1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 
28 #ifdef HAVE_ERRNO_H
29 #include <errno.h>
30 #endif
31 #ifdef HAVE_STDLIB_H
32 #include <stdlib.h>
33 #endif
34 #ifdef HAVE_BZLIB_H
35 #include <bzlib.h>
36 #endif
37 #ifdef HAVE_LZMA_H
38 #include <lzma.h>
39 #endif
40 #ifdef HAVE_ZLIB_H
41 #include <zlib.h>
42 #endif
43 #ifdef HAVE_ZSTD_H
44 #include <zstd.h>
45 #endif
46 
47 #include "archive.h"
48 #include "archive_entry.h"
49 #include "archive_entry_locale.h"
50 #include "archive_ppmd7_private.h"
51 #include "archive_private.h"
52 #include "archive_read_private.h"
53 #include "archive_endian.h"
54 
55 #ifndef HAVE_ZLIB_H
56 #include "archive_crc32.h"
57 #endif
58 
59 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
60 #define SFX_MIN_ADDR	0x27000
61 #define SFX_MAX_ADDR	0x60000
62 
63 
64 /*
65  * Codec ID
66  */
67 #define _7Z_COPY	0
68 #define _7Z_LZMA	0x030101
69 #define _7Z_LZMA2	0x21
70 #define _7Z_DEFLATE	0x040108
71 #define _7Z_BZ2		0x040202
72 #define _7Z_PPMD	0x030401
73 #define _7Z_DELTA	0x03
74 #define _7Z_CRYPTO_MAIN_ZIP			0x06F10101 /* Main Zip crypto algo */
75 #define _7Z_CRYPTO_RAR_29			0x06F10303 /* Rar29 AES-128 + (modified SHA-1) */
76 #define _7Z_CRYPTO_AES_256_SHA_256	0x06F10701 /* AES-256 + SHA-256 */
77 
78 
79 #define _7Z_X86		0x03030103
80 #define _7Z_X86_BCJ2	0x0303011B
81 #define _7Z_POWERPC	0x03030205
82 #define _7Z_IA64	0x03030401
83 #define _7Z_ARM		0x03030501
84 #define _7Z_ARMTHUMB	0x03030701
85 #define _7Z_ARM64	0xa
86 #define _7Z_SPARC	0x03030805
87 
88 #define _7Z_ZSTD	0x4F71101 /* Copied from https://github.com/mcmilk/7-Zip-zstd.git */
89 
90 /*
91  * 7-Zip header property IDs.
92  */
93 #define kEnd			0x00
94 #define kHeader			0x01
95 #define kArchiveProperties	0x02
96 #define kAdditionalStreamsInfo	0x03
97 #define kMainStreamsInfo	0x04
98 #define kFilesInfo		0x05
99 #define kPackInfo		0x06
100 #define kUnPackInfo		0x07
101 #define kSubStreamsInfo		0x08
102 #define kSize			0x09
103 #define kCRC			0x0A
104 #define kFolder			0x0B
105 #define kCodersUnPackSize	0x0C
106 #define kNumUnPackStream	0x0D
107 #define kEmptyStream		0x0E
108 #define kEmptyFile		0x0F
109 #define kAnti			0x10
110 #define kName			0x11
111 #define kCTime			0x12
112 #define kATime			0x13
113 #define kMTime			0x14
114 #define kAttributes		0x15
115 #define kEncodedHeader		0x17
116 #define kDummy			0x19
117 
118 // Check that some windows file attribute constants are defined.
119 // Reference: https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
120 #ifndef FILE_ATTRIBUTE_READONLY
121 #define FILE_ATTRIBUTE_READONLY 0x00000001
122 #endif
123 
124 #ifndef FILE_ATTRIBUTE_HIDDEN
125 #define FILE_ATTRIBUTE_HIDDEN 0x00000002
126 #endif
127 
128 #ifndef FILE_ATTRIBUTE_SYSTEM
129 #define FILE_ATTRIBUTE_SYSTEM 0x00000004
130 #endif
131 
132 #ifndef FILE_ATTRIBUTE_DIRECTORY
133 #define FILE_ATTRIBUTE_DIRECTORY 0x00000010
134 #endif
135 
136 // This value is defined in 7zip with the comment "trick for Unix".
137 //
138 // 7z archives created on unix have this bit set in the high 16 bits of
139 // the attr field along with the unix permissions.
140 #define FILE_ATTRIBUTE_UNIX_EXTENSION 0x8000
141 
142 struct _7z_digests {
143 	unsigned char	*defineds;
144 	uint32_t	*digests;
145 };
146 
147 
148 struct _7z_folder {
149 	uint64_t		 numCoders;
150 	struct _7z_coder {
151 		unsigned long	 codec;
152 		uint64_t	 numInStreams;
153 		uint64_t	 numOutStreams;
154 		uint64_t	 propertiesSize;
155 		unsigned char	*properties;
156 	} *coders;
157 	uint64_t		 numBindPairs;
158 	struct {
159 		uint64_t	 inIndex;
160 		uint64_t	 outIndex;
161 	} *bindPairs;
162 	uint64_t		 numPackedStreams;
163 	uint64_t		*packedStreams;
164 	uint64_t		 numInStreams;
165 	uint64_t		 numOutStreams;
166 	uint64_t		*unPackSize;
167 	unsigned char		 digest_defined;
168 	uint32_t		 digest;
169 	uint64_t		 numUnpackStreams;
170 	uint32_t		 packIndex;
171 	/* Unoperated bytes. */
172 	uint64_t		 skipped_bytes;
173 };
174 
175 struct _7z_coders_info {
176 	uint64_t		 numFolders;
177 	struct _7z_folder	*folders;
178 	uint64_t		 dataStreamIndex;
179 };
180 
181 struct _7z_pack_info {
182 	uint64_t		 pos;
183 	uint64_t		 numPackStreams;
184 	uint64_t		*sizes;
185 	struct _7z_digests	 digest;
186 	/* Calculated from pos and numPackStreams. */
187 	uint64_t		*positions;
188 };
189 
190 struct _7z_substream_info {
191 	size_t			 unpack_streams;
192 	uint64_t		*unpackSizes;
193 	unsigned char		*digestsDefined;
194 	uint32_t		*digests;
195 };
196 
197 struct _7z_stream_info {
198 	struct _7z_pack_info	 pi;
199 	struct _7z_coders_info	 ci;
200 	struct _7z_substream_info ss;
201 };
202 
203 struct _7z_header_info {
204 	uint64_t		 dataIndex;
205 
206 	unsigned char		*emptyStreamBools;
207 	unsigned char		*emptyFileBools;
208 	unsigned char		*antiBools;
209 	unsigned char		*attrBools;
210 };
211 
212 struct _7zip_entry {
213 	size_t			 name_len;
214 	unsigned char		*utf16name;
215 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
216 	const wchar_t		*wname;
217 #endif
218 	uint32_t		 folderIndex;
219 	uint32_t		 ssIndex;
220 	unsigned		 flg;
221 #define MTIME_IS_SET	(1<<0)
222 #define ATIME_IS_SET	(1<<1)
223 #define CTIME_IS_SET	(1<<2)
224 #define CRC32_IS_SET	(1<<3)
225 #define HAS_STREAM	(1<<4)
226 
227 	time_t			 mtime;
228 	time_t			 atime;
229 	time_t			 ctime;
230 	long			 mtime_ns;
231 	long			 atime_ns;
232 	long			 ctime_ns;
233 	uint32_t		 mode;
234 	uint32_t		 attr;
235 };
236 
237 struct _7zip {
238 	/* Structural information about the archive. */
239 	struct _7z_stream_info	 si;
240 
241 	int			 header_is_being_read;
242 	int			 header_is_encoded;
243 	uint64_t		 header_bytes_remaining;
244 	unsigned long		 header_crc32;
245 	/* Header offset to check that reading points of the file contents
246 	 * will not exceed the header. */
247 	uint64_t		 header_offset;
248 	/* Base offset of the archive file for a seek in case reading SFX. */
249 	uint64_t		 seek_base;
250 
251 	/* List of entries */
252 	size_t			 entries_remaining;
253 	uint64_t		 numFiles;
254 	struct _7zip_entry	*entries;
255 	struct _7zip_entry	*entry;
256 	unsigned char		*entry_names;
257 
258 	/* entry_bytes_remaining is the number of bytes we expect. */
259 	int64_t			 entry_offset;
260 	uint64_t		 entry_bytes_remaining;
261 
262 	/* Running CRC32 of the decompressed data */
263 	unsigned long		 entry_crc32;
264 
265 	/* Flags to mark progress of decompression. */
266 	char			 end_of_entry;
267 
268 	/* Uncompressed buffer control.  */
269 #define UBUFF_SIZE	(64 * 1024)
270 	unsigned char 		*uncompressed_buffer;
271 	unsigned char 		*uncompressed_buffer_pointer;
272 	size_t 			 uncompressed_buffer_size;
273 	size_t			 uncompressed_buffer_bytes_remaining;
274 
275 	/* Offset of the compressed data. */
276 	int64_t			 stream_offset;
277 
278 	/*
279 	 * Decompressing control data.
280 	 */
281 	unsigned		 folder_index;
282 	uint64_t		 folder_outbytes_remaining;
283 	unsigned		 pack_stream_index;
284 	unsigned		 pack_stream_remaining;
285 	uint64_t		 pack_stream_inbytes_remaining;
286 	size_t			 pack_stream_bytes_unconsumed;
287 
288 	/* The codec information of a folder. */
289 	unsigned long		 codec;
290 	unsigned long		 codec2;
291 
292 	/*
293 	 * Decompressor controllers.
294 	 */
295 	/* Decoding LZMA1 and LZMA2 data. */
296 #ifdef HAVE_LZMA_H
297 	lzma_stream		 lzstream;
298 	int			 lzstream_valid;
299 #endif
300 	/* Decoding bzip2 data. */
301 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
302 	bz_stream		 bzstream;
303 	int			 bzstream_valid;
304 #endif
305 	/* Decoding deflate data. */
306 #ifdef HAVE_ZLIB_H
307 	z_stream		 stream;
308 	int			 stream_valid;
309 #endif
310 	/* Decoding Zstandard data. */
311 #if HAVE_ZSTD_H
312 	ZSTD_DStream		 *zstd_dstream;
313 	int		         zstdstream_valid;
314 #endif
315 	/* Decoding PPMd data. */
316 	int			 ppmd7_stat;
317 	CPpmd7			 ppmd7_context;
318 	CPpmd7z_RangeDec	 range_dec;
319 	IByteIn			 bytein;
320 	struct {
321 		const unsigned char	*next_in;
322 		int64_t			 avail_in;
323 		int64_t			 total_in;
324 		int64_t			 stream_in;
325 		unsigned char		*next_out;
326 		int64_t			 avail_out;
327 		int64_t			 total_out;
328 		int			 overconsumed;
329 	} ppstream;
330 	int			 ppmd7_valid;
331 
332 	/* Decoding BCJ and BCJ2 data. */
333 	uint32_t		 bcj_state;
334 	size_t			 odd_bcj_size;
335 	unsigned char		 odd_bcj[4];
336 	/* Decoding BCJ data. */
337 	size_t			 bcj_prevPosT;
338 	uint32_t		 bcj_prevMask;
339 	uint32_t		 bcj_ip;
340 
341 	/* Decoding BCJ2 data. */
342 	size_t			 main_stream_bytes_remaining;
343 	unsigned char		*sub_stream_buff[3];
344 	size_t			 sub_stream_size[3];
345 	size_t			 sub_stream_bytes_remaining[3];
346 	unsigned char		*tmp_stream_buff;
347 	size_t			 tmp_stream_buff_size;
348 	size_t			 tmp_stream_bytes_avail;
349 	size_t			 tmp_stream_bytes_remaining;
350 #ifdef _LZMA_PROB32
351 #define CProb uint32_t
352 #else
353 #define CProb uint16_t
354 #endif
355 	CProb			 bcj2_p[256 + 2];
356 	uint8_t			 bcj2_prevByte;
357 	uint32_t		 bcj2_range;
358 	uint32_t		 bcj2_code;
359 	uint64_t		 bcj2_outPos;
360 
361 	/* Filename character-set conversion data. */
362 	struct archive_string_conv *sconv;
363 
364 	char			 format_name[64];
365 
366 	/* Custom value that is non-zero if this archive contains encrypted entries. */
367 	int			 has_encrypted_entries;
368 };
369 
370 /* Maximum entry size. This limitation prevents reading intentional
371  * corrupted 7-zip files on assuming there are not so many entries in
372  * the files. */
373 #define UMAX_ENTRY	ARCHIVE_LITERAL_ULL(100000000)
374 
375 static int	archive_read_format_7zip_has_encrypted_entries(struct archive_read *);
376 static int	archive_read_support_format_7zip_capabilities(struct archive_read *a);
377 static int	archive_read_format_7zip_bid(struct archive_read *, int);
378 static int	archive_read_format_7zip_cleanup(struct archive_read *);
379 static int	archive_read_format_7zip_read_data(struct archive_read *,
380 		    const void **, size_t *, int64_t *);
381 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
382 static int	archive_read_format_7zip_read_header(struct archive_read *,
383 		    struct archive_entry *);
384 static int	check_7zip_header_in_sfx(const char *);
385 static unsigned long decode_codec_id(const unsigned char *, size_t);
386 static int	decode_encoded_header_info(struct archive_read *,
387 		    struct _7z_stream_info *);
388 static int	decompress(struct archive_read *, struct _7zip *,
389 		    void *, size_t *, const void *, size_t *);
390 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
391 static void	fileTimeToUtc(uint64_t, time_t *, long *);
392 static uint64_t folder_uncompressed_size(struct _7z_folder *);
393 static void	free_CodersInfo(struct _7z_coders_info *);
394 static void	free_Digest(struct _7z_digests *);
395 static void	free_Folder(struct _7z_folder *);
396 static void	free_Header(struct _7z_header_info *);
397 static void	free_PackInfo(struct _7z_pack_info *);
398 static void	free_StreamsInfo(struct _7z_stream_info *);
399 static void	free_SubStreamsInfo(struct _7z_substream_info *);
400 static int	free_decompression(struct archive_read *, struct _7zip *);
401 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
402 		    size_t, size_t);
403 static const unsigned char * header_bytes(struct archive_read *, size_t);
404 static int	init_decompression(struct archive_read *, struct _7zip *,
405 		    const struct _7z_coder *, const struct _7z_coder *);
406 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
407 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
408 static int	read_CodersInfo(struct archive_read *,
409 		    struct _7z_coders_info *);
410 static int	read_Digests(struct archive_read *, struct _7z_digests *,
411 		    size_t);
412 static int	read_Folder(struct archive_read *, struct _7z_folder *);
413 static int	read_Header(struct archive_read *, struct _7z_header_info *,
414 		    int);
415 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
416 static int	read_StreamsInfo(struct archive_read *,
417 		    struct _7z_stream_info *);
418 static int	read_SubStreamsInfo(struct archive_read *,
419 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
420 static int	read_Times(struct archive_read *, struct _7z_header_info *,
421 		    int);
422 static void	read_consume(struct archive_read *);
423 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
424 		    size_t);
425 static int	seek_pack(struct archive_read *);
426 static int64_t	skip_stream(struct archive_read *, size_t);
427 static int	skip_sfx(struct archive_read *, ssize_t);
428 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
429 		    struct _7z_header_info *);
430 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
431 		    int);
432 static void	x86_Init(struct _7zip *);
433 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
434 static void	arm_Init(struct _7zip *);
435 static size_t	arm_Convert(struct _7zip *, uint8_t *, size_t);
436 static size_t	arm64_Convert(struct _7zip *, uint8_t *, size_t);
437 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
438 
439 
440 int
441 archive_read_support_format_7zip(struct archive *_a)
442 {
443 	struct archive_read *a = (struct archive_read *)_a;
444 	struct _7zip *zip;
445 	int r;
446 
447 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
448 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
449 
450 	zip = calloc(1, sizeof(*zip));
451 	if (zip == NULL) {
452 		archive_set_error(&a->archive, ENOMEM,
453 		    "Can't allocate 7zip data");
454 		return (ARCHIVE_FATAL);
455 	}
456 
457 	/*
458 	 * Until enough data has been read, we cannot tell about
459 	 * any encrypted entries yet.
460 	 */
461 	zip->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
462 
463 
464 	r = __archive_read_register_format(a,
465 	    zip,
466 	    "7zip",
467 	    archive_read_format_7zip_bid,
468 	    NULL,
469 	    archive_read_format_7zip_read_header,
470 	    archive_read_format_7zip_read_data,
471 	    archive_read_format_7zip_read_data_skip,
472 	    NULL,
473 	    archive_read_format_7zip_cleanup,
474 	    archive_read_support_format_7zip_capabilities,
475 	    archive_read_format_7zip_has_encrypted_entries);
476 
477 	if (r != ARCHIVE_OK)
478 		free(zip);
479 	return (ARCHIVE_OK);
480 }
481 
482 static int
483 archive_read_support_format_7zip_capabilities(struct archive_read * a)
484 {
485 	(void)a; /* UNUSED */
486 	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA |
487 			ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
488 }
489 
490 
491 static int
492 archive_read_format_7zip_has_encrypted_entries(struct archive_read *_a)
493 {
494 	if (_a && _a->format) {
495 		struct _7zip * zip = (struct _7zip *)_a->format->data;
496 		if (zip) {
497 			return zip->has_encrypted_entries;
498 		}
499 	}
500 	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
501 }
502 
503 static int
504 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
505 {
506 	const char *p;
507 
508 	/* If someone has already bid more than 32, then avoid
509 	   trashing the look-ahead buffers with a seek. */
510 	if (best_bid > 32)
511 		return (-1);
512 
513 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
514 		return (0);
515 
516 	/* If first six bytes are the 7-Zip signature,
517 	 * return the bid right now. */
518 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
519 		return (48);
520 
521 	/*
522 	 * It may a 7-Zip SFX archive file. If first two bytes are
523 	 * 'M' and 'Z' available on Windows or first four bytes are
524 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
525 	 * signature. Although we will perform a seek when reading
526 	 * a header, what we do not use __archive_read_seek() here is
527 	 * due to a bidding performance.
