1 /*-
2 * Copyright (c) 2003-2007 Tim Kientzle
3 * Copyright (c) 2011 Andres Mejia
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26 
27 #include "archive_platform.h"
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #include <time.h>
33 #include <limits.h>
34 #ifdef HAVE_ZLIB_H
35 #include <zlib.h> /* crc32 */
36 #endif
37 
38 #include "archive.h"
39 #ifndef HAVE_ZLIB_H
40 #include "archive_crc32.h"
41 #endif
42 #include "archive_endian.h"
43 #include "archive_entry.h"
44 #include "archive_entry_locale.h"
45 #include "archive_ppmd7_private.h"
46 #include "archive_private.h"
47 #include "archive_read_private.h"
48 
49 /* RAR signature, also known as the mark header */
50 #define RAR_SIGNATURE "\x52\x61\x72\x21\x1A\x07\x00"
51 
52 /* Header types */
53 #define MARK_HEAD    0x72
54 #define MAIN_HEAD    0x73
55 #define FILE_HEAD    0x74
56 #define COMM_HEAD    0x75
57 #define AV_HEAD      0x76
58 #define SUB_HEAD     0x77
59 #define PROTECT_HEAD 0x78
60 #define SIGN_HEAD    0x79
61 #define NEWSUB_HEAD  0x7a
62 #define ENDARC_HEAD  0x7b
63 
64 /* Main Header Flags */
65 #define MHD_VOLUME       0x0001
66 #define MHD_COMMENT      0x0002
67 #define MHD_LOCK         0x0004
68 #define MHD_SOLID        0x0008
69 #define MHD_NEWNUMBERING 0x0010
70 #define MHD_AV           0x0020
71 #define MHD_PROTECT      0x0040
72 #define MHD_PASSWORD     0x0080
73 #define MHD_FIRSTVOLUME  0x0100
74 #define MHD_ENCRYPTVER   0x0200
75 
76 /* Flags common to all headers */
77 #define HD_MARKDELETION     0x4000
78 #define HD_ADD_SIZE_PRESENT 0x8000
79 
80 /* File Header Flags */
81 #define FHD_SPLIT_BEFORE 0x0001
82 #define FHD_SPLIT_AFTER  0x0002
83 #define FHD_PASSWORD     0x0004
84 #define FHD_COMMENT      0x0008
85 #define FHD_SOLID        0x0010
86 #define FHD_LARGE        0x0100
87 #define FHD_UNICODE      0x0200
88 #define FHD_SALT         0x0400
89 #define FHD_VERSION      0x0800
90 #define FHD_EXTTIME      0x1000
91 #define FHD_EXTFLAGS     0x2000
92 
93 /* File dictionary sizes */
94 #define DICTIONARY_SIZE_64   0x00
95 #define DICTIONARY_SIZE_128  0x20
96 #define DICTIONARY_SIZE_256  0x40
97 #define DICTIONARY_SIZE_512  0x60
98 #define DICTIONARY_SIZE_1024 0x80
99 #define DICTIONARY_SIZE_2048 0xA0
100 #define DICTIONARY_SIZE_4096 0xC0
101 #define FILE_IS_DIRECTORY    0xE0
102 #define DICTIONARY_MASK      FILE_IS_DIRECTORY
103 
104 /* OS Flags */
105 #define OS_MSDOS  0
106 #define OS_OS2    1
107 #define OS_WIN32  2
108 #define OS_UNIX   3
109 #define OS_MAC_OS 4
110 #define OS_BEOS   5
111 
112 /* Compression Methods */
113 #define COMPRESS_METHOD_STORE   0x30
114 /* LZSS */
115 #define COMPRESS_METHOD_FASTEST 0x31
116 #define COMPRESS_METHOD_FAST    0x32
117 #define COMPRESS_METHOD_NORMAL  0x33
118 /* PPMd Variant H */
119 #define COMPRESS_METHOD_GOOD    0x34
120 #define COMPRESS_METHOD_BEST    0x35
121 
122 #define CRC_POLYNOMIAL 0xEDB88320
123 
124 #define NS_UNIT 10000000
125 
126 #define DICTIONARY_MAX_SIZE 0x400000
127 
128 #define MAINCODE_SIZE      299
129 #define OFFSETCODE_SIZE    60
130 #define LOWOFFSETCODE_SIZE 17
131 #define LENGTHCODE_SIZE    28
132 #define HUFFMAN_TABLE_SIZE \
133   MAINCODE_SIZE + OFFSETCODE_SIZE + LOWOFFSETCODE_SIZE + LENGTHCODE_SIZE
134 
135 #define MAX_SYMBOL_LENGTH 0xF
136 #define MAX_SYMBOLS       20
137 
138 /*
139  * Considering L1,L2 cache miss and a calling of write system-call,
140  * the best size of the output buffer(uncompressed buffer) is 128K.
141  * If the structure of extracting process is changed, this value
142  * might be researched again.
143  */
144 #define UNP_BUFFER_SIZE   (128 * 1024)
145 
146 /* Define this here for non-Windows platforms */
147 #if !((defined(__WIN32__) || defined(_WIN32) || defined(__WIN32)) && !defined(__CYGWIN__))
148 #define FILE_ATTRIBUTE_DIRECTORY 0x10
149 #endif
150 
151 #undef minimum
152 #define minimum(a, b)	((a)<(b)?(a):(b))
153 
154 /* Fields common to all headers */
155 struct rar_header
156 {
157   char crc[2];
158   char type;
159   char flags[2];
160   char size[2];
161 };
162 
163 /* Fields common to all file headers */
164 struct rar_file_header
165 {
166   char pack_size[4];
167   char unp_size[4];
168   char host_os;
169   char file_crc[4];
170   char file_time[4];
171   char unp_ver;
172   char method;
173   char name_size[2];
174   char file_attr[4];
175 };
176 
177 struct huffman_tree_node
178 {
179   int branches[2];
180 };
181 
182 struct huffman_table_entry
183 {
184   unsigned int length;
185   int value;
186 };
187 
188 struct huffman_code
189 {
190   struct huffman_tree_node *tree;
191   int numentries;
192   int numallocatedentries;
193   int minlength;
194   int maxlength;
195   int tablesize;
196   struct huffman_table_entry *table;
197 };
198 
199 struct lzss
200 {
201   unsigned char *window;
202   int mask;
203   int64_t position;
204 };
205 
206 struct data_block_offsets
207 {
208   int64_t header_size;
209   int64_t start_offset;
210   int64_t end_offset;
211 };
212 
213 struct rar
214 {
215   /* Entries from main RAR header */
216   unsigned main_flags;
217   unsigned long file_crc;
218   char reserved1[2];
219   char reserved2[4];
220   char encryptver;
221 
222   /* File header entries */
223   char compression_method;
224   unsigned file_flags;
225   int64_t packed_size;
226   int64_t unp_size;
227   time_t mtime;
228   long mnsec;
229   mode_t mode;
230   char *filename;
231   char *filename_save;
232   size_t filename_save_size;
233   size_t filename_allocated;
234 
235   /* File header optional entries */
236   char salt[8];
237   time_t atime;
238   long ansec;
239   time_t ctime;
240   long cnsec;
241   time_t arctime;
242   long arcnsec;
243 
244   /* Fields to help with tracking decompression of files. */
245   int64_t bytes_unconsumed;
246   int64_t bytes_remaining;
247   int64_t bytes_uncopied;
248   int64_t offset;
249   int64_t offset_outgoing;
250   int64_t offset_seek;
251   char valid;
252   unsigned int unp_offset;
253   unsigned int unp_buffer_size;
254   unsigned char *unp_buffer;
255   unsigned int dictionary_size;
256   char start_new_block;
257   char entry_eof;
258   unsigned long crc_calculated;
259   int found_first_header;
260   char has_endarc_header;
261   struct data_block_offsets *dbo;
262   unsigned int cursor;
263   unsigned int nodes;
264   char filename_must_match;
265 
266   /* LZSS members */
267   struct huffman_code maincode;
268   struct huffman_code offsetcode;
269   struct huffman_code lowoffsetcode;
270   struct huffman_code lengthcode;
271   unsigned char lengthtable[HUFFMAN_TABLE_SIZE];
272   struct lzss lzss;
273   char output_last_match;
274   unsigned int lastlength;
275   unsigned int lastoffset;
276   unsigned int oldoffset[4];
277   unsigned int lastlowoffset;
278   unsigned int numlowoffsetrepeats;
279   int64_t filterstart;
280   char start_new_table;
281 
282   /* PPMd Variant H members */
283   char ppmd_valid;
284   char ppmd_eod;
285   char is_ppmd_block;
286   int ppmd_escape;
287   CPpmd7 ppmd7_context;
288   CPpmd7z_RangeDec range_dec;
289   IByteIn bytein;
290 
291   /*
292    * String conversion object.
293    */
294   int init_default_conversion;
295   struct archive_string_conv *sconv_default;
296   struct archive_string_conv *opt_sconv;
297   struct archive_string_conv *sconv_utf8;
298   struct archive_string_conv *sconv_utf16be;
299 
300   /*
301    * Bit stream reader.
302    */
303   struct rar_br {
304 #define CACHE_TYPE	uint64_t
305 #define CACHE_BITS	(8 * sizeof(CACHE_TYPE))
306     /* Cache buffer. */
307     CACHE_TYPE		 cache_buffer;
308     /* Indicates how many bits avail in cache_buffer. */
309     int			 cache_avail;
310     ssize_t		 avail_in;
311     const unsigned char *next_in;
312   } br;
313 
314   /*
315    * Custom field to denote that this archive contains encrypted entries
316    */
317   int has_encrypted_entries;
318 };
319 
320 static int archive_read_support_format_rar_capabilities(struct archive_read *);
321 static int archive_read_format_rar_has_encrypted_entries(struct archive_read *);
322 static int archive_read_format_rar_bid(struct archive_read *, int);
323 static int archive_read_format_rar_options(struct archive_read *,
324     const char *, const char *);
325 static int archive_read_format_rar_read_header(struct archive_read *,
326     struct archive_entry *);
327 static int archive_read_format_rar_read_data(struct archive_read *,
328     const void **, size_t *, int64_t *);
329 static int archive_read_format_rar_read_data_skip(struct archive_read *a);
330 static int64_t archive_read_format_rar_seek_data(struct archive_read *, int64_t,
331     int);
332 static int archive_read_format_rar_cleanup(struct archive_read *);
333 
334 /* Support functions */
335 static int read_header(struct archive_read *, struct archive_entry *, char);
336 static time_t get_time(int);
337 static int read_exttime(const char *, struct rar *, const char *);
338 static int read_symlink_stored(struct archive_read *, struct archive_entry *,
339                                struct archive_string_conv *);
340 static int read_data_stored(struct archive_read *, const void **, size_t *,
341                             int64_t *);
342 static int read_data_compressed(struct archive_read *, const void **, size_t *,
343                           int64_t *);
344 static int rar_br_preparation(struct archive_read *, struct rar_br *);
345 static int parse_codes(struct archive_read *);
346 static void free_codes(struct archive_read *);
347 static int read_next_symbol(struct archive_read *, struct huffman_code *);
348 static int create_code(struct archive_read *, struct huffman_code *,
349                         unsigned char *, int, char);
350 static int add_value(struct archive_read *, struct huffman_code *, int, int,
351                      int);
352 static int new_node(struct huffman_code *);
353 static int make_table(struct archive_read *, struct huffman_code *);
354 static int make_table_recurse(struct archive_read *, struct huffman_code *, int,
355                               struct huffman_table_entry *, int, int);
356 static int64_t expand(struct archive_read *, int64_t);
357 static int copy_from_lzss_window(struct archive_read *, const void **,
358                                    int64_t, int);
359 static const void *rar_read_ahead(struct archive_read *, size_t, ssize_t *);
360 
361 /*
362  * Bit stream reader.
363  */
364 /* Check that the cache buffer has enough bits. */
365 #define rar_br_has(br, n) ((br)->cache_avail >= n)
366 /* Get compressed data by bit. */
367 #define rar_br_bits(br, n)        \
368   (((uint32_t)((br)->cache_buffer >>    \
369     ((br)->cache_avail - (n)))) & cache_masks[n])
370 #define rar_br_bits_forced(br, n)     \
371   (((uint32_t)((br)->cache_buffer <<    \
372     ((n) - (br)->cache_avail))) & cache_masks[n])
373 /* Read ahead to make sure the cache buffer has enough compressed data we
374  * will use.
375  *  True  : completed, there is enough data in the cache buffer.
