1 /*-
2  * Copyright (c) 2011 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "archive_platform.h"
27 __FBSDID("$FreeBSD$");
28 
29 #ifdef HAVE_ERRNO_H
30 #include <errno.h>
31 #endif
32 #ifdef HAVE_STDLIB_H
33 #include <stdlib.h>
34 #endif
35 #ifdef HAVE_BZLIB_H
36 #include <bzlib.h>
37 #endif
38 #ifdef HAVE_LZMA_H
39 #include <lzma.h>
40 #endif
41 #ifdef HAVE_ZLIB_H
42 #include <zlib.h>
43 #endif
44 
45 #include "archive.h"
46 #include "archive_entry.h"
47 #include "archive_entry_locale.h"
48 #include "archive_ppmd7_private.h"
49 #include "archive_private.h"
50 #include "archive_read_private.h"
51 #include "archive_endian.h"
52 
53 #ifndef HAVE_ZLIB_H
54 #include "archive_crc32.h"
55 #endif
56 
57 #define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
58 #define SFX_MIN_ADDR	0x27000
59 #define SFX_MAX_ADDR	0x60000
60 
61 
62 /*
63  * Codec ID
64  */
65 #define _7Z_COPY	0
66 #define _7Z_LZMA	0x030101
67 #define _7Z_LZMA2	0x21
68 #define _7Z_DEFLATE	0x040108
69 #define _7Z_BZ2		0x040202
70 #define _7Z_PPMD	0x030401
71 #define _7Z_DELTA	0x03
72 #define _7Z_CRYPTO_MAIN_ZIP			0x06F10101 /* Main Zip crypto algo */
73 #define _7Z_CRYPTO_RAR_29			0x06F10303 /* Rar29 AES-128 + (modified SHA-1) */
74 #define _7Z_CRYPTO_AES_256_SHA_256	0x06F10701 /* AES-256 + SHA-256 */
75 
76 
77 #define _7Z_X86		0x03030103
78 #define _7Z_X86_BCJ2	0x0303011B
79 #define _7Z_POWERPC	0x03030205
80 #define _7Z_IA64	0x03030401
81 #define _7Z_ARM		0x03030501
82 #define _7Z_ARMTHUMB	0x03030701
83 #define _7Z_SPARC	0x03030805
84 
85 /*
86  * 7-Zip header property IDs.
87  */
88 #define kEnd			0x00
89 #define kHeader			0x01
90 #define kArchiveProperties	0x02
91 #define kAdditionalStreamsInfo	0x03
92 #define kMainStreamsInfo	0x04
93 #define kFilesInfo		0x05
94 #define kPackInfo		0x06
95 #define kUnPackInfo		0x07
96 #define kSubStreamsInfo		0x08
97 #define kSize			0x09
98 #define kCRC			0x0A
99 #define kFolder			0x0B
100 #define kCodersUnPackSize	0x0C
101 #define kNumUnPackStream	0x0D
102 #define kEmptyStream		0x0E
103 #define kEmptyFile		0x0F
104 #define kAnti			0x10
105 #define kName			0x11
106 #define kCTime			0x12
107 #define kATime			0x13
108 #define kMTime			0x14
109 #define kAttributes		0x15
110 #define kEncodedHeader		0x17
111 #define kDummy			0x19
112 
113 struct _7z_digests {
114 	unsigned char	*defineds;
115 	uint32_t	*digests;
116 };
117 
118 
119 struct _7z_folder {
120 	uint64_t		 numCoders;
121 	struct _7z_coder {
122 		unsigned long	 codec;
123 		uint64_t	 numInStreams;
124 		uint64_t	 numOutStreams;
125 		uint64_t	 propertiesSize;
126 		unsigned char	*properties;
127 	} *coders;
128 	uint64_t		 numBindPairs;
129 	struct {
130 		uint64_t	 inIndex;
131 		uint64_t	 outIndex;
132 	} *bindPairs;
133 	uint64_t		 numPackedStreams;
134 	uint64_t		*packedStreams;
135 	uint64_t		 numInStreams;
136 	uint64_t		 numOutStreams;
137 	uint64_t		*unPackSize;
138 	unsigned char		 digest_defined;
139 	uint32_t		 digest;
140 	uint64_t		 numUnpackStreams;
141 	uint32_t		 packIndex;
142 	/* Unoperated bytes. */
143 	uint64_t		 skipped_bytes;
144 };
145 
146 struct _7z_coders_info {
147 	uint64_t		 numFolders;
148 	struct _7z_folder	*folders;
149 	uint64_t		 dataStreamIndex;
150 };
151 
152 struct _7z_pack_info {
153 	uint64_t		 pos;
154 	uint64_t		 numPackStreams;
155 	uint64_t		*sizes;
156 	struct _7z_digests	 digest;
157 	/* Calculated from pos and numPackStreams. */
158 	uint64_t		*positions;
159 };
160 
161 struct _7z_substream_info {
162 	size_t			 unpack_streams;
163 	uint64_t		*unpackSizes;
164 	unsigned char		*digestsDefined;
165 	uint32_t		*digests;
166 };
167 
168 struct _7z_stream_info {
169 	struct _7z_pack_info	 pi;
170 	struct _7z_coders_info	 ci;
171 	struct _7z_substream_info ss;
172 };
173 
174 struct _7z_header_info {
175 	uint64_t		 dataIndex;
176 
177 	unsigned char		*emptyStreamBools;
178 	unsigned char		*emptyFileBools;
179 	unsigned char		*antiBools;
180 	unsigned char		*attrBools;
181 };
182 
183 struct _7zip_entry {
184 	size_t			 name_len;
185 	unsigned char		*utf16name;
186 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
187 	const wchar_t		*wname;
188 #endif
189 	uint32_t		 folderIndex;
190 	uint32_t		 ssIndex;
191 	unsigned		 flg;
192 #define MTIME_IS_SET	(1<<0)
193 #define ATIME_IS_SET	(1<<1)
194 #define CTIME_IS_SET	(1<<2)
195 #define CRC32_IS_SET	(1<<3)
196 #define HAS_STREAM	(1<<4)
197 
198 	time_t			 mtime;
199 	time_t			 atime;
200 	time_t			 ctime;
201 	long			 mtime_ns;
202 	long			 atime_ns;
203 	long			 ctime_ns;
204 	uint32_t		 mode;
205 	uint32_t		 attr;
206 };
207 
208 struct _7zip {
209 	/* Structural information about the archive. */
210 	struct _7z_stream_info	 si;
211 
212 	int			 header_is_being_read;
213 	int			 header_is_encoded;
214 	uint64_t		 header_bytes_remaining;
215 	unsigned long		 header_crc32;
216 	/* Header offset to check that reading points of the file contents
217 	 * will not exceed the header. */
218 	uint64_t		 header_offset;
219 	/* Base offset of the archive file for a seek in case reading SFX. */
220 	uint64_t		 seek_base;
221 
222 	/* List of entries */
223 	size_t			 entries_remaining;
224 	uint64_t		 numFiles;
225 	struct _7zip_entry	*entries;
226 	struct _7zip_entry	*entry;
227 	unsigned char		*entry_names;
228 
229 	/* entry_bytes_remaining is the number of bytes we expect. */
230 	int64_t			 entry_offset;
231 	uint64_t		 entry_bytes_remaining;
232 
233 	/* Running CRC32 of the decompressed data */
234 	unsigned long		 entry_crc32;
235 
236 	/* Flags to mark progress of decompression. */
237 	char			 end_of_entry;
238 
239 	/* Uncompressed buffer control.  */
240 #define UBUFF_SIZE	(64 * 1024)
241 	unsigned char 		*uncompressed_buffer;
242 	unsigned char 		*uncompressed_buffer_pointer;
243 	size_t 			 uncompressed_buffer_size;
244 	size_t			 uncompressed_buffer_bytes_remaining;
245 
246 	/* Offset of the compressed data. */
247 	int64_t			 stream_offset;
248 
249 	/*
250 	 * Decompressing control data.
251 	 */
252 	unsigned		 folder_index;
253 	uint64_t		 folder_outbytes_remaining;
254 	unsigned		 pack_stream_index;
255 	unsigned		 pack_stream_remaining;
256 	uint64_t		 pack_stream_inbytes_remaining;
257 	size_t			 pack_stream_bytes_unconsumed;
258 
259 	/* The codec information of a folder. */
260 	unsigned long		 codec;
261 	unsigned long		 codec2;
262 
263 	/*
264 	 * Decompressor controllers.
265 	 */
266 	/* Decoding LZMA1 and LZMA2 data. */
267 #ifdef HAVE_LZMA_H
268 	lzma_stream		 lzstream;
269 	int			 lzstream_valid;
270 #endif
271 	/* Decoding bzip2 data. */
272 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
273 	bz_stream		 bzstream;
274 	int			 bzstream_valid;
275 #endif
276 	/* Decoding deflate data. */
277 #ifdef HAVE_ZLIB_H
278 	z_stream		 stream;
279 	int			 stream_valid;
280 #endif
281 	/* Decoding PPMd data. */
282 	int			 ppmd7_stat;
283 	CPpmd7			 ppmd7_context;
284 	CPpmd7z_RangeDec	 range_dec;
285 	IByteIn			 bytein;
286 	struct {
287 		const unsigned char	*next_in;
288 		int64_t			 avail_in;
289 		int64_t			 total_in;
290 		unsigned char		*next_out;
291 		int64_t			 avail_out;
292 		int64_t			 total_out;
293 		int			 overconsumed;
294 	} ppstream;
295 	int			 ppmd7_valid;
296 
297 	/* Decoding BCJ and BCJ2 data. */
298 	uint32_t		 bcj_state;
299 	size_t			 odd_bcj_size;
300 	unsigned char		 odd_bcj[4];
301 	/* Decoding BCJ data. */
302 	size_t			 bcj_prevPosT;
303 	uint32_t		 bcj_prevMask;
304 	uint32_t		 bcj_ip;
305 
306 	/* Decoding BCJ2 data. */
307 	size_t			 main_stream_bytes_remaining;
308 	unsigned char		*sub_stream_buff[3];
309 	size_t			 sub_stream_size[3];
310 	size_t			 sub_stream_bytes_remaining[3];
311 	unsigned char		*tmp_stream_buff;
312 	size_t			 tmp_stream_buff_size;
313 	size_t			 tmp_stream_bytes_avail;
314 	size_t			 tmp_stream_bytes_remaining;
315 #ifdef _LZMA_PROB32
316 #define CProb uint32_t
317 #else
318 #define CProb uint16_t
319 #endif
320 	CProb			 bcj2_p[256 + 2];
321 	uint8_t			 bcj2_prevByte;
322 	uint32_t		 bcj2_range;
323 	uint32_t		 bcj2_code;
324 	uint64_t		 bcj2_outPos;
325 
326 	/* Filename character-set conversion data. */
327 	struct archive_string_conv *sconv;
328 
329 	char			 format_name[64];
330 
331 	/* Custom value that is non-zero if this archive contains encrypted entries. */
332 	int			 has_encrypted_entries;
333 };
334 
335 /* Maximum entry size. This limitation prevents reading intentional
336  * corrupted 7-zip files on assuming there are not so many entries in
337  * the files. */
338 #define UMAX_ENTRY	ARCHIVE_LITERAL_ULL(100000000)
339 
340 static int	archive_read_format_7zip_has_encrypted_entries(struct archive_read *);
341 static int	archive_read_support_format_7zip_capabilities(struct archive_read *a);
342 static int	archive_read_format_7zip_bid(struct archive_read *, int);
343 static int	archive_read_format_7zip_cleanup(struct archive_read *);
344 static int	archive_read_format_7zip_read_data(struct archive_read *,
345 		    const void **, size_t *, int64_t *);
346 static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
347 static int	archive_read_format_7zip_read_header(struct archive_read *,
348 		    struct archive_entry *);
349 static int	check_7zip_header_in_sfx(const char *);
350 static unsigned long decode_codec_id(const unsigned char *, size_t);
351 static int	decode_encoded_header_info(struct archive_read *,
352 		    struct _7z_stream_info *);
353 static int	decompress(struct archive_read *, struct _7zip *,
354 		    void *, size_t *, const void *, size_t *);
355 static ssize_t	extract_pack_stream(struct archive_read *, size_t);
356 static void	fileTimeToUtc(uint64_t, time_t *, long *);
357 static uint64_t folder_uncompressed_size(struct _7z_folder *);
358 static void	free_CodersInfo(struct _7z_coders_info *);
359 static void	free_Digest(struct _7z_digests *);
360 static void	free_Folder(struct _7z_folder *);
361 static void	free_Header(struct _7z_header_info *);
362 static void	free_PackInfo(struct _7z_pack_info *);
363 static void	free_StreamsInfo(struct _7z_stream_info *);
364 static void	free_SubStreamsInfo(struct _7z_substream_info *);
365 static int	free_decompression(struct archive_read *, struct _7zip *);
366 static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
367 		    size_t, size_t);
368 static const unsigned char * header_bytes(struct archive_read *, size_t);
369 static int	init_decompression(struct archive_read *, struct _7zip *,
370 		    const struct _7z_coder *, const struct _7z_coder *);
371 static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
372 static int	read_Bools(struct archive_read *, unsigned char *, size_t);
373 static int	read_CodersInfo(struct archive_read *,
374 		    struct _7z_coders_info *);
375 static int	read_Digests(struct archive_read *, struct _7z_digests *,
376 		    size_t);
377 static int	read_Folder(struct archive_read *, struct _7z_folder *);
378 static int	read_Header(struct archive_read *, struct _7z_header_info *,
379 		    int);
380 static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
381 static int	read_StreamsInfo(struct archive_read *,
382 		    struct _7z_stream_info *);
383 static int	read_SubStreamsInfo(struct archive_read *,
384 		    struct _7z_substream_info *, struct _7z_folder *, size_t);
385 static int	read_Times(struct archive_read *, struct _7z_header_info *,
386 		    int);
387 static void	read_consume(struct archive_read *);
388 static ssize_t	read_stream(struct archive_read *, const void **, size_t,
389 		    size_t);
390 static int	seek_pack(struct archive_read *);
391 static int64_t	skip_stream(struct archive_read *, size_t);
392 static int	skip_sfx(struct archive_read *, ssize_t);
393 static int	slurp_central_directory(struct archive_read *, struct _7zip *,
394 		    struct _7z_header_info *);
395 static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
396 		    int);
397 static void	x86_Init(struct _7zip *);
398 static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
399 static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
400 
401 
402 int
403 archive_read_support_format_7zip(struct archive *_a)
404 {
405 	struct archive_read *a = (struct archive_read *)_a;
406 	struct _7zip *zip;
407 	int r;
408 
409 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
410 	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
411 
412 	zip = calloc(1, sizeof(*zip));
413 	if (zip == NULL) {
414 		archive_set_error(&a->archive, ENOMEM,
415 		    "Can't allocate 7zip data");
416 		return (ARCHIVE_FATAL);
417 	}
418 
419 	/*
420 	 * Until enough data has been read, we cannot tell about
421 	 * any encrypted entries yet.
422 	 */
423 	zip->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
424 
425 
426 	r = __archive_read_register_format(a,
427 	    zip,
428 	    "7zip",
429 	    archive_read_format_7zip_bid,
430 	    NULL,
431 	    archive_read_format_7zip_read_header,
432 	    archive_read_format_7zip_read_data,
433 	    archive_read_format_7zip_read_data_skip,
434 	    NULL,
435 	    archive_read_format_7zip_cleanup,
436 	    archive_read_support_format_7zip_capabilities,
437 	    archive_read_format_7zip_has_encrypted_entries);
438 
439 	if (r != ARCHIVE_OK)
440 		free(zip);
441 	return (ARCHIVE_OK);
442 }
443 
444 static int
445 archive_read_support_format_7zip_capabilities(struct archive_read * a)
446 {
447 	(void)a; /* UNUSED */
448 	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA |
449 			ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
450 }
451 
452 
453 static int
454 archive_read_format_7zip_has_encrypted_entries(struct archive_read *_a)
455 {
456 	if (_a && _a->format) {
457 		struct _7zip * zip = (struct _7zip *)_a->format->data;
458 		if (zip) {
459 			return zip->has_encrypted_entries;
460 		}
461 	}
462 	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
463 }
464 
465 static int
466 archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
467 {
468 	const char *p;
469 
470 	/* If someone has already bid more than 32, then avoid
471 	   trashing the look-ahead buffers with a seek. */
472 	if (best_bid > 32)
473 		return (-1);
474 
475 	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
476 		return (0);
477 
478 	/* If first six bytes are the 7-Zip signature,
479 	 * return the bid right now. */
480 	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
481 		return (48);
482 
483 	/*
484 	 * It may a 7-Zip SFX archive file. If first two bytes are
485 	 * 'M' and 'Z' available on Windows or first four bytes are
486 	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
487 	 * signature. Although we will perform a seek when reading
488 	 * a header, what we do not use __archive_read_seek() here is
489 	 * due to a bidding performance.