528 	 */
529 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
530 		ssize_t offset = SFX_MIN_ADDR;
531 		ssize_t window = 4096;
532 		ssize_t bytes_avail;
533 		while (offset + window <= (SFX_MAX_ADDR)) {
534 			const char *buff = __archive_read_ahead(a,
535 					offset + window, &bytes_avail);
536 			if (buff == NULL) {
537 				/* Remaining bytes are less than window. */
538 				window >>= 1;
539 				if (window < 0x40)
540 					return (0);
541 				continue;
542 			}
543 			p = buff + offset;
544 			while (p + 32 < buff + bytes_avail) {
545 				int step = check_7zip_header_in_sfx(p);
546 				if (step == 0)
547 					return (48);
548 				p += step;
549 			}
550 			offset = p - buff;
551 		}
552 	}
553 	return (0);
554 }
555 
556 static int
557 check_7zip_header_in_sfx(const char *p)
558 {
559 	switch ((unsigned char)p[5]) {
560 	case 0x1C:
561 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
562 			return (6);
563 		/*
564 		 * Test the CRC because its extraction code has 7-Zip
565 		 * Magic Code, so we should do this in order not to
566 		 * make a mis-detection.
567 		 */
568 		if (crc32(0, (const unsigned char *)p + 12, 20)
569 			!= archive_le32dec(p + 8))
570 			return (6);
571 		/* Hit the header! */
572 		return (0);
573 	case 0x37: return (5);
574 	case 0x7A: return (4);
575 	case 0xBC: return (3);
576 	case 0xAF: return (2);
577 	case 0x27: return (1);
578 	default: return (6);
579 	}
580 }
581 
582 static int
583 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
584 {
585 	const void *h;
586 	const char *p, *q;
587 	size_t skip, offset;
588 	ssize_t bytes, window;
589 
590 	/*
591 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
592 	 * __archive_read_seek() at this time since we have
593 	 * already had enough data.
594 	 */
595 	if (bytes_avail > SFX_MIN_ADDR)
596 		__archive_read_consume(a, SFX_MIN_ADDR);
597 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
598 		return (ARCHIVE_FATAL);
599 
600 	offset = 0;
601 	window = 1;
602 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
603 		h = __archive_read_ahead(a, window, &bytes);
604 		if (h == NULL) {
605 			/* Remaining bytes are less than window. */
606 			window >>= 1;
607 			if (window < 0x40)
608 				goto fatal;
609 			continue;
610 		}
611 		if (bytes < 6) {
612 			/* This case might happen when window == 1. */
613 			window = 4096;
614 			continue;
615 		}
616 		p = (const char *)h;
617 		q = p + bytes;
618 
619 		/*
620 		 * Scan ahead until we find something that looks
621 		 * like the 7-Zip header.
622 		 */
623 		while (p + 32 < q) {
624 			int step = check_7zip_header_in_sfx(p);
625 			if (step == 0) {
626 				struct _7zip *zip =
627 				    (struct _7zip *)a->format->data;
628 				skip = p - (const char *)h;
629 				__archive_read_consume(a, skip);
630 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
631 				return (ARCHIVE_OK);
632 			}
633 			p += step;
634 		}
635 		skip = p - (const char *)h;
636 		__archive_read_consume(a, skip);
637 		offset += skip;
638 		if (window == 1)
639 			window = 4096;
640 	}
641 fatal:
642 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
643 	    "Couldn't find out 7-Zip header");
644 	return (ARCHIVE_FATAL);
645 }
646 
647 static int
648 archive_read_format_7zip_read_header(struct archive_read *a,
649 	struct archive_entry *entry)
650 {
651 	struct _7zip *zip = (struct _7zip *)a->format->data;
652 	struct _7zip_entry *zip_entry;
653 	int r, ret = ARCHIVE_OK;
654 	struct _7z_folder *folder = 0;
655 	uint64_t fidx = 0;
656 
657 	/*
658 	 * It should be sufficient to call archive_read_next_header() for
659 	 * a reader to determine if an entry is encrypted or not. If the
660 	 * encryption of an entry is only detectable when calling
661 	 * archive_read_data(), so be it. We'll do the same check there
662 	 * as well.
663 	 */
664 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
665 		zip->has_encrypted_entries = 0;
666 	}
667 
668 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
669 	if (a->archive.archive_format_name == NULL)
670 		a->archive.archive_format_name = "7-Zip";
671 
672 	if (zip->entries == NULL) {
673 		struct _7z_header_info header;
674 
675 		memset(&header, 0, sizeof(header));
676 		r = slurp_central_directory(a, zip, &header);
677 		free_Header(&header);
678 		if (r != ARCHIVE_OK)
679 			return (r);
680 		zip->entries_remaining = (size_t)zip->numFiles;
681 		zip->entry = zip->entries;
682 	} else {
683 		++zip->entry;
684 	}
685 	zip_entry = zip->entry;
686 
687 	if (zip->entries_remaining <= 0 || zip_entry == NULL)
688 		return ARCHIVE_EOF;
689 	--zip->entries_remaining;
690 
691 	zip->entry_offset = 0;
692 	zip->end_of_entry = 0;
693 	zip->entry_crc32 = crc32(0, NULL, 0);
694 
695 	/* Setup a string conversion for a filename. */
696 	if (zip->sconv == NULL) {
697 		zip->sconv = archive_string_conversion_from_charset(
698 		    &a->archive, "UTF-16LE", 1);
699 		if (zip->sconv == NULL)
700 			return (ARCHIVE_FATAL);
701 	}
702 
703 	/* Figure out if the entry is encrypted by looking at the folder
704 	   that is associated to the current 7zip entry. If the folder
705 	   has a coder with a _7Z_CRYPTO codec then the folder is encrypted.
706 	   Hence the entry must also be encrypted. */
707 	if (zip_entry && zip_entry->folderIndex < zip->si.ci.numFolders) {
708 		folder = &(zip->si.ci.folders[zip_entry->folderIndex]);
709 		for (fidx=0; folder && fidx<folder->numCoders; fidx++) {
710 			switch(folder->coders[fidx].codec) {
711 				case _7Z_CRYPTO_MAIN_ZIP:
712 				case _7Z_CRYPTO_RAR_29:
713 				case _7Z_CRYPTO_AES_256_SHA_256: {
714 					archive_entry_set_is_data_encrypted(entry, 1);
715 					zip->has_encrypted_entries = 1;
716 					break;
717 				}
718 			}
719 		}
720 	}
721 
722 	/* Now that we've checked for encryption, if there were still no
723 	 * encrypted entries found we can say for sure that there are none.
724 	 */
725 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
726 		zip->has_encrypted_entries = 0;
727 	}
728 
729 	if (archive_entry_copy_pathname_l(entry,
730 	    (const char *)zip_entry->utf16name,
731 	    zip_entry->name_len, zip->sconv) != 0) {
732 		if (errno == ENOMEM) {
733 			archive_set_error(&a->archive, ENOMEM,
734 			    "Can't allocate memory for Pathname");
735 			return (ARCHIVE_FATAL);
736 		}
737 		archive_set_error(&a->archive,
738 		    ARCHIVE_ERRNO_FILE_FORMAT,
739 		    "Pathname cannot be converted "
740 		    "from %s to current locale.",
741 		    archive_string_conversion_charset_name(zip->sconv));
742 		ret = ARCHIVE_WARN;
743 	}
744 
745 	/* Populate some additional entry fields: */
746 	archive_entry_set_mode(entry, zip_entry->mode);
747 	if (zip_entry->flg & MTIME_IS_SET)
748 		archive_entry_set_mtime(entry, zip_entry->mtime,
749 			zip_entry->mtime_ns);
750 	if (zip_entry->flg & CTIME_IS_SET)
751 		archive_entry_set_ctime(entry, zip_entry->ctime,
752 		    zip_entry->ctime_ns);
753 	if (zip_entry->flg & ATIME_IS_SET)
754 		archive_entry_set_atime(entry, zip_entry->atime,
755 		    zip_entry->atime_ns);
756 	if (zip_entry->ssIndex != (uint32_t)-1) {
757 		zip->entry_bytes_remaining =
758 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
759 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
760 	} else {
761 		zip->entry_bytes_remaining = 0;
762 		archive_entry_set_size(entry, 0);
763 	}
764 
765 	// These attributes are supported by the windows implementation of archive_write_disk.
766 	const int supported_attrs = FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM;
767 
768 	if (zip_entry->attr & supported_attrs) {
769 		char *fflags_text, *ptr;
770 		/* allocate for "rdonly,hidden,system," */
771 		fflags_text = malloc(22 * sizeof(char));
772 		if (fflags_text != NULL) {
773 			ptr = fflags_text;
774 			if (zip_entry->attr & FILE_ATTRIBUTE_READONLY) {
775  			strcpy(ptr, "rdonly,");
776  			ptr = ptr + 7;
777  		}
778  		if (zip_entry->attr & FILE_ATTRIBUTE_HIDDEN) {
779  			strcpy(ptr, "hidden,");
780  			ptr = ptr + 7;
781  		}
782  		if (zip_entry->attr & FILE_ATTRIBUTE_SYSTEM) {
783  			strcpy(ptr, "system,");
784  			ptr = ptr + 7;
785  		}
786  		if (ptr > fflags_text) {
787  			/* Delete trailing comma */
788  			*(ptr - 1) = '\0';
789  			archive_entry_copy_fflags_text(entry,
790 				fflags_text);
791  		}
792  		free(fflags_text);
793 		}
794 	}
795 
796 	/* If there's no body, force read_data() to return EOF immediately. */
797 	if (zip->entry_bytes_remaining < 1)
798 		zip->end_of_entry = 1;
799 
800 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
801 		unsigned char *symname = NULL;
802 		size_t symsize = 0;
803 
804 		/*
805 		 * Symbolic-name is recorded as its contents. We have to
806 		 * read the contents at this time.
807 		 */
808 		while (zip->entry_bytes_remaining > 0) {
809 			const void *buff;
810 			unsigned char *mem;
811 			size_t size;
812 			int64_t offset;
813 
814 			r = archive_read_format_7zip_read_data(a, &buff,
815 				&size, &offset);
816 			if (r < ARCHIVE_WARN) {
817 				free(symname);
818 				return (r);
819 			}
820 			mem = realloc(symname, symsize + size + 1);
821 			if (mem == NULL) {
822 				free(symname);
823 				archive_set_error(&a->archive, ENOMEM,
824 				    "Can't allocate memory for Symname");
825 				return (ARCHIVE_FATAL);
826 			}
827 			symname = mem;
828 			memcpy(symname+symsize, buff, size);
829 			symsize += size;
830 		}
831 		if (symsize == 0) {
832 			/* If there is no symname, handle it as a regular
833 			 * file. */
834 			zip_entry->mode &= ~AE_IFMT;
835 			zip_entry->mode |= AE_IFREG;
836 			archive_entry_set_mode(entry, zip_entry->mode);
837 		} else {
838 			symname[symsize] = '\0';
839 			archive_entry_copy_symlink(entry,
840 			    (const char *)symname);
841 		}
842 		free(symname);
843 		archive_entry_set_size(entry, 0);
844 	}
845 
846 	/* Set up a more descriptive format name. */
847 	snprintf(zip->format_name, sizeof(zip->format_name), "7-Zip");
848 	a->archive.archive_format_name = zip->format_name;
849 
850 	return (ret);
851 }
852 
853 static int
854 archive_read_format_7zip_read_data(struct archive_read *a,
855     const void **buff, size_t *size, int64_t *offset)
856 {
857 	struct _7zip *zip;
858 	ssize_t bytes;
859 	int ret = ARCHIVE_OK;
860 
861 	zip = (struct _7zip *)(a->format->data);
862 
863 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
864 		zip->has_encrypted_entries = 0;
865 	}
866 
867 	if (zip->pack_stream_bytes_unconsumed)
868 		read_consume(a);
869 
870 	*offset = zip->entry_offset;
871 	*size = 0;
872 	*buff = NULL;
873 	/*
874 	 * If we hit end-of-entry last time, clean up and return
875 	 * ARCHIVE_EOF this time.
876 	 */
877 	if (zip->end_of_entry)
878 		return (ARCHIVE_EOF);
879 
880 	const uint64_t max_read_size = 16 * 1024 * 1024;  // Don't try to read more than 16 MB at a time
881 	size_t bytes_to_read = max_read_size;
882 	if ((uint64_t)bytes_to_read > zip->entry_bytes_remaining) {
883 		bytes_to_read = zip->entry_bytes_remaining;
884 	}
885 	bytes = read_stream(a, buff, bytes_to_read, 0);
886 	if (bytes < 0)
887 		return ((int)bytes);
888 	if (bytes == 0) {
889 		archive_set_error(&a->archive,
890 		    ARCHIVE_ERRNO_FILE_FORMAT,
891 		    "Truncated 7-Zip file body");
892 		return (ARCHIVE_FATAL);
893 	}
894 	zip->entry_bytes_remaining -= bytes;
895 	if (zip->entry_bytes_remaining == 0)
896 		zip->end_of_entry = 1;
897 
898 	/* Update checksum */
899 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
900 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff,
901 		    (unsigned)bytes);
902 
903 	/* If we hit the end, swallow any end-of-data marker. */
904 	if (zip->end_of_entry) {
905 		/* Check computed CRC against file contents. */
906 		if ((zip->entry->flg & CRC32_IS_SET) &&
907 			zip->si.ss.digests[zip->entry->ssIndex] !=
908 		    zip->entry_crc32) {
909 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
910 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
911 			    (unsigned long)zip->entry_crc32,
912 			    (unsigned long)zip->si.ss.digests[
913 			    		zip->entry->ssIndex]);
914 			ret = ARCHIVE_WARN;
915 		}
916 	}
917 
918 	*size = bytes;
919 	*offset = zip->entry_offset;
920 	zip->entry_offset += bytes;
921 
922 	return (ret);
923 }
924 
925 static int
926 archive_read_format_7zip_read_data_skip(struct archive_read *a)
927 {
928 	struct _7zip *zip;
929 	int64_t bytes_skipped;
930 
931 	zip = (struct _7zip *)(a->format->data);
932 
933 	if (zip->pack_stream_bytes_unconsumed)
934 		read_consume(a);
935 
936 	/* If we've already read to end of data, we're done. */
937 	if (zip->end_of_entry)
938 		return (ARCHIVE_OK);
939 
940 	/*
941 	 * If the length is at the beginning, we can skip the
942 	 * compressed data much more quickly.
943 	 */
944 	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
945 	if (bytes_skipped < 0)
946 		return (ARCHIVE_FATAL);
947 	zip->entry_bytes_remaining = 0;
948 
949 	/* This entry is finished and done. */
950 	zip->end_of_entry = 1;
951 	return (ARCHIVE_OK);
952 }
953 
954 static int
955 archive_read_format_7zip_cleanup(struct archive_read *a)
956 {
957 	struct _7zip *zip;
958 
959 	zip = (struct _7zip *)(a->format->data);
960 	free_StreamsInfo(&(zip->si));
961 	free(zip->entries);
962 	free(zip->entry_names);
963 	free_decompression(a, zip);
964 	free(zip->uncompressed_buffer);
965 	free(zip->sub_stream_buff[0]);
966 	free(zip->sub_stream_buff[1]);
967 	free(zip->sub_stream_buff[2]);
968 	free(zip->tmp_stream_buff);
969 	free(zip);
970 	(a->format->data) = NULL;
971 	return (ARCHIVE_OK);
972 }
973 
974 static void
975 read_consume(struct archive_read *a)
976 {
977 	struct _7zip *zip = (struct _7zip *)a->format->data;
978 
979 	if (zip->pack_stream_bytes_unconsumed) {
980 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
981 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
982 		zip->pack_stream_bytes_unconsumed = 0;
983 	}
984 }
985 
986 #ifdef HAVE_LZMA_H
987 
988 /*
989  * Set an error code and choose an error message for liblzma.
990  */
991 static void
992 set_error(struct archive_read *a, int ret)
993 {
994 
995 	switch (ret) {
996 	case LZMA_STREAM_END: /* Found end of stream. */
997 	case LZMA_OK: /* Decompressor made some progress. */
998 		break;
999 	case LZMA_MEM_ERROR:
1000 		archive_set_error(&a->archive, ENOMEM,
1001 		    "Lzma library error: Cannot allocate memory");
1002 		break;
1003 	case LZMA_MEMLIMIT_ERROR:
1004 		archive_set_error(&a->archive, ENOMEM,
1005 		    "Lzma library error: Out of memory");
1006 		break;
1007 	case LZMA_FORMAT_ERROR:
1008 		archive_set_error(&a->archive,
1009 		    ARCHIVE_ERRNO_MISC,
1010 		    "Lzma library error: format not recognized");
1011 		break;
1012 	case LZMA_OPTIONS_ERROR:
1013 		archive_set_error(&a->archive,
1014 		    ARCHIVE_ERRNO_MISC,
1015 		    "Lzma library error: Invalid options");
1016 		break;
1017 	case LZMA_DATA_ERROR:
1018 		archive_set_error(&a->archive,
1019 		    ARCHIVE_ERRNO_MISC,
1020 		    "Lzma library error: Corrupted input data");
1021 		break;
1022 	case LZMA_BUF_ERROR:
1023 		archive_set_error(&a->archive,
1024 		    ARCHIVE_ERRNO_MISC,
1025 		    "Lzma library error:  No progress is possible");
1026 		break;
1027 	default:
1028 		/* Return an error. */
1029 		archive_set_error(&a->archive,
1030 		    ARCHIVE_ERRNO_MISC,
1031 		    "Lzma decompression failed:  Unknown error");
1032 		break;
1033 	}
1034 }
1035 
1036 #endif
1037 
1038 static unsigned long
1039 decode_codec_id(const unsigned char *codecId, size_t id_size)
1040 {
1041 	unsigned i;
1042 	unsigned long id = 0;
1043 
1044 	for (i = 0; i < id_size; i++) {
1045 		id <<= 8;
1046 		id += codecId[i];
1047 	}
1048 	return (id);
1049 }
1050 
1051 static Byte
1052 ppmd_read(void *p)
1053 {
1054 	struct archive_read *a = ((IByteIn*)p)->a;
1055 	struct _7zip *zip = (struct _7zip *)(a->format->data);
1056 	Byte b;
1057 
1058 	if (zip->ppstream.avail_in <= 0) {
1059 		/*
1060 		 * Ppmd7_DecodeSymbol might require reading multiple bytes
1061 		 * and we are on boundary;
1062 		 * last resort to read using __archive_read_ahead.
