1/*-
2 * Copyright (c) 2011 Michihiro NAKAJIMA
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "archive_platform.h"
27__FBSDID("$FreeBSD$");
28
29#ifdef HAVE_ERRNO_H
30#include <errno.h>
31#endif
32#ifdef HAVE_STDLIB_H
33#include <stdlib.h>
34#endif
35#ifdef HAVE_BZLIB_H
36#include <bzlib.h>
37#endif
38#ifdef HAVE_LZMA_H
39#include <lzma.h>
40#endif
41#ifdef HAVE_ZLIB_H
42#include <zlib.h>
43#endif
44
45#include "archive.h"
46#include "archive_entry.h"
47#include "archive_entry_locale.h"
48#include "archive_ppmd7_private.h"
49#include "archive_private.h"
50#include "archive_read_private.h"
51#include "archive_endian.h"
52
53#ifndef HAVE_ZLIB_H
54#include "archive_crc32.h"
55#endif
56
57#define _7ZIP_SIGNATURE	"7z\xBC\xAF\x27\x1C"
58#define SFX_MIN_ADDR	0x27000
59#define SFX_MAX_ADDR	0x60000
60
61
62/*
63 * Codec ID
64 */
65#define _7Z_COPY	0
66#define _7Z_LZMA	0x030101
67#define _7Z_LZMA2	0x21
68#define _7Z_DEFLATE	0x040108
69#define _7Z_BZ2		0x040202
70#define _7Z_PPMD	0x030401
71#define _7Z_DELTA	0x03
72#define _7Z_CRYPTO	0x06F10701
73#define _7Z_X86		0x03030103
74#define _7Z_X86_BCJ2	0x0303011B
75#define _7Z_POWERPC	0x03030205
76#define _7Z_IA64	0x03030401
77#define _7Z_ARM		0x03030501
78#define _7Z_ARMTHUMB	0x03030701
79#define _7Z_SPARC	0x03030805
80
81/*
82 * 7-Zip header property IDs.
83 */
84#define kEnd			0x00
85#define kHeader			0x01
86#define kArchiveProperties	0x02
87#define kAdditionalStreamsInfo	0x03
88#define kMainStreamsInfo	0x04
89#define kFilesInfo		0x05
90#define kPackInfo		0x06
91#define kUnPackInfo		0x07
92#define kSubStreamsInfo		0x08
93#define kSize			0x09
94#define kCRC			0x0A
95#define kFolder			0x0B
96#define kCodersUnPackSize	0x0C
97#define kNumUnPackStream	0x0D
98#define kEmptyStream		0x0E
99#define kEmptyFile		0x0F
100#define kAnti			0x10
101#define kName			0x11
102#define kCTime			0x12
103#define kATime			0x13
104#define kMTime			0x14
105#define kAttributes		0x15
106#define kEncodedHeader		0x17
107
108struct _7z_digests {
109	unsigned char	*defineds;
110	uint32_t	*digests;
111};
112
113
114struct _7z_folder {
115	uint64_t		 numCoders;
116	struct _7z_coder {
117		unsigned long	 codec;
118		uint64_t	 numInStreams;
119		uint64_t	 numOutStreams;
120		uint64_t	 propertiesSize;
121		unsigned char	*properties;
122	} *coders;
123	uint64_t		 numBindPairs;
124	struct {
125		uint64_t	 inIndex;
126		uint64_t	 outIndex;
127	} *bindPairs;
128	uint64_t		 numPackedStreams;
129	uint64_t		*packedStreams;
130	uint64_t		 numInStreams;
131	uint64_t		 numOutStreams;
132	uint64_t		*unPackSize;
133	unsigned char		 digest_defined;
134	uint32_t		 digest;
135	uint64_t		 numUnpackStreams;
136	uint32_t		 packIndex;
137	/* Unoperated bytes. */
138	uint64_t		 skipped_bytes;
139};
140
141struct _7z_coders_info {
142	uint64_t		 numFolders;
143	struct _7z_folder	*folders;
144	uint64_t		 dataStreamIndex;
145};
146
147struct _7z_pack_info {
148	uint64_t		 pos;
149	uint64_t		 numPackStreams;
150	uint64_t		*sizes;
151	struct _7z_digests	 digest;
152	/* Calculated from pos and numPackStreams. */
153	uint64_t		*positions;
154};
155
156struct _7z_substream_info {
157	size_t			 unpack_streams;
158	uint64_t		*unpackSizes;
159	unsigned char		*digestsDefined;
160	uint32_t		*digests;
161};
162
163struct _7z_stream_info {
164	struct _7z_pack_info	 pi;
165	struct _7z_coders_info	 ci;
166	struct _7z_substream_info ss;
167};
168
169struct _7z_header_info {
170	uint64_t		 dataIndex;
171
172	unsigned char		*emptyStreamBools;
173	unsigned char		*emptyFileBools;
174	unsigned char		*antiBools;
175	unsigned char		*attrBools;
176};
177
178struct _7zip_entry {
179	size_t			 name_len;
180	unsigned char		*utf16name;
181#if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
182	const wchar_t		*wname;
183#endif
184	uint32_t		 folderIndex;
185	uint32_t		 ssIndex;
186	unsigned		 flg;
187#define MTIME_IS_SET	(1<<0)
188#define ATIME_IS_SET	(1<<1)
189#define CTIME_IS_SET	(1<<2)
190#define CRC32_IS_SET	(1<<3)
191#define HAS_STREAM	(1<<4)
192
193	time_t			 mtime;
194	time_t			 atime;
195	time_t			 ctime;
196	long			 mtime_ns;
197	long			 atime_ns;
198	long			 ctime_ns;
199	uint32_t		 mode;
200	uint32_t		 attr;
201};
202
203struct _7zip {
204	/* Structural information about the archive. */
