1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 
28 #ifdef HAVE_ERRNO_H
29 #include <errno.h>
30 #endif
31 #ifdef HAVE_STDLIB_H
32 #include <stdlib.h>
33 #endif
34 #ifdef HAVE_BZLIB_H
35 #include <bzlib.h>
36 #endif
37 #ifdef HAVE_LZMA_H
38 #include <lzma.h>
39 #endif
40 #ifdef HAVE_ZLIB_H
41 #include <zlib.h>
42 #endif
43 #ifdef HAVE_ZSTD_H
44 #include <zstd.h>
45 #endif
46 
47 #include "archive.h"
48 #include "archive_entry.h"
49 #include "archive_entry_locale.h"
50 #include "archive_ppmd7_private.h"
51 #include "archive_private.h"
52 #include "archive_read_private.h"
53 #include "archive_endian.h"
54 
55 #ifndef HAVE_ZLIB_H
56 #include "archive_crc32.h"
57 #endif
58 
59 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
60 #define SFX_MIN_ADDR	0x27000
61 #define SFX_MAX_ADDR	0x60000
62 
63 
64 /*
65  * Codec ID
66  */
67 #define _7Z_COPY	0
68 #define _7Z_LZMA	0x030101
69 #define _7Z_LZMA2	0x21
70 #define _7Z_DEFLATE	0x040108
71 #define _7Z_BZ2		0x040202
72 #define _7Z_PPMD	0x030401
73 #define _7Z_DELTA	0x03
74 #define _7Z_CRYPTO_MAIN_ZIP			0x06F10101 /* Main Zip crypto algo */
75 #define _7Z_CRYPTO_RAR_29			0x06F10303 /* Rar29 AES-128 + (modified SHA-1) */
76 #define _7Z_CRYPTO_AES_256_SHA_256	0x06F10701 /* AES-256 + SHA-256 */
77 
78 
79 #define _7Z_X86		0x03030103
80 #define _7Z_X86_BCJ2	0x0303011B
81 #define _7Z_POWERPC	0x03030205
82 #define _7Z_IA64	0x03030401
83 #define _7Z_ARM		0x03030501
84 #define _7Z_ARMTHUMB	0x03030701
85 #define _7Z_ARM64	0xa
86 #define _7Z_SPARC	0x03030805
87 
88 #define _7Z_ZSTD	0x4F71101 /* Copied from https://github.com/mcmilk/7-Zip-zstd.git */
89 
90 /*
91  * 7-Zip header property IDs.
92  */
93 #define kEnd			0x00
94 #define kHeader			0x01
95 #define kArchiveProperties	0x02
96 #define kAdditionalStreamsInfo	0x03
97 #define kMainStreamsInfo	0x04
98 #define kFilesInfo		0x05
99 #define kPackInfo		0x06
100 #define kUnPackInfo		0x07
101 #define kSubStreamsInfo		0x08
102 #define kSize			0x09
103 #define kCRC			0x0A
104 #define kFolder			0x0B
105 #define kCodersUnPackSize	0x0C
106 #define kNumUnPackStream	0x0D
107 #define kEmptyStream		0x0E
108 #define kEmptyFile		0x0F
109 #define kAnti			0x10
110 #define kName			0x11
111 #define kCTime			0x12
112 #define kATime			0x13
113 #define kMTime			0x14
114 #define kAttributes		0x15
115 #define kEncodedHeader		0x17
116 #define kDummy			0x19
117 
118 // Check that some windows file attribute constants are defined.
119 // Reference: https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
120 #ifndef FILE_ATTRIBUTE_READONLY
121 #define FILE_ATTRIBUTE_READONLY 0x00000001
122 #endif
123 
124 #ifndef FILE_ATTRIBUTE_HIDDEN
125 #define FILE_ATTRIBUTE_HIDDEN 0x00000002
126 #endif
127 
128 #ifndef FILE_ATTRIBUTE_SYSTEM
129 #define FILE_ATTRIBUTE_SYSTEM 0x00000004
130 #endif
131 
132 #ifndef FILE_ATTRIBUTE_DIRECTORY
133 #define FILE_ATTRIBUTE_DIRECTORY 0x00000010
134 #endif
135 
136 // This value is defined in 7zip with the comment "trick for Unix".
137 //
138 // 7z archives created on unix have this bit set in the high 16 bits of
139 // the attr field along with the unix permissions.
140 #define FILE_ATTRIBUTE_UNIX_EXTENSION 0x8000
141 
142 struct _7z_digests {
143 	unsigned char	*defineds;
144 	uint32_t	*digests;
145 };
146 
147 
148 struct _7z_folder {
149 	uint64_t		 numCoders;
150 	struct _7z_coder {
151 		unsigned long	 codec;
152 		uint64_t	 numInStreams;
153 		uint64_t	 numOutStreams;
154 		uint64_t	 propertiesSize;
155 		unsigned char	*properties;
156 	} *coders;
157 	uint64_t		 numBindPairs;
158 	struct {
159 		uint64_t	 inIndex;
160 		uint64_t	 outIndex;
161 	} *bindPairs;
162 	uint64_t		 numPackedStreams;
163 	uint64_t		*packedStreams;
164 	uint64_t		 numInStreams;
165 	uint64_t		 numOutStreams;
166 	uint64_t		*unPackSize;
167 	unsigned char		 digest_defined;
168 	uint32_t		 digest;
169 	uint64_t		 numUnpackStreams;
170 	uint32_t		 packIndex;
171 	/* Unoperated bytes. */
172 	uint64_t		 skipped_bytes;
173 };
174 
175 struct _7z_coders_info {
176 	uint64_t		 numFolders;
177 	struct _7z_folder	*folders;
178 	uint64_t		 dataStreamIndex;
179 };
180 
181 struct _7z_pack_info {
182 	uint64_t		 pos;
183 	uint64_t		 numPackStreams;
184 	uint64_t		*sizes;
185 	struct _7z_digests	 digest;
186 	/* Calculated from pos and numPackStreams. */
187 	uint64_t		*positions;
188 };
189 
190 struct _7z_substream_info {
191 	size_t			 unpack_streams;
192 	uint64_t		*unpackSizes;
193 	unsigned char		*digestsDefined;
194 	uint32_t		*digests;
195 };
196 
197 struct _7z_stream_info {
198 	struct _7z_pack_info	 pi;
199 	struct _7z_coders_info	 ci;
200 	struct _7z_substream_info ss;
201 };
202 
203 struct _7z_header_info {
204 	uint64_t		 dataIndex;
205 
206 	unsigned char		*emptyStreamBools;
207 	unsigned char		*emptyFileBools;
208 	unsigned char		*antiBools;
209 	unsigned char		*attrBools;
210 };
211 
212 struct _7zip_entry {
213 	size_t			 name_len;
214 	unsigned char		*utf16name;
215 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
216 	const wchar_t		*wname;
217 #endif
218 	uint32_t		 folderIndex;
219 	uint32_t		 ssIndex;
220 	unsigned		 flg;
221 #define MTIME_IS_SET	(1<<0)
222 #define ATIME_IS_SET	(1<<1)
223 #define CTIME_IS_SET	(1<<2)
224 #define CRC32_IS_SET	(1<<3)
225 #define HAS_STREAM	(1<<4)
226 
227 	time_t			 mtime;
228 	time_t			 atime;
229 	time_t			 ctime;
230 	long			 mtime_ns;
231 	long			 atime_ns;
232 	long			 ctime_ns;
233 	uint32_t		 mode;
234 	uint32_t		 attr;
235 };
236 
237 struct _7zip {
238 	/* Structural information about the archive. */
239 	struct _7z_stream_info	 si;
240 
241 	int			 header_is_being_read;
242 	int			 header_is_encoded;
243 	uint64_t		 header_bytes_remaining;
244 	unsigned long		 header_crc32;
245 	/* Header offset to check that reading points of the file contents
246 	 * will not exceed the header. */
247 	uint64_t		 header_offset;
248 	/* Base offset of the archive file for a seek in case reading SFX. */
249 	uint64_t		 seek_base;
250 
251 	/* List of entries */
252 	size_t			 entries_remaining;
253 	uint64_t		 numFiles;
254 	struct _7zip_entry	*entries;
255 	struct _7zip_entry	*entry;
256 	unsigned char		*entry_names;
257 
258 	/* entry_bytes_remaining is the number of bytes we expect. */
259 	int64_t			 entry_offset;
260 	uint64_t		 entry_bytes_remaining;
261 
262 	/* Running CRC32 of the decompressed data */
263 	unsigned long		 entry_crc32;
264 
265 	/* Flags to mark progress of decompression. */
266 	char			 end_of_entry;
267 
268 	/* Uncompressed buffer control.  */
269 #define UBUFF_SIZE	(64 * 1024)
270 	unsigned char 		*uncompressed_buffer;
271 	unsigned char 		*uncompressed_buffer_pointer;
272 	size_t 			 uncompressed_buffer_size;
273 	size_t			 uncompressed_buffer_bytes_remaining;
274 
275 	/* Offset of the compressed data. */
276 	int64_t			 stream_offset;
277 
278 	/*
279 	 * Decompressing control data.
280 	 */
281 	unsigned		 folder_index;
282 	uint64_t		 folder_outbytes_remaining;
283 	unsigned		 pack_stream_index;
284 	unsigned		 pack_stream_remaining;
285 	uint64_t		 pack_stream_inbytes_remaining;
286 	size_t			 pack_stream_bytes_unconsumed;
287 
288 	/* The codec information of a folder. */
289 	unsigned long		 codec;
290 	unsigned long		 codec2;
291 
292 	/*
293 	 * Decompressor controllers.
294 	 */
295 	/* Decoding LZMA1 and LZMA2 data. */
296 #ifdef HAVE_LZMA_H
297 	lzma_stream		 lzstream;
298 	int			 lzstream_valid;
299 #endif
300 	/* Decoding bzip2 data. */
301 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
302 	bz_stream		 bzstream;
303 	int			 bzstream_valid;
304 #endif
305 	/* Decoding deflate data. */
306 #ifdef HAVE_ZLIB_H
307 	z_stream		 stream;
308 	int			 stream_valid;
309 #endif
310 	/* Decoding Zstandard data. */
311 #if HAVE_ZSTD_H
312 	ZSTD_DStream		 *zstd_dstream;
313 	int		         zstdstream_valid;
314 #endif
315 	/* Decoding PPMd data. */
316 	int			 ppmd7_stat;
317 	CPpmd7			 ppmd7_context;
318 	CPpmd7z_RangeDec	 range_dec;
319 	IByteIn			 bytein;
320 	struct {
321 		const unsigned char	*next_in;
322 		int64_t			 avail_in;
323 		int64_t			 total_in;
324 		int64_t			 stream_in;
325 		unsigned char		*next_out;
326 		int64_t			 avail_out;
327 		int64_t			 total_out;
328 		int			 overconsumed;
329 	} ppstream;
330 	int			 ppmd7_valid;
331 
332 	/* Decoding BCJ and BCJ2 data. */
333 	uint32_t		 bcj_state;
334 	size_t			 odd_bcj_size;
335 	unsigned char		 odd_bcj[4];
336 	/* Decoding BCJ data. */
337 	size_t			 bcj_prevPosT;
338 	uint32_t		 bcj_prevMask;
339 	uint32_t		 bcj_ip;
340 
341 	/* Decoding BCJ2 data. */
342 	size_t			 main_stream_bytes_remaining;
343 	unsigned char		*sub_stream_buff[3];
344 	size_t			 sub_stream_size[3];
345 	size_t			 sub_stream_bytes_remaining[3];
346 	unsigned char		*tmp_stream_buff;
347 	size_t			 tmp_stream_buff_size;
348 	size_t			 tmp_stream_bytes_avail;
349 	size_t			 tmp_stream_bytes_remaining;
350 #ifdef _LZMA_PROB32
351 #define CProb uint32_t
352 #else
353 #define CProb uint16_t
354 #endif
355 	CProb			 bcj2_p[256 + 2];
356 	uint8_t			 bcj2_prevByte;
357 	uint32_t		 bcj2_range;
358 	uint32_t		 bcj2_code;
359 	uint64_t		 bcj2_outPos;
360 
361 	/* Filename character-set conversion data. */
362 	struct archive_string_conv *sconv;
363 
364 	char			 format_name[64];
365 
366 	/* Custom value that is non-zero if this archive contains encrypted entries. */
367 	int			 has_encrypted_entries;
368 };
369 
370 /* Maximum entry size. This limitation prevents reading intentional
371  * corrupted 7-zip files on assuming there are not so many entries in
372  * the files. */
373 #define UMAX_ENTRY	ARCHIVE_LITERAL_ULL(100000000)
374 
375 static int	archive_read_format_7zip_has_encrypted_entries(struct archive_read *);
376 static int	archive_read_support_format_7zip_capabilities(struct archive_read *a);
377 static int	archive_read_format_7zip_bid(struct archive_read *, int);
378 static int	archive_read_format_7zip_cleanup(struct archive_read *);
379 static int	archive_read_format_7zip_read_data(struct archive_read *,
380 		    const void **, size_t *, int64_t *);
381 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
382 static int	archive_read_format_7zip_read_header(struct archive_read *,
383 		    struct archive_entry *);
384 static int	check_7zip_header_in_sfx(const char *);
385 static unsigned long decode_codec_id(const unsigned char *, size_t);
386 static int	decode_encoded_header_info(struct archive_read *,
387 		    struct _7z_stream_info *);
388 static int	decompress(struct archive_read *, struct _7zip *,
389 		    void *, size_t *, const void *, size_t *);
390 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
391 static void	fileTimeToUtc(uint64_t, time_t *, long *);
392 static uint64_t folder_uncompressed_size(struct _7z_folder *);
393 static void	free_CodersInfo(struct _7z_coders_info *);
394 static void	free_Digest(struct _7z_digests *);
395 static void	free_Folder(struct _7z_folder *);
396 static void	free_Header(struct _7z_header_info *);
397 static void	free_PackInfo(struct _7z_pack_info *);
398 static void	free_StreamsInfo(struct _7z_stream_info *);
399 static void	free_SubStreamsInfo(struct _7z_substream_info *);
400 static int	free_decompression(struct archive_read *, struct _7zip *);
401 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
402 		    size_t, size_t);
403 static const unsigned char * header_bytes(struct archive_read *, size_t);
404 static int	init_decompression(struct archive_read *, struct _7zip *,
405 		    const struct _7z_coder *, const struct _7z_coder *);
406 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
407 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
408 static int	read_CodersInfo(struct archive_read *,
409 		    struct _7z_coders_info *);
410 static int	read_Digests(struct archive_read *, struct _7z_digests *,
411 		    size_t);
412 static int	read_Folder(struct archive_read *, struct _7z_folder *);
413 static int	read_Header(struct archive_read *, struct _7z_header_info *,
414 		    int);
415 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
416 static int	read_StreamsInfo(struct archive_read *,
417 		    struct _7z_stream_info *);
418 static int	read_SubStreamsInfo(struct archive_read *,
419 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
420 static int	read_Times(struct archive_read *, struct _7z_header_info *,
421 		    int);
422 static void	read_consume(struct archive_read *);
423 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
424 		    size_t);
425 static int	seek_pack(struct archive_read *);
426 static int64_t	skip_stream(struct archive_read *, size_t);
427 static int	skip_sfx(struct archive_read *, ssize_t);
428 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
429 		    struct _7z_header_info *);
430 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
431 		    int);
432 static void	x86_Init(struct _7zip *);
433 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
434 static void	arm_Init(struct _7zip *);
435 static size_t	arm_Convert(struct _7zip *, uint8_t *, size_t);
436 static size_t	arm64_Convert(struct _7zip *, uint8_t *, size_t);
437 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
438 
439 
440 int
archive_read_support_format_7zip(struct archive * _a)441 archive_read_support_format_7zip(struct archive *_a)
442 {
443 	struct archive_read *a = (struct archive_read *)_a;
444 	struct _7zip *zip;
445 	int r;
446 
447 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
448 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
449 
450 	zip = calloc(1, sizeof(*zip));
451 	if (zip == NULL) {
452 		archive_set_error(&a->archive, ENOMEM,
453 		    "Can't allocate 7zip data");
454 		return (ARCHIVE_FATAL);
455 	}
456 
457 	/*
458 	 * Until enough data has been read, we cannot tell about
459 	 * any encrypted entries yet.
460 	 */
461 	zip->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
462 
463 
464 	r = __archive_read_register_format(a,
465 	    zip,
466 	    "7zip",
467 	    archive_read_format_7zip_bid,
468 	    NULL,
469 	    archive_read_format_7zip_read_header,
470 	    archive_read_format_7zip_read_data,
471 	    archive_read_format_7zip_read_data_skip,
472 	    NULL,
473 	    archive_read_format_7zip_cleanup,
474 	    archive_read_support_format_7zip_capabilities,
475 	    archive_read_format_7zip_has_encrypted_entries);
476 
477 	if (r != ARCHIVE_OK)
478 		free(zip);
479 	return (ARCHIVE_OK);
480 }
481 
482 static int
archive_read_support_format_7zip_capabilities(struct archive_read * a)483 archive_read_support_format_7zip_capabilities(struct archive_read * a)
484 {
485 	(void)a; /* UNUSED */
486 	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA |
487 			ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
488 }
489 
490 
491 static int
archive_read_format_7zip_has_encrypted_entries(struct archive_read * _a)492 archive_read_format_7zip_has_encrypted_entries(struct archive_read *_a)
493 {
494 	if (_a && _a->format) {
495 		struct _7zip * zip = (struct _7zip *)_a->format->data;
496 		if (zip) {
497 			return zip->has_encrypted_entries;
498 		}
499 	}
500 	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
501 }
502 
503 static int
archive_read_format_7zip_bid(struct archive_read * a,int best_bid)504 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
505 {
506 	const char *p;
507 
508 	/* If someone has already bid more than 32, then avoid
509 	   trashing the look-ahead buffers with a seek. */
510 	if (best_bid > 32)
511 		return (-1);
512 
513 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
514 		return (0);
515 
516 	/* If first six bytes are the 7-Zip signature,
517 	 * return the bid right now. */
518 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
519 		return (48);
520 
521 	/*
522 	 * It may a 7-Zip SFX archive file. If first two bytes are
523 	 * 'M' and 'Z' available on Windows or first four bytes are
524 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
525 	 * signature. Although we will perform a seek when reading
526 	 * a header, what we do not use __archive_read_seek() here is
527 	 * due to a bidding performance.