376  *  False : there is no data in the stream. */
377 #define rar_br_read_ahead(a, br, n) \
378   ((rar_br_has(br, (n)) || rar_br_fillup(a, br)) || rar_br_has(br, (n)))
379 /* Notify how many bits we consumed. */
380 #define rar_br_consume(br, n) ((br)->cache_avail -= (n))
381 #define rar_br_consume_unalined_bits(br) ((br)->cache_avail &= ~7)
382 
383 static const uint32_t cache_masks[] = {
384   0x00000000, 0x00000001, 0x00000003, 0x00000007,
385   0x0000000F, 0x0000001F, 0x0000003F, 0x0000007F,
386   0x000000FF, 0x000001FF, 0x000003FF, 0x000007FF,
387   0x00000FFF, 0x00001FFF, 0x00003FFF, 0x00007FFF,
388   0x0000FFFF, 0x0001FFFF, 0x0003FFFF, 0x0007FFFF,
389   0x000FFFFF, 0x001FFFFF, 0x003FFFFF, 0x007FFFFF,
390   0x00FFFFFF, 0x01FFFFFF, 0x03FFFFFF, 0x07FFFFFF,
391   0x0FFFFFFF, 0x1FFFFFFF, 0x3FFFFFFF, 0x7FFFFFFF,
392   0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
393 };
394 
395 /*
396  * Shift away used bits in the cache data and fill it up with following bits.
397  * Call this when cache buffer does not have enough bits you need.
398  *
399  * Returns 1 if the cache buffer is full.
400  * Returns 0 if the cache buffer is not full; input buffer is empty.
401  */
402 static int
403 rar_br_fillup(struct archive_read *a, struct rar_br *br)
404 {
405   struct rar *rar = (struct rar *)(a->format->data);
406   int n = CACHE_BITS - br->cache_avail;
407 
408   for (;;) {
409     switch (n >> 3) {
410     case 8:
411       if (br->avail_in >= 8) {
412         br->cache_buffer =
413             ((uint64_t)br->next_in[0]) << 56 |
414             ((uint64_t)br->next_in[1]) << 48 |
415             ((uint64_t)br->next_in[2]) << 40 |
416             ((uint64_t)br->next_in[3]) << 32 |
417             ((uint32_t)br->next_in[4]) << 24 |
418             ((uint32_t)br->next_in[5]) << 16 |
419             ((uint32_t)br->next_in[6]) << 8 |
420              (uint32_t)br->next_in[7];
421         br->next_in += 8;
422         br->avail_in -= 8;
423         br->cache_avail += 8 * 8;
424         rar->bytes_unconsumed += 8;
425         rar->bytes_remaining -= 8;
426         return (1);
427       }
428       break;
429     case 7:
430       if (br->avail_in >= 7) {
431         br->cache_buffer =
432            (br->cache_buffer << 56) |
433             ((uint64_t)br->next_in[0]) << 48 |
434             ((uint64_t)br->next_in[1]) << 40 |
435             ((uint64_t)br->next_in[2]) << 32 |
436             ((uint32_t)br->next_in[3]) << 24 |
437             ((uint32_t)br->next_in[4]) << 16 |
438             ((uint32_t)br->next_in[5]) << 8 |
439              (uint32_t)br->next_in[6];
440         br->next_in += 7;
441         br->avail_in -= 7;
442         br->cache_avail += 7 * 8;
443         rar->bytes_unconsumed += 7;
444         rar->bytes_remaining -= 7;
445         return (1);
446       }
447       break;
448     case 6:
449       if (br->avail_in >= 6) {
450         br->cache_buffer =
451            (br->cache_buffer << 48) |
452             ((uint64_t)br->next_in[0]) << 40 |
453             ((uint64_t)br->next_in[1]) << 32 |
454             ((uint32_t)br->next_in[2]) << 24 |
455             ((uint32_t)br->next_in[3]) << 16 |
456             ((uint32_t)br->next_in[4]) << 8 |
457              (uint32_t)br->next_in[5];
458         br->next_in += 6;
459         br->avail_in -= 6;
460         br->cache_avail += 6 * 8;
461         rar->bytes_unconsumed += 6;
462         rar->bytes_remaining -= 6;
463         return (1);
464       }
465       break;
466     case 0:
467       /* We have enough compressed data in
468        * the cache buffer.*/
469       return (1);
470     default:
471       break;
472     }
473     if (br->avail_in <= 0) {
474 
475       if (rar->bytes_unconsumed > 0) {
476         /* Consume as much as the decompressor
477          * actually used. */
478         __archive_read_consume(a, rar->bytes_unconsumed);
479         rar->bytes_unconsumed = 0;
480       }
481       br->next_in = rar_read_ahead(a, 1, &(br->avail_in));
482       if (br->next_in == NULL)
483         return (0);
484       if (br->avail_in == 0)
485         return (0);
486     }
487     br->cache_buffer =
488        (br->cache_buffer << 8) | *br->next_in++;
489     br->avail_in--;
490     br->cache_avail += 8;
491     n -= 8;
492     rar->bytes_unconsumed++;
493     rar->bytes_remaining--;
494   }
495 }
496 
497 static int
498 rar_br_preparation(struct archive_read *a, struct rar_br *br)
499 {
500   struct rar *rar = (struct rar *)(a->format->data);
501 
502   if (rar->bytes_remaining > 0) {
503     br->next_in = rar_read_ahead(a, 1, &(br->avail_in));
504     if (br->next_in == NULL) {
505       archive_set_error(&a->archive,
506           ARCHIVE_ERRNO_FILE_FORMAT,
507           "Truncated RAR file data");
508       return (ARCHIVE_FATAL);
509     }
510     if (br->cache_avail == 0)
511       (void)rar_br_fillup(a, br);
512   }
513   return (ARCHIVE_OK);
514 }
515 
516 /* Find last bit set */
517 static inline int
518 rar_fls(unsigned int word)
519 {
520   word |= (word >>  1);
521   word |= (word >>  2);
522   word |= (word >>  4);
523   word |= (word >>  8);
524   word |= (word >> 16);
525   return word - (word >> 1);
526 }
527 
528 /* LZSS functions */
529 static inline int64_t
530 lzss_position(struct lzss *lzss)
531 {
532   return lzss->position;
533 }
534 
535 static inline int
536 lzss_mask(struct lzss *lzss)
537 {
538   return lzss->mask;
539 }
540 
541 static inline int
542 lzss_size(struct lzss *lzss)
543 {
544   return lzss->mask + 1;
545 }
546 
547 static inline int
548 lzss_offset_for_position(struct lzss *lzss, int64_t pos)
549 {
550   return (int)(pos & lzss->mask);
551 }
552 
553 static inline unsigned char *
554 lzss_pointer_for_position(struct lzss *lzss, int64_t pos)
555 {
556   return &lzss->window[lzss_offset_for_position(lzss, pos)];
557 }
558 
559 static inline int
560 lzss_current_offset(struct lzss *lzss)
561 {
562   return lzss_offset_for_position(lzss, lzss->position);
563 }
564 
565 static inline uint8_t *
566 lzss_current_pointer(struct lzss *lzss)
567 {
568   return lzss_pointer_for_position(lzss, lzss->position);
569 }
570 
571 static inline void
572 lzss_emit_literal(struct rar *rar, uint8_t literal)
573 {
574   *lzss_current_pointer(&rar->lzss) = literal;
575   rar->lzss.position++;
576 }
577 
578 static inline void
579 lzss_emit_match(struct rar *rar, int offset, int length)
580 {
581   int dstoffs = lzss_current_offset(&rar->lzss);
582   int srcoffs = (dstoffs - offset) & lzss_mask(&rar->lzss);
583   int l, li, remaining;
584   unsigned char *d, *s;
585 
586   remaining = length;
587   while (remaining > 0) {
588     l = remaining;
589     if (dstoffs > srcoffs) {
590       if (l > lzss_size(&rar->lzss) - dstoffs)
591         l = lzss_size(&rar->lzss) - dstoffs;
592     } else {
593       if (l > lzss_size(&rar->lzss) - srcoffs)
594         l = lzss_size(&rar->lzss) - srcoffs;
595     }
596     d = &(rar->lzss.window[dstoffs]);
597     s = &(rar->lzss.window[srcoffs]);
598     if ((dstoffs + l < srcoffs) || (srcoffs + l < dstoffs))
599       memcpy(d, s, l);
600     else {
601       for (li = 0; li < l; li++)
602         d[li] = s[li];
603     }
604     remaining -= l;
605     dstoffs = (dstoffs + l) & lzss_mask(&(rar->lzss));
606     srcoffs = (srcoffs + l) & lzss_mask(&(rar->lzss));
607   }
608   rar->lzss.position += length;
609 }
610 
611 static Byte
612 ppmd_read(void *p)
613 {
614   struct archive_read *a = ((IByteIn*)p)->a;
615   struct rar *rar = (struct rar *)(a->format->data);
616   struct rar_br *br = &(rar->br);
617   Byte b;
618   if (!rar_br_read_ahead(a, br, 8))
619   {
620     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
621                       "Truncated RAR file data");
622     rar->valid = 0;
623     return 0;
624   }
625   b = rar_br_bits(br, 8);
626   rar_br_consume(br, 8);
627   return b;
628 }
629 
630 int
631 archive_read_support_format_rar(struct archive *_a)
632 {
633   struct archive_read *a = (struct archive_read *)_a;
634   struct rar *rar;
635   int r;
636 
637   archive_check_magic(_a, ARCHIVE_READ_MAGIC, ARCHIVE_STATE_NEW,
638                       "archive_read_support_format_rar");
639 
640   rar = (struct rar *)calloc(sizeof(*rar), 1);
641   if (rar == NULL)
642   {
643     archive_set_error(&a->archive, ENOMEM, "Can't allocate rar data");
644     return (ARCHIVE_FATAL);
645   }
646 
647 	/*
648 	 * Until enough data has been read, we cannot tell about
649 	 * any encrypted entries yet.
650 	 */
651 	rar->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
652 
653   r = __archive_read_register_format(a,
654                                      rar,
655                                      "rar",
656                                      archive_read_format_rar_bid,
657                                      archive_read_format_rar_options,
658                                      archive_read_format_rar_read_header,
659                                      archive_read_format_rar_read_data,
660                                      archive_read_format_rar_read_data_skip,
661                                      archive_read_format_rar_seek_data,
662                                      archive_read_format_rar_cleanup,
663                                      archive_read_support_format_rar_capabilities,
664                                      archive_read_format_rar_has_encrypted_entries);
665 
666   if (r != ARCHIVE_OK)
667     free(rar);
668   return (r);
669 }
670 
671 static int
672 archive_read_support_format_rar_capabilities(struct archive_read * a)
673 {
674 	(void)a; /* UNUSED */
675 	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA
676 			| ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
677 }
678 
679 static int
680 archive_read_format_rar_has_encrypted_entries(struct archive_read *_a)
681 {
682 	if (_a && _a->format) {
683 		struct rar * rar = (struct rar *)_a->format->data;
684 		if (rar) {
685 			return rar->has_encrypted_entries;
686 		}
687 	}
688 	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
689 }
690 
691 
692 static int
693 archive_read_format_rar_bid(struct archive_read *a, int best_bid)
694 {
695   const char *p;
696 
697   /* If there's already a bid > 30, we'll never win. */
698   if (best_bid > 30)
699 	  return (-1);
700 
701   if ((p = __archive_read_ahead(a, 7, NULL)) == NULL)
702     return (-1);
703 
704   if (memcmp(p, RAR_SIGNATURE, 7) == 0)
705     return (30);
706 
707   if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
708     /* This is a PE file */
709     ssize_t offset = 0x10000;
710     ssize_t window = 4096;
711     ssize_t bytes_avail;
712     while (offset + window <= (1024 * 128)) {
713       const char *buff = __archive_read_ahead(a, offset + window, &bytes_avail);
714       if (buff == NULL) {
715         /* Remaining bytes are less than window. */
716         window >>= 1;
717         if (window < 0x40)
718           return (0);
719         continue;
720       }
721       p = buff + offset;
722       while (p + 7 < buff + bytes_avail) {
723         if (memcmp(p, RAR_SIGNATURE, 7) == 0)
724           return (30);
725         p += 0x10;
726       }
727       offset = p - buff;
728     }
729   }
730   return (0);
731 }
732 
733 static int
734 skip_sfx(struct archive_read *a)
735 {
736   const void *h;
737   const char *p, *q;
738   size_t skip, total;
739   ssize_t bytes, window;
740 
741   total = 0;
742   window = 4096;
743   while (total + window <= (1024 * 128)) {
744     h = __archive_read_ahead(a, window, &bytes);
745     if (h == NULL) {
746       /* Remaining bytes are less than window. */
747       window >>= 1;
748       if (window < 0x40)
749       	goto fatal;
750       continue;
751     }
752     if (bytes < 0x40)
753       goto fatal;
754     p = h;
755     q = p + bytes;
756 
757     /*
758      * Scan ahead until we find something that looks
759      * like the RAR header.
