1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 __FBSDID("$FreeBSD$");
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #ifdef HAVE_STDLIB_H
33 #include <stdlib.h>
34 #endif
35 #ifdef HAVE_BZLIB_H
36 #include <bzlib.h>
37 #endif
38 #ifdef HAVE_LZMA_H
39 #include <lzma.h>
40 #endif
41 #ifdef HAVE_ZLIB_H
42 #include <zlib.h>
43 #endif
44 
45 #include "archive.h"
46 #include "archive_entry.h"
47 #include "archive_entry_locale.h"
48 #include "archive_ppmd7_private.h"
49 #include "archive_private.h"
50 #include "archive_read_private.h"
51 #include "archive_endian.h"
52 
53 #ifndef HAVE_ZLIB_H
54 #include "archive_crc32.h"
55 #endif
56 
57 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
58 #define SFX_MIN_ADDR	0x27000
59 #define SFX_MAX_ADDR	0x60000
60 
61 
62 /*
63  * Codec ID
64  */
65 #define _7Z_COPY	0
66 #define _7Z_LZMA	0x030101
67 #define _7Z_LZMA2	0x21
68 #define _7Z_DEFLATE	0x040108
69 #define _7Z_BZ2		0x040202
70 #define _7Z_PPMD	0x030401
71 #define _7Z_DELTA	0x03
72 #define _7Z_CRYPTO_MAIN_ZIP			0x06F10101 /* Main Zip crypto algo */
73 #define _7Z_CRYPTO_RAR_29			0x06F10303 /* Rar29 AES-128 + (modified SHA-1) */
74 #define _7Z_CRYPTO_AES_256_SHA_256	0x06F10701 /* AES-256 + SHA-256 */
75 
76 
77 #define _7Z_X86		0x03030103
78 #define _7Z_X86_BCJ2	0x0303011B
79 #define _7Z_POWERPC	0x03030205
80 #define _7Z_IA64	0x03030401
81 #define _7Z_ARM		0x03030501
82 #define _7Z_ARMTHUMB	0x03030701
83 #define _7Z_SPARC	0x03030805
84 
85 /*
86  * 7-Zip header property IDs.
87  */
88 #define kEnd			0x00
89 #define kHeader			0x01
90 #define kArchiveProperties	0x02
91 #define kAdditionalStreamsInfo	0x03
92 #define kMainStreamsInfo	0x04
93 #define kFilesInfo		0x05
94 #define kPackInfo		0x06
95 #define kUnPackInfo		0x07
96 #define kSubStreamsInfo		0x08
97 #define kSize			0x09
98 #define kCRC			0x0A
99 #define kFolder			0x0B
100 #define kCodersUnPackSize	0x0C
101 #define kNumUnPackStream	0x0D
102 #define kEmptyStream		0x0E
103 #define kEmptyFile		0x0F
104 #define kAnti			0x10
105 #define kName			0x11
106 #define kCTime			0x12
107 #define kATime			0x13
108 #define kMTime			0x14
109 #define kAttributes		0x15
110 #define kEncodedHeader		0x17
111 #define kDummy			0x19
112 
113 struct _7z_digests {
114 	unsigned char	*defineds;
115 	uint32_t	*digests;
116 };
117 
118 
119 struct _7z_folder {
120 	uint64_t		 numCoders;
121 	struct _7z_coder {
122 		unsigned long	 codec;
123 		uint64_t	 numInStreams;
124 		uint64_t	 numOutStreams;
125 		uint64_t	 propertiesSize;
126 		unsigned char	*properties;
127 	} *coders;
128 	uint64_t		 numBindPairs;
129 	struct {
130 		uint64_t	 inIndex;
131 		uint64_t	 outIndex;
132 	} *bindPairs;
133 	uint64_t		 numPackedStreams;
134 	uint64_t		*packedStreams;
135 	uint64_t		 numInStreams;
136 	uint64_t		 numOutStreams;
137 	uint64_t		*unPackSize;
138 	unsigned char		 digest_defined;
139 	uint32_t		 digest;
140 	uint64_t		 numUnpackStreams;
141 	uint32_t		 packIndex;
142 	/* Unoperated bytes. */
143 	uint64_t		 skipped_bytes;
144 };
145 
146 struct _7z_coders_info {
147 	uint64_t		 numFolders;
148 	struct _7z_folder	*folders;
149 	uint64_t		 dataStreamIndex;
150 };
151 
152 struct _7z_pack_info {
153 	uint64_t		 pos;
154 	uint64_t		 numPackStreams;
155 	uint64_t		*sizes;
156 	struct _7z_digests	 digest;
157 	/* Calculated from pos and numPackStreams. */
158 	uint64_t		*positions;
159 };
160 
161 struct _7z_substream_info {
162 	size_t			 unpack_streams;
163 	uint64_t		*unpackSizes;
164 	unsigned char		*digestsDefined;
165 	uint32_t		*digests;
166 };
167 
168 struct _7z_stream_info {
169 	struct _7z_pack_info	 pi;
170 	struct _7z_coders_info	 ci;
171 	struct _7z_substream_info ss;
172 };
173 
174 struct _7z_header_info {
175 	uint64_t		 dataIndex;
176 
177 	unsigned char		*emptyStreamBools;
178 	unsigned char		*emptyFileBools;
179 	unsigned char		*antiBools;
180 	unsigned char		*attrBools;
181 };
182 
183 struct _7zip_entry {
184 	size_t			 name_len;
185 	unsigned char		*utf16name;
186 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
187 	const wchar_t		*wname;
188 #endif
189 	uint32_t		 folderIndex;
190 	uint32_t		 ssIndex;
191 	unsigned		 flg;
192 #define MTIME_IS_SET	(1<<0)
193 #define ATIME_IS_SET	(1<<1)
194 #define CTIME_IS_SET	(1<<2)
195 #define CRC32_IS_SET	(1<<3)
196 #define HAS_STREAM	(1<<4)
197 
198 	time_t			 mtime;
199 	time_t			 atime;
200 	time_t			 ctime;
201 	long			 mtime_ns;
202 	long			 atime_ns;
203 	long			 ctime_ns;
204 	uint32_t		 mode;
205 	uint32_t		 attr;
206 };
207 
208 struct _7zip {
209 	/* Structural information about the archive. */
210 	struct _7z_stream_info	 si;
211 
212 	int			 header_is_being_read;
213 	int			 header_is_encoded;
214 	uint64_t		 header_bytes_remaining;
215 	unsigned long		 header_crc32;
216 	/* Header offset to check that reading points of the file contents
217 	 * will not exceed the header. */
218 	uint64_t		 header_offset;
219 	/* Base offset of the archive file for a seek in case reading SFX. */
220 	uint64_t		 seek_base;
221 
222 	/* List of entries */
223 	size_t			 entries_remaining;
224 	uint64_t		 numFiles;
225 	struct _7zip_entry	*entries;
226 	struct _7zip_entry	*entry;
227 	unsigned char		*entry_names;
228 
229 	/* entry_bytes_remaining is the number of bytes we expect. */
230 	int64_t			 entry_offset;
231 	uint64_t		 entry_bytes_remaining;
232 
233 	/* Running CRC32 of the decompressed data */
234 	unsigned long		 entry_crc32;
235 
236 	/* Flags to mark progress of decompression. */
237 	char			 end_of_entry;
238 
239 	/* Uncompressed buffer control.  */
240 #define UBUFF_SIZE	(64 * 1024)
241 	unsigned char 		*uncompressed_buffer;
242 	unsigned char 		*uncompressed_buffer_pointer;
243 	size_t 			 uncompressed_buffer_size;
244 	size_t			 uncompressed_buffer_bytes_remaining;
245 
246 	/* Offset of the compressed data. */
247 	int64_t			 stream_offset;
248 
249 	/*
250 	 * Decompressing control data.
251 	 */
252 	unsigned		 folder_index;
253 	uint64_t		 folder_outbytes_remaining;
254 	unsigned		 pack_stream_index;
255 	unsigned		 pack_stream_remaining;
256 	uint64_t		 pack_stream_inbytes_remaining;
257 	size_t			 pack_stream_bytes_unconsumed;
258 
259 	/* The codec information of a folder. */
260 	unsigned long		 codec;
261 	unsigned long		 codec2;
262 
263 	/*
264 	 * Decompressor controllers.
265 	 */
266 	/* Decoding LZMA1 and LZMA2 data. */
267 #ifdef HAVE_LZMA_H
268 	lzma_stream		 lzstream;
269 	int			 lzstream_valid;
270 #endif
271 	/* Decoding bzip2 data. */
272 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
273 	bz_stream		 bzstream;
274 	int			 bzstream_valid;
275 #endif
276 	/* Decoding deflate data. */
277 #ifdef HAVE_ZLIB_H
278 	z_stream		 stream;
279 	int			 stream_valid;
280 #endif
281 	/* Decoding PPMd data. */
282 	int			 ppmd7_stat;
283 	CPpmd7			 ppmd7_context;
284 	CPpmd7z_RangeDec	 range_dec;
285 	IByteIn			 bytein;
286 	struct {
287 		const unsigned char	*next_in;
288 		int64_t			 avail_in;
289 		int64_t			 total_in;
290 		int64_t			 stream_in;
291 		unsigned char		*next_out;
292 		int64_t			 avail_out;
293 		int64_t			 total_out;
294 		int			 overconsumed;
295 	} ppstream;
296 	int			 ppmd7_valid;
297 
298 	/* Decoding BCJ and BCJ2 data. */
299 	uint32_t		 bcj_state;
300 	size_t			 odd_bcj_size;
301 	unsigned char		 odd_bcj[4];
302 	/* Decoding BCJ data. */
303 	size_t			 bcj_prevPosT;
304 	uint32_t		 bcj_prevMask;
305 	uint32_t		 bcj_ip;
306 
307 	/* Decoding BCJ2 data. */
308 	size_t			 main_stream_bytes_remaining;
309 	unsigned char		*sub_stream_buff[3];
310 	size_t			 sub_stream_size[3];
311 	size_t			 sub_stream_bytes_remaining[3];
312 	unsigned char		*tmp_stream_buff;
313 	size_t			 tmp_stream_buff_size;
314 	size_t			 tmp_stream_bytes_avail;
315 	size_t			 tmp_stream_bytes_remaining;
316 #ifdef _LZMA_PROB32
317 #define CProb uint32_t
318 #else
319 #define CProb uint16_t
320 #endif
321 	CProb			 bcj2_p[256 + 2];
322 	uint8_t			 bcj2_prevByte;
323 	uint32_t		 bcj2_range;
324 	uint32_t		 bcj2_code;
325 	uint64_t		 bcj2_outPos;
326 
327 	/* Filename character-set conversion data. */
328 	struct archive_string_conv *sconv;
329 
330 	char			 format_name[64];
331 
332 	/* Custom value that is non-zero if this archive contains encrypted entries. */
333 	int			 has_encrypted_entries;
334 };
335 
336 /* Maximum entry size. This limitation prevents reading intentional
337  * corrupted 7-zip files on assuming there are not so many entries in
338  * the files. */
339 #define UMAX_ENTRY	ARCHIVE_LITERAL_ULL(100000000)
340 
341 static int	archive_read_format_7zip_has_encrypted_entries(struct archive_read *);
342 static int	archive_read_support_format_7zip_capabilities(struct archive_read *a);
343 static int	archive_read_format_7zip_bid(struct archive_read *, int);
344 static int	archive_read_format_7zip_cleanup(struct archive_read *);
345 static int	archive_read_format_7zip_read_data(struct archive_read *,
346 		    const void **, size_t *, int64_t *);
347 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
348 static int	archive_read_format_7zip_read_header(struct archive_read *,
349 		    struct archive_entry *);
350 static int	check_7zip_header_in_sfx(const char *);
351 static unsigned long decode_codec_id(const unsigned char *, size_t);
352 static int	decode_encoded_header_info(struct archive_read *,
353 		    struct _7z_stream_info *);
354 static int	decompress(struct archive_read *, struct _7zip *,
355 		    void *, size_t *, const void *, size_t *);
356 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
357 static void	fileTimeToUtc(uint64_t, time_t *, long *);
358 static uint64_t folder_uncompressed_size(struct _7z_folder *);
359 static void	free_CodersInfo(struct _7z_coders_info *);
360 static void	free_Digest(struct _7z_digests *);
361 static void	free_Folder(struct _7z_folder *);
362 static void	free_Header(struct _7z_header_info *);
363 static void	free_PackInfo(struct _7z_pack_info *);
364 static void	free_StreamsInfo(struct _7z_stream_info *);
365 static void	free_SubStreamsInfo(struct _7z_substream_info *);
366 static int	free_decompression(struct archive_read *, struct _7zip *);
367 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
368 		    size_t, size_t);
369 static const unsigned char * header_bytes(struct archive_read *, size_t);
370 static int	init_decompression(struct archive_read *, struct _7zip *,
371 		    const struct _7z_coder *, const struct _7z_coder *);
372 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
373 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
374 static int	read_CodersInfo(struct archive_read *,
375 		    struct _7z_coders_info *);
376 static int	read_Digests(struct archive_read *, struct _7z_digests *,
377 		    size_t);
378 static int	read_Folder(struct archive_read *, struct _7z_folder *);
379 static int	read_Header(struct archive_read *, struct _7z_header_info *,
380 		    int);
381 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
382 static int	read_StreamsInfo(struct archive_read *,
383 		    struct _7z_stream_info *);
384 static int	read_SubStreamsInfo(struct archive_read *,
385 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
386 static int	read_Times(struct archive_read *, struct _7z_header_info *,
387 		    int);
388 static void	read_consume(struct archive_read *);
389 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
390 		    size_t);
391 static int	seek_pack(struct archive_read *);
392 static int64_t	skip_stream(struct archive_read *, size_t);
393 static int	skip_sfx(struct archive_read *, ssize_t);
394 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
395 		    struct _7z_header_info *);
396 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
397 		    int);
398 static void	x86_Init(struct _7zip *);
399 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
400 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
401 
402 
403 int
404 archive_read_support_format_7zip(struct archive *_a)
405 {
406 	struct archive_read *a = (struct archive_read *)_a;
407 	struct _7zip *zip;
408 	int r;
409 
410 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
411 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
412 
413 	zip = calloc(1, sizeof(*zip));
414 	if (zip == NULL) {
415 		archive_set_error(&a->archive, ENOMEM,
416 		    "Can't allocate 7zip data");
417 		return (ARCHIVE_FATAL);
418 	}
419 
420 	/*
421 	 * Until enough data has been read, we cannot tell about
422 	 * any encrypted entries yet.
423 	 */
424 	zip->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
425 
426 
427 	r = __archive_read_register_format(a,
428 	    zip,
429 	    "7zip",
430 	    archive_read_format_7zip_bid,
431 	    NULL,
432 	    archive_read_format_7zip_read_header,
433 	    archive_read_format_7zip_read_data,
434 	    archive_read_format_7zip_read_data_skip,
435 	    NULL,
436 	    archive_read_format_7zip_cleanup,
437 	    archive_read_support_format_7zip_capabilities,
438 	    archive_read_format_7zip_has_encrypted_entries);
439 
440 	if (r != ARCHIVE_OK)
441 		free(zip);
442 	return (ARCHIVE_OK);
443 }
444 
445 static int
446 archive_read_support_format_7zip_capabilities(struct archive_read * a)
447 {
448 	(void)a; /* UNUSED */
449 	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA |
450 			ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
451 }
452 
453 
454 static int
455 archive_read_format_7zip_has_encrypted_entries(struct archive_read *_a)
456 {
457 	if (_a && _a->format) {
458 		struct _7zip * zip = (struct _7zip *)_a->format->data;
459 		if (zip) {
460 			return zip->has_encrypted_entries;
461 		}
462 	}
463 	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
464 }
465 
466 static int
467 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
468 {
469 	const char *p;
470 
471 	/* If someone has already bid more than 32, then avoid
472 	   trashing the look-ahead buffers with a seek. */
473 	if (best_bid > 32)
474 		return (-1);
475 
476 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
477 		return (0);
478 
479 	/* If first six bytes are the 7-Zip signature,
480 	 * return the bid right now. */
481 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
482 		return (48);
483 
484 	/*
485 	 * It may a 7-Zip SFX archive file. If first two bytes are
486 	 * 'M' and 'Z' available on Windows or first four bytes are
487 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
488 	 * signature. Although we will perform a seek when reading
489 	 * a header, what we do not use __archive_read_seek() here is
490 	 * due to a bidding performance.