528 	 */
529 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
530 		ssize_t offset = SFX_MIN_ADDR;
531 		ssize_t window = 4096;
532 		ssize_t bytes_avail;
533 		while (offset + window <= (SFX_MAX_ADDR)) {
534 			const char *buff = __archive_read_ahead(a,
535 					offset + window, &bytes_avail);
536 			if (buff == NULL) {
537 				/* Remaining bytes are less than window. */
538 				window >>= 1;
539 				if (window < 0x40)
540 					return (0);
541 				continue;
542 			}
543 			p = buff + offset;
544 			while (p + 32 < buff + bytes_avail) {
545 				int step = check_7zip_header_in_sfx(p);
546 				if (step == 0)
547 					return (48);
548 				p += step;
549 			}
550 			offset = p - buff;
551 		}
552 	}
553 	return (0);
554 }
555 
556 static int
check_7zip_header_in_sfx(const char * p)557 check_7zip_header_in_sfx(const char *p)
558 {
559 	switch ((unsigned char)p[5]) {
560 	case 0x1C:
561 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
562 			return (6);
563 		/*
564 		 * Test the CRC because its extraction code has 7-Zip
565 		 * Magic Code, so we should do this in order not to
566 		 * make a mis-detection.
567 		 */
568 		if (crc32(0, (const unsigned char *)p + 12, 20)
569 			!= archive_le32dec(p + 8))
570 			return (6);
571 		/* Hit the header! */
572 		return (0);
573 	case 0x37: return (5);
574 	case 0x7A: return (4);
575 	case 0xBC: return (3);
576 	case 0xAF: return (2);
577 	case 0x27: return (1);
578 	default: return (6);
579 	}
580 }
581 
582 static int
skip_sfx(struct archive_read * a,ssize_t bytes_avail)583 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
584 {
585 	const void *h;
586 	const char *p, *q;
587 	size_t skip, offset;
588 	ssize_t bytes, window;
589 
590 	/*
591 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
592 	 * __archive_read_seek() at this time since we have
593 	 * already had enough data.
594 	 */
595 	if (bytes_avail > SFX_MIN_ADDR)
596 		__archive_read_consume(a, SFX_MIN_ADDR);
597 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
598 		return (ARCHIVE_FATAL);
599 
600 	offset = 0;
601 	window = 1;
602 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
603 		h = __archive_read_ahead(a, window, &bytes);
604 		if (h == NULL) {
605 			/* Remaining bytes are less than window. */
606 			window >>= 1;
607 			if (window < 0x40)
608 				goto fatal;
609 			continue;
610 		}
611 		if (bytes < 6) {
612 			/* This case might happen when window == 1. */
613 			window = 4096;
614 			continue;
615 		}
616 		p = (const char *)h;
617 		q = p + bytes;
618 
619 		/*
620 		 * Scan ahead until we find something that looks
621 		 * like the 7-Zip header.
622 		 */
623 		while (p + 32 < q) {
624 			int step = check_7zip_header_in_sfx(p);
625 			if (step == 0) {
626 				struct _7zip *zip =
627 				    (struct _7zip *)a->format->data;
628 				skip = p - (const char *)h;
629 				__archive_read_consume(a, skip);
630 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
631 				return (ARCHIVE_OK);
632 			}
633 			p += step;
634 		}
635 		skip = p - (const char *)h;
636 		__archive_read_consume(a, skip);
637 		offset += skip;
638 		if (window == 1)
639 			window = 4096;
640 	}
641 fatal:
642 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
643 	    "Couldn't find out 7-Zip header");
644 	return (ARCHIVE_FATAL);
645 }
646 
647 static int
archive_read_format_7zip_read_header(struct archive_read * a,struct archive_entry * entry)648 archive_read_format_7zip_read_header(struct archive_read *a,
649 	struct archive_entry *entry)
650 {
651 	struct _7zip *zip = (struct _7zip *)a->format->data;
652 	struct _7zip_entry *zip_entry;
653 	int r, ret = ARCHIVE_OK;
654 	struct _7z_folder *folder = 0;
655 	uint64_t fidx = 0;
656 
657 	/*
658 	 * It should be sufficient to call archive_read_next_header() for
659 	 * a reader to determine if an entry is encrypted or not. If the
660 	 * encryption of an entry is only detectable when calling
661 	 * archive_read_data(), so be it. We'll do the same check there
662 	 * as well.
663 	 */
664 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
665 		zip->has_encrypted_entries = 0;
666 	}
667 
668 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
669 	if (a->archive.archive_format_name == NULL)
670 		a->archive.archive_format_name = "7-Zip";
671 
672 	if (zip->entries == NULL) {
673 		struct _7z_header_info header;
674 
675 		memset(&header, 0, sizeof(header));
676 		r = slurp_central_directory(a, zip, &header);
677 		free_Header(&header);
678 		if (r != ARCHIVE_OK)
679 			return (r);
680 		zip->entries_remaining = (size_t)zip->numFiles;
681 		zip->entry = zip->entries;
682 	} else {
683 		++zip->entry;
684 	}
685 	zip_entry = zip->entry;
686 
687 	if (zip->entries_remaining <= 0 || zip_entry == NULL)
688 		return ARCHIVE_EOF;
689 	--zip->entries_remaining;
690 
691 	zip->entry_offset = 0;
692 	zip->end_of_entry = 0;
693 	zip->entry_crc32 = crc32(0, NULL, 0);
694 
695 	/* Setup a string conversion for a filename. */
696 	if (zip->sconv == NULL) {
697 		zip->sconv = archive_string_conversion_from_charset(
698 		    &a->archive, "UTF-16LE", 1);
699 		if (zip->sconv == NULL)
700 			return (ARCHIVE_FATAL);
701 	}
702 
703 	/* Figure out if the entry is encrypted by looking at the folder
704 	   that is associated to the current 7zip entry. If the folder
705 	   has a coder with a _7Z_CRYPTO codec then the folder is encrypted.
706 	   Hence the entry must also be encrypted. */
707 	if (zip_entry && zip_entry->folderIndex < zip->si.ci.numFolders) {
708 		folder = &(zip->si.ci.folders[zip_entry->folderIndex]);
709 		for (fidx=0; folder && fidx<folder->numCoders; fidx++) {
710 			switch(folder->coders[fidx].codec) {
711 				case _7Z_CRYPTO_MAIN_ZIP:
712 				case _7Z_CRYPTO_RAR_29:
713 				case _7Z_CRYPTO_AES_256_SHA_256: {
714 					archive_entry_set_is_data_encrypted(entry, 1);
715 					zip->has_encrypted_entries = 1;
716 					break;
717 				}
718 			}
719 		}
720 	}
721 
722 	/* Now that we've checked for encryption, if there were still no
723 	 * encrypted entries found we can say for sure that there are none.
724 	 */
725 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
726 		zip->has_encrypted_entries = 0;
727 	}
728 
729 	if (archive_entry_copy_pathname_l(entry,
730 	    (const char *)zip_entry->utf16name,
731 	    zip_entry->name_len, zip->sconv) != 0) {
732 		if (errno == ENOMEM) {
733 			archive_set_error(&a->archive, ENOMEM,
734 			    "Can't allocate memory for Pathname");
735 			return (ARCHIVE_FATAL);
736 		}
737 		archive_set_error(&a->archive,
738 		    ARCHIVE_ERRNO_FILE_FORMAT,
739 		    "Pathname cannot be converted "
740 		    "from %s to current locale.",
741 		    archive_string_conversion_charset_name(zip->sconv));
742 		ret = ARCHIVE_WARN;
743 	}
744 
745 	/* Populate some additional entry fields: */
746 	archive_entry_set_mode(entry, zip_entry->mode);
747 	if (zip_entry->flg & MTIME_IS_SET)
748 		archive_entry_set_mtime(entry, zip_entry->mtime,
749 			zip_entry->mtime_ns);
750 	if (zip_entry->flg & CTIME_IS_SET)
751 		archive_entry_set_ctime(entry, zip_entry->ctime,
752 		    zip_entry->ctime_ns);
753 	if (zip_entry->flg & ATIME_IS_SET)
754 		archive_entry_set_atime(entry, zip_entry->atime,
755 		    zip_entry->atime_ns);
756 	if (zip_entry->ssIndex != (uint32_t)-1) {
757 		zip->entry_bytes_remaining =
758 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
759 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
760 	} else {
761 		zip->entry_bytes_remaining = 0;
762 		archive_entry_set_size(entry, 0);
763 	}
764 
765 	// These attributes are supported by the windows implementation of archive_write_disk.
766 	const int supported_attrs = FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM;
767 
768 	if (zip_entry->attr & supported_attrs) {
769 		char *fflags_text, *ptr;
770 		/* allocate for "rdonly,hidden,system," */
771 		fflags_text = malloc(22 * sizeof(char));
772 		if (fflags_text != NULL) {
773 			ptr = fflags_text;
774 			if (zip_entry->attr & FILE_ATTRIBUTE_READONLY) {
775  			strcpy(ptr, "rdonly,");
776  			ptr = ptr + 7;
777  		}
778  		if (zip_entry->attr & FILE_ATTRIBUTE_HIDDEN) {
779  			strcpy(ptr, "hidden,");
780  			ptr = ptr + 7;
781  		}
782  		if (zip_entry->attr & FILE_ATTRIBUTE_SYSTEM) {
783  			strcpy(ptr, "system,");
784  			ptr = ptr + 7;
785  		}
786  		if (ptr > fflags_text) {
787  			/* Delete trailing comma */
788  			*(ptr - 1) = '\0';
789  			archive_entry_copy_fflags_text(entry,
790 				fflags_text);
791  		}
792  		free(fflags_text);
793 		}
794 	}
795 
796 	/* If there's no body, force read_data() to return EOF immediately. */
797 	if (zip->entry_bytes_remaining < 1)
798 		zip->end_of_entry = 1;
799 
800 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
801 		unsigned char *symname = NULL;
802 		size_t symsize = 0;
803 
804 		/*
805 		 * Symbolic-name is recorded as its contents. We have to
806 		 * read the contents at this time.
807 		 */
808 		while (zip->entry_bytes_remaining > 0) {
809 			const void *buff;
810 			unsigned char *mem;
811 			size_t size;
812 			int64_t offset;
813 
814 			r = archive_read_format_7zip_read_data(a, &buff,
815 				&size, &offset);
816 			if (r < ARCHIVE_WARN) {
817 				free(symname);
818 				return (r);
819 			}
820 			mem = realloc(symname, symsize + size + 1);
821 			if (mem == NULL) {
822 				free(symname);
823 				archive_set_error(&a->archive, ENOMEM,
824 				    "Can't allocate memory for Symname");
825 				return (ARCHIVE_FATAL);
826 			}
827 			symname = mem;
828 			memcpy(symname+symsize, buff, size);
829 			symsize += size;
830 		}
831 		if (symsize == 0) {
832 			/* If there is no symname, handle it as a regular
833 			 * file. */
834 			zip_entry->mode &= ~AE_IFMT;
835 			zip_entry->mode |= AE_IFREG;
836 			archive_entry_set_mode(entry, zip_entry->mode);
837 		} else {
838 			symname[symsize] = '\0';
839 			archive_entry_copy_symlink(entry,
840 			    (const char *)symname);
841 		}
842 		free(symname);
843 		archive_entry_set_size(entry, 0);
844 	}
845 
846 	/* Set up a more descriptive format name. */
847 	snprintf(zip->format_name, sizeof(zip->format_name), "7-Zip");
848 	a->archive.archive_format_name = zip->format_name;
849 
850 	return (ret);
851 }
852 
853 static int
archive_read_format_7zip_read_data(struct archive_read * a,const void ** buff,size_t * size,int64_t * offset)854 archive_read_format_7zip_read_data(struct archive_read *a,
855     const void **buff, size_t *size, int64_t *offset)
856 {
857 	struct _7zip *zip;
858 	ssize_t bytes;
859 	int ret = ARCHIVE_OK;
860 
861 	zip = (struct _7zip *)(a->format->data);
862 
863 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
864 		zip->has_encrypted_entries = 0;
865 	}
866 
867 	if (zip->pack_stream_bytes_unconsumed)
868 		read_consume(a);
869 
870 	*offset = zip->entry_offset;
871 	*size = 0;
872 	*buff = NULL;
873 	/*
874 	 * If we hit end-of-entry last time, clean up and return
875 	 * ARCHIVE_EOF this time.
876 	 */
877 	if (zip->end_of_entry)
878 		return (ARCHIVE_EOF);
879 
880 	const uint64_t max_read_size = 16 * 1024 * 1024;  // Don't try to read more than 16 MB at a time
881 	size_t bytes_to_read = max_read_size;
882 	if ((uint64_t)bytes_to_read > zip->entry_bytes_remaining) {
883 		bytes_to_read = zip->entry_bytes_remaining;
884 	}
885 	bytes = read_stream(a, buff, bytes_to_read, 0);
886 	if (bytes < 0)
887 		return ((int)bytes);
888 	if (bytes == 0) {
889 		archive_set_error(&a->archive,
890 		    ARCHIVE_ERRNO_FILE_FORMAT,
891 		    "Truncated 7-Zip file body");
892 		return (ARCHIVE_FATAL);
893 	}
894 	zip->entry_bytes_remaining -= bytes;
895 	if (zip->entry_bytes_remaining == 0)
896 		zip->end_of_entry = 1;
897 
898 	/* Update checksum */
899 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
900 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff,
901 		    (unsigned)bytes);
902 
903 	/* If we hit the end, swallow any end-of-data marker. */
904 	if (zip->end_of_entry) {
905 		/* Check computed CRC against file contents. */
906 		if ((zip->entry->flg & CRC32_IS_SET) &&
907 			zip->si.ss.digests[zip->entry->ssIndex] !=
908 		    zip->entry_crc32) {
909 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
910 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
911 			    (unsigned long)zip->entry_crc32,
912 			    (unsigned long)zip->si.ss.digests[
913 			    		zip->entry->ssIndex]);
914 			ret = ARCHIVE_WARN;
915 		}
916 	}
917 
918 	*size = bytes;
919 	*offset = zip->entry_offset;
920 	zip->entry_offset += bytes;
921 
922 	return (ret);
923 }
924 
925 static int
archive_read_format_7zip_read_data_skip(struct archive_read * a)926 archive_read_format_7zip_read_data_skip(struct archive_read *a)
927 {
928 	struct _7zip *zip;
929 	int64_t bytes_skipped;
930 
931 	zip = (struct _7zip *)(a->format->data);
932 
933 	if (zip->pack_stream_bytes_unconsumed)
934 		read_consume(a);
935 
936 	/* If we've already read to end of data, we're done. */
937 	if (zip->end_of_entry)
938 		return (ARCHIVE_OK);
939 
940 	/*
941 	 * If the length is at the beginning, we can skip the
942 	 * compressed data much more quickly.
943 	 */
944 	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
945 	if (bytes_skipped < 0)
946 		return (ARCHIVE_FATAL);
947 	zip->entry_bytes_remaining = 0;
948 
949 	/* This entry is finished and done. */
950 	zip->end_of_entry = 1;
951 	return (ARCHIVE_OK);
952 }
953 
954 static int
archive_read_format_7zip_cleanup(struct archive_read * a)955 archive_read_format_7zip_cleanup(struct archive_read *a)
956 {
957 	struct _7zip *zip;
958 
959 	zip = (struct _7zip *)(a->format->data);
960 	free_StreamsInfo(&(zip->si));
961 	free(zip->entries);
962 	free(zip->entry_names);
963 	free_decompression(a, zip);
964 	free(zip->uncompressed_buffer);
965 	free(zip->sub_stream_buff[0]);
966 	free(zip->sub_stream_buff[1]);
967 	free(zip->sub_stream_buff[2]);
968 	free(zip->tmp_stream_buff);
969 	free(zip);
970 	(a->format->data) = NULL;
971 	return (ARCHIVE_OK);
972 }
973 
974 static void
read_consume(struct archive_read * a)975 read_consume(struct archive_read *a)
976 {
977 	struct _7zip *zip = (struct _7zip *)a->format->data;
978 
979 	if (zip->pack_stream_bytes_unconsumed) {
980 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
981 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
982 		zip->pack_stream_bytes_unconsumed = 0;
983 	}
984 }
985 
986 #ifdef HAVE_LZMA_H
987 
988 /*
989  * Set an error code and choose an error message for liblzma.
990  */
991 static void
set_error(struct archive_read * a,int ret)992 set_error(struct archive_read *a, int ret)
993 {
994 
995 	switch (ret) {
996 	case LZMA_STREAM_END: /* Found end of stream. */
997 	case LZMA_OK: /* Decompressor made some progress. */
998 		break;
999 	case LZMA_MEM_ERROR:
1000 		archive_set_error(&a->archive, ENOMEM,
1001 		    "Lzma library error: Cannot allocate memory");
1002 		break;
1003 	case LZMA_MEMLIMIT_ERROR:
1004 		archive_set_error(&a->archive, ENOMEM,
1005 		    "Lzma library error: Out of memory");
1006 		break;
1007 	case LZMA_FORMAT_ERROR:
1008 		archive_set_error(&a->archive,
1009 		    ARCHIVE_ERRNO_MISC,
1010 		    "Lzma library error: format not recognized");
1011 		break;
1012 	case LZMA_OPTIONS_ERROR:
1013 		archive_set_error(&a->archive,
1014 		    ARCHIVE_ERRNO_MISC,
1015 		    "Lzma library error: Invalid options");
1016 		break;
1017 	case LZMA_DATA_ERROR:
1018 		archive_set_error(&a->archive,
1019 		    ARCHIVE_ERRNO_MISC,
1020 		    "Lzma library error: Corrupted input data");
1021 		break;
1022 	case LZMA_BUF_ERROR:
1023 		archive_set_error(&a->archive,
1024 		    ARCHIVE_ERRNO_MISC,
1025 		    "Lzma library error:  No progress is possible");
1026 		break;
1027 	default:
1028 		/* Return an error. */
1029 		archive_set_error(&a->archive,
1030 		    ARCHIVE_ERRNO_MISC,
1031 		    "Lzma decompression failed:  Unknown error");
1032 		break;
1033 	}
1034 }
1035 
1036 #endif
1037 
1038 static unsigned long
decode_codec_id(const unsigned char * codecId,size_t id_size)1039 decode_codec_id(const unsigned char *codecId, size_t id_size)
1040 {
1041 	unsigned i;
1042 	unsigned long id = 0;
1043 
1044 	for (i = 0; i < id_size; i++) {
1045 		id <<= 8;
1046 		id += codecId[i];
1047 	}
1048 	return (id);
1049 }
1050 
1051 static Byte
ppmd_read(void * p)1052 ppmd_read(void *p)
1053 {
1054 	struct archive_read *a = ((IByteIn*)p)->a;
1055 	struct _7zip *zip = (struct _7zip *)(a->format->data);
1056 	Byte b;
1057 
1058 	if (zip->ppstream.avail_in <= 0) {
1059 		/*
1060 		 * Ppmd7_DecodeSymbol might require reading multiple bytes
1061 		 * and we are on boundary;
1062 		 * last resort to read using __archive_read_ahead.
