2325 			if (h->emptyStreamBools == NULL)
2326 				return (-1);
2327 			if (read_Bools(
2328 			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2329 				return (-1);
2330 			empty_streams = 0;
2331 			for (i = 0; i < zip->numFiles; i++) {
2332 				if (h->emptyStreamBools[i])
2333 					empty_streams++;
2334 			}
2335 			break;
2336 		case kEmptyFile:
2337 			if (empty_streams <= 0) {
2338 				/* Unexcepted sequence. Skip this. */
2339 				if (header_bytes(a, ll) == NULL)
2340 					return (-1);
2341 				break;
2342 			}
2343 			h->emptyFileBools = calloc(empty_streams,
2344 			    sizeof(*h->emptyFileBools));
2345 			if (h->emptyFileBools == NULL)
2346 				return (-1);
2347 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2348 				return (-1);
2349 			break;
2350 		case kAnti:
2351 			if (empty_streams <= 0) {
2352 				/* Unexcepted sequence. Skip this. */
2353 				if (header_bytes(a, ll) == NULL)
2354 					return (-1);
2355 				break;
2356 			}
2357 			h->antiBools = calloc(empty_streams,
2358 			    sizeof(*h->antiBools));
2359 			if (h->antiBools == NULL)
2360 				return (-1);
2361 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2362 				return (-1);
2363 			break;
2364 		case kCTime:
2365 		case kATime:
2366 		case kMTime:
2367 			if (read_Times(a, h, type) < 0)
2368 				return (-1);
2369 			break;
2370 		case kName:
2371 		{
2372 			unsigned char *np;
2373 			size_t nl, nb;
2374 
2375 			/* Skip one byte. */
2376 			if ((p = header_bytes(a, 1)) == NULL)
2377 				return (-1);
2378 			ll--;
2379 
2380 			if ((ll & 1) || ll < zip->numFiles * 4)
2381 				return (-1);
2382 
2383 			zip->entry_names = malloc(ll);
2384 			if (zip->entry_names == NULL)
2385 				return (-1);
2386 			np = zip->entry_names;
2387 			nb = ll;
2388 			/*
2389 			 * Copy whole file names.
2390 			 * NOTE: This loop prevents from expanding
2391 			 * the uncompressed buffer in order not to
2392 			 * use extra memory resource.
2393 			 */
2394 			while (nb) {
2395 				size_t b;
2396 				if (nb > UBUFF_SIZE)
2397 					b = UBUFF_SIZE;
2398 				else
2399 					b = nb;
2400 				if ((p = header_bytes(a, b)) == NULL)
2401 					return (-1);
2402 				memcpy(np, p, b);
2403 				np += b;
2404 				nb -= b;
2405 			}
2406 			np = zip->entry_names;
2407 			nl = ll;
2408 
2409 			for (i = 0; i < zip->numFiles; i++) {
2410 				entries[i].utf16name = np;
2411 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2412 				entries[i].wname = (wchar_t *)np;
2413 #endif
2414 
2415 				/* Find a terminator. */
2416 				while (nl >= 2 && (np[0] || np[1])) {
2417 					np += 2;
2418 					nl -= 2;
2419 				}
2420 				if (nl < 2)
2421 					return (-1);/* Terminator not found */
2422 				entries[i].name_len = np - entries[i].utf16name;
2423 				np += 2;
2424 				nl -= 2;
2425 			}
2426 			break;
2427 		}
2428 		case kAttributes:
2429 		{
2430 			int allAreDefined;
2431 
2432 			if ((p = header_bytes(a, 2)) == NULL)
2433 				return (-1);
2434 			allAreDefined = *p;
2435 			h->attrBools = calloc((size_t)zip->numFiles,
2436 			    sizeof(*h->attrBools));
2437 			if (h->attrBools == NULL)
2438 				return (-1);
2439 			if (allAreDefined)
2440 				memset(h->attrBools, 1, (size_t)zip->numFiles);
2441 			else {
2442 				if (read_Bools(a, h->attrBools,
2443 				      (size_t)zip->numFiles) < 0)
2444 					return (-1);
2445 			}
2446 			for (i = 0; i < zip->numFiles; i++) {
2447 				if (h->attrBools[i]) {
2448 					if ((p = header_bytes(a, 4)) == NULL)
2449 						return (-1);
2450 					entries[i].attr = archive_le32dec(p);
2451 				}
2452 			}
2453 			break;
2454 		}
2455 		default:
2456 			if (header_bytes(a, ll) == NULL)
2457 				return (-1);
2458 			break;
2459 		}
2460 	}
2461 
2462 	/*
2463 	 * Set up entry's attributes.
2464 	 */
2465 	folders = si->ci.folders;
2466 	eindex = sindex = 0;
2467 	folderIndex = indexInFolder = 0;
2468 	for (i = 0; i < zip->numFiles; i++) {
2469 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2470 			entries[i].flg |= HAS_STREAM;
2471 		/* The high 16 bits of attributes is a posix file mode. */
2472 		entries[i].mode = entries[i].attr >> 16;
2473 		if (entries[i].flg & HAS_STREAM) {
2474 			if ((size_t)sindex >= si->ss.unpack_streams)
2475 				return (-1);
2476 			if (entries[i].mode == 0)
2477 				entries[i].mode = AE_IFREG | 0666;
2478 			if (si->ss.digestsDefined[sindex])
2479 				entries[i].flg |= CRC32_IS_SET;
2480 			entries[i].ssIndex = sindex;
2481 			sindex++;
2482 		} else {
2483 			int dir;
2484 			if (h->emptyFileBools == NULL)
2485 				dir = 1;
2486 			else {
2487 				if (h->emptyFileBools[eindex])
2488 					dir = 0;
2489 				else
2490 					dir = 1;
2491 				eindex++;
2492 			}
2493 			if (entries[i].mode == 0) {
2494 				if (dir)
2495 					entries[i].mode = AE_IFDIR | 0777;
2496 				else
2497 					entries[i].mode = AE_IFREG | 0666;
2498 			} else if (dir &&
2499 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2500 				entries[i].mode &= ~AE_IFMT;
2501 				entries[i].mode |= AE_IFDIR;
2502 			}
2503 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2504 			    entries[i].name_len >= 2 &&
2505 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2506 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2507 				entries[i].utf16name[entries[i].name_len] = '/';
2508 				entries[i].utf16name[entries[i].name_len+1] = 0;
2509 				entries[i].name_len += 2;
2510 			}
2511 			entries[i].ssIndex = -1;
2512 		}
2513 		if (entries[i].attr & 0x01)
2514 			entries[i].mode &= ~0222;/* Read only. */
2515 
2516 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2517 			/*
2518 			 * The entry is an empty file or a directory file,
2519 			 * those both have no contents.