491 	 */
492 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
493 		ssize_t offset = SFX_MIN_ADDR;
494 		ssize_t window = 4096;
495 		ssize_t bytes_avail;
496 		while (offset + window <= (SFX_MAX_ADDR)) {
497 			const char *buff = __archive_read_ahead(a,
498 					offset + window, &bytes_avail);
499 			if (buff == NULL) {
500 				/* Remaining bytes are less than window. */
501 				window >>= 1;
502 				if (window < 0x40)
503 					return (0);
504 				continue;
505 			}
506 			p = buff + offset;
507 			while (p + 32 < buff + bytes_avail) {
508 				int step = check_7zip_header_in_sfx(p);
509 				if (step == 0)
510 					return (48);
511 				p += step;
512 			}
513 			offset = p - buff;
514 		}
515 	}
516 	return (0);
517 }
518 
519 static int
520 check_7zip_header_in_sfx(const char *p)
521 {
522 	switch ((unsigned char)p[5]) {
523 	case 0x1C:
524 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
525 			return (6);
526 		/*
527 		 * Test the CRC because its extraction code has 7-Zip
528 		 * Magic Code, so we should do this in order not to
529 		 * make a mis-detection.
530 		 */
531 		if (crc32(0, (const unsigned char *)p + 12, 20)
532 			!= archive_le32dec(p + 8))
533 			return (6);
534 		/* Hit the header! */
535 		return (0);
536 	case 0x37: return (5);
537 	case 0x7A: return (4);
538 	case 0xBC: return (3);
539 	case 0xAF: return (2);
540 	case 0x27: return (1);
541 	default: return (6);
542 	}
543 }
544 
545 static int
546 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
547 {
548 	const void *h;
549 	const char *p, *q;
550 	size_t skip, offset;
551 	ssize_t bytes, window;
552 
553 	/*
554 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
555 	 * __archive_read_seek() at this time since we have
556 	 * already had enough data.
557 	 */
558 	if (bytes_avail > SFX_MIN_ADDR)
559 		__archive_read_consume(a, SFX_MIN_ADDR);
560 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
561 		return (ARCHIVE_FATAL);
562 
563 	offset = 0;
564 	window = 1;
565 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
566 		h = __archive_read_ahead(a, window, &bytes);
567 		if (h == NULL) {
568 			/* Remaining bytes are less than window. */
569 			window >>= 1;
570 			if (window < 0x40)
571 				goto fatal;
572 			continue;
573 		}
574 		if (bytes < 6) {
575 			/* This case might happen when window == 1. */
576 			window = 4096;
577 			continue;
578 		}
579 		p = (const char *)h;
580 		q = p + bytes;
581 
582 		/*
583 		 * Scan ahead until we find something that looks
584 		 * like the 7-Zip header.
585 		 */
586 		while (p + 32 < q) {
587 			int step = check_7zip_header_in_sfx(p);
588 			if (step == 0) {
589 				struct _7zip *zip =
590 				    (struct _7zip *)a->format->data;
591 				skip = p - (const char *)h;
592 				__archive_read_consume(a, skip);
593 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
594 				return (ARCHIVE_OK);
595 			}
596 			p += step;
597 		}
598 		skip = p - (const char *)h;
599 		__archive_read_consume(a, skip);
600 		offset += skip;
601 		if (window == 1)
602 			window = 4096;
603 	}
604 fatal:
605 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
606 	    "Couldn't find out 7-Zip header");
607 	return (ARCHIVE_FATAL);
608 }
609 
610 static int
611 archive_read_format_7zip_read_header(struct archive_read *a,
612 	struct archive_entry *entry)
613 {
614 	struct _7zip *zip = (struct _7zip *)a->format->data;
615 	struct _7zip_entry *zip_entry;
616 	int r, ret = ARCHIVE_OK;
617 	struct _7z_folder *folder = 0;
618 	uint64_t fidx = 0;
619 
620 	/*
621 	 * It should be sufficient to call archive_read_next_header() for
622 	 * a reader to determine if an entry is encrypted or not. If the
623 	 * encryption of an entry is only detectable when calling
624 	 * archive_read_data(), so be it. We'll do the same check there
625 	 * as well.
626 	 */
627 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
628 		zip->has_encrypted_entries = 0;
629 	}
630 
631 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
632 	if (a->archive.archive_format_name == NULL)
633 		a->archive.archive_format_name = "7-Zip";
634 
635 	if (zip->entries == NULL) {
636 		struct _7z_header_info header;
637 
638 		memset(&header, 0, sizeof(header));
639 		r = slurp_central_directory(a, zip, &header);
640 		free_Header(&header);
641 		if (r != ARCHIVE_OK)
642 			return (r);
643 		zip->entries_remaining = (size_t)zip->numFiles;
644 		zip->entry = zip->entries;
645 	} else {
646 		++zip->entry;
647 	}
648 	zip_entry = zip->entry;
649 
650 	if (zip->entries_remaining <= 0 || zip_entry == NULL)
651 		return ARCHIVE_EOF;
652 	--zip->entries_remaining;
653 
654 	zip->entry_offset = 0;
655 	zip->end_of_entry = 0;
656 	zip->entry_crc32 = crc32(0, NULL, 0);
657 
658 	/* Setup a string conversion for a filename. */
659 	if (zip->sconv == NULL) {
660 		zip->sconv = archive_string_conversion_from_charset(
661 		    &a->archive, "UTF-16LE", 1);
662 		if (zip->sconv == NULL)
663 			return (ARCHIVE_FATAL);
664 	}
665 
666 	/* Figure out if the entry is encrypted by looking at the folder
667 	   that is associated to the current 7zip entry. If the folder
668 	   has a coder with a _7Z_CRYPTO codec then the folder is encrypted.
669 	   Hence the entry must also be encrypted. */
670 	if (zip_entry && zip_entry->folderIndex < zip->si.ci.numFolders) {
671 		folder = &(zip->si.ci.folders[zip_entry->folderIndex]);
672 		for (fidx=0; folder && fidx<folder->numCoders; fidx++) {
673 			switch(folder->coders[fidx].codec) {
674 				case _7Z_CRYPTO_MAIN_ZIP:
675 				case _7Z_CRYPTO_RAR_29:
676 				case _7Z_CRYPTO_AES_256_SHA_256: {
677 					archive_entry_set_is_data_encrypted(entry, 1);
678 					zip->has_encrypted_entries = 1;
679 					break;
680 				}
681 			}
682 		}
683 	}
684 
685 	/* Now that we've checked for encryption, if there were still no
686 	 * encrypted entries found we can say for sure that there are none.
687 	 */
688 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
689 		zip->has_encrypted_entries = 0;
690 	}
691 
692 	if (archive_entry_copy_pathname_l(entry,
693 	    (const char *)zip_entry->utf16name,
694 	    zip_entry->name_len, zip->sconv) != 0) {
695 		if (errno == ENOMEM) {
696 			archive_set_error(&a->archive, ENOMEM,
697 			    "Can't allocate memory for Pathname");
698 			return (ARCHIVE_FATAL);
699 		}
700 		archive_set_error(&a->archive,
701 		    ARCHIVE_ERRNO_FILE_FORMAT,
702 		    "Pathname cannot be converted "
703 		    "from %s to current locale.",
704 		    archive_string_conversion_charset_name(zip->sconv));
705 		ret = ARCHIVE_WARN;
706 	}
707 
708 	/* Populate some additional entry fields: */
709 	archive_entry_set_mode(entry, zip_entry->mode);
710 	if (zip_entry->flg & MTIME_IS_SET)
711 		archive_entry_set_mtime(entry, zip_entry->mtime,
712 			zip_entry->mtime_ns);
713 	if (zip_entry->flg & CTIME_IS_SET)
714 		archive_entry_set_ctime(entry, zip_entry->ctime,
715 		    zip_entry->ctime_ns);
716 	if (zip_entry->flg & ATIME_IS_SET)
717 		archive_entry_set_atime(entry, zip_entry->atime,
718 		    zip_entry->atime_ns);
719 	if (zip_entry->ssIndex != (uint32_t)-1) {
720 		zip->entry_bytes_remaining =
721 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
722 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
723 	} else {
724 		zip->entry_bytes_remaining = 0;
725 		archive_entry_set_size(entry, 0);
726 	}
727 
728 	/* If there's no body, force read_data() to return EOF immediately. */
729 	if (zip->entry_bytes_remaining < 1)
730 		zip->end_of_entry = 1;
731 
732 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
733 		unsigned char *symname = NULL;
734 		size_t symsize = 0;
735 
736 		/*
737 		 * Symbolic-name is recorded as its contents. We have to
738 		 * read the contents at this time.
739 		 */
740 		while (zip->entry_bytes_remaining > 0) {
741 			const void *buff;
742 			unsigned char *mem;
743 			size_t size;
744 			int64_t offset;
745 
746 			r = archive_read_format_7zip_read_data(a, &buff,
747 				&size, &offset);
748 			if (r < ARCHIVE_WARN) {
749 				free(symname);
750 				return (r);
751 			}
752 			mem = realloc(symname, symsize + size + 1);
753 			if (mem == NULL) {
754 				free(symname);
755 				archive_set_error(&a->archive, ENOMEM,
756 				    "Can't allocate memory for Symname");
757 				return (ARCHIVE_FATAL);
758 			}
759 			symname = mem;
760 			memcpy(symname+symsize, buff, size);
761 			symsize += size;
762 		}
763 		if (symsize == 0) {
764 			/* If there is no symname, handle it as a regular
765 			 * file. */
766 			zip_entry->mode &= ~AE_IFMT;
767 			zip_entry->mode |= AE_IFREG;
768 			archive_entry_set_mode(entry, zip_entry->mode);
769 		} else {
770 			symname[symsize] = '\0';
771 			archive_entry_copy_symlink(entry,
772 			    (const char *)symname);
773 		}
774 		free(symname);
775 		archive_entry_set_size(entry, 0);
776 	}
777 
778 	/* Set up a more descriptive format name. */
779 	sprintf(zip->format_name, "7-Zip");
780 	a->archive.archive_format_name = zip->format_name;
781 
782 	return (ret);
783 }
784 
785 static int
786 archive_read_format_7zip_read_data(struct archive_read *a,
787     const void **buff, size_t *size, int64_t *offset)
788 {
789 	struct _7zip *zip;
790 	ssize_t bytes;
791 	int ret = ARCHIVE_OK;
792 
793 	zip = (struct _7zip *)(a->format->data);
794 
795 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
796 		zip->has_encrypted_entries = 0;
797 	}
798 
799 	if (zip->pack_stream_bytes_unconsumed)
800 		read_consume(a);
801 
802 	*offset = zip->entry_offset;
803 	*size = 0;
804 	*buff = NULL;
805 	/*
806 	 * If we hit end-of-entry last time, clean up and return
807 	 * ARCHIVE_EOF this time.
808 	 */
809 	if (zip->end_of_entry)
810 		return (ARCHIVE_EOF);
811 
812 	const uint64_t max_read_size = 16 * 1024 * 1024;  // Don't try to read more than 16 MB at a time
813 	size_t bytes_to_read = max_read_size;
814 	if ((uint64_t)bytes_to_read > zip->entry_bytes_remaining) {
815 		bytes_to_read = zip->entry_bytes_remaining;
816 	}
817 	bytes = read_stream(a, buff, bytes_to_read, 0);
818 	if (bytes < 0)
819 		return ((int)bytes);
820 	if (bytes == 0) {
821 		archive_set_error(&a->archive,
822 		    ARCHIVE_ERRNO_FILE_FORMAT,
823 		    "Truncated 7-Zip file body");
824 		return (ARCHIVE_FATAL);
825 	}
826 	zip->entry_bytes_remaining -= bytes;
827 	if (zip->entry_bytes_remaining == 0)
828 		zip->end_of_entry = 1;
829 
830 	/* Update checksum */
831 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
832 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff,
833 		    (unsigned)bytes);
834 
835 	/* If we hit the end, swallow any end-of-data marker. */
836 	if (zip->end_of_entry) {
837 		/* Check computed CRC against file contents. */
838 		if ((zip->entry->flg & CRC32_IS_SET) &&
839 			zip->si.ss.digests[zip->entry->ssIndex] !=
840 		    zip->entry_crc32) {
841 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
842 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
843 			    (unsigned long)zip->entry_crc32,
844 			    (unsigned long)zip->si.ss.digests[
845 			    		zip->entry->ssIndex]);
846 			ret = ARCHIVE_WARN;
847 		}
848 	}
849 
850 	*size = bytes;
851 	*offset = zip->entry_offset;
852 	zip->entry_offset += bytes;
853 
854 	return (ret);
855 }
856 
857 static int
858 archive_read_format_7zip_read_data_skip(struct archive_read *a)
859 {
860 	struct _7zip *zip;
861 	int64_t bytes_skipped;
862 
863 	zip = (struct _7zip *)(a->format->data);
864 
865 	if (zip->pack_stream_bytes_unconsumed)
866 		read_consume(a);
867 
868 	/* If we've already read to end of data, we're done. */
869 	if (zip->end_of_entry)
870 		return (ARCHIVE_OK);
871 
872 	/*
873 	 * If the length is at the beginning, we can skip the
874 	 * compressed data much more quickly.
875 	 */
876 	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
877 	if (bytes_skipped < 0)
878 		return (ARCHIVE_FATAL);
879 	zip->entry_bytes_remaining = 0;
880 
881 	/* This entry is finished and done. */
882 	zip->end_of_entry = 1;
883 	return (ARCHIVE_OK);
884 }
885 
886 static int
887 archive_read_format_7zip_cleanup(struct archive_read *a)
888 {
889 	struct _7zip *zip;
890 
891 	zip = (struct _7zip *)(a->format->data);
892 	free_StreamsInfo(&(zip->si));
893 	free(zip->entries);
894 	free(zip->entry_names);
895 	free_decompression(a, zip);
896 	free(zip->uncompressed_buffer);
897 	free(zip->sub_stream_buff[0]);
898 	free(zip->sub_stream_buff[1]);
899 	free(zip->sub_stream_buff[2]);
900 	free(zip->tmp_stream_buff);
901 	free(zip);
902 	(a->format->data) = NULL;
903 	return (ARCHIVE_OK);
904 }
905 
906 static void
907 read_consume(struct archive_read *a)
908 {
909 	struct _7zip *zip = (struct _7zip *)a->format->data;
910 
911 	if (zip->pack_stream_bytes_unconsumed) {
912 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
913 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
914 		zip->pack_stream_bytes_unconsumed = 0;
915 	}
916 }
917 
918 #ifdef HAVE_LZMA_H
919 
920 /*
921  * Set an error code and choose an error message for liblzma.
922  */
923 static void
924 set_error(struct archive_read *a, int ret)
925 {
926 
927 	switch (ret) {
928 	case LZMA_STREAM_END: /* Found end of stream. */
929 	case LZMA_OK: /* Decompressor made some progress. */
930 		break;
931 	case LZMA_MEM_ERROR:
932 		archive_set_error(&a->archive, ENOMEM,
933 		    "Lzma library error: Cannot allocate memory");
934 		break;
935 	case LZMA_MEMLIMIT_ERROR:
936 		archive_set_error(&a->archive, ENOMEM,
937 		    "Lzma library error: Out of memory");
938 		break;
939 	case LZMA_FORMAT_ERROR:
940 		archive_set_error(&a->archive,
941 		    ARCHIVE_ERRNO_MISC,
942 		    "Lzma library error: format not recognized");
943 		break;
944 	case LZMA_OPTIONS_ERROR:
945 		archive_set_error(&a->archive,
946 		    ARCHIVE_ERRNO_MISC,
947 		    "Lzma library error: Invalid options");
948 		break;
949 	case LZMA_DATA_ERROR:
950 		archive_set_error(&a->archive,
951 		    ARCHIVE_ERRNO_MISC,
952 		    "Lzma library error: Corrupted input data");
953 		break;
954 	case LZMA_BUF_ERROR:
955 		archive_set_error(&a->archive,
956 		    ARCHIVE_ERRNO_MISC,
957 		    "Lzma library error:  No progress is possible");
958 		break;
959 	default:
960 		/* Return an error. */
961 		archive_set_error(&a->archive,
962 		    ARCHIVE_ERRNO_MISC,
963 		    "Lzma decompression failed:  Unknown error");
964 		break;
965 	}
966 }
967 
968 #endif
969 
970 static unsigned long
971 decode_codec_id(const unsigned char *codecId, size_t id_size)
972 {
973 	unsigned i;
974 	unsigned long id = 0;
975 
976 	for (i = 0; i < id_size; i++) {
977 		id <<= 8;
978 		id += codecId[i];
979 	}
980 	return (id);
981 }
982 
983 static Byte
984 ppmd_read(void *p)
985 {
986 	struct archive_read *a = ((IByteIn*)p)->a;
987 	struct _7zip *zip = (struct _7zip *)(a->format->data);
988 	Byte b;
989 
990 	if (zip->ppstream.avail_in <= 0) {
991 		/*
992 		 * Ppmd7_DecodeSymbol might require reading multiple bytes
993 		 * and we are on boundary;
994 		 * last resort to read using __archive_read_ahead.