205	struct _7z_stream_info	 si;
206
207	int			 header_is_being_read;
208	int			 header_is_encoded;
209	uint64_t		 header_bytes_remaining;
210	unsigned long		 header_crc32;
211	/* Header offset to check that reading pointes of the file contens
212	 * will not exceed the header. */
213	uint64_t		 header_offset;
214	/* Base offset of the archive file for a seek in case reading SFX. */
215	uint64_t		 seek_base;
216
217	/* List of entries */
218	size_t			 entries_remaining;
219	uint64_t		 numFiles;
220	struct _7zip_entry	*entries;
221	struct _7zip_entry	*entry;
222	unsigned char		*entry_names;
223
224	/* entry_bytes_remaining is the number of bytes we expect. */
225	int64_t			 entry_offset;
226	uint64_t		 entry_bytes_remaining;
227
228	/* Running CRC32 of the decompressed data */
229	unsigned long		 entry_crc32;
230
231	/* Flags to mark progress of decompression. */
232	char			 end_of_entry;
233
234	/* Uncompressed buffer control.  */
235#define UBUFF_SIZE	(64 * 1024)
236	unsigned char 		*uncompressed_buffer;
237	unsigned char 		*uncompressed_buffer_pointer;
238	size_t 			 uncompressed_buffer_size;
239	size_t			 uncompressed_buffer_bytes_remaining;
240
241	/* Offset of the compressed data. */
242	int64_t			 stream_offset;
243
244	/*
245	 * Decompressing control data.
246	 */
247	unsigned		 folder_index;
248	uint64_t		 folder_outbytes_remaining;
249	unsigned		 pack_stream_index;
250	unsigned		 pack_stream_remaining;
251	uint64_t		 pack_stream_inbytes_remaining;
252	size_t			 pack_stream_bytes_unconsumed;
253
254	/* The codec information of a folder. */
255	unsigned long		 codec;
256	unsigned long		 codec2;
257
258	/*
259	 * Decompressor controllers.
260	 */
261	/* Decording LZMA1 and LZMA2 data. */
262#ifdef HAVE_LZMA_H
263	lzma_stream		 lzstream;
264	int			 lzstream_valid;
265#endif
266	/* Decording bzip2 data. */
267#if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
268	bz_stream		 bzstream;
269	int			 bzstream_valid;
270#endif
271	/* Decording deflate data. */
272#ifdef HAVE_ZLIB_H
273	z_stream		 stream;
274	int			 stream_valid;
275#endif
276	/* Decording PPMd data. */
277	int			 ppmd7_stat;
278	CPpmd7			 ppmd7_context;
279	CPpmd7z_RangeDec	 range_dec;
280	IByteIn			 bytein;
281	struct {
282		const unsigned char	*next_in;
283		int64_t			 avail_in;
284		int64_t			 total_in;
285		unsigned char		*next_out;
286		int64_t			 avail_out;
287		int64_t			 total_out;
288		int			 overconsumed;
289	} ppstream;
290	int			 ppmd7_valid;
291
292	/* Decoding BCJ and BCJ2 data. */
293	uint32_t		 bcj_state;
294	size_t			 odd_bcj_size;
295	unsigned char		 odd_bcj[4];
296	/* Decoding BCJ data. */
297	size_t			 bcj_prevPosT;
298	uint32_t		 bcj_prevMask;
299	uint32_t		 bcj_ip;
300
301	/* Decoding BCJ2 data. */
302	size_t			 main_stream_bytes_remaining;
303	unsigned char		*sub_stream_buff[3];
304	size_t			 sub_stream_size[3];
305	size_t			 sub_stream_bytes_remaining[3];
306	unsigned char		*tmp_stream_buff;
307	size_t			 tmp_stream_buff_size;
308	size_t			 tmp_stream_bytes_avail;
309	size_t			 tmp_stream_bytes_remaining;
310#ifdef _LZMA_PROB32
311#define CProb uint32_t
312#else
313#define CProb uint16_t
314#endif
315	CProb			 bcj2_p[256 + 2];
316	uint8_t			 bcj2_prevByte;
317	uint32_t		 bcj2_range;
318	uint32_t		 bcj2_code;
319	uint64_t		 bcj2_outPos;
320
321	/* Filename character-set conversion data. */
322	struct archive_string_conv *sconv;
323
324	char			 format_name[64];
325};
326
327static int	archive_read_format_7zip_bid(struct archive_read *, int);
328static int	archive_read_format_7zip_cleanup(struct archive_read *);
329static int	archive_read_format_7zip_read_data(struct archive_read *,
330		    const void **, size_t *, int64_t *);
331static int	archive_read_format_7zip_read_data_skip(struct archive_read *);
332static int	archive_read_format_7zip_read_header(struct archive_read *,
333		    struct archive_entry *);
334static int	check_7zip_header_in_sfx(const char *);
335static unsigned long decode_codec_id(const unsigned char *, size_t);
336static int	decode_encoded_header_info(struct archive_read *,
337		    struct _7z_stream_info *);
338static int	decompress(struct archive_read *, struct _7zip *,
339		    void *, size_t *, const void *, size_t *);