2520 			 */
2521 			entries[i].folderIndex = -1;
2522 			continue;
2523 		}
2524 		if (indexInFolder == 0) {
2525 			for (;;) {
2526 				if (folderIndex >= si->ci.numFolders)
2527 					return (-1);
2528 				if (folders[folderIndex].numUnpackStreams)
2529 					break;
2530 				folderIndex++;
2531 			}
2532 		}
2533 		entries[i].folderIndex = folderIndex;
2534 		if ((entries[i].flg & HAS_STREAM) == 0)
2535 			continue;
2536 		indexInFolder++;
2537 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2538 			folderIndex++;
2539 			indexInFolder = 0;
2540 		}
2541 	}
2542 
2543 	return (0);
2544 }
2545 
2546 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2547 static void
2548 fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2549 {
2550 
2551 	if (fileTime >= EPOC_TIME) {
2552 		fileTime -= EPOC_TIME;
2553 		/* milli seconds base */
2554 		*timep = (time_t)(fileTime / 10000000);
2555 		/* nano seconds base */
2556 		*ns = (long)(fileTime % 10000000) * 100;
2557 	} else {
2558 		*timep = 0;
2559 		*ns = 0;
2560 	}
2561 }
2562 
2563 static int
2564 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2565 {
2566 	struct _7zip *zip = (struct _7zip *)a->format->data;
2567 	const unsigned char *p;
2568 	struct _7zip_entry *entries = zip->entries;
2569 	unsigned char *timeBools;
2570 	int allAreDefined;
2571 	unsigned i;
2572 
2573 	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2574 	if (timeBools == NULL)
2575 		return (-1);
2576 
2577 	/* Read allAreDefined. */
2578 	if ((p = header_bytes(a, 1)) == NULL)
2579 		goto failed;
2580 	allAreDefined = *p;
2581 	if (allAreDefined)
2582 		memset(timeBools, 1, (size_t)zip->numFiles);
2583 	else {
2584 		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2585 			goto failed;
2586 	}
2587 
2588 	/* Read external. */
2589 	if ((p = header_bytes(a, 1)) == NULL)
2590 		goto failed;
2591 	if (*p) {
2592 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2593 			goto failed;
2594 		if (1000000 < h->dataIndex)
2595 			goto failed;
2596 	}
2597 
2598 	for (i = 0; i < zip->numFiles; i++) {
2599 		if (!timeBools[i])
2600 			continue;
2601 		if ((p = header_bytes(a, 8)) == NULL)
2602 			goto failed;
2603 		switch (type) {
2604 		case kCTime:
2605 			fileTimeToUtc(archive_le64dec(p),
2606 			    &(entries[i].ctime),
2607 			    &(entries[i].ctime_ns));
2608 			entries[i].flg |= CTIME_IS_SET;
2609 			break;
2610 		case kATime:
2611 			fileTimeToUtc(archive_le64dec(p),
2612 			    &(entries[i].atime),
2613 			    &(entries[i].atime_ns));
2614 			entries[i].flg |= ATIME_IS_SET;
2615 			break;
2616 		case kMTime:
2617 			fileTimeToUtc(archive_le64dec(p),
2618 			    &(entries[i].mtime),
2619 			    &(entries[i].mtime_ns));
2620 			entries[i].flg |= MTIME_IS_SET;
2621 			break;
2622 		}
2623 	}
2624 
2625 	free(timeBools);
2626 	return (0);
2627 failed:
2628 	free(timeBools);
2629 	return (-1);
2630 }
2631 
2632 static int
2633 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2634 {
2635 	struct _7zip *zip = (struct _7zip *)a->format->data;
2636 
2637 	errno = 0;
2638 	if (read_StreamsInfo(a, si) < 0) {
2639 		if (errno == ENOMEM)
2640 			archive_set_error(&a->archive, -1,
2641 			    "Couldn't allocate memory");
2642 		else
2643 			archive_set_error(&a->archive, -1,
2644 			    "Malformed 7-Zip archive");
2645 		return (ARCHIVE_FATAL);
2646 	}
2647 
2648 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2649 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2650 		return (ARCHIVE_FATAL);
2651 	}
2652 
2653 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2654 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2655 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2656 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2657 		return (ARCHIVE_FATAL);
2658 	}
2659 
2660 	return (ARCHIVE_OK);
2661 }
2662 
2663 static const unsigned char *
2664 header_bytes(struct archive_read *a, size_t rbytes)
2665 {
2666 	struct _7zip *zip = (struct _7zip *)a->format->data;
2667 	const unsigned char *p;
2668 
2669 	if (zip->header_bytes_remaining < rbytes)
2670 		return (NULL);
2671 	if (zip->pack_stream_bytes_unconsumed)
2672 		read_consume(a);
2673 
2674 	if (zip->header_is_encoded == 0) {
2675 		p = __archive_read_ahead(a, rbytes, NULL);
2676 		if (p == NULL)
2677 			return (NULL);
2678 		zip->header_bytes_remaining -= rbytes;
2679 		zip->pack_stream_bytes_unconsumed = rbytes;
2680 	} else {
2681 		const void *buff;
2682 		ssize_t bytes;
2683 
2684 		bytes = read_stream(a, &buff, rbytes, rbytes);
2685 		if (bytes <= 0)
2686 			return (NULL);
2687 		zip->header_bytes_remaining -= bytes;
2688 		p = buff;
2689 	}
2690 
2691 	/* Update checksum */
2692 	zip->header_crc32 = crc32(zip->header_crc32, p, (unsigned)rbytes);
2693 	return (p);
2694 }
2695 
2696 static int
2697 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2698     struct _7z_header_info *header)
2699 {
2700 	const unsigned char *p;
2701 	uint64_t next_header_offset;
2702 	uint64_t next_header_size;
2703 	uint32_t next_header_crc;
2704 	ssize_t bytes_avail;
2705 	int check_header_crc, r;
2706 
2707 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2708 		return (ARCHIVE_FATAL);
2709 
2710 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2711 		/* This is an executable ? Must be self-extracting... */
2712 		r = skip_sfx(a, bytes_avail);
2713 		if (r < ARCHIVE_WARN)
2714 			return (r);
2715 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2716 			return (ARCHIVE_FATAL);
2717 	}
2718 	zip->seek_base += 32;
2719 
2720 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2721 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2722 		return (ARCHIVE_FATAL);