1063 		 */
1064 		ssize_t bytes_avail = 0;
1065 		const uint8_t* data = __archive_read_ahead(a,
1066 		    zip->ppstream.stream_in+1, &bytes_avail);
1067 		if(bytes_avail < zip->ppstream.stream_in+1) {
1068 			archive_set_error(&a->archive,
1069 			    ARCHIVE_ERRNO_FILE_FORMAT,
1070 			    "Truncated 7z file data");
1071 			zip->ppstream.overconsumed = 1;
1072 			return (0);
1073 		}
1074 		zip->ppstream.next_in++;
1075 		b = data[zip->ppstream.stream_in];
1076 	} else {
1077 		b = *zip->ppstream.next_in++;
1078 	}
1079 	zip->ppstream.avail_in--;
1080 	zip->ppstream.total_in++;
1081 	zip->ppstream.stream_in++;
1082 	return (b);
1083 }
1084 
1085 static int
init_decompression(struct archive_read * a,struct _7zip * zip,const struct _7z_coder * coder1,const struct _7z_coder * coder2)1086 init_decompression(struct archive_read *a, struct _7zip *zip,
1087     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
1088 {
1089 	int r;
1090 
1091 	zip->codec = coder1->codec;
1092 	zip->codec2 = -1;
1093 
1094 	switch (zip->codec) {
1095 	case _7Z_COPY:
1096 	case _7Z_BZ2:
1097 	case _7Z_DEFLATE:
1098 	case _7Z_ZSTD:
1099 	case _7Z_PPMD:
1100 		if (coder2 != NULL) {
1101 			if (coder2->codec != _7Z_X86 &&
1102 			    coder2->codec != _7Z_X86_BCJ2 &&
1103 			    coder2->codec != _7Z_ARM &&
1104 			    coder2->codec != _7Z_ARM64) {
1105 				archive_set_error(&a->archive,
1106 				    ARCHIVE_ERRNO_MISC,
1107 				    "Unsupported filter %lx for %lx",
1108 				    coder2->codec, coder1->codec);
1109 				return (ARCHIVE_FAILED);
1110 			}
1111 			zip->codec2 = coder2->codec;
1112 			zip->bcj_state = 0;
1113 			if (coder2->codec == _7Z_X86)
1114 				x86_Init(zip);
1115 			else if (coder2->codec == _7Z_ARM)
1116 				arm_Init(zip);
1117 		}
1118 		break;
1119 	default:
1120 		break;
1121 	}
1122 
1123 	switch (zip->codec) {
1124 	case _7Z_COPY:
1125 		break;
1126 
1127 	case _7Z_LZMA: case _7Z_LZMA2:
1128 #ifdef HAVE_LZMA_H
1129 #if LZMA_VERSION_MAJOR >= 5
1130 /* Effectively disable the limiter. */
1131 #define LZMA_MEMLIMIT   UINT64_MAX
1132 #else
1133 /* NOTE: This needs to check memory size which running system has. */
1134 #define LZMA_MEMLIMIT   (1U << 30)
1135 #endif
1136 	{
1137 		lzma_options_delta delta_opt;
1138 		lzma_filter filters[LZMA_FILTERS_MAX], *ff;
1139 		int fi = 0;
1140 
1141 		if (zip->lzstream_valid) {
1142 			lzma_end(&(zip->lzstream));
1143 			zip->lzstream_valid = 0;
1144 		}
1145 
1146 		/*
1147 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
1148 		 * data made by 7-Zip because 7-Zip does not add End-Of-
1149 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
1150 		 * and so liblzma cannot know the end of the compressed data
1151 		 * without EOPM. So consequently liblzma will not return last
1152 		 * three or four bytes of uncompressed data because
1153 		 * LZMA_FILTER_X86 filter does not handle input data if its
1154 		 * data size is less than five bytes. If liblzma detect EOPM
1155 		 * or know the uncompressed data size, liblzma will flush out
1156 		 * the remaining that three or four bytes of uncompressed
1157 		 * data. That is why we have to use our converting program
1158 		 * for BCJ+LZMA. If we were able to tell the uncompressed
1159 		 * size to liblzma when using lzma_raw_decoder() liblzma
1160 		 * could correctly deal with BCJ+LZMA. But unfortunately
1161 		 * there is no way to do that.
1162 		 * Discussion about this can be found at XZ Utils forum.
1163 		 */
1164 		if (coder2 != NULL) {
1165 			zip->codec2 = coder2->codec;
1166 
1167 			filters[fi].options = NULL;
1168 			switch (zip->codec2) {
1169 			case _7Z_X86:
1170 				if (zip->codec == _7Z_LZMA2) {
1171 					filters[fi].id = LZMA_FILTER_X86;
1172 					fi++;
1173 				} else
1174 					/* Use our filter. */
1175 					x86_Init(zip);
1176 				break;
1177 			case _7Z_X86_BCJ2:
1178 				/* Use our filter. */
1179 				zip->bcj_state = 0;
1180 				break;
1181 			case _7Z_DELTA:
1182 				if (coder2->propertiesSize != 1) {
1183 					archive_set_error(&a->archive,
1184 					    ARCHIVE_ERRNO_MISC,
1185 					    "Invalid Delta parameter");
1186 					return (ARCHIVE_FAILED);
1187 				}
1188 				filters[fi].id = LZMA_FILTER_DELTA;
1189 				memset(&delta_opt, 0, sizeof(delta_opt));
1190 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1191 				delta_opt.dist =
1192 				    (uint32_t)coder2->properties[0] + 1;
1193 				filters[fi].options = &delta_opt;
1194 				fi++;
1195 				break;
1196 			/* Following filters have not been tested yet. */
1197 			case _7Z_POWERPC:
1198 				filters[fi].id = LZMA_FILTER_POWERPC;
1199 				fi++;
1200 				break;
1201 			case _7Z_IA64:
1202 				filters[fi].id = LZMA_FILTER_IA64;
1203 				fi++;
1204 				break;
1205 			case _7Z_ARM:
1206 				filters[fi].id = LZMA_FILTER_ARM;
1207 				fi++;
1208 				break;
1209 			case _7Z_ARMTHUMB:
1210 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1211 				fi++;
1212 				break;
1213 #ifdef LZMA_FILTER_ARM64
1214 			case _7Z_ARM64:
1215 				filters[fi].id = LZMA_FILTER_ARM64;
1216 				fi++;
1217 				break;
1218 #endif
1219 			case _7Z_SPARC:
1220 				filters[fi].id = LZMA_FILTER_SPARC;
1221 				fi++;
1222 				break;
1223 			default:
1224 				archive_set_error(&a->archive,
1225 				    ARCHIVE_ERRNO_MISC,
1226 				    "Unexpected codec ID: %lX", zip->codec2);
1227 				return (ARCHIVE_FAILED);
1228 			}
1229 		}
1230 
1231 		if (zip->codec == _7Z_LZMA2)
1232 			filters[fi].id = LZMA_FILTER_LZMA2;
1233 		else
1234 			filters[fi].id = LZMA_FILTER_LZMA1;
1235 		filters[fi].options = NULL;
1236 		ff = &filters[fi];
1237 		r = lzma_properties_decode(&filters[fi], NULL,
1238 		    coder1->properties, (size_t)coder1->propertiesSize);
1239 		if (r != LZMA_OK) {
1240 			set_error(a, r);
1241 			return (ARCHIVE_FAILED);
1242 		}
1243 		fi++;
1244 
1245 		filters[fi].id = LZMA_VLI_UNKNOWN;
1246 		filters[fi].options = NULL;
1247 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1248 		free(ff->options);
1249 		if (r != LZMA_OK) {
1250 			set_error(a, r);
1251 			return (ARCHIVE_FAILED);
1252 		}
1253 		zip->lzstream_valid = 1;
1254 		zip->lzstream.total_in = 0;
1255 		zip->lzstream.total_out = 0;
1256 		break;
1257 	}
1258 #else
1259 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1260 		    "LZMA codec is unsupported");
1261 		return (ARCHIVE_FAILED);
1262 #endif
1263 	case _7Z_BZ2:
1264 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1265 		if (zip->bzstream_valid) {
1266 			BZ2_bzDecompressEnd(&(zip->bzstream));
1267 			zip->bzstream_valid = 0;
1268 		}
1269 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1270 		if (r == BZ_MEM_ERROR)
1271 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1272 		if (r != BZ_OK) {
1273 			int err = ARCHIVE_ERRNO_MISC;
1274 			const char *detail = NULL;
1275 			switch (r) {
1276 			case BZ_PARAM_ERROR:
1277 				detail = "invalid setup parameter";
1278 				break;
1279 			case BZ_MEM_ERROR:
1280 				err = ENOMEM;
1281 				detail = "out of memory";
1282 				break;
1283 			case BZ_CONFIG_ERROR:
1284 				detail = "mis-compiled library";
1285 				break;
1286 			}
1287 			archive_set_error(&a->archive, err,
1288 			    "Internal error initializing decompressor: %s",
1289 			    detail != NULL ? detail : "??");
1290 			zip->bzstream_valid = 0;
1291 			return (ARCHIVE_FAILED);
1292 		}
1293 		zip->bzstream_valid = 1;
1294 		zip->bzstream.total_in_lo32 = 0;
1295 		zip->bzstream.total_in_hi32 = 0;
1296 		zip->bzstream.total_out_lo32 = 0;
1297 		zip->bzstream.total_out_hi32 = 0;
1298 		break;
1299 #else
1300 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1301 		    "BZ2 codec is unsupported");
1302 		return (ARCHIVE_FAILED);
1303 #endif
1304 	case _7Z_ZSTD:
1305 	{
1306 #if defined(HAVE_ZSTD_H)
1307 		if (zip->zstdstream_valid) {
1308 			ZSTD_freeDStream(zip->zstd_dstream);
1309 			zip->zstdstream_valid = 0;
1310 		}
1311 		zip->zstd_dstream = ZSTD_createDStream();
1312 		zip->zstdstream_valid = 1;
1313 		break;
1314 #else
1315 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1316 			"ZSTD codec is unsupported");
1317 		return (ARCHIVE_FAILED);
1318 #endif
1319 	}
1320 	case _7Z_DEFLATE:
1321 #ifdef HAVE_ZLIB_H
1322 		if (zip->stream_valid)
1323 			r = inflateReset(&(zip->stream));
1324 		else
1325 			r = inflateInit2(&(zip->stream),
1326 			    -15 /* Don't check for zlib header */);
1327 		if (r != Z_OK) {
1328 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1329 			    "Couldn't initialize zlib stream.");
1330 			return (ARCHIVE_FAILED);
1331 		}
1332 		zip->stream_valid = 1;
1333 		zip->stream.total_in = 0;
1334 		zip->stream.total_out = 0;
1335 		break;
1336 #else
1337 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1338 		    "DEFLATE codec is unsupported");
1339 		return (ARCHIVE_FAILED);
1340 #endif
1341 	case _7Z_PPMD:
1342 	{
1343 		unsigned order;
1344 		uint32_t msize;
1345 
1346 		if (zip->ppmd7_valid) {
1347 			__archive_ppmd7_functions.Ppmd7_Free(
1348 			    &zip->ppmd7_context);
1349 			zip->ppmd7_valid = 0;
1350 		}
1351 
1352 		if (coder1->propertiesSize < 5) {
1353 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1354 			    "Malformed PPMd parameter");
1355 			return (ARCHIVE_FAILED);
1356 		}
1357 		order = coder1->properties[0];
1358 		msize = archive_le32dec(&(coder1->properties[1]));
1359 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1360 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1361 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1362 			    "Malformed PPMd parameter");
1363 			return (ARCHIVE_FAILED);
1364 		}
1365 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1366 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1367 			&zip->ppmd7_context, msize);
1368 		if (r == 0) {
1369 			archive_set_error(&a->archive, ENOMEM,
1370 			    "Coludn't allocate memory for PPMd");
1371 			return (ARCHIVE_FATAL);
1372 		}
1373 		__archive_ppmd7_functions.Ppmd7_Init(
1374 			&zip->ppmd7_context, order);
1375 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1376 			&zip->range_dec);
1377 		zip->ppmd7_valid = 1;
1378 		zip->ppmd7_stat = 0;
1379 		zip->ppstream.overconsumed = 0;
1380 		zip->ppstream.total_in = 0;
1381 		zip->ppstream.total_out = 0;
1382 		break;
1383 	}
1384 	case _7Z_X86:
1385 	case _7Z_X86_BCJ2:
1386 	case _7Z_POWERPC:
1387 	case _7Z_IA64:
1388 	case _7Z_ARM:
1389 	case _7Z_ARMTHUMB:
1390 	case _7Z_ARM64:
1391 	case _7Z_SPARC:
1392 	case _7Z_DELTA:
1393 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1394 		    "Unexpected codec ID: %lX", zip->codec);
1395 		return (ARCHIVE_FAILED);
1396 	case _7Z_CRYPTO_MAIN_ZIP:
1397 	case _7Z_CRYPTO_RAR_29:
1398 	case _7Z_CRYPTO_AES_256_SHA_256:
1399 		if (a->entry) {
1400 			archive_entry_set_is_metadata_encrypted(a->entry, 1);
1401 			archive_entry_set_is_data_encrypted(a->entry, 1);
1402 			zip->has_encrypted_entries = 1;
1403 		}
1404 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1405 		    "Crypto codec not supported yet (ID: 0x%lX)", zip->codec);
1406 		return (ARCHIVE_FAILED);
1407 	default:
1408 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1409 		    "Unknown codec ID: %lX", zip->codec);
1410 		return (ARCHIVE_FAILED);
1411 	}
1412 
1413 	return (ARCHIVE_OK);
1414 }
1415 
1416 static int
decompress(struct archive_read * a,struct _7zip * zip,void * buff,size_t * outbytes,const void * b,size_t * used)1417 decompress(struct archive_read *a, struct _7zip *zip,
1418     void *buff, size_t *outbytes, const void *b, size_t *used)
1419 {
1420 	const uint8_t *t_next_in;
1421 	uint8_t *t_next_out;
1422 	size_t o_avail_in, o_avail_out;
1423 	size_t t_avail_in, t_avail_out;
1424 	uint8_t *bcj2_next_out;
1425 	size_t bcj2_avail_out;
1426 	int r, ret = ARCHIVE_OK;
1427 
1428 	t_avail_in = o_avail_in = *used;
1429 	t_avail_out = o_avail_out = *outbytes;
1430 	t_next_in = b;
1431 	t_next_out = buff;
1432 
1433 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1434 		int i;
1435 
1436 		/* Do not copy out the BCJ remaining bytes when the output
1437 		 * buffer size is less than five bytes. */
1438 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1439 			*used = 0;
1440 			*outbytes = 0;
1441 			return (ret);
1442 		}
1443 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1444 			*t_next_out++ = zip->odd_bcj[i];
1445 			t_avail_out--;
1446 			zip->odd_bcj_size--;
1447 		}
1448 		if (o_avail_in == 0 || t_avail_out == 0) {
1449 			*used = o_avail_in - t_avail_in;
1450 			*outbytes = o_avail_out - t_avail_out;
1451 			if (o_avail_in == 0)
1452 				ret = ARCHIVE_EOF;
1453 			return (ret);
1454 		}
1455 	}
1456 
1457 	bcj2_next_out = t_next_out;
1458 	bcj2_avail_out = t_avail_out;
1459 	if (zip->codec2 == _7Z_X86_BCJ2) {
1460 		/*
1461 		 * Decord a remaining decompressed main stream for BCJ2.