490 	 */
491 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
492 		ssize_t offset = SFX_MIN_ADDR;
493 		ssize_t window = 4096;
494 		ssize_t bytes_avail;
495 		while (offset + window <= (SFX_MAX_ADDR)) {
496 			const char *buff = __archive_read_ahead(a,
497 					offset + window, &bytes_avail);
498 			if (buff == NULL) {
499 				/* Remaining bytes are less than window. */
500 				window >>= 1;
501 				if (window < 0x40)
502 					return (0);
503 				continue;
504 			}
505 			p = buff + offset;
506 			while (p + 32 < buff + bytes_avail) {
507 				int step = check_7zip_header_in_sfx(p);
508 				if (step == 0)
509 					return (48);
510 				p += step;
511 			}
512 			offset = p - buff;
513 		}
514 	}
515 	return (0);
516 }
517 
518 static int
519 check_7zip_header_in_sfx(const char *p)
520 {
521 	switch ((unsigned char)p[5]) {
522 	case 0x1C:
523 		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
524 			return (6);
525 		/*
526 		 * Test the CRC because its extraction code has 7-Zip
527 		 * Magic Code, so we should do this in order not to
528 		 * make a mis-detection.
529 		 */
530 		if (crc32(0, (const unsigned char *)p + 12, 20)
531 			!= archive_le32dec(p + 8))
532 			return (6);
533 		/* Hit the header! */
534 		return (0);
535 	case 0x37: return (5);
536 	case 0x7A: return (4);
537 	case 0xBC: return (3);
538 	case 0xAF: return (2);
539 	case 0x27: return (1);
540 	default: return (6);
541 	}
542 }
543 
544 static int
545 skip_sfx(struct archive_read *a, ssize_t bytes_avail)
546 {
547 	const void *h;
548 	const char *p, *q;
549 	size_t skip, offset;
550 	ssize_t bytes, window;
551 
552 	/*
553 	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
554 	 * __archive_read_seek() at this time since we have
555 	 * already had enough data.
556 	 */
557 	if (bytes_avail > SFX_MIN_ADDR)
558 		__archive_read_consume(a, SFX_MIN_ADDR);
559 	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
560 		return (ARCHIVE_FATAL);
561 
562 	offset = 0;
563 	window = 1;
564 	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
565 		h = __archive_read_ahead(a, window, &bytes);
566 		if (h == NULL) {
567 			/* Remaining bytes are less than window. */
568 			window >>= 1;
569 			if (window < 0x40)
570 				goto fatal;
571 			continue;
572 		}
573 		if (bytes < 6) {
574 			/* This case might happen when window == 1. */
575 			window = 4096;
576 			continue;
577 		}
578 		p = (const char *)h;
579 		q = p + bytes;
580 
581 		/*
582 		 * Scan ahead until we find something that looks
583 		 * like the 7-Zip header.
584 		 */
585 		while (p + 32 < q) {
586 			int step = check_7zip_header_in_sfx(p);
587 			if (step == 0) {
588 				struct _7zip *zip =
589 				    (struct _7zip *)a->format->data;
590 				skip = p - (const char *)h;
591 				__archive_read_consume(a, skip);
592 				zip->seek_base = SFX_MIN_ADDR + offset + skip;
593 				return (ARCHIVE_OK);
594 			}
595 			p += step;
596 		}
597 		skip = p - (const char *)h;
598 		__archive_read_consume(a, skip);
599 		offset += skip;
600 		if (window == 1)
601 			window = 4096;
602 	}
603 fatal:
604 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
605 	    "Couldn't find out 7-Zip header");
606 	return (ARCHIVE_FATAL);
607 }
608 
609 static int
610 archive_read_format_7zip_read_header(struct archive_read *a,
611 	struct archive_entry *entry)
612 {
613 	struct _7zip *zip = (struct _7zip *)a->format->data;
614 	struct _7zip_entry *zip_entry;
615 	int r, ret = ARCHIVE_OK;
616 	struct _7z_folder *folder = 0;
617 	uint64_t fidx = 0;
618 
619 	/*
620 	 * It should be sufficient to call archive_read_next_header() for
621 	 * a reader to determine if an entry is encrypted or not. If the
622 	 * encryption of an entry is only detectable when calling
623 	 * archive_read_data(), so be it. We'll do the same check there
624 	 * as well.
625 	 */
626 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
627 		zip->has_encrypted_entries = 0;
628 	}
629 
630 	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
631 	if (a->archive.archive_format_name == NULL)
632 		a->archive.archive_format_name = "7-Zip";
633 
634 	if (zip->entries == NULL) {
635 		struct _7z_header_info header;
636 
637 		memset(&header, 0, sizeof(header));
638 		r = slurp_central_directory(a, zip, &header);
639 		free_Header(&header);
640 		if (r != ARCHIVE_OK)
641 			return (r);
642 		zip->entries_remaining = (size_t)zip->numFiles;
643 		zip->entry = zip->entries;
644 	} else {
645 		++zip->entry;
646 	}
647 	zip_entry = zip->entry;
648 
649 	if (zip->entries_remaining <= 0 || zip_entry == NULL)
650 		return ARCHIVE_EOF;
651 	--zip->entries_remaining;
652 
653 	zip->entry_offset = 0;
654 	zip->end_of_entry = 0;
655 	zip->entry_crc32 = crc32(0, NULL, 0);
656 
657 	/* Setup a string conversion for a filename. */
658 	if (zip->sconv == NULL) {
659 		zip->sconv = archive_string_conversion_from_charset(
660 		    &a->archive, "UTF-16LE", 1);
661 		if (zip->sconv == NULL)
662 			return (ARCHIVE_FATAL);
663 	}
664 
665 	/* Figure out if the entry is encrypted by looking at the folder
666 	   that is associated to the current 7zip entry. If the folder
667 	   has a coder with a _7Z_CRYPTO codec then the folder is encrypted.
668 	   Hence the entry must also be encrypted. */
669 	if (zip_entry && zip_entry->folderIndex < zip->si.ci.numFolders) {
670 		folder = &(zip->si.ci.folders[zip_entry->folderIndex]);
671 		for (fidx=0; folder && fidx<folder->numCoders; fidx++) {
672 			switch(folder->coders[fidx].codec) {
673 				case _7Z_CRYPTO_MAIN_ZIP:
674 				case _7Z_CRYPTO_RAR_29:
675 				case _7Z_CRYPTO_AES_256_SHA_256: {
676 					archive_entry_set_is_data_encrypted(entry, 1);
677 					zip->has_encrypted_entries = 1;
678 					break;
679 				}
680 			}
681 		}
682 	}
683 
684 	/* Now that we've checked for encryption, if there were still no
685 	 * encrypted entries found we can say for sure that there are none.
686 	 */
687 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
688 		zip->has_encrypted_entries = 0;
689 	}
690 
691 	if (archive_entry_copy_pathname_l(entry,
692 	    (const char *)zip_entry->utf16name,
693 	    zip_entry->name_len, zip->sconv) != 0) {
694 		if (errno == ENOMEM) {
695 			archive_set_error(&a->archive, ENOMEM,
696 			    "Can't allocate memory for Pathname");
697 			return (ARCHIVE_FATAL);
698 		}
699 		archive_set_error(&a->archive,
700 		    ARCHIVE_ERRNO_FILE_FORMAT,
701 		    "Pathname cannot be converted "
702 		    "from %s to current locale.",
703 		    archive_string_conversion_charset_name(zip->sconv));
704 		ret = ARCHIVE_WARN;
705 	}
706 
707 	/* Populate some additional entry fields: */
708 	archive_entry_set_mode(entry, zip_entry->mode);
709 	if (zip_entry->flg & MTIME_IS_SET)
710 		archive_entry_set_mtime(entry, zip_entry->mtime,
711 			zip_entry->mtime_ns);
712 	if (zip_entry->flg & CTIME_IS_SET)
713 		archive_entry_set_ctime(entry, zip_entry->ctime,
714 		    zip_entry->ctime_ns);
715 	if (zip_entry->flg & ATIME_IS_SET)
716 		archive_entry_set_atime(entry, zip_entry->atime,
717 		    zip_entry->atime_ns);
718 	if (zip_entry->ssIndex != (uint32_t)-1) {
719 		zip->entry_bytes_remaining =
720 		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
721 		archive_entry_set_size(entry, zip->entry_bytes_remaining);
722 	} else {
723 		zip->entry_bytes_remaining = 0;
724 		archive_entry_set_size(entry, 0);
725 	}
726 
727 	/* If there's no body, force read_data() to return EOF immediately. */
728 	if (zip->entry_bytes_remaining < 1)
729 		zip->end_of_entry = 1;
730 
731 	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
732 		unsigned char *symname = NULL;
733 		size_t symsize = 0;
734 
735 		/*
736 		 * Symbolic-name is recorded as its contents. We have to
737 		 * read the contents at this time.
738 		 */
739 		while (zip->entry_bytes_remaining > 0) {
740 			const void *buff;
741 			unsigned char *mem;
742 			size_t size;
743 			int64_t offset;
744 
745 			r = archive_read_format_7zip_read_data(a, &buff,
746 				&size, &offset);
747 			if (r < ARCHIVE_WARN) {
748 				free(symname);
749 				return (r);
750 			}
751 			mem = realloc(symname, symsize + size + 1);
752 			if (mem == NULL) {
753 				free(symname);
754 				archive_set_error(&a->archive, ENOMEM,
755 				    "Can't allocate memory for Symname");
756 				return (ARCHIVE_FATAL);
757 			}
758 			symname = mem;
759 			memcpy(symname+symsize, buff, size);
760 			symsize += size;
761 		}
762 		if (symsize == 0) {
763 			/* If there is no symname, handle it as a regular
764 			 * file. */
765 			zip_entry->mode &= ~AE_IFMT;
766 			zip_entry->mode |= AE_IFREG;
767 			archive_entry_set_mode(entry, zip_entry->mode);
768 		} else {
769 			symname[symsize] = '\0';
770 			archive_entry_copy_symlink(entry,
771 			    (const char *)symname);
772 		}
773 		free(symname);
774 		archive_entry_set_size(entry, 0);
775 	}
776 
777 	/* Set up a more descriptive format name. */
778 	sprintf(zip->format_name, "7-Zip");
779 	a->archive.archive_format_name = zip->format_name;
780 
781 	return (ret);
782 }
783 
784 static int
785 archive_read_format_7zip_read_data(struct archive_read *a,
786     const void **buff, size_t *size, int64_t *offset)
787 {
788 	struct _7zip *zip;
789 	ssize_t bytes;
790 	int ret = ARCHIVE_OK;
791 
792 	zip = (struct _7zip *)(a->format->data);
793 
794 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
795 		zip->has_encrypted_entries = 0;
796 	}
797 
798 	if (zip->pack_stream_bytes_unconsumed)
799 		read_consume(a);
800 
801 	*offset = zip->entry_offset;
802 	*size = 0;
803 	*buff = NULL;
804 	/*
805 	 * If we hit end-of-entry last time, clean up and return
806 	 * ARCHIVE_EOF this time.
807 	 */
808 	if (zip->end_of_entry)
809 		return (ARCHIVE_EOF);
810 
811 	bytes = read_stream(a, buff,
812 		(size_t)zip->entry_bytes_remaining, 0);
813 	if (bytes < 0)
814 		return ((int)bytes);
815 	if (bytes == 0) {
816 		archive_set_error(&a->archive,
817 		    ARCHIVE_ERRNO_FILE_FORMAT,
818 		    "Truncated 7-Zip file body");
819 		return (ARCHIVE_FATAL);
820 	}
821 	zip->entry_bytes_remaining -= bytes;
822 	if (zip->entry_bytes_remaining == 0)
823 		zip->end_of_entry = 1;
824 
825 	/* Update checksum */
826 	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
827 		zip->entry_crc32 = crc32(zip->entry_crc32, *buff,
828 		    (unsigned)bytes);
829 
830 	/* If we hit the end, swallow any end-of-data marker. */
831 	if (zip->end_of_entry) {
832 		/* Check computed CRC against file contents. */
833 		if ((zip->entry->flg & CRC32_IS_SET) &&
834 			zip->si.ss.digests[zip->entry->ssIndex] !=
835 		    zip->entry_crc32) {
836 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
837 			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
838 			    (unsigned long)zip->entry_crc32,
839 			    (unsigned long)zip->si.ss.digests[
840 			    		zip->entry->ssIndex]);
841 			ret = ARCHIVE_WARN;
842 		}
843 	}
844 
845 	*size = bytes;
846 	*offset = zip->entry_offset;
847 	zip->entry_offset += bytes;
848 
849 	return (ret);
850 }
851 
852 static int
853 archive_read_format_7zip_read_data_skip(struct archive_read *a)
854 {
855 	struct _7zip *zip;
856 	int64_t bytes_skipped;
857 
858 	zip = (struct _7zip *)(a->format->data);
859 
860 	if (zip->pack_stream_bytes_unconsumed)
861 		read_consume(a);
862 
863 	/* If we've already read to end of data, we're done. */
864 	if (zip->end_of_entry)
865 		return (ARCHIVE_OK);
866 
867 	/*
868 	 * If the length is at the beginning, we can skip the
869 	 * compressed data much more quickly.
870 	 */
871 	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
872 	if (bytes_skipped < 0)
873 		return (ARCHIVE_FATAL);
874 	zip->entry_bytes_remaining = 0;
875 
876 	/* This entry is finished and done. */
877 	zip->end_of_entry = 1;
878 	return (ARCHIVE_OK);
879 }
880 
881 static int
882 archive_read_format_7zip_cleanup(struct archive_read *a)
883 {
884 	struct _7zip *zip;
885 
886 	zip = (struct _7zip *)(a->format->data);
887 	free_StreamsInfo(&(zip->si));
888 	free(zip->entries);
889 	free(zip->entry_names);
890 	free_decompression(a, zip);
891 	free(zip->uncompressed_buffer);
892 	free(zip->sub_stream_buff[0]);
893 	free(zip->sub_stream_buff[1]);
894 	free(zip->sub_stream_buff[2]);
895 	free(zip->tmp_stream_buff);
896 	free(zip);
897 	(a->format->data) = NULL;
898 	return (ARCHIVE_OK);
899 }
900 
901 static void
902 read_consume(struct archive_read *a)
903 {
904 	struct _7zip *zip = (struct _7zip *)a->format->data;
905 
906 	if (zip->pack_stream_bytes_unconsumed) {
907 		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
908 		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
909 		zip->pack_stream_bytes_unconsumed = 0;
910 	}
911 }
912 
913 #ifdef HAVE_LZMA_H
914 
915 /*
916  * Set an error code and choose an error message for liblzma.