340static ssize_t	extract_pack_stream(struct archive_read *, size_t);
341static void	fileTimeToUtc(uint64_t, time_t *, long *);
342static uint64_t folder_uncompressed_size(struct _7z_folder *);
343static void	free_CodersInfo(struct _7z_coders_info *);
344static void	free_Digest(struct _7z_digests *);
345static void	free_Folder(struct _7z_folder *);
346static void	free_Header(struct _7z_header_info *);
347static void	free_PackInfo(struct _7z_pack_info *);
348static void	free_StreamsInfo(struct _7z_stream_info *);
349static void	free_SubStreamsInfo(struct _7z_substream_info *);
350static int	free_decompression(struct archive_read *, struct _7zip *);
351static ssize_t	get_uncompressed_data(struct archive_read *, const void **,
352		    size_t, size_t);
353static const unsigned char * header_bytes(struct archive_read *, size_t);
354static int	init_decompression(struct archive_read *, struct _7zip *,
355		    const struct _7z_coder *, const struct _7z_coder *);
356static int	parse_7zip_uint64(struct archive_read *, uint64_t *);
357static int	read_Bools(struct archive_read *, unsigned char *, size_t);
358static int	read_CodersInfo(struct archive_read *,
359		    struct _7z_coders_info *);
360static int	read_Digests(struct archive_read *, struct _7z_digests *,
361		    size_t);
362static int	read_Folder(struct archive_read *, struct _7z_folder *);
363static int	read_Header(struct archive_read *, struct _7z_header_info *,
364		    int);
365static int	read_PackInfo(struct archive_read *, struct _7z_pack_info *);
366static int	read_StreamsInfo(struct archive_read *,
367		    struct _7z_stream_info *);
368static int	read_SubStreamsInfo(struct archive_read *,
369		    struct _7z_substream_info *, struct _7z_folder *, size_t);
370static int	read_Times(struct archive_read *, struct _7z_header_info *,
371		    int);
372static void	read_consume(struct archive_read *);
373static ssize_t	read_stream(struct archive_read *, const void **, size_t,
374		    size_t);
375static int	seek_pack(struct archive_read *);
376static int64_t	skip_stream(struct archive_read *, size_t);
377static int	skip_sfx(struct archive_read *, ssize_t);
378static int	slurp_central_directory(struct archive_read *, struct _7zip *,
379		    struct _7z_header_info *);
380static int	setup_decode_folder(struct archive_read *, struct _7z_folder *,
381		    int);
382static void	x86_Init(struct _7zip *);
383static size_t	x86_Convert(struct _7zip *, uint8_t *, size_t);
384static ssize_t		Bcj2_Decode(struct _7zip *, uint8_t *, size_t);
385
386
387int
388archive_read_support_format_7zip(struct archive *_a)
389{
390	struct archive_read *a = (struct archive_read *)_a;
391	struct _7zip *zip;
392	int r;
393
394	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
395	    ARCHIVE_STATE_NEW, "archive_read_support_format_7zip");
396
397	zip = calloc(1, sizeof(*zip));
398	if (zip == NULL) {
399		archive_set_error(&a->archive, ENOMEM,
400		    "Can't allocate 7zip data");
401		return (ARCHIVE_FATAL);
402	}
403
404	r = __archive_read_register_format(a,
405	    zip,
406	    "7zip",
407	    archive_read_format_7zip_bid,
408	    NULL,
409	    archive_read_format_7zip_read_header,
410	    archive_read_format_7zip_read_data,
411	    archive_read_format_7zip_read_data_skip,
412	    NULL,
413	    archive_read_format_7zip_cleanup);
414
415	if (r != ARCHIVE_OK)
416		free(zip);
417	return (ARCHIVE_OK);
418}
419
420static int
421archive_read_format_7zip_bid(struct archive_read *a, int best_bid)
422{
423	const char *p;
424
425	/* If someone has already bid more than 32, then avoid
426	   trashing the look-ahead buffers with a seek. */
427	if (best_bid > 32)
428		return (-1);
429
430	if ((p = __archive_read_ahead(a, 6, NULL)) == NULL)
431		return (0);
432
433	/* If first six bytes are the 7-Zip signature,
434	 * return the bid right now. */
435	if (memcmp(p, _7ZIP_SIGNATURE, 6) == 0)
436		return (48);
437
438	/*
439	 * It may a 7-Zip SFX archive file. If first two bytes are
440	 * 'M' and 'Z' available on Windows or first four bytes are
441	 * "\x7F\x45LF" available on posix like system, seek the 7-Zip
442	 * signature. Although we will perform a seek when reading
443	 * a header, what we do not use __archive_read_seek() here is
444	 * due to a bidding performance.