1063 		 */
1064 		ssize_t bytes_avail = 0;
1065 		const uint8_t* data = __archive_read_ahead(a,
1066 		    zip->ppstream.stream_in+1, &bytes_avail);
1067 		if(bytes_avail < zip->ppstream.stream_in+1) {
1068 			archive_set_error(&a->archive,
1069 			    ARCHIVE_ERRNO_FILE_FORMAT,
1070 			    "Truncated 7z file data");
1071 			zip->ppstream.overconsumed = 1;
1072 			return (0);
1073 		}
1074 		zip->ppstream.next_in++;
1075 		b = data[zip->ppstream.stream_in];
1076 	} else {
1077 		b = *zip->ppstream.next_in++;
1078 	}
1079 	zip->ppstream.avail_in--;
1080 	zip->ppstream.total_in++;
1081 	zip->ppstream.stream_in++;
1082 	return (b);
1083 }
1084 
1085 static int
1086 init_decompression(struct archive_read *a, struct _7zip *zip,
1087     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
1088 {
1089 	int r;
1090 
1091 	zip->codec = coder1->codec;
1092 	zip->codec2 = -1;
1093 
1094 	switch (zip->codec) {
1095 	case _7Z_COPY:
1096 	case _7Z_BZ2:
1097 	case _7Z_DEFLATE:
1098 	case _7Z_ZSTD:
1099 	case _7Z_PPMD:
1100 		if (coder2 != NULL) {
1101 			if (coder2->codec != _7Z_X86 &&
1102 			    coder2->codec != _7Z_X86_BCJ2 &&
1103 			    coder2->codec != _7Z_ARM &&
1104 			    coder2->codec != _7Z_ARM64) {
1105 				archive_set_error(&a->archive,
1106 				    ARCHIVE_ERRNO_MISC,
1107 				    "Unsupported filter %lx for %lx",
1108 				    coder2->codec, coder1->codec);
1109 				return (ARCHIVE_FAILED);
1110 			}
1111 			zip->codec2 = coder2->codec;
1112 			zip->bcj_state = 0;
1113 			if (coder2->codec == _7Z_X86)
1114 				x86_Init(zip);
1115 			else if (coder2->codec == _7Z_ARM)
1116 				arm_Init(zip);
1117 		}
1118 		break;
1119 	default:
1120 		break;
1121 	}
1122 
1123 	switch (zip->codec) {
1124 	case _7Z_COPY:
1125 		break;
1126 
1127 	case _7Z_LZMA: case _7Z_LZMA2:
1128 #ifdef HAVE_LZMA_H
1129 #if LZMA_VERSION_MAJOR >= 5
1130 /* Effectively disable the limiter. */
1131 #define LZMA_MEMLIMIT   UINT64_MAX
1132 #else
1133 /* NOTE: This needs to check memory size which running system has. */
1134 #define LZMA_MEMLIMIT   (1U << 30)
1135 #endif
1136 	{
1137 		lzma_options_delta delta_opt;
1138 		lzma_filter filters[LZMA_FILTERS_MAX], *ff;
1139 		int fi = 0;
1140 
1141 		if (zip->lzstream_valid) {
1142 			lzma_end(&(zip->lzstream));
1143 			zip->lzstream_valid = 0;
1144 		}
1145 
1146 		/*
1147 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
1148 		 * data made by 7-Zip because 7-Zip does not add End-Of-
1149 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
1150 		 * and so liblzma cannot know the end of the compressed data
1151 		 * without EOPM. So consequently liblzma will not return last
1152 		 * three or four bytes of uncompressed data because
1153 		 * LZMA_FILTER_X86 filter does not handle input data if its
1154 		 * data size is less than five bytes. If liblzma detect EOPM
1155 		 * or know the uncompressed data size, liblzma will flush out
1156 		 * the remaining that three or four bytes of uncompressed
1157 		 * data. That is why we have to use our converting program
1158 		 * for BCJ+LZMA. If we were able to tell the uncompressed
1159 		 * size to liblzma when using lzma_raw_decoder() liblzma
1160 		 * could correctly deal with BCJ+LZMA. But unfortunately
1161 		 * there is no way to do that.
1162 		 * Discussion about this can be found at XZ Utils forum.
1163 		 */
1164 		if (coder2 != NULL) {
1165 			zip->codec2 = coder2->codec;
1166 
1167 			filters[fi].options = NULL;
1168 			switch (zip->codec2) {
1169 			case _7Z_X86:
1170 				if (zip->codec == _7Z_LZMA2) {
1171 					filters[fi].id = LZMA_FILTER_X86;
1172 					fi++;
1173 				} else
1174 					/* Use our filter. */
1175 					x86_Init(zip);
1176 				break;
1177 			case _7Z_X86_BCJ2:
1178 				/* Use our filter. */
1179 				zip->bcj_state = 0;
1180 				break;
1181 			case _7Z_DELTA:
1182 				if (coder2->propertiesSize != 1) {
1183 					archive_set_error(&a->archive,
1184 					    ARCHIVE_ERRNO_MISC,
1185 					    "Invalid Delta parameter");
1186 					return (ARCHIVE_FAILED);
1187 				}
1188 				filters[fi].id = LZMA_FILTER_DELTA;
1189 				memset(&delta_opt, 0, sizeof(delta_opt));
1190 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1191 				delta_opt.dist =
1192 				    (uint32_t)coder2->properties[0] + 1;
1193 				filters[fi].options = &delta_opt;
1194 				fi++;
1195 				break;
1196 			/* Following filters have not been tested yet. */
1197 			case _7Z_POWERPC:
1198 				filters[fi].id = LZMA_FILTER_POWERPC;
1199 				fi++;
1200 				break;
1201 			case _7Z_IA64:
1202 				filters[fi].id = LZMA_FILTER_IA64;
1203 				fi++;
1204 				break;
1205 			case _7Z_ARM:
1206 				filters[fi].id = LZMA_FILTER_ARM;
1207 				fi++;
1208 				break;
1209 			case _7Z_ARMTHUMB:
1210 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1211 				fi++;
1212 				break;
1213 #ifdef LZMA_FILTER_ARM64
1214 			case _7Z_ARM64:
1215 				filters[fi].id = LZMA_FILTER_ARM64;
1216 				fi++;
1217 				break;
1218 #endif
1219 			case _7Z_SPARC:
1220 				filters[fi].id = LZMA_FILTER_SPARC;
1221 				fi++;
1222 				break;
1223 			default:
1224 				archive_set_error(&a->archive,
1225 				    ARCHIVE_ERRNO_MISC,
1226 				    "Unexpected codec ID: %lX", zip->codec2);
1227 				return (ARCHIVE_FAILED);
1228 			}
1229 		}
1230 
1231 		if (zip->codec == _7Z_LZMA2)
1232 			filters[fi].id = LZMA_FILTER_LZMA2;
1233 		else
1234 			filters[fi].id = LZMA_FILTER_LZMA1;
1235 		filters[fi].options = NULL;
1236 		ff = &filters[fi];
1237 		r = lzma_properties_decode(&filters[fi], NULL,
1238 		    coder1->properties, (size_t)coder1->propertiesSize);
1239 		if (r != LZMA_OK) {
1240 			set_error(a, r);
1241 			return (ARCHIVE_FAILED);
1242 		}
1243 		fi++;
1244 
1245 		filters[fi].id = LZMA_VLI_UNKNOWN;
1246 		filters[fi].options = NULL;
1247 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1248 		free(ff->options);
1249 		if (r != LZMA_OK) {
1250 			set_error(a, r);
1251 			return (ARCHIVE_FAILED);
1252 		}
1253 		zip->lzstream_valid = 1;
1254 		zip->lzstream.total_in = 0;
1255 		zip->lzstream.total_out = 0;
1256 		break;
1257 	}
1258 #else
1259 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1260 		    "LZMA codec is unsupported");
1261 		return (ARCHIVE_FAILED);
1262 #endif
1263 	case _7Z_BZ2:
1264 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1265 		if (zip->bzstream_valid) {
1266 			BZ2_bzDecompressEnd(&(zip->bzstream));
1267 			zip->bzstream_valid = 0;
1268 		}
1269 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1270 		if (r == BZ_MEM_ERROR)
1271 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1272 		if (r != BZ_OK) {
1273 			int err = ARCHIVE_ERRNO_MISC;
1274 			const char *detail = NULL;
1275 			switch (r) {
1276 			case BZ_PARAM_ERROR:
1277 				detail = "invalid setup parameter";
1278 				break;
1279 			case BZ_MEM_ERROR:
1280 				err = ENOMEM;
1281 				detail = "out of memory";
1282 				break;
1283 			case BZ_CONFIG_ERROR:
1284 				detail = "mis-compiled library";
1285 				break;
1286 			}
1287 			archive_set_error(&a->archive, err,
1288 			    "Internal error initializing decompressor: %s",
1289 			    detail != NULL ? detail : "??");
1290 			zip->bzstream_valid = 0;
1291 			return (ARCHIVE_FAILED);
1292 		}
1293 		zip->bzstream_valid = 1;
1294 		zip->bzstream.total_in_lo32 = 0;
1295 		zip->bzstream.total_in_hi32 = 0;
1296 		zip->bzstream.total_out_lo32 = 0;
1297 		zip->bzstream.total_out_hi32 = 0;
1298 		break;
1299 #else
1300 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1301 		    "BZ2 codec is unsupported");
1302 		return (ARCHIVE_FAILED);
1303 #endif
1304 	case _7Z_ZSTD:
1305 	{
1306 #if defined(HAVE_ZSTD_H)
1307 		if (zip->zstdstream_valid) {
1308 			ZSTD_freeDStream(zip->zstd_dstream);
1309 			zip->zstdstream_valid = 0;
1310 		}
1311 		zip->zstd_dstream = ZSTD_createDStream();
1312 		zip->zstdstream_valid = 1;
1313 		break;
1314 #else
1315 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1316 			"ZSTD codec is unsupported");
1317 		return (ARCHIVE_FAILED);
1318 #endif
1319 	}
1320 	case _7Z_DEFLATE:
1321 #ifdef HAVE_ZLIB_H
1322 		if (zip->stream_valid)
1323 			r = inflateReset(&(zip->stream));
1324 		else
1325 			r = inflateInit2(&(zip->stream),
1326 			    -15 /* Don't check for zlib header */);
1327 		if (r != Z_OK) {
1328 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1329 			    "Couldn't initialize zlib stream.");
1330 			return (ARCHIVE_FAILED);
1331 		}
1332 		zip->stream_valid = 1;
1333 		zip->stream.total_in = 0;
1334 		zip->stream.total_out = 0;
1335 		break;
1336 #else
1337 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1338 		    "DEFLATE codec is unsupported");
1339 		return (ARCHIVE_FAILED);
1340 #endif
1341 	case _7Z_PPMD:
1342 	{
1343 		unsigned order;
1344 		uint32_t msize;
1345 
1346 		if (zip->ppmd7_valid) {
1347 			__archive_ppmd7_functions.Ppmd7_Free(
1348 			    &zip->ppmd7_context);
1349 			zip->ppmd7_valid = 0;
1350 		}
1351 
1352 		if (coder1->propertiesSize < 5) {
1353 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1354 			    "Malformed PPMd parameter");
1355 			return (ARCHIVE_FAILED);
1356 		}
1357 		order = coder1->properties[0];
1358 		msize = archive_le32dec(&(coder1->properties[1]));
1359 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1360 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1361 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1362 			    "Malformed PPMd parameter");
1363 			return (ARCHIVE_FAILED);
1364 		}
1365 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1366 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1367 			&zip->ppmd7_context, msize);
1368 		if (r == 0) {
1369 			archive_set_error(&a->archive, ENOMEM,
1370 			    "Coludn't allocate memory for PPMd");
1371 			return (ARCHIVE_FATAL);
1372 		}
1373 		__archive_ppmd7_functions.Ppmd7_Init(
1374 			&zip->ppmd7_context, order);
1375 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1376 			&zip->range_dec);
1377 		zip->ppmd7_valid = 1;
1378 		zip->ppmd7_stat = 0;
1379 		zip->ppstream.overconsumed = 0;
1380 		zip->ppstream.total_in = 0;
1381 		zip->ppstream.total_out = 0;
1382 		break;
1383 	}
1384 	case _7Z_X86:
1385 	case _7Z_X86_BCJ2:
1386 	case _7Z_POWERPC:
1387 	case _7Z_IA64:
1388 	case _7Z_ARM:
1389 	case _7Z_ARMTHUMB:
1390 	case _7Z_ARM64:
1391 	case _7Z_SPARC:
1392 	case _7Z_DELTA:
1393 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1394 		    "Unexpected codec ID: %lX", zip->codec);
1395 		return (ARCHIVE_FAILED);
1396 	case _7Z_CRYPTO_MAIN_ZIP:
1397 	case _7Z_CRYPTO_RAR_29:
1398 	case _7Z_CRYPTO_AES_256_SHA_256:
1399 		if (a->entry) {
1400 			archive_entry_set_is_metadata_encrypted(a->entry, 1);
1401 			archive_entry_set_is_data_encrypted(a->entry, 1);
1402 			zip->has_encrypted_entries = 1;
1403 		}
1404 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1405 		    "Crypto codec not supported yet (ID: 0x%lX)", zip->codec);
1406 		return (ARCHIVE_FAILED);
1407 	default:
1408 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1409 		    "Unknown codec ID: %lX", zip->codec);
1410 		return (ARCHIVE_FAILED);
1411 	}
1412 
1413 	return (ARCHIVE_OK);
1414 }
1415 
1416 static int
1417 decompress(struct archive_read *a, struct _7zip *zip,
1418     void *buff, size_t *outbytes, const void *b, size_t *used)
1419 {
1420 	const uint8_t *t_next_in;
1421 	uint8_t *t_next_out;
1422 	size_t o_avail_in, o_avail_out;
1423 	size_t t_avail_in, t_avail_out;
1424 	uint8_t *bcj2_next_out;
1425 	size_t bcj2_avail_out;
1426 	int r, ret = ARCHIVE_OK;
1427 
1428 	t_avail_in = o_avail_in = *used;
1429 	t_avail_out = o_avail_out = *outbytes;
1430 	t_next_in = b;
1431 	t_next_out = buff;
1432 
1433 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1434 		int i;
1435 
1436 		/* Do not copy out the BCJ remaining bytes when the output
1437 		 * buffer size is less than five bytes. */
1438 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1439 			*used = 0;
1440 			*outbytes = 0;
1441 			return (ret);
1442 		}
1443 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1444 			*t_next_out++ = zip->odd_bcj[i];
1445 			t_avail_out--;
1446 			zip->odd_bcj_size--;
1447 		}
1448 		if (o_avail_in == 0 || t_avail_out == 0) {
1449 			*used = o_avail_in - t_avail_in;
1450 			*outbytes = o_avail_out - t_avail_out;
1451 			if (o_avail_in == 0)
1452 				ret = ARCHIVE_EOF;
1453 			return (ret);
1454 		}
1455 	}
1456 
1457 	bcj2_next_out = t_next_out;
1458 	bcj2_avail_out = t_avail_out;
1459 	if (zip->codec2 == _7Z_X86_BCJ2) {
1460 		/*
1461 		 * Decord a remaining decompressed main stream for BCJ2.