917  */
918 static void
919 set_error(struct archive_read *a, int ret)
920 {
921 
922 	switch (ret) {
923 	case LZMA_STREAM_END: /* Found end of stream. */
924 	case LZMA_OK: /* Decompressor made some progress. */
925 		break;
926 	case LZMA_MEM_ERROR:
927 		archive_set_error(&a->archive, ENOMEM,
928 		    "Lzma library error: Cannot allocate memory");
929 		break;
930 	case LZMA_MEMLIMIT_ERROR:
931 		archive_set_error(&a->archive, ENOMEM,
932 		    "Lzma library error: Out of memory");
933 		break;
934 	case LZMA_FORMAT_ERROR:
935 		archive_set_error(&a->archive,
936 		    ARCHIVE_ERRNO_MISC,
937 		    "Lzma library error: format not recognized");
938 		break;
939 	case LZMA_OPTIONS_ERROR:
940 		archive_set_error(&a->archive,
941 		    ARCHIVE_ERRNO_MISC,
942 		    "Lzma library error: Invalid options");
943 		break;
944 	case LZMA_DATA_ERROR:
945 		archive_set_error(&a->archive,
946 		    ARCHIVE_ERRNO_MISC,
947 		    "Lzma library error: Corrupted input data");
948 		break;
949 	case LZMA_BUF_ERROR:
950 		archive_set_error(&a->archive,
951 		    ARCHIVE_ERRNO_MISC,
952 		    "Lzma library error:  No progress is possible");
953 		break;
954 	default:
955 		/* Return an error. */
956 		archive_set_error(&a->archive,
957 		    ARCHIVE_ERRNO_MISC,
958 		    "Lzma decompression failed:  Unknown error");
959 		break;
960 	}
961 }
962 
963 #endif
964 
965 static unsigned long
966 decode_codec_id(const unsigned char *codecId, size_t id_size)
967 {
968 	unsigned i;
969 	unsigned long id = 0;
970 
971 	for (i = 0; i < id_size; i++) {
972 		id <<= 8;
973 		id += codecId[i];
974 	}
975 	return (id);
976 }
977 
978 static void *
979 ppmd_alloc(void *p, size_t size)
980 {
981 	(void)p;
982 	return malloc(size);
983 }
984 static void
985 ppmd_free(void *p, void *address)
986 {
987 	(void)p;
988 	free(address);
989 }
990 static Byte
991 ppmd_read(void *p)
992 {
993 	struct archive_read *a = ((IByteIn*)p)->a;
994 	struct _7zip *zip = (struct _7zip *)(a->format->data);
995 	Byte b;
996 
997 	if (zip->ppstream.avail_in == 0) {
998 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
999 		    "Truncated RAR file data");
1000 		zip->ppstream.overconsumed = 1;
1001 		return (0);
1002 	}
1003 	b = *zip->ppstream.next_in++;
1004 	zip->ppstream.avail_in--;
1005 	zip->ppstream.total_in++;
1006 	return (b);
1007 }
1008 
1009 static ISzAlloc g_szalloc = { ppmd_alloc, ppmd_free };
1010 
1011 static int
1012 init_decompression(struct archive_read *a, struct _7zip *zip,
1013     const struct _7z_coder *coder1, const struct _7z_coder *coder2)
1014 {
1015 	int r;
1016 
1017 	zip->codec = coder1->codec;
1018 	zip->codec2 = -1;
1019 
1020 	switch (zip->codec) {
1021 	case _7Z_COPY:
1022 	case _7Z_BZ2:
1023 	case _7Z_DEFLATE:
1024 	case _7Z_PPMD:
1025 		if (coder2 != NULL) {
1026 			if (coder2->codec != _7Z_X86 &&
1027 			    coder2->codec != _7Z_X86_BCJ2) {
1028 				archive_set_error(&a->archive,
1029 				    ARCHIVE_ERRNO_MISC,
1030 				    "Unsupported filter %lx for %lx",
1031 				    coder2->codec, coder1->codec);
1032 				return (ARCHIVE_FAILED);
1033 			}
1034 			zip->codec2 = coder2->codec;
1035 			zip->bcj_state = 0;
1036 			if (coder2->codec == _7Z_X86)
1037 				x86_Init(zip);
1038 		}
1039 		break;
1040 	default:
1041 		break;
1042 	}
1043 
1044 	switch (zip->codec) {
1045 	case _7Z_COPY:
1046 		break;
1047 
1048 	case _7Z_LZMA: case _7Z_LZMA2:
1049 #ifdef HAVE_LZMA_H
1050 #if LZMA_VERSION_MAJOR >= 5
1051 /* Effectively disable the limiter. */
1052 #define LZMA_MEMLIMIT   UINT64_MAX
1053 #else
1054 /* NOTE: This needs to check memory size which running system has. */
1055 #define LZMA_MEMLIMIT   (1U << 30)
1056 #endif
1057 	{
1058 		lzma_options_delta delta_opt;
1059 		lzma_filter filters[LZMA_FILTERS_MAX], *ff;
1060 		int fi = 0;
1061 
1062 		if (zip->lzstream_valid) {
1063 			lzma_end(&(zip->lzstream));
1064 			zip->lzstream_valid = 0;
1065 		}
1066 
1067 		/*
1068 		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
1069 		 * data made by 7-Zip because 7-Zip does not add End-Of-
1070 		 * Payload Marker(EOPM) at the end of LZMA compressed data,
1071 		 * and so liblzma cannot know the end of the compressed data
1072 		 * without EOPM. So consequently liblzma will not return last
1073 		 * three or four bytes of uncompressed data because
1074 		 * LZMA_FILTER_X86 filter does not handle input data if its
1075 		 * data size is less than five bytes. If liblzma detect EOPM
1076 		 * or know the uncompressed data size, liblzma will flush out
1077 		 * the remaining that three or four bytes of uncompressed
1078 		 * data. That is why we have to use our converting program
1079 		 * for BCJ+LZMA. If we were able to tell the uncompressed
1080 		 * size to liblzma when using lzma_raw_decoder() liblzma
1081 		 * could correctly deal with BCJ+LZMA. But unfortunately
1082 		 * there is no way to do that.
1083 		 * Discussion about this can be found at XZ Utils forum.
1084 		 */
1085 		if (coder2 != NULL) {
1086 			zip->codec2 = coder2->codec;
1087 
1088 			filters[fi].options = NULL;
1089 			switch (zip->codec2) {
1090 			case _7Z_X86:
1091 				if (zip->codec == _7Z_LZMA2) {
1092 					filters[fi].id = LZMA_FILTER_X86;
1093 					fi++;
1094 				} else
1095 					/* Use our filter. */
1096 					x86_Init(zip);
1097 				break;
1098 			case _7Z_X86_BCJ2:
1099 				/* Use our filter. */
1100 				zip->bcj_state = 0;
1101 				break;
1102 			case _7Z_DELTA:
1103 				filters[fi].id = LZMA_FILTER_DELTA;
1104 				memset(&delta_opt, 0, sizeof(delta_opt));
1105 				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1106 				delta_opt.dist = 1;
1107 				filters[fi].options = &delta_opt;
1108 				fi++;
1109 				break;
1110 			/* Following filters have not been tested yet. */
1111 			case _7Z_POWERPC:
1112 				filters[fi].id = LZMA_FILTER_POWERPC;
1113 				fi++;
1114 				break;
1115 			case _7Z_IA64:
1116 				filters[fi].id = LZMA_FILTER_IA64;
1117 				fi++;
1118 				break;
1119 			case _7Z_ARM:
1120 				filters[fi].id = LZMA_FILTER_ARM;
1121 				fi++;
1122 				break;
1123 			case _7Z_ARMTHUMB:
1124 				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1125 				fi++;
1126 				break;
1127 			case _7Z_SPARC:
1128 				filters[fi].id = LZMA_FILTER_SPARC;
1129 				fi++;
1130 				break;
1131 			default:
1132 				archive_set_error(&a->archive,
1133 				    ARCHIVE_ERRNO_MISC,
1134 				    "Unexpected codec ID: %lX", zip->codec2);
1135 				return (ARCHIVE_FAILED);
1136 			}
1137 		}
1138 
1139 		if (zip->codec == _7Z_LZMA2)
1140 			filters[fi].id = LZMA_FILTER_LZMA2;
1141 		else
1142 			filters[fi].id = LZMA_FILTER_LZMA1;
1143 		filters[fi].options = NULL;
1144 		ff = &filters[fi];
1145 		r = lzma_properties_decode(&filters[fi], NULL,
1146 		    coder1->properties, (size_t)coder1->propertiesSize);
1147 		if (r != LZMA_OK) {
1148 			set_error(a, r);
1149 			return (ARCHIVE_FAILED);
1150 		}
1151 		fi++;
1152 
1153 		filters[fi].id = LZMA_VLI_UNKNOWN;
1154 		filters[fi].options = NULL;
1155 		r = lzma_raw_decoder(&(zip->lzstream), filters);
1156 		free(ff->options);
1157 		if (r != LZMA_OK) {
1158 			set_error(a, r);
1159 			return (ARCHIVE_FAILED);
1160 		}
1161 		zip->lzstream_valid = 1;
1162 		zip->lzstream.total_in = 0;
1163 		zip->lzstream.total_out = 0;
1164 		break;
1165 	}
1166 #else
1167 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1168 		    "LZMA codec is unsupported");
1169 		return (ARCHIVE_FAILED);
1170 #endif
1171 	case _7Z_BZ2:
1172 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1173 		if (zip->bzstream_valid) {
1174 			BZ2_bzDecompressEnd(&(zip->bzstream));
1175 			zip->bzstream_valid = 0;
1176 		}
1177 		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1178 		if (r == BZ_MEM_ERROR)
1179 			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1180 		if (r != BZ_OK) {
1181 			int err = ARCHIVE_ERRNO_MISC;
1182 			const char *detail = NULL;
1183 			switch (r) {
1184 			case BZ_PARAM_ERROR:
1185 				detail = "invalid setup parameter";
1186 				break;
1187 			case BZ_MEM_ERROR:
1188 				err = ENOMEM;
1189 				detail = "out of memory";
1190 				break;
1191 			case BZ_CONFIG_ERROR:
1192 				detail = "mis-compiled library";
1193 				break;
1194 			}
1195 			archive_set_error(&a->archive, err,
1196 			    "Internal error initializing decompressor: %s",
1197 			    detail != NULL ? detail : "??");
1198 			zip->bzstream_valid = 0;
1199 			return (ARCHIVE_FAILED);
1200 		}
1201 		zip->bzstream_valid = 1;
1202 		zip->bzstream.total_in_lo32 = 0;
1203 		zip->bzstream.total_in_hi32 = 0;
1204 		zip->bzstream.total_out_lo32 = 0;
1205 		zip->bzstream.total_out_hi32 = 0;
1206 		break;
1207 #else
1208 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1209 		    "BZ2 codec is unsupported");
1210 		return (ARCHIVE_FAILED);
1211 #endif
1212 	case _7Z_DEFLATE:
1213 #ifdef HAVE_ZLIB_H
1214 		if (zip->stream_valid)
1215 			r = inflateReset(&(zip->stream));
1216 		else
1217 			r = inflateInit2(&(zip->stream),
1218 			    -15 /* Don't check for zlib header */);
1219 		if (r != Z_OK) {
1220 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1221 			    "Couldn't initialize zlib stream.");
1222 			return (ARCHIVE_FAILED);
1223 		}
1224 		zip->stream_valid = 1;
1225 		zip->stream.total_in = 0;
1226 		zip->stream.total_out = 0;
1227 		break;
1228 #else
1229 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1230 		    "DEFLATE codec is unsupported");
1231 		return (ARCHIVE_FAILED);
1232 #endif
1233 	case _7Z_PPMD:
1234 	{
1235 		unsigned order;
1236 		uint32_t msize;
1237 
1238 		if (zip->ppmd7_valid) {
1239 			__archive_ppmd7_functions.Ppmd7_Free(
1240 			    &zip->ppmd7_context, &g_szalloc);
1241 			zip->ppmd7_valid = 0;
1242 		}
1243 
1244 		if (coder1->propertiesSize < 5) {
1245 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1246 			    "Malformed PPMd parameter");
1247 			return (ARCHIVE_FAILED);
1248 		}
1249 		order = coder1->properties[0];
1250 		msize = archive_le32dec(&(coder1->properties[1]));
1251 		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1252 		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1253 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1254 			    "Malformed PPMd parameter");
1255 			return (ARCHIVE_FAILED);
1256 		}
1257 		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1258 		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1259 			&zip->ppmd7_context, msize, &g_szalloc);
1260 		if (r == 0) {
1261 			archive_set_error(&a->archive, ENOMEM,
1262 			    "Coludn't allocate memory for PPMd");
1263 			return (ARCHIVE_FATAL);
1264 		}
1265 		__archive_ppmd7_functions.Ppmd7_Init(
1266 			&zip->ppmd7_context, order);
1267 		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1268 			&zip->range_dec);
1269 		zip->ppmd7_valid = 1;
1270 		zip->ppmd7_stat = 0;
1271 		zip->ppstream.overconsumed = 0;
1272 		zip->ppstream.total_in = 0;
1273 		zip->ppstream.total_out = 0;
1274 		break;
1275 	}
1276 	case _7Z_X86:
1277 	case _7Z_X86_BCJ2:
1278 	case _7Z_POWERPC:
1279 	case _7Z_IA64:
1280 	case _7Z_ARM:
1281 	case _7Z_ARMTHUMB:
1282 	case _7Z_SPARC:
1283 	case _7Z_DELTA:
1284 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1285 		    "Unexpected codec ID: %lX", zip->codec);
1286 		return (ARCHIVE_FAILED);
1287 	case _7Z_CRYPTO_MAIN_ZIP:
1288 	case _7Z_CRYPTO_RAR_29:
1289 	case _7Z_CRYPTO_AES_256_SHA_256:
1290 		if (a->entry) {
1291 			archive_entry_set_is_metadata_encrypted(a->entry, 1);
1292 			archive_entry_set_is_data_encrypted(a->entry, 1);
1293 			zip->has_encrypted_entries = 1;
1294 		}
1295 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1296 		    "Crypto codec not supported yet (ID: 0x%lX)", zip->codec);
1297 		return (ARCHIVE_FAILED);
1298 	default:
1299 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1300 		    "Unknown codec ID: %lX", zip->codec);
1301 		return (ARCHIVE_FAILED);
1302 	}
1303 
1304 	return (ARCHIVE_OK);
1305 }
1306 
1307 static int
1308 decompress(struct archive_read *a, struct _7zip *zip,
1309     void *buff, size_t *outbytes, const void *b, size_t *used)
1310 {
1311 	const uint8_t *t_next_in;
1312 	uint8_t *t_next_out;
1313 	size_t o_avail_in, o_avail_out;
1314 	size_t t_avail_in, t_avail_out;
1315 	uint8_t *bcj2_next_out;
1316 	size_t bcj2_avail_out;
1317 	int r, ret = ARCHIVE_OK;
1318 
1319 	t_avail_in = o_avail_in = *used;
1320 	t_avail_out = o_avail_out = *outbytes;
1321 	t_next_in = b;
1322 	t_next_out = buff;
1323 
1324 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1325 		int i;
1326 
1327 		/* Do not copy out the BCJ remaining bytes when the output
1328 		 * buffer size is less than five bytes. */
1329 		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1330 			*used = 0;
1331 			*outbytes = 0;
1332 			return (ret);
1333 		}
1334 		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1335 			*t_next_out++ = zip->odd_bcj[i];
1336 			t_avail_out--;
1337 			zip->odd_bcj_size--;
1338 		}
1339 		if (o_avail_in == 0 || t_avail_out == 0) {
1340 			*used = o_avail_in - t_avail_in;
1341 			*outbytes = o_avail_out - t_avail_out;
1342 			if (o_avail_in == 0)
1343 				ret = ARCHIVE_EOF;
1344 			return (ret);
1345 		}
1346 	}
1347 
1348 	bcj2_next_out = t_next_out;
1349 	bcj2_avail_out = t_avail_out;
1350 	if (zip->codec2 == _7Z_X86_BCJ2) {
1351 		/*
1352 		 * Decord a remaining decompressed main stream for BCJ2.