2723 	}
2724 
2725 	/* CRC check. */
2726 	if (crc32(0, (const unsigned char *)p + 12, 20)
2727 	    != archive_le32dec(p + 8)) {
2728 		archive_set_error(&a->archive, -1, "Header CRC error");
2729 		return (ARCHIVE_FATAL);
2730 	}
2731 
2732 	next_header_offset = archive_le64dec(p + 12);
2733 	next_header_size = archive_le64dec(p + 20);
2734 	next_header_crc = archive_le32dec(p + 28);
2735 
2736 	if (next_header_size == 0)
2737 		/* There is no entry in an archive file. */
2738 		return (ARCHIVE_EOF);
2739 
2740 	if (((int64_t)next_header_offset) < 0) {
2741 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2742 		return (ARCHIVE_FATAL);
2743 	}
2744 	__archive_read_consume(a, 32);
2745 	if (next_header_offset != 0) {
2746 		if (bytes_avail >= (ssize_t)next_header_offset)
2747 			__archive_read_consume(a, next_header_offset);
2748 		else if (__archive_read_seek(a,
2749 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
2750 			return (ARCHIVE_FATAL);
2751 	}
2752 	zip->stream_offset = next_header_offset;
2753 	zip->header_offset = next_header_offset;
2754 	zip->header_bytes_remaining = next_header_size;
2755 	zip->header_crc32 = 0;
2756 	zip->header_is_encoded = 0;
2757 	zip->header_is_being_read = 1;
2758 	check_header_crc = 1;
2759 
2760 	if ((p = header_bytes(a, 1)) == NULL) {
2761 		archive_set_error(&a->archive,
2762 		    ARCHIVE_ERRNO_FILE_FORMAT,
2763 		    "Truncated 7-Zip file body");
2764 		return (ARCHIVE_FATAL);
2765 	}
2766 	/* Parse ArchiveProperties. */
2767 	switch (p[0]) {
2768 	case kEncodedHeader:
2769 		/*
2770 		 * The archive has an encoded header and we have to decode it
2771 		 * in order to parse the header correctly.
2772 		 */
2773 		r = decode_encoded_header_info(a, &(zip->si));
2774 
2775 		/* Check the EncodedHeader CRC.*/
2776 		if (r == 0 && zip->header_crc32 != next_header_crc) {
2777 			archive_set_error(&a->archive, -1,
2778 			    "Damaged 7-Zip archive");
2779 			r = -1;
2780 		}
2781 		if (r == 0) {
2782 			if (zip->si.ci.folders[0].digest_defined)
2783 				next_header_crc = zip->si.ci.folders[0].digest;
2784 			else
2785 				check_header_crc = 0;
2786 			if (zip->pack_stream_bytes_unconsumed)
2787 				read_consume(a);
2788 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
2789 			if (r == 0) {
2790 				zip->header_bytes_remaining =
2791 					zip->folder_outbytes_remaining;
2792 				r = seek_pack(a);
2793 			}
2794 		}
2795 		/* Clean up StreamsInfo. */
2796 		free_StreamsInfo(&(zip->si));
2797 		memset(&(zip->si), 0, sizeof(zip->si));
2798 		if (r < 0)
2799 			return (ARCHIVE_FATAL);
2800 		zip->header_is_encoded = 1;
2801 		zip->header_crc32 = 0;
2802 		/* FALL THROUGH */
2803 	case kHeader:
2804 		/*
2805 		 * Parse the header.
2806 		 */
2807 		errno = 0;
2808 		r = read_Header(a, header, zip->header_is_encoded);
2809 		if (r < 0) {
2810 			if (errno == ENOMEM)
2811 				archive_set_error(&a->archive, -1,
2812 				    "Couldn't allocate memory");
2813 			else
2814 				archive_set_error(&a->archive, -1,
2815 				    "Damaged 7-Zip archive");
2816 			return (ARCHIVE_FATAL);
2817 		}
2818 
2819 		/*
2820 		 *  Must be kEnd.
2821 		 */
2822 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
2823 			archive_set_error(&a->archive, -1,
2824 			    "Malformed 7-Zip archive");
2825 			return (ARCHIVE_FATAL);
2826 		}
2827 
2828 		/* Check the Header CRC.*/
2829 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
2830 			archive_set_error(&a->archive, -1,
2831 			    "Malformed 7-Zip archive");
2832 			return (ARCHIVE_FATAL);
2833 		}
2834 		break;
2835 	default:
2836 		archive_set_error(&a->archive, -1,
2837 		    "Unexpected Property ID = %X", p[0]);
2838 		return (ARCHIVE_FATAL);
2839 	}
2840 
2841 	/* Clean up variables be used for decoding the archive header */
2842 	zip->pack_stream_remaining = 0;
2843 	zip->pack_stream_index = 0;
2844 	zip->folder_outbytes_remaining = 0;
2845 	zip->uncompressed_buffer_bytes_remaining = 0;
2846 	zip->pack_stream_bytes_unconsumed = 0;
2847 	zip->header_is_being_read = 0;
2848 
2849 	return (ARCHIVE_OK);
2850 }
2851 
2852 static ssize_t
2853 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
2854     size_t minimum)
2855 {
2856 	struct _7zip *zip = (struct _7zip *)a->format->data;
2857 	ssize_t bytes_avail;
2858 
2859 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2860 		/* Copy mode. */
2861 
2862 		/*
2863 		 * Note: '1' here is a performance optimization.
2864 		 * Recall that the decompression layer returns a count of
2865 		 * available bytes; asking for more than that forces the
2866 		 * decompressor to combine reads by copying data.
2867 		 */
2868 		*buff = __archive_read_ahead(a, 1, &bytes_avail);
2869 		if (bytes_avail <= 0) {
2870 			archive_set_error(&a->archive,
2871 			    ARCHIVE_ERRNO_FILE_FORMAT,
2872 			    "Truncated 7-Zip file data");
2873 			return (ARCHIVE_FATAL);
2874 		}
2875 		if ((size_t)bytes_avail >
2876 		    zip->uncompressed_buffer_bytes_remaining)
2877 			bytes_avail = (ssize_t)
2878 			    zip->uncompressed_buffer_bytes_remaining;
2879 		if ((size_t)bytes_avail > size)
2880 			bytes_avail = (ssize_t)size;
2881 
2882 		zip->pack_stream_bytes_unconsumed = bytes_avail;
2883 	} else if (zip->uncompressed_buffer_pointer == NULL) {
2884 		/* Decompression has failed. */
2885 		archive_set_error(&(a->archive),
2886 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
2887 		return (ARCHIVE_FATAL);
2888 	} else {
2889 		/* Packed mode. */
2890 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
2891 			/*
2892 			 * If remaining uncompressed data size is less than
2893 			 * the minimum size, fill the buffer up to the
2894 			 * minimum size.