445	 */
446	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
447		ssize_t offset = SFX_MIN_ADDR;
448		ssize_t window = 4096;
449		ssize_t bytes_avail;
450		while (offset + window <= (SFX_MAX_ADDR)) {
451			const char *buff = __archive_read_ahead(a,
452					offset + window, &bytes_avail);
453			if (buff == NULL) {
454				/* Remaining bytes are less than window. */
455				window >>= 1;
456				if (window < 0x40)
457					return (0);
458				continue;
459			}
460			p = buff + offset;
461			while (p + 32 < buff + bytes_avail) {
462				int step = check_7zip_header_in_sfx(p);
463				if (step == 0)
464					return (48);
465				p += step;
466			}
467			offset = p - buff;
468		}
469	}
470	return (0);
471}
472
473static int
474check_7zip_header_in_sfx(const char *p)
475{
476	switch ((unsigned char)p[5]) {
477	case 0x1C:
478		if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0)
479			return (6);
480		/*
481		 * Test the CRC because its extraction code has 7-Zip
482		 * Magic Code, so we should do this in order not to
483		 * make a mis-detection.
484		 */
485		if (crc32(0, (const unsigned char *)p + 12, 20)
486			!= archive_le32dec(p + 8))
487			return (6);
488		/* Hit the header! */
489		return (0);
490	case 0x37: return (5);
491	case 0x7A: return (4);
492	case 0xBC: return (3);
493	case 0xAF: return (2);
494	case 0x27: return (1);
495	default: return (6);
496	}
497}
498
499static int
500skip_sfx(struct archive_read *a, ssize_t bytes_avail)
501{
502	const void *h;
503	const char *p, *q;
504	size_t skip, offset;
505	ssize_t bytes, window;
506
507	/*
508	 * If bytes_avail > SFX_MIN_ADDR we do not have to call
509	 * __archive_read_seek() at this time since we have
510	 * alredy had enough data.
511	 */
512	if (bytes_avail > SFX_MIN_ADDR)
513		__archive_read_consume(a, SFX_MIN_ADDR);
514	else if (__archive_read_seek(a, SFX_MIN_ADDR, SEEK_SET) < 0)
515		return (ARCHIVE_FATAL);
516
517	offset = 0;
518	window = 1;
519	while (offset + window <= SFX_MAX_ADDR - SFX_MIN_ADDR) {
520		h = __archive_read_ahead(a, window, &bytes);
521		if (h == NULL) {
522			/* Remaining bytes are less than window. */
523			window >>= 1;
524			if (window < 0x40)
525				goto fatal;
526			continue;
527		}
528		if (bytes < 6) {
529			/* This case might happen when window == 1. */
530			window = 4096;
531			continue;
532		}
533		p = (const char *)h;
534		q = p + bytes;
535
536		/*
537		 * Scan ahead until we find something that looks
538		 * like the 7-Zip header.
539		 */
540		while (p + 32 < q) {
541			int step = check_7zip_header_in_sfx(p);
542			if (step == 0) {
543				struct _7zip *zip =
544				    (struct _7zip *)a->format->data;
545				skip = p - (const char *)h;
546				__archive_read_consume(a, skip);
547				zip->seek_base = SFX_MIN_ADDR + offset + skip;
548				return (ARCHIVE_OK);
549			}
550			p += step;
551		}
552		skip = p - (const char *)h;
553		__archive_read_consume(a, skip);
554		offset += skip;
555		if (window == 1)
556			window = 4096;
557	}
558fatal:
559	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
560	    "Couldn't find out 7-Zip header");
561	return (ARCHIVE_FATAL);
562}
563
564static int
565archive_read_format_7zip_read_header(struct archive_read *a,
566	struct archive_entry *entry)
567{
568	struct _7zip *zip = (struct _7zip *)a->format->data;
569	struct _7zip_entry *zip_entry;
570	int r, ret = ARCHIVE_OK;
571
572	a->archive.archive_format = ARCHIVE_FORMAT_7ZIP;
573	if (a->archive.archive_format_name == NULL)
574		a->archive.archive_format_name = "7-Zip";
575
576	if (zip->entries == NULL) {
577		struct _7z_header_info header;
578
579		memset(&header, 0, sizeof(header));
580		r = slurp_central_directory(a, zip, &header);
581		free_Header(&header);
582		if (r != ARCHIVE_OK)
583			return (r);
584		zip->entries_remaining = (size_t)zip->numFiles;
585		zip->entry = zip->entries;
586	} else {
587		++zip->entry;
588	}