995 		 */
996 		ssize_t bytes_avail = 0;
997 		const uint8_t* data = __archive_read_ahead(a,
998 		    zip->ppstream.stream_in+1, &bytes_avail);
999 		if(bytes_avail < zip->ppstream.stream_in+1) {
1000 			archive_set_error(&a->archive,
1001 			    ARCHIVE_ERRNO_FILE_FORMAT,
1002 			    "Truncated 7z file data");
1003 			zip->ppstream.overconsumed = 1;
1004 			return (0);
1005 		}
1006 		zip->ppstream.next_in++;
1007 		b = data[zip->ppstream.stream_in];
1008 	} else {
1009 		b = *zip->ppstream.next_in++;
1010 	}
1011 	zip->ppstream.avail_in--;
1012 	zip->ppstream.total_in++;
1013 	zip->ppstream.stream_in++;
1014 	return (b);
1015 }
1016 
1017 static int
1018 init_decompression(struct archive_read *a, struct _7zip *zip,
1019     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
1020 {
1021 	int r;
1022 
1023 	zip->codec = coder1->codec;
1024 	zip->codec2 = -1;
1025 
1026 	switch (zip->codec) {
1027 	case _7Z_COPY:
1028 	case _7Z_BZ2:
1029 	case _7Z_DEFLATE:
1030 	case _7Z_PPMD:
1031 		if (coder2 != NULL) {
1032 			if (coder2->codec != _7Z_X86 &&
1033 			    coder2->codec != _7Z_X86_BCJ2) {
1034 				archive_set_error(&a->archive,
1035 				    ARCHIVE_ERRNO_MISC,
1036 				    "Unsupported filter %lx for %lx",
1037 				    coder2->codec, coder1->codec);
1038 				return (ARCHIVE_FAILED);
1039 			}
1040 			zip->codec2 = coder2->codec;
1041 			zip->bcj_state = 0;
1042 			if (coder2->codec == _7Z_X86)
1043 				x86_Init(zip);
1044 		}
1045 		break;
1046 	default:
1047 		break;
1048 	}
1049 
1050 	switch (zip->codec) {
1051 	case _7Z_COPY:
1052 		break;
1053 
1054 	case _7Z_LZMA: case _7Z_LZMA2:
1055 #ifdef HAVE_LZMA_H
1056 #if LZMA_VERSION_MAJOR >= 5
1057 /* Effectively disable the limiter. */
1058 #define LZMA_MEMLIMIT   UINT64_MAX
1059 #else
1060 /* NOTE: This needs to check memory size which running system has. */
1061 #define LZMA_MEMLIMIT   (1U << 30)
1062 #endif
1063 	{
1064 		lzma_options_delta delta_opt;
1065 		lzma_filter filters[LZMA_FILTERS_MAX], *ff;
1066 		int fi = 0;
1067 
1068 		if (zip->lzstream_valid) {
1069 			lzma_end(&(zip->lzstream));
1070 			zip->lzstream_valid = 0;
1071 		}
1072 
1073 		/*
1074 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
1075 		 * data made by 7-Zip because 7-Zip does not add End-Of-
1076 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
1077 		 * and so liblzma cannot know the end of the compressed data
1078 		 * without EOPM. So consequently liblzma will not return last
1079 		 * three or four bytes of uncompressed data because
1080 		 * LZMA_FILTER_X86 filter does not handle input data if its
1081 		 * data size is less than five bytes. If liblzma detect EOPM
1082 		 * or know the uncompressed data size, liblzma will flush out
1083 		 * the remaining that three or four bytes of uncompressed
1084 		 * data. That is why we have to use our converting program
1085 		 * for BCJ+LZMA. If we were able to tell the uncompressed
1086 		 * size to liblzma when using lzma_raw_decoder() liblzma
1087 		 * could correctly deal with BCJ+LZMA. But unfortunately
1088 		 * there is no way to do that.
1089 		 * Discussion about this can be found at XZ Utils forum.
1090 		 */
1091 		if (coder2 != NULL) {
1092 			zip->codec2 = coder2->codec;
1093 
1094 			filters[fi].options = NULL;
1095 			switch (zip->codec2) {
1096 			case _7Z_X86:
1097 				if (zip->codec == _7Z_LZMA2) {
1098 					filters[fi].id = LZMA_FILTER_X86;
1099 					fi++;
1100 				} else
1101 					/* Use our filter. */
1102 					x86_Init(zip);
1103 				break;
1104 			case _7Z_X86_BCJ2:
1105 				/* Use our filter. */
1106 				zip->bcj_state = 0;
1107 				break;
1108 			case _7Z_DELTA:
1109 				if (coder2->propertiesSize != 1) {
1110 					archive_set_error(&a->archive,
1111 					    ARCHIVE_ERRNO_MISC,
1112 					    "Invalid Delta parameter");
1113 					return (ARCHIVE_FAILED);
1114 				}
1115 				filters[fi].id = LZMA_FILTER_DELTA;
1116 				memset(&delta_opt, 0, sizeof(delta_opt));
1117 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1118 				delta_opt.dist =
1119 				    (uint32_t)coder2->properties[0] + 1;
1120 				filters[fi].options = &delta_opt;
1121 				fi++;
1122 				break;
1123 			/* Following filters have not been tested yet. */
1124 			case _7Z_POWERPC:
1125 				filters[fi].id = LZMA_FILTER_POWERPC;
1126 				fi++;
1127 				break;
1128 			case _7Z_IA64:
1129 				filters[fi].id = LZMA_FILTER_IA64;
1130 				fi++;
1131 				break;
1132 			case _7Z_ARM:
1133 				filters[fi].id = LZMA_FILTER_ARM;
1134 				fi++;
1135 				break;
1136 			case _7Z_ARMTHUMB:
1137 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1138 				fi++;
1139 				break;
1140 			case _7Z_SPARC:
1141 				filters[fi].id = LZMA_FILTER_SPARC;
1142 				fi++;
1143 				break;
1144 			default:
1145 				archive_set_error(&a->archive,
1146 				    ARCHIVE_ERRNO_MISC,
1147 				    "Unexpected codec ID: %lX", zip->codec2);
1148 				return (ARCHIVE_FAILED);
1149 			}
1150 		}
1151 
1152 		if (zip->codec == _7Z_LZMA2)
1153 			filters[fi].id = LZMA_FILTER_LZMA2;
1154 		else
1155 			filters[fi].id = LZMA_FILTER_LZMA1;
1156 		filters[fi].options = NULL;
1157 		ff = &filters[fi];
1158 		r = lzma_properties_decode(&filters[fi], NULL,
1159 		    coder1->properties, (size_t)coder1->propertiesSize);
1160 		if (r != LZMA_OK) {
1161 			set_error(a, r);
1162 			return (ARCHIVE_FAILED);
1163 		}
1164 		fi++;
1165 
1166 		filters[fi].id = LZMA_VLI_UNKNOWN;
1167 		filters[fi].options = NULL;
1168 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1169 		free(ff->options);
1170 		if (r != LZMA_OK) {
1171 			set_error(a, r);
1172 			return (ARCHIVE_FAILED);
1173 		}
1174 		zip->lzstream_valid = 1;
1175 		zip->lzstream.total_in = 0;
1176 		zip->lzstream.total_out = 0;
1177 		break;
1178 	}
1179 #else
1180 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1181 		    "LZMA codec is unsupported");
1182 		return (ARCHIVE_FAILED);
1183 #endif
1184 	case _7Z_BZ2:
1185 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1186 		if (zip->bzstream_valid) {
1187 			BZ2_bzDecompressEnd(&(zip->bzstream));
1188 			zip->bzstream_valid = 0;
1189 		}
1190 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1191 		if (r == BZ_MEM_ERROR)
1192 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1193 		if (r != BZ_OK) {
1194 			int err = ARCHIVE_ERRNO_MISC;
1195 			const char *detail = NULL;
1196 			switch (r) {
1197 			case BZ_PARAM_ERROR:
1198 				detail = "invalid setup parameter";
1199 				break;
1200 			case BZ_MEM_ERROR:
1201 				err = ENOMEM;
1202 				detail = "out of memory";
1203 				break;
1204 			case BZ_CONFIG_ERROR:
1205 				detail = "mis-compiled library";
1206 				break;
1207 			}
1208 			archive_set_error(&a->archive, err,
1209 			    "Internal error initializing decompressor: %s",
1210 			    detail != NULL ? detail : "??");
1211 			zip->bzstream_valid = 0;
1212 			return (ARCHIVE_FAILED);
1213 		}
1214 		zip->bzstream_valid = 1;
1215 		zip->bzstream.total_in_lo32 = 0;
1216 		zip->bzstream.total_in_hi32 = 0;
1217 		zip->bzstream.total_out_lo32 = 0;
1218 		zip->bzstream.total_out_hi32 = 0;
1219 		break;
1220 #else
1221 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1222 		    "BZ2 codec is unsupported");
1223 		return (ARCHIVE_FAILED);
1224 #endif
1225 	case _7Z_DEFLATE:
1226 #ifdef HAVE_ZLIB_H
1227 		if (zip->stream_valid)
1228 			r = inflateReset(&(zip->stream));
1229 		else
1230 			r = inflateInit2(&(zip->stream),
1231 			    -15 /* Don't check for zlib header */);
1232 		if (r != Z_OK) {
1233 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1234 			    "Couldn't initialize zlib stream.");
1235 			return (ARCHIVE_FAILED);
1236 		}
1237 		zip->stream_valid = 1;
1238 		zip->stream.total_in = 0;
1239 		zip->stream.total_out = 0;
1240 		break;
1241 #else
1242 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1243 		    "DEFLATE codec is unsupported");
1244 		return (ARCHIVE_FAILED);
1245 #endif
1246 	case _7Z_PPMD:
1247 	{
1248 		unsigned order;
1249 		uint32_t msize;
1250 
1251 		if (zip->ppmd7_valid) {
1252 			__archive_ppmd7_functions.Ppmd7_Free(
1253 			    &zip->ppmd7_context);
1254 			zip->ppmd7_valid = 0;
1255 		}
1256 
1257 		if (coder1->propertiesSize < 5) {
1258 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1259 			    "Malformed PPMd parameter");
1260 			return (ARCHIVE_FAILED);
1261 		}
1262 		order = coder1->properties[0];
1263 		msize = archive_le32dec(&(coder1->properties[1]));
1264 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1265 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1266 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1267 			    "Malformed PPMd parameter");
1268 			return (ARCHIVE_FAILED);
1269 		}
1270 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1271 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1272 			&zip->ppmd7_context, msize);
1273 		if (r == 0) {
1274 			archive_set_error(&a->archive, ENOMEM,
1275 			    "Coludn't allocate memory for PPMd");
1276 			return (ARCHIVE_FATAL);
1277 		}
1278 		__archive_ppmd7_functions.Ppmd7_Init(
1279 			&zip->ppmd7_context, order);
1280 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1281 			&zip->range_dec);
1282 		zip->ppmd7_valid = 1;
1283 		zip->ppmd7_stat = 0;
1284 		zip->ppstream.overconsumed = 0;
1285 		zip->ppstream.total_in = 0;
1286 		zip->ppstream.total_out = 0;
1287 		break;
1288 	}
1289 	case _7Z_X86:
1290 	case _7Z_X86_BCJ2:
1291 	case _7Z_POWERPC:
1292 	case _7Z_IA64:
1293 	case _7Z_ARM:
1294 	case _7Z_ARMTHUMB:
1295 	case _7Z_SPARC:
1296 	case _7Z_DELTA:
1297 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1298 		    "Unexpected codec ID: %lX", zip->codec);
1299 		return (ARCHIVE_FAILED);
1300 	case _7Z_CRYPTO_MAIN_ZIP:
1301 	case _7Z_CRYPTO_RAR_29:
1302 	case _7Z_CRYPTO_AES_256_SHA_256:
1303 		if (a->entry) {
1304 			archive_entry_set_is_metadata_encrypted(a->entry, 1);
1305 			archive_entry_set_is_data_encrypted(a->entry, 1);
1306 			zip->has_encrypted_entries = 1;
1307 		}
1308 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1309 		    "Crypto codec not supported yet (ID: 0x%lX)", zip->codec);
1310 		return (ARCHIVE_FAILED);
1311 	default:
1312 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1313 		    "Unknown codec ID: %lX", zip->codec);
1314 		return (ARCHIVE_FAILED);
1315 	}
1316 
1317 	return (ARCHIVE_OK);
1318 }
1319 
1320 static int
1321 decompress(struct archive_read *a, struct _7zip *zip,
1322     void *buff, size_t *outbytes, const void *b, size_t *used)
1323 {
1324 	const uint8_t *t_next_in;
1325 	uint8_t *t_next_out;
1326 	size_t o_avail_in, o_avail_out;
1327 	size_t t_avail_in, t_avail_out;
1328 	uint8_t *bcj2_next_out;
1329 	size_t bcj2_avail_out;
1330 	int r, ret = ARCHIVE_OK;
1331 
1332 	t_avail_in = o_avail_in = *used;
1333 	t_avail_out = o_avail_out = *outbytes;
1334 	t_next_in = b;
1335 	t_next_out = buff;
1336 
1337 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1338 		int i;
1339 
1340 		/* Do not copy out the BCJ remaining bytes when the output
1341 		 * buffer size is less than five bytes. */
1342 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1343 			*used = 0;
1344 			*outbytes = 0;
1345 			return (ret);
1346 		}
1347 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1348 			*t_next_out++ = zip->odd_bcj[i];
1349 			t_avail_out--;
1350 			zip->odd_bcj_size--;
1351 		}
1352 		if (o_avail_in == 0 || t_avail_out == 0) {
1353 			*used = o_avail_in - t_avail_in;
1354 			*outbytes = o_avail_out - t_avail_out;
1355 			if (o_avail_in == 0)
1356 				ret = ARCHIVE_EOF;
1357 			return (ret);
1358 		}
1359 	}
1360 
1361 	bcj2_next_out = t_next_out;
1362 	bcj2_avail_out = t_avail_out;
1363 	if (zip->codec2 == _7Z_X86_BCJ2) {
1364 		/*
1365 		 * Decord a remaining decompressed main stream for BCJ2.