1353 		 */
1354 		if (zip->tmp_stream_bytes_remaining) {
1355 			ssize_t bytes;
1356 			size_t remaining = zip->tmp_stream_bytes_remaining;
1357 			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1358 			if (bytes < 0) {
1359 				archive_set_error(&(a->archive),
1360 				    ARCHIVE_ERRNO_MISC,
1361 				    "BCJ2 conversion Failed");
1362 				return (ARCHIVE_FAILED);
1363 			}
1364 			zip->main_stream_bytes_remaining -=
1365 			    remaining - zip->tmp_stream_bytes_remaining;
1366 			t_avail_out -= bytes;
1367 			if (o_avail_in == 0 || t_avail_out == 0) {
1368 				*used = 0;
1369 				*outbytes = o_avail_out - t_avail_out;
1370 				if (o_avail_in == 0 &&
1371 				    zip->tmp_stream_bytes_remaining)
1372 					ret = ARCHIVE_EOF;
1373 				return (ret);
1374 			}
1375 			t_next_out += bytes;
1376 			bcj2_next_out = t_next_out;
1377 			bcj2_avail_out = t_avail_out;
1378 		}
1379 		t_next_out = zip->tmp_stream_buff;
1380 		t_avail_out = zip->tmp_stream_buff_size;
1381 	}
1382 
1383 	switch (zip->codec) {
1384 	case _7Z_COPY:
1385 	{
1386 		size_t bytes =
1387 		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1388 
1389 		memcpy(t_next_out, t_next_in, bytes);
1390 		t_avail_in -= bytes;
1391 		t_avail_out -= bytes;
1392 		if (o_avail_in == 0)
1393 			ret = ARCHIVE_EOF;
1394 		break;
1395 	}
1396 #ifdef HAVE_LZMA_H
1397 	case _7Z_LZMA: case _7Z_LZMA2:
1398 		zip->lzstream.next_in = t_next_in;
1399 		zip->lzstream.avail_in = t_avail_in;
1400 		zip->lzstream.next_out = t_next_out;
1401 		zip->lzstream.avail_out = t_avail_out;
1402 
1403 		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1404 		switch (r) {
1405 		case LZMA_STREAM_END: /* Found end of stream. */
1406 			lzma_end(&(zip->lzstream));
1407 			zip->lzstream_valid = 0;
1408 			ret = ARCHIVE_EOF;
1409 			break;
1410 		case LZMA_OK: /* Decompressor made some progress. */
1411 			break;
1412 		default:
1413 			archive_set_error(&(a->archive),
1414 			    ARCHIVE_ERRNO_MISC,
1415 				"Decompression failed(%d)",
1416 			    r);
1417 			return (ARCHIVE_FAILED);
1418 		}
1419 		t_avail_in = zip->lzstream.avail_in;
1420 		t_avail_out = zip->lzstream.avail_out;
1421 		break;
1422 #endif
1423 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1424 	case _7Z_BZ2:
1425 		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1426 		zip->bzstream.avail_in = t_avail_in;
1427 		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1428 		zip->bzstream.avail_out = t_avail_out;
1429 		r = BZ2_bzDecompress(&(zip->bzstream));
1430 		switch (r) {
1431 		case BZ_STREAM_END: /* Found end of stream. */
1432 			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1433 			case BZ_OK:
1434 				break;
1435 			default:
1436 				archive_set_error(&(a->archive),
1437 				    ARCHIVE_ERRNO_MISC,
1438 				    "Failed to clean up decompressor");
1439 				return (ARCHIVE_FAILED);
1440 			}
1441 			zip->bzstream_valid = 0;
1442 			ret = ARCHIVE_EOF;
1443 			break;
1444 		case BZ_OK: /* Decompressor made some progress. */
1445 			break;
1446 		default:
1447 			archive_set_error(&(a->archive),
1448 			    ARCHIVE_ERRNO_MISC,
1449 			    "bzip decompression failed");
1450 			return (ARCHIVE_FAILED);
1451 		}
1452 		t_avail_in = zip->bzstream.avail_in;
1453 		t_avail_out = zip->bzstream.avail_out;
1454 		break;
1455 #endif
1456 #ifdef HAVE_ZLIB_H
1457 	case _7Z_DEFLATE:
1458 		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1459 		zip->stream.avail_in = (uInt)t_avail_in;
1460 		zip->stream.next_out = t_next_out;
1461 		zip->stream.avail_out = (uInt)t_avail_out;
1462 		r = inflate(&(zip->stream), 0);
1463 		switch (r) {
1464 		case Z_STREAM_END: /* Found end of stream. */
1465 			ret = ARCHIVE_EOF;
1466 			break;
1467 		case Z_OK: /* Decompressor made some progress.*/
1468 			break;
1469 		default:
1470 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1471 			    "File decompression failed (%d)", r);
1472 			return (ARCHIVE_FAILED);
1473 		}
1474 		t_avail_in = zip->stream.avail_in;
1475 		t_avail_out = zip->stream.avail_out;
1476 		break;
1477 #endif
1478 	case _7Z_PPMD:
1479 	{
1480 		uint64_t flush_bytes;
1481 
1482 		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1483 		    t_avail_out <= 0) {
1484 			archive_set_error(&(a->archive),
1485 			    ARCHIVE_ERRNO_MISC,
1486 			    "Decompression internal error");
1487 			return (ARCHIVE_FAILED);
1488 		}
1489 		zip->ppstream.next_in = t_next_in;
1490 		zip->ppstream.avail_in = t_avail_in;
1491 		zip->ppstream.next_out = t_next_out;
1492 		zip->ppstream.avail_out = t_avail_out;
1493 		if (zip->ppmd7_stat == 0) {
1494 			zip->bytein.a = a;
1495 			zip->bytein.Read = &ppmd_read;
1496 			zip->range_dec.Stream = &zip->bytein;
1497 			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1498 				&(zip->range_dec));
1499 			if (r == 0) {
1500 				zip->ppmd7_stat = -1;
1501 				archive_set_error(&a->archive,
1502 				    ARCHIVE_ERRNO_MISC,
1503 				    "Failed to initialize PPMd range decorder");
1504 				return (ARCHIVE_FAILED);
1505 			}
1506 			if (zip->ppstream.overconsumed) {
1507 				zip->ppmd7_stat = -1;
1508 				return (ARCHIVE_FAILED);
1509 			}
1510 			zip->ppmd7_stat = 1;
1511 		}
1512 
1513 		if (t_avail_in == 0)
1514 			/* XXX Flush out remaining decoded data XXX */
1515 			flush_bytes = zip->folder_outbytes_remaining;
1516 		else
1517 			flush_bytes = 0;
1518 
1519 		do {
1520 			int sym;
1521 
1522 			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1523 				&(zip->ppmd7_context), &(zip->range_dec.p));
1524 			if (sym < 0) {
1525 				zip->ppmd7_stat = -1;
1526 				archive_set_error(&a->archive,
1527 				    ARCHIVE_ERRNO_FILE_FORMAT,
1528 				    "Failed to decode PPMd");
1529 				return (ARCHIVE_FAILED);
1530 			}
1531 			if (zip->ppstream.overconsumed) {
1532 				zip->ppmd7_stat = -1;
1533 				return (ARCHIVE_FAILED);
1534 			}
1535 			*zip->ppstream.next_out++ = (unsigned char)sym;
1536 			zip->ppstream.avail_out--;
1537 			zip->ppstream.total_out++;
1538 			if (flush_bytes)
1539 				flush_bytes--;
1540 		} while (zip->ppstream.avail_out &&
1541 			(zip->ppstream.avail_in || flush_bytes));
1542 
1543 		t_avail_in = (size_t)zip->ppstream.avail_in;
1544 		t_avail_out = (size_t)zip->ppstream.avail_out;
1545 		break;
1546 	}
1547 	default:
1548 		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1549 		    "Decompression internal error");
1550 		return (ARCHIVE_FAILED);
1551 	}
1552 	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1553 		return (ret);
1554 
1555 	*used = o_avail_in - t_avail_in;
1556 	*outbytes = o_avail_out - t_avail_out;
1557 
1558 	/*
1559 	 * Decord BCJ.
1560 	 */
1561 	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1562 		size_t l = x86_Convert(zip, buff, *outbytes);
1563 		zip->odd_bcj_size = *outbytes - l;
1564 		if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1565 		    o_avail_in && ret != ARCHIVE_EOF) {
1566 			memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1567 			    zip->odd_bcj_size);
1568 			*outbytes = l;
1569 		} else
1570 			zip->odd_bcj_size = 0;
1571 	}
1572 
1573 	/*
1574 	 * Decord BCJ2 with a decompressed main stream.
1575 	 */
1576 	if (zip->codec2 == _7Z_X86_BCJ2) {
1577 		ssize_t bytes;
1578 
1579 		zip->tmp_stream_bytes_avail =
1580 		    zip->tmp_stream_buff_size - t_avail_out;
1581 		if (zip->tmp_stream_bytes_avail >
1582 		      zip->main_stream_bytes_remaining)
1583 			zip->tmp_stream_bytes_avail =
1584 			    zip->main_stream_bytes_remaining;
1585 		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1586 		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1587 		if (bytes < 0) {
1588 			archive_set_error(&(a->archive),
1589 			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1590 			return (ARCHIVE_FAILED);
1591 		}
1592 		zip->main_stream_bytes_remaining -=
1593 		    zip->tmp_stream_bytes_avail
1594 		      - zip->tmp_stream_bytes_remaining;
1595 		bcj2_avail_out -= bytes;
1596 		*outbytes = o_avail_out - bcj2_avail_out;
1597 	}
1598 
1599 	return (ret);
1600 }
1601 
1602 static int
1603 free_decompression(struct archive_read *a, struct _7zip *zip)
1604 {
1605 	int r = ARCHIVE_OK;
1606 
1607 #if !defined(HAVE_ZLIB_H) &&\
1608 	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1609 	(void)a;/* UNUSED */
1610 #endif
1611 #ifdef HAVE_LZMA_H
1612 	if (zip->lzstream_valid)
1613 		lzma_end(&(zip->lzstream));
1614 #endif
1615 #if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1616 	if (zip->bzstream_valid) {
1617 		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1618 			archive_set_error(&a->archive,
1619 			    ARCHIVE_ERRNO_MISC,
1620 			    "Failed to clean up bzip2 decompressor");
1621 			r = ARCHIVE_FATAL;
1622 		}
1623 		zip->bzstream_valid = 0;
1624 	}
1625 #endif
1626 #ifdef HAVE_ZLIB_H
1627 	if (zip->stream_valid) {
1628 		if (inflateEnd(&(zip->stream)) != Z_OK) {
1629 			archive_set_error(&a->archive,
1630 			    ARCHIVE_ERRNO_MISC,
1631 			    "Failed to clean up zlib decompressor");
1632 			r = ARCHIVE_FATAL;
1633 		}
1634 		zip->stream_valid = 0;
1635 	}
1636 #endif
1637 	if (zip->ppmd7_valid) {
1638 		__archive_ppmd7_functions.Ppmd7_Free(
1639 			&zip->ppmd7_context, &g_szalloc);
1640 		zip->ppmd7_valid = 0;
1641 	}
1642 	return (r);
1643 }
1644 
1645 static int
1646 parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1647 {
1648 	const unsigned char *p;
1649 	unsigned char avail, mask;
1650 	int i;
1651 
1652 	if ((p = header_bytes(a, 1)) == NULL)
1653 		return (-1);
1654 	avail = *p;
1655 	mask = 0x80;
1656 	*val = 0;
1657 	for (i = 0; i < 8; i++) {
1658 		if (avail & mask) {
1659 			if ((p = header_bytes(a, 1)) == NULL)
1660 				return (-1);
1661 			*val |= ((uint64_t)*p) << (8 * i);
1662 			mask >>= 1;
1663 			continue;
1664 		}
1665 		*val += ((uint64_t)(avail & (mask -1))) << (8 * i);
1666 		break;
1667 	}
1668 	return (0);
1669 }
1670 
1671 static int
1672 read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1673 {
1674 	const unsigned char *p;
1675 	unsigned i, mask = 0, avail = 0;
1676 
1677 	for (i = 0; i < num; i++) {
1678 		if (mask == 0) {
1679 			if ((p = header_bytes(a, 1)) == NULL)
1680 				return (-1);
1681 			avail = *p;
1682 			mask = 0x80;
1683 		}
1684 		data[i] = (avail & mask)?1:0;
1685 		mask >>= 1;
1686 	}
1687 	return (0);
1688 }
1689 
1690 static void
1691 free_Digest(struct _7z_digests *d)
1692 {
1693 	free(d->defineds);
1694 	free(d->digests);
1695 }
1696 
1697 static int
1698 read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1699 {
1700 	const unsigned char *p;
1701 	unsigned i;
1702 
1703 	if (num == 0)
1704 		return (-1);
1705 	memset(d, 0, sizeof(*d));
1706 
1707 	d->defineds = malloc(num);
1708 	if (d->defineds == NULL)
1709 		return (-1);
1710 	/*
1711 	 * Read Bools.
1712 	 */
1713 	if ((p = header_bytes(a, 1)) == NULL)
1714 		return (-1);
1715 	if (*p == 0) {
1716 		if (read_Bools(a, d->defineds, num) < 0)
1717 			return (-1);
1718 	} else
1719 		/* All are defined */
1720 		memset(d->defineds, 1, num);
1721 
1722 	d->digests = calloc(num, sizeof(*d->digests));
1723 	if (d->digests == NULL)
1724 		return (-1);
1725 	for (i = 0; i < num; i++) {
1726 		if (d->defineds[i]) {
1727 			if ((p = header_bytes(a, 4)) == NULL)
1728 				return (-1);
1729 			d->digests[i] = archive_le32dec(p);
1730 		}
1731 	}
1732 
1733 	return (0);
1734 }
1735 
1736 static void
1737 free_PackInfo(struct _7z_pack_info *pi)
1738 {
1739 	free(pi->sizes);
1740 	free(pi->positions);
1741 	free_Digest(&(pi->digest));
1742 }
1743 
1744 static int
1745 read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1746 {
1747 	const unsigned char *p;
1748 	unsigned i;
1749 
1750 	memset(pi, 0, sizeof(*pi));
1751 
1752 	/*
1753 	 * Read PackPos.
1754 	 */
1755 	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1756 		return (-1);
1757 
1758 	/*
1759 	 * Read NumPackStreams.
1760 	 */
1761 	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1762 		return (-1);
1763 	if (pi->numPackStreams == 0)
1764 		return (-1);
1765 	if (UMAX_ENTRY < pi->numPackStreams)
1766 		return (-1);
1767 
1768 	/*
1769 	 * Read PackSizes[num]
1770 	 */
1771 	if ((p = header_bytes(a, 1)) == NULL)
1772 		return (-1);
1773 	if (*p == kEnd)
1774 		/* PackSizes[num] are not present. */
1775 		return (0);
1776 	if (*p != kSize)
1777 		return (-1);
1778 	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1779 	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1780 	if (pi->sizes == NULL || pi->positions == NULL)
1781 		return (-1);
1782 
1783 	for (i = 0; i < pi->numPackStreams; i++) {
1784 		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1785 			return (-1);
1786 	}
1787 
1788 	/*
1789 	 * Read PackStreamDigests[num]
1790 	 */
1791 	if ((p = header_bytes(a, 1)) == NULL)
1792 		return (-1);
1793 	if (*p == kEnd) {
1794 		/* PackStreamDigests[num] are not present. */
1795 		pi->digest.defineds =
1796 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1797 		pi->digest.digests =
1798 		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1799 		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1800 			return (-1);
1801 		return (0);
1802 	}
1803 
1804 	if (*p != kSize)
1805 		return (-1);
1806 
1807 	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1808 		return (-1);
1809 
1810 	/*
1811 	 *  Must be marked by kEnd.
1812 	 */
1813 	if ((p = header_bytes(a, 1)) == NULL)
1814 		return (-1);
1815 	if (*p != kEnd)
1816 		return (-1);
1817 	return (0);
1818 }
1819 
1820 static void
1821 free_Folder(struct _7z_folder *f)
1822 {
1823 	unsigned i;
1824 
1825 	if (f->coders) {
1826 		for (i = 0; i< f->numCoders; i++) {
1827 			free(f->coders[i].properties);
1828 		}
1829 		free(f->coders);
1830 	}
1831 	free(f->bindPairs);
1832 	free(f->packedStreams);
1833 	free(f->unPackSize);
1834 }
1835 
1836 static int
1837 read_Folder(struct archive_read *a, struct _7z_folder *f)
1838 {
1839 	struct _7zip *zip = (struct _7zip *)a->format->data;
1840 	const unsigned char *p;
1841 	uint64_t numInStreamsTotal = 0;
1842 	uint64_t numOutStreamsTotal = 0;
1843 	unsigned i;
1844 
1845 	memset(f, 0, sizeof(*f));
1846 
1847 	/*
1848 	 * Read NumCoders.
1849 	 */
1850 	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1851 		return (-1);
1852 	if (f->numCoders > 4)
1853 		/* Too many coders. */
1854 		return (-1);
1855 
1856 	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1857 	if (f->coders == NULL)
1858 		return (-1);
1859 	for (i = 0; i< f->numCoders; i++) {
1860 		size_t codec_size;
1861 		int simple, attr;
1862 
1863 		if ((p = header_bytes(a, 1)) == NULL)
1864 			return (-1);
1865 		/*
1866 		 * 0:3 CodecIdSize
1867 		 * 4:  0 - IsSimple
1868 		 *     1 - Is not Simple
1869 		 * 5:  0 - No Attributes
1870 		 *     1 - There are Attributes;
1871 		 * 7:  Must be zero.
1872 		 */
1873 		codec_size = *p & 0xf;
1874 		simple = (*p & 0x10)?0:1;
1875 		attr = *p & 0x20;
1876 		if (*p & 0x80)
1877 			return (-1);/* Not supported. */
1878 
1879 		/*
1880 		 * Read Decompression Method IDs.
1881 		 */
1882 		if ((p = header_bytes(a, codec_size)) == NULL)
1883 			return (-1);
1884 
1885 		f->coders[i].codec = decode_codec_id(p, codec_size);
1886 
1887 		if (simple) {
1888 			f->coders[i].numInStreams = 1;
1889 			f->coders[i].numOutStreams = 1;
1890 		} else {
1891 			if (parse_7zip_uint64(
1892 			    a, &(f->coders[i].numInStreams)) < 0)
1893 				return (-1);
1894 			if (UMAX_ENTRY < f->coders[i].numInStreams)
1895 				return (-1);
1896 			if (parse_7zip_uint64(
1897 			    a, &(f->coders[i].numOutStreams)) < 0)
1898 				return (-1);
1899 			if (UMAX_ENTRY < f->coders[i].numOutStreams)
1900 				return (-1);
1901 		}
1902 
1903 		if (attr) {
1904 			if (parse_7zip_uint64(
1905 			    a, &(f->coders[i].propertiesSize)) < 0)
1906 				return (-1);
1907 			if ((p = header_bytes(
1908 			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
1909 				return (-1);
1910 			f->coders[i].properties =
1911 			    malloc((size_t)f->coders[i].propertiesSize);
1912 			if (f->coders[i].properties == NULL)
1913 				return (-1);
1914 			memcpy(f->coders[i].properties, p,
1915 			    (size_t)f->coders[i].propertiesSize);
1916 		}
1917 
1918 		numInStreamsTotal += f->coders[i].numInStreams;
1919 		numOutStreamsTotal += f->coders[i].numOutStreams;
1920 	}
1921 
1922 	if (numOutStreamsTotal == 0 ||
1923 	    numInStreamsTotal < numOutStreamsTotal-1)
1924 		return (-1);
1925 
1926 	f->numBindPairs = numOutStreamsTotal - 1;
1927 	if (zip->header_bytes_remaining < f->numBindPairs)
1928 			return (-1);
1929 	if (f->numBindPairs > 0) {
1930 		f->bindPairs =
1931 			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
1932 		if (f->bindPairs == NULL)
1933 			return (-1);
1934 	} else
1935 		f->bindPairs = NULL;
1936 	for (i = 0; i < f->numBindPairs; i++) {
1937 		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
1938 			return (-1);
1939 		if (UMAX_ENTRY < f->bindPairs[i].inIndex)
1940 			return (-1);
1941 		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
1942 			return (-1);
1943 		if (UMAX_ENTRY < f->bindPairs[i].outIndex)
1944 			return (-1);
1945 	}
1946 
1947 	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
1948 	f->packedStreams =
1949 	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
1950 	if (f->packedStreams == NULL)
1951 		return (-1);
1952 	if (f->numPackedStreams == 1) {
1953 		for (i = 0; i < numInStreamsTotal; i++) {
1954 			unsigned j;
1955 			for (j = 0; j < f->numBindPairs; j++) {
1956 				if (f->bindPairs[j].inIndex == i)
1957 					break;
1958 			}
1959 			if (j == f->numBindPairs)
1960 				break;
1961 		}
1962 		if (i == numInStreamsTotal)
1963 			return (-1);
1964 		f->packedStreams[0] = i;
1965 	} else {
1966 		for (i = 0; i < f->numPackedStreams; i++) {
1967 			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
1968 				return (-1);
1969 			if (UMAX_ENTRY < f->packedStreams[i])
1970 				return (-1);
1971 		}
1972 	}
1973 	f->numInStreams = numInStreamsTotal;
1974 	f->numOutStreams = numOutStreamsTotal;
1975 
1976 	return (0);
1977 }
1978 
1979 static void
1980 free_CodersInfo(struct _7z_coders_info *ci)
1981 {
1982 	unsigned i;
1983 
1984 	if (ci->folders) {
1985 		for (i = 0; i < ci->numFolders; i++)
1986 			free_Folder(&(ci->folders[i]));
1987 		free(ci->folders);
1988 	}
1989 }
1990 
1991 static int
1992 read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
1993 {
1994 	const unsigned char *p;
1995 	struct _7z_digests digest;
1996 	unsigned i;
1997 
1998 	memset(ci, 0, sizeof(*ci));
1999 	memset(&digest, 0, sizeof(digest));
2000 
2001 	if ((p = header_bytes(a, 1)) == NULL)
2002 		goto failed;
2003 	if (*p != kFolder)
2004 		goto failed;
2005 
2006 	/*
2007 	 * Read NumFolders.