1462 		 */
1463 		if (zip->tmp_stream_bytes_remaining) {
1464 			ssize_t bytes;
1465 			size_t remaining = zip->tmp_stream_bytes_remaining;
1466 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1467 			if (bytes < 0) {
1468 				archive_set_error(&(a->archive),
1469 				    ARCHIVE_ERRNO_MISC,
1470 				    "BCJ2 conversion Failed");
1471 				return (ARCHIVE_FAILED);
1472 			}
1473 			zip->main_stream_bytes_remaining -=
1474 			    remaining - zip->tmp_stream_bytes_remaining;
1475 			t_avail_out -= bytes;
1476 			if (o_avail_in == 0 || t_avail_out == 0) {
1477 				*used = 0;
1478 				*outbytes = o_avail_out - t_avail_out;
1479 				if (o_avail_in == 0 &&
1480 				    zip->tmp_stream_bytes_remaining)
1481 					ret = ARCHIVE_EOF;
1482 				return (ret);
1483 			}
1484 			t_next_out += bytes;
1485 			bcj2_next_out = t_next_out;
1486 			bcj2_avail_out = t_avail_out;
1487 		}
1488 		t_next_out = zip->tmp_stream_buff;
1489 		t_avail_out = zip->tmp_stream_buff_size;
1490 	}
1491 
1492 	switch (zip->codec) {
1493 	case _7Z_COPY:
1494 	{
1495 		size_t bytes =
1496 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1497 
1498 		memcpy(t_next_out, t_next_in, bytes);
1499 		t_avail_in -= bytes;
1500 		t_avail_out -= bytes;
1501 		if (o_avail_in == 0)
1502 			ret = ARCHIVE_EOF;
1503 		break;
1504 	}
1505 #ifdef HAVE_LZMA_H
1506 	case _7Z_LZMA: case _7Z_LZMA2:
1507 		zip->lzstream.next_in = t_next_in;
1508 		zip->lzstream.avail_in = t_avail_in;
1509 		zip->lzstream.next_out = t_next_out;
1510 		zip->lzstream.avail_out = t_avail_out;
1511 
1512 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1513 		switch (r) {
1514 		case LZMA_STREAM_END: /* Found end of stream. */
1515 			lzma_end(&(zip->lzstream));
1516 			zip->lzstream_valid = 0;
1517 			ret = ARCHIVE_EOF;
1518 			break;
1519 		case LZMA_OK: /* Decompressor made some progress. */
1520 			break;
1521 		default:
1522 			archive_set_error(&(a->archive),
1523 			    ARCHIVE_ERRNO_MISC,
1524 				"Decompression failed(%d)",
1525 			    r);
1526 			return (ARCHIVE_FAILED);
1527 		}
1528 		t_avail_in = zip->lzstream.avail_in;
1529 		t_avail_out = zip->lzstream.avail_out;
1530 		break;
1531 #endif
1532 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1533 	case _7Z_BZ2:
1534 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1535 		zip->bzstream.avail_in = (uint32_t)t_avail_in;
1536 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1537 		zip->bzstream.avail_out = (uint32_t)t_avail_out;
1538 		r = BZ2_bzDecompress(&(zip->bzstream));
1539 		switch (r) {
1540 		case BZ_STREAM_END: /* Found end of stream. */
1541 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1542 			case BZ_OK:
1543 				break;
1544 			default:
1545 				archive_set_error(&(a->archive),
1546 				    ARCHIVE_ERRNO_MISC,
1547 				    "Failed to clean up decompressor");
1548 				return (ARCHIVE_FAILED);
1549 			}
1550 			zip->bzstream_valid = 0;
1551 			ret = ARCHIVE_EOF;
1552 			break;
1553 		case BZ_OK: /* Decompressor made some progress. */
1554 			break;
1555 		default:
1556 			archive_set_error(&(a->archive),
1557 			    ARCHIVE_ERRNO_MISC,
1558 			    "bzip decompression failed");
1559 			return (ARCHIVE_FAILED);
1560 		}
1561 		t_avail_in = zip->bzstream.avail_in;
1562 		t_avail_out = zip->bzstream.avail_out;
1563 		break;
1564 #endif
1565 #ifdef HAVE_ZLIB_H
1566 	case _7Z_DEFLATE:
1567 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1568 		zip->stream.avail_in = (uInt)t_avail_in;
1569 		zip->stream.next_out = t_next_out;
1570 		zip->stream.avail_out = (uInt)t_avail_out;
1571 		r = inflate(&(zip->stream), 0);
1572 		switch (r) {
1573 		case Z_STREAM_END: /* Found end of stream. */
1574 			ret = ARCHIVE_EOF;
1575 			break;
1576 		case Z_OK: /* Decompressor made some progress.*/
1577 			break;
1578 		default:
1579 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1580 			    "File decompression failed (%d)", r);
1581 			return (ARCHIVE_FAILED);
1582 		}
1583 		t_avail_in = zip->stream.avail_in;
1584 		t_avail_out = zip->stream.avail_out;
1585 		break;
1586 #endif
1587 #ifdef HAVE_ZSTD_H
1588 	case _7Z_ZSTD:
1589 	{
1590 		ZSTD_inBuffer input = { t_next_in, t_avail_in, 0 }; // src, size, pos
1591 		ZSTD_outBuffer output = { t_next_out, t_avail_out, 0 }; // dst, size, pos
1592 
1593 		size_t const zret = ZSTD_decompressStream(zip->zstd_dstream, &output, &input);
1594 		if (ZSTD_isError(zret)) {
1595 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, "Zstd decompression failed: %s", ZSTD_getErrorName(zret));
1596 			return ARCHIVE_FAILED;
1597 		}
1598 		t_avail_in -= input.pos;
1599 		t_avail_out -= output.pos;
1600 		break;
1601 	}
1602 #endif
1603 	case _7Z_PPMD:
1604 	{
1605 		uint64_t flush_bytes;
1606 
1607 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1608 		    t_avail_out <= 0) {
1609 			archive_set_error(&(a->archive),
1610 			    ARCHIVE_ERRNO_MISC,
1611 			    "Decompression internal error");
1612 			return (ARCHIVE_FAILED);
1613 		}
1614 		zip->ppstream.next_in = t_next_in;
1615 		zip->ppstream.avail_in = t_avail_in;
1616 		zip->ppstream.stream_in = 0;
1617 		zip->ppstream.next_out = t_next_out;
1618 		zip->ppstream.avail_out = t_avail_out;
1619 		if (zip->ppmd7_stat == 0) {
1620 			zip->bytein.a = a;
1621 			zip->bytein.Read = &ppmd_read;
1622 			zip->range_dec.Stream = &zip->bytein;
1623 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1624 				&(zip->range_dec));
1625 			if (r == 0) {
1626 				zip->ppmd7_stat = -1;
1627 				archive_set_error(&a->archive,
1628 				    ARCHIVE_ERRNO_MISC,
1629 				    "Failed to initialize PPMd range decoder");
1630 				return (ARCHIVE_FAILED);
1631 			}
1632 			if (zip->ppstream.overconsumed) {
1633 				zip->ppmd7_stat = -1;
1634 				return (ARCHIVE_FAILED);
1635 			}
1636 			zip->ppmd7_stat = 1;
1637 		}
1638 
1639 		if (t_avail_in == 0)
1640 			/* XXX Flush out remaining decoded data XXX */
1641 			flush_bytes = zip->folder_outbytes_remaining;
1642 		else
1643 			flush_bytes = 0;
1644 
1645 		do {
1646 			int sym;
1647 
1648 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1649 				&(zip->ppmd7_context), &(zip->range_dec.p));
1650 			if (sym < 0) {
1651 				zip->ppmd7_stat = -1;
1652 				archive_set_error(&a->archive,
1653 				    ARCHIVE_ERRNO_FILE_FORMAT,
1654 				    "Failed to decode PPMd");
1655 				return (ARCHIVE_FAILED);
1656 			}
1657 			if (zip->ppstream.overconsumed) {
1658 				zip->ppmd7_stat = -1;
1659 				return (ARCHIVE_FAILED);
1660 			}
1661 			*zip->ppstream.next_out++ = (unsigned char)sym;
1662 			zip->ppstream.avail_out--;
1663 			zip->ppstream.total_out++;
1664 			if (flush_bytes)
1665 				flush_bytes--;
1666 		} while (zip->ppstream.avail_out &&
1667 			(zip->ppstream.avail_in || flush_bytes));
1668 
1669 		t_avail_in = (size_t)zip->ppstream.avail_in;
1670 		t_avail_out = (size_t)zip->ppstream.avail_out;
1671 		break;
1672 	}
1673 	default:
1674 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1675 		    "Decompression internal error");
1676 		return (ARCHIVE_FAILED);
1677 	}
1678 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1679 		return (ret);
1680 
1681 	*used = o_avail_in - t_avail_in;
1682 	*outbytes = o_avail_out - t_avail_out;
1683 
1684 	/*
1685 	 * Decord BCJ.
1686 	 */
1687 	if (zip->codec != _7Z_LZMA2) {
1688 		if (zip->codec2 == _7Z_X86) {
1689 			size_t l = x86_Convert(zip, buff, *outbytes);
1690 
1691 			zip->odd_bcj_size = *outbytes - l;
1692 			if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1693 		    	o_avail_in && ret != ARCHIVE_EOF) {
1694 				memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1695 			    	zip->odd_bcj_size);
1696 				*outbytes = l;
1697 			} else
1698 				zip->odd_bcj_size = 0;
1699 		} else if (zip->codec2 == _7Z_ARM) {
1700 			*outbytes = arm_Convert(zip, buff, *outbytes);
1701 		} else if (zip->codec2 == _7Z_ARM64) {
1702 			*outbytes = arm64_Convert(zip, buff, *outbytes);
1703 		}
1704 	}
1705 
1706 	/*
1707 	 * Decord BCJ2 with a decompressed main stream.
1708 	 */
1709 	if (zip->codec2 == _7Z_X86_BCJ2) {
1710 		ssize_t bytes;
1711 
1712 		zip->tmp_stream_bytes_avail =
1713 		    zip->tmp_stream_buff_size - t_avail_out;
1714 		if (zip->tmp_stream_bytes_avail >
1715 		      zip->main_stream_bytes_remaining)
1716 			zip->tmp_stream_bytes_avail =
1717 			    zip->main_stream_bytes_remaining;
1718 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1719 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1720 		if (bytes < 0) {
1721 			archive_set_error(&(a->archive),
1722 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1723 			return (ARCHIVE_FAILED);
1724 		}
1725 		zip->main_stream_bytes_remaining -=
1726 		    zip->tmp_stream_bytes_avail
1727 		      - zip->tmp_stream_bytes_remaining;
1728 		bcj2_avail_out -= bytes;
1729 		*outbytes = o_avail_out - bcj2_avail_out;
1730 	}
1731 
1732 	return (ret);
1733 }
1734 
1735 static int
1736 free_decompression(struct archive_read *a, struct _7zip *zip)
1737 {
1738 	int r = ARCHIVE_OK;
1739 
1740 #if !defined(HAVE_ZLIB_H) &&\
1741 	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1742 	(void)a;/* UNUSED */
1743 #endif
1744 #ifdef HAVE_LZMA_H
1745 	if (zip->lzstream_valid)
1746 		lzma_end(&(zip->lzstream));
1747 #endif
1748 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1749 	if (zip->bzstream_valid) {
1750 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1751 			archive_set_error(&a->archive,
1752 			    ARCHIVE_ERRNO_MISC,
1753 			    "Failed to clean up bzip2 decompressor");
1754 			r = ARCHIVE_FATAL;
1755 		}
1756 		zip->bzstream_valid = 0;
1757 	}
1758 #endif
1759 #ifdef HAVE_ZLIB_H
1760 	if (zip->stream_valid) {
1761 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1762 			archive_set_error(&a->archive,
1763 			    ARCHIVE_ERRNO_MISC,
1764 			    "Failed to clean up zlib decompressor");
1765 			r = ARCHIVE_FATAL;
1766 		}
1767 		zip->stream_valid = 0;
1768 	}
1769 #endif
1770 	if (zip->ppmd7_valid) {
1771 		__archive_ppmd7_functions.Ppmd7_Free(
1772 			&zip->ppmd7_context);
1773 		zip->ppmd7_valid = 0;
1774 	}
1775 	return (r);
1776 }
1777 
1778 static int
1779 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1780 {
1781 	const unsigned char *p;
1782 	unsigned char avail, mask;
1783 	int i;
1784 
1785 	if ((p = header_bytes(a, 1)) == NULL)
1786 		return (-1);
1787 	avail = *p;
1788 	mask = 0x80;
1789 	*val = 0;
1790 	for (i = 0; i < 8; i++) {
1791 		if (avail & mask) {
1792 			if ((p = header_bytes(a, 1)) == NULL)
1793 				return (-1);
1794 			*val |= ((uint64_t)*p) << (8 * i);
1795 			mask >>= 1;
1796 			continue;
1797 		}
1798 		*val += ((uint64_t)(avail & (mask -1))) << (8 * i);
1799 		break;
1800 	}
1801 	return (0);
1802 }
1803 
1804 static int
1805 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1806 {
1807 	const unsigned char *p;
1808 	unsigned i, mask = 0, avail = 0;
1809 
1810 	for (i = 0; i < num; i++) {
1811 		if (mask == 0) {
1812 			if ((p = header_bytes(a, 1)) == NULL)
1813 				return (-1);
1814 			avail = *p;
1815 			mask = 0x80;
1816 		}
1817 		data[i] = (avail & mask)?1:0;
1818 		mask >>= 1;
1819 	}
1820 	return (0);
1821 }
1822 
1823 static void
1824 free_Digest(struct _7z_digests *d)
1825 {
1826 	free(d->defineds);
1827 	free(d->digests);
1828 }
1829 
1830 static int
1831 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1832 {
1833 	const unsigned char *p;
1834 	unsigned i;
1835 
1836 	if (num == 0)
1837 		return (-1);
1838 	memset(d, 0, sizeof(*d));
1839 
1840 	d->defineds = malloc(num);
1841 	if (d->defineds == NULL)
1842 		return (-1);
1843 	/*
1844 	 * Read Bools.
1845 	 */
1846 	if ((p = header_bytes(a, 1)) == NULL)
1847 		return (-1);
1848 	if (*p == 0) {
1849 		if (read_Bools(a, d->defineds, num) < 0)
1850 			return (-1);
1851 	} else
1852 		/* All are defined */
1853 		memset(d->defineds, 1, num);
1854 
1855 	d->digests = calloc(num, sizeof(*d->digests));
1856 	if (d->digests == NULL)
1857 		return (-1);
1858 	for (i = 0; i < num; i++) {
1859 		if (d->defineds[i]) {
1860 			if ((p = header_bytes(a, 4)) == NULL)
1861 				return (-1);
1862 			d->digests[i] = archive_le32dec(p);
1863 		}
1864 	}
1865 
1866 	return (0);
1867 }
1868 
1869 static void
1870 free_PackInfo(struct _7z_pack_info *pi)
1871 {
1872 	free(pi->sizes);
1873 	free(pi->positions);
1874 	free_Digest(&(pi->digest));
1875 }
1876 
1877 static int
1878 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1879 {
1880 	const unsigned char *p;
1881 	unsigned i;
1882 
1883 	memset(pi, 0, sizeof(*pi));
1884 
1885 	/*
1886 	 * Read PackPos.
1887 	 */
1888 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1889 		return (-1);
1890 
1891 	/*
1892 	 * Read NumPackStreams.
1893 	 */
1894 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1895 		return (-1);
1896 	if (pi->numPackStreams == 0)
1897 		return (-1);
1898 	if (UMAX_ENTRY < pi->numPackStreams)
1899 		return (-1);
1900 
1901 	/*
1902 	 * Read PackSizes[num]
1903 	 */
1904 	if ((p = header_bytes(a, 1)) == NULL)
1905 		return (-1);
1906 	if (*p == kEnd)
1907 		/* PackSizes[num] are not present. */
1908 		return (0);
1909 	if (*p != kSize)
1910 		return (-1);
1911 	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1912 	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1913 	if (pi->sizes == NULL || pi->positions == NULL)
1914 		return (-1);
1915 
1916 	for (i = 0; i < pi->numPackStreams; i++) {
1917 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1918 			return (-1);
1919 	}
1920 
1921 	/*
1922 	 * Read PackStreamDigests[num]
1923 	 */
1924 	if ((p = header_bytes(a, 1)) == NULL)
1925 		return (-1);
1926 	if (*p == kEnd) {
1927 		/* PackStreamDigests[num] are not present. */
1928 		pi->digest.defineds =
1929 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1930 		pi->digest.digests =
1931 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1932 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1933 			return (-1);
1934 		return (0);
1935 	}
1936 
1937 	if (*p != kCRC)
1938 		return (-1);
1939 
1940 	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1941 		return (-1);
1942 
1943 	/*
1944 	 *  Must be marked by kEnd.
1945 	 */
1946 	if ((p = header_bytes(a, 1)) == NULL)
1947 		return (-1);
1948 	if (*p != kEnd)
1949 		return (-1);
1950 	return (0);
1951 }
1952 
1953 static void
1954 free_Folder(struct _7z_folder *f)
1955 {
1956 	unsigned i;
1957 
1958 	if (f->coders) {
1959 		for (i = 0; i< f->numCoders; i++) {
1960 			free(f->coders[i].properties);
1961 		}
1962 		free(f->coders);
1963 	}
1964 	free(f->bindPairs);
1965 	free(f->packedStreams);
1966 	free(f->unPackSize);
1967 }
1968 
1969 static int
1970 read_Folder(struct archive_read *a, struct _7z_folder *f)
1971 {
1972 	struct _7zip *zip = (struct _7zip *)a->format->data;
1973 	const unsigned char *p;
1974 	uint64_t numInStreamsTotal = 0;
1975 	uint64_t numOutStreamsTotal = 0;
1976 	unsigned i;
1977 
1978 	memset(f, 0, sizeof(*f));
1979 
1980 	/*
1981 	 * Read NumCoders.
1982 	 */
1983 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1984 		return (-1);
1985 	if (f->numCoders > 4)
1986 		/* Too many coders. */
1987 		return (-1);
1988 
1989 	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1990 	if (f->coders == NULL)
1991 		return (-1);
1992 	for (i = 0; i< f->numCoders; i++) {
1993 		size_t codec_size;
1994 		int simple, attr;
1995 
1996 		if ((p = header_bytes(a, 1)) == NULL)
1997 			return (-1);
1998 		/*
1999 		 * 0:3 CodecIdSize
2000 		 * 4:  0 - IsSimple
2001 		 *     1 - Is not Simple
2002 		 * 5:  0 - No Attributes
2003 		 *     1 - There are Attributes;
2004 		 * 7:  Must be zero.
2005 		 */
2006 		codec_size = *p & 0xf;
2007 		simple = (*p & 0x10)?0:1;
2008 		attr = *p & 0x20;
2009 		if (*p & 0x80)
2010 			return (-1);/* Not supported. */
2011 
2012 		/*
2013 		 * Read Decompression Method IDs.