760      */
761     while (p + 7 < q) {
762       if (memcmp(p, RAR_SIGNATURE, 7) == 0) {
763       	skip = p - (const char *)h;
764       	__archive_read_consume(a, skip);
765       	return (ARCHIVE_OK);
766       }
767       p += 0x10;
768     }
769     skip = p - (const char *)h;
770     __archive_read_consume(a, skip);
771 	total += skip;
772   }
773 fatal:
774   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
775       "Couldn't find out RAR header");
776   return (ARCHIVE_FATAL);
777 }
778 
779 static int
780 archive_read_format_rar_options(struct archive_read *a,
781     const char *key, const char *val)
782 {
783   struct rar *rar;
784   int ret = ARCHIVE_FAILED;
785 
786   rar = (struct rar *)(a->format->data);
787   if (strcmp(key, "hdrcharset")  == 0) {
788     if (val == NULL || val[0] == 0)
789       archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
790           "rar: hdrcharset option needs a character-set name");
791     else {
792       rar->opt_sconv =
793           archive_string_conversion_from_charset(
794               &a->archive, val, 0);
795       if (rar->opt_sconv != NULL)
796         ret = ARCHIVE_OK;
797       else
798         ret = ARCHIVE_FATAL;
799     }
800     return (ret);
801   }
802 
803   /* Note: The "warn" return is just to inform the options
804    * supervisor that we didn't handle it.  It will generate
805    * a suitable error if no one used this option. */
806   return (ARCHIVE_WARN);
807 }
808 
809 static int
810 archive_read_format_rar_read_header(struct archive_read *a,
811                                     struct archive_entry *entry)
812 {
813   const void *h;
814   const char *p;
815   struct rar *rar;
816   size_t skip;
817   char head_type;
818   int ret;
819   unsigned flags;
820   unsigned long crc32_expected;
821 
822   a->archive.archive_format = ARCHIVE_FORMAT_RAR;
823   if (a->archive.archive_format_name == NULL)
824     a->archive.archive_format_name = "RAR";
825 
826   rar = (struct rar *)(a->format->data);
827 
828   /*
829    * It should be sufficient to call archive_read_next_header() for
830    * a reader to determine if an entry is encrypted or not. If the
831    * encryption of an entry is only detectable when calling
832    * archive_read_data(), so be it. We'll do the same check there
833    * as well.
834    */
835   if (rar->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
836 	  rar->has_encrypted_entries = 0;
837   }
838 
839   /* RAR files can be generated without EOF headers, so return ARCHIVE_EOF if
840   * this fails.
841   */
842   if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
843     return (ARCHIVE_EOF);
844 
845   p = h;
846   if (rar->found_first_header == 0 &&
847      ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0)) {
848     /* This is an executable ? Must be self-extracting... */
849     ret = skip_sfx(a);
850     if (ret < ARCHIVE_WARN)
851       return (ret);
852   }
853   rar->found_first_header = 1;
854 
855   while (1)
856   {
857     unsigned long crc32_val;
858 
859     if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
860       return (ARCHIVE_FATAL);
861     p = h;
862 
863     head_type = p[2];
864     switch(head_type)
865     {
866     case MARK_HEAD:
867       if (memcmp(p, RAR_SIGNATURE, 7) != 0) {
868         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
869           "Invalid marker header");
870         return (ARCHIVE_FATAL);
871       }
872       __archive_read_consume(a, 7);
873       break;
874 
875     case MAIN_HEAD:
876       rar->main_flags = archive_le16dec(p + 3);
877       skip = archive_le16dec(p + 5);
878       if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)) {
879         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
880           "Invalid header size");
881         return (ARCHIVE_FATAL);
882       }
883       if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
884         return (ARCHIVE_FATAL);
885       p = h;
886       memcpy(rar->reserved1, p + 7, sizeof(rar->reserved1));
887       memcpy(rar->reserved2, p + 7 + sizeof(rar->reserved1),
888              sizeof(rar->reserved2));
889       if (rar->main_flags & MHD_ENCRYPTVER) {
890         if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)+1) {
891           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
892             "Invalid header size");
893           return (ARCHIVE_FATAL);
894         }
895         rar->encryptver = *(p + 7 + sizeof(rar->reserved1) +
896                             sizeof(rar->reserved2));
897       }
898 
899       /* Main header is password encrypted, so we cannot read any
900          file names or any other info about files from the header. */
901       if (rar->main_flags & MHD_PASSWORD)
902       {
903         archive_entry_set_is_metadata_encrypted(entry, 1);
904         archive_entry_set_is_data_encrypted(entry, 1);
905         rar->has_encrypted_entries = 1;
906          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
907                           "RAR encryption support unavailable.");
908         return (ARCHIVE_FATAL);
909       }
910 
911       crc32_val = crc32(0, (const unsigned char *)p + 2, (unsigned)skip - 2);
912       if ((crc32_val & 0xffff) != archive_le16dec(p)) {
913         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
914           "Header CRC error");
915         return (ARCHIVE_FATAL);
916       }
917       __archive_read_consume(a, skip);
918       break;
919 
920     case FILE_HEAD:
921       return read_header(a, entry, head_type);
922 
923     case COMM_HEAD:
924     case AV_HEAD:
925     case SUB_HEAD:
926     case PROTECT_HEAD:
927     case SIGN_HEAD:
928     case ENDARC_HEAD:
929       flags = archive_le16dec(p + 3);
930       skip = archive_le16dec(p + 5);
931       if (skip < 7) {
932         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
933           "Invalid header size too small");
934         return (ARCHIVE_FATAL);
935       }
936       if (flags & HD_ADD_SIZE_PRESENT)
937       {
938         if (skip < 7 + 4) {
939           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
940             "Invalid header size too small");
941           return (ARCHIVE_FATAL);
942         }
943         if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
944           return (ARCHIVE_FATAL);
945         p = h;
946         skip += archive_le32dec(p + 7);
947       }
948 
949       /* Skip over the 2-byte CRC at the beginning of the header. */
950       crc32_expected = archive_le16dec(p);
951       __archive_read_consume(a, 2);
952       skip -= 2;
953 
954       /* Skim the entire header and compute the CRC. */
955       crc32_val = 0;
956       while (skip > 0) {
957 	      size_t to_read = skip;
958 	      ssize_t did_read;
959 	      if (to_read > 32 * 1024) {
960 		      to_read = 32 * 1024;
961 	      }
962 	      if ((h = __archive_read_ahead(a, to_read, &did_read)) == NULL) {
963 		      return (ARCHIVE_FATAL);
964 	      }
965 	      p = h;
966 	      crc32_val = crc32(crc32_val, (const unsigned char *)p, (unsigned)did_read);
967 	      __archive_read_consume(a, did_read);
968 	      skip -= did_read;
969       }
970       if ((crc32_val & 0xffff) != crc32_expected) {
971 	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
972 		  "Header CRC error");
973 	      return (ARCHIVE_FATAL);
974       }
975       if (head_type == ENDARC_HEAD)
976 	      return (ARCHIVE_EOF);
977       break;
978 
979     case NEWSUB_HEAD:
980       if ((ret = read_header(a, entry, head_type)) < ARCHIVE_WARN)
981         return ret;
982       break;
983 
984     default:
985       archive_set_error(&a->archive,  ARCHIVE_ERRNO_FILE_FORMAT,
986                         "Bad RAR file");
987       return (ARCHIVE_FATAL);
988     }
989   }
990 }
991 
992 static int
993 archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
994                                   size_t *size, int64_t *offset)
995 {
996   struct rar *rar = (struct rar *)(a->format->data);
997   int ret;
998 
999   if (rar->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
1000 	  rar->has_encrypted_entries = 0;
1001   }
1002 
1003   if (rar->bytes_unconsumed > 0) {
1004       /* Consume as much as the decompressor actually used. */
1005       __archive_read_consume(a, rar->bytes_unconsumed);
1006       rar->bytes_unconsumed = 0;
1007   }
1008 
1009   *buff = NULL;
1010   if (rar->entry_eof || rar->offset_seek >= rar->unp_size) {
1011     *size = 0;
1012     *offset = rar->offset;
1013     if (*offset < rar->unp_size)
1014       *offset = rar->unp_size;
1015     return (ARCHIVE_EOF);
1016   }
1017 
1018   switch (rar->compression_method)
1019   {
1020   case COMPRESS_METHOD_STORE:
1021     ret = read_data_stored(a, buff, size, offset);
1022     break;
1023 
1024   case COMPRESS_METHOD_FASTEST:
1025   case COMPRESS_METHOD_FAST:
1026   case COMPRESS_METHOD_NORMAL:
1027   case COMPRESS_METHOD_GOOD:
1028   case COMPRESS_METHOD_BEST:
1029     ret = read_data_compressed(a, buff, size, offset);
1030     if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
1031       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1032       rar->start_new_table = 1;
1033       rar->ppmd_valid = 0;
1034     }
1035     break;
1036 
1037   default:
1038     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1039                       "Unsupported compression method for RAR file.");
1040     ret = ARCHIVE_FATAL;
1041     break;
1042   }
1043   return (ret);
1044 }
1045 
1046 static int
1047 archive_read_format_rar_read_data_skip(struct archive_read *a)
1048 {
1049   struct rar *rar;
1050   int64_t bytes_skipped;
1051   int ret;
1052 
1053   rar = (struct rar *)(a->format->data);
1054 
1055   if (rar->bytes_unconsumed > 0) {
1056       /* Consume as much as the decompressor actually used. */
1057       __archive_read_consume(a, rar->bytes_unconsumed);
1058       rar->bytes_unconsumed = 0;
1059   }
1060 
1061   if (rar->bytes_remaining > 0) {
1062     bytes_skipped = __archive_read_consume(a, rar->bytes_remaining);
1063     if (bytes_skipped < 0)
1064       return (ARCHIVE_FATAL);
1065   }
1066 
1067   /* Compressed data to skip must be read from each header in a multivolume
1068    * archive.
1069    */
1070   if (rar->main_flags & MHD_VOLUME && rar->file_flags & FHD_SPLIT_AFTER)
1071   {
1072     ret = archive_read_format_rar_read_header(a, a->entry);
1073     if (ret == (ARCHIVE_EOF))
1074       ret = archive_read_format_rar_read_header(a, a->entry);
1075     if (ret != (ARCHIVE_OK))
1076       return ret;
1077     return archive_read_format_rar_read_data_skip(a);
1078   }
1079 
1080   return (ARCHIVE_OK);
1081 }
1082 
1083 static int64_t
1084 archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
1085     int whence)
1086 {
1087   int64_t client_offset, ret;
1088   unsigned int i;
1089   struct rar *rar = (struct rar *)(a->format->data);
1090 
1091   if (rar->compression_method == COMPRESS_METHOD_STORE)
1092   {
1093     /* Modify the offset for use with SEEK_SET */
1094     switch (whence)
1095     {
1096       case SEEK_CUR:
1097         client_offset = rar->offset_seek;
1098         break;
1099       case SEEK_END:
1100         client_offset = rar->unp_size;
1101         break;
1102       case SEEK_SET:
1103       default:
1104         client_offset = 0;
1105     }
1106     client_offset += offset;
1107     if (client_offset < 0)
1108     {
1109       /* Can't seek past beginning of data block */
1110       return -1;
1111     }
1112     else if (client_offset > rar->unp_size)
1113     {
1114       /*
1115        * Set the returned offset but only seek to the end of
1116        * the data block.
1117        */
1118       rar->offset_seek = client_offset;
1119       client_offset = rar->unp_size;
1120     }
1121 
1122     client_offset += rar->dbo[0].start_offset;
1123     i = 0;
1124     while (i < rar->cursor)
1125     {
1126       i++;
1127       client_offset += rar->dbo[i].start_offset - rar->dbo[i-1].end_offset;
1128     }
1129     if (rar->main_flags & MHD_VOLUME)
1130     {
1131       /* Find the appropriate offset among the multivolume archive */
1132       while (1)
1133       {
1134         if (client_offset < rar->dbo[rar->cursor].start_offset &&
1135           rar->file_flags & FHD_SPLIT_BEFORE)
1136         {
1137           /* Search backwards for the correct data block */
1138           if (rar->cursor == 0)
1139           {
1140             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1141               "Attempt to seek past beginning of RAR data block");
1142             return (ARCHIVE_FAILED);
1143           }
1144           rar->cursor--;
1145           client_offset -= rar->dbo[rar->cursor+1].start_offset -
1146             rar->dbo[rar->cursor].end_offset;
1147           if (client_offset < rar->dbo[rar->cursor].start_offset)
1148             continue;
1149           ret = __archive_read_seek(a, rar->dbo[rar->cursor].start_offset -
1150             rar->dbo[rar->cursor].header_size, SEEK_SET);
1151           if (ret < (ARCHIVE_OK))
1152             return ret;
1153           ret = archive_read_format_rar_read_header(a, a->entry);
1154           if (ret != (ARCHIVE_OK))
1155           {
1156             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1157               "Error during seek of RAR file");
1158             return (ARCHIVE_FAILED);
1159           }
1160           rar->cursor--;
1161           break;
1162         }
1163         else if (client_offset > rar->dbo[rar->cursor].end_offset &&
1164           rar->file_flags & FHD_SPLIT_AFTER)
1165         {
1166           /* Search forward for the correct data block */
1167           rar->cursor++;
1168           if (rar->cursor < rar->nodes &&
1169             client_offset > rar->dbo[rar->cursor].end_offset)
1170           {
1171             client_offset += rar->dbo[rar->cursor].start_offset -
1172               rar->dbo[rar->cursor-1].end_offset;
1173             continue;
1174           }
1175           rar->cursor--;
1176           ret = __archive_read_seek(a, rar->dbo[rar->cursor].end_offset,
1177                                     SEEK_SET);
1178           if (ret < (ARCHIVE_OK))
1179             return ret;
1180           ret = archive_read_format_rar_read_header(a, a->entry);
1181           if (ret == (ARCHIVE_EOF))
1182           {
1183             rar->has_endarc_header = 1;
1184             ret = archive_read_format_rar_read_header(a, a->entry);
1185           }
1186           if (ret != (ARCHIVE_OK))
1187           {
1188             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1189               "Error during seek of RAR file");
1190             return (ARCHIVE_FAILED);
1191           }
1192           client_offset += rar->dbo[rar->cursor].start_offset -
1193             rar->dbo[rar->cursor-1].end_offset;
1194           continue;
1195         }
1196         break;
1197       }
1198     }
1199 
1200     ret = __archive_read_seek(a, client_offset, SEEK_SET);
1201     if (ret < (ARCHIVE_OK))
1202       return ret;
1203     rar->bytes_remaining = rar->dbo[rar->cursor].end_offset - ret;
1204     i = rar->cursor;
1205     while (i > 0)
1206     {
1207       i--;
1208       ret -= rar->dbo[i+1].start_offset - rar->dbo[i].end_offset;
1209     }
1210     ret -= rar->dbo[0].start_offset;
1211 
1212     /* Always restart reading the file after a seek */
1213     __archive_reset_read_data(&a->archive);
1214 
1215     rar->bytes_unconsumed = 0;
1216     rar->offset = 0;
1217 
1218     /*
1219      * If a seek past the end of file was requested, return the requested
1220      * offset.