2008 	 */
2009 	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
2010 		goto failed;
2011 	if (UMAX_ENTRY < ci->numFolders)
2012 		return (-1);
2013 
2014 	/*
2015 	 * Read External.
2016 	 */
2017 	if ((p = header_bytes(a, 1)) == NULL)
2018 		goto failed;
2019 	switch (*p) {
2020 	case 0:
2021 		ci->folders =
2022 			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
2023 		if (ci->folders == NULL)
2024 			return (-1);
2025 		for (i = 0; i < ci->numFolders; i++) {
2026 			if (read_Folder(a, &(ci->folders[i])) < 0)
2027 				goto failed;
2028 		}
2029 		break;
2030 	case 1:
2031 		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
2032 			return (-1);
2033 		if (UMAX_ENTRY < ci->dataStreamIndex)
2034 			return (-1);
2035 		if (ci->numFolders > 0) {
2036 			archive_set_error(&a->archive, -1,
2037 			    "Malformed 7-Zip archive");
2038 			goto failed;
2039 		}
2040 		break;
2041 	default:
2042 		archive_set_error(&a->archive, -1,
2043 		    "Malformed 7-Zip archive");
2044 		goto failed;
2045 	}
2046 
2047 	if ((p = header_bytes(a, 1)) == NULL)
2048 		goto failed;
2049 	if (*p != kCodersUnPackSize)
2050 		goto failed;
2051 
2052 	for (i = 0; i < ci->numFolders; i++) {
2053 		struct _7z_folder *folder = &(ci->folders[i]);
2054 		unsigned j;
2055 
2056 		folder->unPackSize =
2057 		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
2058 		if (folder->unPackSize == NULL)
2059 			goto failed;
2060 		for (j = 0; j < folder->numOutStreams; j++) {
2061 			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
2062 				goto failed;
2063 		}
2064 	}
2065 
2066 	/*
2067 	 * Read CRCs.
2068 	 */
2069 	if ((p = header_bytes(a, 1)) == NULL)
2070 		goto failed;
2071 	if (*p == kEnd)
2072 		return (0);
2073 	if (*p != kCRC)
2074 		goto failed;
2075 	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
2076 		goto failed;
2077 	for (i = 0; i < ci->numFolders; i++) {
2078 		ci->folders[i].digest_defined = digest.defineds[i];
2079 		ci->folders[i].digest = digest.digests[i];
2080 	}
2081 
2082 	/*
2083 	 *  Must be kEnd.
2084 	 */
2085 	if ((p = header_bytes(a, 1)) == NULL)
2086 		goto failed;
2087 	if (*p != kEnd)
2088 		goto failed;
2089 	free_Digest(&digest);
2090 	return (0);
2091 failed:
2092 	free_Digest(&digest);
2093 	return (-1);
2094 }
2095 
2096 static uint64_t
2097 folder_uncompressed_size(struct _7z_folder *f)
2098 {
2099 	int n = (int)f->numOutStreams;
2100 	unsigned pairs = (unsigned)f->numBindPairs;
2101 
2102 	while (--n >= 0) {
2103 		unsigned i;
2104 		for (i = 0; i < pairs; i++) {
2105 			if (f->bindPairs[i].outIndex == (uint64_t)n)
2106 				break;
2107 		}
2108 		if (i >= pairs)
2109 			return (f->unPackSize[n]);
2110 	}
2111 	return (0);
2112 }
2113 
2114 static void
2115 free_SubStreamsInfo(struct _7z_substream_info *ss)
2116 {
2117 	free(ss->unpackSizes);
2118 	free(ss->digestsDefined);
2119 	free(ss->digests);
2120 }
2121 
2122 static int
2123 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2124     struct _7z_folder *f, size_t numFolders)
2125 {
2126 	const unsigned char *p;
2127 	uint64_t *usizes;
2128 	size_t unpack_streams;
2129 	int type;
2130 	unsigned i;
2131 	uint32_t numDigests;
2132 
2133 	memset(ss, 0, sizeof(*ss));
2134 
2135 	for (i = 0; i < numFolders; i++)
2136 		f[i].numUnpackStreams = 1;
2137 
2138 	if ((p = header_bytes(a, 1)) == NULL)
2139 		return (-1);
2140 	type = *p;
2141 
2142 	if (type == kNumUnPackStream) {
2143 		unpack_streams = 0;
2144 		for (i = 0; i < numFolders; i++) {
2145 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2146 				return (-1);
2147 			if (UMAX_ENTRY < f[i].numUnpackStreams)
2148 				return (-1);
2149 			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
2150 				return (-1);
2151 			}
2152 			unpack_streams += (size_t)f[i].numUnpackStreams;
2153 		}
2154 		if ((p = header_bytes(a, 1)) == NULL)
2155 			return (-1);
2156 		type = *p;
2157 	} else
2158 		unpack_streams = numFolders;
2159 
2160 	ss->unpack_streams = unpack_streams;
2161 	if (unpack_streams) {
2162 		ss->unpackSizes = calloc(unpack_streams,
2163 		    sizeof(*ss->unpackSizes));
2164 		ss->digestsDefined = calloc(unpack_streams,
2165 		    sizeof(*ss->digestsDefined));
2166 		ss->digests = calloc(unpack_streams,
2167 		    sizeof(*ss->digests));
2168 		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2169 		    ss->digests == NULL)
2170 			return (-1);
2171 	}
2172 
2173 	usizes = ss->unpackSizes;
2174 	for (i = 0; i < numFolders; i++) {
2175 		unsigned pack;
2176 		uint64_t sum;
2177 
2178 		if (f[i].numUnpackStreams == 0)
2179 			continue;
2180 
2181 		sum = 0;
2182 		if (type == kSize) {
2183 			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2184 				if (parse_7zip_uint64(a, usizes) < 0)
2185 					return (-1);
2186 				sum += *usizes++;
2187 			}
2188 		}
2189 		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2190 	}
2191 
2192 	if (type == kSize) {
2193 		if ((p = header_bytes(a, 1)) == NULL)
2194 			return (-1);
2195 		type = *p;
2196 	}
2197 
2198 	for (i = 0; i < unpack_streams; i++) {
2199 		ss->digestsDefined[i] = 0;
2200 		ss->digests[i] = 0;
2201 	}
2202 
2203 	numDigests = 0;
2204 	for (i = 0; i < numFolders; i++) {
2205 		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2206 			numDigests += (uint32_t)f[i].numUnpackStreams;
2207 	}
2208 
2209 	if (type == kCRC) {
2210 		struct _7z_digests tmpDigests;
2211 		unsigned char *digestsDefined = ss->digestsDefined;
2212 		uint32_t * digests = ss->digests;
2213 		int di = 0;
2214 
2215 		memset(&tmpDigests, 0, sizeof(tmpDigests));
2216 		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2217 			free_Digest(&tmpDigests);
2218 			return (-1);
2219 		}
2220 		for (i = 0; i < numFolders; i++) {
2221 			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2222 				*digestsDefined++ = 1;
2223 				*digests++ = f[i].digest;
2224 			} else {
2225 				unsigned j;
2226 
2227 				for (j = 0; j < f[i].numUnpackStreams;
2228 				    j++, di++) {
2229 					*digestsDefined++ =
2230 					    tmpDigests.defineds[di];
2231 					*digests++ =
2232 					    tmpDigests.digests[di];
2233 				}
2234 			}
2235 		}
2236 		free_Digest(&tmpDigests);
2237 		if ((p = header_bytes(a, 1)) == NULL)
2238 			return (-1);
2239 		type = *p;
2240 	}
2241 
2242 	/*
2243 	 *  Must be kEnd.
2244 	 */
2245 	if (type != kEnd)
2246 		return (-1);
2247 	return (0);
2248 }
2249 
2250 static void
2251 free_StreamsInfo(struct _7z_stream_info *si)
2252 {
2253 	free_PackInfo(&(si->pi));
2254 	free_CodersInfo(&(si->ci));
2255 	free_SubStreamsInfo(&(si->ss));
2256 }
2257 
2258 static int
2259 read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2260 {
2261 	struct _7zip *zip = (struct _7zip *)a->format->data;
2262 	const unsigned char *p;
2263 	unsigned i;
2264 
2265 	memset(si, 0, sizeof(*si));
2266 
2267 	if ((p = header_bytes(a, 1)) == NULL)
2268 		return (-1);
2269 	if (*p == kPackInfo) {
2270 		uint64_t packPos;
2271 
2272 		if (read_PackInfo(a, &(si->pi)) < 0)
2273 			return (-1);
2274 
2275 		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2276 			return (-1);
2277 		/*
2278 		 * Calculate packed stream positions.
2279 		 */
2280 		packPos = si->pi.pos;
2281 		for (i = 0; i < si->pi.numPackStreams; i++) {
2282 			si->pi.positions[i] = packPos;
2283 			packPos += si->pi.sizes[i];
2284 			if (packPos > zip->header_offset)
2285 				return (-1);
2286 		}
2287 		if ((p = header_bytes(a, 1)) == NULL)
2288 			return (-1);
2289 	}
2290 	if (*p == kUnPackInfo) {
2291 		uint32_t packIndex;
2292 		struct _7z_folder *f;
2293 
2294 		if (read_CodersInfo(a, &(si->ci)) < 0)
2295 			return (-1);
2296 
2297 		/*
2298 		 * Calculate packed stream indexes.
2299 		 */
2300 		packIndex = 0;
2301 		f = si->ci.folders;
2302 		for (i = 0; i < si->ci.numFolders; i++) {
2303 			f[i].packIndex = packIndex;
2304 			packIndex += (uint32_t)f[i].numPackedStreams;
2305 			if (packIndex > si->pi.numPackStreams)
2306 				return (-1);
2307 		}
2308 		if ((p = header_bytes(a, 1)) == NULL)
2309 			return (-1);
2310 	}
2311 
2312 	if (*p == kSubStreamsInfo) {
2313 		if (read_SubStreamsInfo(a, &(si->ss),
2314 		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2315 			return (-1);
2316 		if ((p = header_bytes(a, 1)) == NULL)
2317 			return (-1);
2318 	}
2319 
2320 	/*
2321 	 *  Must be kEnd.
2322 	 */
2323 	if (*p != kEnd)
2324 		return (-1);
2325 	return (0);
2326 }
2327 
2328 static void
2329 free_Header(struct _7z_header_info *h)
2330 {
2331 	free(h->emptyStreamBools);
2332 	free(h->emptyFileBools);
2333 	free(h->antiBools);
2334 	free(h->attrBools);
2335 }
2336 
2337 static int
2338 read_Header(struct archive_read *a, struct _7z_header_info *h,
2339     int check_header_id)
2340 {
2341 	struct _7zip *zip = (struct _7zip *)a->format->data;
2342 	const unsigned char *p;
2343 	struct _7z_folder *folders;
2344 	struct _7z_stream_info *si = &(zip->si);
2345 	struct _7zip_entry *entries;
2346 	uint32_t folderIndex, indexInFolder;
2347 	unsigned i;
2348 	int eindex, empty_streams, sindex;
2349 
2350 	if (check_header_id) {
2351 		/*
2352 		 * Read Header.
2353 		 */
2354 		if ((p = header_bytes(a, 1)) == NULL)
2355 			return (-1);
2356 		if (*p != kHeader)
2357 			return (-1);
2358 	}
2359 
2360 	/*
2361 	 * Read ArchiveProperties.
2362 	 */
2363 	if ((p = header_bytes(a, 1)) == NULL)
2364 		return (-1);
2365 	if (*p == kArchiveProperties) {
2366 		for (;;) {
2367 			uint64_t size;
2368 			if ((p = header_bytes(a, 1)) == NULL)
2369 				return (-1);
2370 			if (*p == 0)
2371 				break;
2372 			if (parse_7zip_uint64(a, &size) < 0)
2373 				return (-1);
2374 		}
2375 		if ((p = header_bytes(a, 1)) == NULL)
2376 			return (-1);
2377 	}
2378 
2379 	/*
2380 	 * Read MainStreamsInfo.
2381 	 */
2382 	if (*p == kMainStreamsInfo) {
2383 		if (read_StreamsInfo(a, &(zip->si)) < 0)
2384 			return (-1);
2385 		if ((p = header_bytes(a, 1)) == NULL)
2386 			return (-1);
2387 	}
2388 	if (*p == kEnd)
2389 		return (0);
2390 
2391 	/*
2392 	 * Read FilesInfo.
2393 	 */
2394 	if (*p != kFilesInfo)
2395 		return (-1);
2396 
2397 	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2398 		return (-1);
2399 	if (UMAX_ENTRY < zip->numFiles)
2400 		return (-1);
2401 
2402 	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2403 	if (zip->entries == NULL)
2404 		return (-1);
2405 	entries = zip->entries;
2406 
2407 	empty_streams = 0;
2408 	for (;;) {
2409 		int type;
2410 		uint64_t size;
2411 		size_t ll;
2412 
2413 		if ((p = header_bytes(a, 1)) == NULL)
2414 			return (-1);
2415 		type = *p;
2416 		if (type == kEnd)
2417 			break;
2418 
2419 		if (parse_7zip_uint64(a, &size) < 0)
2420 			return (-1);
2421 		if (zip->header_bytes_remaining < size)
2422 			return (-1);
2423 		ll = (size_t)size;
2424 
2425 		switch (type) {
2426 		case kEmptyStream:
2427 			if (h->emptyStreamBools != NULL)
2428 				return (-1);
2429 			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2430 			    sizeof(*h->emptyStreamBools));
2431 			if (h->emptyStreamBools == NULL)
2432 				return (-1);
2433 			if (read_Bools(
2434 			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2435 				return (-1);
2436 			empty_streams = 0;
2437 			for (i = 0; i < zip->numFiles; i++) {
2438 				if (h->emptyStreamBools[i])
2439 					empty_streams++;
2440 			}
2441 			break;
2442 		case kEmptyFile:
2443 			if (empty_streams <= 0) {
2444 				/* Unexcepted sequence. Skip this. */
2445 				if (header_bytes(a, ll) == NULL)
2446 					return (-1);
2447 				break;
2448 			}
2449 			if (h->emptyFileBools != NULL)
2450 				return (-1);
2451 			h->emptyFileBools = calloc(empty_streams,
2452 			    sizeof(*h->emptyFileBools));
2453 			if (h->emptyFileBools == NULL)
2454 				return (-1);
2455 			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2456 				return (-1);
2457 			break;
2458 		case kAnti:
2459 			if (empty_streams <= 0) {
2460 				/* Unexcepted sequence. Skip this. */
2461 				if (header_bytes(a, ll) == NULL)
2462 					return (-1);
2463 				break;
2464 			}
2465 			if (h->antiBools != NULL)
2466 				return (-1);
2467 			h->antiBools = calloc(empty_streams,
2468 			    sizeof(*h->antiBools));
2469 			if (h->antiBools == NULL)
2470 				return (-1);
2471 			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2472 				return (-1);
2473 			break;
2474 		case kCTime:
2475 		case kATime:
2476 		case kMTime:
2477 			if (read_Times(a, h, type) < 0)
2478 				return (-1);
2479 			break;
2480 		case kName:
2481 		{
2482 			unsigned char *np;
2483 			size_t nl, nb;
2484 
2485 			/* Skip one byte. */
2486 			if ((p = header_bytes(a, 1)) == NULL)
2487 				return (-1);
2488 			ll--;
2489 
2490 			if ((ll & 1) || ll < zip->numFiles * 4)
2491 				return (-1);
2492 
2493 			if (zip->entry_names != NULL)
2494 				return (-1);
2495 			zip->entry_names = malloc(ll);
2496 			if (zip->entry_names == NULL)
2497 				return (-1);
2498 			np = zip->entry_names;
2499 			nb = ll;
2500 			/*
2501 			 * Copy whole file names.