2895 			 */
2896 			if (extract_pack_stream(a, minimum) < 0)
2897 				return (ARCHIVE_FATAL);
2898 		}
2899 		if (size > zip->uncompressed_buffer_bytes_remaining)
2900 			bytes_avail = (ssize_t)
2901 			    zip->uncompressed_buffer_bytes_remaining;
2902 		else
2903 			bytes_avail = (ssize_t)size;
2904 		*buff = zip->uncompressed_buffer_pointer;
2905 		zip->uncompressed_buffer_pointer += bytes_avail;
2906 	}
2907 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
2908 	return (bytes_avail);
2909 }
2910 
2911 static ssize_t
2912 extract_pack_stream(struct archive_read *a, size_t minimum)
2913 {
2914 	struct _7zip *zip = (struct _7zip *)a->format->data;
2915 	ssize_t bytes_avail;
2916 	int r;
2917 
2918 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2919 		if (minimum == 0)
2920 			minimum = 1;
2921 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
2922 		    || bytes_avail <= 0) {
2923 			archive_set_error(&a->archive,
2924 			    ARCHIVE_ERRNO_FILE_FORMAT,
2925 			    "Truncated 7-Zip file body");
2926 			return (ARCHIVE_FATAL);
2927 		}
2928 		if (bytes_avail > (ssize_t)zip->pack_stream_inbytes_remaining)
2929 			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
2930 		zip->pack_stream_inbytes_remaining -= bytes_avail;
2931 		if (bytes_avail > (ssize_t)zip->folder_outbytes_remaining)
2932 			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
2933 		zip->folder_outbytes_remaining -= bytes_avail;
2934 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
2935 		return (ARCHIVE_OK);
2936 	}
2937 
2938 	/* If the buffer hasn't been allocated, allocate it now. */
2939 	if (zip->uncompressed_buffer == NULL) {
2940 		zip->uncompressed_buffer_size = UBUFF_SIZE;
2941 		if (zip->uncompressed_buffer_size < minimum) {
2942 			zip->uncompressed_buffer_size = minimum + 1023;
2943 			zip->uncompressed_buffer_size &= ~0x3ff;
2944 		}
2945 		zip->uncompressed_buffer =
2946 		    malloc(zip->uncompressed_buffer_size);
2947 		if (zip->uncompressed_buffer == NULL) {
2948 			archive_set_error(&a->archive, ENOMEM,
2949 			    "No memory for 7-Zip decompression");
2950 			return (ARCHIVE_FATAL);
2951 		}
2952 		zip->uncompressed_buffer_bytes_remaining = 0;
2953 	} else if (zip->uncompressed_buffer_size < minimum ||
2954 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
2955 		/*
2956 		 * Make sure the uncompressed buffer can have bytes
2957 		 * at least `minimum' bytes.
2958 		 * NOTE: This case happen when reading the header.
2959 		 */
2960 		size_t used;
2961 		if (zip->uncompressed_buffer_pointer != 0)
2962 			used = zip->uncompressed_buffer_pointer -
2963 				zip->uncompressed_buffer;
2964 		else
2965 			used = 0;
2966 		if (zip->uncompressed_buffer_size < minimum) {
2967 			/*
2968 			 * Expand the uncompressed buffer up to
2969 			 * the minimum size.
2970 			 */
2971 			void *p;
2972 			size_t new_size;
2973 
2974 			new_size = minimum + 1023;
2975 			new_size &= ~0x3ff;
2976 			p = realloc(zip->uncompressed_buffer, new_size);
2977 			if (p == NULL) {
2978 				archive_set_error(&a->archive, ENOMEM,
2979 				    "No memory for 7-Zip decompression");
2980 				return (ARCHIVE_FATAL);
2981 			}
2982 			zip->uncompressed_buffer = (unsigned char *)p;
2983 			zip->uncompressed_buffer_size = new_size;
2984 		}
2985 		/*
2986 		 * Move unconsumed bytes to the head.
2987 		 */
2988 		if (used) {
2989 			memmove(zip->uncompressed_buffer,
2990 				zip->uncompressed_buffer + used,
2991 				zip->uncompressed_buffer_bytes_remaining);
2992 		}
2993 	} else
2994 		zip->uncompressed_buffer_bytes_remaining = 0;
2995 	zip->uncompressed_buffer_pointer = NULL;
2996 	for (;;) {
2997 		size_t bytes_in, bytes_out;
2998 		const void *buff_in;
2999 		unsigned char *buff_out;
3000 		int end_of_data;
3001 
3002 		/*
3003 		 * Note: '1' here is a performance optimization.
3004 		 * Recall that the decompression layer returns a count of
3005 		 * available bytes; asking for more than that forces the
3006 		 * decompressor to combine reads by copying data.
3007 		 */
3008 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3009 		if (bytes_avail <= 0) {
3010 			archive_set_error(&a->archive,
3011 			    ARCHIVE_ERRNO_FILE_FORMAT,
3012 			    "Truncated 7-Zip file body");
3013 			return (ARCHIVE_FATAL);
3014 		}
3015 
3016 		buff_out = zip->uncompressed_buffer
3017 			+ zip->uncompressed_buffer_bytes_remaining;
3018 		bytes_out = zip->uncompressed_buffer_size
3019 			- zip->uncompressed_buffer_bytes_remaining;
3020 		bytes_in = bytes_avail;
3021 		if (bytes_in > zip->pack_stream_inbytes_remaining)
3022 			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3023 		/* Drive decompression. */
3024 		r = decompress(a, zip, buff_out, &bytes_out,
3025 			buff_in, &bytes_in);
3026 		switch (r) {
3027 		case ARCHIVE_OK:
3028 			end_of_data = 0;
3029 			break;
3030 		case ARCHIVE_EOF:
3031 			end_of_data = 1;
3032 			break;
3033 		default:
3034 			return (ARCHIVE_FATAL);
3035 		}
3036 		zip->pack_stream_inbytes_remaining -= bytes_in;
3037 		if (bytes_out > zip->folder_outbytes_remaining)
3038 			bytes_out = (size_t)zip->folder_outbytes_remaining;
3039 		zip->folder_outbytes_remaining -= bytes_out;
3040 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3041 		zip->pack_stream_bytes_unconsumed = bytes_in;
3042 
3043 		/*
3044 		 * Continue decompression until uncompressed_buffer is full.