1221      */
1222     if (ret == rar->unp_size && rar->offset_seek > rar->unp_size)
1223       return rar->offset_seek;
1224 
1225     /* Return the new offset */
1226     rar->offset_seek = ret;
1227     return rar->offset_seek;
1228   }
1229   else
1230   {
1231     archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1232       "Seeking of compressed RAR files is unsupported");
1233   }
1234   return (ARCHIVE_FAILED);
1235 }
1236 
1237 static int
1238 archive_read_format_rar_cleanup(struct archive_read *a)
1239 {
1240   struct rar *rar;
1241 
1242   rar = (struct rar *)(a->format->data);
1243   free_codes(a);
1244   free(rar->filename);
1245   free(rar->filename_save);
1246   free(rar->dbo);
1247   free(rar->unp_buffer);
1248   free(rar->lzss.window);
1249   __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1250   free(rar);
1251   (a->format->data) = NULL;
1252   return (ARCHIVE_OK);
1253 }
1254 
1255 static int
1256 read_header(struct archive_read *a, struct archive_entry *entry,
1257             char head_type)
1258 {
1259   const void *h;
1260   const char *p, *endp;
1261   struct rar *rar;
1262   struct rar_header rar_header;
1263   struct rar_file_header file_header;
1264   int64_t header_size;
1265   unsigned filename_size, end;
1266   char *filename;
1267   char *strp;
1268   char packed_size[8];
1269   char unp_size[8];
1270   int ttime;
1271   struct archive_string_conv *sconv, *fn_sconv;
1272   unsigned long crc32_val;
1273   int ret = (ARCHIVE_OK), ret2;
1274 
1275   rar = (struct rar *)(a->format->data);
1276 
1277   /* Setup a string conversion object for non-rar-unicode filenames. */
1278   sconv = rar->opt_sconv;
1279   if (sconv == NULL) {
1280     if (!rar->init_default_conversion) {
1281       rar->sconv_default =
1282           archive_string_default_conversion_for_read(
1283             &(a->archive));
1284       rar->init_default_conversion = 1;
1285     }
1286     sconv = rar->sconv_default;
1287   }
1288 
1289 
1290   if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
1291     return (ARCHIVE_FATAL);
1292   p = h;
1293   memcpy(&rar_header, p, sizeof(rar_header));
1294   rar->file_flags = archive_le16dec(rar_header.flags);
1295   header_size = archive_le16dec(rar_header.size);
1296   if (header_size < (int64_t)sizeof(file_header) + 7) {
1297     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1298       "Invalid header size");
1299     return (ARCHIVE_FATAL);
1300   }
1301   crc32_val = crc32(0, (const unsigned char *)p + 2, 7 - 2);
1302   __archive_read_consume(a, 7);
1303 
1304   if (!(rar->file_flags & FHD_SOLID))
1305   {
1306     rar->compression_method = 0;
1307     rar->packed_size = 0;
1308     rar->unp_size = 0;
1309     rar->mtime = 0;
1310     rar->ctime = 0;
1311     rar->atime = 0;
1312     rar->arctime = 0;
1313     rar->mode = 0;
1314     memset(&rar->salt, 0, sizeof(rar->salt));
1315     rar->atime = 0;
1316     rar->ansec = 0;
1317     rar->ctime = 0;
1318     rar->cnsec = 0;
1319     rar->mtime = 0;
1320     rar->mnsec = 0;
1321     rar->arctime = 0;
1322     rar->arcnsec = 0;
1323   }
1324   else
1325   {
1326     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1327                       "RAR solid archive support unavailable.");
1328     return (ARCHIVE_FATAL);
1329   }
1330 
1331   if ((h = __archive_read_ahead(a, (size_t)header_size - 7, NULL)) == NULL)
1332     return (ARCHIVE_FATAL);
1333 
1334   /* File Header CRC check. */
1335   crc32_val = crc32(crc32_val, h, (unsigned)(header_size - 7));
1336   if ((crc32_val & 0xffff) != archive_le16dec(rar_header.crc)) {
1337     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1338       "Header CRC error");
1339     return (ARCHIVE_FATAL);
1340   }
1341   /* If no CRC error, Go on parsing File Header. */
1342   p = h;
1343   endp = p + header_size - 7;
1344   memcpy(&file_header, p, sizeof(file_header));
1345   p += sizeof(file_header);
1346 
1347   rar->compression_method = file_header.method;
1348 
1349   ttime = archive_le32dec(file_header.file_time);
1350   rar->mtime = get_time(ttime);
1351 
1352   rar->file_crc = archive_le32dec(file_header.file_crc);
1353 
1354   if (rar->file_flags & FHD_PASSWORD)
1355   {
1356 	archive_entry_set_is_data_encrypted(entry, 1);
1357 	rar->has_encrypted_entries = 1;
1358     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1359                       "RAR encryption support unavailable.");
1360     /* Since it is only the data part itself that is encrypted we can at least
1361        extract information about the currently processed entry and don't need
1362        to return ARCHIVE_FATAL here. */
1363     /*return (ARCHIVE_FATAL);*/
1364   }
1365 
1366   if (rar->file_flags & FHD_LARGE)
1367   {
1368     memcpy(packed_size, file_header.pack_size, 4);
1369     memcpy(packed_size + 4, p, 4); /* High pack size */
1370     p += 4;
1371     memcpy(unp_size, file_header.unp_size, 4);
1372     memcpy(unp_size + 4, p, 4); /* High unpack size */
1373     p += 4;
1374     rar->packed_size = archive_le64dec(&packed_size);
1375     rar->unp_size = archive_le64dec(&unp_size);
1376   }
1377   else
1378   {
1379     rar->packed_size = archive_le32dec(file_header.pack_size);
1380     rar->unp_size = archive_le32dec(file_header.unp_size);
1381   }
1382 
1383   if (rar->packed_size < 0 || rar->unp_size < 0)
1384   {
1385     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1386                       "Invalid sizes specified.");
1387     return (ARCHIVE_FATAL);
1388   }
1389 
1390   rar->bytes_remaining = rar->packed_size;
1391 
1392   /* TODO: RARv3 subblocks contain comments. For now the complete block is
1393    * consumed at the end.
1394    */
1395   if (head_type == NEWSUB_HEAD) {
1396     size_t distance = p - (const char *)h;
1397     header_size += rar->packed_size;
1398     /* Make sure we have the extended data. */
1399     if ((h = __archive_read_ahead(a, (size_t)header_size - 7, NULL)) == NULL)
1400         return (ARCHIVE_FATAL);
1401     p = h;
1402     endp = p + header_size - 7;
1403     p += distance;
1404   }
1405 
1406   filename_size = archive_le16dec(file_header.name_size);
1407   if (p + filename_size > endp) {
1408     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1409       "Invalid filename size");
1410     return (ARCHIVE_FATAL);
1411   }
1412   if (rar->filename_allocated < filename_size * 2 + 2) {
1413     char *newptr;
1414     size_t newsize = filename_size * 2 + 2;
1415     newptr = realloc(rar->filename, newsize);
1416     if (newptr == NULL) {
1417       archive_set_error(&a->archive, ENOMEM,
1418                         "Couldn't allocate memory.");
1419       return (ARCHIVE_FATAL);
1420     }
1421     rar->filename = newptr;
1422     rar->filename_allocated = newsize;
1423   }
1424   filename = rar->filename;
1425   memcpy(filename, p, filename_size);
1426   filename[filename_size] = '\0';
1427   if (rar->file_flags & FHD_UNICODE)
1428   {
1429     if (filename_size != strlen(filename))
1430     {
1431       unsigned char highbyte, flagbits, flagbyte;
1432       unsigned fn_end, offset;
1433 
1434       end = filename_size;
1435       fn_end = filename_size * 2;
1436       filename_size = 0;
1437       offset = (unsigned)strlen(filename) + 1;
1438       highbyte = *(p + offset++);
1439       flagbits = 0;
1440       flagbyte = 0;
1441       while (offset < end && filename_size < fn_end)
1442       {
1443         if (!flagbits)
1444         {
1445           flagbyte = *(p + offset++);
1446           flagbits = 8;
1447         }
1448 
1449         flagbits -= 2;
1450         switch((flagbyte >> flagbits) & 3)
1451         {
1452           case 0:
1453             filename[filename_size++] = '\0';
1454             filename[filename_size++] = *(p + offset++);
1455             break;
1456           case 1:
1457             filename[filename_size++] = highbyte;
1458             filename[filename_size++] = *(p + offset++);
1459             break;
1460           case 2:
1461             filename[filename_size++] = *(p + offset + 1);
1462             filename[filename_size++] = *(p + offset);
1463             offset += 2;
1464             break;
1465           case 3:
1466           {
1467             char extra, high;
1468             uint8_t length = *(p + offset++);
1469 
1470             if (length & 0x80) {
1471               extra = *(p + offset++);
1472               high = (char)highbyte;
1473             } else
1474               extra = high = 0;
1475             length = (length & 0x7f) + 2;
1476             while (length && filename_size < fn_end) {
1477               unsigned cp = filename_size >> 1;
1478               filename[filename_size++] = high;
1479               filename[filename_size++] = p[cp] + extra;
1480               length--;
1481             }
1482           }
1483           break;
1484         }
1485       }
1486       if (filename_size > fn_end) {
1487         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1488           "Invalid filename");
1489         return (ARCHIVE_FATAL);
1490       }
1491       filename[filename_size++] = '\0';
1492       /*
1493        * Do not increment filename_size here as the computations below
1494        * add the space for the terminating NUL explicitly.
1495        */
1496       filename[filename_size] = '\0';
1497 
1498       /* Decoded unicode form is UTF-16BE, so we have to update a string
1499        * conversion object for it. */
1500       if (rar->sconv_utf16be == NULL) {
1501         rar->sconv_utf16be = archive_string_conversion_from_charset(
1502            &a->archive, "UTF-16BE", 1);
1503         if (rar->sconv_utf16be == NULL)
1504           return (ARCHIVE_FATAL);
1505       }
1506       fn_sconv = rar->sconv_utf16be;
1507 
1508       strp = filename;
1509       while (memcmp(strp, "\x00\x00", 2))
1510       {
1511         if (!memcmp(strp, "\x00\\", 2))
1512           *(strp + 1) = '/';
1513         strp += 2;
1514       }
1515       p += offset;
1516     } else {
1517       /*
1518        * If FHD_UNICODE is set but no unicode data, this file name form
1519        * is UTF-8, so we have to update a string conversion object for
1520        * it accordingly.