2502 			 * NOTE: This loop prevents from expanding
2503 			 * the uncompressed buffer in order not to
2504 			 * use extra memory resource.
2505 			 */
2506 			while (nb) {
2507 				size_t b;
2508 				if (nb > UBUFF_SIZE)
2509 					b = UBUFF_SIZE;
2510 				else
2511 					b = nb;
2512 				if ((p = header_bytes(a, b)) == NULL)
2513 					return (-1);
2514 				memcpy(np, p, b);
2515 				np += b;
2516 				nb -= b;
2517 			}
2518 			np = zip->entry_names;
2519 			nl = ll;
2520 
2521 			for (i = 0; i < zip->numFiles; i++) {
2522 				entries[i].utf16name = np;
2523 #if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2524 				entries[i].wname = (wchar_t *)np;
2525 #endif
2526 
2527 				/* Find a terminator. */
2528 				while (nl >= 2 && (np[0] || np[1])) {
2529 					np += 2;
2530 					nl -= 2;
2531 				}
2532 				if (nl < 2)
2533 					return (-1);/* Terminator not found */
2534 				entries[i].name_len = np - entries[i].utf16name;
2535 				np += 2;
2536 				nl -= 2;
2537 			}
2538 			break;
2539 		}
2540 		case kAttributes:
2541 		{
2542 			int allAreDefined;
2543 
2544 			if ((p = header_bytes(a, 2)) == NULL)
2545 				return (-1);
2546 			allAreDefined = *p;
2547 			if (h->attrBools != NULL)
2548 				return (-1);
2549 			h->attrBools = calloc((size_t)zip->numFiles,
2550 			    sizeof(*h->attrBools));
2551 			if (h->attrBools == NULL)
2552 				return (-1);
2553 			if (allAreDefined)
2554 				memset(h->attrBools, 1, (size_t)zip->numFiles);
2555 			else {
2556 				if (read_Bools(a, h->attrBools,
2557 				      (size_t)zip->numFiles) < 0)
2558 					return (-1);
2559 			}
2560 			for (i = 0; i < zip->numFiles; i++) {
2561 				if (h->attrBools[i]) {
2562 					if ((p = header_bytes(a, 4)) == NULL)
2563 						return (-1);
2564 					entries[i].attr = archive_le32dec(p);
2565 				}
2566 			}
2567 			break;
2568 		}
2569 		case kDummy:
2570 			if (ll == 0)
2571 				break;
2572 		default:
2573 			if (header_bytes(a, ll) == NULL)
2574 				return (-1);
2575 			break;
2576 		}
2577 	}
2578 
2579 	/*
2580 	 * Set up entry's attributes.
2581 	 */
2582 	folders = si->ci.folders;
2583 	eindex = sindex = 0;
2584 	folderIndex = indexInFolder = 0;
2585 	for (i = 0; i < zip->numFiles; i++) {
2586 		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2587 			entries[i].flg |= HAS_STREAM;
2588 		/* The high 16 bits of attributes is a posix file mode. */
2589 		entries[i].mode = entries[i].attr >> 16;
2590 		if (entries[i].flg & HAS_STREAM) {
2591 			if ((size_t)sindex >= si->ss.unpack_streams)
2592 				return (-1);
2593 			if (entries[i].mode == 0)
2594 				entries[i].mode = AE_IFREG | 0666;
2595 			if (si->ss.digestsDefined[sindex])
2596 				entries[i].flg |= CRC32_IS_SET;
2597 			entries[i].ssIndex = sindex;
2598 			sindex++;
2599 		} else {
2600 			int dir;
2601 			if (h->emptyFileBools == NULL)
2602 				dir = 1;
2603 			else {
2604 				if (h->emptyFileBools[eindex])
2605 					dir = 0;
2606 				else
2607 					dir = 1;
2608 				eindex++;
2609 			}
2610 			if (entries[i].mode == 0) {
2611 				if (dir)
2612 					entries[i].mode = AE_IFDIR | 0777;
2613 				else
2614 					entries[i].mode = AE_IFREG | 0666;
2615 			} else if (dir &&
2616 			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2617 				entries[i].mode &= ~AE_IFMT;
2618 				entries[i].mode |= AE_IFDIR;
2619 			}
2620 			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2621 			    entries[i].name_len >= 2 &&
2622 			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2623 			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2624 				entries[i].utf16name[entries[i].name_len] = '/';
2625 				entries[i].utf16name[entries[i].name_len+1] = 0;
2626 				entries[i].name_len += 2;
2627 			}
2628 			entries[i].ssIndex = -1;
2629 		}
2630 		if (entries[i].attr & 0x01)
2631 			entries[i].mode &= ~0222;/* Read only. */
2632 
2633 		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2634 			/*
2635 			 * The entry is an empty file or a directory file,
2636 			 * those both have no contents.
2637 			 */
2638 			entries[i].folderIndex = -1;
2639 			continue;
2640 		}
2641 		if (indexInFolder == 0) {
2642 			for (;;) {
2643 				if (folderIndex >= si->ci.numFolders)
2644 					return (-1);
2645 				if (folders[folderIndex].numUnpackStreams)
2646 					break;
2647 				folderIndex++;
2648 			}
2649 		}
2650 		entries[i].folderIndex = folderIndex;
2651 		if ((entries[i].flg & HAS_STREAM) == 0)
2652 			continue;
2653 		indexInFolder++;
2654 		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2655 			folderIndex++;
2656 			indexInFolder = 0;
2657 		}
2658 	}
2659 
2660 	return (0);
2661 }
2662 
2663 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2664 static void
2665 fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2666 {
2667 
2668 	if (fileTime >= EPOC_TIME) {
2669 		fileTime -= EPOC_TIME;
2670 		/* milli seconds base */
2671 		*timep = (time_t)(fileTime / 10000000);
2672 		/* nano seconds base */
2673 		*ns = (long)(fileTime % 10000000) * 100;
2674 	} else {
2675 		*timep = 0;
2676 		*ns = 0;
2677 	}
2678 }
2679 
2680 static int
2681 read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2682 {
2683 	struct _7zip *zip = (struct _7zip *)a->format->data;
2684 	const unsigned char *p;
2685 	struct _7zip_entry *entries = zip->entries;
2686 	unsigned char *timeBools;
2687 	int allAreDefined;
2688 	unsigned i;
2689 
2690 	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2691 	if (timeBools == NULL)
2692 		return (-1);
2693 
2694 	/* Read allAreDefined. */
2695 	if ((p = header_bytes(a, 1)) == NULL)
2696 		goto failed;
2697 	allAreDefined = *p;
2698 	if (allAreDefined)
2699 		memset(timeBools, 1, (size_t)zip->numFiles);
2700 	else {
2701 		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2702 			goto failed;
2703 	}
2704 
2705 	/* Read external. */
2706 	if ((p = header_bytes(a, 1)) == NULL)
2707 		goto failed;
2708 	if (*p) {
2709 		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2710 			goto failed;
2711 		if (UMAX_ENTRY < h->dataIndex)
2712 			goto failed;
2713 	}
2714 
2715 	for (i = 0; i < zip->numFiles; i++) {
2716 		if (!timeBools[i])
2717 			continue;
2718 		if ((p = header_bytes(a, 8)) == NULL)
2719 			goto failed;
2720 		switch (type) {
2721 		case kCTime:
2722 			fileTimeToUtc(archive_le64dec(p),
2723 			    &(entries[i].ctime),
2724 			    &(entries[i].ctime_ns));
2725 			entries[i].flg |= CTIME_IS_SET;
2726 			break;
2727 		case kATime:
2728 			fileTimeToUtc(archive_le64dec(p),
2729 			    &(entries[i].atime),
2730 			    &(entries[i].atime_ns));
2731 			entries[i].flg |= ATIME_IS_SET;
2732 			break;
2733 		case kMTime:
2734 			fileTimeToUtc(archive_le64dec(p),
2735 			    &(entries[i].mtime),
2736 			    &(entries[i].mtime_ns));
2737 			entries[i].flg |= MTIME_IS_SET;
2738 			break;
2739 		}
2740 	}
2741 
2742 	free(timeBools);
2743 	return (0);
2744 failed:
2745 	free(timeBools);
2746 	return (-1);
2747 }
2748 
2749 static int
2750 decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2751 {
2752 	struct _7zip *zip = (struct _7zip *)a->format->data;
2753 
2754 	errno = 0;
2755 	if (read_StreamsInfo(a, si) < 0) {
2756 		if (errno == ENOMEM)
2757 			archive_set_error(&a->archive, -1,
2758 			    "Couldn't allocate memory");
2759 		else
2760 			archive_set_error(&a->archive, -1,
2761 			    "Malformed 7-Zip archive");
2762 		return (ARCHIVE_FATAL);
2763 	}
2764 
2765 	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2766 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2767 		return (ARCHIVE_FATAL);
2768 	}
2769 
2770 	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2771 	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2772 	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2773 		archive_set_error(&a->archive, -1, "Malformed Header offset");
2774 		return (ARCHIVE_FATAL);
2775 	}
2776 
2777 	return (ARCHIVE_OK);
2778 }
2779 
2780 static const unsigned char *
2781 header_bytes(struct archive_read *a, size_t rbytes)
2782 {
2783 	struct _7zip *zip = (struct _7zip *)a->format->data;
2784 	const unsigned char *p;
2785 
2786 	if (zip->header_bytes_remaining < rbytes)
2787 		return (NULL);
2788 	if (zip->pack_stream_bytes_unconsumed)
2789 		read_consume(a);
2790 
2791 	if (zip->header_is_encoded == 0) {
2792 		p = __archive_read_ahead(a, rbytes, NULL);
2793 		if (p == NULL)
2794 			return (NULL);
2795 		zip->header_bytes_remaining -= rbytes;
2796 		zip->pack_stream_bytes_unconsumed = rbytes;
2797 	} else {
2798 		const void *buff;
2799 		ssize_t bytes;
2800 
2801 		bytes = read_stream(a, &buff, rbytes, rbytes);
2802 		if (bytes <= 0)
2803 			return (NULL);
2804 		zip->header_bytes_remaining -= bytes;
2805 		p = buff;
2806 	}
2807 
2808 	/* Update checksum */
2809 	zip->header_crc32 = crc32(zip->header_crc32, p, (unsigned)rbytes);
2810 	return (p);
2811 }
2812 
2813 static int
2814 slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2815     struct _7z_header_info *header)
2816 {
2817 	const unsigned char *p;
2818 	uint64_t next_header_offset;
2819 	uint64_t next_header_size;
2820 	uint32_t next_header_crc;
2821 	ssize_t bytes_avail;
2822 	int check_header_crc, r;
2823 
2824 	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2825 		return (ARCHIVE_FATAL);
2826 
2827 	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2828 		/* This is an executable ? Must be self-extracting... */
2829 		r = skip_sfx(a, bytes_avail);
2830 		if (r < ARCHIVE_WARN)
2831 			return (r);
2832 		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2833 			return (ARCHIVE_FATAL);
2834 	}
2835 	zip->seek_base += 32;
2836 
2837 	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2838 		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2839 		return (ARCHIVE_FATAL);
2840 	}
2841 
2842 	/* CRC check. */
2843 	if (crc32(0, (const unsigned char *)p + 12, 20)
2844 	    != archive_le32dec(p + 8)) {
2845 		archive_set_error(&a->archive, -1, "Header CRC error");
2846 		return (ARCHIVE_FATAL);
2847 	}
2848 
2849 	next_header_offset = archive_le64dec(p + 12);
2850 	next_header_size = archive_le64dec(p + 20);
2851 	next_header_crc = archive_le32dec(p + 28);
2852 
2853 	if (next_header_size == 0)
2854 		/* There is no entry in an archive file. */
2855 		return (ARCHIVE_EOF);
2856 
2857 	if (((int64_t)next_header_offset) < 0) {
2858 		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2859 		return (ARCHIVE_FATAL);
2860 	}
2861 	__archive_read_consume(a, 32);
2862 	if (next_header_offset != 0) {
2863 		if (bytes_avail >= (ssize_t)next_header_offset)
2864 			__archive_read_consume(a, next_header_offset);
2865 		else if (__archive_read_seek(a,
2866 		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
2867 			return (ARCHIVE_FATAL);
2868 	}
2869 	zip->stream_offset = next_header_offset;
2870 	zip->header_offset = next_header_offset;
2871 	zip->header_bytes_remaining = next_header_size;
2872 	zip->header_crc32 = 0;
2873 	zip->header_is_encoded = 0;
2874 	zip->header_is_being_read = 1;
2875 	zip->has_encrypted_entries = 0;
2876 	check_header_crc = 1;
2877 
2878 	if ((p = header_bytes(a, 1)) == NULL) {
2879 		archive_set_error(&a->archive,
2880 		    ARCHIVE_ERRNO_FILE_FORMAT,
2881 		    "Truncated 7-Zip file body");
2882 		return (ARCHIVE_FATAL);
2883 	}
2884 	/* Parse ArchiveProperties. */
2885 	switch (p[0]) {
2886 	case kEncodedHeader:
2887 		/*
2888 		 * The archive has an encoded header and we have to decode it
2889 		 * in order to parse the header correctly.
2890 		 */
2891 		r = decode_encoded_header_info(a, &(zip->si));
2892 
2893 		/* Check the EncodedHeader CRC.*/
2894 		if (r == 0 && zip->header_crc32 != next_header_crc) {
2895 			archive_set_error(&a->archive, -1,
2896 			    "Damaged 7-Zip archive");
2897 			r = -1;
2898 		}
2899 		if (r == 0) {
2900 			if (zip->si.ci.folders[0].digest_defined)
2901 				next_header_crc = zip->si.ci.folders[0].digest;
2902 			else
2903 				check_header_crc = 0;
2904 			if (zip->pack_stream_bytes_unconsumed)
2905 				read_consume(a);
2906 			r = setup_decode_folder(a, zip->si.ci.folders, 1);
2907 			if (r == 0) {
2908 				zip->header_bytes_remaining =
2909 					zip->folder_outbytes_remaining;
2910 				r = seek_pack(a);
2911 			}
2912 		}
2913 		/* Clean up StreamsInfo. */
2914 		free_StreamsInfo(&(zip->si));
2915 		memset(&(zip->si), 0, sizeof(zip->si));
2916 		if (r < 0)
2917 			return (ARCHIVE_FATAL);
2918 		zip->header_is_encoded = 1;
2919 		zip->header_crc32 = 0;
2920 		/* FALL THROUGH */
2921 	case kHeader:
2922 		/*
2923 		 * Parse the header.
2924 		 */
2925 		errno = 0;
2926 		r = read_Header(a, header, zip->header_is_encoded);
2927 		if (r < 0) {
2928 			if (errno == ENOMEM)
2929 				archive_set_error(&a->archive, -1,
2930 				    "Couldn't allocate memory");
2931 			else
2932 				archive_set_error(&a->archive, -1,
2933 				    "Damaged 7-Zip archive");
2934 			return (ARCHIVE_FATAL);
2935 		}
2936 
2937 		/*
2938 		 *  Must be kEnd.
2939 		 */
2940 		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
2941 			archive_set_error(&a->archive, -1,
2942 			    "Malformed 7-Zip archive");
2943 			return (ARCHIVE_FATAL);
2944 		}
2945 
2946 		/* Check the Header CRC.*/
2947 		if (check_header_crc && zip->header_crc32 != next_header_crc) {
2948 			archive_set_error(&a->archive, -1,
2949 			    "Malformed 7-Zip archive");
2950 			return (ARCHIVE_FATAL);
2951 		}
2952 		break;
2953 	default:
2954 		archive_set_error(&a->archive, -1,
2955 		    "Unexpected Property ID = %X", p[0]);
2956 		return (ARCHIVE_FATAL);
2957 	}
2958 
2959 	/* Clean up variables be used for decoding the archive header */
2960 	zip->pack_stream_remaining = 0;
2961 	zip->pack_stream_index = 0;
2962 	zip->folder_outbytes_remaining = 0;
2963 	zip->uncompressed_buffer_bytes_remaining = 0;
2964 	zip->pack_stream_bytes_unconsumed = 0;
2965 	zip->header_is_being_read = 0;
2966 
2967 	return (ARCHIVE_OK);
2968 }
2969 
2970 static ssize_t
2971 get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
2972     size_t minimum)
2973 {
2974 	struct _7zip *zip = (struct _7zip *)a->format->data;
2975 	ssize_t bytes_avail;
2976 
2977 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2978 		/* Copy mode. */
2979 
2980 		/*
2981 		 * Note: '1' here is a performance optimization.