1462 		 */
1463 		if (zip->tmp_stream_bytes_remaining) {
1464 			ssize_t bytes;
1465 			size_t remaining = zip->tmp_stream_bytes_remaining;
1466 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1467 			if (bytes < 0) {
1468 				archive_set_error(&(a->archive),
1469 				    ARCHIVE_ERRNO_MISC,
1470 				    "BCJ2 conversion Failed");
1471 				return (ARCHIVE_FAILED);
1472 			}
1473 			zip->main_stream_bytes_remaining -=
1474 			    remaining - zip->tmp_stream_bytes_remaining;
1475 			t_avail_out -= bytes;
1476 			if (o_avail_in == 0 || t_avail_out == 0) {
1477 				*used = 0;
1478 				*outbytes = o_avail_out - t_avail_out;
1479 				if (o_avail_in == 0 &&
1480 				    zip->tmp_stream_bytes_remaining)
1481 					ret = ARCHIVE_EOF;
1482 				return (ret);
1483 			}
1484 			t_next_out += bytes;
1485 			bcj2_next_out = t_next_out;
1486 			bcj2_avail_out = t_avail_out;
1487 		}
1488 		t_next_out = zip->tmp_stream_buff;
1489 		t_avail_out = zip->tmp_stream_buff_size;
1490 	}
1491 
1492 	switch (zip->codec) {
1493 	case _7Z_COPY:
1494 	{
1495 		size_t bytes =
1496 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1497 
1498 		memcpy(t_next_out, t_next_in, bytes);
1499 		t_avail_in -= bytes;
1500 		t_avail_out -= bytes;
1501 		if (o_avail_in == 0)
1502 			ret = ARCHIVE_EOF;
1503 		break;
1504 	}
1505 #ifdef HAVE_LZMA_H
1506 	case _7Z_LZMA: case _7Z_LZMA2:
1507 		zip->lzstream.next_in = t_next_in;
1508 		zip->lzstream.avail_in = t_avail_in;
1509 		zip->lzstream.next_out = t_next_out;
1510 		zip->lzstream.avail_out = t_avail_out;
1511 
1512 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1513 		switch (r) {
1514 		case LZMA_STREAM_END: /* Found end of stream. */
1515 			lzma_end(&(zip->lzstream));
1516 			zip->lzstream_valid = 0;
1517 			ret = ARCHIVE_EOF;
1518 			break;
1519 		case LZMA_OK: /* Decompressor made some progress. */
1520 			break;
1521 		default:
1522 			archive_set_error(&(a->archive),
1523 			    ARCHIVE_ERRNO_MISC,
1524 				"Decompression failed(%d)",
1525 			    r);
1526 			return (ARCHIVE_FAILED);
1527 		}
1528 		t_avail_in = zip->lzstream.avail_in;
1529 		t_avail_out = zip->lzstream.avail_out;
1530 		break;
1531 #endif
1532 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1533 	case _7Z_BZ2:
1534 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1535 		zip->bzstream.avail_in = (uint32_t)t_avail_in;
1536 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1537 		zip->bzstream.avail_out = (uint32_t)t_avail_out;
1538 		r = BZ2_bzDecompress(&(zip->bzstream));
1539 		switch (r) {
1540 		case BZ_STREAM_END: /* Found end of stream. */
1541 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1542 			case BZ_OK:
1543 				break;
1544 			default:
1545 				archive_set_error(&(a->archive),
1546 				    ARCHIVE_ERRNO_MISC,
1547 				    "Failed to clean up decompressor");
1548 				return (ARCHIVE_FAILED);
1549 			}
1550 			zip->bzstream_valid = 0;
1551 			ret = ARCHIVE_EOF;
1552 			break;
1553 		case BZ_OK: /* Decompressor made some progress. */
1554 			break;
1555 		default:
1556 			archive_set_error(&(a->archive),
1557 			    ARCHIVE_ERRNO_MISC,
1558 			    "bzip decompression failed");
1559 			return (ARCHIVE_FAILED);
1560 		}
1561 		t_avail_in = zip->bzstream.avail_in;
1562 		t_avail_out = zip->bzstream.avail_out;
1563 		break;
1564 #endif
1565 #ifdef HAVE_ZLIB_H
1566 	case _7Z_DEFLATE:
1567 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1568 		zip->stream.avail_in = (uInt)t_avail_in;
1569 		zip->stream.next_out = t_next_out;
1570 		zip->stream.avail_out = (uInt)t_avail_out;
1571 		r = inflate(&(zip->stream), 0);
1572 		switch (r) {
1573 		case Z_STREAM_END: /* Found end of stream. */
1574 			ret = ARCHIVE_EOF;
1575 			break;
1576 		case Z_OK: /* Decompressor made some progress.*/
1577 			break;
1578 		default:
1579 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1580 			    "File decompression failed (%d)", r);
1581 			return (ARCHIVE_FAILED);
1582 		}
1583 		t_avail_in = zip->stream.avail_in;
1584 		t_avail_out = zip->stream.avail_out;
1585 		break;
1586 #endif
1587 #ifdef HAVE_ZSTD_H
1588 	case _7Z_ZSTD:
1589 	{
1590 		ZSTD_inBuffer input = { t_next_in, t_avail_in, 0 }; // src, size, pos
1591 		ZSTD_outBuffer output = { t_next_out, t_avail_out, 0 }; // dst, size, pos
1592 
1593 		size_t const zret = ZSTD_decompressStream(zip->zstd_dstream, &output, &input);
1594 		if (ZSTD_isError(zret)) {
1595 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, "Zstd decompression failed: %s", ZSTD_getErrorName(zret));
1596 			return ARCHIVE_FAILED;
1597 		}
1598 		t_avail_in -= input.pos;
1599 		t_avail_out -= output.pos;
1600 		break;
1601 	}
1602 #endif
1603 	case _7Z_PPMD:
1604 	{
1605 		uint64_t flush_bytes;
1606 
1607 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1608 		    t_avail_out <= 0) {
1609 			archive_set_error(&(a->archive),
1610 			    ARCHIVE_ERRNO_MISC,
1611 			    "Decompression internal error");
1612 			return (ARCHIVE_FAILED);
1613 		}
1614 		zip->ppstream.next_in = t_next_in;
1615 		zip->ppstream.avail_in = t_avail_in;
1616 		zip->ppstream.stream_in = 0;
1617 		zip->ppstream.next_out = t_next_out;
1618 		zip->ppstream.avail_out = t_avail_out;
1619 		if (zip->ppmd7_stat == 0) {
1620 			zip->bytein.a = a;
1621 			zip->bytein.Read = &ppmd_read;
1622 			zip->range_dec.Stream = &zip->bytein;
1623 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1624 				&(zip->range_dec));
1625 			if (r == 0) {
1626 				zip->ppmd7_stat = -1;
1627 				archive_set_error(&a->archive,
1628 				    ARCHIVE_ERRNO_MISC,
1629 				    "Failed to initialize PPMd range decoder");
1630 				return (ARCHIVE_FAILED);
1631 			}
1632 			if (zip->ppstream.overconsumed) {
1633 				zip->ppmd7_stat = -1;
1634 				return (ARCHIVE_FAILED);
1635 			}
1636 			zip->ppmd7_stat = 1;
1637 		}
1638 
1639 		if (t_avail_in == 0)
1640 			/* XXX Flush out remaining decoded data XXX */
1641 			flush_bytes = zip->folder_outbytes_remaining;
1642 		else
1643 			flush_bytes = 0;
1644 
1645 		do {
1646 			int sym;
1647 
1648 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1649 				&(zip->ppmd7_context), &(zip->range_dec.p));
1650 			if (sym < 0) {
1651 				zip->ppmd7_stat = -1;
1652 				archive_set_error(&a->archive,
1653 				    ARCHIVE_ERRNO_FILE_FORMAT,
1654 				    "Failed to decode PPMd");
1655 				return (ARCHIVE_FAILED);
1656 			}
1657 			if (zip->ppstream.overconsumed) {
1658 				zip->ppmd7_stat = -1;
1659 				return (ARCHIVE_FAILED);
1660 			}
1661 			*zip->ppstream.next_out++ = (unsigned char)sym;
1662 			zip->ppstream.avail_out--;
1663 			zip->ppstream.total_out++;
1664 			if (flush_bytes)
1665 				flush_bytes--;
1666 		} while (zip->ppstream.avail_out &&
1667 			(zip->ppstream.avail_in || flush_bytes));
1668 
1669 		t_avail_in = (size_t)zip->ppstream.avail_in;
1670 		t_avail_out = (size_t)zip->ppstream.avail_out;
1671 		break;
1672 	}
1673 	default:
1674 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1675 		    "Decompression internal error");
1676 		return (ARCHIVE_FAILED);
1677 	}
1678 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1679 		return (ret);
1680 
1681 	*used = o_avail_in - t_avail_in;
1682 	*outbytes = o_avail_out - t_avail_out;
1683 
1684 	/*
1685 	 * Decord BCJ.
1686 	 */
1687 	if (zip->codec != _7Z_LZMA2) {
1688 		if (zip->codec2 == _7Z_X86) {
1689 			size_t l = x86_Convert(zip, buff, *outbytes);
1690 
1691 			zip->odd_bcj_size = *outbytes - l;
1692 			if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1693 		    	o_avail_in && ret != ARCHIVE_EOF) {
1694 				memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1695 			    	zip->odd_bcj_size);
1696 				*outbytes = l;
1697 			} else
1698 				zip->odd_bcj_size = 0;
1699 		} else if (zip->codec2 == _7Z_ARM) {
1700 			*outbytes = arm_Convert(zip, buff, *outbytes);
1701 		} else if (zip->codec2 == _7Z_ARM64) {
1702 			*outbytes = arm64_Convert(zip, buff, *outbytes);
1703 		}
1704 	}
1705 
1706 	/*
1707 	 * Decord BCJ2 with a decompressed main stream.
1708 	 */
1709 	if (zip->codec2 == _7Z_X86_BCJ2) {
1710 		ssize_t bytes;
1711 
1712 		zip->tmp_stream_bytes_avail =
1713 		    zip->tmp_stream_buff_size - t_avail_out;
1714 		if (zip->tmp_stream_bytes_avail >
1715 		      zip->main_stream_bytes_remaining)
1716 			zip->tmp_stream_bytes_avail =
1717 			    zip->main_stream_bytes_remaining;
1718 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1719 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1720 		if (bytes < 0) {
1721 			archive_set_error(&(a->archive),
1722 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1723 			return (ARCHIVE_FAILED);
1724 		}
1725 		zip->main_stream_bytes_remaining -=
1726 		    zip->tmp_stream_bytes_avail
1727 		      - zip->tmp_stream_bytes_remaining;
1728 		bcj2_avail_out -= bytes;
1729 		*outbytes = o_avail_out - bcj2_avail_out;
1730 	}
1731 
1732 	return (ret);
1733 }
1734 
1735 static int
free_decompression(struct archive_read * a,struct _7zip * zip)1736 free_decompression(struct archive_read *a, struct _7zip *zip)
1737 {
1738 	int r = ARCHIVE_OK;
1739 
1740 #if !defined(HAVE_ZLIB_H) &&\
1741 	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1742 	(void)a;/* UNUSED */
1743 #endif
1744 #ifdef HAVE_LZMA_H
1745 	if (zip->lzstream_valid)
1746 		lzma_end(&(zip->lzstream));
1747 #endif
1748 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1749 	if (zip->bzstream_valid) {
1750 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1751 			archive_set_error(&a->archive,
1752 			    ARCHIVE_ERRNO_MISC,
1753 			    "Failed to clean up bzip2 decompressor");
1754 			r = ARCHIVE_FATAL;
1755 		}
1756 		zip->bzstream_valid = 0;
1757 	}
1758 #endif
1759 #ifdef HAVE_ZLIB_H
1760 	if (zip->stream_valid) {
1761 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1762 			archive_set_error(&a->archive,
1763 			    ARCHIVE_ERRNO_MISC,
1764 			    "Failed to clean up zlib decompressor");
1765 			r = ARCHIVE_FATAL;
1766 		}
1767 		zip->stream_valid = 0;
1768 	}
1769 #endif
1770 	if (zip->ppmd7_valid) {
1771 		__archive_ppmd7_functions.Ppmd7_Free(
1772 			&zip->ppmd7_context);
1773 		zip->ppmd7_valid = 0;
1774 	}
1775 	return (r);
1776 }
1777 
1778 static int
parse_7zip_uint64(struct archive_read * a,uint64_t * val)1779 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1780 {
1781 	const unsigned char *p;
1782 	unsigned char avail, mask;
1783 	int i;
1784 
1785 	if ((p = header_bytes(a, 1)) == NULL)
1786 		return (-1);
1787 	avail = *p;
1788 	mask = 0x80;
1789 	*val = 0;
1790 	for (i = 0; i < 8; i++) {
1791 		if (avail & mask) {
1792 			if ((p = header_bytes(a, 1)) == NULL)
1793 				return (-1);
1794 			*val |= ((uint64_t)*p) << (8 * i);
1795 			mask >>= 1;
1796 			continue;
1797 		}
1798 		*val += ((uint64_t)(avail & (mask -1))) << (8 * i);
1799 		break;
1800 	}
1801 	return (0);
1802 }
1803 
1804 static int
read_Bools(struct archive_read * a,unsigned char * data,size_t num)1805 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1806 {
1807 	const unsigned char *p;
1808 	unsigned i, mask = 0, avail = 0;
1809 
1810 	for (i = 0; i < num; i++) {
1811 		if (mask == 0) {
1812 			if ((p = header_bytes(a, 1)) == NULL)
1813 				return (-1);
1814 			avail = *p;
1815 			mask = 0x80;
1816 		}
1817 		data[i] = (avail & mask)?1:0;
1818 		mask >>= 1;
1819 	}
1820 	return (0);
1821 }
1822 
1823 static void
free_Digest(struct _7z_digests * d)1824 free_Digest(struct _7z_digests *d)
1825 {
1826 	free(d->defineds);
1827 	free(d->digests);
1828 }
1829 
1830 static int
read_Digests(struct archive_read * a,struct _7z_digests * d,size_t num)1831 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1832 {
1833 	const unsigned char *p;
1834 	unsigned i;
1835 
1836 	if (num == 0)
1837 		return (-1);
1838 	memset(d, 0, sizeof(*d));
1839 
1840 	d->defineds = malloc(num);
1841 	if (d->defineds == NULL)
1842 		return (-1);
1843 	/*
1844 	 * Read Bools.
1845 	 */
1846 	if ((p = header_bytes(a, 1)) == NULL)
1847 		return (-1);
1848 	if (*p == 0) {
1849 		if (read_Bools(a, d->defineds, num) < 0)
1850 			return (-1);
1851 	} else
1852 		/* All are defined */
1853 		memset(d->defineds, 1, num);
1854 
1855 	d->digests = calloc(num, sizeof(*d->digests));
1856 	if (d->digests == NULL)
1857 		return (-1);
1858 	for (i = 0; i < num; i++) {
1859 		if (d->defineds[i]) {
1860 			if ((p = header_bytes(a, 4)) == NULL)
1861 				return (-1);
1862 			d->digests[i] = archive_le32dec(p);
1863 		}
1864 	}
1865 
1866 	return (0);
1867 }
1868 
1869 static void
free_PackInfo(struct _7z_pack_info * pi)1870 free_PackInfo(struct _7z_pack_info *pi)
1871 {
1872 	free(pi->sizes);
1873 	free(pi->positions);
1874 	free_Digest(&(pi->digest));
1875 }
1876 
1877 static int
read_PackInfo(struct archive_read * a,struct _7z_pack_info * pi)1878 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1879 {
1880 	const unsigned char *p;
1881 	unsigned i;
1882 
1883 	memset(pi, 0, sizeof(*pi));
1884 
1885 	/*
1886 	 * Read PackPos.
1887 	 */
1888 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1889 		return (-1);
1890 
1891 	/*
1892 	 * Read NumPackStreams.
1893 	 */
1894 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1895 		return (-1);
1896 	if (pi->numPackStreams == 0)
1897 		return (-1);
1898 	if (UMAX_ENTRY < pi->numPackStreams)
1899 		return (-1);
1900 
1901 	/*
1902 	 * Read PackSizes[num]
1903 	 */
1904 	if ((p = header_bytes(a, 1)) == NULL)
1905 		return (-1);
1906 	if (*p == kEnd)
1907 		/* PackSizes[num] are not present. */
1908 		return (0);
1909 	if (*p != kSize)
1910 		return (-1);
1911 	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1912 	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1913 	if (pi->sizes == NULL || pi->positions == NULL)
1914 		return (-1);
1915 
1916 	for (i = 0; i < pi->numPackStreams; i++) {
1917 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1918 			return (-1);
1919 	}
1920 
1921 	/*
1922 	 * Read PackStreamDigests[num]
1923 	 */
1924 	if ((p = header_bytes(a, 1)) == NULL)
1925 		return (-1);
1926 	if (*p == kEnd) {
1927 		/* PackStreamDigests[num] are not present. */
1928 		pi->digest.defineds =
1929 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1930 		pi->digest.digests =
1931 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1932 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1933 			return (-1);
1934 		return (0);
1935 	}
1936 
1937 	if (*p != kCRC)
1938 		return (-1);
1939 
1940 	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1941 		return (-1);
1942 
1943 	/*
1944 	 *  Must be marked by kEnd.
1945 	 */
1946 	if ((p = header_bytes(a, 1)) == NULL)
1947 		return (-1);
1948 	if (*p != kEnd)
1949 		return (-1);
1950 	return (0);
1951 }
1952 
1953 static void
free_Folder(struct _7z_folder * f)1954 free_Folder(struct _7z_folder *f)
1955 {
1956 	unsigned i;
1957 
1958 	if (f->coders) {
1959 		for (i = 0; i< f->numCoders; i++) {
1960 			free(f->coders[i].properties);
1961 		}
1962 		free(f->coders);
1963 	}
1964 	free(f->bindPairs);
1965 	free(f->packedStreams);
1966 	free(f->unPackSize);
1967 }
1968 
1969 static int
read_Folder(struct archive_read * a,struct _7z_folder * f)1970 read_Folder(struct archive_read *a, struct _7z_folder *f)
1971 {
1972 	struct _7zip *zip = (struct _7zip *)a->format->data;
1973 	const unsigned char *p;
1974 	uint64_t numInStreamsTotal = 0;
1975 	uint64_t numOutStreamsTotal = 0;
1976 	unsigned i;
1977 
1978 	memset(f, 0, sizeof(*f));
1979 
1980 	/*
1981 	 * Read NumCoders.
1982 	 */
1983 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1984 		return (-1);
1985 	if (f->numCoders > 4)
1986 		/* Too many coders. */
1987 		return (-1);
1988 
1989 	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1990 	if (f->coders == NULL)
1991 		return (-1);
1992 	for (i = 0; i< f->numCoders; i++) {
1993 		size_t codec_size;
1994 		int simple, attr;
1995 
1996 		if ((p = header_bytes(a, 1)) == NULL)
1997 			return (-1);
1998 		/*
1999 		 * 0:3 CodecIdSize
2000 		 * 4:  0 - IsSimple
2001 		 *     1 - Is not Simple
2002 		 * 5:  0 - No Attributes
2003 		 *     1 - There are Attributes;
2004 		 * 7:  Must be zero.
2005 		 */
2006 		codec_size = *p & 0xf;
2007 		simple = (*p & 0x10)?0:1;
2008 		attr = *p & 0x20;
2009 		if (*p & 0x80)
2010 			return (-1);/* Not supported. */
2011 
2012 		/*
2013 		 * Read Decompression Method IDs.