1521        */
1522       if (rar->sconv_utf8 == NULL) {
1523         rar->sconv_utf8 = archive_string_conversion_from_charset(
1524            &a->archive, "UTF-8", 1);
1525         if (rar->sconv_utf8 == NULL)
1526           return (ARCHIVE_FATAL);
1527       }
1528       fn_sconv = rar->sconv_utf8;
1529       while ((strp = strchr(filename, '\\')) != NULL)
1530         *strp = '/';
1531       p += filename_size;
1532     }
1533   }
1534   else
1535   {
1536     fn_sconv = sconv;
1537     while ((strp = strchr(filename, '\\')) != NULL)
1538       *strp = '/';
1539     p += filename_size;
1540   }
1541 
1542   /* Split file in multivolume RAR. No more need to process header. */
1543   if (rar->filename_save &&
1544     filename_size == rar->filename_save_size &&
1545     !memcmp(rar->filename, rar->filename_save, filename_size + 1))
1546   {
1547     __archive_read_consume(a, header_size - 7);
1548     rar->cursor++;
1549     if (rar->cursor >= rar->nodes)
1550     {
1551       rar->nodes++;
1552       if ((rar->dbo =
1553         realloc(rar->dbo, sizeof(*rar->dbo) * rar->nodes)) == NULL)
1554       {
1555         archive_set_error(&a->archive, ENOMEM, "Couldn't allocate memory.");
1556         return (ARCHIVE_FATAL);
1557       }
1558       rar->dbo[rar->cursor].header_size = header_size;
1559       rar->dbo[rar->cursor].start_offset = -1;
1560       rar->dbo[rar->cursor].end_offset = -1;
1561     }
1562     if (rar->dbo[rar->cursor].start_offset < 0)
1563     {
1564       rar->dbo[rar->cursor].start_offset = a->filter->position;
1565       rar->dbo[rar->cursor].end_offset = rar->dbo[rar->cursor].start_offset +
1566         rar->packed_size;
1567     }
1568     return ret;
1569   }
1570   else if (rar->filename_must_match)
1571   {
1572     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1573       "Mismatch of file parts split across multi-volume archive");
1574     return (ARCHIVE_FATAL);
1575   }
1576 
1577   rar->filename_save = (char*)realloc(rar->filename_save,
1578                                       filename_size + 1);
1579   memcpy(rar->filename_save, rar->filename, filename_size + 1);
1580   rar->filename_save_size = filename_size;
1581 
1582   /* Set info for seeking */
1583   free(rar->dbo);
1584   if ((rar->dbo = calloc(1, sizeof(*rar->dbo))) == NULL)
1585   {
1586     archive_set_error(&a->archive, ENOMEM, "Couldn't allocate memory.");
1587     return (ARCHIVE_FATAL);
1588   }
1589   rar->dbo[0].header_size = header_size;
1590   rar->dbo[0].start_offset = -1;
1591   rar->dbo[0].end_offset = -1;
1592   rar->cursor = 0;
1593   rar->nodes = 1;
1594 
1595   if (rar->file_flags & FHD_SALT)
1596   {
1597     if (p + 8 > endp) {
1598       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1599         "Invalid header size");
1600       return (ARCHIVE_FATAL);
1601     }
1602     memcpy(rar->salt, p, 8);
1603     p += 8;
1604   }
1605 
1606   if (rar->file_flags & FHD_EXTTIME) {
1607     if (read_exttime(p, rar, endp) < 0) {
1608       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1609         "Invalid header size");
1610       return (ARCHIVE_FATAL);
1611     }
1612   }
1613 
1614   __archive_read_consume(a, header_size - 7);
1615   rar->dbo[0].start_offset = a->filter->position;
1616   rar->dbo[0].end_offset = rar->dbo[0].start_offset + rar->packed_size;
1617 
1618   switch(file_header.host_os)
1619   {
1620   case OS_MSDOS:
1621   case OS_OS2:
1622   case OS_WIN32:
1623     rar->mode = archive_le32dec(file_header.file_attr);
1624     if (rar->mode & FILE_ATTRIBUTE_DIRECTORY)
1625       rar->mode = AE_IFDIR | S_IXUSR | S_IXGRP | S_IXOTH;
1626     else
1627       rar->mode = AE_IFREG;
1628     rar->mode |= S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
1629     break;
1630 
1631   case OS_UNIX:
1632   case OS_MAC_OS:
1633   case OS_BEOS:
1634     rar->mode = archive_le32dec(file_header.file_attr);
1635     break;
1636 
1637   default:
1638     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1639                       "Unknown file attributes from RAR file's host OS");
1640     return (ARCHIVE_FATAL);
1641   }
1642 
1643   rar->bytes_uncopied = rar->bytes_unconsumed = 0;
1644   rar->lzss.position = rar->offset = 0;
1645   rar->offset_seek = 0;
1646   rar->dictionary_size = 0;
1647   rar->offset_outgoing = 0;
1648   rar->br.cache_avail = 0;
1649   rar->br.avail_in = 0;
1650   rar->crc_calculated = 0;
1651   rar->entry_eof = 0;
1652   rar->valid = 1;
1653   rar->is_ppmd_block = 0;
1654   rar->start_new_table = 1;
1655   free(rar->unp_buffer);
1656   rar->unp_buffer = NULL;
1657   rar->unp_offset = 0;
1658   rar->unp_buffer_size = UNP_BUFFER_SIZE;
1659   memset(rar->lengthtable, 0, sizeof(rar->lengthtable));
1660   __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1661   rar->ppmd_valid = rar->ppmd_eod = 0;
1662 
1663   /* Don't set any archive entries for non-file header types */
1664   if (head_type == NEWSUB_HEAD)
1665     return ret;
1666 
1667   archive_entry_set_mtime(entry, rar->mtime, rar->mnsec);
1668   archive_entry_set_ctime(entry, rar->ctime, rar->cnsec);
1669   archive_entry_set_atime(entry, rar->atime, rar->ansec);
1670   archive_entry_set_size(entry, rar->unp_size);
1671   archive_entry_set_mode(entry, rar->mode);
1672 
1673   if (archive_entry_copy_pathname_l(entry, filename, filename_size, fn_sconv))
1674   {
1675     if (errno == ENOMEM)
1676     {
1677       archive_set_error(&a->archive, ENOMEM,
1678                         "Can't allocate memory for Pathname");
1679       return (ARCHIVE_FATAL);
1680     }
1681     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1682                       "Pathname cannot be converted from %s to current locale.",
1683                       archive_string_conversion_charset_name(fn_sconv));
1684     ret = (ARCHIVE_WARN);
1685   }
1686 
1687   if (((rar->mode) & AE_IFMT) == AE_IFLNK)
1688   {
1689     /* Make sure a symbolic-link file does not have its body. */
1690     rar->bytes_remaining = 0;
1691     archive_entry_set_size(entry, 0);
1692 
1693     /* Read a symbolic-link name. */
1694     if ((ret2 = read_symlink_stored(a, entry, sconv)) < (ARCHIVE_WARN))
1695       return ret2;
1696     if (ret > ret2)
1697       ret = ret2;
1698   }
1699 
1700   if (rar->bytes_remaining == 0)
1701     rar->entry_eof = 1;
1702 
1703   return ret;
1704 }
1705 
1706 static time_t
1707 get_time(int ttime)
1708 {
1709   struct tm tm;
1710   tm.tm_sec = 2 * (ttime & 0x1f);
1711   tm.tm_min = (ttime >> 5) & 0x3f;
1712   tm.tm_hour = (ttime >> 11) & 0x1f;
1713   tm.tm_mday = (ttime >> 16) & 0x1f;
1714   tm.tm_mon = ((ttime >> 21) & 0x0f) - 1;
1715   tm.tm_year = ((ttime >> 25) & 0x7f) + 80;
1716   tm.tm_isdst = -1;
1717   return mktime(&tm);
1718 }
1719 
1720 static int
1721 read_exttime(const char *p, struct rar *rar, const char *endp)
1722 {
1723   unsigned rmode, flags, rem, j, count;
1724   int ttime, i;
1725   struct tm *tm;
1726   time_t t;
1727   long nsec;
1728 #if defined(HAVE_LOCALTIME_R) || defined(HAVE__LOCALTIME64_S)
1729   struct tm tmbuf;
1730 #endif
1731 #if defined(HAVE__LOCALTIME64_S)
1732   errno_t terr;
1733   __time64_t tmptime;
1734 #endif
1735 
1736   if (p + 2 > endp)
1737     return (-1);
1738   flags = archive_le16dec(p);
1739   p += 2;
1740 
1741   for (i = 3; i >= 0; i--)
1742   {
1743     t = 0;
1744     if (i == 3)
1745       t = rar->mtime;
1746     rmode = flags >> i * 4;
1747     if (rmode & 8)
1748     {
1749       if (!t)
1750       {
1751         if (p + 4 > endp)
1752           return (-1);
1753         ttime = archive_le32dec(p);
1754         t = get_time(ttime);
1755         p += 4;
1756       }
1757       rem = 0;
1758       count = rmode & 3;
1759       if (p + count > endp)
1760         return (-1);
1761       for (j = 0; j < count; j++)
1762       {
1763         rem = (((unsigned)(unsigned char)*p) << 16) | (rem >> 8);
1764         p++;
1765       }
1766 #if defined(HAVE_LOCALTIME_R)
1767       tm = localtime_r(&t, &tmbuf);
1768 #elif defined(HAVE__LOCALTIME64_S)
1769       tmptime = t;
1770       terr = _localtime64_s(&tmbuf, &tmptime);
1771       if (terr)
1772         tm = NULL;
1773       else
1774         tm = &tmbuf;
1775 #else
1776       tm = localtime(&t);
1777 #endif
1778       nsec = tm->tm_sec + rem / NS_UNIT;
1779       if (rmode & 4)
1780       {
1781         tm->tm_sec++;
1782         t = mktime(tm);
1783       }
1784       if (i == 3)
1785       {
1786         rar->mtime = t;
1787         rar->mnsec = nsec;
1788       }
1789       else if (i == 2)
1790       {
1791         rar->ctime = t;
1792         rar->cnsec = nsec;
1793       }
1794       else if (i == 1)
1795       {
1796         rar->atime = t;
1797         rar->ansec = nsec;
1798       }
1799       else
1800       {
1801         rar->arctime = t;
1802         rar->arcnsec = nsec;
1803       }
1804     }
1805   }
1806   return (0);
1807 }
1808 
1809 static int
1810 read_symlink_stored(struct archive_read *a, struct archive_entry *entry,
1811                     struct archive_string_conv *sconv)
1812 {
1813   const void *h;
1814   const char *p;
1815   struct rar *rar;
1816   int ret = (ARCHIVE_OK);
1817 
1818   rar = (struct rar *)(a->format->data);
1819   if ((h = rar_read_ahead(a, (size_t)rar->packed_size, NULL)) == NULL)
1820     return (ARCHIVE_FATAL);
1821   p = h;
1822 
1823   if (archive_entry_copy_symlink_l(entry,
1824       p, (size_t)rar->packed_size, sconv))
1825   {
1826     if (errno == ENOMEM)
1827     {
1828       archive_set_error(&a->archive, ENOMEM,
1829                         "Can't allocate memory for link");
1830       return (ARCHIVE_FATAL);
1831     }
1832     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1833                       "link cannot be converted from %s to current locale.",
1834                       archive_string_conversion_charset_name(sconv));
1835     ret = (ARCHIVE_WARN);
1836   }
1837   __archive_read_consume(a, rar->packed_size);
1838   return ret;
1839 }
1840 
1841 static int
1842 read_data_stored(struct archive_read *a, const void **buff, size_t *size,
1843                  int64_t *offset)
1844 {
1845   struct rar *rar;
1846   ssize_t bytes_avail;
1847 
1848   rar = (struct rar *)(a->format->data);
1849   if (rar->bytes_remaining == 0 &&
1850     !(rar->main_flags & MHD_VOLUME && rar->file_flags & FHD_SPLIT_AFTER))
1851   {
1852     *buff = NULL;
1853     *size = 0;
1854     *offset = rar->offset;
1855     if (rar->file_crc != rar->crc_calculated) {
1856       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1857                         "File CRC error");
1858       return (ARCHIVE_FATAL);
1859     }
1860     rar->entry_eof = 1;
1861     return (ARCHIVE_EOF);
1862   }
1863 
1864   *buff = rar_read_ahead(a, 1, &bytes_avail);
1865   if (bytes_avail <= 0)
1866   {
1867     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1868                       "Truncated RAR file data");
1869     return (ARCHIVE_FATAL);
1870   }
1871 
1872   *size = bytes_avail;
1873   *offset = rar->offset;
1874   rar->offset += bytes_avail;
1875   rar->offset_seek += bytes_avail;
1876   rar->bytes_remaining -= bytes_avail;
1877   rar->bytes_unconsumed = bytes_avail;
1878   /* Calculate File CRC. */
1879   rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1880     (unsigned)bytes_avail);
1881   return (ARCHIVE_OK);
1882 }
1883 
1884 static int
1885 read_data_compressed(struct archive_read *a, const void **buff, size_t *size,
1886                int64_t *offset)
1887 {
1888   struct rar *rar;
1889   int64_t start, end, actualend;
1890   size_t bs;
1891   int ret = (ARCHIVE_OK), sym, code, lzss_offset, length, i;
1892 
1893   rar = (struct rar *)(a->format->data);
1894 
1895   do {
1896     if (!rar->valid)
1897       return (ARCHIVE_FATAL);
1898     if (rar->ppmd_eod ||
1899        (rar->dictionary_size && rar->offset >= rar->unp_size))
1900     {
1901       if (rar->unp_offset > 0) {
1902         /*
1903          * We have unprocessed extracted data. write it out.