1366 		 */
1367 		if (zip->tmp_stream_bytes_remaining) {
1368 			ssize_t bytes;
1369 			size_t remaining = zip->tmp_stream_bytes_remaining;
1370 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1371 			if (bytes < 0) {
1372 				archive_set_error(&(a->archive),
1373 				    ARCHIVE_ERRNO_MISC,
1374 				    "BCJ2 conversion Failed");
1375 				return (ARCHIVE_FAILED);
1376 			}
1377 			zip->main_stream_bytes_remaining -=
1378 			    remaining - zip->tmp_stream_bytes_remaining;
1379 			t_avail_out -= bytes;
1380 			if (o_avail_in == 0 || t_avail_out == 0) {
1381 				*used = 0;
1382 				*outbytes = o_avail_out - t_avail_out;
1383 				if (o_avail_in == 0 &&
1384 				    zip->tmp_stream_bytes_remaining)
1385 					ret = ARCHIVE_EOF;
1386 				return (ret);
1387 			}
1388 			t_next_out += bytes;
1389 			bcj2_next_out = t_next_out;
1390 			bcj2_avail_out = t_avail_out;
1391 		}
1392 		t_next_out = zip->tmp_stream_buff;
1393 		t_avail_out = zip->tmp_stream_buff_size;
1394 	}
1395 
1396 	switch (zip->codec) {
1397 	case _7Z_COPY:
1398 	{
1399 		size_t bytes =
1400 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1401 
1402 		memcpy(t_next_out, t_next_in, bytes);
1403 		t_avail_in -= bytes;
1404 		t_avail_out -= bytes;
1405 		if (o_avail_in == 0)
1406 			ret = ARCHIVE_EOF;
1407 		break;
1408 	}
1409 #ifdef HAVE_LZMA_H
1410 	case _7Z_LZMA: case _7Z_LZMA2:
1411 		zip->lzstream.next_in = t_next_in;
1412 		zip->lzstream.avail_in = t_avail_in;
1413 		zip->lzstream.next_out = t_next_out;
1414 		zip->lzstream.avail_out = t_avail_out;
1415 
1416 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1417 		switch (r) {
1418 		case LZMA_STREAM_END: /* Found end of stream. */
1419 			lzma_end(&(zip->lzstream));
1420 			zip->lzstream_valid = 0;
1421 			ret = ARCHIVE_EOF;
1422 			break;
1423 		case LZMA_OK: /* Decompressor made some progress. */
1424 			break;
1425 		default:
1426 			archive_set_error(&(a->archive),
1427 			    ARCHIVE_ERRNO_MISC,
1428 				"Decompression failed(%d)",
1429 			    r);
1430 			return (ARCHIVE_FAILED);
1431 		}
1432 		t_avail_in = zip->lzstream.avail_in;
1433 		t_avail_out = zip->lzstream.avail_out;
1434 		break;
1435 #endif
1436 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1437 	case _7Z_BZ2:
1438 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1439 		zip->bzstream.avail_in = t_avail_in;
1440 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1441 		zip->bzstream.avail_out = t_avail_out;
1442 		r = BZ2_bzDecompress(&(zip->bzstream));
1443 		switch (r) {
1444 		case BZ_STREAM_END: /* Found end of stream. */
1445 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1446 			case BZ_OK:
1447 				break;
1448 			default:
1449 				archive_set_error(&(a->archive),
1450 				    ARCHIVE_ERRNO_MISC,
1451 				    "Failed to clean up decompressor");
1452 				return (ARCHIVE_FAILED);
1453 			}
1454 			zip->bzstream_valid = 0;
1455 			ret = ARCHIVE_EOF;
1456 			break;
1457 		case BZ_OK: /* Decompressor made some progress. */
1458 			break;
1459 		default:
1460 			archive_set_error(&(a->archive),
1461 			    ARCHIVE_ERRNO_MISC,
1462 			    "bzip decompression failed");
1463 			return (ARCHIVE_FAILED);
1464 		}
1465 		t_avail_in = zip->bzstream.avail_in;
1466 		t_avail_out = zip->bzstream.avail_out;
1467 		break;
1468 #endif
1469 #ifdef HAVE_ZLIB_H
1470 	case _7Z_DEFLATE:
1471 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1472 		zip->stream.avail_in = (uInt)t_avail_in;
1473 		zip->stream.next_out = t_next_out;
1474 		zip->stream.avail_out = (uInt)t_avail_out;
1475 		r = inflate(&(zip->stream), 0);
1476 		switch (r) {
1477 		case Z_STREAM_END: /* Found end of stream. */
1478 			ret = ARCHIVE_EOF;
1479 			break;
1480 		case Z_OK: /* Decompressor made some progress.*/
1481 			break;
1482 		default:
1483 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1484 			    "File decompression failed (%d)", r);
1485 			return (ARCHIVE_FAILED);
1486 		}
1487 		t_avail_in = zip->stream.avail_in;
1488 		t_avail_out = zip->stream.avail_out;
1489 		break;
1490 #endif
1491 	case _7Z_PPMD:
1492 	{
1493 		uint64_t flush_bytes;
1494 
1495 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1496 		    t_avail_out <= 0) {
1497 			archive_set_error(&(a->archive),
1498 			    ARCHIVE_ERRNO_MISC,
1499 			    "Decompression internal error");
1500 			return (ARCHIVE_FAILED);
1501 		}
1502 		zip->ppstream.next_in = t_next_in;
1503 		zip->ppstream.avail_in = t_avail_in;
1504 		zip->ppstream.stream_in = 0;
1505 		zip->ppstream.next_out = t_next_out;
1506 		zip->ppstream.avail_out = t_avail_out;
1507 		if (zip->ppmd7_stat == 0) {
1508 			zip->bytein.a = a;
1509 			zip->bytein.Read = &ppmd_read;
1510 			zip->range_dec.Stream = &zip->bytein;
1511 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1512 				&(zip->range_dec));
1513 			if (r == 0) {
1514 				zip->ppmd7_stat = -1;
1515 				archive_set_error(&a->archive,
1516 				    ARCHIVE_ERRNO_MISC,
1517 				    "Failed to initialize PPMd range decoder");
1518 				return (ARCHIVE_FAILED);
1519 			}
1520 			if (zip->ppstream.overconsumed) {
1521 				zip->ppmd7_stat = -1;
1522 				return (ARCHIVE_FAILED);
1523 			}
1524 			zip->ppmd7_stat = 1;
1525 		}
1526 
1527 		if (t_avail_in == 0)
1528 			/* XXX Flush out remaining decoded data XXX */
1529 			flush_bytes = zip->folder_outbytes_remaining;
1530 		else
1531 			flush_bytes = 0;
1532 
1533 		do {
1534 			int sym;
1535 
1536 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1537 				&(zip->ppmd7_context), &(zip->range_dec.p));
1538 			if (sym < 0) {
1539 				zip->ppmd7_stat = -1;
1540 				archive_set_error(&a->archive,
1541 				    ARCHIVE_ERRNO_FILE_FORMAT,
1542 				    "Failed to decode PPMd");
1543 				return (ARCHIVE_FAILED);
1544 			}
1545 			if (zip->ppstream.overconsumed) {
1546 				zip->ppmd7_stat = -1;
1547 				return (ARCHIVE_FAILED);
1548 			}
1549 			*zip->ppstream.next_out++ = (unsigned char)sym;
1550 			zip->ppstream.avail_out--;
1551 			zip->ppstream.total_out++;
1552 			if (flush_bytes)
1553 				flush_bytes--;
1554 		} while (zip->ppstream.avail_out &&
1555 			(zip->ppstream.avail_in || flush_bytes));
1556 
1557 		t_avail_in = (size_t)zip->ppstream.avail_in;
1558 		t_avail_out = (size_t)zip->ppstream.avail_out;
1559 		break;
1560 	}
1561 	default:
1562 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1563 		    "Decompression internal error");
1564 		return (ARCHIVE_FAILED);
1565 	}
1566 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1567 		return (ret);
1568 
1569 	*used = o_avail_in - t_avail_in;
1570 	*outbytes = o_avail_out - t_avail_out;
1571 
1572 	/*
1573 	 * Decord BCJ.
1574 	 */
1575 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1576 		size_t l = x86_Convert(zip, buff, *outbytes);
1577 		zip->odd_bcj_size = *outbytes - l;
1578 		if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1579 		    o_avail_in && ret != ARCHIVE_EOF) {
1580 			memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1581 			    zip->odd_bcj_size);
1582 			*outbytes = l;
1583 		} else
1584 			zip->odd_bcj_size = 0;
1585 	}
1586 
1587 	/*
1588 	 * Decord BCJ2 with a decompressed main stream.
1589 	 */
1590 	if (zip->codec2 == _7Z_X86_BCJ2) {
1591 		ssize_t bytes;
1592 
1593 		zip->tmp_stream_bytes_avail =
1594 		    zip->tmp_stream_buff_size - t_avail_out;
1595 		if (zip->tmp_stream_bytes_avail >
1596 		      zip->main_stream_bytes_remaining)
1597 			zip->tmp_stream_bytes_avail =
1598 			    zip->main_stream_bytes_remaining;
1599 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1600 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1601 		if (bytes < 0) {
1602 			archive_set_error(&(a->archive),
1603 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1604 			return (ARCHIVE_FAILED);
1605 		}
1606 		zip->main_stream_bytes_remaining -=
1607 		    zip->tmp_stream_bytes_avail
1608 		      - zip->tmp_stream_bytes_remaining;
1609 		bcj2_avail_out -= bytes;
1610 		*outbytes = o_avail_out - bcj2_avail_out;
1611 	}
1612 
1613 	return (ret);
1614 }
1615 
1616 static int
1617 free_decompression(struct archive_read *a, struct _7zip *zip)
1618 {
1619 	int r = ARCHIVE_OK;
1620 
1621 #if !defined(HAVE_ZLIB_H) &&\
1622 	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1623 	(void)a;/* UNUSED */
1624 #endif
1625 #ifdef HAVE_LZMA_H
1626 	if (zip->lzstream_valid)
1627 		lzma_end(&(zip->lzstream));
1628 #endif
1629 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1630 	if (zip->bzstream_valid) {
1631 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1632 			archive_set_error(&a->archive,
1633 			    ARCHIVE_ERRNO_MISC,
1634 			    "Failed to clean up bzip2 decompressor");
1635 			r = ARCHIVE_FATAL;
1636 		}
1637 		zip->bzstream_valid = 0;
1638 	}
1639 #endif
1640 #ifdef HAVE_ZLIB_H
1641 	if (zip->stream_valid) {
1642 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1643 			archive_set_error(&a->archive,
1644 			    ARCHIVE_ERRNO_MISC,
1645 			    "Failed to clean up zlib decompressor");
1646 			r = ARCHIVE_FATAL;
1647 		}
1648 		zip->stream_valid = 0;
1649 	}
1650 #endif
1651 	if (zip->ppmd7_valid) {
1652 		__archive_ppmd7_functions.Ppmd7_Free(
1653 			&zip->ppmd7_context);
1654 		zip->ppmd7_valid = 0;
1655 	}
1656 	return (r);
1657 }
1658 
1659 static int
1660 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1661 {
1662 	const unsigned char *p;
1663 	unsigned char avail, mask;
1664 	int i;
1665 
1666 	if ((p = header_bytes(a, 1)) == NULL)
1667 		return (-1);
1668 	avail = *p;
1669 	mask = 0x80;
1670 	*val = 0;
1671 	for (i = 0; i < 8; i++) {
1672 		if (avail & mask) {
1673 			if ((p = header_bytes(a, 1)) == NULL)
1674 				return (-1);
1675 			*val |= ((uint64_t)*p) << (8 * i);
1676 			mask >>= 1;
1677 			continue;
1678 		}
1679 		*val += ((uint64_t)(avail & (mask -1))) << (8 * i);
1680 		break;
1681 	}
1682 	return (0);
1683 }
1684 
1685 static int
1686 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1687 {
1688 	const unsigned char *p;
1689 	unsigned i, mask = 0, avail = 0;
1690 
1691 	for (i = 0; i < num; i++) {
1692 		if (mask == 0) {
1693 			if ((p = header_bytes(a, 1)) == NULL)
1694 				return (-1);
1695 			avail = *p;
1696 			mask = 0x80;
1697 		}
1698 		data[i] = (avail & mask)?1:0;
1699 		mask >>= 1;
1700 	}
1701 	return (0);
1702 }
1703 
1704 static void
1705 free_Digest(struct _7z_digests *d)
1706 {
1707 	free(d->defineds);
1708 	free(d->digests);
1709 }
1710 
1711 static int
1712 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1713 {
1714 	const unsigned char *p;
1715 	unsigned i;
1716 
1717 	if (num == 0)
1718 		return (-1);
1719 	memset(d, 0, sizeof(*d));
1720 
1721 	d->defineds = malloc(num);
1722 	if (d->defineds == NULL)
1723 		return (-1);
1724 	/*
1725 	 * Read Bools.
1726 	 */
1727 	if ((p = header_bytes(a, 1)) == NULL)
1728 		return (-1);
1729 	if (*p == 0) {
1730 		if (read_Bools(a, d->defineds, num) < 0)
1731 			return (-1);
1732 	} else
1733 		/* All are defined */
1734 		memset(d->defineds, 1, num);
1735 
1736 	d->digests = calloc(num, sizeof(*d->digests));
1737 	if (d->digests == NULL)
1738 		return (-1);
1739 	for (i = 0; i < num; i++) {
1740 		if (d->defineds[i]) {
1741 			if ((p = header_bytes(a, 4)) == NULL)
1742 				return (-1);
1743 			d->digests[i] = archive_le32dec(p);
1744 		}
1745 	}
1746 
1747 	return (0);
1748 }
1749 
1750 static void
1751 free_PackInfo(struct _7z_pack_info *pi)
1752 {
1753 	free(pi->sizes);
1754 	free(pi->positions);
1755 	free_Digest(&(pi->digest));
1756 }
1757 
1758 static int
1759 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1760 {
1761 	const unsigned char *p;
1762 	unsigned i;
1763 
1764 	memset(pi, 0, sizeof(*pi));
1765 
1766 	/*
1767 	 * Read PackPos.
1768 	 */
1769 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1770 		return (-1);
1771 
1772 	/*
1773 	 * Read NumPackStreams.
1774 	 */
1775 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1776 		return (-1);
1777 	if (pi->numPackStreams == 0)
1778 		return (-1);
1779 	if (UMAX_ENTRY < pi->numPackStreams)
1780 		return (-1);
1781 
1782 	/*
1783 	 * Read PackSizes[num]
1784 	 */
1785 	if ((p = header_bytes(a, 1)) == NULL)
1786 		return (-1);
1787 	if (*p == kEnd)
1788 		/* PackSizes[num] are not present. */
1789 		return (0);
1790 	if (*p != kSize)
1791 		return (-1);
1792 	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1793 	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1794 	if (pi->sizes == NULL || pi->positions == NULL)
1795 		return (-1);
1796 
1797 	for (i = 0; i < pi->numPackStreams; i++) {
1798 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1799 			return (-1);
1800 	}
1801 
1802 	/*
1803 	 * Read PackStreamDigests[num]
1804 	 */
1805 	if ((p = header_bytes(a, 1)) == NULL)
1806 		return (-1);
1807 	if (*p == kEnd) {
1808 		/* PackStreamDigests[num] are not present. */
1809 		pi->digest.defineds =
1810 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1811 		pi->digest.digests =
1812 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1813 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1814 			return (-1);
1815 		return (0);
1816 	}
1817 
1818 	if (*p != kCRC)
1819 		return (-1);
1820 
1821 	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1822 		return (-1);
1823 
1824 	/*
1825 	 *  Must be marked by kEnd.
1826 	 */
1827 	if ((p = header_bytes(a, 1)) == NULL)
1828 		return (-1);
1829 	if (*p != kEnd)
1830 		return (-1);
1831 	return (0);
1832 }
1833 
1834 static void
1835 free_Folder(struct _7z_folder *f)
1836 {
1837 	unsigned i;
1838 
1839 	if (f->coders) {
1840 		for (i = 0; i< f->numCoders; i++) {
1841 			free(f->coders[i].properties);
1842 		}
1843 		free(f->coders);
1844 	}
1845 	free(f->bindPairs);
1846 	free(f->packedStreams);
1847 	free(f->unPackSize);
1848 }
1849 
1850 static int
1851 read_Folder(struct archive_read *a, struct _7z_folder *f)
1852 {
1853 	struct _7zip *zip = (struct _7zip *)a->format->data;
1854 	const unsigned char *p;
1855 	uint64_t numInStreamsTotal = 0;
1856 	uint64_t numOutStreamsTotal = 0;
1857 	unsigned i;
1858 
1859 	memset(f, 0, sizeof(*f));
1860 
1861 	/*
1862 	 * Read NumCoders.
1863 	 */
1864 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1865 		return (-1);
1866 	if (f->numCoders > 4)
1867 		/* Too many coders. */
1868 		return (-1);
1869 
1870 	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1871 	if (f->coders == NULL)
1872 		return (-1);
1873 	for (i = 0; i< f->numCoders; i++) {
1874 		size_t codec_size;
1875 		int simple, attr;
1876 
1877 		if ((p = header_bytes(a, 1)) == NULL)
1878 			return (-1);
1879 		/*
1880 		 * 0:3 CodecIdSize
1881 		 * 4:  0 - IsSimple
1882 		 *     1 - Is not Simple
1883 		 * 5:  0 - No Attributes
1884 		 *     1 - There are Attributes;
1885 		 * 7:  Must be zero.
1886 		 */
1887 		codec_size = *p & 0xf;
1888 		simple = (*p & 0x10)?0:1;
1889 		attr = *p & 0x20;
1890 		if (*p & 0x80)
1891 			return (-1);/* Not supported. */
1892 
1893 		/*
1894 		 * Read Decompression Method IDs.