3045 		 */
3046 		if (zip->uncompressed_buffer_bytes_remaining ==
3047 		    zip->uncompressed_buffer_size)
3048 			break;
3049 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3050 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3051 		    zip->uncompressed_buffer_size)
3052 			break;
3053 		if (zip->pack_stream_inbytes_remaining == 0 &&
3054 		    zip->folder_outbytes_remaining == 0)
3055 			break;
3056 		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3057 			archive_set_error(&(a->archive),
3058 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3059 			return (ARCHIVE_FATAL);
3060 		}
3061 		read_consume(a);
3062 	}
3063 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3064 		archive_set_error(&(a->archive),
3065 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3066 		return (ARCHIVE_FATAL);
3067 	}
3068 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3069 	return (ARCHIVE_OK);
3070 }
3071 
3072 static int
3073 seek_pack(struct archive_read *a)
3074 {
3075 	struct _7zip *zip = (struct _7zip *)a->format->data;
3076 	int64_t pack_offset;
3077 
3078 	if (zip->pack_stream_remaining <= 0) {
3079 		archive_set_error(&(a->archive),
3080 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3081 		return (ARCHIVE_FATAL);
3082 	}
3083 	zip->pack_stream_inbytes_remaining =
3084 	    zip->si.pi.sizes[zip->pack_stream_index];
3085 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3086 	if (zip->stream_offset != pack_offset) {
3087 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3088 		    SEEK_SET))
3089 			return (ARCHIVE_FATAL);
3090 		zip->stream_offset = pack_offset;
3091 	}
3092 	zip->pack_stream_index++;
3093 	zip->pack_stream_remaining--;
3094 	return (ARCHIVE_OK);
3095 }
3096 
3097 static ssize_t
3098 read_stream(struct archive_read *a, const void **buff, size_t size,
3099     size_t minimum)
3100 {
3101 	struct _7zip *zip = (struct _7zip *)a->format->data;
3102 	uint64_t skip_bytes = 0;
3103 	ssize_t r;
3104 
3105 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3106 		if (zip->pack_stream_inbytes_remaining > 0) {
3107 			r = extract_pack_stream(a, 0);
3108 			if (r < 0)
3109 				return (r);
3110 			return (get_uncompressed_data(a, buff, size, minimum));
3111 		} else if (zip->folder_outbytes_remaining > 0) {
3112 			/* Extract a remaining pack stream. */
3113 			r = extract_pack_stream(a, 0);
3114 			if (r < 0)
3115 				return (r);
3116 			return (get_uncompressed_data(a, buff, size, minimum));
3117 		}
3118 	} else
3119 		return (get_uncompressed_data(a, buff, size, minimum));
3120 
3121 	/*
3122 	 * Current pack stream has been consumed.
3123 	 */
3124 	if (zip->pack_stream_remaining == 0) {
3125 		if (zip->header_is_being_read) {
3126 			/* Invalid sequence. This might happen when
3127 			 * reading a malformed archive. */
3128 			archive_set_error(&(a->archive),
3129 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3130 			return (ARCHIVE_FATAL);
3131 		}
3132 
3133 		/*
3134 		 * All current folder's pack streams have been
3135 		 * consumed. Switch to next folder.
3136 		 */
3137 		if (zip->folder_index == 0 &&
3138 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3139 		     || zip->folder_index != zip->entry->folderIndex)) {
3140 			zip->folder_index = zip->entry->folderIndex;
3141 			skip_bytes =
3142 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3143 		}
3144 
3145 		if (zip->folder_index >= zip->si.ci.numFolders) {
3146 			/*
3147 			 * We have consumed all folders and its pack streams.
3148 			 */
3149 			*buff = NULL;
3150 			return (0);
3151 		}
3152 		r = setup_decode_folder(a,
3153 			&(zip->si.ci.folders[zip->folder_index]), 0);
3154 		if (r != ARCHIVE_OK)
3155 			return (ARCHIVE_FATAL);
3156 
3157 		zip->folder_index++;
3158 	}
3159 
3160 	/*
3161 	 * Switch to next pack stream.
3162 	 */
3163 	r = seek_pack(a);
3164 	if (r < 0)
3165 		return (r);
3166 
3167 	/* Extract a new pack stream. */
3168 	r = extract_pack_stream(a, 0);
3169 	if (r < 0)
3170 		return (r);
3171 
3172 	/*
3173 	 * Skip the bytes we alrady has skipped in skip_stream().
3174 	 */
3175 	while (skip_bytes) {
3176 		ssize_t skipped;
3177 
3178 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3179 			if (zip->pack_stream_inbytes_remaining > 0) {
3180 				r = extract_pack_stream(a, 0);
3181 				if (r < 0)
3182 					return (r);
3183 			} else if (zip->folder_outbytes_remaining > 0) {
3184 				/* Extract a remaining pack stream. */
3185 				r = extract_pack_stream(a, 0);
3186 				if (r < 0)
3187 					return (r);
3188 			} else {
3189 				archive_set_error(&a->archive,
3190 				    ARCHIVE_ERRNO_FILE_FORMAT,
3191 				    "Truncated 7-Zip file body");
3192 				return (ARCHIVE_FATAL);
3193 			}
3194 		}
3195 		skipped = get_uncompressed_data(
3196 			a, buff, (size_t)skip_bytes, 0);
3197 		if (skipped < 0)
3198 			return (skipped);
3199 		skip_bytes -= skipped;
3200 		if (zip->pack_stream_bytes_unconsumed)
3201 			read_consume(a);
3202 	}
3203 
3204 	return (get_uncompressed_data(a, buff, size, minimum));
3205 }
3206 
3207 static int
3208 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3209     int header)
3210 {
3211 	struct _7zip *zip = (struct _7zip *)a->format->data;
3212 	const struct _7z_coder *coder1, *coder2;
3213 	const char *cname = (header)?"archive header":"file content";
3214 	unsigned i;
3215 	int r, found_bcj2 = 0;
3216 
3217 	/*
3218 	 * Release the memory which the previous folder used for BCJ2.