589	zip_entry = zip->entry;
590
591	if (zip->entries_remaining <= 0)
592		return ARCHIVE_EOF;
593	--zip->entries_remaining;
594
595	zip->entry_offset = 0;
596	zip->end_of_entry = 0;
597	zip->entry_crc32 = crc32(0, NULL, 0);
598
599	/* Setup a string conversion for a filename. */
600	if (zip->sconv == NULL) {
601		zip->sconv = archive_string_conversion_from_charset(
602		    &a->archive, "UTF-16LE", 1);
603		if (zip->sconv == NULL)
604			return (ARCHIVE_FATAL);
605	}
606
607	if (archive_entry_copy_pathname_l(entry,
608	    (const char *)zip_entry->utf16name,
609	    zip_entry->name_len, zip->sconv) != 0) {
610		if (errno == ENOMEM) {
611			archive_set_error(&a->archive, ENOMEM,
612			    "Can't allocate memory for Pathname");
613			return (ARCHIVE_FATAL);
614		}
615		archive_set_error(&a->archive,
616		    ARCHIVE_ERRNO_FILE_FORMAT,
617		    "Pathname cannot be converted "
618		    "from %s to current locale.",
619		    archive_string_conversion_charset_name(zip->sconv));
620		ret = ARCHIVE_WARN;
621	}
622
623	/* Populate some additional entry fields: */
624	archive_entry_set_mode(entry, zip_entry->mode);
625	if (zip_entry->flg & MTIME_IS_SET)
626		archive_entry_set_mtime(entry, zip_entry->mtime,
627			zip_entry->mtime_ns);
628	if (zip_entry->flg & CTIME_IS_SET)
629		archive_entry_set_ctime(entry, zip_entry->ctime,
630		    zip_entry->ctime_ns);
631	if (zip_entry->flg & ATIME_IS_SET)
632		archive_entry_set_atime(entry, zip_entry->atime,
633		    zip_entry->atime_ns);
634	if (zip_entry->ssIndex != (uint32_t)-1) {
635		zip->entry_bytes_remaining =
636		    zip->si.ss.unpackSizes[zip_entry->ssIndex];
637		archive_entry_set_size(entry, zip->entry_bytes_remaining);
638	} else {
639		zip->entry_bytes_remaining = 0;
640		archive_entry_set_size(entry, 0);
641	}
642
643	/* If there's no body, force read_data() to return EOF immediately. */
644	if (zip->entry_bytes_remaining < 1)
645		zip->end_of_entry = 1;
646
647	if ((zip_entry->mode & AE_IFMT) == AE_IFLNK) {
648		unsigned char *symname = NULL;
649		size_t symsize = 0;
650
651		/*
652		 * Symbolic-name is recorded as its contents. We have to
653		 * read the contents at this time.
654		 */
655		while (zip->entry_bytes_remaining > 0) {
656			const void *buff;
657			unsigned char *mem;
658			size_t size;
659			int64_t offset;
660
661			r = archive_read_format_7zip_read_data(a, &buff,
662				&size, &offset);
663			if (r < ARCHIVE_WARN) {
664				free(symname);
665				return (r);
666			}
667			mem = realloc(symname, symsize + size + 1);
668			if (mem == NULL) {
669				free(symname);
670				archive_set_error(&a->archive, ENOMEM,
671				    "Can't allocate memory for Symname");
672				return (ARCHIVE_FATAL);
673			}
674			symname = mem;
675			memcpy(symname+symsize, buff, size);
676			symsize += size;
677		}
678		if (symsize == 0) {
679			/* If there is no synname, handle it as a regular
680			 * file. */
681			zip_entry->mode &= ~AE_IFMT;
682			zip_entry->mode |= AE_IFREG;
683			archive_entry_set_mode(entry, zip_entry->mode);
684		} else {
685			symname[symsize] = '\0';
686			archive_entry_copy_symlink(entry,
687			    (const char *)symname);
688		}
689		free(symname);
690		archive_entry_set_size(entry, 0);
691	}
692
693	/* Set up a more descriptive format name. */
694	sprintf(zip->format_name, "7-Zip");
695	a->archive.archive_format_name = zip->format_name;
696
697	return (ret);
698}
699
700static int
701archive_read_format_7zip_read_data(struct archive_read *a,
702    const void **buff, size_t *size, int64_t *offset)
703{
704	struct _7zip *zip;
705	ssize_t bytes;
706	int ret = ARCHIVE_OK;
707
708	zip = (struct _7zip *)(a->format->data);
709
710	if (zip->pack_stream_bytes_unconsumed)
711		read_consume(a);
712
713	*offset = zip->entry_offset;
714	*size = 0;
715	*buff = NULL;
716	/*
717	 * If we hit end-of-entry last time, clean up and return
718	 * ARCHIVE_EOF this time.