1895 		 */
1896 		if ((p = header_bytes(a, codec_size)) == NULL)
1897 			return (-1);
1898 
1899 		f->coders[i].codec = decode_codec_id(p, codec_size);
1900 
1901 		if (simple) {
1902 			f->coders[i].numInStreams = 1;
1903 			f->coders[i].numOutStreams = 1;
1904 		} else {
1905 			if (parse_7zip_uint64(
1906 			    a, &(f->coders[i].numInStreams)) < 0)
1907 				return (-1);
1908 			if (UMAX_ENTRY < f->coders[i].numInStreams)
1909 				return (-1);
1910 			if (parse_7zip_uint64(
1911 			    a, &(f->coders[i].numOutStreams)) < 0)
1912 				return (-1);
1913 			if (UMAX_ENTRY < f->coders[i].numOutStreams)
1914 				return (-1);
1915 		}
1916 
1917 		if (attr) {
1918 			if (parse_7zip_uint64(
1919 			    a, &(f->coders[i].propertiesSize)) < 0)
1920 				return (-1);
1921 			if ((p = header_bytes(
1922 			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
1923 				return (-1);
1924 			f->coders[i].properties =
1925 			    malloc((size_t)f->coders[i].propertiesSize);
1926 			if (f->coders[i].properties == NULL)
1927 				return (-1);
1928 			memcpy(f->coders[i].properties, p,
1929 			    (size_t)f->coders[i].propertiesSize);
1930 		}
1931 
1932 		numInStreamsTotal += f->coders[i].numInStreams;
1933 		numOutStreamsTotal += f->coders[i].numOutStreams;
1934 	}
1935 
1936 	if (numOutStreamsTotal == 0 ||
1937 	    numInStreamsTotal < numOutStreamsTotal-1)
1938 		return (-1);
1939 
1940 	f->numBindPairs = numOutStreamsTotal - 1;
1941 	if (zip->header_bytes_remaining < f->numBindPairs)
1942 			return (-1);
1943 	if (f->numBindPairs > 0) {
1944 		f->bindPairs =
1945 			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
1946 		if (f->bindPairs == NULL)
1947 			return (-1);
1948 	} else
1949 		f->bindPairs = NULL;
1950 	for (i = 0; i < f->numBindPairs; i++) {
1951 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
1952 			return (-1);
1953 		if (UMAX_ENTRY < f->bindPairs[i].inIndex)
1954 			return (-1);
1955 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
1956 			return (-1);
1957 		if (UMAX_ENTRY < f->bindPairs[i].outIndex)
1958 			return (-1);
1959 	}
1960 
1961 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
1962 	f->packedStreams =
1963 	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
1964 	if (f->packedStreams == NULL)
1965 		return (-1);
1966 	if (f->numPackedStreams == 1) {
1967 		for (i = 0; i < numInStreamsTotal; i++) {
1968 			unsigned j;
1969 			for (j = 0; j < f->numBindPairs; j++) {
1970 				if (f->bindPairs[j].inIndex == i)
1971 					break;
1972 			}
1973 			if (j == f->numBindPairs)
1974 				break;
1975 		}
1976 		if (i == numInStreamsTotal)
1977 			return (-1);
1978 		f->packedStreams[0] = i;
1979 	} else {
1980 		for (i = 0; i < f->numPackedStreams; i++) {
1981 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
1982 				return (-1);
1983 			if (UMAX_ENTRY < f->packedStreams[i])
1984 				return (-1);
1985 		}
1986 	}
1987 	f->numInStreams = numInStreamsTotal;
1988 	f->numOutStreams = numOutStreamsTotal;
1989 
1990 	return (0);
1991 }
1992 
1993 static void
1994 free_CodersInfo(struct _7z_coders_info *ci)
1995 {
1996 	unsigned i;
1997 
1998 	if (ci->folders) {
1999 		for (i = 0; i < ci->numFolders; i++)
2000 			free_Folder(&(ci->folders[i]));
2001 		free(ci->folders);
2002 	}
2003 }
2004 
2005 static int
2006 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
2007 {
2008 	const unsigned char *p;
2009 	struct _7z_digests digest;
2010 	unsigned i;
2011 
2012 	memset(ci, 0, sizeof(*ci));
2013 	memset(&digest, 0, sizeof(digest));
2014 
2015 	if ((p = header_bytes(a, 1)) == NULL)
2016 		goto failed;
2017 	if (*p != kFolder)
2018 		goto failed;
2019 
2020 	/*
2021 	 * Read NumFolders.
2022 	 */
2023 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
2024 		goto failed;
2025 	if (UMAX_ENTRY < ci->numFolders)
2026 		return (-1);
2027 
2028 	/*
2029 	 * Read External.
2030 	 */
2031 	if ((p = header_bytes(a, 1)) == NULL)
2032 		goto failed;
2033 	switch (*p) {
2034 	case 0:
2035 		ci->folders =
2036 			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
2037 		if (ci->folders == NULL)
2038 			return (-1);
2039 		for (i = 0; i < ci->numFolders; i++) {
2040 			if (read_Folder(a, &(ci->folders[i])) < 0)
2041 				goto failed;
2042 		}
2043 		break;
2044 	case 1:
2045 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
2046 			return (-1);
2047 		if (UMAX_ENTRY < ci->dataStreamIndex)
2048 			return (-1);
2049 		if (ci->numFolders > 0) {
2050 			archive_set_error(&a->archive, -1,
2051 			    "Malformed 7-Zip archive");
2052 			goto failed;
2053 		}
2054 		break;
2055 	default:
2056 		archive_set_error(&a->archive, -1,
2057 		    "Malformed 7-Zip archive");
2058 		goto failed;
2059 	}
2060 
2061 	if ((p = header_bytes(a, 1)) == NULL)
2062 		goto failed;
2063 	if (*p != kCodersUnPackSize)
2064 		goto failed;
2065 
2066 	for (i = 0; i < ci->numFolders; i++) {
2067 		struct _7z_folder *folder = &(ci->folders[i]);
2068 		unsigned j;
2069 
2070 		folder->unPackSize =
2071 		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
2072 		if (folder->unPackSize == NULL)
2073 			goto failed;
2074 		for (j = 0; j < folder->numOutStreams; j++) {
2075 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
2076 				goto failed;
2077 		}
2078 	}
2079 
2080 	/*
2081 	 * Read CRCs.
2082 	 */
2083 	if ((p = header_bytes(a, 1)) == NULL)
2084 		goto failed;
2085 	if (*p == kEnd)
2086 		return (0);
2087 	if (*p != kCRC)
2088 		goto failed;
2089 	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
2090 		goto failed;
2091 	for (i = 0; i < ci->numFolders; i++) {
2092 		ci->folders[i].digest_defined = digest.defineds[i];
2093 		ci->folders[i].digest = digest.digests[i];
2094 	}
2095 
2096 	/*
2097 	 *  Must be kEnd.
2098 	 */
2099 	if ((p = header_bytes(a, 1)) == NULL)
2100 		goto failed;
2101 	if (*p != kEnd)
2102 		goto failed;
2103 	free_Digest(&digest);
2104 	return (0);
2105 failed:
2106 	free_Digest(&digest);
2107 	return (-1);
2108 }
2109 
2110 static uint64_t
2111 folder_uncompressed_size(struct _7z_folder *f)
2112 {
2113 	int n = (int)f->numOutStreams;
2114 	unsigned pairs = (unsigned)f->numBindPairs;
2115 
2116 	while (--n >= 0) {
2117 		unsigned i;
2118 		for (i = 0; i < pairs; i++) {
2119 			if (f->bindPairs[i].outIndex == (uint64_t)n)
2120 				break;
2121 		}
2122 		if (i >= pairs)
2123 			return (f->unPackSize[n]);
2124 	}
2125 	return (0);
2126 }
2127 
2128 static void
2129 free_SubStreamsInfo(struct _7z_substream_info *ss)
2130 {
2131 	free(ss->unpackSizes);
2132 	free(ss->digestsDefined);
2133 	free(ss->digests);
2134 }
2135 
2136 static int
2137 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2138     struct _7z_folder *f, size_t numFolders)
2139 {
2140 	const unsigned char *p;
2141 	uint64_t *usizes;
2142 	size_t unpack_streams;
2143 	int type;
2144 	unsigned i;
2145 	uint32_t numDigests;
2146 
2147 	memset(ss, 0, sizeof(*ss));
2148 
2149 	for (i = 0; i < numFolders; i++)
2150 		f[i].numUnpackStreams = 1;
2151 
2152 	if ((p = header_bytes(a, 1)) == NULL)
2153 		return (-1);
2154 	type = *p;
2155 
2156 	if (type == kNumUnPackStream) {
2157 		unpack_streams = 0;
2158 		for (i = 0; i < numFolders; i++) {
2159 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2160 				return (-1);
2161 			if (UMAX_ENTRY < f[i].numUnpackStreams)
2162 				return (-1);
2163 			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
2164 				return (-1);
2165 			}
2166 			unpack_streams += (size_t)f[i].numUnpackStreams;
2167 		}
2168 		if ((p = header_bytes(a, 1)) == NULL)
2169 			return (-1);
2170 		type = *p;
2171 	} else
2172 		unpack_streams = numFolders;
2173 
2174 	ss->unpack_streams = unpack_streams;
2175 	if (unpack_streams) {
2176 		ss->unpackSizes = calloc(unpack_streams,
2177 		    sizeof(*ss->unpackSizes));
2178 		ss->digestsDefined = calloc(unpack_streams,
2179 		    sizeof(*ss->digestsDefined));
2180 		ss->digests = calloc(unpack_streams,
2181 		    sizeof(*ss->digests));
2182 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2183 		    ss->digests == NULL)
2184 			return (-1);
2185 	}
2186 
2187 	usizes = ss->unpackSizes;
2188 	for (i = 0; i < numFolders; i++) {
2189 		unsigned pack;
2190 		uint64_t sum;
2191 
2192 		if (f[i].numUnpackStreams == 0)
2193 			continue;
2194 
2195 		sum = 0;
2196 		if (type == kSize) {
2197 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2198 				if (parse_7zip_uint64(a, usizes) < 0)
2199 					return (-1);
2200 				sum += *usizes++;
2201 			}
2202 		}
2203 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2204 	}
2205 
2206 	if (type == kSize) {
2207 		if ((p = header_bytes(a, 1)) == NULL)
2208 			return (-1);
2209 		type = *p;
2210 	}
2211 
2212 	for (i = 0; i < unpack_streams; i++) {
2213 		ss->digestsDefined[i] = 0;
2214 		ss->digests[i] = 0;
2215 	}
2216 
2217 	numDigests = 0;
2218 	for (i = 0; i < numFolders; i++) {
2219 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2220 			numDigests += (uint32_t)f[i].numUnpackStreams;
2221 	}
2222 
2223 	if (type == kCRC) {
2224 		struct _7z_digests tmpDigests;
2225 		unsigned char *digestsDefined = ss->digestsDefined;
2226 		uint32_t * digests = ss->digests;
2227 		int di = 0;
2228 
2229 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2230 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2231 			free_Digest(&tmpDigests);
2232 			return (-1);
2233 		}
2234 		for (i = 0; i < numFolders; i++) {
2235 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2236 				*digestsDefined++ = 1;
2237 				*digests++ = f[i].digest;
2238 			} else {
2239 				unsigned j;
2240 
2241 				for (j = 0; j < f[i].numUnpackStreams;
2242 				    j++, di++) {
2243 					*digestsDefined++ =
2244 					    tmpDigests.defineds[di];
2245 					*digests++ =
2246 					    tmpDigests.digests[di];
2247 				}
2248 			}
2249 		}
2250 		free_Digest(&tmpDigests);
2251 		if ((p = header_bytes(a, 1)) == NULL)
2252 			return (-1);
2253 		type = *p;
2254 	}
2255 
2256 	/*
2257 	 *  Must be kEnd.
2258 	 */
2259 	if (type != kEnd)
2260 		return (-1);
2261 	return (0);
2262 }
2263 
2264 static void
2265 free_StreamsInfo(struct _7z_stream_info *si)
2266 {
2267 	free_PackInfo(&(si->pi));
2268 	free_CodersInfo(&(si->ci));
2269 	free_SubStreamsInfo(&(si->ss));
2270 }
2271 
2272 static int
2273 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2274 {
2275 	struct _7zip *zip = (struct _7zip *)a->format->data;
2276 	const unsigned char *p;
2277 	unsigned i;
2278 
2279 	memset(si, 0, sizeof(*si));
2280 
2281 	if ((p = header_bytes(a, 1)) == NULL)
2282 		return (-1);
2283 	if (*p == kPackInfo) {
2284 		uint64_t packPos;
2285 
2286 		if (read_PackInfo(a, &(si->pi)) < 0)
2287 			return (-1);
2288 
2289 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2290 			return (-1);
2291 		/*
2292 		 * Calculate packed stream positions.
2293 		 */
2294 		packPos = si->pi.pos;
2295 		for (i = 0; i < si->pi.numPackStreams; i++) {
2296 			si->pi.positions[i] = packPos;
2297 			packPos += si->pi.sizes[i];
2298 			if (packPos > zip->header_offset)
2299 				return (-1);
2300 		}
2301 		if ((p = header_bytes(a, 1)) == NULL)
2302 			return (-1);
2303 	}
2304 	if (*p == kUnPackInfo) {
2305 		uint32_t packIndex;
2306 		struct _7z_folder *f;
2307 
2308 		if (read_CodersInfo(a, &(si->ci)) < 0)
2309 			return (-1);
2310 
2311 		/*
2312 		 * Calculate packed stream indexes.
2313 		 */
2314 		packIndex = 0;
2315 		f = si->ci.folders;
2316 		for (i = 0; i < si->ci.numFolders; i++) {
2317 			f[i].packIndex = packIndex;
2318 			packIndex += (uint32_t)f[i].numPackedStreams;
2319 			if (packIndex > si->pi.numPackStreams)
2320 				return (-1);
2321 		}
2322 		if ((p = header_bytes(a, 1)) == NULL)
2323 			return (-1);
2324 	}
2325 
2326 	if (*p == kSubStreamsInfo) {
2327 		if (read_SubStreamsInfo(a, &(si->ss),
2328 		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2329 			return (-1);
2330 		if ((p = header_bytes(a, 1)) == NULL)
2331 			return (-1);
2332 	}
2333 
2334 	/*
2335 	 *  Must be kEnd.
2336 	 */
2337 	if (*p != kEnd)
2338 		return (-1);
2339 	return (0);
2340 }
2341 
2342 static void
2343 free_Header(struct _7z_header_info *h)
2344 {
2345 	free(h->emptyStreamBools);
2346 	free(h->emptyFileBools);
2347 	free(h->antiBools);
2348 	free(h->attrBools);
2349 }
2350 
2351 static int
2352 read_Header(struct archive_read *a, struct _7z_header_info *h,
2353     int check_header_id)
2354 {
2355 	struct _7zip *zip = (struct _7zip *)a->format->data;
2356 	const unsigned char *p;
2357 	struct _7z_folder *folders;
2358 	struct _7z_stream_info *si = &(zip->si);
2359 	struct _7zip_entry *entries;
2360 	uint32_t folderIndex, indexInFolder;
2361 	unsigned i;
2362 	int eindex, empty_streams, sindex;
2363 
2364 	if (check_header_id) {
2365 		/*
2366 		 * Read Header.
2367 		 */
2368 		if ((p = header_bytes(a, 1)) == NULL)
2369 			return (-1);
2370 		if (*p != kHeader)
2371 			return (-1);
2372 	}
2373 
2374 	/*
2375 	 * Read ArchiveProperties.
2376 	 */
2377 	if ((p = header_bytes(a, 1)) == NULL)
2378 		return (-1);
2379 	if (*p == kArchiveProperties) {
2380 		for (;;) {
2381 			uint64_t size;
2382 			if ((p = header_bytes(a, 1)) == NULL)
2383 				return (-1);
2384 			if (*p == 0)
2385 				break;
2386 			if (parse_7zip_uint64(a, &size) < 0)
2387 				return (-1);
2388 		}
2389 		if ((p = header_bytes(a, 1)) == NULL)
2390 			return (-1);
2391 	}
2392 
2393 	/*
2394 	 * Read MainStreamsInfo.
2395 	 */
2396 	if (*p == kMainStreamsInfo) {
2397 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2398 			return (-1);
2399 		if ((p = header_bytes(a, 1)) == NULL)
2400 			return (-1);
2401 	}
2402 	if (*p == kEnd)
2403 		return (0);
2404 
2405 	/*
2406 	 * Read FilesInfo.
2407 	 */
2408 	if (*p != kFilesInfo)
2409 		return (-1);
2410 
2411 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2412 		return (-1);
2413 	if (UMAX_ENTRY < zip->numFiles)
2414 		return (-1);
2415 
2416 	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2417 	if (zip->entries == NULL)
2418 		return (-1);
2419 	entries = zip->entries;
2420 
2421 	empty_streams = 0;
2422 	for (;;) {
2423 		int type;
2424 		uint64_t size;
2425 		size_t ll;
2426 
2427 		if ((p = header_bytes(a, 1)) == NULL)
2428 			return (-1);
2429 		type = *p;
2430 		if (type == kEnd)
2431 			break;
2432 
2433 		if (parse_7zip_uint64(a, &size) < 0)
2434 			return (-1);
2435 		if (zip->header_bytes_remaining < size)
2436 			return (-1);
2437 		ll = (size_t)size;
2438 
2439 		switch (type) {
2440 		case kEmptyStream:
2441 			if (h->emptyStreamBools != NULL)
2442 				return (-1);
2443 			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2444 			    sizeof(*h->emptyStreamBools));
2445 			if (h->emptyStreamBools == NULL)
2446 				return (-1);
2447 			if (read_Bools(
2448 			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2449 				return (-1);
2450 			empty_streams = 0;
2451 			for (i = 0; i < zip->numFiles; i++) {
2452 				if (h->emptyStreamBools[i])
2453 					empty_streams++;
2454 			}
2455 			break;
2456 		case kEmptyFile:
2457 			if (empty_streams <= 0) {
2458 				/* Unexcepted sequence. Skip this. */
2459 				if (header_bytes(a, ll) == NULL)
2460 					return (-1);
2461 				break;
2462 			}
2463 			if (h->emptyFileBools != NULL)
2464 				return (-1);
2465 			h->emptyFileBools = calloc(empty_streams,
2466 			    sizeof(*h->emptyFileBools));
2467 			if (h->emptyFileBools == NULL)
2468 				return (-1);
2469 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2470 				return (-1);
2471 			break;
2472 		case kAnti:
2473 			if (empty_streams <= 0) {
2474 				/* Unexcepted sequence. Skip this. */
2475 				if (header_bytes(a, ll) == NULL)
2476 					return (-1);
2477 				break;
2478 			}
2479 			if (h->antiBools != NULL)
2480 				return (-1);
2481 			h->antiBools = calloc(empty_streams,
2482 			    sizeof(*h->antiBools));
2483 			if (h->antiBools == NULL)
2484 				return (-1);
2485 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2486 				return (-1);
2487 			break;
2488 		case kCTime:
2489 		case kATime:
2490 		case kMTime:
2491 			if (read_Times(a, h, type) < 0)
2492 				return (-1);
2493 			break;
2494 		case kName:
2495 		{
2496 			unsigned char *np;
2497 			size_t nl, nb;
2498 
2499 			/* Skip one byte. */
2500 			if ((p = header_bytes(a, 1)) == NULL)
2501 				return (-1);
2502 			ll--;
2503 
2504 			if ((ll & 1) || ll < zip->numFiles * 4)
2505 				return (-1);
2506 
2507 			if (zip->entry_names != NULL)
2508 				return (-1);
2509 			zip->entry_names = malloc(ll);
2510 			if (zip->entry_names == NULL)
2511 				return (-1);
2512 			np = zip->entry_names;
2513 			nb = ll;
2514 			/*
2515 			 * Copy whole file names.