3219 	 */
3220 	for (i = 0; i < 3; i++) {
3221 		if (zip->sub_stream_buff[i] != NULL)
3222 			free(zip->sub_stream_buff[i]);
3223 		zip->sub_stream_buff[i] = NULL;
3224 	}
3225 
3226 	/*
3227 	 * Initialize a stream reader.
3228 	 */
3229 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3230 	zip->pack_stream_index = (unsigned)folder->packIndex;
3231 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3232 	zip->uncompressed_buffer_bytes_remaining = 0;
3233 
3234 	/*
3235 	 * Check coder types.
3236 	 */
3237 	for (i = 0; i < folder->numCoders; i++) {
3238 		if (folder->coders[i].codec == _7Z_CRYPTO) {
3239 			archive_set_error(&(a->archive),
3240 			    ARCHIVE_ERRNO_MISC,
3241 			    "The %s is encrypted, "
3242 			    "but currently not supported", cname);
3243 			return (ARCHIVE_FATAL);
3244 		}
3245 		if (folder->coders[i].codec == _7Z_X86_BCJ2)
3246 			found_bcj2++;
3247 	}
3248 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3249 		archive_set_error(&(a->archive),
3250 		    ARCHIVE_ERRNO_MISC,
3251 		    "The %s is encoded with many filters, "
3252 		    "but currently not supported", cname);
3253 		return (ARCHIVE_FATAL);
3254 	}
3255 	coder1 = &(folder->coders[0]);
3256 	if (folder->numCoders == 2)
3257 		coder2 = &(folder->coders[1]);
3258 	else
3259 		coder2 = NULL;
3260 
3261 	if (found_bcj2) {
3262 		/*
3263 		 * Preparation to decode BCJ2.
3264 		 * Decoding BCJ2 requires four sources. Those are at least,
3265 		 * as far as I know, two types of the storage form.
3266 		 */
3267 		const struct _7z_coder *fc = folder->coders;
3268 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3269 		const struct _7z_coder *scoder[3] =
3270 			{&coder_copy, &coder_copy, &coder_copy};
3271 		const void *buff;
3272 		ssize_t bytes;
3273 		unsigned char *b[3] = {NULL, NULL, NULL};
3274 		uint64_t sunpack[3] ={-1, -1, -1};
3275 		size_t s[3] = {0, 0, 0};
3276 		int idx[3] = {0, 1, 2};
3277 
3278 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3279 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3280 		    zip->pack_stream_remaining == 4) {
3281 			/* Source type 1 made by 7zr or 7z with -m options. */
3282 			if (folder->bindPairs[0].inIndex == 5) {
3283 				/* The form made by 7zr */
3284 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3285 				scoder[1] = &(fc[1]);
3286 				scoder[2] = &(fc[0]);
3287 				sunpack[1] = folder->unPackSize[1];
3288 				sunpack[2] = folder->unPackSize[0];
3289 				coder1 = &(fc[2]);
3290 			} else {
3291 				/*
3292 				 * NOTE: Some patterns do not work.
3293 				 * work:
3294 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3295 				 *       -m3=(any)
3296 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3297 				 *       -m3=COPY
3298 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3299 				 *       -m3=COPY
3300 				 * not work:
3301 				 *  other patterns.
3302 				 *
3303 				 * We have to handle this like `pipe' or
3304 				 * our libarchive7s filter frame work,
3305 				 * decoding the BCJ2 main stream sequentially,
3306 				 * m3 -> m2 -> m1 -> BCJ2.
3307 				 *
3308 				 */
3309 				if (fc[0].codec == _7Z_COPY &&
3310 				    fc[1].codec == _7Z_COPY)
3311 					coder1 = &(folder->coders[2]);
3312 				else if (fc[0].codec == _7Z_COPY &&
3313 				    fc[2].codec == _7Z_COPY)
3314 					coder1 = &(folder->coders[1]);
3315 				else if (fc[1].codec == _7Z_COPY &&
3316 				    fc[2].codec == _7Z_COPY)
3317 					coder1 = &(folder->coders[0]);
3318 				else {
3319 					archive_set_error(&(a->archive),
3320 					    ARCHIVE_ERRNO_MISC,
3321 					    "Unsupported form of "
3322 					    "BCJ2 streams");
3323 					return (ARCHIVE_FATAL);
3324 				}
3325 			}
3326 			coder2 = &(fc[3]);
3327 			zip->main_stream_bytes_remaining =
3328 				(size_t)folder->unPackSize[2];
3329 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3330 		    zip->pack_stream_remaining == 4 &&
3331 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3332 			/* Source type 0 made by 7z */
3333 			zip->main_stream_bytes_remaining =
3334 				(size_t)folder->unPackSize[0];
3335 		} else {
3336 			/* We got an unexpected form. */
3337 			archive_set_error(&(a->archive),
3338 			    ARCHIVE_ERRNO_MISC,
3339 			    "Unsupported form of BCJ2 streams");
3340 			return (ARCHIVE_FATAL);
3341 		}
3342 
3343 		/* Skip the main stream at this time. */
3344 		if ((r = seek_pack(a)) < 0)
3345 			return (r);
3346 		zip->pack_stream_bytes_unconsumed =
3347 		    (size_t)zip->pack_stream_inbytes_remaining;
3348 		read_consume(a);
3349 
3350 		/* Read following three sub streams. */
3351 		for (i = 0; i < 3; i++) {
3352 			const struct _7z_coder *coder = scoder[i];
3353 
3354 			if ((r = seek_pack(a)) < 0) {
3355 				free(b[0]); free(b[1]); free(b[2]);
3356 				return (r);
3357 			}
3358 
3359 			if (sunpack[i] == (uint64_t)-1)
3360 				zip->folder_outbytes_remaining =
3361 				    zip->pack_stream_inbytes_remaining;
3362 			else
3363 				zip->folder_outbytes_remaining = sunpack[i];
3364 
3365 			r = init_decompression(a, zip, coder, NULL);
3366 			if (r != ARCHIVE_OK) {
3367 				free(b[0]); free(b[1]); free(b[2]);
3368 				return (ARCHIVE_FATAL);
3369 			}
3370 
3371 			/* Allocate memory for the decorded data of a sub
3372 			 * stream. */
3373 			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3374 			if (b[i] == NULL) {
3375 				free(b[0]); free(b[1]); free(b[2]);
3376 				archive_set_error(&a->archive, ENOMEM,
3377 				    "No memory for 7-Zip decompression");
3378 				return (ARCHIVE_FATAL);
3379 			}
3380 
3381 			/* Extract a sub stream. */
3382 			while (zip->pack_stream_inbytes_remaining > 0) {
3383 				r = (int)extract_pack_stream(a, 0);
3384 				if (r < 0) {
3385 					free(b[0]); free(b[1]); free(b[2]);
3386 					return (r);
3387 				}
3388 				bytes = get_uncompressed_data(a, &buff,
3389 				    zip->uncompressed_buffer_bytes_remaining,
3390 				    0);
3391 				if (bytes < 0) {
3392 					free(b[0]); free(b[1]); free(b[2]);
3393 					return ((int)bytes);
3394 				}
3395 				memcpy(b[i]+s[i], buff, bytes);
3396 				s[i] += bytes;
3397 				if (zip->pack_stream_bytes_unconsumed)
3398 					read_consume(a);
3399 			}
3400 		}
3401 
3402 		/* Set the sub streams to the right place. */
3403 		for (i = 0; i < 3; i++) {
3404 			zip->sub_stream_buff[i] = b[idx[i]];
3405 			zip->sub_stream_size[i] = s[idx[i]];
3406 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3407 		}
3408 
3409 		/* Allocate memory used for decoded main stream bytes. */
3410 		if (zip->tmp_stream_buff == NULL) {
3411 			zip->tmp_stream_buff_size = 32 * 1024;
3412 			zip->tmp_stream_buff =
3413 			    malloc(zip->tmp_stream_buff_size);
3414 			if (zip->tmp_stream_buff == NULL) {
3415 				archive_set_error(&a->archive, ENOMEM,
3416 				    "No memory for 7-Zip decompression");
3417 				return (ARCHIVE_FATAL);
3418 			}
3419 		}
3420 		zip->tmp_stream_bytes_avail = 0;
3421 		zip->tmp_stream_bytes_remaining = 0;
3422 		zip->odd_bcj_size = 0;
3423 		zip->bcj2_outPos = 0;
3424 
3425 		/*
3426 		 * Reset a stream reader in order to read the main stream
3427 		 * of BCJ2.