2014 		 */
2015 		if ((p = header_bytes(a, codec_size)) == NULL)
2016 			return (-1);
2017 
2018 		f->coders[i].codec = decode_codec_id(p, codec_size);
2019 
2020 		if (simple) {
2021 			f->coders[i].numInStreams = 1;
2022 			f->coders[i].numOutStreams = 1;
2023 		} else {
2024 			if (parse_7zip_uint64(
2025 			    a, &(f->coders[i].numInStreams)) < 0)
2026 				return (-1);
2027 			if (UMAX_ENTRY < f->coders[i].numInStreams)
2028 				return (-1);
2029 			if (parse_7zip_uint64(
2030 			    a, &(f->coders[i].numOutStreams)) < 0)
2031 				return (-1);
2032 			if (UMAX_ENTRY < f->coders[i].numOutStreams)
2033 				return (-1);
2034 		}
2035 
2036 		if (attr) {
2037 			if (parse_7zip_uint64(
2038 			    a, &(f->coders[i].propertiesSize)) < 0)
2039 				return (-1);
2040 			if ((p = header_bytes(
2041 			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
2042 				return (-1);
2043 			f->coders[i].properties =
2044 			    malloc((size_t)f->coders[i].propertiesSize);
2045 			if (f->coders[i].properties == NULL)
2046 				return (-1);
2047 			memcpy(f->coders[i].properties, p,
2048 			    (size_t)f->coders[i].propertiesSize);
2049 		}
2050 
2051 		numInStreamsTotal += f->coders[i].numInStreams;
2052 		numOutStreamsTotal += f->coders[i].numOutStreams;
2053 	}
2054 
2055 	if (numOutStreamsTotal == 0 ||
2056 	    numInStreamsTotal < numOutStreamsTotal-1)
2057 		return (-1);
2058 
2059 	f->numBindPairs = numOutStreamsTotal - 1;
2060 	if (zip->header_bytes_remaining < f->numBindPairs)
2061 			return (-1);
2062 	if (f->numBindPairs > 0) {
2063 		f->bindPairs =
2064 			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
2065 		if (f->bindPairs == NULL)
2066 			return (-1);
2067 	} else
2068 		f->bindPairs = NULL;
2069 	for (i = 0; i < f->numBindPairs; i++) {
2070 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
2071 			return (-1);
2072 		if (UMAX_ENTRY < f->bindPairs[i].inIndex)
2073 			return (-1);
2074 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
2075 			return (-1);
2076 		if (UMAX_ENTRY < f->bindPairs[i].outIndex)
2077 			return (-1);
2078 	}
2079 
2080 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
2081 	f->packedStreams =
2082 	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
2083 	if (f->packedStreams == NULL)
2084 		return (-1);
2085 	if (f->numPackedStreams == 1) {
2086 		for (i = 0; i < numInStreamsTotal; i++) {
2087 			unsigned j;
2088 			for (j = 0; j < f->numBindPairs; j++) {
2089 				if (f->bindPairs[j].inIndex == i)
2090 					break;
2091 			}
2092 			if (j == f->numBindPairs)
2093 				break;
2094 		}
2095 		if (i == numInStreamsTotal)
2096 			return (-1);
2097 		f->packedStreams[0] = i;
2098 	} else {
2099 		for (i = 0; i < f->numPackedStreams; i++) {
2100 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
2101 				return (-1);
2102 			if (UMAX_ENTRY < f->packedStreams[i])
2103 				return (-1);
2104 		}
2105 	}
2106 	f->numInStreams = numInStreamsTotal;
2107 	f->numOutStreams = numOutStreamsTotal;
2108 
2109 	return (0);
2110 }
2111 
2112 static void
2113 free_CodersInfo(struct _7z_coders_info *ci)
2114 {
2115 	unsigned i;
2116 
2117 	if (ci->folders) {
2118 		for (i = 0; i < ci->numFolders; i++)
2119 			free_Folder(&(ci->folders[i]));
2120 		free(ci->folders);
2121 	}
2122 }
2123 
2124 static int
2125 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
2126 {
2127 	const unsigned char *p;
2128 	struct _7z_digests digest;
2129 	unsigned i;
2130 
2131 	memset(ci, 0, sizeof(*ci));
2132 	memset(&digest, 0, sizeof(digest));
2133 
2134 	if ((p = header_bytes(a, 1)) == NULL)
2135 		goto failed;
2136 	if (*p != kFolder)
2137 		goto failed;
2138 
2139 	/*
2140 	 * Read NumFolders.
2141 	 */
2142 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
2143 		goto failed;
2144 	if (UMAX_ENTRY < ci->numFolders)
2145 		return (-1);
2146 
2147 	/*
2148 	 * Read External.
2149 	 */
2150 	if ((p = header_bytes(a, 1)) == NULL)
2151 		goto failed;
2152 	switch (*p) {
2153 	case 0:
2154 		ci->folders =
2155 			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
2156 		if (ci->folders == NULL)
2157 			return (-1);
2158 		for (i = 0; i < ci->numFolders; i++) {
2159 			if (read_Folder(a, &(ci->folders[i])) < 0)
2160 				goto failed;
2161 		}
2162 		break;
2163 	case 1:
2164 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
2165 			return (-1);
2166 		if (UMAX_ENTRY < ci->dataStreamIndex)
2167 			return (-1);
2168 		if (ci->numFolders > 0) {
2169 			archive_set_error(&a->archive, -1,
2170 			    "Malformed 7-Zip archive");
2171 			goto failed;
2172 		}
2173 		break;
2174 	default:
2175 		archive_set_error(&a->archive, -1,
2176 		    "Malformed 7-Zip archive");
2177 		goto failed;
2178 	}
2179 
2180 	if ((p = header_bytes(a, 1)) == NULL)
2181 		goto failed;
2182 	if (*p != kCodersUnPackSize)
2183 		goto failed;
2184 
2185 	for (i = 0; i < ci->numFolders; i++) {
2186 		struct _7z_folder *folder = &(ci->folders[i]);
2187 		unsigned j;
2188 
2189 		folder->unPackSize =
2190 		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
2191 		if (folder->unPackSize == NULL)
2192 			goto failed;
2193 		for (j = 0; j < folder->numOutStreams; j++) {
2194 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
2195 				goto failed;
2196 		}
2197 	}
2198 
2199 	/*
2200 	 * Read CRCs.
2201 	 */
2202 	if ((p = header_bytes(a, 1)) == NULL)
2203 		goto failed;
2204 	if (*p == kEnd)
2205 		return (0);
2206 	if (*p != kCRC)
2207 		goto failed;
2208 	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
2209 		goto failed;
2210 	for (i = 0; i < ci->numFolders; i++) {
2211 		ci->folders[i].digest_defined = digest.defineds[i];
2212 		ci->folders[i].digest = digest.digests[i];
2213 	}
2214 
2215 	/*
2216 	 *  Must be kEnd.
2217 	 */
2218 	if ((p = header_bytes(a, 1)) == NULL)
2219 		goto failed;
2220 	if (*p != kEnd)
2221 		goto failed;
2222 	free_Digest(&digest);
2223 	return (0);
2224 failed:
2225 	free_Digest(&digest);
2226 	return (-1);
2227 }
2228 
2229 static uint64_t
2230 folder_uncompressed_size(struct _7z_folder *f)
2231 {
2232 	int n = (int)f->numOutStreams;
2233 	unsigned pairs = (unsigned)f->numBindPairs;
2234 
2235 	while (--n >= 0) {
2236 		unsigned i;
2237 		for (i = 0; i < pairs; i++) {
2238 			if (f->bindPairs[i].outIndex == (uint64_t)n)
2239 				break;
2240 		}
2241 		if (i >= pairs)
2242 			return (f->unPackSize[n]);
2243 	}
2244 	return (0);
2245 }
2246 
2247 static void
2248 free_SubStreamsInfo(struct _7z_substream_info *ss)
2249 {
2250 	free(ss->unpackSizes);
2251 	free(ss->digestsDefined);
2252 	free(ss->digests);
2253 }
2254 
2255 static int
2256 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2257     struct _7z_folder *f, size_t numFolders)
2258 {
2259 	const unsigned char *p;
2260 	uint64_t *usizes;
2261 	size_t unpack_streams;
2262 	int type;
2263 	unsigned i;
2264 	uint32_t numDigests;
2265 
2266 	memset(ss, 0, sizeof(*ss));
2267 
2268 	for (i = 0; i < numFolders; i++)
2269 		f[i].numUnpackStreams = 1;
2270 
2271 	if ((p = header_bytes(a, 1)) == NULL)
2272 		return (-1);
2273 	type = *p;
2274 
2275 	if (type == kNumUnPackStream) {
2276 		unpack_streams = 0;
2277 		for (i = 0; i < numFolders; i++) {
2278 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2279 				return (-1);
2280 			if (UMAX_ENTRY < f[i].numUnpackStreams)
2281 				return (-1);
2282 			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
2283 				return (-1);
2284 			}
2285 			unpack_streams += (size_t)f[i].numUnpackStreams;
2286 		}
2287 		if ((p = header_bytes(a, 1)) == NULL)
2288 			return (-1);
2289 		type = *p;
2290 	} else
2291 		unpack_streams = numFolders;
2292 
2293 	ss->unpack_streams = unpack_streams;
2294 	if (unpack_streams) {
2295 		ss->unpackSizes = calloc(unpack_streams,
2296 		    sizeof(*ss->unpackSizes));
2297 		ss->digestsDefined = calloc(unpack_streams,
2298 		    sizeof(*ss->digestsDefined));
2299 		ss->digests = calloc(unpack_streams,
2300 		    sizeof(*ss->digests));
2301 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2302 		    ss->digests == NULL)
2303 			return (-1);
2304 	}
2305 
2306 	usizes = ss->unpackSizes;
2307 	for (i = 0; i < numFolders; i++) {
2308 		unsigned pack;
2309 		uint64_t sum;
2310 
2311 		if (f[i].numUnpackStreams == 0)
2312 			continue;
2313 
2314 		sum = 0;
2315 		if (type == kSize) {
2316 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2317 				if (parse_7zip_uint64(a, usizes) < 0)
2318 					return (-1);
2319 				sum += *usizes++;
2320 			}
2321 		}
2322 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2323 	}
2324 
2325 	if (type == kSize) {
2326 		if ((p = header_bytes(a, 1)) == NULL)
2327 			return (-1);
2328 		type = *p;
2329 	}
2330 
2331 	for (i = 0; i < unpack_streams; i++) {
2332 		ss->digestsDefined[i] = 0;
2333 		ss->digests[i] = 0;
2334 	}
2335 
2336 	numDigests = 0;
2337 	for (i = 0; i < numFolders; i++) {
2338 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2339 			numDigests += (uint32_t)f[i].numUnpackStreams;
2340 	}
2341 
2342 	if (type == kCRC) {
2343 		struct _7z_digests tmpDigests;
2344 		unsigned char *digestsDefined = ss->digestsDefined;
2345 		uint32_t * digests = ss->digests;
2346 		int di = 0;
2347 
2348 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2349 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2350 			free_Digest(&tmpDigests);
2351 			return (-1);
2352 		}
2353 		for (i = 0; i < numFolders; i++) {
2354 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2355 				*digestsDefined++ = 1;
2356 				*digests++ = f[i].digest;
2357 			} else {
2358 				unsigned j;
2359 
2360 				for (j = 0; j < f[i].numUnpackStreams;
2361 				    j++, di++) {
2362 					*digestsDefined++ =
2363 					    tmpDigests.defineds[di];
2364 					*digests++ =
2365 					    tmpDigests.digests[di];
2366 				}
2367 			}
2368 		}
2369 		free_Digest(&tmpDigests);
2370 		if ((p = header_bytes(a, 1)) == NULL)
2371 			return (-1);
2372 		type = *p;
2373 	}
2374 
2375 	/*
2376 	 *  Must be kEnd.
2377 	 */
2378 	if (type != kEnd)
2379 		return (-1);
2380 	return (0);
2381 }
2382 
2383 static void
2384 free_StreamsInfo(struct _7z_stream_info *si)
2385 {
2386 	free_PackInfo(&(si->pi));
2387 	free_CodersInfo(&(si->ci));
2388 	free_SubStreamsInfo(&(si->ss));
2389 }
2390 
2391 static int
2392 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2393 {
2394 	struct _7zip *zip = (struct _7zip *)a->format->data;
2395 	const unsigned char *p;
2396 	unsigned i;
2397 
2398 	memset(si, 0, sizeof(*si));
2399 
2400 	if ((p = header_bytes(a, 1)) == NULL)
2401 		return (-1);
2402 	if (*p == kPackInfo) {
2403 		uint64_t packPos;
2404 
2405 		if (read_PackInfo(a, &(si->pi)) < 0)
2406 			return (-1);
2407 
2408 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2409 			return (-1);
2410 		/*
2411 		 * Calculate packed stream positions.
2412 		 */
2413 		packPos = si->pi.pos;
2414 		for (i = 0; i < si->pi.numPackStreams; i++) {
2415 			si->pi.positions[i] = packPos;
2416 			packPos += si->pi.sizes[i];
2417 			if (packPos > zip->header_offset)
2418 				return (-1);
2419 		}
2420 		if ((p = header_bytes(a, 1)) == NULL)
2421 			return (-1);
2422 	}
2423 	if (*p == kUnPackInfo) {
2424 		uint32_t packIndex;
2425 		struct _7z_folder *f;
2426 
2427 		if (read_CodersInfo(a, &(si->ci)) < 0)
2428 			return (-1);
2429 
2430 		/*
2431 		 * Calculate packed stream indexes.
2432 		 */
2433 		packIndex = 0;
2434 		f = si->ci.folders;
2435 		for (i = 0; i < si->ci.numFolders; i++) {
2436 			f[i].packIndex = packIndex;
2437 			packIndex += (uint32_t)f[i].numPackedStreams;
2438 			if (packIndex > si->pi.numPackStreams)
2439 				return (-1);
2440 		}
2441 		if ((p = header_bytes(a, 1)) == NULL)
2442 			return (-1);
2443 	}
2444 
2445 	if (*p == kSubStreamsInfo) {
2446 		if (read_SubStreamsInfo(a, &(si->ss),
2447 		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2448 			return (-1);
2449 		if ((p = header_bytes(a, 1)) == NULL)
2450 			return (-1);
2451 	}
2452 
2453 	/*
2454 	 *  Must be kEnd.
2455 	 */
2456 	if (*p != kEnd)
2457 		return (-1);
2458 	return (0);
2459 }
2460 
2461 static void
2462 free_Header(struct _7z_header_info *h)
2463 {
2464 	free(h->emptyStreamBools);
2465 	free(h->emptyFileBools);
2466 	free(h->antiBools);
2467 	free(h->attrBools);
2468 }
2469 
2470 static int
2471 read_Header(struct archive_read *a, struct _7z_header_info *h,
2472     int check_header_id)
2473 {
2474 	struct _7zip *zip = (struct _7zip *)a->format->data;
2475 	const unsigned char *p;
2476 	struct _7z_folder *folders;
2477 	struct _7z_stream_info *si = &(zip->si);
2478 	struct _7zip_entry *entries;
2479 	uint32_t folderIndex, indexInFolder;
2480 	unsigned i;
2481 	int eindex, empty_streams, sindex;
2482 
2483 	if (check_header_id) {
2484 		/*
2485 		 * Read Header.
2486 		 */
2487 		if ((p = header_bytes(a, 1)) == NULL)
2488 			return (-1);
2489 		if (*p != kHeader)
2490 			return (-1);
2491 	}
2492 
2493 	/*
2494 	 * Read ArchiveProperties.
2495 	 */
2496 	if ((p = header_bytes(a, 1)) == NULL)
2497 		return (-1);
2498 	if (*p == kArchiveProperties) {
2499 		for (;;) {
2500 			uint64_t size;
2501 			if ((p = header_bytes(a, 1)) == NULL)
2502 				return (-1);
2503 			if (*p == 0)
2504 				break;
2505 			if (parse_7zip_uint64(a, &size) < 0)
2506 				return (-1);
2507 		}
2508 		if ((p = header_bytes(a, 1)) == NULL)
2509 			return (-1);
2510 	}
2511 
2512 	/*
2513 	 * Read MainStreamsInfo.
2514 	 */
2515 	if (*p == kMainStreamsInfo) {
2516 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2517 			return (-1);
2518 		if ((p = header_bytes(a, 1)) == NULL)
2519 			return (-1);
2520 	}
2521 	if (*p == kEnd)
2522 		return (0);
2523 
2524 	/*
2525 	 * Read FilesInfo.
2526 	 */
2527 	if (*p != kFilesInfo)
2528 		return (-1);
2529 
2530 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2531 		return (-1);
2532 	if (UMAX_ENTRY < zip->numFiles)
2533 		return (-1);
2534 
2535 	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2536 	if (zip->entries == NULL)
2537 		return (-1);
2538 	entries = zip->entries;
2539 
2540 	empty_streams = 0;
2541 	for (;;) {
2542 		int type;
2543 		uint64_t size;
2544 		size_t ll;
2545 
2546 		if ((p = header_bytes(a, 1)) == NULL)
2547 			return (-1);
2548 		type = *p;
2549 		if (type == kEnd)
2550 			break;
2551 
2552 		if (parse_7zip_uint64(a, &size) < 0)
2553 			return (-1);
2554 		if (zip->header_bytes_remaining < size)
2555 			return (-1);
2556 		ll = (size_t)size;
2557 
2558 		switch (type) {
2559 		case kEmptyStream:
2560 			if (h->emptyStreamBools != NULL)
2561 				return (-1);
2562 			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2563 			    sizeof(*h->emptyStreamBools));
2564 			if (h->emptyStreamBools == NULL)
2565 				return (-1);
2566 			if (read_Bools(
2567 			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2568 				return (-1);
2569 			empty_streams = 0;
2570 			for (i = 0; i < zip->numFiles; i++) {
2571 				if (h->emptyStreamBools[i])
2572 					empty_streams++;
2573 			}
2574 			break;
2575 		case kEmptyFile:
2576 			if (empty_streams <= 0) {
2577 				/* Unexcepted sequence. Skip this. */
2578 				if (header_bytes(a, ll) == NULL)
2579 					return (-1);
2580 				break;
2581 			}
2582 			if (h->emptyFileBools != NULL)
2583 				return (-1);
2584 			h->emptyFileBools = calloc(empty_streams,
2585 			    sizeof(*h->emptyFileBools));
2586 			if (h->emptyFileBools == NULL)
2587 				return (-1);
2588 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2589 				return (-1);
2590 			break;
2591 		case kAnti:
2592 			if (empty_streams <= 0) {
2593 				/* Unexcepted sequence. Skip this. */
2594 				if (header_bytes(a, ll) == NULL)
2595 					return (-1);
2596 				break;
2597 			}
2598 			if (h->antiBools != NULL)
2599 				return (-1);
2600 			h->antiBools = calloc(empty_streams,
2601 			    sizeof(*h->antiBools));
2602 			if (h->antiBools == NULL)
2603 				return (-1);
2604 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2605 				return (-1);
2606 			break;
2607 		case kCTime:
2608 		case kATime:
2609 		case kMTime:
2610 			if (read_Times(a, h, type) < 0)
2611 				return (-1);
2612 			break;
2613 		case kName:
2614 		{
2615 			unsigned char *np;
2616 			size_t nl, nb;
2617 
2618 			/* Skip one byte. */
2619 			if ((p = header_bytes(a, 1)) == NULL)
2620 				return (-1);
2621 			ll--;
2622 
2623 			if ((ll & 1) || ll < zip->numFiles * 4)
2624 				return (-1);
2625 
2626 			if (zip->entry_names != NULL)
2627 				return (-1);
2628 			zip->entry_names = malloc(ll);
2629 			if (zip->entry_names == NULL)
2630 				return (-1);
2631 			np = zip->entry_names;
2632 			nb = ll;
2633 			/*
2634 			 * Copy whole file names.
2635 			 * NOTE: This loop prevents from expanding
2636 			 * the uncompressed buffer in order not to
2637 			 * use extra memory resource.