1904          */
1905         *buff = rar->unp_buffer;
1906         *size = rar->unp_offset;
1907         *offset = rar->offset_outgoing;
1908         rar->offset_outgoing += *size;
1909         /* Calculate File CRC. */
1910         rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1911           (unsigned)*size);
1912         rar->unp_offset = 0;
1913         return (ARCHIVE_OK);
1914       }
1915       *buff = NULL;
1916       *size = 0;
1917       *offset = rar->offset;
1918       if (rar->file_crc != rar->crc_calculated) {
1919         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1920                           "File CRC error");
1921         return (ARCHIVE_FATAL);
1922       }
1923       rar->entry_eof = 1;
1924       return (ARCHIVE_EOF);
1925     }
1926 
1927     if (!rar->is_ppmd_block && rar->dictionary_size && rar->bytes_uncopied > 0)
1928     {
1929       if (rar->bytes_uncopied > (rar->unp_buffer_size - rar->unp_offset))
1930         bs = rar->unp_buffer_size - rar->unp_offset;
1931       else
1932         bs = (size_t)rar->bytes_uncopied;
1933       ret = copy_from_lzss_window(a, buff, rar->offset, (int)bs);
1934       if (ret != ARCHIVE_OK)
1935         return (ret);
1936       rar->offset += bs;
1937       rar->bytes_uncopied -= bs;
1938       if (*buff != NULL) {
1939         rar->unp_offset = 0;
1940         *size = rar->unp_buffer_size;
1941         *offset = rar->offset_outgoing;
1942         rar->offset_outgoing += *size;
1943         /* Calculate File CRC. */
1944         rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1945           (unsigned)*size);
1946         return (ret);
1947       }
1948       continue;
1949     }
1950 
1951     if (!rar->br.next_in &&
1952       (ret = rar_br_preparation(a, &(rar->br))) < ARCHIVE_WARN)
1953       return (ret);
1954     if (rar->start_new_table && ((ret = parse_codes(a)) < (ARCHIVE_WARN)))
1955       return (ret);
1956 
1957     if (rar->is_ppmd_block)
1958     {
1959       if ((sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1960         &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1961       {
1962         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1963                           "Invalid symbol");
1964         return (ARCHIVE_FATAL);
1965       }
1966       if(sym != rar->ppmd_escape)
1967       {
1968         lzss_emit_literal(rar, sym);
1969         rar->bytes_uncopied++;
1970       }
1971       else
1972       {
1973         if ((code = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1974           &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1975         {
1976           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1977                             "Invalid symbol");
1978           return (ARCHIVE_FATAL);
1979         }
1980 
1981         switch(code)
1982         {
1983           case 0:
1984             rar->start_new_table = 1;
1985             return read_data_compressed(a, buff, size, offset);
1986 
1987           case 2:
1988             rar->ppmd_eod = 1;/* End Of ppmd Data. */
1989             continue;
1990 
1991           case 3:
1992             archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1993                               "Parsing filters is unsupported.");
1994             return (ARCHIVE_FAILED);
1995 
1996           case 4:
1997             lzss_offset = 0;
1998             for (i = 2; i >= 0; i--)
1999             {
2000               if ((code = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
2001                 &rar->ppmd7_context, &rar->range_dec.p)) < 0)
2002               {
2003                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2004                                   "Invalid symbol");
2005                 return (ARCHIVE_FATAL);
2006               }
2007               lzss_offset |= code << (i * 8);
2008             }
2009             if ((length = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
2010               &rar->ppmd7_context, &rar->range_dec.p)) < 0)
2011             {
2012               archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2013                                 "Invalid symbol");
2014               return (ARCHIVE_FATAL);
2015             }
2016             lzss_emit_match(rar, lzss_offset + 2, length + 32);
2017             rar->bytes_uncopied += length + 32;
2018             break;
2019 
2020           case 5:
2021             if ((length = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
2022               &rar->ppmd7_context, &rar->range_dec.p)) < 0)
2023             {
2024               archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2025                                 "Invalid symbol");
2026               return (ARCHIVE_FATAL);
2027             }
2028             lzss_emit_match(rar, 1, length + 4);
2029             rar->bytes_uncopied += length + 4;
2030             break;
2031 
2032          default:
2033            lzss_emit_literal(rar, sym);
2034            rar->bytes_uncopied++;
2035         }
2036       }
2037     }
2038     else
2039     {
2040       start = rar->offset;
2041       end = start + rar->dictionary_size;
2042       rar->filterstart = INT64_MAX;
2043 
2044       if ((actualend = expand(a, end)) < 0)
2045         return ((int)actualend);
2046 
2047       rar->bytes_uncopied = actualend - start;
2048       if (rar->bytes_uncopied == 0) {
2049           /* Broken RAR files cause this case.
2050           * NOTE: If this case were possible on a normal RAR file
2051           * we would find out where it was actually bad and
2052           * what we would do to solve it. */
2053           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2054                             "Internal error extracting RAR file");
2055           return (ARCHIVE_FATAL);
2056       }
2057     }
2058     if (rar->bytes_uncopied > (rar->unp_buffer_size - rar->unp_offset))
2059       bs = rar->unp_buffer_size - rar->unp_offset;
2060     else
2061       bs = (size_t)rar->bytes_uncopied;
2062     ret = copy_from_lzss_window(a, buff, rar->offset, (int)bs);
2063     if (ret != ARCHIVE_OK)
2064       return (ret);
2065     rar->offset += bs;
2066     rar->bytes_uncopied -= bs;
2067     /*
2068      * If *buff is NULL, it means unp_buffer is not full.
2069      * So we have to continue extracting a RAR file.
2070      */
2071   } while (*buff == NULL);
2072 
2073   rar->unp_offset = 0;
2074   *size = rar->unp_buffer_size;
2075   *offset = rar->offset_outgoing;
2076   rar->offset_outgoing += *size;
2077   /* Calculate File CRC. */
2078   rar->crc_calculated = crc32(rar->crc_calculated, *buff, (unsigned)*size);
2079   return ret;
2080 }
2081 
2082 static int
2083 parse_codes(struct archive_read *a)
2084 {
2085   int i, j, val, n, r;
2086   unsigned char bitlengths[MAX_SYMBOLS], zerocount, ppmd_flags;
2087   unsigned int maxorder;
2088   struct huffman_code precode;
2089   struct rar *rar = (struct rar *)(a->format->data);
2090   struct rar_br *br = &(rar->br);
2091 
2092   free_codes(a);
2093 
2094   /* Skip to the next byte */
2095   rar_br_consume_unalined_bits(br);
2096 
2097   /* PPMd block flag */
2098   if (!rar_br_read_ahead(a, br, 1))
2099     goto truncated_data;
2100   if ((rar->is_ppmd_block = rar_br_bits(br, 1)) != 0)
2101   {
2102     rar_br_consume(br, 1);
2103     if (!rar_br_read_ahead(a, br, 7))
2104       goto truncated_data;
2105     ppmd_flags = rar_br_bits(br, 7);
2106     rar_br_consume(br, 7);
2107 
2108     /* Memory is allocated in MB */
2109     if (ppmd_flags & 0x20)
2110     {
2111       if (!rar_br_read_ahead(a, br, 8))
2112         goto truncated_data;
2113       rar->dictionary_size = (rar_br_bits(br, 8) + 1) << 20;
2114       rar_br_consume(br, 8);
2115     }
2116 
2117     if (ppmd_flags & 0x40)
2118     {
2119       if (!rar_br_read_ahead(a, br, 8))
2120         goto truncated_data;
2121       rar->ppmd_escape = rar->ppmd7_context.InitEsc = rar_br_bits(br, 8);
2122       rar_br_consume(br, 8);
2123     }
2124     else
2125       rar->ppmd_escape = 2;
2126 
2127     if (ppmd_flags & 0x20)
2128     {
2129       maxorder = (ppmd_flags & 0x1F) + 1;
2130       if(maxorder > 16)
2131         maxorder = 16 + (maxorder - 16) * 3;
2132 
2133       if (maxorder == 1)
2134       {
2135         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2136                           "Truncated RAR file data");
2137         return (ARCHIVE_FATAL);
2138       }
2139 
2140       /* Make sure ppmd7_contest is freed before Ppmd7_Construct
2141        * because reading a broken file cause this abnormal sequence. */
2142       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
2143 
2144       rar->bytein.a = a;
2145       rar->bytein.Read = &ppmd_read;
2146       __archive_ppmd7_functions.PpmdRAR_RangeDec_CreateVTable(&rar->range_dec);
2147       rar->range_dec.Stream = &rar->bytein;
2148       __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);
2149 
2150       if (rar->dictionary_size == 0) {
2151 	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2152                           "Invalid zero dictionary size");
2153 	      return (ARCHIVE_FATAL);
2154       }
2155 
2156       if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,
2157         rar->dictionary_size))
2158       {
2159         archive_set_error(&a->archive, ENOMEM,
2160                           "Out of memory");
2161         return (ARCHIVE_FATAL);
2162       }
2163       if (!__archive_ppmd7_functions.PpmdRAR_RangeDec_Init(&rar->range_dec))
2164       {
2165         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2166                           "Unable to initialize PPMd range decoder");
2167         return (ARCHIVE_FATAL);
2168       }
2169       __archive_ppmd7_functions.Ppmd7_Init(&rar->ppmd7_context, maxorder);
2170       rar->ppmd_valid = 1;
2171     }
2172     else
2173     {
2174       if (!rar->ppmd_valid) {
2175         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2176                           "Invalid PPMd sequence");
2177         return (ARCHIVE_FATAL);
2178       }
2179       if (!__archive_ppmd7_functions.PpmdRAR_RangeDec_Init(&rar->range_dec))
2180       {
2181         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2182                           "Unable to initialize PPMd range decoder");
2183         return (ARCHIVE_FATAL);
2184       }
2185     }
2186   }
2187   else
2188   {
2189     rar_br_consume(br, 1);
2190 
2191     /* Keep existing table flag */
2192     if (!rar_br_read_ahead(a, br, 1))
2193       goto truncated_data;
2194     if (!rar_br_bits(br, 1))
2195       memset(rar->lengthtable, 0, sizeof(rar->lengthtable));
2196     rar_br_consume(br, 1);
2197 
2198     memset(&bitlengths, 0, sizeof(bitlengths));
2199     for (i = 0; i < MAX_SYMBOLS;)
2200     {
2201       if (!rar_br_read_ahead(a, br, 4))
2202         goto truncated_data;
2203       bitlengths[i++] = rar_br_bits(br, 4);
2204       rar_br_consume(br, 4);
2205       if (bitlengths[i-1] == 0xF)
2206       {
2207         if (!rar_br_read_ahead(a, br, 4))
2208           goto truncated_data;
2209         zerocount = rar_br_bits(br, 4);
2210         rar_br_consume(br, 4);
2211         if (zerocount)
2212         {
2213           i--;
2214           for (j = 0; j < zerocount + 2 && i < MAX_SYMBOLS; j++)
2215             bitlengths[i++] = 0;
2216         }
2217       }
2218     }
2219 
2220     memset(&precode, 0, sizeof(precode));
2221     r = create_code(a, &precode, bitlengths, MAX_SYMBOLS, MAX_SYMBOL_LENGTH);
2222     if (r != ARCHIVE_OK) {
2223       free(precode.tree);
2224       free(precode.table);
2225       return (r);
2226     }
2227 
2228     for (i = 0; i < HUFFMAN_TABLE_SIZE;)
2229     {
2230       if ((val = read_next_symbol(a, &precode)) < 0) {
2231         free(precode.tree);
2232         free(precode.table);
2233         return (ARCHIVE_FATAL);
2234       }
2235       if (val < 16)
2236       {
2237         rar->lengthtable[i] = (rar->lengthtable[i] + val) & 0xF;
2238         i++;
2239       }
2240       else if (val < 18)
2241       {
2242         if (i == 0)
2243         {
2244           free(precode.tree);
2245           free(precode.table);
2246           archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2247                             "Internal error extracting RAR file.");
2248           return (ARCHIVE_FATAL);
2249         }
2250 
2251         if(val == 16) {
2252           if (!rar_br_read_ahead(a, br, 3)) {
2253             free(precode.tree);
2254             free(precode.table);
2255             goto truncated_data;
2256           }
2257           n = rar_br_bits(br, 3) + 3;
2258           rar_br_consume(br, 3);
2259         } else {
2260           if (!rar_br_read_ahead(a, br, 7)) {
2261             free(precode.tree);
2262             free(precode.table);
2263             goto truncated_data;
2264           }
2265           n = rar_br_bits(br, 7) + 11;
2266           rar_br_consume(br, 7);
2267         }
2268 
2269         for (j = 0; j < n && i < HUFFMAN_TABLE_SIZE; j++)
2270         {
2271           rar->lengthtable[i] = rar->lengthtable[i-1];
2272           i++;
2273         }
2274       }
2275       else
2276       {
2277         if(val == 18) {
2278           if (!rar_br_read_ahead(a, br, 3)) {
2279             free(precode.tree);
2280             free(precode.table);
2281             goto truncated_data;
2282           }
2283           n = rar_br_bits(br, 3) + 3;
2284           rar_br_consume(br, 3);
2285         } else {
2286           if (!rar_br_read_ahead(a, br, 7)) {
2287             free(precode.tree);
2288             free(precode.table);
2289             goto truncated_data;
2290           }
2291           n = rar_br_bits(br, 7) + 11;
2292           rar_br_consume(br, 7);
2293         }
2294 
2295         for(j = 0; j < n && i < HUFFMAN_TABLE_SIZE; j++)
2296           rar->lengthtable[i++] = 0;
2297       }
2298     }
2299     free(precode.tree);
2300     free(precode.table);
2301 
2302     r = create_code(a, &rar->maincode, &rar->lengthtable[0], MAINCODE_SIZE,
2303                 MAX_SYMBOL_LENGTH);
2304     if (r != ARCHIVE_OK)
2305       return (r);
2306     r = create_code(a, &rar->offsetcode, &rar->lengthtable[MAINCODE_SIZE],
2307                 OFFSETCODE_SIZE, MAX_SYMBOL_LENGTH);
2308     if (r != ARCHIVE_OK)
2309       return (r);
2310     r = create_code(a, &rar->lowoffsetcode,
2311                 &rar->lengthtable[MAINCODE_SIZE + OFFSETCODE_SIZE],
2312                 LOWOFFSETCODE_SIZE, MAX_SYMBOL_LENGTH);
2313     if (r != ARCHIVE_OK)
2314       return (r);
2315     r = create_code(a, &rar->lengthcode,
2316                 &rar->lengthtable[MAINCODE_SIZE + OFFSETCODE_SIZE +
2317                 LOWOFFSETCODE_SIZE], LENGTHCODE_SIZE, MAX_SYMBOL_LENGTH);
2318     if (r != ARCHIVE_OK)
2319       return (r);
2320   }
2321 
2322   if (!rar->dictionary_size || !rar->lzss.window)
2323   {
2324     /* Seems as though dictionary sizes are not used. Even so, minimize
2325      * memory usage as much as possible.