3428 		 */
3429 		zip->pack_stream_remaining = 1;
3430 		zip->pack_stream_index = (unsigned)folder->packIndex;
3431 		zip->folder_outbytes_remaining =
3432 		    folder_uncompressed_size(folder);
3433 		zip->uncompressed_buffer_bytes_remaining = 0;
3434 	}
3435 
3436 	/*
3437 	 * Initialize the decompressor for the new folder's pack streams.
3438 	 */
3439 	r = init_decompression(a, zip, coder1, coder2);
3440 	if (r != ARCHIVE_OK)
3441 		return (ARCHIVE_FATAL);
3442 	return (ARCHIVE_OK);
3443 }
3444 
3445 static int64_t
3446 skip_stream(struct archive_read *a, size_t skip_bytes)
3447 {
3448 	struct _7zip *zip = (struct _7zip *)a->format->data;
3449 	const void *p;
3450 	int64_t skipped_bytes;
3451 	size_t bytes = skip_bytes;
3452 
3453 	if (zip->folder_index == 0) {
3454 		/*
3455 		 * Optimization for a list mode.
3456 		 * Avoid unncecessary decoding operations.
3457 		 */
3458 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3459 		    += skip_bytes;
3460 		return (skip_bytes);
3461 	}
3462 
3463 	while (bytes) {
3464 		skipped_bytes = read_stream(a, &p, bytes, 0);
3465 		if (skipped_bytes < 0)
3466 			return (skipped_bytes);
3467 		if (skipped_bytes == 0) {
3468 			archive_set_error(&a->archive,
3469 			    ARCHIVE_ERRNO_FILE_FORMAT,
3470 			    "Truncated 7-Zip file body");
3471 			return (ARCHIVE_FATAL);
3472 		}
3473 		bytes -= (size_t)skipped_bytes;
3474 		if (zip->pack_stream_bytes_unconsumed)
3475 			read_consume(a);
3476 	}
3477 	return (skip_bytes);
3478 }
3479 
3480 /*
3481  * Brought from LZMA SDK.
3482  *
3483  * Bra86.c -- Converter for x86 code (BCJ)
3484  * 2008-10-04 : Igor Pavlov : Public domain
3485  *
3486  */
3487 
3488 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3489 
3490 static void
3491 x86_Init(struct _7zip *zip)
3492 {
3493 	zip->bcj_state = 0;
3494 	zip->bcj_prevPosT = (size_t)0 - 1;
3495 	zip->bcj_prevMask = 0;
3496 	zip->bcj_ip = 5;
3497 }
3498 
3499 static size_t
3500 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3501 {
3502 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3503 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3504 	size_t bufferPos, prevPosT;
3505 	uint32_t ip, prevMask;
3506 
3507 	if (size < 5)
3508 		return 0;
3509 
3510 	bufferPos = 0;
3511 	prevPosT = zip->bcj_prevPosT;
3512 	prevMask = zip->bcj_prevMask;
3513 	ip = zip->bcj_ip;
3514 
3515 	for (;;) {
3516 		uint8_t *p = data + bufferPos;
3517 		uint8_t *limit = data + size - 4;
3518 
3519 		for (; p < limit; p++)
3520 			if ((*p & 0xFE) == 0xE8)
3521 				break;
3522 		bufferPos = (size_t)(p - data);
3523 		if (p >= limit)
3524 			break;
3525 		prevPosT = bufferPos - prevPosT;
3526 		if (prevPosT > 3)
3527 			prevMask = 0;
3528 		else {
3529 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3530 			if (prevMask != 0) {
3531 				unsigned char b =
3532 					p[4 - kMaskToBitNumber[prevMask]];
3533 				if (!kMaskToAllowedStatus[prevMask] ||
3534 				    Test86MSByte(b)) {
3535 					prevPosT = bufferPos;
3536 					prevMask = ((prevMask << 1) & 0x7) | 1;
3537 					bufferPos++;
3538 					continue;
3539 				}
3540 			}
3541 		}
3542 		prevPosT = bufferPos;
3543 
3544 		if (Test86MSByte(p[4])) {
3545 			uint32_t src = ((uint32_t)p[4] << 24) |
3546 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3547 				((uint32_t)p[1]);
3548 			uint32_t dest;
3549 			for (;;) {
3550 				uint8_t b;
3551 				int b_index;
3552 
3553 				dest = src - (ip + (uint32_t)bufferPos);
3554 				if (prevMask == 0)
3555 					break;
3556 				b_index = kMaskToBitNumber[prevMask] * 8;
3557 				b = (uint8_t)(dest >> (24 - b_index));
3558 				if (!Test86MSByte(b))
3559 					break;
3560 				src = dest ^ ((1 << (32 - b_index)) - 1);
3561 			}
3562 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3563 			p[3] = (uint8_t)(dest >> 16);
3564 			p[2] = (uint8_t)(dest >> 8);
3565 			p[1] = (uint8_t)dest;
3566 			bufferPos += 5;
3567 		} else {
3568 			prevMask = ((prevMask << 1) & 0x7) | 1;
3569 			bufferPos++;
3570 		}
3571 	}
3572 	zip->bcj_prevPosT = prevPosT;
3573 	zip->bcj_prevMask = prevMask;
3574 	zip->bcj_ip += (uint32_t)bufferPos;
3575 	return (bufferPos);
3576 }
3577 
3578 /*
3579  * Brought from LZMA SDK.