2014 		 */
2015 		if ((p = header_bytes(a, codec_size)) == NULL)
2016 			return (-1);
2017 
2018 		f->coders[i].codec = decode_codec_id(p, codec_size);
2019 
2020 		if (simple) {
2021 			f->coders[i].numInStreams = 1;
2022 			f->coders[i].numOutStreams = 1;
2023 		} else {
2024 			if (parse_7zip_uint64(
2025 			    a, &(f->coders[i].numInStreams)) < 0)
2026 				return (-1);
2027 			if (UMAX_ENTRY < f->coders[i].numInStreams)
2028 				return (-1);
2029 			if (parse_7zip_uint64(
2030 			    a, &(f->coders[i].numOutStreams)) < 0)
2031 				return (-1);
2032 			if (UMAX_ENTRY < f->coders[i].numOutStreams)
2033 				return (-1);
2034 		}
2035 
2036 		if (attr) {
2037 			if (parse_7zip_uint64(
2038 			    a, &(f->coders[i].propertiesSize)) < 0)
2039 				return (-1);
2040 			if (UMAX_ENTRY < f->coders[i].propertiesSize)
2041 				return (-1);
2042 			if ((p = header_bytes(
2043 			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
2044 				return (-1);
2045 			f->coders[i].properties =
2046 			    malloc((size_t)f->coders[i].propertiesSize);
2047 			if (f->coders[i].properties == NULL)
2048 				return (-1);
2049 			memcpy(f->coders[i].properties, p,
2050 			    (size_t)f->coders[i].propertiesSize);
2051 		}
2052 
2053 		numInStreamsTotal += f->coders[i].numInStreams;
2054 		numOutStreamsTotal += f->coders[i].numOutStreams;
2055 	}
2056 
2057 	if (numOutStreamsTotal == 0 ||
2058 	    numInStreamsTotal < numOutStreamsTotal-1)
2059 		return (-1);
2060 
2061 	f->numBindPairs = numOutStreamsTotal - 1;
2062 	if (zip->header_bytes_remaining < f->numBindPairs)
2063 			return (-1);
2064 	if (f->numBindPairs > 0) {
2065 		f->bindPairs =
2066 			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
2067 		if (f->bindPairs == NULL)
2068 			return (-1);
2069 	} else
2070 		f->bindPairs = NULL;
2071 	for (i = 0; i < f->numBindPairs; i++) {
2072 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
2073 			return (-1);
2074 		if (UMAX_ENTRY < f->bindPairs[i].inIndex)
2075 			return (-1);
2076 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
2077 			return (-1);
2078 		if (UMAX_ENTRY < f->bindPairs[i].outIndex)
2079 			return (-1);
2080 	}
2081 
2082 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
2083 	f->packedStreams =
2084 	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
2085 	if (f->packedStreams == NULL)
2086 		return (-1);
2087 	if (f->numPackedStreams == 1) {
2088 		for (i = 0; i < numInStreamsTotal; i++) {
2089 			unsigned j;
2090 			for (j = 0; j < f->numBindPairs; j++) {
2091 				if (f->bindPairs[j].inIndex == i)
2092 					break;
2093 			}
2094 			if (j == f->numBindPairs)
2095 				break;
2096 		}
2097 		if (i == numInStreamsTotal)
2098 			return (-1);
2099 		f->packedStreams[0] = i;
2100 	} else {
2101 		for (i = 0; i < f->numPackedStreams; i++) {
2102 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
2103 				return (-1);
2104 			if (UMAX_ENTRY < f->packedStreams[i])
2105 				return (-1);
2106 		}
2107 	}
2108 	f->numInStreams = numInStreamsTotal;
2109 	f->numOutStreams = numOutStreamsTotal;
2110 
2111 	return (0);
2112 }
2113 
2114 static void
free_CodersInfo(struct _7z_coders_info * ci)2115 free_CodersInfo(struct _7z_coders_info *ci)
2116 {
2117 	unsigned i;
2118 
2119 	if (ci->folders) {
2120 		for (i = 0; i < ci->numFolders; i++)
2121 			free_Folder(&(ci->folders[i]));
2122 		free(ci->folders);
2123 	}
2124 }
2125 
2126 static int
read_CodersInfo(struct archive_read * a,struct _7z_coders_info * ci)2127 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
2128 {
2129 	const unsigned char *p;
2130 	struct _7z_digests digest;
2131 	unsigned i;
2132 
2133 	memset(ci, 0, sizeof(*ci));
2134 	memset(&digest, 0, sizeof(digest));
2135 
2136 	if ((p = header_bytes(a, 1)) == NULL)
2137 		goto failed;
2138 	if (*p != kFolder)
2139 		goto failed;
2140 
2141 	/*
2142 	 * Read NumFolders.
2143 	 */
2144 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
2145 		goto failed;
2146 	if (UMAX_ENTRY < ci->numFolders)
2147 		return (-1);
2148 
2149 	/*
2150 	 * Read External.
2151 	 */
2152 	if ((p = header_bytes(a, 1)) == NULL)
2153 		goto failed;
2154 	switch (*p) {
2155 	case 0:
2156 		ci->folders =
2157 			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
2158 		if (ci->folders == NULL)
2159 			return (-1);
2160 		for (i = 0; i < ci->numFolders; i++) {
2161 			if (read_Folder(a, &(ci->folders[i])) < 0)
2162 				goto failed;
2163 		}
2164 		break;
2165 	case 1:
2166 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
2167 			return (-1);
2168 		if (UMAX_ENTRY < ci->dataStreamIndex)
2169 			return (-1);
2170 		if (ci->numFolders > 0) {
2171 			archive_set_error(&a->archive, -1,
2172 			    "Malformed 7-Zip archive");
2173 			goto failed;
2174 		}
2175 		break;
2176 	default:
2177 		archive_set_error(&a->archive, -1,
2178 		    "Malformed 7-Zip archive");
2179 		goto failed;
2180 	}
2181 
2182 	if ((p = header_bytes(a, 1)) == NULL)
2183 		goto failed;
2184 	if (*p != kCodersUnPackSize)
2185 		goto failed;
2186 
2187 	for (i = 0; i < ci->numFolders; i++) {
2188 		struct _7z_folder *folder = &(ci->folders[i]);
2189 		unsigned j;
2190 
2191 		folder->unPackSize =
2192 		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
2193 		if (folder->unPackSize == NULL)
2194 			goto failed;
2195 		for (j = 0; j < folder->numOutStreams; j++) {
2196 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
2197 				goto failed;
2198 		}
2199 	}
2200 
2201 	/*
2202 	 * Read CRCs.
2203 	 */
2204 	if ((p = header_bytes(a, 1)) == NULL)
2205 		goto failed;
2206 	if (*p == kEnd)
2207 		return (0);
2208 	if (*p != kCRC)
2209 		goto failed;
2210 	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
2211 		goto failed;
2212 	for (i = 0; i < ci->numFolders; i++) {
2213 		ci->folders[i].digest_defined = digest.defineds[i];
2214 		ci->folders[i].digest = digest.digests[i];
2215 	}
2216 
2217 	/*
2218 	 *  Must be kEnd.
2219 	 */
2220 	if ((p = header_bytes(a, 1)) == NULL)
2221 		goto failed;
2222 	if (*p != kEnd)
2223 		goto failed;
2224 	free_Digest(&digest);
2225 	return (0);
2226 failed:
2227 	free_Digest(&digest);
2228 	return (-1);
2229 }
2230 
2231 static uint64_t
folder_uncompressed_size(struct _7z_folder * f)2232 folder_uncompressed_size(struct _7z_folder *f)
2233 {
2234 	int n = (int)f->numOutStreams;
2235 	unsigned pairs = (unsigned)f->numBindPairs;
2236 
2237 	while (--n >= 0) {
2238 		unsigned i;
2239 		for (i = 0; i < pairs; i++) {
2240 			if (f->bindPairs[i].outIndex == (uint64_t)n)
2241 				break;
2242 		}
2243 		if (i >= pairs)
2244 			return (f->unPackSize[n]);
2245 	}
2246 	return (0);
2247 }
2248 
2249 static void
free_SubStreamsInfo(struct _7z_substream_info * ss)2250 free_SubStreamsInfo(struct _7z_substream_info *ss)
2251 {
2252 	free(ss->unpackSizes);
2253 	free(ss->digestsDefined);
2254 	free(ss->digests);
2255 }
2256 
2257 static int
read_SubStreamsInfo(struct archive_read * a,struct _7z_substream_info * ss,struct _7z_folder * f,size_t numFolders)2258 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2259     struct _7z_folder *f, size_t numFolders)
2260 {
2261 	const unsigned char *p;
2262 	uint64_t *usizes;
2263 	size_t unpack_streams;
2264 	int type;
2265 	unsigned i;
2266 	uint32_t numDigests;
2267 
2268 	memset(ss, 0, sizeof(*ss));
2269 
2270 	for (i = 0; i < numFolders; i++)
2271 		f[i].numUnpackStreams = 1;
2272 
2273 	if ((p = header_bytes(a, 1)) == NULL)
2274 		return (-1);
2275 	type = *p;
2276 
2277 	if (type == kNumUnPackStream) {
2278 		unpack_streams = 0;
2279 		for (i = 0; i < numFolders; i++) {
2280 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2281 				return (-1);
2282 			if (UMAX_ENTRY < f[i].numUnpackStreams)
2283 				return (-1);
2284 			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
2285 				return (-1);
2286 			}
2287 			unpack_streams += (size_t)f[i].numUnpackStreams;
2288 		}
2289 		if ((p = header_bytes(a, 1)) == NULL)
2290 			return (-1);
2291 		type = *p;
2292 	} else
2293 		unpack_streams = numFolders;
2294 
2295 	ss->unpack_streams = unpack_streams;
2296 	if (unpack_streams) {
2297 		ss->unpackSizes = calloc(unpack_streams,
2298 		    sizeof(*ss->unpackSizes));
2299 		ss->digestsDefined = calloc(unpack_streams,
2300 		    sizeof(*ss->digestsDefined));
2301 		ss->digests = calloc(unpack_streams,
2302 		    sizeof(*ss->digests));
2303 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2304 		    ss->digests == NULL)
2305 			return (-1);
2306 	}
2307 
2308 	usizes = ss->unpackSizes;
2309 	for (i = 0; i < numFolders; i++) {
2310 		unsigned pack;
2311 		uint64_t sum;
2312 
2313 		if (f[i].numUnpackStreams == 0)
2314 			continue;
2315 
2316 		sum = 0;
2317 		if (type == kSize) {
2318 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2319 				if (parse_7zip_uint64(a, usizes) < 0)
2320 					return (-1);
2321 				sum += *usizes++;
2322 			}
2323 		}
2324 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2325 	}
2326 
2327 	if (type == kSize) {
2328 		if ((p = header_bytes(a, 1)) == NULL)
2329 			return (-1);
2330 		type = *p;
2331 	}
2332 
2333 	for (i = 0; i < unpack_streams; i++) {
2334 		ss->digestsDefined[i] = 0;
2335 		ss->digests[i] = 0;
2336 	}
2337 
2338 	numDigests = 0;
2339 	for (i = 0; i < numFolders; i++) {
2340 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2341 			numDigests += (uint32_t)f[i].numUnpackStreams;
2342 	}
2343 
2344 	if (type == kCRC) {
2345 		struct _7z_digests tmpDigests;
2346 		unsigned char *digestsDefined = ss->digestsDefined;
2347 		uint32_t * digests = ss->digests;
2348 		int di = 0;
2349 
2350 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2351 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2352 			free_Digest(&tmpDigests);
2353 			return (-1);
2354 		}
2355 		for (i = 0; i < numFolders; i++) {
2356 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2357 				*digestsDefined++ = 1;
2358 				*digests++ = f[i].digest;
2359 			} else {
2360 				unsigned j;
2361 
2362 				for (j = 0; j < f[i].numUnpackStreams;
2363 				    j++, di++) {
2364 					*digestsDefined++ =
2365 					    tmpDigests.defineds[di];
2366 					*digests++ =
2367 					    tmpDigests.digests[di];
2368 				}
2369 			}
2370 		}
2371 		free_Digest(&tmpDigests);
2372 		if ((p = header_bytes(a, 1)) == NULL)
2373 			return (-1);
2374 		type = *p;
2375 	}
2376 
2377 	/*
2378 	 *  Must be kEnd.
2379 	 */
2380 	if (type != kEnd)
2381 		return (-1);
2382 	return (0);
2383 }
2384 
2385 static void
free_StreamsInfo(struct _7z_stream_info * si)2386 free_StreamsInfo(struct _7z_stream_info *si)
2387 {
2388 	free_PackInfo(&(si->pi));
2389 	free_CodersInfo(&(si->ci));
2390 	free_SubStreamsInfo(&(si->ss));
2391 }
2392 
2393 static int
read_StreamsInfo(struct archive_read * a,struct _7z_stream_info * si)2394 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2395 {
2396 	struct _7zip *zip = (struct _7zip *)a->format->data;
2397 	const unsigned char *p;
2398 	unsigned i;
2399 
2400 	memset(si, 0, sizeof(*si));
2401 
2402 	if ((p = header_bytes(a, 1)) == NULL)
2403 		return (-1);
2404 	if (*p == kPackInfo) {
2405 		uint64_t packPos;
2406 
2407 		if (read_PackInfo(a, &(si->pi)) < 0)
2408 			return (-1);
2409 
2410 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2411 			return (-1);
2412 		/*
2413 		 * Calculate packed stream positions.
2414 		 */
2415 		packPos = si->pi.pos;
2416 		for (i = 0; i < si->pi.numPackStreams; i++) {
2417 			si->pi.positions[i] = packPos;
2418 			packPos += si->pi.sizes[i];
2419 			if (packPos > zip->header_offset)
2420 				return (-1);
2421 		}
2422 		if ((p = header_bytes(a, 1)) == NULL)
2423 			return (-1);
2424 	}
2425 	if (*p == kUnPackInfo) {
2426 		uint32_t packIndex;
2427 		struct _7z_folder *f;
2428 
2429 		if (read_CodersInfo(a, &(si->ci)) < 0)
2430 			return (-1);
2431 
2432 		/*
2433 		 * Calculate packed stream indexes.
2434 		 */
2435 		packIndex = 0;
2436 		f = si->ci.folders;
2437 		for (i = 0; i < si->ci.numFolders; i++) {
2438 			f[i].packIndex = packIndex;
2439 			packIndex += (uint32_t)f[i].numPackedStreams;
2440 			if (packIndex > si->pi.numPackStreams)
2441 				return (-1);
2442 		}
2443 		if ((p = header_bytes(a, 1)) == NULL)
2444 			return (-1);
2445 	}
2446 
2447 	if (*p == kSubStreamsInfo) {
2448 		if (read_SubStreamsInfo(a, &(si->ss),
2449 		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2450 			return (-1);
2451 		if ((p = header_bytes(a, 1)) == NULL)
2452 			return (-1);
2453 	}
2454 
2455 	/*
2456 	 *  Must be kEnd.
2457 	 */
2458 	if (*p != kEnd)
2459 		return (-1);
2460 	return (0);
2461 }
2462 
2463 static void
free_Header(struct _7z_header_info * h)2464 free_Header(struct _7z_header_info *h)
2465 {
2466 	free(h->emptyStreamBools);
2467 	free(h->emptyFileBools);
2468 	free(h->antiBools);
2469 	free(h->attrBools);
2470 }
2471 
2472 static int
read_Header(struct archive_read * a,struct _7z_header_info * h,int check_header_id)2473 read_Header(struct archive_read *a, struct _7z_header_info *h,
2474     int check_header_id)
2475 {
2476 	struct _7zip *zip = (struct _7zip *)a->format->data;
2477 	const unsigned char *p;
2478 	struct _7z_folder *folders;
2479 	struct _7z_stream_info *si = &(zip->si);
2480 	struct _7zip_entry *entries;
2481 	uint32_t folderIndex, indexInFolder;
2482 	unsigned i;
2483 	int eindex, empty_streams, sindex;
2484 
2485 	if (check_header_id) {
2486 		/*
2487 		 * Read Header.
2488 		 */
2489 		if ((p = header_bytes(a, 1)) == NULL)
2490 			return (-1);
2491 		if (*p != kHeader)
2492 			return (-1);
2493 	}
2494 
2495 	/*
2496 	 * Read ArchiveProperties.
2497 	 */
2498 	if ((p = header_bytes(a, 1)) == NULL)
2499 		return (-1);
2500 	if (*p == kArchiveProperties) {
2501 		for (;;) {
2502 			uint64_t size;
2503 			if ((p = header_bytes(a, 1)) == NULL)
2504 				return (-1);
2505 			if (*p == 0)
2506 				break;
2507 			if (parse_7zip_uint64(a, &size) < 0)
2508 				return (-1);
2509 		}
2510 		if ((p = header_bytes(a, 1)) == NULL)
2511 			return (-1);
2512 	}
2513 
2514 	/*
2515 	 * Read MainStreamsInfo.
2516 	 */
2517 	if (*p == kMainStreamsInfo) {
2518 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2519 			return (-1);
2520 		if ((p = header_bytes(a, 1)) == NULL)
2521 			return (-1);
2522 	}
2523 	if (*p == kEnd)
2524 		return (0);
2525 
2526 	/*
2527 	 * Read FilesInfo.
2528 	 */
2529 	if (*p != kFilesInfo)
2530 		return (-1);
2531 
2532 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2533 		return (-1);
2534 	if (UMAX_ENTRY < zip->numFiles)
2535 		return (-1);
2536 
2537 	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2538 	if (zip->entries == NULL)
2539 		return (-1);
2540 	entries = zip->entries;
2541 
2542 	empty_streams = 0;
2543 	for (;;) {
2544 		int type;
2545 		uint64_t size;
2546 		size_t ll;
2547 
2548 		if ((p = header_bytes(a, 1)) == NULL)
2549 			return (-1);
2550 		type = *p;
2551 		if (type == kEnd)
2552 			break;
2553 
2554 		if (parse_7zip_uint64(a, &size) < 0)
2555 			return (-1);
2556 		if (zip->header_bytes_remaining < size)
2557 			return (-1);
2558 		ll = (size_t)size;
2559 
2560 		switch (type) {
2561 		case kEmptyStream:
2562 			if (h->emptyStreamBools != NULL)
2563 				return (-1);
2564 			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2565 			    sizeof(*h->emptyStreamBools));
2566 			if (h->emptyStreamBools == NULL)
2567 				return (-1);
2568 			if (read_Bools(
2569 			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2570 				return (-1);
2571 			empty_streams = 0;
2572 			for (i = 0; i < zip->numFiles; i++) {
2573 				if (h->emptyStreamBools[i])
2574 					empty_streams++;
2575 			}
2576 			break;
2577 		case kEmptyFile:
2578 			if (empty_streams <= 0) {
2579 				/* Unexcepted sequence. Skip this. */
2580 				if (header_bytes(a, ll) == NULL)
2581 					return (-1);
2582 				break;
2583 			}
2584 			if (h->emptyFileBools != NULL)
2585 				return (-1);
2586 			h->emptyFileBools = calloc(empty_streams,
2587 			    sizeof(*h->emptyFileBools));
2588 			if (h->emptyFileBools == NULL)
2589 				return (-1);
2590 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2591 				return (-1);
2592 			break;
2593 		case kAnti:
2594 			if (empty_streams <= 0) {
2595 				/* Unexcepted sequence. Skip this. */
2596 				if (header_bytes(a, ll) == NULL)
2597 					return (-1);
2598 				break;
2599 			}
2600 			if (h->antiBools != NULL)
2601 				return (-1);
2602 			h->antiBools = calloc(empty_streams,
2603 			    sizeof(*h->antiBools));
2604 			if (h->antiBools == NULL)
2605 				return (-1);
2606 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2607 				return (-1);
2608 			break;
2609 		case kCTime:
2610 		case kATime:
2611 		case kMTime:
2612 			if (read_Times(a, h, type) < 0)
2613 				return (-1);
2614 			break;
2615 		case kName:
2616 		{
2617 			unsigned char *np;
2618 			size_t nl, nb;
2619 
2620 			/* Skip one byte. */
2621 			if ((p = header_bytes(a, 1)) == NULL)
2622 				return (-1);
2623 			ll--;
2624 
2625 			if ((ll & 1) || ll < zip->numFiles * 4)
2626 				return (-1);
2627 
2628 			if (zip->entry_names != NULL)
2629 				return (-1);
2630 			zip->entry_names = malloc(ll);
2631 			if (zip->entry_names == NULL)
2632 				return (-1);
2633 			np = zip->entry_names;
2634 			nb = ll;
2635 			/*
2636 			 * Copy whole file names.
2637 			 * NOTE: This loop prevents from expanding
2638 			 * the uncompressed buffer in order not to
2639 			 * use extra memory resource.