719	 */
720	if (zip->end_of_entry)
721		return (ARCHIVE_EOF);
722
723	bytes = read_stream(a, buff,
724		(size_t)zip->entry_bytes_remaining, 0);
725	if (bytes < 0)
726		return ((int)bytes);
727	if (bytes == 0) {
728		archive_set_error(&a->archive,
729		    ARCHIVE_ERRNO_FILE_FORMAT,
730		    "Truncated 7-Zip file body");
731		return (ARCHIVE_FATAL);
732	}
733	zip->entry_bytes_remaining -= bytes;
734	if (zip->entry_bytes_remaining == 0)
735		zip->end_of_entry = 1;
736
737	/* Update checksum */
738	if ((zip->entry->flg & CRC32_IS_SET) && bytes)
739		zip->entry_crc32 = crc32(zip->entry_crc32, *buff,
740		    (unsigned)bytes);
741
742	/* If we hit the end, swallow any end-of-data marker. */
743	if (zip->end_of_entry) {
744		/* Check computed CRC against file contents. */
745		if ((zip->entry->flg & CRC32_IS_SET) &&
746			zip->si.ss.digests[zip->entry->ssIndex] !=
747		    zip->entry_crc32) {
748			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
749			    "7-Zip bad CRC: 0x%lx should be 0x%lx",
750			    (unsigned long)zip->entry_crc32,
751			    (unsigned long)zip->si.ss.digests[
752			    		zip->entry->ssIndex]);
753			ret = ARCHIVE_WARN;
754		}
755	}
756
757	*size = bytes;
758	*offset = zip->entry_offset;
759	zip->entry_offset += bytes;
760
761	return (ret);
762}
763
764static int
765archive_read_format_7zip_read_data_skip(struct archive_read *a)
766{
767	struct _7zip *zip;
768	int64_t bytes_skipped;
769
770	zip = (struct _7zip *)(a->format->data);
771
772	if (zip->pack_stream_bytes_unconsumed)
773		read_consume(a);
774
775	/* If we've already read to end of data, we're done. */
776	if (zip->end_of_entry)
777		return (ARCHIVE_OK);
778
779	/*
780	 * If the length is at the beginning, we can skip the
781	 * compressed data much more quickly.
782	 */
783	bytes_skipped = skip_stream(a, (size_t)zip->entry_bytes_remaining);
784	if (bytes_skipped < 0)
785		return (ARCHIVE_FATAL);
786	zip->entry_bytes_remaining = 0;
787
788	/* This entry is finished and done. */
789	zip->end_of_entry = 1;
790	return (ARCHIVE_OK);
791}
792
793static int
794archive_read_format_7zip_cleanup(struct archive_read *a)
795{
796	struct _7zip *zip;
797
798	zip = (struct _7zip *)(a->format->data);
799	free_StreamsInfo(&(zip->si));
800	free(zip->entries);
801	free(zip->entry_names);
802	free_decompression(a, zip);
803	free(zip->uncompressed_buffer);
804	free(zip->sub_stream_buff[0]);
805	free(zip->sub_stream_buff[1]);
806	free(zip->sub_stream_buff[2]);
807	free(zip->tmp_stream_buff);
808	free(zip);
809	(a->format->data) = NULL;
810	return (ARCHIVE_OK);
811}
812
813static void
814read_consume(struct archive_read *a)
815{
816	struct _7zip *zip = (struct _7zip *)a->format->data;
817
818	if (zip->pack_stream_bytes_unconsumed) {
819		__archive_read_consume(a, zip->pack_stream_bytes_unconsumed);
820		zip->stream_offset += zip->pack_stream_bytes_unconsumed;
821		zip->pack_stream_bytes_unconsumed = 0;
822	}
823}
824
825#ifdef HAVE_LZMA_H
826
827/*
828 * Set an error code and choose an error message for liblzma.
829 */
830static void
831set_error(struct archive_read *a, int ret)
832{
833
834	switch (ret) {
835	case LZMA_STREAM_END: /* Found end of stream. */
836	case LZMA_OK: /* Decompressor made some progress. */
837		break;
838	case LZMA_MEM_ERROR:
839		archive_set_error(&a->archive, ENOMEM,
840		    "Lzma library error: Cannot allocate memory");
841		break;
842	case LZMA_MEMLIMIT_ERROR:
843		archive_set_error(&a->archive, ENOMEM,
844		    "Lzma library error: Out of memory");
845		break;
846	case LZMA_FORMAT_ERROR:
847		archive_set_error(&a->archive,
848		    ARCHIVE_ERRNO_MISC,
849		    "Lzma library error: format not recognized");
850		break;
851	case LZMA_OPTIONS_ERROR:
852		archive_set_error(&a->archive,
853		    ARCHIVE_ERRNO_MISC,
854		    "Lzma library error: Invalid options");
855		break;
856	case LZMA_DATA_ERROR:
857		archive_set_error(&a->archive,