3580  *
3581  * Bcj2.c -- Converter for x86 code (BCJ2)
3582  * 2008-10-04 : Igor Pavlov : Public domain
3583  *
3584  */
3585 
3586 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3587 
3588 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3589 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3590 
3591 #define kNumTopBits 24
3592 #define kTopValue ((uint32_t)1 << kNumTopBits)
3593 
3594 #define kNumBitModelTotalBits 11
3595 #define kBitModelTotal (1 << kNumBitModelTotalBits)
3596 #define kNumMoveBits 5
3597 
3598 #define RC_READ_BYTE (*buffer++)
3599 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
3600 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
3601   { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
3602 
3603 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
3604 
3605 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
3606 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
3607 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
3608 
3609 static ssize_t
3610 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
3611 {
3612 	size_t inPos = 0, outPos = 0;
3613 	const uint8_t *buf0, *buf1, *buf2, *buf3;
3614 	size_t size0, size1, size2, size3;
3615 	const uint8_t *buffer, *bufferLim;
3616 	unsigned int i, j;
3617 
3618 	size0 = zip->tmp_stream_bytes_remaining;
3619 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
3620 	size1 = zip->sub_stream_bytes_remaining[0];
3621 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
3622 	size2 = zip->sub_stream_bytes_remaining[1];
3623 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
3624 	size3 = zip->sub_stream_bytes_remaining[2];
3625 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
3626 
3627 	buffer = buf3;
3628 	bufferLim = buffer + size3;
3629 
3630 	if (zip->bcj_state == 0) {
3631 		/*
3632 		 * Initialize.
3633 		 */
3634 		zip->bcj2_prevByte = 0;
3635 		for (i = 0;
3636 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
3637 			zip->bcj2_p[i] = kBitModelTotal >> 1;
3638 		RC_INIT2;
3639 		zip->bcj_state = 1;
3640 	}
3641 
3642 	/*
3643 	 * Gather the odd bytes of a previous call.
3644 	 */
3645 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
3646 		outBuf[outPos++] = zip->odd_bcj[i];
3647 		zip->odd_bcj_size--;
3648 	}
3649 
3650 	if (outSize == 0) {
3651 		zip->bcj2_outPos += outPos;
3652 		return (outPos);
3653 	}
3654 
3655 	for (;;) {
3656 		uint8_t b;
3657 		CProb *prob;
3658 		uint32_t bound;
3659 		uint32_t ttt;
3660 
3661 		size_t limit = size0 - inPos;
3662 		if (outSize - outPos < limit)
3663 			limit = outSize - outPos;
3664 
3665 		if (zip->bcj_state == 1) {
3666 			while (limit != 0) {
3667 				uint8_t bb = buf0[inPos];
3668 				outBuf[outPos++] = bb;
3669 				if (IsJ(zip->bcj2_prevByte, bb)) {
3670 					zip->bcj_state = 2;
3671 					break;
3672 				}
3673 				inPos++;
3674 				zip->bcj2_prevByte = bb;
3675 				limit--;
3676 			}
3677 		}
3678 
3679 		if (limit == 0 || outPos == outSize)
3680 			break;
3681 		zip->bcj_state = 1;
3682 
3683 		b = buf0[inPos++];
3684 
3685 		if (b == 0xE8)
3686 			prob = zip->bcj2_p + zip->bcj2_prevByte;
3687 		else if (b == 0xE9)
3688 			prob = zip->bcj2_p + 256;
3689 		else
3690 			prob = zip->bcj2_p + 257;
3691 
3692 		IF_BIT_0(prob) {
3693 			UPDATE_0(prob)
3694 			zip->bcj2_prevByte = b;
3695 		} else {
3696 			uint32_t dest;
3697 			const uint8_t *v;
3698 			uint8_t out[4];
3699 
3700 			UPDATE_1(prob)
3701 			if (b == 0xE8) {
3702 				v = buf1;
3703 				if (size1 < 4)
3704 					return SZ_ERROR_DATA;
3705 				buf1 += 4;
3706 				size1 -= 4;
3707 			} else {
3708 				v = buf2;
3709 				if (size2 < 4)
3710 					return SZ_ERROR_DATA;
3711 				buf2 += 4;
3712 				size2 -= 4;
3713 			}
3714 			dest = (((uint32_t)v[0] << 24) |
3715 			    ((uint32_t)v[1] << 16) |
3716 			    ((uint32_t)v[2] << 8) |
3717 			    ((uint32_t)v[3])) -
3718 			    ((uint32_t)zip->bcj2_outPos + (uint32_t)outPos + 4);
3719 			out[0] = (uint8_t)dest;
3720 			out[1] = (uint8_t)(dest >> 8);
3721 			out[2] = (uint8_t)(dest >> 16);
3722 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
3723 
3724 			for (i = 0; i < 4 && outPos < outSize; i++)
3725 				outBuf[outPos++] = out[i];
3726 			if (i < 4) {
3727 				/*
3728 				 * Save odd bytes which we could not add into
3729 				 * the output buffer because of out of space.
3730 				 */
3731 				zip->odd_bcj_size = 4 -i;
3732 				for (; i < 4; i++) {
3733 					j = i - 4 + (unsigned)zip->odd_bcj_size;
3734 					zip->odd_bcj[j] = out[i];
3735 				}
3736 				break;
3737 			}
3738 		}
3739 	}
3740 	zip->tmp_stream_bytes_remaining -= inPos;
3741 	zip->sub_stream_bytes_remaining[0] = size1;
3742 	zip->sub_stream_bytes_remaining[1] = size2;
3743 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
3744 	zip->bcj2_outPos += outPos;
3745 
3746 	return ((ssize_t)outPos);
3747 }
3748 
3749