2638 			 */
2639 			while (nb) {
2640 				size_t b;
2641 				if (nb > UBUFF_SIZE)
2642 					b = UBUFF_SIZE;
2643 				else
2644 					b = nb;
2645 				if ((p = header_bytes(a, b)) == NULL)
2646 					return (-1);
2647 				memcpy(np, p, b);
2648 				np += b;
2649 				nb -= b;
2650 			}
2651 			np = zip->entry_names;
2652 			nl = ll;
2653 
2654 			for (i = 0; i < zip->numFiles; i++) {
2655 				entries[i].utf16name = np;
2656 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2657 				entries[i].wname = (wchar_t *)np;
2658 #endif
2659 
2660 				/* Find a terminator. */
2661 				while (nl >= 2 && (np[0] || np[1])) {
2662 					np += 2;
2663 					nl -= 2;
2664 				}
2665 				if (nl < 2)
2666 					return (-1);/* Terminator not found */
2667 				entries[i].name_len = np - entries[i].utf16name;
2668 				np += 2;
2669 				nl -= 2;
2670 			}
2671 			break;
2672 		}
2673 		case kAttributes:
2674 		{
2675 			int allAreDefined;
2676 
2677 			if ((p = header_bytes(a, 2)) == NULL)
2678 				return (-1);
2679 			allAreDefined = *p;
2680 			if (h->attrBools != NULL)
2681 				return (-1);
2682 			h->attrBools = calloc((size_t)zip->numFiles,
2683 			    sizeof(*h->attrBools));
2684 			if (h->attrBools == NULL)
2685 				return (-1);
2686 			if (allAreDefined)
2687 				memset(h->attrBools, 1, (size_t)zip->numFiles);
2688 			else {
2689 				if (read_Bools(a, h->attrBools,
2690 				      (size_t)zip->numFiles) < 0)
2691 					return (-1);
2692 			}
2693 			for (i = 0; i < zip->numFiles; i++) {
2694 				if (h->attrBools[i]) {
2695 					if ((p = header_bytes(a, 4)) == NULL)
2696 						return (-1);
2697 					entries[i].attr = archive_le32dec(p);
2698 				}
2699 			}
2700 			break;
2701 		}
2702 		case kDummy:
2703 			if (ll == 0)
2704 				break;
2705 			__LA_FALLTHROUGH;
2706 		default:
2707 			if (header_bytes(a, ll) == NULL)
2708 				return (-1);
2709 			break;
2710 		}
2711 	}
2712 
2713 	/*
2714 	 * Set up entry's attributes.
2715 	 */
2716 	folders = si->ci.folders;
2717 	eindex = sindex = 0;
2718 	folderIndex = indexInFolder = 0;
2719 	for (i = 0; i < zip->numFiles; i++) {
2720 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2721 			entries[i].flg |= HAS_STREAM;
2722 		/* The high 16 bits of attributes is a posix file mode. */
2723 		entries[i].mode = entries[i].attr >> 16;
2724 
2725 		if (!(entries[i].attr & FILE_ATTRIBUTE_UNIX_EXTENSION)) {
2726 			// Only windows permissions specified for this entry. Translate to
2727 			// reasonable corresponding unix permissions.
2728 
2729 			if (entries[i].attr & FILE_ATTRIBUTE_DIRECTORY) {
2730 				if (entries[i].attr & FILE_ATTRIBUTE_READONLY) {
2731 					// Read-only directory.
2732 					entries[i].mode = AE_IFDIR | 0555;
2733 				} else {
2734 					// Read-write directory.
2735 					entries[i].mode = AE_IFDIR | 0755;
2736 				}
2737 			} else if (entries[i].attr & FILE_ATTRIBUTE_READONLY) {
2738 				// Readonly file.
2739 				entries[i].mode = AE_IFREG | 0444;
2740 			} else {
2741 				// Assume read-write file.
2742 				entries[i].mode = AE_IFREG | 0644;
2743 			}
2744 		}
2745 
2746 		if (entries[i].flg & HAS_STREAM) {
2747 			if ((size_t)sindex >= si->ss.unpack_streams)
2748 				return (-1);
2749 			if (entries[i].mode == 0)
2750 				entries[i].mode = AE_IFREG | 0666;
2751 			if (si->ss.digestsDefined[sindex])
2752 				entries[i].flg |= CRC32_IS_SET;
2753 			entries[i].ssIndex = sindex;
2754 			sindex++;
2755 		} else {
2756 			int dir;
2757 			if (h->emptyFileBools == NULL)
2758 				dir = 1;
2759 			else {
2760 				if (h->emptyFileBools[eindex])
2761 					dir = 0;
2762 				else
2763 					dir = 1;
2764 				eindex++;
2765 			}
2766 			if (entries[i].mode == 0) {
2767 				if (dir)
2768 					entries[i].mode = AE_IFDIR | 0777;
2769 				else
2770 					entries[i].mode = AE_IFREG | 0666;
2771 			} else if (dir &&
2772 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2773 				entries[i].mode &= ~AE_IFMT;
2774 				entries[i].mode |= AE_IFDIR;
2775 			}
2776 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2777 			    entries[i].name_len >= 2 &&
2778 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2779 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2780 				entries[i].utf16name[entries[i].name_len] = '/';
2781 				entries[i].utf16name[entries[i].name_len+1] = 0;
2782 				entries[i].name_len += 2;
2783 			}
2784 			entries[i].ssIndex = -1;
2785 		}
2786 		if (entries[i].attr & FILE_ATTRIBUTE_READONLY)
2787 			entries[i].mode &= ~0222;/* Read only. */
2788 
2789 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2790 			/*
2791 			 * The entry is an empty file or a directory file,
2792 			 * those both have no contents.
2793 			 */
2794 			entries[i].folderIndex = -1;
2795 			continue;
2796 		}
2797 		if (indexInFolder == 0) {
2798 			for (;;) {
2799 				if (folderIndex >= si->ci.numFolders)
2800 					return (-1);
2801 				if (folders[folderIndex].numUnpackStreams)
2802 					break;
2803 				folderIndex++;
2804 			}
2805 		}
2806 		entries[i].folderIndex = folderIndex;
2807 		if ((entries[i].flg & HAS_STREAM) == 0)
2808 			continue;
2809 		indexInFolder++;
2810 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2811 			folderIndex++;
2812 			indexInFolder = 0;
2813 		}
2814 	}
2815 
2816 	return (0);
2817 }
2818 
2819 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2820 static void
2821 fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2822 {
2823 
2824 	if (fileTime >= EPOC_TIME) {
2825 		fileTime -= EPOC_TIME;
2826 		/* milli seconds base */
2827 		*timep = (time_t)(fileTime / 10000000);
2828 		/* nano seconds base */
2829 		*ns = (long)(fileTime % 10000000) * 100;
2830 	} else {
2831 		*timep = 0;
2832 		*ns = 0;
2833 	}
2834 }
2835 
2836 static int
2837 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2838 {
2839 	struct _7zip *zip = (struct _7zip *)a->format->data;
2840 	const unsigned char *p;
2841 	struct _7zip_entry *entries = zip->entries;
2842 	unsigned char *timeBools;
2843 	int allAreDefined;
2844 	unsigned i;
2845 
2846 	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2847 	if (timeBools == NULL)
2848 		return (-1);
2849 
2850 	/* Read allAreDefined. */
2851 	if ((p = header_bytes(a, 1)) == NULL)
2852 		goto failed;
2853 	allAreDefined = *p;
2854 	if (allAreDefined)
2855 		memset(timeBools, 1, (size_t)zip->numFiles);
2856 	else {
2857 		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2858 			goto failed;
2859 	}
2860 
2861 	/* Read external. */
2862 	if ((p = header_bytes(a, 1)) == NULL)
2863 		goto failed;
2864 	if (*p) {
2865 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2866 			goto failed;
2867 		if (UMAX_ENTRY < h->dataIndex)
2868 			goto failed;
2869 	}
2870 
2871 	for (i = 0; i < zip->numFiles; i++) {
2872 		if (!timeBools[i])
2873 			continue;
2874 		if ((p = header_bytes(a, 8)) == NULL)
2875 			goto failed;
2876 		switch (type) {
2877 		case kCTime:
2878 			fileTimeToUtc(archive_le64dec(p),
2879 			    &(entries[i].ctime),
2880 			    &(entries[i].ctime_ns));
2881 			entries[i].flg |= CTIME_IS_SET;
2882 			break;
2883 		case kATime:
2884 			fileTimeToUtc(archive_le64dec(p),
2885 			    &(entries[i].atime),
2886 			    &(entries[i].atime_ns));
2887 			entries[i].flg |= ATIME_IS_SET;
2888 			break;
2889 		case kMTime:
2890 			fileTimeToUtc(archive_le64dec(p),
2891 			    &(entries[i].mtime),
2892 			    &(entries[i].mtime_ns));
2893 			entries[i].flg |= MTIME_IS_SET;
2894 			break;
2895 		}
2896 	}
2897 
2898 	free(timeBools);
2899 	return (0);
2900 failed:
2901 	free(timeBools);
2902 	return (-1);
2903 }
2904 
2905 static int
2906 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2907 {
2908 	struct _7zip *zip = (struct _7zip *)a->format->data;
2909 
2910 	errno = 0;
2911 	if (read_StreamsInfo(a, si) < 0) {
2912 		if (errno == ENOMEM)
2913 			archive_set_error(&a->archive, -1,
2914 			    "Couldn't allocate memory");
2915 		else
2916 			archive_set_error(&a->archive, -1,
2917 			    "Malformed 7-Zip archive");
2918 		return (ARCHIVE_FATAL);
2919 	}
2920 
2921 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2922 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2923 		return (ARCHIVE_FATAL);
2924 	}
2925 
2926 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2927 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2928 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2929 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2930 		return (ARCHIVE_FATAL);
2931 	}
2932 
2933 	return (ARCHIVE_OK);
2934 }
2935 
2936 static const unsigned char *
2937 header_bytes(struct archive_read *a, size_t rbytes)
2938 {
2939 	struct _7zip *zip = (struct _7zip *)a->format->data;
2940 	const unsigned char *p;
2941 
2942 	if (zip->header_bytes_remaining < rbytes)
2943 		return (NULL);
2944 	if (zip->pack_stream_bytes_unconsumed)
2945 		read_consume(a);
2946 
2947 	if (zip->header_is_encoded == 0) {
2948 		p = __archive_read_ahead(a, rbytes, NULL);
2949 		if (p == NULL)
2950 			return (NULL);
2951 		zip->header_bytes_remaining -= rbytes;
2952 		zip->pack_stream_bytes_unconsumed = rbytes;
2953 	} else {
2954 		const void *buff;
2955 		ssize_t bytes;
2956 
2957 		bytes = read_stream(a, &buff, rbytes, rbytes);
2958 		if (bytes <= 0)
2959 			return (NULL);
2960 		zip->header_bytes_remaining -= bytes;
2961 		p = buff;
2962 	}
2963 
2964 	/* Update checksum */
2965 	zip->header_crc32 = crc32(zip->header_crc32, p, (unsigned)rbytes);
2966 	return (p);
2967 }
2968 
2969 static int
2970 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2971     struct _7z_header_info *header)
2972 {
2973 	const unsigned char *p;
2974 	uint64_t next_header_offset;
2975 	uint64_t next_header_size;
2976 	uint32_t next_header_crc;
2977 	ssize_t bytes_avail;
2978 	int check_header_crc, r;
2979 
2980 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2981 		return (ARCHIVE_FATAL);
2982 
2983 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2984 		/* This is an executable ? Must be self-extracting... */
2985 		r = skip_sfx(a, bytes_avail);
2986 		if (r < ARCHIVE_WARN)
2987 			return (r);
2988 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2989 			return (ARCHIVE_FATAL);
2990 	}
2991 	zip->seek_base += 32;
2992 
2993 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2994 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2995 		return (ARCHIVE_FATAL);
2996 	}
2997 
2998 	/* CRC check. */
2999 	if (crc32(0, (const unsigned char *)p + 12, 20)
3000 	    != archive_le32dec(p + 8)) {
3001 #ifdef DONT_FAIL_ON_CRC_ERROR
3002 		archive_set_error(&a->archive, -1, "Header CRC error");
3003 		return (ARCHIVE_FATAL);
3004 #endif
3005 	}
3006 
3007 	next_header_offset = archive_le64dec(p + 12);
3008 	next_header_size = archive_le64dec(p + 20);
3009 	next_header_crc = archive_le32dec(p + 28);
3010 
3011 	if (next_header_size == 0)
3012 		/* There is no entry in an archive file. */
3013 		return (ARCHIVE_EOF);
3014 
3015 	if (((int64_t)next_header_offset) < 0) {
3016 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
3017 		return (ARCHIVE_FATAL);
3018 	}
3019 	__archive_read_consume(a, 32);
3020 	if (next_header_offset != 0) {
3021 		if (bytes_avail >= (ssize_t)next_header_offset)
3022 			__archive_read_consume(a, next_header_offset);
3023 		else if (__archive_read_seek(a,
3024 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
3025 			return (ARCHIVE_FATAL);
3026 	}
3027 	zip->stream_offset = next_header_offset;
3028 	zip->header_offset = next_header_offset;
3029 	zip->header_bytes_remaining = next_header_size;
3030 	zip->header_crc32 = 0;
3031 	zip->header_is_encoded = 0;
3032 	zip->header_is_being_read = 1;
3033 	zip->has_encrypted_entries = 0;
3034 	check_header_crc = 1;
3035 
3036 	if ((p = header_bytes(a, 1)) == NULL) {
3037 		archive_set_error(&a->archive,
3038 		    ARCHIVE_ERRNO_FILE_FORMAT,
3039 		    "Truncated 7-Zip file body");
3040 		return (ARCHIVE_FATAL);
3041 	}
3042 	/* Parse ArchiveProperties. */
3043 	switch (p[0]) {
3044 	case kEncodedHeader:
3045 		/*
3046 		 * The archive has an encoded header and we have to decode it
3047 		 * in order to parse the header correctly.
3048 		 */
3049 		r = decode_encoded_header_info(a, &(zip->si));
3050 
3051 		/* Check the EncodedHeader CRC.*/
3052 		if (r == 0 && zip->header_crc32 != next_header_crc) {
3053 #ifndef DONT_FAIL_ON_CRC_ERROR
3054 			archive_set_error(&a->archive, -1,
3055 			    "Damaged 7-Zip archive");
3056 			r = -1;
3057 #endif
3058 		}
3059 		if (r == 0) {
3060 			if (zip->si.ci.folders[0].digest_defined)
3061 				next_header_crc = zip->si.ci.folders[0].digest;
3062 			else
3063 				check_header_crc = 0;
3064 			if (zip->pack_stream_bytes_unconsumed)
3065 				read_consume(a);
3066 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
3067 			if (r == 0) {
3068 				zip->header_bytes_remaining =
3069 					zip->folder_outbytes_remaining;
3070 				r = seek_pack(a);
3071 			}
3072 		}
3073 		/* Clean up StreamsInfo. */
3074 		free_StreamsInfo(&(zip->si));
3075 		memset(&(zip->si), 0, sizeof(zip->si));
3076 		if (r < 0)
3077 			return (ARCHIVE_FATAL);
3078 		zip->header_is_encoded = 1;
3079 		zip->header_crc32 = 0;
3080 		/* FALL THROUGH */
3081 	case kHeader:
3082 		/*
3083 		 * Parse the header.
3084 		 */
3085 		errno = 0;
3086 		r = read_Header(a, header, zip->header_is_encoded);
3087 		if (r < 0) {
3088 			if (errno == ENOMEM)
3089 				archive_set_error(&a->archive, -1,
3090 				    "Couldn't allocate memory");
3091 			else
3092 				archive_set_error(&a->archive, -1,
3093 				    "Damaged 7-Zip archive");
3094 			return (ARCHIVE_FATAL);
3095 		}
3096 
3097 		/*
3098 		 *  Must be kEnd.
3099 		 */
3100 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
3101 			archive_set_error(&a->archive, -1,
3102 			    "Malformed 7-Zip archive");
3103 			return (ARCHIVE_FATAL);
3104 		}
3105 
3106 		/* Check the Header CRC.*/
3107 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
3108 #ifndef DONT_FAIL_ON_CRC_ERROR
3109 			archive_set_error(&a->archive, -1,
3110 			    "Malformed 7-Zip archive");
3111 			return (ARCHIVE_FATAL);
3112 #endif
3113 		}
3114 		break;
3115 	default:
3116 		archive_set_error(&a->archive, -1,
3117 		    "Unexpected Property ID = %X", p[0]);
3118 		return (ARCHIVE_FATAL);
3119 	}
3120 
3121 	/* Clean up variables be used for decoding the archive header */
3122 	zip->pack_stream_remaining = 0;
3123 	zip->pack_stream_index = 0;
3124 	zip->folder_outbytes_remaining = 0;
3125 	zip->uncompressed_buffer_bytes_remaining = 0;
3126 	zip->pack_stream_bytes_unconsumed = 0;
3127 	zip->header_is_being_read = 0;
3128 
3129 	return (ARCHIVE_OK);
3130 }
3131 
3132 static ssize_t
3133 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
3134     size_t minimum)
3135 {
3136 	struct _7zip *zip = (struct _7zip *)a->format->data;
3137 	ssize_t bytes_avail;
3138 
3139 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
3140 		/* Copy mode. */
3141 
3142 		*buff = __archive_read_ahead(a, minimum, &bytes_avail);
3143 		if (bytes_avail <= 0) {
3144 			archive_set_error(&a->archive,
3145 			    ARCHIVE_ERRNO_FILE_FORMAT,
3146 			    "Truncated 7-Zip file data");
3147 			return (ARCHIVE_FATAL);
3148 		}
3149 		if ((size_t)bytes_avail >
3150 		    zip->uncompressed_buffer_bytes_remaining)
3151 			bytes_avail = (ssize_t)
3152 			    zip->uncompressed_buffer_bytes_remaining;
3153 		if ((size_t)bytes_avail > size)
3154 			bytes_avail = (ssize_t)size;
3155 
3156 		zip->pack_stream_bytes_unconsumed = bytes_avail;
3157 	} else if (zip->uncompressed_buffer_pointer == NULL) {
3158 		/* Decompression has failed. */
3159 		archive_set_error(&(a->archive),
3160 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3161 		return (ARCHIVE_FATAL);
3162 	} else {
3163 		/* Packed mode. */
3164 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
3165 			/*
3166 			 * If remaining uncompressed data size is less than
3167 			 * the minimum size, fill the buffer up to the
3168 			 * minimum size.