2326      */
2327     void *new_window;
2328     unsigned int new_size;
2329 
2330     if (rar->unp_size >= DICTIONARY_MAX_SIZE)
2331       new_size = DICTIONARY_MAX_SIZE;
2332     else
2333       new_size = rar_fls((unsigned int)rar->unp_size) << 1;
2334     if (new_size == 0) {
2335       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2336                         "Zero window size is invalid.");
2337       return (ARCHIVE_FATAL);
2338     }
2339     new_window = realloc(rar->lzss.window, new_size);
2340     if (new_window == NULL) {
2341       archive_set_error(&a->archive, ENOMEM,
2342                         "Unable to allocate memory for uncompressed data.");
2343       return (ARCHIVE_FATAL);
2344     }
2345     rar->lzss.window = (unsigned char *)new_window;
2346     rar->dictionary_size = new_size;
2347     memset(rar->lzss.window, 0, rar->dictionary_size);
2348     rar->lzss.mask = rar->dictionary_size - 1;
2349   }
2350 
2351   rar->start_new_table = 0;
2352   return (ARCHIVE_OK);
2353 truncated_data:
2354   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2355                     "Truncated RAR file data");
2356   rar->valid = 0;
2357   return (ARCHIVE_FATAL);
2358 }
2359 
2360 static void
2361 free_codes(struct archive_read *a)
2362 {
2363   struct rar *rar = (struct rar *)(a->format->data);
2364   free(rar->maincode.tree);
2365   free(rar->offsetcode.tree);
2366   free(rar->lowoffsetcode.tree);
2367   free(rar->lengthcode.tree);
2368   free(rar->maincode.table);
2369   free(rar->offsetcode.table);
2370   free(rar->lowoffsetcode.table);
2371   free(rar->lengthcode.table);
2372   memset(&rar->maincode, 0, sizeof(rar->maincode));
2373   memset(&rar->offsetcode, 0, sizeof(rar->offsetcode));
2374   memset(&rar->lowoffsetcode, 0, sizeof(rar->lowoffsetcode));
2375   memset(&rar->lengthcode, 0, sizeof(rar->lengthcode));
2376 }
2377 
2378 
2379 static int
2380 read_next_symbol(struct archive_read *a, struct huffman_code *code)
2381 {
2382   unsigned char bit;
2383   unsigned int bits;
2384   int length, value, node;
2385   struct rar *rar;
2386   struct rar_br *br;
2387 
2388   if (!code->table)
2389   {
2390     if (make_table(a, code) != (ARCHIVE_OK))
2391       return -1;
2392   }
2393 
2394   rar = (struct rar *)(a->format->data);
2395   br = &(rar->br);
2396 
2397   /* Look ahead (peek) at bits */
2398   if (!rar_br_read_ahead(a, br, code->tablesize)) {
2399     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2400                       "Truncated RAR file data");
2401     rar->valid = 0;
2402     return -1;
2403   }
2404   bits = rar_br_bits(br, code->tablesize);
2405 
2406   length = code->table[bits].length;
2407   value = code->table[bits].value;
2408 
2409   if (length < 0)
2410   {
2411     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2412                       "Invalid prefix code in bitstream");
2413     return -1;
2414   }
2415 
2416   if (length <= code->tablesize)
2417   {
2418     /* Skip length bits */
2419     rar_br_consume(br, length);
2420     return value;
2421   }
2422 
2423   /* Skip tablesize bits */
2424   rar_br_consume(br, code->tablesize);
2425 
2426   node = value;
2427   while (!(code->tree[node].branches[0] ==
2428     code->tree[node].branches[1]))
2429   {
2430     if (!rar_br_read_ahead(a, br, 1)) {
2431       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2432                         "Truncated RAR file data");
2433       rar->valid = 0;
2434       return -1;
2435     }
2436     bit = rar_br_bits(br, 1);
2437     rar_br_consume(br, 1);
2438 
2439     if (code->tree[node].branches[bit] < 0)
2440     {
2441       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2442                         "Invalid prefix code in bitstream");
2443       return -1;
2444     }
2445     node = code->tree[node].branches[bit];
2446   }
2447 
2448   return code->tree[node].branches[0];
2449 }
2450 
2451 static int
2452 create_code(struct archive_read *a, struct huffman_code *code,
2453             unsigned char *lengths, int numsymbols, char maxlength)
2454 {
2455   int i, j, codebits = 0, symbolsleft = numsymbols;
2456 
2457   code->numentries = 0;
2458   code->numallocatedentries = 0;
2459   if (new_node(code) < 0) {
2460     archive_set_error(&a->archive, ENOMEM,
2461                       "Unable to allocate memory for node data.");
2462     return (ARCHIVE_FATAL);
2463   }
2464   code->numentries = 1;
2465   code->minlength = INT_MAX;
2466   code->maxlength = INT_MIN;
2467   codebits = 0;
2468   for(i = 1; i <= maxlength; i++)
2469   {
2470     for(j = 0; j < numsymbols; j++)
2471     {
2472       if (lengths[j] != i) continue;
2473       if (add_value(a, code, j, codebits, i) != ARCHIVE_OK)
2474         return (ARCHIVE_FATAL);
2475       codebits++;
2476       if (--symbolsleft <= 0)
2477         break;
2478     }
2479     if (symbolsleft <= 0)
2480       break;
2481     codebits <<= 1;
2482   }
2483   return (ARCHIVE_OK);
2484 }
2485 
2486 static int
2487 add_value(struct archive_read *a, struct huffman_code *code, int value,
2488           int codebits, int length)
2489 {
2490   int lastnode, bitpos, bit;
2491   /* int repeatpos, repeatnode, nextnode; */
2492 
2493   free(code->table);
2494   code->table = NULL;
2495 
2496   if(length > code->maxlength)
2497     code->maxlength = length;
2498   if(length < code->minlength)
2499     code->minlength = length;
2500 
2501   /*
2502    * Dead code, repeatpos was is -1
2503    *
2504   repeatpos = -1;
2505   if (repeatpos == 0 || (repeatpos >= 0
2506     && (((codebits >> (repeatpos - 1)) & 3) == 0
2507     || ((codebits >> (repeatpos - 1)) & 3) == 3)))
2508   {
2509     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2510                       "Invalid repeat position");
2511     return (ARCHIVE_FATAL);
2512   }
2513   */
2514 
2515   lastnode = 0;
2516   for (bitpos = length - 1; bitpos >= 0; bitpos--)
2517   {
2518     bit = (codebits >> bitpos) & 1;
2519 
2520     /* Leaf node check */
2521     if (code->tree[lastnode].branches[0] ==
2522       code->tree[lastnode].branches[1])
2523     {
2524       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2525                         "Prefix found");
2526       return (ARCHIVE_FATAL);
2527     }
2528 
2529     /*
2530      * Dead code, repeatpos was -1, bitpos >=0
2531      *
2532     if (bitpos == repeatpos)
2533     {
2534       * Open branch check *
2535       if (!(code->tree[lastnode].branches[bit] < 0))
2536       {
2537         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2538                           "Invalid repeating code");
2539         return (ARCHIVE_FATAL);
2540       }
2541 
2542       if ((repeatnode = new_node(code)) < 0) {
2543         archive_set_error(&a->archive, ENOMEM,
2544                           "Unable to allocate memory for node data.");
2545         return (ARCHIVE_FATAL);
2546       }
2547       if ((nextnode = new_node(code)) < 0) {
2548         archive_set_error(&a->archive, ENOMEM,
2549                           "Unable to allocate memory for node data.");
2550         return (ARCHIVE_FATAL);
2551       }
2552 
2553       * Set branches *
2554       code->tree[lastnode].branches[bit] = repeatnode;
2555       code->tree[repeatnode].branches[bit] = repeatnode;
2556       code->tree[repeatnode].branches[bit^1] = nextnode;
2557       lastnode = nextnode;
2558 
2559       bitpos++; * terminating bit already handled, skip it *
2560     }
2561     else
2562     {
2563     */
2564       /* Open branch check */
2565       if (code->tree[lastnode].branches[bit] < 0)
2566       {
2567         if (new_node(code) < 0) {
2568           archive_set_error(&a->archive, ENOMEM,
2569                             "Unable to allocate memory for node data.");
2570           return (ARCHIVE_FATAL);
2571         }
2572         code->tree[lastnode].branches[bit] = code->numentries++;
2573       }
2574 
2575       /* set to branch */
2576       lastnode = code->tree[lastnode].branches[bit];
2577  /* } */
2578   }
2579 
2580   if (!(code->tree[lastnode].branches[0] == -1
2581     && code->tree[lastnode].branches[1] == -2))
2582   {
2583     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2584                       "Prefix found");
2585     return (ARCHIVE_FATAL);
2586   }
2587 
2588   /* Set leaf value */
2589   code->tree[lastnode].branches[0] = value;
2590   code->tree[lastnode].branches[1] = value;
2591 
2592   return (ARCHIVE_OK);
2593 }
2594 
2595 static int
2596 new_node(struct huffman_code *code)
2597 {
2598   void *new_tree;
2599   if (code->numallocatedentries == code->numentries) {
2600     int new_num_entries = 256;
2601     if (code->numentries > 0) {
2602         new_num_entries = code->numentries * 2;
2603     }
2604     new_tree = realloc(code->tree, new_num_entries * sizeof(*code->tree));
2605     if (new_tree == NULL)
2606         return (-1);
2607     code->tree = (struct huffman_tree_node *)new_tree;
2608     code->numallocatedentries = new_num_entries;
2609   }
2610   code->tree[code->numentries].branches[0] = -1;
2611   code->tree[code->numentries].branches[1] = -2;
2612   return 1;
2613 }
2614 
2615 static int
2616 make_table(struct archive_read *a, struct huffman_code *code)
2617 {
2618   if (code->maxlength < code->minlength || code->maxlength > 10)
2619     code->tablesize = 10;
2620   else
2621     code->tablesize = code->maxlength;
2622 
2623   code->table =
2624     (struct huffman_table_entry *)calloc(1, sizeof(*code->table)
2625     * ((size_t)1 << code->tablesize));
2626 
2627   return make_table_recurse(a, code, 0, code->table, 0, code->tablesize);
2628 }
2629 
2630 static int
2631 make_table_recurse(struct archive_read *a, struct huffman_code *code, int node,
2632                    struct huffman_table_entry *table, int depth,
2633                    int maxdepth)
2634 {
2635   int currtablesize, i, ret = (ARCHIVE_OK);
2636 
2637   if (!code->tree)
2638   {
2639     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2640                       "Huffman tree was not created.");
2641     return (ARCHIVE_FATAL);
2642   }
2643   if (node < 0 || node >= code->numentries)
2644   {
2645     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2646                       "Invalid location to Huffman tree specified.");
2647     return (ARCHIVE_FATAL);
2648   }
2649 
2650   currtablesize = 1 << (maxdepth - depth);
2651 
2652   if (code->tree[node].branches[0] ==
2653     code->tree[node].branches[1])
2654   {
2655     for(i = 0; i < currtablesize; i++)
2656     {
2657       table[i].length = depth;
2658       table[i].value = code->tree[node].branches[0];
2659     }
2660   }
2661   /*
2662    * Dead code, node >= 0
2663    *
2664   else if (node < 0)
2665   {
2666     for(i = 0; i < currtablesize; i++)
2667       table[i].length = -1;
2668   }
2669    */
2670   else
2671   {
2672     if(depth == maxdepth)
2673     {
2674       table[0].length = maxdepth + 1;
2675       table[0].value = node;
2676     }
2677     else
2678     {
2679       ret |= make_table_recurse(a, code, code->tree[node].branches[0], table,
2680                                 depth + 1, maxdepth);
2681       ret |= make_table_recurse(a, code, code->tree[node].branches[1],
2682                          table + currtablesize / 2, depth + 1, maxdepth);