2640 			 */
2641 			while (nb) {
2642 				size_t b;
2643 				if (nb > UBUFF_SIZE)
2644 					b = UBUFF_SIZE;
2645 				else
2646 					b = nb;
2647 				if ((p = header_bytes(a, b)) == NULL)
2648 					return (-1);
2649 				memcpy(np, p, b);
2650 				np += b;
2651 				nb -= b;
2652 			}
2653 			np = zip->entry_names;
2654 			nl = ll;
2655 
2656 			for (i = 0; i < zip->numFiles; i++) {
2657 				entries[i].utf16name = np;
2658 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2659 				entries[i].wname = (wchar_t *)np;
2660 #endif
2661 
2662 				/* Find a terminator. */
2663 				while (nl >= 2 && (np[0] || np[1])) {
2664 					np += 2;
2665 					nl -= 2;
2666 				}
2667 				if (nl < 2)
2668 					return (-1);/* Terminator not found */
2669 				entries[i].name_len = np - entries[i].utf16name;
2670 				np += 2;
2671 				nl -= 2;
2672 			}
2673 			break;
2674 		}
2675 		case kAttributes:
2676 		{
2677 			int allAreDefined;
2678 
2679 			if ((p = header_bytes(a, 2)) == NULL)
2680 				return (-1);
2681 			allAreDefined = *p;
2682 			if (h->attrBools != NULL)
2683 				return (-1);
2684 			h->attrBools = calloc((size_t)zip->numFiles,
2685 			    sizeof(*h->attrBools));
2686 			if (h->attrBools == NULL)
2687 				return (-1);
2688 			if (allAreDefined)
2689 				memset(h->attrBools, 1, (size_t)zip->numFiles);
2690 			else {
2691 				if (read_Bools(a, h->attrBools,
2692 				      (size_t)zip->numFiles) < 0)
2693 					return (-1);
2694 			}
2695 			for (i = 0; i < zip->numFiles; i++) {
2696 				if (h->attrBools[i]) {
2697 					if ((p = header_bytes(a, 4)) == NULL)
2698 						return (-1);
2699 					entries[i].attr = archive_le32dec(p);
2700 				}
2701 			}
2702 			break;
2703 		}
2704 		case kDummy:
2705 			if (ll == 0)
2706 				break;
2707 			__LA_FALLTHROUGH;
2708 		default:
2709 			if (header_bytes(a, ll) == NULL)
2710 				return (-1);
2711 			break;
2712 		}
2713 	}
2714 
2715 	/*
2716 	 * Set up entry's attributes.
2717 	 */
2718 	folders = si->ci.folders;
2719 	eindex = sindex = 0;
2720 	folderIndex = indexInFolder = 0;
2721 	for (i = 0; i < zip->numFiles; i++) {
2722 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2723 			entries[i].flg |= HAS_STREAM;
2724 		/* The high 16 bits of attributes is a posix file mode. */
2725 		entries[i].mode = entries[i].attr >> 16;
2726 
2727 		if (!(entries[i].attr & FILE_ATTRIBUTE_UNIX_EXTENSION)) {
2728 			// Only windows permissions specified for this entry. Translate to
2729 			// reasonable corresponding unix permissions.
2730 
2731 			if (entries[i].attr & FILE_ATTRIBUTE_DIRECTORY) {
2732 				if (entries[i].attr & FILE_ATTRIBUTE_READONLY) {
2733 					// Read-only directory.
2734 					entries[i].mode = AE_IFDIR | 0555;
2735 				} else {
2736 					// Read-write directory.
2737 					entries[i].mode = AE_IFDIR | 0755;
2738 				}
2739 			} else if (entries[i].attr & FILE_ATTRIBUTE_READONLY) {
2740 				// Readonly file.
2741 				entries[i].mode = AE_IFREG | 0444;
2742 			} else {
2743 				// Assume read-write file.
2744 				entries[i].mode = AE_IFREG | 0644;
2745 			}
2746 		}
2747 
2748 		if (entries[i].flg & HAS_STREAM) {
2749 			if ((size_t)sindex >= si->ss.unpack_streams)
2750 				return (-1);
2751 			if (entries[i].mode == 0)
2752 				entries[i].mode = AE_IFREG | 0666;
2753 			if (si->ss.digestsDefined[sindex])
2754 				entries[i].flg |= CRC32_IS_SET;
2755 			entries[i].ssIndex = sindex;
2756 			sindex++;
2757 		} else {
2758 			int dir;
2759 			if (h->emptyFileBools == NULL)
2760 				dir = 1;
2761 			else {
2762 				if (h->emptyFileBools[eindex])
2763 					dir = 0;
2764 				else
2765 					dir = 1;
2766 				eindex++;
2767 			}
2768 			if (entries[i].mode == 0) {
2769 				if (dir)
2770 					entries[i].mode = AE_IFDIR | 0777;
2771 				else
2772 					entries[i].mode = AE_IFREG | 0666;
2773 			} else if (dir &&
2774 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2775 				entries[i].mode &= ~AE_IFMT;
2776 				entries[i].mode |= AE_IFDIR;
2777 			}
2778 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2779 			    entries[i].name_len >= 2 &&
2780 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2781 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2782 				entries[i].utf16name[entries[i].name_len] = '/';
2783 				entries[i].utf16name[entries[i].name_len+1] = 0;
2784 				entries[i].name_len += 2;
2785 			}
2786 			entries[i].ssIndex = -1;
2787 		}
2788 		if (entries[i].attr & FILE_ATTRIBUTE_READONLY)
2789 			entries[i].mode &= ~0222;/* Read only. */
2790 
2791 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2792 			/*
2793 			 * The entry is an empty file or a directory file,
2794 			 * those both have no contents.
2795 			 */
2796 			entries[i].folderIndex = -1;
2797 			continue;
2798 		}
2799 		if (indexInFolder == 0) {
2800 			for (;;) {
2801 				if (folderIndex >= si->ci.numFolders)
2802 					return (-1);
2803 				if (folders[folderIndex].numUnpackStreams)
2804 					break;
2805 				folderIndex++;
2806 			}
2807 		}
2808 		entries[i].folderIndex = folderIndex;
2809 		if ((entries[i].flg & HAS_STREAM) == 0)
2810 			continue;
2811 		indexInFolder++;
2812 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2813 			folderIndex++;
2814 			indexInFolder = 0;
2815 		}
2816 	}
2817 
2818 	return (0);
2819 }
2820 
2821 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2822 static void
fileTimeToUtc(uint64_t fileTime,time_t * timep,long * ns)2823 fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2824 {
2825 
2826 	if (fileTime >= EPOC_TIME) {
2827 		fileTime -= EPOC_TIME;
2828 		/* milli seconds base */
2829 		*timep = (time_t)(fileTime / 10000000);
2830 		/* nano seconds base */
2831 		*ns = (long)(fileTime % 10000000) * 100;
2832 	} else {
2833 		*timep = 0;
2834 		*ns = 0;
2835 	}
2836 }
2837 
2838 static int
read_Times(struct archive_read * a,struct _7z_header_info * h,int type)2839 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2840 {
2841 	struct _7zip *zip = (struct _7zip *)a->format->data;
2842 	const unsigned char *p;
2843 	struct _7zip_entry *entries = zip->entries;
2844 	unsigned char *timeBools;
2845 	int allAreDefined;
2846 	unsigned i;
2847 
2848 	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2849 	if (timeBools == NULL)
2850 		return (-1);
2851 
2852 	/* Read allAreDefined. */
2853 	if ((p = header_bytes(a, 1)) == NULL)
2854 		goto failed;
2855 	allAreDefined = *p;
2856 	if (allAreDefined)
2857 		memset(timeBools, 1, (size_t)zip->numFiles);
2858 	else {
2859 		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2860 			goto failed;
2861 	}
2862 
2863 	/* Read external. */
2864 	if ((p = header_bytes(a, 1)) == NULL)
2865 		goto failed;
2866 	if (*p) {
2867 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2868 			goto failed;
2869 		if (UMAX_ENTRY < h->dataIndex)
2870 			goto failed;
2871 	}
2872 
2873 	for (i = 0; i < zip->numFiles; i++) {
2874 		if (!timeBools[i])
2875 			continue;
2876 		if ((p = header_bytes(a, 8)) == NULL)
2877 			goto failed;
2878 		switch (type) {
2879 		case kCTime:
2880 			fileTimeToUtc(archive_le64dec(p),
2881 			    &(entries[i].ctime),
2882 			    &(entries[i].ctime_ns));
2883 			entries[i].flg |= CTIME_IS_SET;
2884 			break;
2885 		case kATime:
2886 			fileTimeToUtc(archive_le64dec(p),
2887 			    &(entries[i].atime),
2888 			    &(entries[i].atime_ns));
2889 			entries[i].flg |= ATIME_IS_SET;
2890 			break;
2891 		case kMTime:
2892 			fileTimeToUtc(archive_le64dec(p),
2893 			    &(entries[i].mtime),
2894 			    &(entries[i].mtime_ns));
2895 			entries[i].flg |= MTIME_IS_SET;
2896 			break;
2897 		}
2898 	}
2899 
2900 	free(timeBools);
2901 	return (0);
2902 failed:
2903 	free(timeBools);
2904 	return (-1);
2905 }
2906 
2907 static int
decode_encoded_header_info(struct archive_read * a,struct _7z_stream_info * si)2908 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2909 {
2910 	struct _7zip *zip = (struct _7zip *)a->format->data;
2911 
2912 	errno = 0;
2913 	if (read_StreamsInfo(a, si) < 0) {
2914 		if (errno == ENOMEM)
2915 			archive_set_error(&a->archive, -1,
2916 			    "Couldn't allocate memory");
2917 		else
2918 			archive_set_error(&a->archive, -1,
2919 			    "Malformed 7-Zip archive");
2920 		return (ARCHIVE_FATAL);
2921 	}
2922 
2923 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2924 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2925 		return (ARCHIVE_FATAL);
2926 	}
2927 
2928 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2929 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2930 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2931 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2932 		return (ARCHIVE_FATAL);
2933 	}
2934 
2935 	return (ARCHIVE_OK);
2936 }
2937 
2938 static const unsigned char *
header_bytes(struct archive_read * a,size_t rbytes)2939 header_bytes(struct archive_read *a, size_t rbytes)
2940 {
2941 	struct _7zip *zip = (struct _7zip *)a->format->data;
2942 	const unsigned char *p;
2943 
2944 	if (zip->header_bytes_remaining < rbytes)
2945 		return (NULL);
2946 	if (zip->pack_stream_bytes_unconsumed)
2947 		read_consume(a);
2948 
2949 	if (zip->header_is_encoded == 0) {
2950 		p = __archive_read_ahead(a, rbytes, NULL);
2951 		if (p == NULL)
2952 			return (NULL);
2953 		zip->header_bytes_remaining -= rbytes;
2954 		zip->pack_stream_bytes_unconsumed = rbytes;
2955 	} else {
2956 		const void *buff;
2957 		ssize_t bytes;
2958 
2959 		bytes = read_stream(a, &buff, rbytes, rbytes);
2960 		if (bytes <= 0)
2961 			return (NULL);
2962 		zip->header_bytes_remaining -= bytes;
2963 		p = buff;
2964 	}
2965 
2966 	/* Update checksum */
2967 	zip->header_crc32 = crc32(zip->header_crc32, p, (unsigned)rbytes);
2968 	return (p);
2969 }
2970 
2971 static int
slurp_central_directory(struct archive_read * a,struct _7zip * zip,struct _7z_header_info * header)2972 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2973     struct _7z_header_info *header)
2974 {
2975 	const unsigned char *p;
2976 	uint64_t next_header_offset;
2977 	uint64_t next_header_size;
2978 	uint32_t next_header_crc;
2979 	ssize_t bytes_avail;
2980 	int check_header_crc, r;
2981 
2982 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2983 		return (ARCHIVE_FATAL);
2984 
2985 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2986 		/* This is an executable ? Must be self-extracting... */
2987 		r = skip_sfx(a, bytes_avail);
2988 		if (r < ARCHIVE_WARN)
2989 			return (r);
2990 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2991 			return (ARCHIVE_FATAL);
2992 	}
2993 	zip->seek_base += 32;
2994 
2995 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2996 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2997 		return (ARCHIVE_FATAL);
2998 	}
2999 
3000 	/* CRC check. */
3001 	if (crc32(0, (const unsigned char *)p + 12, 20)
3002 	    != archive_le32dec(p + 8)) {
3003 #ifdef DONT_FAIL_ON_CRC_ERROR
3004 		archive_set_error(&a->archive, -1, "Header CRC error");
3005 		return (ARCHIVE_FATAL);
3006 #endif
3007 	}
3008 
3009 	next_header_offset = archive_le64dec(p + 12);
3010 	next_header_size = archive_le64dec(p + 20);
3011 	next_header_crc = archive_le32dec(p + 28);
3012 
3013 	if (next_header_size == 0)
3014 		/* There is no entry in an archive file. */
3015 		return (ARCHIVE_EOF);
3016 
3017 	if (((int64_t)next_header_offset) < 0) {
3018 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
3019 		return (ARCHIVE_FATAL);
3020 	}
3021 	__archive_read_consume(a, 32);
3022 	if (next_header_offset != 0) {
3023 		if (bytes_avail >= (ssize_t)next_header_offset)
3024 			__archive_read_consume(a, next_header_offset);
3025 		else if (__archive_read_seek(a,
3026 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
3027 			return (ARCHIVE_FATAL);
3028 	}
3029 	zip->stream_offset = next_header_offset;
3030 	zip->header_offset = next_header_offset;
3031 	zip->header_bytes_remaining = next_header_size;
3032 	zip->header_crc32 = 0;
3033 	zip->header_is_encoded = 0;
3034 	zip->header_is_being_read = 1;
3035 	zip->has_encrypted_entries = 0;
3036 	check_header_crc = 1;
3037 
3038 	if ((p = header_bytes(a, 1)) == NULL) {
3039 		archive_set_error(&a->archive,
3040 		    ARCHIVE_ERRNO_FILE_FORMAT,
3041 		    "Truncated 7-Zip file body");
3042 		return (ARCHIVE_FATAL);
3043 	}
3044 	/* Parse ArchiveProperties. */
3045 	switch (p[0]) {
3046 	case kEncodedHeader:
3047 		/*
3048 		 * The archive has an encoded header and we have to decode it
3049 		 * in order to parse the header correctly.
3050 		 */
3051 		r = decode_encoded_header_info(a, &(zip->si));
3052 
3053 		/* Check the EncodedHeader CRC.*/
3054 		if (r == 0 && zip->header_crc32 != next_header_crc) {
3055 #ifndef DONT_FAIL_ON_CRC_ERROR
3056 			archive_set_error(&a->archive, -1,
3057 			    "Damaged 7-Zip archive");
3058 			r = -1;
3059 #endif
3060 		}
3061 		if (r == 0) {
3062 			if (zip->si.ci.folders[0].digest_defined)
3063 				next_header_crc = zip->si.ci.folders[0].digest;
3064 			else
3065 				check_header_crc = 0;
3066 			if (zip->pack_stream_bytes_unconsumed)
3067 				read_consume(a);
3068 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
3069 			if (r == 0) {
3070 				zip->header_bytes_remaining =
3071 					zip->folder_outbytes_remaining;
3072 				r = seek_pack(a);
3073 			}
3074 		}
3075 		/* Clean up StreamsInfo. */
3076 		free_StreamsInfo(&(zip->si));
3077 		memset(&(zip->si), 0, sizeof(zip->si));
3078 		if (r < 0)
3079 			return (ARCHIVE_FATAL);
3080 		zip->header_is_encoded = 1;
3081 		zip->header_crc32 = 0;
3082 		/* FALL THROUGH */
3083 	case kHeader:
3084 		/*
3085 		 * Parse the header.
3086 		 */
3087 		errno = 0;
3088 		r = read_Header(a, header, zip->header_is_encoded);
3089 		if (r < 0) {
3090 			if (errno == ENOMEM)
3091 				archive_set_error(&a->archive, -1,
3092 				    "Couldn't allocate memory");
3093 			else
3094 				archive_set_error(&a->archive, -1,
3095 				    "Damaged 7-Zip archive");
3096 			return (ARCHIVE_FATAL);
3097 		}
3098 
3099 		/*
3100 		 *  Must be kEnd.
3101 		 */
3102 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
3103 			archive_set_error(&a->archive, -1,
3104 			    "Malformed 7-Zip archive");
3105 			return (ARCHIVE_FATAL);
3106 		}
3107 
3108 		/* Check the Header CRC.*/
3109 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
3110 #ifndef DONT_FAIL_ON_CRC_ERROR
3111 			archive_set_error(&a->archive, -1,
3112 			    "Malformed 7-Zip archive");
3113 			return (ARCHIVE_FATAL);
3114 #endif
3115 		}
3116 		break;
3117 	default:
3118 		archive_set_error(&a->archive, -1,
3119 		    "Unexpected Property ID = %X", p[0]);
3120 		return (ARCHIVE_FATAL);
3121 	}
3122 
3123 	/* Clean up variables be used for decoding the archive header */
3124 	zip->pack_stream_remaining = 0;
3125 	zip->pack_stream_index = 0;
3126 	zip->folder_outbytes_remaining = 0;
3127 	zip->uncompressed_buffer_bytes_remaining = 0;
3128 	zip->pack_stream_bytes_unconsumed = 0;
3129 	zip->header_is_being_read = 0;
3130 
3131 	return (ARCHIVE_OK);
3132 }
3133 
3134 static ssize_t
get_uncompressed_data(struct archive_read * a,const void ** buff,size_t size,size_t minimum)3135 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
3136     size_t minimum)
3137 {
3138 	struct _7zip *zip = (struct _7zip *)a->format->data;
3139 	ssize_t bytes_avail;
3140 
3141 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
3142 		/* Copy mode. */
3143 
3144 		*buff = __archive_read_ahead(a, minimum, &bytes_avail);
3145 		if (bytes_avail <= 0) {
3146 			archive_set_error(&a->archive,
3147 			    ARCHIVE_ERRNO_FILE_FORMAT,
3148 			    "Truncated 7-Zip file data");
3149 			return (ARCHIVE_FATAL);
3150 		}
3151 		if ((size_t)bytes_avail >
3152 		    zip->uncompressed_buffer_bytes_remaining)
3153 			bytes_avail = (ssize_t)
3154 			    zip->uncompressed_buffer_bytes_remaining;
3155 		if ((size_t)bytes_avail > size)
3156 			bytes_avail = (ssize_t)size;
3157 
3158 		zip->pack_stream_bytes_unconsumed = bytes_avail;
3159 	} else if (zip->uncompressed_buffer_pointer == NULL) {
3160 		/* Decompression has failed. */
3161 		archive_set_error(&(a->archive),
3162 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3163 		return (ARCHIVE_FATAL);
3164 	} else {
3165 		/* Packed mode. */
3166 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
3167 			/*
3168 			 * If remaining uncompressed data size is less than
3169 			 * the minimum size, fill the buffer up to the
3170 			 * minimum size.