858		    ARCHIVE_ERRNO_MISC,
859		    "Lzma library error: Corrupted input data");
860		break;
861	case LZMA_BUF_ERROR:
862		archive_set_error(&a->archive,
863		    ARCHIVE_ERRNO_MISC,
864		    "Lzma library error:  No progress is possible");
865		break;
866	default:
867		/* Return an error. */
868		archive_set_error(&a->archive,
869		    ARCHIVE_ERRNO_MISC,
870		    "Lzma decompression failed:  Unknown error");
871		break;
872	}
873}
874
875#endif
876
877static unsigned long
878decode_codec_id(const unsigned char *codecId, size_t id_size)
879{
880	unsigned i;
881	unsigned long id = 0;
882
883	for (i = 0; i < id_size; i++) {
884		id <<= 8;
885		id += codecId[i];
886	}
887	return (id);
888}
889
890static void *
891ppmd_alloc(void *p, size_t size)
892{
893	(void)p;
894	return malloc(size);
895}
896static void
897ppmd_free(void *p, void *address)
898{
899	(void)p;
900	free(address);
901}
902static Byte
903ppmd_read(void *p)
904{
905	struct archive_read *a = ((IByteIn*)p)->a;
906	struct _7zip *zip = (struct _7zip *)(a->format->data);
907	Byte b;
908
909	if (zip->ppstream.avail_in == 0) {
910		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
911		    "Truncated RAR file data");
912		zip->ppstream.overconsumed = 1;
913		return (0);
914	}
915	b = *zip->ppstream.next_in++;
916	zip->ppstream.avail_in--;
917	zip->ppstream.total_in++;
918	return (b);
919}
920
921static ISzAlloc g_szalloc = { ppmd_alloc, ppmd_free };
922
923static int
924init_decompression(struct archive_read *a, struct _7zip *zip,
925    const struct _7z_coder *coder1, const struct _7z_coder *coder2)
926{
927	int r;
928
929	zip->codec = coder1->codec;
930	zip->codec2 = -1;
931
932	switch (zip->codec) {
933	case _7Z_COPY:
934	case _7Z_BZ2:
935	case _7Z_DEFLATE:
936	case _7Z_PPMD:
937		if (coder2 != NULL) {
938			if (coder2->codec != _7Z_X86 &&
939			    coder2->codec != _7Z_X86_BCJ2) {
940				archive_set_error(&a->archive,
941				    ARCHIVE_ERRNO_MISC,
942				    "Unsupported filter %lx for %lx",
943				    coder2->codec, coder1->codec);
944				return (ARCHIVE_FAILED);
945			}
946			zip->codec2 = coder2->codec;
947			zip->bcj_state = 0;
948			if (coder2->codec == _7Z_X86)
949				x86_Init(zip);
950		}
951		break;
952	default:
953		break;
954	}
955
956	switch (zip->codec) {
957	case _7Z_COPY:
958		break;
959
960	case _7Z_LZMA: case _7Z_LZMA2:
961#ifdef HAVE_LZMA_H
962#if LZMA_VERSION_MAJOR >= 5
963/* Effectively disable the limiter. */
964#define LZMA_MEMLIMIT   UINT64_MAX
965#else
966/* NOTE: This needs to check memory size which running system has. */
967#define LZMA_MEMLIMIT   (1U << 30)
968#endif
969	{
970		lzma_options_delta delta_opt;
971		lzma_filter filters[LZMA_FILTERS_MAX];
972#if LZMA_VERSION < 50000030
973		lzma_filter *ff;
974#endif
975		int fi = 0;
976
977		if (zip->lzstream_valid) {
978			lzma_end(&(zip->lzstream));
979			zip->lzstream_valid = 0;
980		}
981
982		/*
983		 * NOTE: liblzma incompletely handle the BCJ+LZMA compressed
984		 * data made by 7-Zip because 7-Zip does not add End-Of-
985		 * Payload Marker(EOPM) at the end of LZMA compressed data,
986		 * and so liblzma cannot know the end of the compressed data
987		 * without EOPM. So consequently liblzma will not return last
988		 * three or four bytes of uncompressed data because
989		 * LZMA_FILTER_X86 filter does not handle input data if its
990		 * data size is less than five bytes. If liblzma detect EOPM
991		 * or know the uncompressed data size, liblzma will flush out
992		 * the remaining that three or four bytes of uncompressed
993		 * data. That is why we have to use our converting program
994		 * for BCJ+LZMA. If we were able to tell the uncompressed
995		 * size to liblzma when using lzma_raw_decoder() liblzma
996		 * could correctly deal with BCJ+LZMA. But unfortunately
997		 * there is no way to do that.
998		 * Discussion about this can be found at XZ Utils forum.