2683     }
2684   }
2685   return ret;
2686 }
2687 
2688 static int64_t
2689 expand(struct archive_read *a, int64_t end)
2690 {
2691   static const unsigned char lengthbases[] =
2692     {   0,   1,   2,   3,   4,   5,   6,
2693         7,   8,  10,  12,  14,  16,  20,
2694        24,  28,  32,  40,  48,  56,  64,
2695        80,  96, 112, 128, 160, 192, 224 };
2696   static const unsigned char lengthbits[] =
2697     { 0, 0, 0, 0, 0, 0, 0,
2698       0, 1, 1, 1, 1, 2, 2,
2699       2, 2, 3, 3, 3, 3, 4,
2700       4, 4, 4, 5, 5, 5, 5 };
2701   static const int lengthb_min = minimum(
2702     (int)(sizeof(lengthbases)/sizeof(lengthbases[0])),
2703     (int)(sizeof(lengthbits)/sizeof(lengthbits[0]))
2704   );
2705   static const unsigned int offsetbases[] =
2706     {       0,       1,       2,       3,       4,       6,
2707             8,      12,      16,      24,      32,      48,
2708            64,      96,     128,     192,     256,     384,
2709           512,     768,    1024,    1536,    2048,    3072,
2710          4096,    6144,    8192,   12288,   16384,   24576,
2711         32768,   49152,   65536,   98304,  131072,  196608,
2712        262144,  327680,  393216,  458752,  524288,  589824,
2713        655360,  720896,  786432,  851968,  917504,  983040,
2714       1048576, 1310720, 1572864, 1835008, 2097152, 2359296,
2715       2621440, 2883584, 3145728, 3407872, 3670016, 3932160 };
2716   static const unsigned char offsetbits[] =
2717     {  0,  0,  0,  0,  1,  1,  2,  2,  3,  3,  4,  4,
2718        5,  5,  6,  6,  7,  7,  8,  8,  9,  9, 10, 10,
2719       11, 11, 12, 12, 13, 13, 14, 14, 15, 15, 16, 16,
2720       16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16,
2721       18, 18, 18, 18, 18, 18, 18, 18, 18, 18, 18, 18 };
2722   static const int offsetb_min = minimum(
2723     (int)(sizeof(offsetbases)/sizeof(offsetbases[0])),
2724     (int)(sizeof(offsetbits)/sizeof(offsetbits[0]))
2725   );
2726   static const unsigned char shortbases[] =
2727     { 0, 4, 8, 16, 32, 64, 128, 192 };
2728   static const unsigned char shortbits[] =
2729     { 2, 2, 3, 4, 5, 6, 6, 6 };
2730 
2731   int symbol, offs, len, offsindex, lensymbol, i, offssymbol, lowoffsetsymbol;
2732   unsigned char newfile;
2733   struct rar *rar = (struct rar *)(a->format->data);
2734   struct rar_br *br = &(rar->br);
2735 
2736   if (rar->filterstart < end)
2737     end = rar->filterstart;
2738 
2739   while (1)
2740   {
2741     if (rar->output_last_match &&
2742       lzss_position(&rar->lzss) + rar->lastlength <= end)
2743     {
2744       lzss_emit_match(rar, rar->lastoffset, rar->lastlength);
2745       rar->output_last_match = 0;
2746     }
2747 
2748     if(rar->is_ppmd_block || rar->output_last_match ||
2749       lzss_position(&rar->lzss) >= end)
2750       return lzss_position(&rar->lzss);
2751 
2752     if ((symbol = read_next_symbol(a, &rar->maincode)) < 0)
2753       return (ARCHIVE_FATAL);
2754     rar->output_last_match = 0;
2755 
2756     if (symbol < 256)
2757     {
2758       lzss_emit_literal(rar, symbol);
2759       continue;
2760     }
2761     else if (symbol == 256)
2762     {
2763       if (!rar_br_read_ahead(a, br, 1))
2764         goto truncated_data;
2765       newfile = !rar_br_bits(br, 1);
2766       rar_br_consume(br, 1);
2767 
2768       if(newfile)
2769       {
2770         rar->start_new_block = 1;
2771         if (!rar_br_read_ahead(a, br, 1))
2772           goto truncated_data;
2773         rar->start_new_table = rar_br_bits(br, 1);
2774         rar_br_consume(br, 1);
2775         return lzss_position(&rar->lzss);
2776       }
2777       else
2778       {
2779         if (parse_codes(a) != ARCHIVE_OK)
2780           return (ARCHIVE_FATAL);
2781         continue;
2782       }
2783     }
2784     else if(symbol==257)
2785     {
2786       archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2787                         "Parsing filters is unsupported.");
2788       return (ARCHIVE_FAILED);
2789     }
2790     else if(symbol==258)
2791     {
2792       if(rar->lastlength == 0)
2793         continue;
2794 
2795       offs = rar->lastoffset;
2796       len = rar->lastlength;
2797     }
2798     else if (symbol <= 262)
2799     {
2800       offsindex = symbol - 259;
2801       offs = rar->oldoffset[offsindex];
2802 
2803       if ((lensymbol = read_next_symbol(a, &rar->lengthcode)) < 0)
2804         goto bad_data;
2805       if (lensymbol > lengthb_min)
2806         goto bad_data;
2807       len = lengthbases[lensymbol] + 2;
2808       if (lengthbits[lensymbol] > 0) {
2809         if (!rar_br_read_ahead(a, br, lengthbits[lensymbol]))
2810           goto truncated_data;
2811         len += rar_br_bits(br, lengthbits[lensymbol]);
2812         rar_br_consume(br, lengthbits[lensymbol]);
2813       }
2814 
2815       for (i = offsindex; i > 0; i--)
2816         rar->oldoffset[i] = rar->oldoffset[i-1];
2817       rar->oldoffset[0] = offs;
2818     }
2819     else if(symbol<=270)
2820     {
2821       offs = shortbases[symbol-263] + 1;
2822       if(shortbits[symbol-263] > 0) {
2823         if (!rar_br_read_ahead(a, br, shortbits[symbol-263]))
2824           goto truncated_data;
2825         offs += rar_br_bits(br, shortbits[symbol-263]);
2826         rar_br_consume(br, shortbits[symbol-263]);
2827       }
2828 
2829       len = 2;
2830 
2831       for(i = 3; i > 0; i--)
2832         rar->oldoffset[i] = rar->oldoffset[i-1];
2833       rar->oldoffset[0] = offs;
2834     }
2835     else
2836     {
2837       if (symbol-271 > lengthb_min)
2838         goto bad_data;
2839       len = lengthbases[symbol-271]+3;
2840       if(lengthbits[symbol-271] > 0) {
2841         if (!rar_br_read_ahead(a, br, lengthbits[symbol-271]))
2842           goto truncated_data;
2843         len += rar_br_bits(br, lengthbits[symbol-271]);
2844         rar_br_consume(br, lengthbits[symbol-271]);
2845       }
2846 
2847       if ((offssymbol = read_next_symbol(a, &rar->offsetcode)) < 0)
2848         goto bad_data;
2849       if (offssymbol > offsetb_min)
2850         goto bad_data;
2851       offs = offsetbases[offssymbol]+1;
2852       if(offsetbits[offssymbol] > 0)
2853       {
2854         if(offssymbol > 9)
2855         {
2856           if(offsetbits[offssymbol] > 4) {
2857             if (!rar_br_read_ahead(a, br, offsetbits[offssymbol] - 4))
2858               goto truncated_data;
2859             offs += rar_br_bits(br, offsetbits[offssymbol] - 4) << 4;
2860             rar_br_consume(br, offsetbits[offssymbol] - 4);
2861 	  }
2862 
2863           if(rar->numlowoffsetrepeats > 0)
2864           {
2865             rar->numlowoffsetrepeats--;
2866             offs += rar->lastlowoffset;
2867           }
2868           else
2869           {
2870             if ((lowoffsetsymbol =
2871               read_next_symbol(a, &rar->lowoffsetcode)) < 0)
2872               return (ARCHIVE_FATAL);
2873             if(lowoffsetsymbol == 16)
2874             {
2875               rar->numlowoffsetrepeats = 15;
2876               offs += rar->lastlowoffset;
2877             }
2878             else
2879             {
2880               offs += lowoffsetsymbol;
2881               rar->lastlowoffset = lowoffsetsymbol;
2882             }
2883           }
2884         }
2885         else {
2886           if (!rar_br_read_ahead(a, br, offsetbits[offssymbol]))
2887             goto truncated_data;
2888           offs += rar_br_bits(br, offsetbits[offssymbol]);
2889           rar_br_consume(br, offsetbits[offssymbol]);
2890         }
2891       }
2892 
2893       if (offs >= 0x40000)
2894         len++;
2895       if (offs >= 0x2000)
2896         len++;
2897 
2898       for(i = 3; i > 0; i--)
2899         rar->oldoffset[i] = rar->oldoffset[i-1];
2900       rar->oldoffset[0] = offs;
2901     }
2902 
2903     rar->lastoffset = offs;
2904     rar->lastlength = len;
2905     rar->output_last_match = 1;
2906   }
2907 truncated_data:
2908   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2909                     "Truncated RAR file data");
2910   rar->valid = 0;
2911   return (ARCHIVE_FATAL);
2912 bad_data:
2913   archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2914                     "Bad RAR file data");
2915   return (ARCHIVE_FATAL);
2916 }
2917 
2918 static int
2919 copy_from_lzss_window(struct archive_read *a, const void **buffer,
2920                         int64_t startpos, int length)
2921 {
2922   int windowoffs, firstpart;
2923   struct rar *rar = (struct rar *)(a->format->data);
2924 
2925   if (!rar->unp_buffer)
2926   {
2927     if ((rar->unp_buffer = malloc(rar->unp_buffer_size)) == NULL)
2928     {
2929       archive_set_error(&a->archive, ENOMEM,
2930                         "Unable to allocate memory for uncompressed data.");
2931       return (ARCHIVE_FATAL);
2932     }
2933   }
2934 
2935   windowoffs = lzss_offset_for_position(&rar->lzss, startpos);
2936   if(windowoffs + length <= lzss_size(&rar->lzss)) {
2937     memcpy(&rar->unp_buffer[rar->unp_offset], &rar->lzss.window[windowoffs],
2938            length);
2939   } else if (length <= lzss_size(&rar->lzss)) {
2940     firstpart = lzss_size(&rar->lzss) - windowoffs;
2941     if (firstpart < 0) {
2942       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2943                         "Bad RAR file data");
2944       return (ARCHIVE_FATAL);
2945     }
2946     if (firstpart < length) {
2947       memcpy(&rar->unp_buffer[rar->unp_offset],
2948              &rar->lzss.window[windowoffs], firstpart);
2949       memcpy(&rar->unp_buffer[rar->unp_offset + firstpart],
2950              &rar->lzss.window[0], length - firstpart);
2951     } else {
2952       memcpy(&rar->unp_buffer[rar->unp_offset],
2953              &rar->lzss.window[windowoffs], length);
2954     }
2955   } else {
2956       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2957                         "Bad RAR file data");
2958       return (ARCHIVE_FATAL);
2959   }
2960   rar->unp_offset += length;
2961   if (rar->unp_offset >= rar->unp_buffer_size)
2962     *buffer = rar->unp_buffer;
2963   else
2964     *buffer = NULL;
2965   return (ARCHIVE_OK);
2966 }
2967 
2968 static const void *
2969 rar_read_ahead(struct archive_read *a, size_t min, ssize_t *avail)
2970 {
2971   struct rar *rar = (struct rar *)(a->format->data);
2972   const void *h = __archive_read_ahead(a, min, avail);
2973   int ret;
2974   if (avail)
2975   {
2976     if (a->archive.read_data_is_posix_read && *avail > (ssize_t)a->archive.read_data_requested)
2977       *avail = a->archive.read_data_requested;
2978     if (*avail > rar->bytes_remaining)
2979       *avail = (ssize_t)rar->bytes_remaining;
2980     if (*avail < 0)
2981       return NULL;
2982     else if (*avail == 0 && rar->main_flags & MHD_VOLUME &&
2983       rar->file_flags & FHD_SPLIT_AFTER)
2984     {
2985       rar->filename_must_match = 1;
2986       ret = archive_read_format_rar_read_header(a, a->entry);
2987       if (ret == (ARCHIVE_EOF))
2988       {
2989         rar->has_endarc_header = 1;
2990         ret = archive_read_format_rar_read_header(a, a->entry);
2991       }
2992       rar->filename_must_match = 0;
2993       if (ret != (ARCHIVE_OK))
2994         return NULL;
2995       return rar_read_ahead(a, min, avail);
2996     }
2997   }
2998   return h;
2999 }
3000