3171 			 */
3172 			if (extract_pack_stream(a, minimum) < 0)
3173 				return (ARCHIVE_FATAL);
3174 		}
3175 		if (size > zip->uncompressed_buffer_bytes_remaining)
3176 			bytes_avail = (ssize_t)
3177 			    zip->uncompressed_buffer_bytes_remaining;
3178 		else
3179 			bytes_avail = (ssize_t)size;
3180 		*buff = zip->uncompressed_buffer_pointer;
3181 		zip->uncompressed_buffer_pointer += bytes_avail;
3182 	}
3183 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
3184 	return (bytes_avail);
3185 }
3186 
3187 static ssize_t
extract_pack_stream(struct archive_read * a,size_t minimum)3188 extract_pack_stream(struct archive_read *a, size_t minimum)
3189 {
3190 	struct _7zip *zip = (struct _7zip *)a->format->data;
3191 	ssize_t bytes_avail;
3192 	int r;
3193 
3194 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
3195 		if (minimum == 0)
3196 			minimum = 1;
3197 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
3198 		    || bytes_avail <= 0) {
3199 			archive_set_error(&a->archive,
3200 			    ARCHIVE_ERRNO_FILE_FORMAT,
3201 			    "Truncated 7-Zip file body");
3202 			return (ARCHIVE_FATAL);
3203 		}
3204 		if ((uint64_t)bytes_avail > zip->pack_stream_inbytes_remaining)
3205 			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
3206 		zip->pack_stream_inbytes_remaining -= bytes_avail;
3207 		if ((uint64_t)bytes_avail > zip->folder_outbytes_remaining)
3208 			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
3209 		zip->folder_outbytes_remaining -= bytes_avail;
3210 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
3211 		return (ARCHIVE_OK);
3212 	}
3213 
3214 	/* If the buffer hasn't been allocated, allocate it now. */
3215 	if (zip->uncompressed_buffer == NULL) {
3216 		zip->uncompressed_buffer_size = UBUFF_SIZE;
3217 		if (zip->uncompressed_buffer_size < minimum) {
3218 			zip->uncompressed_buffer_size = minimum + 1023;
3219 			zip->uncompressed_buffer_size &= ~0x3ff;
3220 		}
3221 		zip->uncompressed_buffer =
3222 		    malloc(zip->uncompressed_buffer_size);
3223 		if (zip->uncompressed_buffer == NULL) {
3224 			archive_set_error(&a->archive, ENOMEM,
3225 			    "No memory for 7-Zip decompression");
3226 			return (ARCHIVE_FATAL);
3227 		}
3228 		zip->uncompressed_buffer_bytes_remaining = 0;
3229 	} else if (zip->uncompressed_buffer_size < minimum ||
3230 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
3231 		/*
3232 		 * Make sure the uncompressed buffer can have bytes
3233 		 * at least `minimum' bytes.
3234 		 * NOTE: This case happen when reading the header.
3235 		 */
3236 		size_t used;
3237 		if (zip->uncompressed_buffer_pointer != 0)
3238 			used = zip->uncompressed_buffer_pointer -
3239 				zip->uncompressed_buffer;
3240 		else
3241 			used = 0;
3242 		if (zip->uncompressed_buffer_size < minimum) {
3243 			/*
3244 			 * Expand the uncompressed buffer up to
3245 			 * the minimum size.
3246 			 */
3247 			void *p;
3248 			size_t new_size;
3249 
3250 			new_size = minimum + 1023;
3251 			new_size &= ~0x3ff;
3252 			p = realloc(zip->uncompressed_buffer, new_size);
3253 			if (p == NULL) {
3254 				archive_set_error(&a->archive, ENOMEM,
3255 				    "No memory for 7-Zip decompression");
3256 				return (ARCHIVE_FATAL);
3257 			}
3258 			zip->uncompressed_buffer = (unsigned char *)p;
3259 			zip->uncompressed_buffer_size = new_size;
3260 		}
3261 		/*
3262 		 * Move unconsumed bytes to the head.
3263 		 */
3264 		if (used) {
3265 			memmove(zip->uncompressed_buffer,
3266 				zip->uncompressed_buffer + used,
3267 				zip->uncompressed_buffer_bytes_remaining);
3268 		}
3269 	} else
3270 		zip->uncompressed_buffer_bytes_remaining = 0;
3271 	zip->uncompressed_buffer_pointer = NULL;
3272 	for (;;) {
3273 		size_t bytes_in, bytes_out;
3274 		const void *buff_in;
3275 		unsigned char *buff_out;
3276 		int end_of_data;
3277 
3278 		/*
3279 		 * Note: '1' here is a performance optimization.
3280 		 * Recall that the decompression layer returns a count of
3281 		 * available bytes; asking for more than that forces the
3282 		 * decompressor to combine reads by copying data.
3283 		 */
3284 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3285 		if (bytes_avail <= 0) {
3286 			archive_set_error(&a->archive,
3287 			    ARCHIVE_ERRNO_FILE_FORMAT,
3288 			    "Truncated 7-Zip file body");
3289 			return (ARCHIVE_FATAL);
3290 		}
3291 
3292 		buff_out = zip->uncompressed_buffer
3293 			+ zip->uncompressed_buffer_bytes_remaining;
3294 		bytes_out = zip->uncompressed_buffer_size
3295 			- zip->uncompressed_buffer_bytes_remaining;
3296 		bytes_in = bytes_avail;
3297 		if (bytes_in > zip->pack_stream_inbytes_remaining)
3298 			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3299 		/* Drive decompression. */
3300 		r = decompress(a, zip, buff_out, &bytes_out,
3301 			buff_in, &bytes_in);
3302 		switch (r) {
3303 		case ARCHIVE_OK:
3304 			end_of_data = 0;
3305 			break;
3306 		case ARCHIVE_EOF:
3307 			end_of_data = 1;
3308 			break;
3309 		default:
3310 			return (ARCHIVE_FATAL);
3311 		}
3312 		zip->pack_stream_inbytes_remaining -= bytes_in;
3313 		if (bytes_out > zip->folder_outbytes_remaining)
3314 			bytes_out = (size_t)zip->folder_outbytes_remaining;
3315 		zip->folder_outbytes_remaining -= bytes_out;
3316 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3317 		zip->pack_stream_bytes_unconsumed = bytes_in;
3318 
3319 		/*
3320 		 * Continue decompression until uncompressed_buffer is full.
3321 		 */
3322 		if (zip->uncompressed_buffer_bytes_remaining ==
3323 		    zip->uncompressed_buffer_size)
3324 			break;
3325 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3326 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3327 		    zip->uncompressed_buffer_size)
3328 			break;
3329 		if (zip->pack_stream_inbytes_remaining == 0 &&
3330 		    zip->folder_outbytes_remaining == 0)
3331 			break;
3332 		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3333 			archive_set_error(&(a->archive),
3334 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3335 			return (ARCHIVE_FATAL);
3336 		}
3337 		read_consume(a);
3338 	}
3339 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3340 		archive_set_error(&(a->archive),
3341 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3342 		return (ARCHIVE_FATAL);
3343 	}
3344 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3345 	return (ARCHIVE_OK);
3346 }
3347 
3348 static int
seek_pack(struct archive_read * a)3349 seek_pack(struct archive_read *a)
3350 {
3351 	struct _7zip *zip = (struct _7zip *)a->format->data;
3352 	int64_t pack_offset;
3353 
3354 	if (zip->pack_stream_remaining <= 0) {
3355 		archive_set_error(&(a->archive),
3356 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3357 		return (ARCHIVE_FATAL);
3358 	}
3359 	zip->pack_stream_inbytes_remaining =
3360 	    zip->si.pi.sizes[zip->pack_stream_index];
3361 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3362 	if (zip->stream_offset != pack_offset) {
3363 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3364 		    SEEK_SET))
3365 			return (ARCHIVE_FATAL);
3366 		zip->stream_offset = pack_offset;
3367 	}
3368 	zip->pack_stream_index++;
3369 	zip->pack_stream_remaining--;
3370 	return (ARCHIVE_OK);
3371 }
3372 
3373 static ssize_t
read_stream(struct archive_read * a,const void ** buff,size_t size,size_t minimum)3374 read_stream(struct archive_read *a, const void **buff, size_t size,
3375     size_t minimum)
3376 {
3377 	struct _7zip *zip = (struct _7zip *)a->format->data;
3378 	uint64_t skip_bytes = 0;
3379 	ssize_t r;
3380 
3381 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3382 		if (zip->pack_stream_inbytes_remaining > 0) {
3383 			r = extract_pack_stream(a, 0);
3384 			if (r < 0)
3385 				return (r);
3386 			return (get_uncompressed_data(a, buff, size, minimum));
3387 		} else if (zip->folder_outbytes_remaining > 0) {
3388 			/* Extract a remaining pack stream. */
3389 			r = extract_pack_stream(a, 0);
3390 			if (r < 0)
3391 				return (r);
3392 			return (get_uncompressed_data(a, buff, size, minimum));
3393 		}
3394 	} else
3395 		return (get_uncompressed_data(a, buff, size, minimum));
3396 
3397 	/*
3398 	 * Current pack stream has been consumed.
3399 	 */
3400 	if (zip->pack_stream_remaining == 0) {
3401 		if (zip->header_is_being_read) {
3402 			/* Invalid sequence. This might happen when
3403 			 * reading a malformed archive. */
3404 			archive_set_error(&(a->archive),
3405 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3406 			return (ARCHIVE_FATAL);
3407 		}
3408 
3409 		/*
3410 		 * All current folder's pack streams have been
3411 		 * consumed. Switch to next folder.
3412 		 */
3413 		if (zip->folder_index == 0 &&
3414 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3415 		     || zip->folder_index != zip->entry->folderIndex)) {
3416 			zip->folder_index = zip->entry->folderIndex;
3417 			skip_bytes =
3418 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3419 		}
3420 
3421 		if (zip->folder_index >= zip->si.ci.numFolders) {
3422 			/*
3423 			 * We have consumed all folders and its pack streams.
3424 			 */
3425 			*buff = NULL;
3426 			return (0);
3427 		}
3428 		r = setup_decode_folder(a,
3429 			&(zip->si.ci.folders[zip->folder_index]), 0);
3430 		if (r != ARCHIVE_OK)
3431 			return (ARCHIVE_FATAL);
3432 
3433 		zip->folder_index++;
3434 	}
3435 
3436 	/*
3437 	 * Switch to next pack stream.
3438 	 */
3439 	r = seek_pack(a);
3440 	if (r < 0)
3441 		return (r);
3442 
3443 	/* Extract a new pack stream. */
3444 	r = extract_pack_stream(a, 0);
3445 	if (r < 0)
3446 		return (r);
3447 
3448 	/*
3449 	 * Skip the bytes we already has skipped in skip_stream().
3450 	 */
3451 	while (skip_bytes) {
3452 		ssize_t skipped;
3453 
3454 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3455 			if (zip->pack_stream_inbytes_remaining > 0) {
3456 				r = extract_pack_stream(a, 0);
3457 				if (r < 0)
3458 					return (r);
3459 			} else if (zip->folder_outbytes_remaining > 0) {
3460 				/* Extract a remaining pack stream. */
3461 				r = extract_pack_stream(a, 0);
3462 				if (r < 0)
3463 					return (r);
3464 			} else {
3465 				archive_set_error(&a->archive,
3466 				    ARCHIVE_ERRNO_FILE_FORMAT,
3467 				    "Truncated 7-Zip file body");
3468 				return (ARCHIVE_FATAL);
3469 			}
3470 		}
3471 		skipped = get_uncompressed_data(
3472 			a, buff, (size_t)skip_bytes, 0);
3473 		if (skipped < 0)
3474 			return (skipped);
3475 		skip_bytes -= skipped;
3476 		if (zip->pack_stream_bytes_unconsumed)
3477 			read_consume(a);
3478 	}
3479 
3480 	return (get_uncompressed_data(a, buff, size, minimum));
3481 }
3482 
3483 static int
setup_decode_folder(struct archive_read * a,struct _7z_folder * folder,int header)3484 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3485     int header)
3486 {
3487 	struct _7zip *zip = (struct _7zip *)a->format->data;
3488 	const struct _7z_coder *coder1, *coder2;
3489 	const char *cname = (header)?"archive header":"file content";
3490 	unsigned i;
3491 	int r, found_bcj2 = 0;
3492 
3493 	/*
3494 	 * Release the memory which the previous folder used for BCJ2.
3495 	 */
3496 	for (i = 0; i < 3; i++) {
3497 		free(zip->sub_stream_buff[i]);
3498 		zip->sub_stream_buff[i] = NULL;
3499 	}
3500 
3501 	/*
3502 	 * Initialize a stream reader.
3503 	 */
3504 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3505 	zip->pack_stream_index = (unsigned)folder->packIndex;
3506 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3507 	zip->uncompressed_buffer_bytes_remaining = 0;
3508 
3509 	/*
3510 	 * Check coder types.
3511 	 */
3512 	for (i = 0; i < folder->numCoders; i++) {
3513 		switch(folder->coders[i].codec) {
3514 			case _7Z_CRYPTO_MAIN_ZIP:
3515 			case _7Z_CRYPTO_RAR_29:
3516 			case _7Z_CRYPTO_AES_256_SHA_256: {
3517 				/* For entry that is associated with this folder, mark
3518 				   it as encrypted (data+metadata). */
3519 				zip->has_encrypted_entries = 1;
3520 				if (a->entry) {
3521 					archive_entry_set_is_data_encrypted(a->entry, 1);
3522 					archive_entry_set_is_metadata_encrypted(a->entry, 1);
3523 				}
3524 				archive_set_error(&(a->archive),
3525 					ARCHIVE_ERRNO_MISC,
3526 					"The %s is encrypted, "
3527 					"but currently not supported", cname);
3528 				return (ARCHIVE_FATAL);
3529 			}
3530 			case _7Z_X86_BCJ2: {
3531 				found_bcj2++;
3532 				break;
3533 			}
3534 		}
3535 	}
3536 	/* Now that we've checked for encryption, if there were still no
3537 	 * encrypted entries found we can say for sure that there are none.
3538 	 */
3539 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
3540 		zip->has_encrypted_entries = 0;
3541 	}
3542 
3543 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3544 		archive_set_error(&(a->archive),
3545 		    ARCHIVE_ERRNO_MISC,
3546 		    "The %s is encoded with many filters, "
3547 		    "but currently not supported", cname);
3548 		return (ARCHIVE_FATAL);
3549 	}
3550 	coder1 = &(folder->coders[0]);
3551 	if (folder->numCoders == 2)
3552 		coder2 = &(folder->coders[1]);
3553 	else
3554 		coder2 = NULL;
3555 
3556 	if (found_bcj2) {
3557 		/*
3558 		 * Preparation to decode BCJ2.
3559 		 * Decoding BCJ2 requires four sources. Those are at least,
3560 		 * as far as I know, two types of the storage form.
3561 		 */
3562 		const struct _7z_coder *fc = folder->coders;
3563 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3564 		const struct _7z_coder *scoder[3] =
3565 			{&coder_copy, &coder_copy, &coder_copy};
3566 		const void *buff;
3567 		ssize_t bytes;
3568 		unsigned char *b[3] = {NULL, NULL, NULL};
3569 		uint64_t sunpack[3] ={-1, -1, -1};
3570 		size_t s[3] = {0, 0, 0};
3571 		int idx[3] = {0, 1, 2};
3572 
3573 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3574 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3575 		    zip->pack_stream_remaining == 4) {
3576 			/* Source type 1 made by 7zr or 7z with -m options. */
3577 			if (folder->bindPairs[0].inIndex == 5) {
3578 				/* The form made by 7zr */
3579 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3580 				scoder[1] = &(fc[1]);
3581 				scoder[2] = &(fc[0]);
3582 				sunpack[1] = folder->unPackSize[1];
3583 				sunpack[2] = folder->unPackSize[0];
3584 				coder1 = &(fc[2]);
3585 			} else {
3586 				/*
3587 				 * NOTE: Some patterns do not work.
3588 				 * work:
3589 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3590 				 *       -m3=(any)
3591 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3592 				 *       -m3=COPY
3593 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3594 				 *       -m3=COPY
3595 				 * not work:
3596 				 *  other patterns.
3597 				 *
3598 				 * We have to handle this like `pipe' or
3599 				 * our libarchive7s filter frame work,
3600 				 * decoding the BCJ2 main stream sequentially,
3601 				 * m3 -> m2 -> m1 -> BCJ2.