2982 		 * Recall that the decompression layer returns a count of
2983 		 * available bytes; asking for more than that forces the
2984 		 * decompressor to combine reads by copying data.
2985 		 */
2986 		*buff = __archive_read_ahead(a, 1, &bytes_avail);
2987 		if (bytes_avail <= 0) {
2988 			archive_set_error(&a->archive,
2989 			    ARCHIVE_ERRNO_FILE_FORMAT,
2990 			    "Truncated 7-Zip file data");
2991 			return (ARCHIVE_FATAL);
2992 		}
2993 		if ((size_t)bytes_avail >
2994 		    zip->uncompressed_buffer_bytes_remaining)
2995 			bytes_avail = (ssize_t)
2996 			    zip->uncompressed_buffer_bytes_remaining;
2997 		if ((size_t)bytes_avail > size)
2998 			bytes_avail = (ssize_t)size;
2999 
3000 		zip->pack_stream_bytes_unconsumed = bytes_avail;
3001 	} else if (zip->uncompressed_buffer_pointer == NULL) {
3002 		/* Decompression has failed. */
3003 		archive_set_error(&(a->archive),
3004 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3005 		return (ARCHIVE_FATAL);
3006 	} else {
3007 		/* Packed mode. */
3008 		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
3009 			/*
3010 			 * If remaining uncompressed data size is less than
3011 			 * the minimum size, fill the buffer up to the
3012 			 * minimum size.
3013 			 */
3014 			if (extract_pack_stream(a, minimum) < 0)
3015 				return (ARCHIVE_FATAL);
3016 		}
3017 		if (size > zip->uncompressed_buffer_bytes_remaining)
3018 			bytes_avail = (ssize_t)
3019 			    zip->uncompressed_buffer_bytes_remaining;
3020 		else
3021 			bytes_avail = (ssize_t)size;
3022 		*buff = zip->uncompressed_buffer_pointer;
3023 		zip->uncompressed_buffer_pointer += bytes_avail;
3024 	}
3025 	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
3026 	return (bytes_avail);
3027 }
3028 
3029 static ssize_t
3030 extract_pack_stream(struct archive_read *a, size_t minimum)
3031 {
3032 	struct _7zip *zip = (struct _7zip *)a->format->data;
3033 	ssize_t bytes_avail;
3034 	int r;
3035 
3036 	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
3037 		if (minimum == 0)
3038 			minimum = 1;
3039 		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
3040 		    || bytes_avail <= 0) {
3041 			archive_set_error(&a->archive,
3042 			    ARCHIVE_ERRNO_FILE_FORMAT,
3043 			    "Truncated 7-Zip file body");
3044 			return (ARCHIVE_FATAL);
3045 		}
3046 		if (bytes_avail > (ssize_t)zip->pack_stream_inbytes_remaining)
3047 			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
3048 		zip->pack_stream_inbytes_remaining -= bytes_avail;
3049 		if (bytes_avail > (ssize_t)zip->folder_outbytes_remaining)
3050 			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
3051 		zip->folder_outbytes_remaining -= bytes_avail;
3052 		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
3053 		return (ARCHIVE_OK);
3054 	}
3055 
3056 	/* If the buffer hasn't been allocated, allocate it now. */
3057 	if (zip->uncompressed_buffer == NULL) {
3058 		zip->uncompressed_buffer_size = UBUFF_SIZE;
3059 		if (zip->uncompressed_buffer_size < minimum) {
3060 			zip->uncompressed_buffer_size = minimum + 1023;
3061 			zip->uncompressed_buffer_size &= ~0x3ff;
3062 		}
3063 		zip->uncompressed_buffer =
3064 		    malloc(zip->uncompressed_buffer_size);
3065 		if (zip->uncompressed_buffer == NULL) {
3066 			archive_set_error(&a->archive, ENOMEM,
3067 			    "No memory for 7-Zip decompression");
3068 			return (ARCHIVE_FATAL);
3069 		}
3070 		zip->uncompressed_buffer_bytes_remaining = 0;
3071 	} else if (zip->uncompressed_buffer_size < minimum ||
3072 	    zip->uncompressed_buffer_bytes_remaining < minimum) {
3073 		/*
3074 		 * Make sure the uncompressed buffer can have bytes
3075 		 * at least `minimum' bytes.
3076 		 * NOTE: This case happen when reading the header.
3077 		 */
3078 		size_t used;
3079 		if (zip->uncompressed_buffer_pointer != 0)
3080 			used = zip->uncompressed_buffer_pointer -
3081 				zip->uncompressed_buffer;
3082 		else
3083 			used = 0;
3084 		if (zip->uncompressed_buffer_size < minimum) {
3085 			/*
3086 			 * Expand the uncompressed buffer up to
3087 			 * the minimum size.
3088 			 */
3089 			void *p;
3090 			size_t new_size;
3091 
3092 			new_size = minimum + 1023;
3093 			new_size &= ~0x3ff;
3094 			p = realloc(zip->uncompressed_buffer, new_size);
3095 			if (p == NULL) {
3096 				archive_set_error(&a->archive, ENOMEM,
3097 				    "No memory for 7-Zip decompression");
3098 				return (ARCHIVE_FATAL);
3099 			}
3100 			zip->uncompressed_buffer = (unsigned char *)p;
3101 			zip->uncompressed_buffer_size = new_size;
3102 		}
3103 		/*
3104 		 * Move unconsumed bytes to the head.
3105 		 */
3106 		if (used) {
3107 			memmove(zip->uncompressed_buffer,
3108 				zip->uncompressed_buffer + used,
3109 				zip->uncompressed_buffer_bytes_remaining);
3110 		}
3111 	} else
3112 		zip->uncompressed_buffer_bytes_remaining = 0;
3113 	zip->uncompressed_buffer_pointer = NULL;
3114 	for (;;) {
3115 		size_t bytes_in, bytes_out;
3116 		const void *buff_in;
3117 		unsigned char *buff_out;
3118 		int end_of_data;
3119 
3120 		/*
3121 		 * Note: '1' here is a performance optimization.
3122 		 * Recall that the decompression layer returns a count of
3123 		 * available bytes; asking for more than that forces the
3124 		 * decompressor to combine reads by copying data.
3125 		 */
3126 		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3127 		if (bytes_avail <= 0) {
3128 			archive_set_error(&a->archive,
3129 			    ARCHIVE_ERRNO_FILE_FORMAT,
3130 			    "Truncated 7-Zip file body");
3131 			return (ARCHIVE_FATAL);
3132 		}
3133 
3134 		buff_out = zip->uncompressed_buffer
3135 			+ zip->uncompressed_buffer_bytes_remaining;
3136 		bytes_out = zip->uncompressed_buffer_size
3137 			- zip->uncompressed_buffer_bytes_remaining;
3138 		bytes_in = bytes_avail;
3139 		if (bytes_in > zip->pack_stream_inbytes_remaining)
3140 			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3141 		/* Drive decompression. */
3142 		r = decompress(a, zip, buff_out, &bytes_out,
3143 			buff_in, &bytes_in);
3144 		switch (r) {
3145 		case ARCHIVE_OK:
3146 			end_of_data = 0;
3147 			break;
3148 		case ARCHIVE_EOF:
3149 			end_of_data = 1;
3150 			break;
3151 		default:
3152 			return (ARCHIVE_FATAL);
3153 		}
3154 		zip->pack_stream_inbytes_remaining -= bytes_in;
3155 		if (bytes_out > zip->folder_outbytes_remaining)
3156 			bytes_out = (size_t)zip->folder_outbytes_remaining;
3157 		zip->folder_outbytes_remaining -= bytes_out;
3158 		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3159 		zip->pack_stream_bytes_unconsumed = bytes_in;
3160 
3161 		/*
3162 		 * Continue decompression until uncompressed_buffer is full.
3163 		 */
3164 		if (zip->uncompressed_buffer_bytes_remaining ==
3165 		    zip->uncompressed_buffer_size)
3166 			break;
3167 		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3168 		    zip->uncompressed_buffer_bytes_remaining + 5 >
3169 		    zip->uncompressed_buffer_size)
3170 			break;
3171 		if (zip->pack_stream_inbytes_remaining == 0 &&
3172 		    zip->folder_outbytes_remaining == 0)
3173 			break;
3174 		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3175 			archive_set_error(&(a->archive),
3176 			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3177 			return (ARCHIVE_FATAL);
3178 		}
3179 		read_consume(a);
3180 	}
3181 	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3182 		archive_set_error(&(a->archive),
3183 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3184 		return (ARCHIVE_FATAL);
3185 	}
3186 	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3187 	return (ARCHIVE_OK);
3188 }
3189 
3190 static int
3191 seek_pack(struct archive_read *a)
3192 {
3193 	struct _7zip *zip = (struct _7zip *)a->format->data;
3194 	int64_t pack_offset;
3195 
3196 	if (zip->pack_stream_remaining <= 0) {
3197 		archive_set_error(&(a->archive),
3198 		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3199 		return (ARCHIVE_FATAL);
3200 	}
3201 	zip->pack_stream_inbytes_remaining =
3202 	    zip->si.pi.sizes[zip->pack_stream_index];
3203 	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3204 	if (zip->stream_offset != pack_offset) {
3205 		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3206 		    SEEK_SET))
3207 			return (ARCHIVE_FATAL);
3208 		zip->stream_offset = pack_offset;
3209 	}
3210 	zip->pack_stream_index++;
3211 	zip->pack_stream_remaining--;
3212 	return (ARCHIVE_OK);
3213 }
3214 
3215 static ssize_t
3216 read_stream(struct archive_read *a, const void **buff, size_t size,
3217     size_t minimum)
3218 {
3219 	struct _7zip *zip = (struct _7zip *)a->format->data;
3220 	uint64_t skip_bytes = 0;
3221 	ssize_t r;
3222 
3223 	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3224 		if (zip->pack_stream_inbytes_remaining > 0) {
3225 			r = extract_pack_stream(a, 0);
3226 			if (r < 0)
3227 				return (r);
3228 			return (get_uncompressed_data(a, buff, size, minimum));
3229 		} else if (zip->folder_outbytes_remaining > 0) {
3230 			/* Extract a remaining pack stream. */
3231 			r = extract_pack_stream(a, 0);
3232 			if (r < 0)
3233 				return (r);
3234 			return (get_uncompressed_data(a, buff, size, minimum));
3235 		}
3236 	} else
3237 		return (get_uncompressed_data(a, buff, size, minimum));
3238 
3239 	/*
3240 	 * Current pack stream has been consumed.
3241 	 */
3242 	if (zip->pack_stream_remaining == 0) {
3243 		if (zip->header_is_being_read) {
3244 			/* Invalid sequence. This might happen when
3245 			 * reading a malformed archive. */
3246 			archive_set_error(&(a->archive),
3247 			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3248 			return (ARCHIVE_FATAL);
3249 		}
3250 
3251 		/*
3252 		 * All current folder's pack streams have been
3253 		 * consumed. Switch to next folder.
3254 		 */
3255 		if (zip->folder_index == 0 &&
3256 		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3257 		     || zip->folder_index != zip->entry->folderIndex)) {
3258 			zip->folder_index = zip->entry->folderIndex;
3259 			skip_bytes =
3260 			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3261 		}
3262 
3263 		if (zip->folder_index >= zip->si.ci.numFolders) {
3264 			/*
3265 			 * We have consumed all folders and its pack streams.
3266 			 */
3267 			*buff = NULL;
3268 			return (0);
3269 		}
3270 		r = setup_decode_folder(a,
3271 			&(zip->si.ci.folders[zip->folder_index]), 0);
3272 		if (r != ARCHIVE_OK)
3273 			return (ARCHIVE_FATAL);
3274 
3275 		zip->folder_index++;
3276 	}
3277 
3278 	/*
3279 	 * Switch to next pack stream.
3280 	 */
3281 	r = seek_pack(a);
3282 	if (r < 0)
3283 		return (r);
3284 
3285 	/* Extract a new pack stream. */
3286 	r = extract_pack_stream(a, 0);
3287 	if (r < 0)
3288 		return (r);
3289 
3290 	/*
3291 	 * Skip the bytes we already has skipped in skip_stream().
3292 	 */
3293 	while (skip_bytes) {
3294 		ssize_t skipped;
3295 
3296 		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3297 			if (zip->pack_stream_inbytes_remaining > 0) {
3298 				r = extract_pack_stream(a, 0);
3299 				if (r < 0)
3300 					return (r);
3301 			} else if (zip->folder_outbytes_remaining > 0) {
3302 				/* Extract a remaining pack stream. */
3303 				r = extract_pack_stream(a, 0);
3304 				if (r < 0)
3305 					return (r);
3306 			} else {
3307 				archive_set_error(&a->archive,
3308 				    ARCHIVE_ERRNO_FILE_FORMAT,
3309 				    "Truncated 7-Zip file body");
3310 				return (ARCHIVE_FATAL);
3311 			}
3312 		}
3313 		skipped = get_uncompressed_data(
3314 			a, buff, (size_t)skip_bytes, 0);
3315 		if (skipped < 0)
3316 			return (skipped);
3317 		skip_bytes -= skipped;
3318 		if (zip->pack_stream_bytes_unconsumed)
3319 			read_consume(a);
3320 	}
3321 
3322 	return (get_uncompressed_data(a, buff, size, minimum));
3323 }
3324 
3325 static int
3326 setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3327     int header)
3328 {
3329 	struct _7zip *zip = (struct _7zip *)a->format->data;
3330 	const struct _7z_coder *coder1, *coder2;
3331 	const char *cname = (header)?"archive header":"file content";
3332 	unsigned i;
3333 	int r, found_bcj2 = 0;
3334 
3335 	/*
3336 	 * Release the memory which the previous folder used for BCJ2.
3337 	 */
3338 	for (i = 0; i < 3; i++) {
3339 		if (zip->sub_stream_buff[i] != NULL)
3340 			free(zip->sub_stream_buff[i]);
3341 		zip->sub_stream_buff[i] = NULL;
3342 	}
3343 
3344 	/*
3345 	 * Initialize a stream reader.
3346 	 */
3347 	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3348 	zip->pack_stream_index = (unsigned)folder->packIndex;
3349 	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3350 	zip->uncompressed_buffer_bytes_remaining = 0;
3351 
3352 	/*
3353 	 * Check coder types.
3354 	 */
3355 	for (i = 0; i < folder->numCoders; i++) {
3356 		switch(folder->coders[i].codec) {
3357 			case _7Z_CRYPTO_MAIN_ZIP:
3358 			case _7Z_CRYPTO_RAR_29:
3359 			case _7Z_CRYPTO_AES_256_SHA_256: {
3360 				/* For entry that is associated with this folder, mark
3361 				   it as encrypted (data+metadata). */
3362 				zip->has_encrypted_entries = 1;
3363 				if (a->entry) {
3364 					archive_entry_set_is_data_encrypted(a->entry, 1);
3365 					archive_entry_set_is_metadata_encrypted(a->entry, 1);
3366 				}
3367 				archive_set_error(&(a->archive),
3368 					ARCHIVE_ERRNO_MISC,
3369 					"The %s is encrypted, "
3370 					"but currently not supported", cname);
3371 				return (ARCHIVE_FATAL);
3372 			}
3373 			case _7Z_X86_BCJ2: {
3374 				found_bcj2++;
3375 				break;
3376 			}
3377 		}
3378 	}
3379 	/* Now that we've checked for encryption, if there were still no
3380 	 * encrypted entries found we can say for sure that there are none.
3381 	 */
3382 	if (zip->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
3383 		zip->has_encrypted_entries = 0;
3384 	}
3385 
3386 	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3387 		archive_set_error(&(a->archive),
3388 		    ARCHIVE_ERRNO_MISC,
3389 		    "The %s is encoded with many filters, "
3390 		    "but currently not supported", cname);
3391 		return (ARCHIVE_FATAL);
3392 	}
3393 	coder1 = &(folder->coders[0]);
3394 	if (folder->numCoders == 2)
3395 		coder2 = &(folder->coders[1]);
3396 	else
3397 		coder2 = NULL;
3398 
3399 	if (found_bcj2) {
3400 		/*
3401 		 * Preparation to decode BCJ2.
3402 		 * Decoding BCJ2 requires four sources. Those are at least,
3403 		 * as far as I know, two types of the storage form.
3404 		 */
3405 		const struct _7z_coder *fc = folder->coders;
3406 		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3407 		const struct _7z_coder *scoder[3] =
3408 			{&coder_copy, &coder_copy, &coder_copy};
3409 		const void *buff;
3410 		ssize_t bytes;
3411 		unsigned char *b[3] = {NULL, NULL, NULL};
3412 		uint64_t sunpack[3] ={-1, -1, -1};
3413 		size_t s[3] = {0, 0, 0};
3414 		int idx[3] = {0, 1, 2};
3415 
3416 		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3417 		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3418 		    zip->pack_stream_remaining == 4) {
3419 			/* Source type 1 made by 7zr or 7z with -m options. */
3420 			if (folder->bindPairs[0].inIndex == 5) {
3421 				/* The form made by 7zr */
3422 				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3423 				scoder[1] = &(fc[1]);
3424 				scoder[2] = &(fc[0]);
3425 				sunpack[1] = folder->unPackSize[1];
3426 				sunpack[2] = folder->unPackSize[0];
3427 				coder1 = &(fc[2]);
3428 			} else {
3429 				/*
3430 				 * NOTE: Some patterns do not work.