2516 			 * NOTE: This loop prevents from expanding
2517 			 * the uncompressed buffer in order not to
2518 			 * use extra memory resource.
2519 			 */
2520 			while (nb) {
2521 				size_t b;
2522 				if (nb > UBUFF_SIZE)
2523 					b = UBUFF_SIZE;
2524 				else
2525 					b = nb;
2526 				if ((p = header_bytes(a, b)) == NULL)
2527 					return (-1);
2528 				memcpy(np, p, b);
2529 				np += b;
2530 				nb -= b;
2531 			}
2532 			np = zip->entry_names;
2533 			nl = ll;
2534 
2535 			for (i = 0; i < zip->numFiles; i++) {
2536 				entries[i].utf16name = np;
2537 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2538 				entries[i].wname = (wchar_t *)np;
2539 #endif
2540 
2541 				/* Find a terminator. */
2542 				while (nl >= 2 && (np[0] || np[1])) {
2543 					np += 2;
2544 					nl -= 2;
2545 				}
2546 				if (nl < 2)
2547 					return (-1);/* Terminator not found */
2548 				entries[i].name_len = np - entries[i].utf16name;
2549 				np += 2;
2550 				nl -= 2;
2551 			}
2552 			break;
2553 		}
2554 		case kAttributes:
2555 		{
2556 			int allAreDefined;
2557 
2558 			if ((p = header_bytes(a, 2)) == NULL)
2559 				return (-1);
2560 			allAreDefined = *p;
2561 			if (h->attrBools != NULL)
2562 				return (-1);
2563 			h->attrBools = calloc((size_t)zip->numFiles,
2564 			    sizeof(*h->attrBools));
2565 			if (h->attrBools == NULL)
2566 				return (-1);
2567 			if (allAreDefined)
2568 				memset(h->attrBools, 1, (size_t)zip->numFiles);
2569 			else {
2570 				if (read_Bools(a, h->attrBools,
2571 				      (size_t)zip->numFiles) < 0)
2572 					return (-1);
2573 			}
2574 			for (i = 0; i < zip->numFiles; i++) {
2575 				if (h->attrBools[i]) {
2576 					if ((p = header_bytes(a, 4)) == NULL)
2577 						return (-1);
2578 					entries[i].attr = archive_le32dec(p);
2579 				}
2580 			}
2581 			break;
2582 		}
2583 		case kDummy:
2584 			if (ll == 0)
2585 				break;
2586 			__LA_FALLTHROUGH;
2587 		default:
2588 			if (header_bytes(a, ll) == NULL)
2589 				return (-1);
2590 			break;
2591 		}
2592 	}
2593 
2594 	/*
2595 	 * Set up entry's attributes.
2596 	 */
2597 	folders = si->ci.folders;
2598 	eindex = sindex = 0;
2599 	folderIndex = indexInFolder = 0;
2600 	for (i = 0; i < zip->numFiles; i++) {
2601 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2602 			entries[i].flg |= HAS_STREAM;
2603 		/* The high 16 bits of attributes is a posix file mode. */
2604 		entries[i].mode = entries[i].attr >> 16;
2605 		if (entries[i].flg & HAS_STREAM) {
2606 			if ((size_t)sindex >= si->ss.unpack_streams)
2607 				return (-1);
2608 			if (entries[i].mode == 0)
2609 				entries[i].mode = AE_IFREG | 0666;
2610 			if (si->ss.digestsDefined[sindex])
2611 				entries[i].flg |= CRC32_IS_SET;
2612 			entries[i].ssIndex = sindex;
2613 			sindex++;
2614 		} else {
2615 			int dir;
2616 			if (h->emptyFileBools == NULL)
2617 				dir = 1;
2618 			else {
2619 				if (h->emptyFileBools[eindex])
2620 					dir = 0;
2621 				else
2622 					dir = 1;
2623 				eindex++;
2624 			}
2625 			if (entries[i].mode == 0) {
2626 				if (dir)
2627 					entries[i].mode = AE_IFDIR | 0777;
2628 				else
2629 					entries[i].mode = AE_IFREG | 0666;
2630 			} else if (dir &&
2631 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2632 				entries[i].mode &= ~AE_IFMT;
2633 				entries[i].mode |= AE_IFDIR;
2634 			}
2635 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2636 			    entries[i].name_len >= 2 &&
2637 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2638 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2639 				entries[i].utf16name[entries[i].name_len] = '/';
2640 				entries[i].utf16name[entries[i].name_len+1] = 0;
2641 				entries[i].name_len += 2;
2642 			}
2643 			entries[i].ssIndex = -1;
2644 		}
2645 		if (entries[i].attr & 0x01)
2646 			entries[i].mode &= ~0222;/* Read only. */
2647 
2648 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2649 			/*
2650 			 * The entry is an empty file or a directory file,
2651 			 * those both have no contents.
2652 			 */
2653 			entries[i].folderIndex = -1;
2654 			continue;
2655 		}
2656 		if (indexInFolder == 0) {
2657 			for (;;) {
2658 				if (folderIndex >= si->ci.numFolders)
2659 					return (-1);
2660 				if (folders[folderIndex].numUnpackStreams)
2661 					break;
2662 				folderIndex++;
2663 			}
2664 		}
2665 		entries[i].folderIndex = folderIndex;
2666 		if ((entries[i].flg & HAS_STREAM) == 0)
2667 			continue;
2668 		indexInFolder++;
2669 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2670 			folderIndex++;
2671 			indexInFolder = 0;
2672 		}
2673 	}
2674 
2675 	return (0);
2676 }
2677 
2678 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2679 static void
2680 fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2681 {
2682 
2683 	if (fileTime >= EPOC_TIME) {
2684 		fileTime -= EPOC_TIME;
2685 		/* milli seconds base */
2686 		*timep = (time_t)(fileTime / 10000000);
2687 		/* nano seconds base */
2688 		*ns = (long)(fileTime % 10000000) * 100;
2689 	} else {
2690 		*timep = 0;
2691 		*ns = 0;
2692 	}
2693 }
2694 
2695 static int
2696 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2697 {
2698 	struct _7zip *zip = (struct _7zip *)a->format->data;
2699 	const unsigned char *p;
2700 	struct _7zip_entry *entries = zip->entries;
2701 	unsigned char *timeBools;
2702 	int allAreDefined;
2703 	unsigned i;
2704 
2705 	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2706 	if (timeBools == NULL)
2707 		return (-1);
2708 
2709 	/* Read allAreDefined. */
2710 	if ((p = header_bytes(a, 1)) == NULL)
2711 		goto failed;
2712 	allAreDefined = *p;
2713 	if (allAreDefined)
2714 		memset(timeBools, 1, (size_t)zip->numFiles);
2715 	else {
2716 		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2717 			goto failed;
2718 	}
2719 
2720 	/* Read external. */
2721 	if ((p = header_bytes(a, 1)) == NULL)
2722 		goto failed;
2723 	if (*p) {
2724 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2725 			goto failed;
2726 		if (UMAX_ENTRY < h->dataIndex)
2727 			goto failed;
2728 	}
2729 
2730 	for (i = 0; i < zip->numFiles; i++) {
2731 		if (!timeBools[i])
2732 			continue;
2733 		if ((p = header_bytes(a, 8)) == NULL)
2734 			goto failed;
2735 		switch (type) {
2736 		case kCTime:
2737 			fileTimeToUtc(archive_le64dec(p),
2738 			    &(entries[i].ctime),
2739 			    &(entries[i].ctime_ns));
2740 			entries[i].flg |= CTIME_IS_SET;
2741 			break;
2742 		case kATime:
2743 			fileTimeToUtc(archive_le64dec(p),
2744 			    &(entries[i].atime),
2745 			    &(entries[i].atime_ns));
2746 			entries[i].flg |= ATIME_IS_SET;
2747 			break;
2748 		case kMTime:
2749 			fileTimeToUtc(archive_le64dec(p),
2750 			    &(entries[i].mtime),
2751 			    &(entries[i].mtime_ns));
2752 			entries[i].flg |= MTIME_IS_SET;
2753 			break;
2754 		}
2755 	}
2756 
2757 	free(timeBools);
2758 	return (0);
2759 failed:
2760 	free(timeBools);
2761 	return (-1);
2762 }
2763 
2764 static int
2765 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2766 {
2767 	struct _7zip *zip = (struct _7zip *)a->format->data;
2768 
2769 	errno = 0;
2770 	if (read_StreamsInfo(a, si) < 0) {
2771 		if (errno == ENOMEM)
2772 			archive_set_error(&a->archive, -1,
2773 			    "Couldn't allocate memory");
2774 		else
2775 			archive_set_error(&a->archive, -1,
2776 			    "Malformed 7-Zip archive");
2777 		return (ARCHIVE_FATAL);
2778 	}
2779 
2780 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2781 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2782 		return (ARCHIVE_FATAL);
2783 	}
2784 
2785 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2786 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2787 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2788 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2789 		return (ARCHIVE_FATAL);
2790 	}
2791 
2792 	return (ARCHIVE_OK);
2793 }
2794 
2795 static const unsigned char *
2796 header_bytes(struct archive_read *a, size_t rbytes)
2797 {
2798 	struct _7zip *zip = (struct _7zip *)a->format->data;
2799 	const unsigned char *p;
2800 
2801 	if (zip->header_bytes_remaining < rbytes)
2802 		return (NULL);
2803 	if (zip->pack_stream_bytes_unconsumed)
2804 		read_consume(a);
2805 
2806 	if (zip->header_is_encoded == 0) {
2807 		p = __archive_read_ahead(a, rbytes, NULL);
2808 		if (p == NULL)
2809 			return (NULL);
2810 		zip->header_bytes_remaining -= rbytes;
2811 		zip->pack_stream_bytes_unconsumed = rbytes;
2812 	} else {
2813 		const void *buff;
2814 		ssize_t bytes;
2815 
2816 		bytes = read_stream(a, &buff, rbytes, rbytes);
2817 		if (bytes <= 0)
2818 			return (NULL);
2819 		zip->header_bytes_remaining -= bytes;
2820 		p = buff;
2821 	}
2822 
2823 	/* Update checksum */
2824 	zip->header_crc32 = crc32(zip->header_crc32, p, (unsigned)rbytes);
2825 	return (p);
2826 }
2827 
2828 static int
2829 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2830     struct _7z_header_info *header)
2831 {
2832 	const unsigned char *p;
2833 	uint64_t next_header_offset;
2834 	uint64_t next_header_size;
2835 	uint32_t next_header_crc;
2836 	ssize_t bytes_avail;
2837 	int check_header_crc, r;
2838 
2839 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2840 		return (ARCHIVE_FATAL);
2841 
2842 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2843 		/* This is an executable ? Must be self-extracting... */
2844 		r = skip_sfx(a, bytes_avail);
2845 		if (r < ARCHIVE_WARN)
2846 			return (r);
2847 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2848 			return (ARCHIVE_FATAL);
2849 	}
2850 	zip->seek_base += 32;
2851 
2852 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2853 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2854 		return (ARCHIVE_FATAL);
2855 	}
2856 
2857 	/* CRC check. */
2858 	if (crc32(0, (const unsigned char *)p + 12, 20)
2859 	    != archive_le32dec(p + 8)) {
2860 		archive_set_error(&a->archive, -1, "Header CRC error");
2861 		return (ARCHIVE_FATAL);
2862 	}
2863 
2864 	next_header_offset = archive_le64dec(p + 12);
2865 	next_header_size = archive_le64dec(p + 20);
2866 	next_header_crc = archive_le32dec(p + 28);
2867 
2868 	if (next_header_size == 0)
2869 		/* There is no entry in an archive file. */
2870 		return (ARCHIVE_EOF);
2871 
2872 	if (((int64_t)next_header_offset) < 0) {
2873 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2874 		return (ARCHIVE_FATAL);
2875 	}
2876 	__archive_read_consume(a, 32);
2877 	if (next_header_offset != 0) {
2878 		if (bytes_avail >= (ssize_t)next_header_offset)
2879 			__archive_read_consume(a, next_header_offset);
2880 		else if (__archive_read_seek(a,
2881 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
2882 			return (ARCHIVE_FATAL);
2883 	}
2884 	zip->stream_offset = next_header_offset;
2885 	zip->header_offset = next_header_offset;
2886 	zip->header_bytes_remaining = next_header_size;
2887 	zip->header_crc32 = 0;
2888 	zip->header_is_encoded = 0;
2889 	zip->header_is_being_read = 1;
2890 	zip->has_encrypted_entries = 0;
2891 	check_header_crc = 1;
2892 
2893 	if ((p = header_bytes(a, 1)) == NULL) {
2894 		archive_set_error(&a->archive,
2895 		    ARCHIVE_ERRNO_FILE_FORMAT,
2896 		    "Truncated 7-Zip file body");
2897 		return (ARCHIVE_FATAL);
2898 	}
2899 	/* Parse ArchiveProperties. */
2900 	switch (p[0]) {
2901 	case kEncodedHeader:
2902 		/*
2903 		 * The archive has an encoded header and we have to decode it
2904 		 * in order to parse the header correctly.
2905 		 */
2906 		r = decode_encoded_header_info(a, &(zip->si));
2907 
2908 		/* Check the EncodedHeader CRC.*/
2909 		if (r == 0 && zip->header_crc32 != next_header_crc) {
2910 			archive_set_error(&a->archive, -1,
2911 			    "Damaged 7-Zip archive");
2912 			r = -1;
2913 		}
2914 		if (r == 0) {
2915 			if (zip->si.ci.folders[0].digest_defined)
2916 				next_header_crc = zip->si.ci.folders[0].digest;
2917 			else
2918 				check_header_crc = 0;
2919 			if (zip->pack_stream_bytes_unconsumed)
2920 				read_consume(a);
2921 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
2922 			if (r == 0) {
2923 				zip->header_bytes_remaining =
2924 					zip->folder_outbytes_remaining;
2925 				r = seek_pack(a);
2926 			}
2927 		}
2928 		/* Clean up StreamsInfo. */
2929 		free_StreamsInfo(&(zip->si));
2930 		memset(&(zip->si), 0, sizeof(zip->si));
2931 		if (r < 0)
2932 			return (ARCHIVE_FATAL);
2933 		zip->header_is_encoded = 1;
2934 		zip->header_crc32 = 0;
2935 		/* FALL THROUGH */
2936 	case kHeader:
2937 		/*
2938 		 * Parse the header.
2939 		 */
2940 		errno = 0;
2941 		r = read_Header(a, header, zip->header_is_encoded);
2942 		if (r < 0) {
2943 			if (errno == ENOMEM)
2944 				archive_set_error(&a->archive, -1,
2945 				    "Couldn't allocate memory");
2946 			else
2947 				archive_set_error(&a->archive, -1,
2948 				    "Damaged 7-Zip archive");
2949 			return (ARCHIVE_FATAL);
2950 		}
2951 
2952 		/*
2953 		 *  Must be kEnd.