3169 			 */
3170 			if (extract_pack_stream(a, minimum) < 0)
3171 				return (ARCHIVE_FATAL);
3172 		}
3173 		if (size > zip->uncompressed_buffer_bytes_remaining)
3174 			bytes_avail = (ssize_t)
3175 			    zip->uncompressed_buffer_bytes_remaining;
3176 		else
3177 			bytes_avail = (ssize_t)size;
3178 		*buff = zip->uncompressed_buffer_pointer;
3179 		zip->uncompressed_buffer_pointer += bytes_avail;
3180 	}
3181 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
3182 	return (bytes_avail);
3183 }
3184 
3185 static ssize_t
3186 extract_pack_stream(struct archive_read *a, size_t minimum)
3187 {
3188 	struct _7zip *zip = (struct _7zip *)a->format->data;
3189 	ssize_t bytes_avail;
3190 	int r;
3191 
3192 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
3193 		if (minimum == 0)
3194 			minimum = 1;
3195 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
3196 		    || bytes_avail <= 0) {
3197 			archive_set_error(&a->archive,
3198 			    ARCHIVE_ERRNO_FILE_FORMAT,
3199 			    "Truncated 7-Zip file body");
3200 			return (ARCHIVE_FATAL);
3201 		}
3202 		if ((uint64_t)bytes_avail > zip->pack_stream_inbytes_remaining)
3203 			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
3204 		zip->pack_stream_inbytes_remaining -= bytes_avail;
3205 		if ((uint64_t)bytes_avail > zip->folder_outbytes_remaining)
3206 			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
3207 		zip->folder_outbytes_remaining -= bytes_avail;
3208 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
3209 		return (ARCHIVE_OK);
3210 	}
3211 
3212 	/* If the buffer hasn't been allocated, allocate it now. */
3213 	if (zip->uncompressed_buffer == NULL) {
3214 		zip->uncompressed_buffer_size = UBUFF_SIZE;
3215 		if (zip->uncompressed_buffer_size < minimum) {
3216 			zip->uncompressed_buffer_size = minimum + 1023;
3217 			zip->uncompressed_buffer_size &= ~0x3ff;
3218 		}
3219 		zip->uncompressed_buffer =
3220 		    malloc(zip->uncompressed_buffer_size);
3221 		if (zip->uncompressed_buffer == NULL) {
3222 			archive_set_error(&a->archive, ENOMEM,
3223 			    "No memory for 7-Zip decompression");
3224 			return (ARCHIVE_FATAL);
3225 		}
3226 		zip->uncompressed_buffer_bytes_remaining = 0;
3227 	} else if (zip->uncompressed_buffer_size < minimum ||
3228 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
3229 		/*
3230 		 * Make sure the uncompressed buffer can have bytes
3231 		 * at least `minimum' bytes.
3232 		 * NOTE: This case happen when reading the header.
3233 		 */
3234 		size_t used;
3235 		if (zip->uncompressed_buffer_pointer != 0)
3236 			used = zip->uncompressed_buffer_pointer -
3237 				zip->uncompressed_buffer;
3238 		else
3239 			used = 0;
3240 		if (zip->uncompressed_buffer_size < minimum) {
3241 			/*
3242 			 * Expand the uncompressed buffer up to
3243 			 * the minimum size.
3244 			 */
3245 			void *p;
3246 			size_t new_size;
3247 
3248 			new_size = minimum + 1023;
3249 			new_size &= ~0x3ff;
3250 			p = realloc(zip->uncompressed_buffer, new_size);
3251 			if (p == NULL) {
3252 				archive_set_error(&a->archive, ENOMEM,
3253 				    "No memory for 7-Zip decompression");
3254 				return (ARCHIVE_FATAL);
3255 			}
3256 			zip->uncompressed_buffer = (unsigned char *)p;
3257 			zip->uncompressed_buffer_size = new_size;
3258 		}
3259 		/*
3260 		 * Move unconsumed bytes to the head.
3261 		 */
3262 		if (used) {
3263 			memmove(zip->uncompressed_buffer,
3264 				zip->uncompressed_buffer + used,
3265 				zip->uncompressed_buffer_bytes_remaining);
3266 		}
3267 	} else
3268 		zip->uncompressed_buffer_bytes_remaining = 0;
3269 	zip->uncompressed_buffer_pointer = NULL;
3270 	for (;;) {
3271 		size_t bytes_in, bytes_out;
3272 		const void *buff_in;
3273 		unsigned char *buff_out;
3274 		int end_of_data;
3275 
3276 		/*
3277 		 * Note: '1' here is a performance optimization.
3278 		 * Recall that the decompression layer returns a count of
3279 		 * available bytes; asking for more than that forces the
3280 		 * decompressor to combine reads by copying data.
3281 		 */
3282 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3283 		if (bytes_avail <= 0) {
3284 			archive_set_error(&a->archive,
3285 			    ARCHIVE_ERRNO_FILE_FORMAT,
3286 			    "Truncated 7-Zip file body");
3287 			return (ARCHIVE_FATAL);
3288 		}
3289 
3290 		buff_out = zip->uncompressed_buffer
3291 			+ zip->uncompressed_buffer_bytes_remaining;
3292 		bytes_out = zip->uncompressed_buffer_size
3293 			- zip->uncompressed_buffer_bytes_remaining;
3294 		bytes_in = bytes_avail;
3295 		if (bytes_in > zip->pack_stream_inbytes_remaining)
3296 			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3297 		/* Drive decompression. */
3298 		r = decompress(a, zip, buff_out, &bytes_out,
3299 			buff_in, &bytes_in);
3300 		switch (r) {
3301 		case ARCHIVE_OK:
3302 			end_of_data = 0;
3303 			break;
3304 		case ARCHIVE_EOF:
3305 			end_of_data = 1;
3306 			break;
3307 		default:
3308 			return (ARCHIVE_FATAL);
3309 		}
3310 		zip->pack_stream_inbytes_remaining -= bytes_in;
3311 		if (bytes_out > zip->folder_outbytes_remaining)
3312 			bytes_out = (size_t)zip->folder_outbytes_remaining;
3313 		zip->folder_outbytes_remaining -= bytes_out;
3314 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3315 		zip->pack_stream_bytes_unconsumed = bytes_in;
3316 
3317 		/*
3318 		 * Continue decompression until uncompressed_buffer is full.
3319 		 */
3320 		if (zip->uncompressed_buffer_bytes_remaining ==
3321 		    zip->uncompressed_buffer_size)
3322 			break;
3323 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3324 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3325 		    zip->uncompressed_buffer_size)
3326 			break;
3327 		if (zip->pack_stream_inbytes_remaining == 0 &&
3328 		    zip->folder_outbytes_remaining == 0)
3329 			break;
3330 		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3331 			archive_set_error(&(a->archive),
3332 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3333 			return (ARCHIVE_FATAL);
3334 		}
3335 		read_consume(a);
3336 	}
3337 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3338 		archive_set_error(&(a->archive),
3339 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3340 		return (ARCHIVE_FATAL);
3341 	}
3342 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3343 	return (ARCHIVE_OK);
3344 }
3345 
3346 static int
3347 seek_pack(struct archive_read *a)
3348 {
3349 	struct _7zip *zip = (struct _7zip *)a->format->data;
3350 	int64_t pack_offset;
3351 
3352 	if (zip->pack_stream_remaining <= 0) {
3353 		archive_set_error(&(a->archive),
3354 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3355 		return (ARCHIVE_FATAL);
3356 	}
3357 	zip->pack_stream_inbytes_remaining =
3358 	    zip->si.pi.sizes[zip->pack_stream_index];
3359 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3360 	if (zip->stream_offset != pack_offset) {
3361 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3362 		    SEEK_SET))
3363 			return (ARCHIVE_FATAL);
3364 		zip->stream_offset = pack_offset;
3365 	}
3366 	zip->pack_stream_index++;
3367 	zip->pack_stream_remaining--;
3368 	return (ARCHIVE_OK);
3369 }
3370 
3371 static ssize_t
3372 read_stream(struct archive_read *a, const void **buff, size_t size,
3373     size_t minimum)
3374 {
3375 	struct _7zip *zip = (struct _7zip *)a->format->data;
3376 	uint64_t skip_bytes = 0;
3377 	ssize_t r;
3378 
3379 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3380 		if (zip->pack_stream_inbytes_remaining > 0) {
3381 			r = extract_pack_stream(a, 0);
3382 			if (r < 0)
3383 				return (r);
3384 			return (get_uncompressed_data(a, buff, size, minimum));
3385 		} else if (zip->folder_outbytes_remaining > 0) {
3386 			/* Extract a remaining pack stream. */
3387 			r = extract_pack_stream(a, 0);
3388 			if (r < 0)
3389 				return (r);
3390 			return (get_uncompressed_data(a, buff, size, minimum));
3391 		}
3392 	} else
3393 		return (get_uncompressed_data(a, buff, size, minimum));
3394 
3395 	/*
3396 	 * Current pack stream has been consumed.
3397 	 */
3398 	if (zip->pack_stream_remaining == 0) {
3399 		if (zip->header_is_being_read) {
3400 			/* Invalid sequence. This might happen when
3401 			 * reading a malformed archive. */
3402 			archive_set_error(&(a->archive),
3403 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3404 			return (ARCHIVE_FATAL);
3405 		}
3406 
3407 		/*
3408 		 * All current folder's pack streams have been
3409 		 * consumed. Switch to next folder.
3410 		 */
3411 		if (zip->folder_index == 0 &&
3412 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3413 		     || zip->folder_index != zip->entry->folderIndex)) {
3414 			zip->folder_index = zip->entry->folderIndex;
3415 			skip_bytes =
3416 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3417 		}
3418 
3419 		if (zip->folder_index >= zip->si.ci.numFolders) {
3420 			/*
3421 			 * We have consumed all folders and its pack streams.
3422 			 */
3423 			*buff = NULL;
3424 			return (0);
3425 		}
3426 		r = setup_decode_folder(a,
3427 			&(zip->si.ci.folders[zip->folder_index]), 0);
3428 		if (r != ARCHIVE_OK)
3429 			return (ARCHIVE_FATAL);
3430 
3431 		zip->folder_index++;
3432 	}
3433 
3434 	/*
3435 	 * Switch to next pack stream.
3436 	 */
3437 	r = seek_pack(a);
3438 	if (r < 0)
3439 		return (r);
3440 
3441 	/* Extract a new pack stream. */
3442 	r = extract_pack_stream(a, 0);
3443 	if (r < 0)
3444 		return (r);
3445 
3446 	/*
3447 	 * Skip the bytes we already has skipped in skip_stream().
3448 	 */
3449 	while (skip_bytes) {
3450 		ssize_t skipped;
3451 
3452 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3453 			if (zip->pack_stream_inbytes_remaining > 0) {
3454 				r = extract_pack_stream(a, 0);
3455 				if (r < 0)
3456 					return (r);
3457 			} else if (zip->folder_outbytes_remaining > 0) {
3458 				/* Extract a remaining pack stream. */
3459 				r = extract_pack_stream(a, 0);
3460 				if (r < 0)
3461 					return (r);
3462 			} else {
3463 				archive_set_error(&a->archive,
3464 				    ARCHIVE_ERRNO_FILE_FORMAT,
3465 				    "Truncated 7-Zip file body");
3466 				return (ARCHIVE_FATAL);
3467 			}
3468 		}
3469 		skipped = get_uncompressed_data(
3470 			a, buff, (size_t)skip_bytes, 0);
3471 		if (skipped < 0)
3472 			return (skipped);
3473 		skip_bytes -= skipped;
3474 		if (zip->pack_stream_bytes_unconsumed)
3475 			read_consume(a);
3476 	}
3477 
3478 	return (get_uncompressed_data(a, buff, size, minimum));
3479 }
3480 
3481 static int
3482 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3483     int header)
3484 {
3485 	struct _7zip *zip = (struct _7zip *)a->format->data;
3486 	const struct _7z_coder *coder1, *coder2;
3487 	const char *cname = (header)?"archive header":"file content";
3488 	unsigned i;
3489 	int r, found_bcj2 = 0;
3490 
3491 	/*
3492 	 * Release the memory which the previous folder used for BCJ2.
3493 	 */
3494 	for (i = 0; i < 3; i++) {
3495 		free(zip->sub_stream_buff[i]);
3496 		zip->sub_stream_buff[i] = NULL;
3497 	}
3498 
3499 	/*
3500 	 * Initialize a stream reader.
3501 	 */
3502 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3503 	zip->pack_stream_index = (unsigned)folder->packIndex;
3504 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3505 	zip->uncompressed_buffer_bytes_remaining = 0;
3506 
3507 	/*
3508 	 * Check coder types.
3509 	 */
3510 	for (i = 0; i < folder->numCoders; i++) {
3511 		switch(folder->coders[i].codec) {
3512 			case _7Z_CRYPTO_MAIN_ZIP:
3513 			case _7Z_CRYPTO_RAR_29:
3514 			case _7Z_CRYPTO_AES_256_SHA_256: {
3515 				/* For entry that is associated with this folder, mark
3516 				   it as encrypted (data+metadata). */
3517 				zip->has_encrypted_entries = 1;
3518 				if (a->entry) {
3519 					archive_entry_set_is_data_encrypted(a->entry, 1);
3520 					archive_entry_set_is_metadata_encrypted(a->entry, 1);
3521 				}
3522 				archive_set_error(&(a->archive),
3523 					ARCHIVE_ERRNO_MISC,
3524 					"The %s is encrypted, "
3525 					"but currently not supported", cname);
3526 				return (ARCHIVE_FATAL);
3527 			}
3528 			case _7Z_X86_BCJ2: {
3529 				found_bcj2++;
3530 				break;
3531 			}
3532 		}
3533 	}
3534 	/* Now that we've checked for encryption, if there were still no
3535 	 * encrypted entries found we can say for sure that there are none.
3536 	 */
3537 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
3538 		zip->has_encrypted_entries = 0;
3539 	}
3540 
3541 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3542 		archive_set_error(&(a->archive),
3543 		    ARCHIVE_ERRNO_MISC,
3544 		    "The %s is encoded with many filters, "
3545 		    "but currently not supported", cname);
3546 		return (ARCHIVE_FATAL);
3547 	}
3548 	coder1 = &(folder->coders[0]);
3549 	if (folder->numCoders == 2)
3550 		coder2 = &(folder->coders[1]);
3551 	else
3552 		coder2 = NULL;
3553 
3554 	if (found_bcj2) {
3555 		/*
3556 		 * Preparation to decode BCJ2.
3557 		 * Decoding BCJ2 requires four sources. Those are at least,
3558 		 * as far as I know, two types of the storage form.
3559 		 */
3560 		const struct _7z_coder *fc = folder->coders;
3561 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3562 		const struct _7z_coder *scoder[3] =
3563 			{&coder_copy, &coder_copy, &coder_copy};
3564 		const void *buff;
3565 		ssize_t bytes;
3566 		unsigned char *b[3] = {NULL, NULL, NULL};
3567 		uint64_t sunpack[3] ={-1, -1, -1};
3568 		size_t s[3] = {0, 0, 0};
3569 		int idx[3] = {0, 1, 2};
3570 
3571 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3572 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3573 		    zip->pack_stream_remaining == 4) {
3574 			/* Source type 1 made by 7zr or 7z with -m options. */
3575 			if (folder->bindPairs[0].inIndex == 5) {
3576 				/* The form made by 7zr */
3577 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3578 				scoder[1] = &(fc[1]);
3579 				scoder[2] = &(fc[0]);
3580 				sunpack[1] = folder->unPackSize[1];
3581 				sunpack[2] = folder->unPackSize[0];
3582 				coder1 = &(fc[2]);
3583 			} else {
3584 				/*
3585 				 * NOTE: Some patterns do not work.
3586 				 * work:
3587 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3588 				 *       -m3=(any)
3589 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3590 				 *       -m3=COPY
3591 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3592 				 *       -m3=COPY
3593 				 * not work:
3594 				 *  other patterns.
3595 				 *
3596 				 * We have to handle this like `pipe' or
3597 				 * our libarchive7s filter frame work,
3598 				 * decoding the BCJ2 main stream sequentially,
3599 				 * m3 -> m2 -> m1 -> BCJ2.