3431 				 * work:
3432 				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3433 				 *       -m3=(any)
3434 				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3435 				 *       -m3=COPY
3436 				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3437 				 *       -m3=COPY
3438 				 * not work:
3439 				 *  other patterns.
3440 				 *
3441 				 * We have to handle this like `pipe' or
3442 				 * our libarchive7s filter frame work,
3443 				 * decoding the BCJ2 main stream sequentially,
3444 				 * m3 -> m2 -> m1 -> BCJ2.
3445 				 *
3446 				 */
3447 				if (fc[0].codec == _7Z_COPY &&
3448 				    fc[1].codec == _7Z_COPY)
3449 					coder1 = &(folder->coders[2]);
3450 				else if (fc[0].codec == _7Z_COPY &&
3451 				    fc[2].codec == _7Z_COPY)
3452 					coder1 = &(folder->coders[1]);
3453 				else if (fc[1].codec == _7Z_COPY &&
3454 				    fc[2].codec == _7Z_COPY)
3455 					coder1 = &(folder->coders[0]);
3456 				else {
3457 					archive_set_error(&(a->archive),
3458 					    ARCHIVE_ERRNO_MISC,
3459 					    "Unsupported form of "
3460 					    "BCJ2 streams");
3461 					return (ARCHIVE_FATAL);
3462 				}
3463 			}
3464 			coder2 = &(fc[3]);
3465 			zip->main_stream_bytes_remaining =
3466 				(size_t)folder->unPackSize[2];
3467 		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3468 		    zip->pack_stream_remaining == 4 &&
3469 		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3470 			/* Source type 0 made by 7z */
3471 			zip->main_stream_bytes_remaining =
3472 				(size_t)folder->unPackSize[0];
3473 		} else {
3474 			/* We got an unexpected form. */
3475 			archive_set_error(&(a->archive),
3476 			    ARCHIVE_ERRNO_MISC,
3477 			    "Unsupported form of BCJ2 streams");
3478 			return (ARCHIVE_FATAL);
3479 		}
3480 
3481 		/* Skip the main stream at this time. */
3482 		if ((r = seek_pack(a)) < 0)
3483 			return (r);
3484 		zip->pack_stream_bytes_unconsumed =
3485 		    (size_t)zip->pack_stream_inbytes_remaining;
3486 		read_consume(a);
3487 
3488 		/* Read following three sub streams. */
3489 		for (i = 0; i < 3; i++) {
3490 			const struct _7z_coder *coder = scoder[i];
3491 
3492 			if ((r = seek_pack(a)) < 0) {
3493 				free(b[0]); free(b[1]); free(b[2]);
3494 				return (r);
3495 			}
3496 
3497 			if (sunpack[i] == (uint64_t)-1)
3498 				zip->folder_outbytes_remaining =
3499 				    zip->pack_stream_inbytes_remaining;
3500 			else
3501 				zip->folder_outbytes_remaining = sunpack[i];
3502 
3503 			r = init_decompression(a, zip, coder, NULL);
3504 			if (r != ARCHIVE_OK) {
3505 				free(b[0]); free(b[1]); free(b[2]);
3506 				return (ARCHIVE_FATAL);
3507 			}
3508 
3509 			/* Allocate memory for the decoded data of a sub
3510 			 * stream. */
3511 			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3512 			if (b[i] == NULL) {
3513 				free(b[0]); free(b[1]); free(b[2]);
3514 				archive_set_error(&a->archive, ENOMEM,
3515 				    "No memory for 7-Zip decompression");
3516 				return (ARCHIVE_FATAL);
3517 			}
3518 
3519 			/* Extract a sub stream. */
3520 			while (zip->pack_stream_inbytes_remaining > 0) {
3521 				r = (int)extract_pack_stream(a, 0);
3522 				if (r < 0) {
3523 					free(b[0]); free(b[1]); free(b[2]);
3524 					return (r);
3525 				}
3526 				bytes = get_uncompressed_data(a, &buff,
3527 				    zip->uncompressed_buffer_bytes_remaining,
3528 				    0);
3529 				if (bytes < 0) {
3530 					free(b[0]); free(b[1]); free(b[2]);
3531 					return ((int)bytes);
3532 				}
3533 				memcpy(b[i]+s[i], buff, bytes);
3534 				s[i] += bytes;
3535 				if (zip->pack_stream_bytes_unconsumed)
3536 					read_consume(a);
3537 			}
3538 		}
3539 
3540 		/* Set the sub streams to the right place. */
3541 		for (i = 0; i < 3; i++) {
3542 			zip->sub_stream_buff[i] = b[idx[i]];
3543 			zip->sub_stream_size[i] = s[idx[i]];
3544 			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3545 		}
3546 
3547 		/* Allocate memory used for decoded main stream bytes. */
3548 		if (zip->tmp_stream_buff == NULL) {
3549 			zip->tmp_stream_buff_size = 32 * 1024;
3550 			zip->tmp_stream_buff =
3551 			    malloc(zip->tmp_stream_buff_size);
3552 			if (zip->tmp_stream_buff == NULL) {
3553 				archive_set_error(&a->archive, ENOMEM,
3554 				    "No memory for 7-Zip decompression");
3555 				return (ARCHIVE_FATAL);
3556 			}
3557 		}
3558 		zip->tmp_stream_bytes_avail = 0;
3559 		zip->tmp_stream_bytes_remaining = 0;
3560 		zip->odd_bcj_size = 0;
3561 		zip->bcj2_outPos = 0;
3562 
3563 		/*
3564 		 * Reset a stream reader in order to read the main stream
3565 		 * of BCJ2.
3566 		 */
3567 		zip->pack_stream_remaining = 1;
3568 		zip->pack_stream_index = (unsigned)folder->packIndex;
3569 		zip->folder_outbytes_remaining =
3570 		    folder_uncompressed_size(folder);
3571 		zip->uncompressed_buffer_bytes_remaining = 0;
3572 	}
3573 
3574 	/*
3575 	 * Initialize the decompressor for the new folder's pack streams.
3576 	 */
3577 	r = init_decompression(a, zip, coder1, coder2);
3578 	if (r != ARCHIVE_OK)
3579 		return (ARCHIVE_FATAL);
3580 	return (ARCHIVE_OK);
3581 }
3582 
3583 static int64_t
3584 skip_stream(struct archive_read *a, size_t skip_bytes)
3585 {
3586 	struct _7zip *zip = (struct _7zip *)a->format->data;
3587 	const void *p;
3588 	int64_t skipped_bytes;
3589 	size_t bytes = skip_bytes;
3590 
3591 	if (zip->folder_index == 0) {
3592 		/*
3593 		 * Optimization for a list mode.
3594 		 * Avoid unnecessary decoding operations.
3595 		 */
3596 		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3597 		    += skip_bytes;
3598 		return (skip_bytes);
3599 	}
3600 
3601 	while (bytes) {
3602 		skipped_bytes = read_stream(a, &p, bytes, 0);
3603 		if (skipped_bytes < 0)
3604 			return (skipped_bytes);
3605 		if (skipped_bytes == 0) {
3606 			archive_set_error(&a->archive,
3607 			    ARCHIVE_ERRNO_FILE_FORMAT,
3608 			    "Truncated 7-Zip file body");
3609 			return (ARCHIVE_FATAL);
3610 		}
3611 		bytes -= (size_t)skipped_bytes;
3612 		if (zip->pack_stream_bytes_unconsumed)
3613 			read_consume(a);
3614 	}
3615 	return (skip_bytes);
3616 }
3617 
3618 /*
3619  * Brought from LZMA SDK.
3620  *
3621  * Bra86.c -- Converter for x86 code (BCJ)
3622  * 2008-10-04 : Igor Pavlov : Public domain
3623  *
3624  */
3625 
3626 #define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3627 
3628 static void
3629 x86_Init(struct _7zip *zip)
3630 {
3631 	zip->bcj_state = 0;
3632 	zip->bcj_prevPosT = (size_t)0 - 1;
3633 	zip->bcj_prevMask = 0;
3634 	zip->bcj_ip = 5;
3635 }
3636 
3637 static size_t
3638 x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3639 {
3640 	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3641 	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3642 	size_t bufferPos, prevPosT;
3643 	uint32_t ip, prevMask;
3644 
3645 	if (size < 5)
3646 		return 0;
3647 
3648 	bufferPos = 0;
3649 	prevPosT = zip->bcj_prevPosT;
3650 	prevMask = zip->bcj_prevMask;
3651 	ip = zip->bcj_ip;
3652 
3653 	for (;;) {
3654 		uint8_t *p = data + bufferPos;
3655 		uint8_t *limit = data + size - 4;
3656 
3657 		for (; p < limit; p++)
3658 			if ((*p & 0xFE) == 0xE8)
3659 				break;
3660 		bufferPos = (size_t)(p - data);
3661 		if (p >= limit)
3662 			break;
3663 		prevPosT = bufferPos - prevPosT;
3664 		if (prevPosT > 3)
3665 			prevMask = 0;
3666 		else {
3667 			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3668 			if (prevMask != 0) {
3669 				unsigned char b =
3670 					p[4 - kMaskToBitNumber[prevMask]];
3671 				if (!kMaskToAllowedStatus[prevMask] ||
3672 				    Test86MSByte(b)) {
3673 					prevPosT = bufferPos;
3674 					prevMask = ((prevMask << 1) & 0x7) | 1;
3675 					bufferPos++;
3676 					continue;
3677 				}
3678 			}
3679 		}
3680 		prevPosT = bufferPos;
3681 
3682 		if (Test86MSByte(p[4])) {
3683 			uint32_t src = ((uint32_t)p[4] << 24) |
3684 				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3685 				((uint32_t)p[1]);
3686 			uint32_t dest;
3687 			for (;;) {
3688 				uint8_t b;
3689 				int b_index;
3690 
3691 				dest = src - (ip + (uint32_t)bufferPos);
3692 				if (prevMask == 0)
3693 					break;
3694 				b_index = kMaskToBitNumber[prevMask] * 8;
3695 				b = (uint8_t)(dest >> (24 - b_index));
3696 				if (!Test86MSByte(b))
3697 					break;
3698 				src = dest ^ ((1 << (32 - b_index)) - 1);
3699 			}
3700 			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3701 			p[3] = (uint8_t)(dest >> 16);
3702 			p[2] = (uint8_t)(dest >> 8);
3703 			p[1] = (uint8_t)dest;
3704 			bufferPos += 5;
3705 		} else {
3706 			prevMask = ((prevMask << 1) & 0x7) | 1;
3707 			bufferPos++;
3708 		}
3709 	}
3710 	zip->bcj_prevPosT = prevPosT;
3711 	zip->bcj_prevMask = prevMask;
3712 	zip->bcj_ip += (uint32_t)bufferPos;
3713 	return (bufferPos);
3714 }
3715 
3716 /*
3717  * Brought from LZMA SDK.
3718  *
3719  * Bcj2.c -- Converter for x86 code (BCJ2)
3720  * 2008-10-04 : Igor Pavlov : Public domain
3721  *
3722  */
3723 
3724 #define SZ_ERROR_DATA	 ARCHIVE_FAILED
3725 
3726 #define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3727 #define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3728 
3729 #define kNumTopBits 24
3730 #define kTopValue ((uint32_t)1 << kNumTopBits)
3731 
3732 #define kNumBitModelTotalBits 11
3733 #define kBitModelTotal (1 << kNumBitModelTotalBits)
3734 #define kNumMoveBits 5
3735 
3736 #define RC_READ_BYTE (*buffer++)
3737 #define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
3738 #define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
3739   { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
3740 
3741 #define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
3742 
3743 #define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
3744 #define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
3745 #define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
3746 
3747 static ssize_t
3748 Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
3749 {
3750 	size_t inPos = 0, outPos = 0;
3751 	const uint8_t *buf0, *buf1, *buf2, *buf3;
3752 	size_t size0, size1, size2, size3;
3753 	const uint8_t *buffer, *bufferLim;
3754 	unsigned int i, j;
3755 
3756 	size0 = zip->tmp_stream_bytes_remaining;
3757 	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
3758 	size1 = zip->sub_stream_bytes_remaining[0];
3759 	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
3760 	size2 = zip->sub_stream_bytes_remaining[1];
3761 	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
3762 	size3 = zip->sub_stream_bytes_remaining[2];
3763 	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
3764 
3765 	buffer = buf3;
3766 	bufferLim = buffer + size3;
3767 
3768 	if (zip->bcj_state == 0) {
3769 		/*
3770 		 * Initialize.
3771 		 */
3772 		zip->bcj2_prevByte = 0;
3773 		for (i = 0;
3774 		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
3775 			zip->bcj2_p[i] = kBitModelTotal >> 1;
3776 		RC_INIT2;
3777 		zip->bcj_state = 1;
3778 	}
3779 
3780 	/*
3781 	 * Gather the odd bytes of a previous call.
3782 	 */
3783 	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
3784 		outBuf[outPos++] = zip->odd_bcj[i];
3785 		zip->odd_bcj_size--;
3786 	}
3787 
3788 	if (outSize == 0) {
3789 		zip->bcj2_outPos += outPos;
3790 		return (outPos);
3791 	}
3792 
3793 	for (;;) {
3794 		uint8_t b;
3795 		CProb *prob;
3796 		uint32_t bound;
3797 		uint32_t ttt;
3798 
3799 		size_t limit = size0 - inPos;
3800 		if (outSize - outPos < limit)
3801 			limit = outSize - outPos;
3802 
3803 		if (zip->bcj_state == 1) {
3804 			while (limit != 0) {
3805 				uint8_t bb = buf0[inPos];
3806 				outBuf[outPos++] = bb;
3807 				if (IsJ(zip->bcj2_prevByte, bb)) {
3808 					zip->bcj_state = 2;
3809 					break;
3810 				}
3811 				inPos++;
3812 				zip->bcj2_prevByte = bb;
3813 				limit--;
3814 			}
3815 		}
3816 
3817 		if (limit == 0 || outPos == outSize)
3818 			break;
3819 		zip->bcj_state = 1;
3820 
3821 		b = buf0[inPos++];
3822 
3823 		if (b == 0xE8)
3824 			prob = zip->bcj2_p + zip->bcj2_prevByte;
3825 		else if (b == 0xE9)
3826 			prob = zip->bcj2_p + 256;
3827 		else
3828 			prob = zip->bcj2_p + 257;
3829 
3830 		IF_BIT_0(prob) {
3831 			UPDATE_0(prob)
3832 			zip->bcj2_prevByte = b;
3833 		} else {
3834 			uint32_t dest;
3835 			const uint8_t *v;
3836 			uint8_t out[4];
3837 
3838 			UPDATE_1(prob)
3839 			if (b == 0xE8) {
3840 				v = buf1;
3841 				if (size1 < 4)
3842 					return SZ_ERROR_DATA;
3843 				buf1 += 4;
3844 				size1 -= 4;
3845 			} else {
3846 				v = buf2;
3847 				if (size2 < 4)
3848 					return SZ_ERROR_DATA;
3849 				buf2 += 4;
3850 				size2 -= 4;
3851 			}
3852 			dest = (((uint32_t)v[0] << 24) |
3853 			    ((uint32_t)v[1] << 16) |
3854 			    ((uint32_t)v[2] << 8) |
3855 			    ((uint32_t)v[3])) -
3856 			    ((uint32_t)zip->bcj2_outPos + (uint32_t)outPos + 4);
3857 			out[0] = (uint8_t)dest;
3858 			out[1] = (uint8_t)(dest >> 8);
3859 			out[2] = (uint8_t)(dest >> 16);
3860 			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
3861 
3862 			for (i = 0; i < 4 && outPos < outSize; i++)
3863 				outBuf[outPos++] = out[i];
3864 			if (i < 4) {
3865 				/*
3866 				 * Save odd bytes which we could not add into
3867 				 * the output buffer because of out of space.
3868 				 */
3869 				zip->odd_bcj_size = 4 -i;
3870 				for (; i < 4; i++) {
3871 					j = i - 4 + (unsigned)zip->odd_bcj_size;
3872 					zip->odd_bcj[j] = out[i];
3873 				}
3874 				break;
3875 			}
3876 		}
3877 	}
3878 	zip->tmp_stream_bytes_remaining -= inPos;
3879 	zip->sub_stream_bytes_remaining[0] = size1;
3880 	zip->sub_stream_bytes_remaining[1] = size2;
3881 	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
3882 	zip->bcj2_outPos += outPos;
3883 
3884 	return ((ssize_t)outPos);
3885 }
3886 
3887