2954 		 */
2955 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
2956 			archive_set_error(&a->archive, -1,
2957 			    "Malformed 7-Zip archive");
2958 			return (ARCHIVE_FATAL);
2959 		}
2960 
2961 		/* Check the Header CRC.*/
2962 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
2963 			archive_set_error(&a->archive, -1,
2964 			    "Malformed 7-Zip archive");
2965 			return (ARCHIVE_FATAL);
2966 		}
2967 		break;
2968 	default:
2969 		archive_set_error(&a->archive, -1,
2970 		    "Unexpected Property ID = %X", p[0]);
2971 		return (ARCHIVE_FATAL);
2972 	}
2973 
2974 	/* Clean up variables be used for decoding the archive header */
2975 	zip->pack_stream_remaining = 0;
2976 	zip->pack_stream_index = 0;
2977 	zip->folder_outbytes_remaining = 0;
2978 	zip->uncompressed_buffer_bytes_remaining = 0;
2979 	zip->pack_stream_bytes_unconsumed = 0;
2980 	zip->header_is_being_read = 0;
2981 
2982 	return (ARCHIVE_OK);
2983 }
2984 
2985 static ssize_t
2986 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
2987     size_t minimum)
2988 {
2989 	struct _7zip *zip = (struct _7zip *)a->format->data;
2990 	ssize_t bytes_avail;
2991 
2992 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2993 		/* Copy mode. */
2994 
2995 		*buff = __archive_read_ahead(a, minimum, &bytes_avail);
2996 		if (bytes_avail <= 0) {
2997 			archive_set_error(&a->archive,
2998 			    ARCHIVE_ERRNO_FILE_FORMAT,
2999 			    "Truncated 7-Zip file data");
3000 			return (ARCHIVE_FATAL);
3001 		}
3002 		if ((size_t)bytes_avail >
3003 		    zip->uncompressed_buffer_bytes_remaining)
3004 			bytes_avail = (ssize_t)
3005 			    zip->uncompressed_buffer_bytes_remaining;
3006 		if ((size_t)bytes_avail > size)
3007 			bytes_avail = (ssize_t)size;
3008 
3009 		zip->pack_stream_bytes_unconsumed = bytes_avail;
3010 	} else if (zip->uncompressed_buffer_pointer == NULL) {
3011 		/* Decompression has failed. */
3012 		archive_set_error(&(a->archive),
3013 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3014 		return (ARCHIVE_FATAL);
3015 	} else {
3016 		/* Packed mode. */
3017 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
3018 			/*
3019 			 * If remaining uncompressed data size is less than
3020 			 * the minimum size, fill the buffer up to the
3021 			 * minimum size.
3022 			 */
3023 			if (extract_pack_stream(a, minimum) < 0)
3024 				return (ARCHIVE_FATAL);
3025 		}
3026 		if (size > zip->uncompressed_buffer_bytes_remaining)
3027 			bytes_avail = (ssize_t)
3028 			    zip->uncompressed_buffer_bytes_remaining;
3029 		else
3030 			bytes_avail = (ssize_t)size;
3031 		*buff = zip->uncompressed_buffer_pointer;
3032 		zip->uncompressed_buffer_pointer += bytes_avail;
3033 	}
3034 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
3035 	return (bytes_avail);
3036 }
3037 
3038 static ssize_t
3039 extract_pack_stream(struct archive_read *a, size_t minimum)
3040 {
3041 	struct _7zip *zip = (struct _7zip *)a->format->data;
3042 	ssize_t bytes_avail;
3043 	int r;
3044 
3045 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
3046 		if (minimum == 0)
3047 			minimum = 1;
3048 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
3049 		    || bytes_avail <= 0) {
3050 			archive_set_error(&a->archive,
3051 			    ARCHIVE_ERRNO_FILE_FORMAT,
3052 			    "Truncated 7-Zip file body");
3053 			return (ARCHIVE_FATAL);
3054 		}
3055 		if ((uint64_t)bytes_avail > zip->pack_stream_inbytes_remaining)
3056 			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
3057 		zip->pack_stream_inbytes_remaining -= bytes_avail;
3058 		if ((uint64_t)bytes_avail > zip->folder_outbytes_remaining)
3059 			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
3060 		zip->folder_outbytes_remaining -= bytes_avail;
3061 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
3062 		return (ARCHIVE_OK);
3063 	}
3064 
3065 	/* If the buffer hasn't been allocated, allocate it now. */
3066 	if (zip->uncompressed_buffer == NULL) {
3067 		zip->uncompressed_buffer_size = UBUFF_SIZE;
3068 		if (zip->uncompressed_buffer_size < minimum) {
3069 			zip->uncompressed_buffer_size = minimum + 1023;
3070 			zip->uncompressed_buffer_size &= ~0x3ff;
3071 		}
3072 		zip->uncompressed_buffer =
3073 		    malloc(zip->uncompressed_buffer_size);
3074 		if (zip->uncompressed_buffer == NULL) {
3075 			archive_set_error(&a->archive, ENOMEM,
3076 			    "No memory for 7-Zip decompression");
3077 			return (ARCHIVE_FATAL);
3078 		}
3079 		zip->uncompressed_buffer_bytes_remaining = 0;
3080 	} else if (zip->uncompressed_buffer_size < minimum ||
3081 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
3082 		/*
3083 		 * Make sure the uncompressed buffer can have bytes
3084 		 * at least `minimum' bytes.
3085 		 * NOTE: This case happen when reading the header.
3086 		 */
3087 		size_t used;
3088 		if (zip->uncompressed_buffer_pointer != 0)
3089 			used = zip->uncompressed_buffer_pointer -
3090 				zip->uncompressed_buffer;
3091 		else
3092 			used = 0;
3093 		if (zip->uncompressed_buffer_size < minimum) {
3094 			/*
3095 			 * Expand the uncompressed buffer up to
3096 			 * the minimum size.
3097 			 */
3098 			void *p;
3099 			size_t new_size;
3100 
3101 			new_size = minimum + 1023;
3102 			new_size &= ~0x3ff;
3103 			p = realloc(zip->uncompressed_buffer, new_size);
3104 			if (p == NULL) {
3105 				archive_set_error(&a->archive, ENOMEM,
3106 				    "No memory for 7-Zip decompression");
3107 				return (ARCHIVE_FATAL);
3108 			}
3109 			zip->uncompressed_buffer = (unsigned char *)p;
3110 			zip->uncompressed_buffer_size = new_size;
3111 		}
3112 		/*
3113 		 * Move unconsumed bytes to the head.
3114 		 */
3115 		if (used) {
3116 			memmove(zip->uncompressed_buffer,
3117 				zip->uncompressed_buffer + used,
3118 				zip->uncompressed_buffer_bytes_remaining);
3119 		}
3120 	} else
3121 		zip->uncompressed_buffer_bytes_remaining = 0;
3122 	zip->uncompressed_buffer_pointer = NULL;
3123 	for (;;) {
3124 		size_t bytes_in, bytes_out;
3125 		const void *buff_in;
3126 		unsigned char *buff_out;
3127 		int end_of_data;
3128 
3129 		/*
3130 		 * Note: '1' here is a performance optimization.
3131 		 * Recall that the decompression layer returns a count of
3132 		 * available bytes; asking for more than that forces the
3133 		 * decompressor to combine reads by copying data.
3134 		 */
3135 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3136 		if (bytes_avail <= 0) {
3137 			archive_set_error(&a->archive,
3138 			    ARCHIVE_ERRNO_FILE_FORMAT,
3139 			    "Truncated 7-Zip file body");
3140 			return (ARCHIVE_FATAL);
3141 		}
3142 
3143 		buff_out = zip->uncompressed_buffer
3144 			+ zip->uncompressed_buffer_bytes_remaining;
3145 		bytes_out = zip->uncompressed_buffer_size
3146 			- zip->uncompressed_buffer_bytes_remaining;
3147 		bytes_in = bytes_avail;
3148 		if (bytes_in > zip->pack_stream_inbytes_remaining)
3149 			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3150 		/* Drive decompression. */
3151 		r = decompress(a, zip, buff_out, &bytes_out,
3152 			buff_in, &bytes_in);
3153 		switch (r) {
3154 		case ARCHIVE_OK:
3155 			end_of_data = 0;
3156 			break;
3157 		case ARCHIVE_EOF:
3158 			end_of_data = 1;
3159 			break;
3160 		default:
3161 			return (ARCHIVE_FATAL);
3162 		}
3163 		zip->pack_stream_inbytes_remaining -= bytes_in;
3164 		if (bytes_out > zip->folder_outbytes_remaining)
3165 			bytes_out = (size_t)zip->folder_outbytes_remaining;
3166 		zip->folder_outbytes_remaining -= bytes_out;
3167 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3168 		zip->pack_stream_bytes_unconsumed = bytes_in;
3169 
3170 		/*
3171 		 * Continue decompression until uncompressed_buffer is full.
3172 		 */
3173 		if (zip->uncompressed_buffer_bytes_remaining ==
3174 		    zip->uncompressed_buffer_size)
3175 			break;
3176 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3177 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3178 		    zip->uncompressed_buffer_size)
3179 			break;
3180 		if (zip->pack_stream_inbytes_remaining == 0 &&
3181 		    zip->folder_outbytes_remaining == 0)
3182 			break;
3183 		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3184 			archive_set_error(&(a->archive),
3185 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3186 			return (ARCHIVE_FATAL);
3187 		}
3188 		read_consume(a);
3189 	}
3190 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3191 		archive_set_error(&(a->archive),
3192 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3193 		return (ARCHIVE_FATAL);
3194 	}
3195 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3196 	return (ARCHIVE_OK);
3197 }
3198 
3199 static int
3200 seek_pack(struct archive_read *a)
3201 {
3202 	struct _7zip *zip = (struct _7zip *)a->format->data;
3203 	int64_t pack_offset;
3204 
3205 	if (zip->pack_stream_remaining <= 0) {
3206 		archive_set_error(&(a->archive),
3207 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3208 		return (ARCHIVE_FATAL);
3209 	}
3210 	zip->pack_stream_inbytes_remaining =
3211 	    zip->si.pi.sizes[zip->pack_stream_index];
3212 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3213 	if (zip->stream_offset != pack_offset) {
3214 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3215 		    SEEK_SET))
3216 			return (ARCHIVE_FATAL);
3217 		zip->stream_offset = pack_offset;
3218 	}
3219 	zip->pack_stream_index++;
3220 	zip->pack_stream_remaining--;
3221 	return (ARCHIVE_OK);
3222 }
3223 
3224 static ssize_t
3225 read_stream(struct archive_read *a, const void **buff, size_t size,
3226     size_t minimum)
3227 {
3228 	struct _7zip *zip = (struct _7zip *)a->format->data;
3229 	uint64_t skip_bytes = 0;
3230 	ssize_t r;
3231 
3232 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3233 		if (zip->pack_stream_inbytes_remaining > 0) {
3234 			r = extract_pack_stream(a, 0);
3235 			if (r < 0)
3236 				return (r);
3237 			return (get_uncompressed_data(a, buff, size, minimum));
3238 		} else if (zip->folder_outbytes_remaining > 0) {
3239 			/* Extract a remaining pack stream. */
3240 			r = extract_pack_stream(a, 0);
3241 			if (r < 0)
3242 				return (r);
3243 			return (get_uncompressed_data(a, buff, size, minimum));
3244 		}
3245 	} else
3246 		return (get_uncompressed_data(a, buff, size, minimum));
3247 
3248 	/*
3249 	 * Current pack stream has been consumed.
3250 	 */
3251 	if (zip->pack_stream_remaining == 0) {
3252 		if (zip->header_is_being_read) {
3253 			/* Invalid sequence. This might happen when
3254 			 * reading a malformed archive. */
3255 			archive_set_error(&(a->archive),
3256 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3257 			return (ARCHIVE_FATAL);
3258 		}
3259 
3260 		/*
3261 		 * All current folder's pack streams have been
3262 		 * consumed. Switch to next folder.
3263 		 */
3264 		if (zip->folder_index == 0 &&
3265 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3266 		     || zip->folder_index != zip->entry->folderIndex)) {
3267 			zip->folder_index = zip->entry->folderIndex;
3268 			skip_bytes =
3269 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3270 		}
3271 
3272 		if (zip->folder_index >= zip->si.ci.numFolders) {
3273 			/*
3274 			 * We have consumed all folders and its pack streams.
3275 			 */
3276 			*buff = NULL;
3277 			return (0);
3278 		}
3279 		r = setup_decode_folder(a,
3280 			&(zip->si.ci.folders[zip->folder_index]), 0);
3281 		if (r != ARCHIVE_OK)
3282 			return (ARCHIVE_FATAL);
3283 
3284 		zip->folder_index++;
3285 	}
3286 
3287 	/*
3288 	 * Switch to next pack stream.
3289 	 */
3290 	r = seek_pack(a);
3291 	if (r < 0)
3292 		return (r);
3293 
3294 	/* Extract a new pack stream. */
3295 	r = extract_pack_stream(a, 0);
3296 	if (r < 0)
3297 		return (r);
3298 
3299 	/*
3300 	 * Skip the bytes we already has skipped in skip_stream().
3301 	 */
3302 	while (skip_bytes) {
3303 		ssize_t skipped;
3304 
3305 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3306 			if (zip->pack_stream_inbytes_remaining > 0) {
3307 				r = extract_pack_stream(a, 0);
3308 				if (r < 0)
3309 					return (r);
3310 			} else if (zip->folder_outbytes_remaining > 0) {
3311 				/* Extract a remaining pack stream. */
3312 				r = extract_pack_stream(a, 0);
3313 				if (r < 0)
3314 					return (r);
3315 			} else {
3316 				archive_set_error(&a->archive,
3317 				    ARCHIVE_ERRNO_FILE_FORMAT,
3318 				    "Truncated 7-Zip file body");
3319 				return (ARCHIVE_FATAL);
3320 			}
3321 		}
3322 		skipped = get_uncompressed_data(
3323 			a, buff, (size_t)skip_bytes, 0);
3324 		if (skipped < 0)
3325 			return (skipped);
3326 		skip_bytes -= skipped;
3327 		if (zip->pack_stream_bytes_unconsumed)
3328 			read_consume(a);
3329 	}
3330 
3331 	return (get_uncompressed_data(a, buff, size, minimum));
3332 }
3333 
3334 static int
3335 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3336     int header)
3337 {
3338 	struct _7zip *zip = (struct _7zip *)a->format->data;
3339 	const struct _7z_coder *coder1, *coder2;
3340 	const char *cname = (header)?"archive header":"file content";
3341 	unsigned i;
3342 	int r, found_bcj2 = 0;
3343 
3344 	/*
3345 	 * Release the memory which the previous folder used for BCJ2.
3346 	 */
3347 	for (i = 0; i < 3; i++) {
3348 		free(zip->sub_stream_buff[i]);
3349 		zip->sub_stream_buff[i] = NULL;
3350 	}
3351 
3352 	/*
3353 	 * Initialize a stream reader.
3354 	 */
3355 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3356 	zip->pack_stream_index = (unsigned)folder->packIndex;
3357 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3358 	zip->uncompressed_buffer_bytes_remaining = 0;
3359 
3360 	/*
3361 	 * Check coder types.
3362 	 */
3363 	for (i = 0; i < folder->numCoders; i++) {
3364 		switch(folder->coders[i].codec) {
3365 			case _7Z_CRYPTO_MAIN_ZIP:
3366 			case _7Z_CRYPTO_RAR_29:
3367 			case _7Z_CRYPTO_AES_256_SHA_256: {
3368 				/* For entry that is associated with this folder, mark
3369 				   it as encrypted (data+metadata). */
3370 				zip->has_encrypted_entries = 1;
3371 				if (a->entry) {
3372 					archive_entry_set_is_data_encrypted(a->entry, 1);
3373 					archive_entry_set_is_metadata_encrypted(a->entry, 1);
3374 				}
3375 				archive_set_error(&(a->archive),
3376 					ARCHIVE_ERRNO_MISC,
3377 					"The %s is encrypted, "
3378 					"but currently not supported", cname);
3379 				return (ARCHIVE_FATAL);
3380 			}
3381 			case _7Z_X86_BCJ2: {
3382 				found_bcj2++;
3383 				break;
3384 			}
3385 		}
3386 	}
3387 	/* Now that we've checked for encryption, if there were still no
3388 	 * encrypted entries found we can say for sure that there are none.
3389 	 */
3390 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
3391 		zip->has_encrypted_entries = 0;
3392 	}
3393 
3394 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3395 		archive_set_error(&(a->archive),
3396 		    ARCHIVE_ERRNO_MISC,
3397 		    "The %s is encoded with many filters, "
3398 		    "but currently not supported", cname);
3399 		return (ARCHIVE_FATAL);
3400 	}
3401 	coder1 = &(folder->coders[0]);
3402 	if (folder->numCoders == 2)
3403 		coder2 = &(folder->coders[1]);
3404 	else
3405 		coder2 = NULL;
3406 
3407 	if (found_bcj2) {
3408 		/*
3409 		 * Preparation to decode BCJ2.
3410 		 * Decoding BCJ2 requires four sources. Those are at least,
3411 		 * as far as I know, two types of the storage form.