3600 				 *
3601 				 */
3602 				if (fc[0].codec == _7Z_COPY &&
3603 				    fc[1].codec == _7Z_COPY)
3604 					coder1 = &(folder->coders[2]);
3605 				else if (fc[0].codec == _7Z_COPY &&
3606 				    fc[2].codec == _7Z_COPY)
3607 					coder1 = &(folder->coders[1]);
3608 				else if (fc[1].codec == _7Z_COPY &&
3609 				    fc[2].codec == _7Z_COPY)
3610 					coder1 = &(folder->coders[0]);
3611 				else {
3612 					archive_set_error(&(a->archive),
3613 					    ARCHIVE_ERRNO_MISC,
3614 					    "Unsupported form of "
3615 					    "BCJ2 streams");
3616 					return (ARCHIVE_FATAL);
3617 				}
3618 			}
3619 			coder2 = &(fc[3]);
3620 			zip->main_stream_bytes_remaining =
3621 				(size_t)folder->unPackSize[2];
3622 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3623 		    zip->pack_stream_remaining == 4 &&
3624 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3625 			/* Source type 0 made by 7z */
3626 			zip->main_stream_bytes_remaining =
3627 				(size_t)folder->unPackSize[0];
3628 		} else {
3629 			/* We got an unexpected form. */
3630 			archive_set_error(&(a->archive),
3631 			    ARCHIVE_ERRNO_MISC,
3632 			    "Unsupported form of BCJ2 streams");
3633 			return (ARCHIVE_FATAL);
3634 		}
3635 
3636 		/* Skip the main stream at this time. */
3637 		if ((r = seek_pack(a)) < 0)
3638 			return (r);
3639 		zip->pack_stream_bytes_unconsumed =
3640 		    (size_t)zip->pack_stream_inbytes_remaining;
3641 		read_consume(a);
3642 
3643 		/* Read following three sub streams. */
3644 		for (i = 0; i < 3; i++) {
3645 			const struct _7z_coder *coder = scoder[i];
3646 
3647 			if ((r = seek_pack(a)) < 0) {
3648 				free(b[0]); free(b[1]); free(b[2]);
3649 				return (r);
3650 			}
3651 
3652 			if (sunpack[i] == (uint64_t)-1)
3653 				zip->folder_outbytes_remaining =
3654 				    zip->pack_stream_inbytes_remaining;
3655 			else
3656 				zip->folder_outbytes_remaining = sunpack[i];
3657 
3658 			r = init_decompression(a, zip, coder, NULL);
3659 			if (r != ARCHIVE_OK) {
3660 				free(b[0]); free(b[1]); free(b[2]);
3661 				return (ARCHIVE_FATAL);
3662 			}
3663 
3664 			/* Allocate memory for the decoded data of a sub
3665 			 * stream. */
3666 			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3667 			if (b[i] == NULL) {
3668 				free(b[0]); free(b[1]); free(b[2]);
3669 				archive_set_error(&a->archive, ENOMEM,
3670 				    "No memory for 7-Zip decompression");
3671 				return (ARCHIVE_FATAL);
3672 			}
3673 
3674 			/* Extract a sub stream. */
3675 			while (zip->pack_stream_inbytes_remaining > 0) {
3676 				r = (int)extract_pack_stream(a, 0);
3677 				if (r < 0) {
3678 					free(b[0]); free(b[1]); free(b[2]);
3679 					return (r);
3680 				}
3681 				bytes = get_uncompressed_data(a, &buff,
3682 				    zip->uncompressed_buffer_bytes_remaining,
3683 				    0);
3684 				if (bytes < 0) {
3685 					free(b[0]); free(b[1]); free(b[2]);
3686 					return ((int)bytes);
3687 				}
3688 				memcpy(b[i]+s[i], buff, bytes);
3689 				s[i] += bytes;
3690 				if (zip->pack_stream_bytes_unconsumed)
3691 					read_consume(a);
3692 			}
3693 		}
3694 
3695 		/* Set the sub streams to the right place. */
3696 		for (i = 0; i < 3; i++) {
3697 			zip->sub_stream_buff[i] = b[idx[i]];
3698 			zip->sub_stream_size[i] = s[idx[i]];
3699 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3700 		}
3701 
3702 		/* Allocate memory used for decoded main stream bytes. */
3703 		if (zip->tmp_stream_buff == NULL) {
3704 			zip->tmp_stream_buff_size = 32 * 1024;
3705 			zip->tmp_stream_buff =
3706 			    malloc(zip->tmp_stream_buff_size);
3707 			if (zip->tmp_stream_buff == NULL) {
3708 				archive_set_error(&a->archive, ENOMEM,
3709 				    "No memory for 7-Zip decompression");
3710 				return (ARCHIVE_FATAL);
3711 			}
3712 		}
3713 		zip->tmp_stream_bytes_avail = 0;
3714 		zip->tmp_stream_bytes_remaining = 0;
3715 		zip->odd_bcj_size = 0;
3716 		zip->bcj2_outPos = 0;
3717 
3718 		/*
3719 		 * Reset a stream reader in order to read the main stream
3720 		 * of BCJ2.
3721 		 */
3722 		zip->pack_stream_remaining = 1;
3723 		zip->pack_stream_index = (unsigned)folder->packIndex;
3724 		zip->folder_outbytes_remaining =
3725 		    folder_uncompressed_size(folder);
3726 		zip->uncompressed_buffer_bytes_remaining = 0;
3727 	}
3728 
3729 	/*
3730 	 * Initialize the decompressor for the new folder's pack streams.
3731 	 */
3732 	r = init_decompression(a, zip, coder1, coder2);
3733 	if (r != ARCHIVE_OK)
3734 		return (ARCHIVE_FATAL);
3735 	return (ARCHIVE_OK);
3736 }
3737 
3738 static int64_t
3739 skip_stream(struct archive_read *a, size_t skip_bytes)
3740 {
3741 	struct _7zip *zip = (struct _7zip *)a->format->data;
3742 	const void *p;
3743 	int64_t skipped_bytes;
3744 	size_t bytes = skip_bytes;
3745 
3746 	if (zip->folder_index == 0) {
3747 		/*
3748 		 * Optimization for a list mode.
3749 		 * Avoid unnecessary decoding operations.
3750 		 */
3751 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3752 		    += skip_bytes;
3753 		return (skip_bytes);
3754 	}
3755 
3756 	while (bytes) {
3757 		skipped_bytes = read_stream(a, &p, bytes, 0);
3758 		if (skipped_bytes < 0)
3759 			return (skipped_bytes);
3760 		if (skipped_bytes == 0) {
3761 			archive_set_error(&a->archive,
3762 			    ARCHIVE_ERRNO_FILE_FORMAT,
3763 			    "Truncated 7-Zip file body");
3764 			return (ARCHIVE_FATAL);
3765 		}
3766 		bytes -= (size_t)skipped_bytes;
3767 		if (zip->pack_stream_bytes_unconsumed)
3768 			read_consume(a);
3769 	}
3770 	return (skip_bytes);
3771 }
3772 
3773 /*
3774  * Brought from LZMA SDK.
3775  *
3776  * Bra86.c -- Converter for x86 code (BCJ)
3777  * 2008-10-04 : Igor Pavlov : Public domain
3778  *
3779  */
3780 
3781 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3782 
3783 static void
3784 x86_Init(struct _7zip *zip)
3785 {
3786 	zip->bcj_state = 0;
3787 	zip->bcj_prevPosT = (size_t)0 - 1;
3788 	zip->bcj_prevMask = 0;
3789 	zip->bcj_ip = 5;
3790 }
3791 
3792 static size_t
3793 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3794 {
3795 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3796 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3797 	size_t bufferPos, prevPosT;
3798 	uint32_t ip, prevMask;
3799 
3800 	if (size < 5)
3801 		return 0;
3802 
3803 	bufferPos = 0;
3804 	prevPosT = zip->bcj_prevPosT;
3805 	prevMask = zip->bcj_prevMask;
3806 	ip = zip->bcj_ip;
3807 
3808 	for (;;) {
3809 		uint8_t *p = data + bufferPos;
3810 		uint8_t *limit = data + size - 4;
3811 
3812 		for (; p < limit; p++)
3813 			if ((*p & 0xFE) == 0xE8)
3814 				break;
3815 		bufferPos = (size_t)(p - data);
3816 		if (p >= limit)
3817 			break;
3818 		prevPosT = bufferPos - prevPosT;
3819 		if (prevPosT > 3)
3820 			prevMask = 0;
3821 		else {
3822 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3823 			if (prevMask != 0) {
3824 				unsigned char b =
3825 					p[4 - kMaskToBitNumber[prevMask]];
3826 				if (!kMaskToAllowedStatus[prevMask] ||
3827 				    Test86MSByte(b)) {
3828 					prevPosT = bufferPos;
3829 					prevMask = ((prevMask << 1) & 0x7) | 1;
3830 					bufferPos++;
3831 					continue;
3832 				}
3833 			}
3834 		}
3835 		prevPosT = bufferPos;
3836 
3837 		if (Test86MSByte(p[4])) {
3838 			uint32_t src = ((uint32_t)p[4] << 24) |
3839 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3840 				((uint32_t)p[1]);
3841 			uint32_t dest;
3842 			for (;;) {
3843 				uint8_t b;
3844 				int b_index;
3845 
3846 				dest = src - (ip + (uint32_t)bufferPos);
3847 				if (prevMask == 0)
3848 					break;
3849 				b_index = kMaskToBitNumber[prevMask] * 8;
3850 				b = (uint8_t)(dest >> (24 - b_index));
3851 				if (!Test86MSByte(b))
3852 					break;
3853 				src = dest ^ ((1 << (32 - b_index)) - 1);
3854 			}
3855 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3856 			p[3] = (uint8_t)(dest >> 16);
3857 			p[2] = (uint8_t)(dest >> 8);
3858 			p[1] = (uint8_t)dest;
3859 			bufferPos += 5;
3860 		} else {
3861 			prevMask = ((prevMask << 1) & 0x7) | 1;
3862 			bufferPos++;
3863 		}
3864 	}
3865 	zip->bcj_prevPosT = prevPosT;
3866 	zip->bcj_prevMask = prevMask;
3867 	zip->bcj_ip += (uint32_t)bufferPos;
3868 	return (bufferPos);
3869 }
3870 
3871 static void
3872 arm_Init(struct _7zip *zip)
3873 {
3874 	zip->bcj_ip = 8;
3875 }
3876 
3877 static size_t
3878 arm_Convert(struct _7zip *zip, uint8_t *buf, size_t size)
3879 {
3880 	// This function was adapted from
3881 	// static size_t bcj_arm(struct xz_dec_bcj *s, uint8_t *buf, size_t size)
3882 	// in https://git.tukaani.org/xz-embedded.git
3883 
3884 	/*
3885 	 * Branch/Call/Jump (BCJ) filter decoders
3886 	 *
3887 	 * Authors: Lasse Collin <lasse.collin@tukaani.org>
3888 	 *          Igor Pavlov <https://7-zip.org/>
3889 	 *
3890 	 * This file has been put into the public domain.
3891 	 * You can do whatever you want with this file.
3892 	 */
3893 
3894 	size_t i;
3895 	uint32_t addr;
3896 
3897 	for (i = 0; i + 4 <= size; i += 4) {
3898 		if (buf[i + 3] == 0xEB) {
3899 			// Calculate the transformed addr.
3900 			addr = (uint32_t)buf[i] | ((uint32_t)buf[i + 1] << 8)
3901 				| ((uint32_t)buf[i + 2] << 16);
3902 			addr <<= 2;
3903 			addr -= zip->bcj_ip + (uint32_t)i;
3904 			addr >>= 2;
3905 
3906 			// Store the transformed addr in buf.
3907 			buf[i] = (uint8_t)addr;
3908 			buf[i + 1] = (uint8_t)(addr >> 8);
3909 			buf[i + 2] = (uint8_t)(addr >> 16);
3910 		}
3911 	}
3912 
3913 	zip->bcj_ip += (uint32_t)i;
3914 
3915 	return i;
3916 }
3917 
3918 static size_t
3919 arm64_Convert(struct _7zip *zip, uint8_t *buf, size_t size)
3920 {
3921 	// This function was adapted from
3922 	// static size_t bcj_arm64(struct xz_dec_bcj *s, uint8_t *buf, size_t size)
3923 	// in https://git.tukaani.org/xz-embedded.git
3924 
3925 	/*
3926 	 * Branch/Call/Jump (BCJ) filter decoders
3927 	 *
3928 	 * Authors: Lasse Collin <lasse.collin@tukaani.org>
3929 	 *          Igor Pavlov <https://7-zip.org/>
3930 	 *
3931 	 * This file has been put into the public domain.
3932 	 * You can do whatever you want with this file.
3933 	 */
3934 
3935 	size_t i;
3936 	uint32_t instr;
3937 	uint32_t addr;
3938 
3939 	for (i = 0; i + 4 <= size; i += 4) {
3940 		instr = (uint32_t)buf[i]
3941 			| ((uint32_t)buf[i+1] << 8)
3942 			| ((uint32_t)buf[i+2] << 16)
3943 			| ((uint32_t)buf[i+3] << 24);
3944 
3945 		if ((instr >> 26) == 0x25) {
3946 			/* BL instruction */
3947 			addr = instr - ((zip->bcj_ip + (uint32_t)i) >> 2);
3948 			instr = 0x94000000 | (addr & 0x03FFFFFF);
3949 
3950 			buf[i]   = (uint8_t)instr;
3951 			buf[i+1] = (uint8_t)(instr >> 8);
3952 			buf[i+2] = (uint8_t)(instr >> 16);
3953 			buf[i+3] = (uint8_t)(instr >> 24);
3954 		} else if ((instr & 0x9F000000) == 0x90000000) {
3955 			/* ADRP instruction */
3956 			addr = ((instr >> 29) & 3) | ((instr >> 3) & 0x1FFFFC);
3957 
3958 			/* Only convert values in the range +/-512 MiB. */
3959 			if ((addr + 0x020000) & 0x1C0000)
3960 				continue;
3961 
3962 			addr -= (zip->bcj_ip + (uint32_t)i) >> 12;
3963 
3964 			instr &= 0x9000001F;
3965 			instr |= (addr & 3) << 29;
3966 			instr |= (addr & 0x03FFFC) << 3;
3967 			instr |= (0U - (addr & 0x020000)) & 0xE00000;
3968 
3969 			buf[i]   = (uint8_t)instr;
3970 			buf[i+1] = (uint8_t)(instr >> 8);
3971 			buf[i+2] = (uint8_t)(instr >> 16);
3972 			buf[i+3] = (uint8_t)(instr >> 24);
3973 		}
3974 	}
3975 
3976 	zip->bcj_ip += (uint32_t)i;
3977 
3978 	return i;
3979 }
3980 
3981 /*
3982  * Brought from LZMA SDK.
3983  *
3984  * Bcj2.c -- Converter for x86 code (BCJ2)
3985  * 2008-10-04 : Igor Pavlov : Public domain
3986  *
3987  */
3988 
3989 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3990 
3991 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3992 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3993 
3994 #define kNumTopBits 24
3995 #define kTopValue ((uint32_t)1 << kNumTopBits)
3996 
3997 #define kNumBitModelTotalBits 11
3998 #define kBitModelTotal (1 << kNumBitModelTotalBits)
3999 #define kNumMoveBits 5
4000 
4001 #define RC_READ_BYTE (*buffer++)
4002 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
4003 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
4004   { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
4005 
4006 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
4007 
4008 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
4009 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
4010 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
4011 
4012 static ssize_t
4013 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
4014 {
4015 	size_t inPos = 0, outPos = 0;
4016 	const uint8_t *buf0, *buf1, *buf2, *buf3;
4017 	size_t size0, size1, size2, size3;
4018 	const uint8_t *buffer, *bufferLim;
4019 	unsigned int i, j;
4020 
4021 	size0 = zip->tmp_stream_bytes_remaining;
4022 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
4023 	size1 = zip->sub_stream_bytes_remaining[0];
4024 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
4025 	size2 = zip->sub_stream_bytes_remaining[1];
4026 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
4027 	size3 = zip->sub_stream_bytes_remaining[2];
4028 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
4029 
4030 	buffer = buf3;
4031 	bufferLim = buffer + size3;
4032 
4033 	if (zip->bcj_state == 0) {
4034 		/*
4035 		 * Initialize.
4036 		 */
4037 		zip->bcj2_prevByte = 0;
4038 		for (i = 0;
4039 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
4040 			zip->bcj2_p[i] = kBitModelTotal >> 1;
4041 		RC_INIT2;
4042 		zip->bcj_state = 1;
4043 	}
4044 
4045 	/*
4046 	 * Gather the odd bytes of a previous call.
4047 	 */
4048 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
4049 		outBuf[outPos++] = zip->odd_bcj[i];
4050 		zip->odd_bcj_size--;
4051 	}
4052 
4053 	if (outSize == 0) {
4054 		zip->bcj2_outPos += outPos;
4055 		return (outPos);
4056 	}
4057 
4058 	for (;;) {
4059 		uint8_t b;
4060 		CProb *prob;
4061 		uint32_t bound;
4062 		uint32_t ttt;
4063 
4064 		size_t limit = size0 - inPos;
4065 		if (outSize - outPos < limit)
4066 			limit = outSize - outPos;
4067 
4068 		if (zip->bcj_state == 1) {
4069 			while (limit != 0) {
4070 				uint8_t bb = buf0[inPos];
4071 				outBuf[outPos++] = bb;
4072 				if (IsJ(zip->bcj2_prevByte, bb)) {
4073 					zip->bcj_state = 2;
4074 					break;
4075 				}
4076 				inPos++;
4077 				zip->bcj2_prevByte = bb;
4078 				limit--;
4079 			}
4080 		}
4081 
4082 		if (limit == 0 || outPos == outSize)
4083 			break;
4084 		zip->bcj_state = 1;
4085 
4086 		b = buf0[inPos++];
4087 
4088 		if (b == 0xE8)
4089 			prob = zip->bcj2_p + zip->bcj2_prevByte;
4090 		else if (b == 0xE9)
4091 			prob = zip->bcj2_p + 256;
4092 		else
4093 			prob = zip->bcj2_p + 257;
4094 
4095 		IF_BIT_0(prob) {
4096 			UPDATE_0(prob)
4097 			zip->bcj2_prevByte = b;
4098 		} else {
4099 			uint32_t dest;
4100 			const uint8_t *v;
4101 			uint8_t out[4];
4102 
4103 			UPDATE_1(prob)
4104 			if (b == 0xE8) {
4105 				v = buf1;
4106 				if (size1 < 4)
4107 					return SZ_ERROR_DATA;
4108 				buf1 += 4;
4109 				size1 -= 4;
4110 			} else {
4111 				v = buf2;
4112 				if (size2 < 4)
4113 					return SZ_ERROR_DATA;
4114 				buf2 += 4;
4115 				size2 -= 4;
4116 			}
4117 			dest = (((uint32_t)v[0] << 24) |
4118 			    ((uint32_t)v[1] << 16) |
4119 			    ((uint32_t)v[2] << 8) |
4120 			    ((uint32_t)v[3])) -
4121 			    ((uint32_t)zip->bcj2_outPos + (uint32_t)outPos + 4);
4122 			out[0] = (uint8_t)dest;
4123 			out[1] = (uint8_t)(dest >> 8);
4124 			out[2] = (uint8_t)(dest >> 16);
4125 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
4126 
4127 			for (i = 0; i < 4 && outPos < outSize; i++)
4128 				outBuf[outPos++] = out[i];
4129 			if (i < 4) {
4130 				/*
4131 				 * Save odd bytes which we could not add into
4132 				 * the output buffer because of out of space.
4133 				 */
4134 				zip->odd_bcj_size = 4 -i;
4135 				for (; i < 4; i++) {
4136 					j = i - 4 + (unsigned)zip->odd_bcj_size;
4137 					zip->odd_bcj[j] = out[i];
4138 				}
4139 				break;
4140 			}
4141 		}
4142 	}
4143 	zip->tmp_stream_bytes_remaining -= inPos;
4144 	zip->sub_stream_bytes_remaining[0] = size1;
4145 	zip->sub_stream_bytes_remaining[1] = size2;
4146 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
4147 	zip->bcj2_outPos += outPos;
4148 
4149 	return ((ssize_t)outPos);
4150 }
4151 
4152