3602 				 *
3603 				 */
3604 				if (fc[0].codec == _7Z_COPY &&
3605 				    fc[1].codec == _7Z_COPY)
3606 					coder1 = &(folder->coders[2]);
3607 				else if (fc[0].codec == _7Z_COPY &&
3608 				    fc[2].codec == _7Z_COPY)
3609 					coder1 = &(folder->coders[1]);
3610 				else if (fc[1].codec == _7Z_COPY &&
3611 				    fc[2].codec == _7Z_COPY)
3612 					coder1 = &(folder->coders[0]);
3613 				else {
3614 					archive_set_error(&(a->archive),
3615 					    ARCHIVE_ERRNO_MISC,
3616 					    "Unsupported form of "
3617 					    "BCJ2 streams");
3618 					return (ARCHIVE_FATAL);
3619 				}
3620 			}
3621 			coder2 = &(fc[3]);
3622 			zip->main_stream_bytes_remaining =
3623 				(size_t)folder->unPackSize[2];
3624 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3625 		    zip->pack_stream_remaining == 4 &&
3626 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3627 			/* Source type 0 made by 7z */
3628 			zip->main_stream_bytes_remaining =
3629 				(size_t)folder->unPackSize[0];
3630 		} else {
3631 			/* We got an unexpected form. */
3632 			archive_set_error(&(a->archive),
3633 			    ARCHIVE_ERRNO_MISC,
3634 			    "Unsupported form of BCJ2 streams");
3635 			return (ARCHIVE_FATAL);
3636 		}
3637 
3638 		/* Skip the main stream at this time. */
3639 		if ((r = seek_pack(a)) < 0)
3640 			return (r);
3641 		zip->pack_stream_bytes_unconsumed =
3642 		    (size_t)zip->pack_stream_inbytes_remaining;
3643 		read_consume(a);
3644 
3645 		/* Read following three sub streams. */
3646 		for (i = 0; i < 3; i++) {
3647 			const struct _7z_coder *coder = scoder[i];
3648 
3649 			if ((r = seek_pack(a)) < 0) {
3650 				free(b[0]); free(b[1]); free(b[2]);
3651 				return (r);
3652 			}
3653 
3654 			if (sunpack[i] == (uint64_t)-1)
3655 				zip->folder_outbytes_remaining =
3656 				    zip->pack_stream_inbytes_remaining;
3657 			else
3658 				zip->folder_outbytes_remaining = sunpack[i];
3659 
3660 			r = init_decompression(a, zip, coder, NULL);
3661 			if (r != ARCHIVE_OK) {
3662 				free(b[0]); free(b[1]); free(b[2]);
3663 				return (ARCHIVE_FATAL);
3664 			}
3665 
3666 			/* Allocate memory for the decoded data of a sub
3667 			 * stream. */
3668 			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3669 			if (b[i] == NULL) {
3670 				free(b[0]); free(b[1]); free(b[2]);
3671 				archive_set_error(&a->archive, ENOMEM,
3672 				    "No memory for 7-Zip decompression");
3673 				return (ARCHIVE_FATAL);
3674 			}
3675 
3676 			/* Extract a sub stream. */
3677 			while (zip->pack_stream_inbytes_remaining > 0) {
3678 				r = (int)extract_pack_stream(a, 0);
3679 				if (r < 0) {
3680 					free(b[0]); free(b[1]); free(b[2]);
3681 					return (r);
3682 				}
3683 				bytes = get_uncompressed_data(a, &buff,
3684 				    zip->uncompressed_buffer_bytes_remaining,
3685 				    0);
3686 				if (bytes < 0) {
3687 					free(b[0]); free(b[1]); free(b[2]);
3688 					return ((int)bytes);
3689 				}
3690 				memcpy(b[i]+s[i], buff, bytes);
3691 				s[i] += bytes;
3692 				if (zip->pack_stream_bytes_unconsumed)
3693 					read_consume(a);
3694 			}
3695 		}
3696 
3697 		/* Set the sub streams to the right place. */
3698 		for (i = 0; i < 3; i++) {
3699 			zip->sub_stream_buff[i] = b[idx[i]];
3700 			zip->sub_stream_size[i] = s[idx[i]];
3701 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3702 		}
3703 
3704 		/* Allocate memory used for decoded main stream bytes. */
3705 		if (zip->tmp_stream_buff == NULL) {
3706 			zip->tmp_stream_buff_size = 32 * 1024;
3707 			zip->tmp_stream_buff =
3708 			    malloc(zip->tmp_stream_buff_size);
3709 			if (zip->tmp_stream_buff == NULL) {
3710 				archive_set_error(&a->archive, ENOMEM,
3711 				    "No memory for 7-Zip decompression");
3712 				return (ARCHIVE_FATAL);
3713 			}
3714 		}
3715 		zip->tmp_stream_bytes_avail = 0;
3716 		zip->tmp_stream_bytes_remaining = 0;
3717 		zip->odd_bcj_size = 0;
3718 		zip->bcj2_outPos = 0;
3719 
3720 		/*
3721 		 * Reset a stream reader in order to read the main stream
3722 		 * of BCJ2.
3723 		 */
3724 		zip->pack_stream_remaining = 1;
3725 		zip->pack_stream_index = (unsigned)folder->packIndex;
3726 		zip->folder_outbytes_remaining =
3727 		    folder_uncompressed_size(folder);
3728 		zip->uncompressed_buffer_bytes_remaining = 0;
3729 	}
3730 
3731 	/*
3732 	 * Initialize the decompressor for the new folder's pack streams.
3733 	 */
3734 	r = init_decompression(a, zip, coder1, coder2);
3735 	if (r != ARCHIVE_OK)
3736 		return (ARCHIVE_FATAL);
3737 	return (ARCHIVE_OK);
3738 }
3739 
3740 static int64_t
skip_stream(struct archive_read * a,size_t skip_bytes)3741 skip_stream(struct archive_read *a, size_t skip_bytes)
3742 {
3743 	struct _7zip *zip = (struct _7zip *)a->format->data;
3744 	const void *p;
3745 	int64_t skipped_bytes;
3746 	size_t bytes = skip_bytes;
3747 
3748 	if (zip->folder_index == 0) {
3749 		/*
3750 		 * Optimization for a list mode.
3751 		 * Avoid unnecessary decoding operations.
3752 		 */
3753 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3754 		    += skip_bytes;
3755 		return (skip_bytes);
3756 	}
3757 
3758 	while (bytes) {
3759 		skipped_bytes = read_stream(a, &p, bytes, 0);
3760 		if (skipped_bytes < 0)
3761 			return (skipped_bytes);
3762 		if (skipped_bytes == 0) {
3763 			archive_set_error(&a->archive,
3764 			    ARCHIVE_ERRNO_FILE_FORMAT,
3765 			    "Truncated 7-Zip file body");
3766 			return (ARCHIVE_FATAL);
3767 		}
3768 		bytes -= (size_t)skipped_bytes;
3769 		if (zip->pack_stream_bytes_unconsumed)
3770 			read_consume(a);
3771 	}
3772 	return (skip_bytes);
3773 }
3774 
3775 /*
3776  * Brought from LZMA SDK.
3777  *
3778  * Bra86.c -- Converter for x86 code (BCJ)
3779  * 2008-10-04 : Igor Pavlov : Public domain
3780  *
3781  */
3782 
3783 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3784 
3785 static void
x86_Init(struct _7zip * zip)3786 x86_Init(struct _7zip *zip)
3787 {
3788 	zip->bcj_state = 0;
3789 	zip->bcj_prevPosT = (size_t)0 - 1;
3790 	zip->bcj_prevMask = 0;
3791 	zip->bcj_ip = 5;
3792 }
3793 
3794 static size_t
x86_Convert(struct _7zip * zip,uint8_t * data,size_t size)3795 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3796 {
3797 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3798 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3799 	size_t bufferPos, prevPosT;
3800 	uint32_t ip, prevMask;
3801 
3802 	if (size < 5)
3803 		return 0;
3804 
3805 	bufferPos = 0;
3806 	prevPosT = zip->bcj_prevPosT;
3807 	prevMask = zip->bcj_prevMask;
3808 	ip = zip->bcj_ip;
3809 
3810 	for (;;) {
3811 		uint8_t *p = data + bufferPos;
3812 		uint8_t *limit = data + size - 4;
3813 
3814 		for (; p < limit; p++)
3815 			if ((*p & 0xFE) == 0xE8)
3816 				break;
3817 		bufferPos = (size_t)(p - data);
3818 		if (p >= limit)
3819 			break;
3820 		prevPosT = bufferPos - prevPosT;
3821 		if (prevPosT > 3)
3822 			prevMask = 0;
3823 		else {
3824 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3825 			if (prevMask != 0) {
3826 				unsigned char b =
3827 					p[4 - kMaskToBitNumber[prevMask]];
3828 				if (!kMaskToAllowedStatus[prevMask] ||
3829 				    Test86MSByte(b)) {
3830 					prevPosT = bufferPos;
3831 					prevMask = ((prevMask << 1) & 0x7) | 1;
3832 					bufferPos++;
3833 					continue;
3834 				}
3835 			}
3836 		}
3837 		prevPosT = bufferPos;
3838 
3839 		if (Test86MSByte(p[4])) {
3840 			uint32_t src = ((uint32_t)p[4] << 24) |
3841 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3842 				((uint32_t)p[1]);
3843 			uint32_t dest;
3844 			for (;;) {
3845 				uint8_t b;
3846 				int b_index;
3847 
3848 				dest = src - (ip + (uint32_t)bufferPos);
3849 				if (prevMask == 0)
3850 					break;
3851 				b_index = kMaskToBitNumber[prevMask] * 8;
3852 				b = (uint8_t)(dest >> (24 - b_index));
3853 				if (!Test86MSByte(b))
3854 					break;
3855 				src = dest ^ ((1 << (32 - b_index)) - 1);
3856 			}
3857 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3858 			p[3] = (uint8_t)(dest >> 16);
3859 			p[2] = (uint8_t)(dest >> 8);
3860 			p[1] = (uint8_t)dest;
3861 			bufferPos += 5;
3862 		} else {
3863 			prevMask = ((prevMask << 1) & 0x7) | 1;
3864 			bufferPos++;
3865 		}
3866 	}
3867 	zip->bcj_prevPosT = prevPosT;
3868 	zip->bcj_prevMask = prevMask;
3869 	zip->bcj_ip += (uint32_t)bufferPos;
3870 	return (bufferPos);
3871 }
3872 
3873 static void
arm_Init(struct _7zip * zip)3874 arm_Init(struct _7zip *zip)
3875 {
3876 	zip->bcj_ip = 8;
3877 }
3878 
3879 static size_t
arm_Convert(struct _7zip * zip,uint8_t * buf,size_t size)3880 arm_Convert(struct _7zip *zip, uint8_t *buf, size_t size)
3881 {
3882 	// This function was adapted from
3883 	// static size_t bcj_arm(struct xz_dec_bcj *s, uint8_t *buf, size_t size)
3884 	// in https://git.tukaani.org/xz-embedded.git
3885 
3886 	/*
3887 	 * Branch/Call/Jump (BCJ) filter decoders
3888 	 *
3889 	 * Authors: Lasse Collin <lasse.collin@tukaani.org>
3890 	 *          Igor Pavlov <https://7-zip.org/>
3891 	 *
3892 	 * This file has been put into the public domain.
3893 	 * You can do whatever you want with this file.
3894 	 */
3895 
3896 	size_t i;
3897 	uint32_t addr;
3898 
3899 	for (i = 0; i + 4 <= size; i += 4) {
3900 		if (buf[i + 3] == 0xEB) {
3901 			// Calculate the transformed addr.
3902 			addr = (uint32_t)buf[i] | ((uint32_t)buf[i + 1] << 8)
3903 				| ((uint32_t)buf[i + 2] << 16);
3904 			addr <<= 2;
3905 			addr -= zip->bcj_ip + (uint32_t)i;
3906 			addr >>= 2;
3907 
3908 			// Store the transformed addr in buf.
3909 			buf[i] = (uint8_t)addr;
3910 			buf[i + 1] = (uint8_t)(addr >> 8);
3911 			buf[i + 2] = (uint8_t)(addr >> 16);
3912 		}
3913 	}
3914 
3915 	zip->bcj_ip += (uint32_t)i;
3916 
3917 	return i;
3918 }
3919 
3920 static size_t
arm64_Convert(struct _7zip * zip,uint8_t * buf,size_t size)3921 arm64_Convert(struct _7zip *zip, uint8_t *buf, size_t size)
3922 {
3923 	// This function was adapted from
3924 	// static size_t bcj_arm64(struct xz_dec_bcj *s, uint8_t *buf, size_t size)
3925 	// in https://git.tukaani.org/xz-embedded.git
3926 
3927 	/*
3928 	 * Branch/Call/Jump (BCJ) filter decoders
3929 	 *
3930 	 * Authors: Lasse Collin <lasse.collin@tukaani.org>
3931 	 *          Igor Pavlov <https://7-zip.org/>
3932 	 *
3933 	 * This file has been put into the public domain.
3934 	 * You can do whatever you want with this file.
3935 	 */
3936 
3937 	size_t i;
3938 	uint32_t instr;
3939 	uint32_t addr;
3940 
3941 	for (i = 0; i + 4 <= size; i += 4) {
3942 		instr = (uint32_t)buf[i]
3943 			| ((uint32_t)buf[i+1] << 8)
3944 			| ((uint32_t)buf[i+2] << 16)
3945 			| ((uint32_t)buf[i+3] << 24);
3946 
3947 		if ((instr >> 26) == 0x25) {
3948 			/* BL instruction */
3949 			addr = instr - ((zip->bcj_ip + (uint32_t)i) >> 2);
3950 			instr = 0x94000000 | (addr & 0x03FFFFFF);
3951 
3952 			buf[i]   = (uint8_t)instr;
3953 			buf[i+1] = (uint8_t)(instr >> 8);
3954 			buf[i+2] = (uint8_t)(instr >> 16);
3955 			buf[i+3] = (uint8_t)(instr >> 24);
3956 		} else if ((instr & 0x9F000000) == 0x90000000) {
3957 			/* ADRP instruction */
3958 			addr = ((instr >> 29) & 3) | ((instr >> 3) & 0x1FFFFC);
3959 
3960 			/* Only convert values in the range +/-512 MiB. */
3961 			if ((addr + 0x020000) & 0x1C0000)
3962 				continue;
3963 
3964 			addr -= (zip->bcj_ip + (uint32_t)i) >> 12;
3965 
3966 			instr &= 0x9000001F;
3967 			instr |= (addr & 3) << 29;
3968 			instr |= (addr & 0x03FFFC) << 3;
3969 			instr |= (0U - (addr & 0x020000)) & 0xE00000;
3970 
3971 			buf[i]   = (uint8_t)instr;
3972 			buf[i+1] = (uint8_t)(instr >> 8);
3973 			buf[i+2] = (uint8_t)(instr >> 16);
3974 			buf[i+3] = (uint8_t)(instr >> 24);
3975 		}
3976 	}
3977 
3978 	zip->bcj_ip += (uint32_t)i;
3979 
3980 	return i;
3981 }
3982 
3983 /*
3984  * Brought from LZMA SDK.
3985  *
3986  * Bcj2.c -- Converter for x86 code (BCJ2)
3987  * 2008-10-04 : Igor Pavlov : Public domain
3988  *
3989  */
3990 
3991 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3992 
3993 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3994 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3995 
3996 #define kNumTopBits 24
3997 #define kTopValue ((uint32_t)1 << kNumTopBits)
3998 
3999 #define kNumBitModelTotalBits 11
4000 #define kBitModelTotal (1 << kNumBitModelTotalBits)
4001 #define kNumMoveBits 5
4002 
4003 #define RC_READ_BYTE (*buffer++)
4004 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
4005 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
4006   { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
4007 
4008 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
4009 
4010 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
4011 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
4012 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
4013 
4014 static ssize_t
Bcj2_Decode(struct _7zip * zip,uint8_t * outBuf,size_t outSize)4015 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
4016 {
4017 	size_t inPos = 0, outPos = 0;
4018 	const uint8_t *buf0, *buf1, *buf2, *buf3;
4019 	size_t size0, size1, size2, size3;
4020 	const uint8_t *buffer, *bufferLim;
4021 	unsigned int i, j;
4022 
4023 	size0 = zip->tmp_stream_bytes_remaining;
4024 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
4025 	size1 = zip->sub_stream_bytes_remaining[0];
4026 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
4027 	size2 = zip->sub_stream_bytes_remaining[1];
4028 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
4029 	size3 = zip->sub_stream_bytes_remaining[2];
4030 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
4031 
4032 	buffer = buf3;
4033 	bufferLim = buffer + size3;
4034 
4035 	if (zip->bcj_state == 0) {
4036 		/*
4037 		 * Initialize.
4038 		 */
4039 		zip->bcj2_prevByte = 0;
4040 		for (i = 0;
4041 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
4042 			zip->bcj2_p[i] = kBitModelTotal >> 1;
4043 		RC_INIT2;
4044 		zip->bcj_state = 1;
4045 	}
4046 
4047 	/*
4048 	 * Gather the odd bytes of a previous call.
4049 	 */
4050 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
4051 		outBuf[outPos++] = zip->odd_bcj[i];
4052 		zip->odd_bcj_size--;
4053 	}
4054 
4055 	if (outSize == 0) {
4056 		zip->bcj2_outPos += outPos;
4057 		return (outPos);
4058 	}
4059 
4060 	for (;;) {
4061 		uint8_t b;
4062 		CProb *prob;
4063 		uint32_t bound;
4064 		uint32_t ttt;
4065 
4066 		size_t limit = size0 - inPos;
4067 		if (outSize - outPos < limit)
4068 			limit = outSize - outPos;
4069 
4070 		if (zip->bcj_state == 1) {
4071 			while (limit != 0) {
4072 				uint8_t bb = buf0[inPos];
4073 				outBuf[outPos++] = bb;
4074 				if (IsJ(zip->bcj2_prevByte, bb)) {
4075 					zip->bcj_state = 2;
4076 					break;
4077 				}
4078 				inPos++;
4079 				zip->bcj2_prevByte = bb;
4080 				limit--;
4081 			}
4082 		}
4083 
4084 		if (limit == 0 || outPos == outSize)
4085 			break;
4086 		zip->bcj_state = 1;
4087 
4088 		b = buf0[inPos++];
4089 
4090 		if (b == 0xE8)
4091 			prob = zip->bcj2_p + zip->bcj2_prevByte;
4092 		else if (b == 0xE9)
4093 			prob = zip->bcj2_p + 256;
4094 		else
4095 			prob = zip->bcj2_p + 257;
4096 
4097 		IF_BIT_0(prob) {
4098 			UPDATE_0(prob)
4099 			zip->bcj2_prevByte = b;
4100 		} else {
4101 			uint32_t dest;
4102 			const uint8_t *v;
4103 			uint8_t out[4];
4104 
4105 			UPDATE_1(prob)
4106 			if (b == 0xE8) {
4107 				v = buf1;
4108 				if (size1 < 4)
4109 					return SZ_ERROR_DATA;
4110 				buf1 += 4;
4111 				size1 -= 4;
4112 			} else {
4113 				v = buf2;
4114 				if (size2 < 4)
4115 					return SZ_ERROR_DATA;
4116 				buf2 += 4;
4117 				size2 -= 4;
4118 			}
4119 			dest = (((uint32_t)v[0] << 24) |
4120 			    ((uint32_t)v[1] << 16) |
4121 			    ((uint32_t)v[2] << 8) |
4122 			    ((uint32_t)v[3])) -
4123 			    ((uint32_t)zip->bcj2_outPos + (uint32_t)outPos + 4);
4124 			out[0] = (uint8_t)dest;
4125 			out[1] = (uint8_t)(dest >> 8);
4126 			out[2] = (uint8_t)(dest >> 16);
4127 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
4128 
4129 			for (i = 0; i < 4 && outPos < outSize; i++)
4130 				outBuf[outPos++] = out[i];
4131 			if (i < 4) {
4132 				/*
4133 				 * Save odd bytes which we could not add into
4134 				 * the output buffer because of out of space.
4135 				 */
4136 				zip->odd_bcj_size = 4 -i;
4137 				for (; i < 4; i++) {
4138 					j = i - 4 + (unsigned)zip->odd_bcj_size;
4139 					zip->odd_bcj[j] = out[i];
4140 				}
4141 				break;
4142 			}
4143 		}
4144 	}
4145 	zip->tmp_stream_bytes_remaining -= inPos;
4146 	zip->sub_stream_bytes_remaining[0] = size1;
4147 	zip->sub_stream_bytes_remaining[1] = size2;
4148 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
4149 	zip->bcj2_outPos += outPos;
4150 
4151 	return ((ssize_t)outPos);
4152 }
4153 
4154