3412 		 */
3413 		const struct _7z_coder *fc = folder->coders;
3414 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3415 		const struct _7z_coder *scoder[3] =
3416 			{&coder_copy, &coder_copy, &coder_copy};
3417 		const void *buff;
3418 		ssize_t bytes;
3419 		unsigned char *b[3] = {NULL, NULL, NULL};
3420 		uint64_t sunpack[3] ={-1, -1, -1};
3421 		size_t s[3] = {0, 0, 0};
3422 		int idx[3] = {0, 1, 2};
3423 
3424 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3425 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3426 		    zip->pack_stream_remaining == 4) {
3427 			/* Source type 1 made by 7zr or 7z with -m options. */
3428 			if (folder->bindPairs[0].inIndex == 5) {
3429 				/* The form made by 7zr */
3430 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3431 				scoder[1] = &(fc[1]);
3432 				scoder[2] = &(fc[0]);
3433 				sunpack[1] = folder->unPackSize[1];
3434 				sunpack[2] = folder->unPackSize[0];
3435 				coder1 = &(fc[2]);
3436 			} else {
3437 				/*
3438 				 * NOTE: Some patterns do not work.
3439 				 * work:
3440 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3441 				 *       -m3=(any)
3442 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3443 				 *       -m3=COPY
3444 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3445 				 *       -m3=COPY
3446 				 * not work:
3447 				 *  other patterns.
3448 				 *
3449 				 * We have to handle this like `pipe' or
3450 				 * our libarchive7s filter frame work,
3451 				 * decoding the BCJ2 main stream sequentially,
3452 				 * m3 -> m2 -> m1 -> BCJ2.
3453 				 *
3454 				 */
3455 				if (fc[0].codec == _7Z_COPY &&
3456 				    fc[1].codec == _7Z_COPY)
3457 					coder1 = &(folder->coders[2]);
3458 				else if (fc[0].codec == _7Z_COPY &&
3459 				    fc[2].codec == _7Z_COPY)
3460 					coder1 = &(folder->coders[1]);
3461 				else if (fc[1].codec == _7Z_COPY &&
3462 				    fc[2].codec == _7Z_COPY)
3463 					coder1 = &(folder->coders[0]);
3464 				else {
3465 					archive_set_error(&(a->archive),
3466 					    ARCHIVE_ERRNO_MISC,
3467 					    "Unsupported form of "
3468 					    "BCJ2 streams");
3469 					return (ARCHIVE_FATAL);
3470 				}
3471 			}
3472 			coder2 = &(fc[3]);
3473 			zip->main_stream_bytes_remaining =
3474 				(size_t)folder->unPackSize[2];
3475 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3476 		    zip->pack_stream_remaining == 4 &&
3477 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3478 			/* Source type 0 made by 7z */
3479 			zip->main_stream_bytes_remaining =
3480 				(size_t)folder->unPackSize[0];
3481 		} else {
3482 			/* We got an unexpected form. */
3483 			archive_set_error(&(a->archive),
3484 			    ARCHIVE_ERRNO_MISC,
3485 			    "Unsupported form of BCJ2 streams");
3486 			return (ARCHIVE_FATAL);
3487 		}
3488 
3489 		/* Skip the main stream at this time. */
3490 		if ((r = seek_pack(a)) < 0)
3491 			return (r);
3492 		zip->pack_stream_bytes_unconsumed =
3493 		    (size_t)zip->pack_stream_inbytes_remaining;
3494 		read_consume(a);
3495 
3496 		/* Read following three sub streams. */
3497 		for (i = 0; i < 3; i++) {
3498 			const struct _7z_coder *coder = scoder[i];
3499 
3500 			if ((r = seek_pack(a)) < 0) {
3501 				free(b[0]); free(b[1]); free(b[2]);
3502 				return (r);
3503 			}
3504 
3505 			if (sunpack[i] == (uint64_t)-1)
3506 				zip->folder_outbytes_remaining =
3507 				    zip->pack_stream_inbytes_remaining;
3508 			else
3509 				zip->folder_outbytes_remaining = sunpack[i];
3510 
3511 			r = init_decompression(a, zip, coder, NULL);
3512 			if (r != ARCHIVE_OK) {
3513 				free(b[0]); free(b[1]); free(b[2]);
3514 				return (ARCHIVE_FATAL);
3515 			}
3516 
3517 			/* Allocate memory for the decoded data of a sub
3518 			 * stream. */
3519 			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3520 			if (b[i] == NULL) {
3521 				free(b[0]); free(b[1]); free(b[2]);
3522 				archive_set_error(&a->archive, ENOMEM,
3523 				    "No memory for 7-Zip decompression");
3524 				return (ARCHIVE_FATAL);
3525 			}
3526 
3527 			/* Extract a sub stream. */
3528 			while (zip->pack_stream_inbytes_remaining > 0) {
3529 				r = (int)extract_pack_stream(a, 0);
3530 				if (r < 0) {
3531 					free(b[0]); free(b[1]); free(b[2]);
3532 					return (r);
3533 				}
3534 				bytes = get_uncompressed_data(a, &buff,
3535 				    zip->uncompressed_buffer_bytes_remaining,
3536 				    0);
3537 				if (bytes < 0) {
3538 					free(b[0]); free(b[1]); free(b[2]);
3539 					return ((int)bytes);
3540 				}
3541 				memcpy(b[i]+s[i], buff, bytes);
3542 				s[i] += bytes;
3543 				if (zip->pack_stream_bytes_unconsumed)
3544 					read_consume(a);
3545 			}
3546 		}
3547 
3548 		/* Set the sub streams to the right place. */
3549 		for (i = 0; i < 3; i++) {
3550 			zip->sub_stream_buff[i] = b[idx[i]];
3551 			zip->sub_stream_size[i] = s[idx[i]];
3552 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3553 		}
3554 
3555 		/* Allocate memory used for decoded main stream bytes. */
3556 		if (zip->tmp_stream_buff == NULL) {
3557 			zip->tmp_stream_buff_size = 32 * 1024;
3558 			zip->tmp_stream_buff =
3559 			    malloc(zip->tmp_stream_buff_size);
3560 			if (zip->tmp_stream_buff == NULL) {
3561 				archive_set_error(&a->archive, ENOMEM,
3562 				    "No memory for 7-Zip decompression");
3563 				return (ARCHIVE_FATAL);
3564 			}
3565 		}
3566 		zip->tmp_stream_bytes_avail = 0;
3567 		zip->tmp_stream_bytes_remaining = 0;
3568 		zip->odd_bcj_size = 0;
3569 		zip->bcj2_outPos = 0;
3570 
3571 		/*
3572 		 * Reset a stream reader in order to read the main stream
3573 		 * of BCJ2.
3574 		 */
3575 		zip->pack_stream_remaining = 1;
3576 		zip->pack_stream_index = (unsigned)folder->packIndex;
3577 		zip->folder_outbytes_remaining =
3578 		    folder_uncompressed_size(folder);
3579 		zip->uncompressed_buffer_bytes_remaining = 0;
3580 	}
3581 
3582 	/*
3583 	 * Initialize the decompressor for the new folder's pack streams.
3584 	 */
3585 	r = init_decompression(a, zip, coder1, coder2);
3586 	if (r != ARCHIVE_OK)
3587 		return (ARCHIVE_FATAL);
3588 	return (ARCHIVE_OK);
3589 }
3590 
3591 static int64_t
3592 skip_stream(struct archive_read *a, size_t skip_bytes)
3593 {
3594 	struct _7zip *zip = (struct _7zip *)a->format->data;
3595 	const void *p;
3596 	int64_t skipped_bytes;
3597 	size_t bytes = skip_bytes;
3598 
3599 	if (zip->folder_index == 0) {
3600 		/*
3601 		 * Optimization for a list mode.
3602 		 * Avoid unnecessary decoding operations.
3603 		 */
3604 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3605 		    += skip_bytes;
3606 		return (skip_bytes);
3607 	}
3608 
3609 	while (bytes) {
3610 		skipped_bytes = read_stream(a, &p, bytes, 0);
3611 		if (skipped_bytes < 0)
3612 			return (skipped_bytes);
3613 		if (skipped_bytes == 0) {
3614 			archive_set_error(&a->archive,
3615 			    ARCHIVE_ERRNO_FILE_FORMAT,
3616 			    "Truncated 7-Zip file body");
3617 			return (ARCHIVE_FATAL);
3618 		}
3619 		bytes -= (size_t)skipped_bytes;
3620 		if (zip->pack_stream_bytes_unconsumed)
3621 			read_consume(a);
3622 	}
3623 	return (skip_bytes);
3624 }
3625 
3626 /*
3627  * Brought from LZMA SDK.
3628  *
3629  * Bra86.c -- Converter for x86 code (BCJ)
3630  * 2008-10-04 : Igor Pavlov : Public domain
3631  *
3632  */
3633 
3634 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3635 
3636 static void
3637 x86_Init(struct _7zip *zip)
3638 {
3639 	zip->bcj_state = 0;
3640 	zip->bcj_prevPosT = (size_t)0 - 1;
3641 	zip->bcj_prevMask = 0;
3642 	zip->bcj_ip = 5;
3643 }
3644 
3645 static size_t
3646 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3647 {
3648 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3649 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3650 	size_t bufferPos, prevPosT;
3651 	uint32_t ip, prevMask;
3652 
3653 	if (size < 5)
3654 		return 0;
3655 
3656 	bufferPos = 0;
3657 	prevPosT = zip->bcj_prevPosT;
3658 	prevMask = zip->bcj_prevMask;
3659 	ip = zip->bcj_ip;
3660 
3661 	for (;;) {
3662 		uint8_t *p = data + bufferPos;
3663 		uint8_t *limit = data + size - 4;
3664 
3665 		for (; p < limit; p++)
3666 			if ((*p & 0xFE) == 0xE8)
3667 				break;
3668 		bufferPos = (size_t)(p - data);
3669 		if (p >= limit)
3670 			break;
3671 		prevPosT = bufferPos - prevPosT;
3672 		if (prevPosT > 3)
3673 			prevMask = 0;
3674 		else {
3675 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3676 			if (prevMask != 0) {
3677 				unsigned char b =
3678 					p[4 - kMaskToBitNumber[prevMask]];
3679 				if (!kMaskToAllowedStatus[prevMask] ||
3680 				    Test86MSByte(b)) {
3681 					prevPosT = bufferPos;
3682 					prevMask = ((prevMask << 1) & 0x7) | 1;
3683 					bufferPos++;
3684 					continue;
3685 				}
3686 			}
3687 		}
3688 		prevPosT = bufferPos;
3689 
3690 		if (Test86MSByte(p[4])) {
3691 			uint32_t src = ((uint32_t)p[4] << 24) |
3692 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3693 				((uint32_t)p[1]);
3694 			uint32_t dest;
3695 			for (;;) {
3696 				uint8_t b;
3697 				int b_index;
3698 
3699 				dest = src - (ip + (uint32_t)bufferPos);
3700 				if (prevMask == 0)
3701 					break;
3702 				b_index = kMaskToBitNumber[prevMask] * 8;
3703 				b = (uint8_t)(dest >> (24 - b_index));
3704 				if (!Test86MSByte(b))
3705 					break;
3706 				src = dest ^ ((1 << (32 - b_index)) - 1);
3707 			}
3708 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3709 			p[3] = (uint8_t)(dest >> 16);
3710 			p[2] = (uint8_t)(dest >> 8);
3711 			p[1] = (uint8_t)dest;
3712 			bufferPos += 5;
3713 		} else {
3714 			prevMask = ((prevMask << 1) & 0x7) | 1;
3715 			bufferPos++;
3716 		}
3717 	}
3718 	zip->bcj_prevPosT = prevPosT;
3719 	zip->bcj_prevMask = prevMask;
3720 	zip->bcj_ip += (uint32_t)bufferPos;
3721 	return (bufferPos);
3722 }
3723 
3724 /*
3725  * Brought from LZMA SDK.
3726  *
3727  * Bcj2.c -- Converter for x86 code (BCJ2)
3728  * 2008-10-04 : Igor Pavlov : Public domain
3729  *
3730  */
3731 
3732 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3733 
3734 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3735 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3736 
3737 #define kNumTopBits 24
3738 #define kTopValue ((uint32_t)1 << kNumTopBits)
3739 
3740 #define kNumBitModelTotalBits 11
3741 #define kBitModelTotal (1 << kNumBitModelTotalBits)
3742 #define kNumMoveBits 5
3743 
3744 #define RC_READ_BYTE (*buffer++)
3745 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
3746 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
3747   { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
3748 
3749 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
3750 
3751 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
3752 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
3753 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
3754 
3755 static ssize_t
3756 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
3757 {
3758 	size_t inPos = 0, outPos = 0;
3759 	const uint8_t *buf0, *buf1, *buf2, *buf3;
3760 	size_t size0, size1, size2, size3;
3761 	const uint8_t *buffer, *bufferLim;
3762 	unsigned int i, j;
3763 
3764 	size0 = zip->tmp_stream_bytes_remaining;
3765 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
3766 	size1 = zip->sub_stream_bytes_remaining[0];
3767 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
3768 	size2 = zip->sub_stream_bytes_remaining[1];
3769 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
3770 	size3 = zip->sub_stream_bytes_remaining[2];
3771 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
3772 
3773 	buffer = buf3;
3774 	bufferLim = buffer + size3;
3775 
3776 	if (zip->bcj_state == 0) {
3777 		/*
3778 		 * Initialize.
3779 		 */
3780 		zip->bcj2_prevByte = 0;
3781 		for (i = 0;
3782 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
3783 			zip->bcj2_p[i] = kBitModelTotal >> 1;
3784 		RC_INIT2;
3785 		zip->bcj_state = 1;
3786 	}
3787 
3788 	/*
3789 	 * Gather the odd bytes of a previous call.
3790 	 */
3791 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
3792 		outBuf[outPos++] = zip->odd_bcj[i];
3793 		zip->odd_bcj_size--;
3794 	}
3795 
3796 	if (outSize == 0) {
3797 		zip->bcj2_outPos += outPos;
3798 		return (outPos);
3799 	}
3800 
3801 	for (;;) {
3802 		uint8_t b;
3803 		CProb *prob;
3804 		uint32_t bound;
3805 		uint32_t ttt;
3806 
3807 		size_t limit = size0 - inPos;
3808 		if (outSize - outPos < limit)
3809 			limit = outSize - outPos;
3810 
3811 		if (zip->bcj_state == 1) {
3812 			while (limit != 0) {
3813 				uint8_t bb = buf0[inPos];
3814 				outBuf[outPos++] = bb;
3815 				if (IsJ(zip->bcj2_prevByte, bb)) {
3816 					zip->bcj_state = 2;
3817 					break;
3818 				}
3819 				inPos++;
3820 				zip->bcj2_prevByte = bb;
3821 				limit--;
3822 			}
3823 		}
3824 
3825 		if (limit == 0 || outPos == outSize)
3826 			break;
3827 		zip->bcj_state = 1;
3828 
3829 		b = buf0[inPos++];
3830 
3831 		if (b == 0xE8)
3832 			prob = zip->bcj2_p + zip->bcj2_prevByte;
3833 		else if (b == 0xE9)
3834 			prob = zip->bcj2_p + 256;
3835 		else
3836 			prob = zip->bcj2_p + 257;
3837 
3838 		IF_BIT_0(prob) {
3839 			UPDATE_0(prob)
3840 			zip->bcj2_prevByte = b;
3841 		} else {
3842 			uint32_t dest;
3843 			const uint8_t *v;
3844 			uint8_t out[4];
3845 
3846 			UPDATE_1(prob)
3847 			if (b == 0xE8) {
3848 				v = buf1;
3849 				if (size1 < 4)
3850 					return SZ_ERROR_DATA;
3851 				buf1 += 4;
3852 				size1 -= 4;
3853 			} else {
3854 				v = buf2;
3855 				if (size2 < 4)
3856 					return SZ_ERROR_DATA;
3857 				buf2 += 4;
3858 				size2 -= 4;
3859 			}
3860 			dest = (((uint32_t)v[0] << 24) |
3861 			    ((uint32_t)v[1] << 16) |
3862 			    ((uint32_t)v[2] << 8) |
3863 			    ((uint32_t)v[3])) -
3864 			    ((uint32_t)zip->bcj2_outPos + (uint32_t)outPos + 4);
3865 			out[0] = (uint8_t)dest;
3866 			out[1] = (uint8_t)(dest >> 8);
3867 			out[2] = (uint8_t)(dest >> 16);
3868 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
3869 
3870 			for (i = 0; i < 4 && outPos < outSize; i++)
3871 				outBuf[outPos++] = out[i];
3872 			if (i < 4) {
3873 				/*
3874 				 * Save odd bytes which we could not add into
3875 				 * the output buffer because of out of space.
3876 				 */
3877 				zip->odd_bcj_size = 4 -i;
3878 				for (; i < 4; i++) {
3879 					j = i - 4 + (unsigned)zip->odd_bcj_size;
3880 					zip->odd_bcj[j] = out[i];
3881 				}
3882 				break;
3883 			}
3884 		}
3885 	}
3886 	zip->tmp_stream_bytes_remaining -= inPos;
3887 	zip->sub_stream_bytes_remaining[0] = size1;
3888 	zip->sub_stream_bytes_remaining[1] = size2;
3889 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
3890 	zip->bcj2_outPos += outPos;
3891 
3892 	return ((ssize_t)outPos);
3893 }
3894 
3895