999		 */
1000		if (coder2 != NULL) {
1001			zip->codec2 = coder2->codec;
1002
1003			filters[fi].options = NULL;
1004			switch (zip->codec2) {
1005			case _7Z_X86:
1006				if (zip->codec == _7Z_LZMA2) {
1007					filters[fi].id = LZMA_FILTER_X86;
1008					fi++;
1009				} else
1010					/* Use our filter. */
1011					x86_Init(zip);
1012				break;
1013			case _7Z_X86_BCJ2:
1014				/* Use our filter. */
1015				zip->bcj_state = 0;
1016				break;
1017			case _7Z_DELTA:
1018				filters[fi].id = LZMA_FILTER_DELTA;
1019				memset(&delta_opt, 0, sizeof(delta_opt));
1020				delta_opt.type = LZMA_DELTA_TYPE_BYTE;
1021				delta_opt.dist = 1;
1022				filters[fi].options = &delta_opt;
1023				fi++;
1024				break;
1025			/* Following filters have not been tested yet. */
1026			case _7Z_POWERPC:
1027				filters[fi].id = LZMA_FILTER_POWERPC;
1028				fi++;
1029				break;
1030			case _7Z_IA64:
1031				filters[fi].id = LZMA_FILTER_IA64;
1032				fi++;
1033				break;
1034			case _7Z_ARM:
1035				filters[fi].id = LZMA_FILTER_ARM;
1036				fi++;
1037				break;
1038			case _7Z_ARMTHUMB:
1039				filters[fi].id = LZMA_FILTER_ARMTHUMB;
1040				fi++;
1041				break;
1042			case _7Z_SPARC:
1043				filters[fi].id = LZMA_FILTER_SPARC;
1044				fi++;
1045				break;
1046			default:
1047				archive_set_error(&a->archive,
1048				    ARCHIVE_ERRNO_MISC,
1049				    "Unexpected codec ID: %lX", zip->codec2);
1050				return (ARCHIVE_FAILED);
1051			}
1052		}
1053
1054		if (zip->codec == _7Z_LZMA2)
1055			filters[fi].id = LZMA_FILTER_LZMA2;
1056		else
1057			filters[fi].id = LZMA_FILTER_LZMA1;
1058		filters[fi].options = NULL;
1059#if LZMA_VERSION < 50000030
1060		ff = &filters[fi];
1061#endif
1062		r = lzma_properties_decode(&filters[fi], NULL,
1063		    coder1->properties, (size_t)coder1->propertiesSize);
1064		if (r != LZMA_OK) {
1065			set_error(a, r);
1066			return (ARCHIVE_FAILED);
1067		}
1068		fi++;
1069
1070		filters[fi].id = LZMA_VLI_UNKNOWN;
1071		filters[fi].options = NULL;
1072		r = lzma_raw_decoder(&(zip->lzstream), filters);
1073#if LZMA_VERSION < 50000030
1074		free(ff->options);
1075#endif
1076		if (r != LZMA_OK) {
1077			set_error(a, r);
1078			return (ARCHIVE_FAILED);
1079		}
1080		zip->lzstream_valid = 1;
1081		zip->lzstream.total_in = 0;
1082		zip->lzstream.total_out = 0;
1083		break;
1084	}
1085#else
1086		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1087		    "LZMA codec is unsupported");
1088		return (ARCHIVE_FAILED);
1089#endif
1090	case _7Z_BZ2:
1091#if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1092		if (zip->bzstream_valid) {
1093			BZ2_bzDecompressEnd(&(zip->bzstream));
1094			zip->bzstream_valid = 0;
1095		}
1096		r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 0);
1097		if (r == BZ_MEM_ERROR)
1098			r = BZ2_bzDecompressInit(&(zip->bzstream), 0, 1);
1099		if (r != BZ_OK) {
1100			int err = ARCHIVE_ERRNO_MISC;
1101			const char *detail = NULL;
1102			switch (r) {
1103			case BZ_PARAM_ERROR:
1104				detail = "invalid setup parameter";
1105				break;
1106			case BZ_MEM_ERROR:
1107				err = ENOMEM;
1108				detail = "out of memory";
1109				break;
1110			case BZ_CONFIG_ERROR:
1111				detail = "mis-compiled library";
1112				break;
1113			}
1114			archive_set_error(&a->archive, err,
1115			    "Internal error initializing decompressor: %s",
1116			    detail == NULL ? "??" : detail);
1117			zip->bzstream_valid = 0;
1118			return (ARCHIVE_FAILED);
1119		}
1120		zip->bzstream_valid = 1;
1121		zip->bzstream.total_in_lo32 = 0;
1122		zip->bzstream.total_in_hi32 = 0;
1123		zip->bzstream.total_out_lo32 = 0;
1124		zip->bzstream.total_out_hi32 = 0;
1125		break;
1126#else
1127		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1128		    "BZ2 codec is unsupported");
1129		return (ARCHIVE_FAILED);
1130#endif
1131	case _7Z_DEFLATE:
1132#ifdef HAVE_ZLIB_H
1133		if (zip->stream_valid)
1134			r = inflateReset(&(zip->stream));
1135		else
1136			r = inflateInit2(&(zip->stream),
1137			    -15 /* Don't check for zlib header */);
1138		if (r != Z_OK) {
1139			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1140			    "Couldn't initialize zlib stream.");
1141			return (ARCHIVE_FAILED);
1142		}
1143		zip->stream_valid = 1;
1144		zip->stream.total_in = 0;
1145		zip->stream.total_out = 0;
1146		break;
1147#else
1148		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1149		    "DEFLATE codec is unsupported");
1150		return (ARCHIVE_FAILED);
1151#endif
1152	case _7Z_PPMD:
1153	{
1154		unsigned order;
1155		uint32_t msize;
1156
1157		if (zip->ppmd7_valid) {
1158			__archive_ppmd7_functions.Ppmd7_Free(
1159			    &zip->ppmd7_context, &g_szalloc);
1160			zip->ppmd7_valid = 0;
1161		}
1162
1163		if (coder1->propertiesSize < 5) {
1164			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1165			    "Malformed PPMd parameter");
1166			return (ARCHIVE_FAILED);
1167		}
1168		order = coder1->properties[0];
1169		msize = archive_le32dec(&(coder1->properties[1]));
1170		if (order < PPMD7_MIN_ORDER || order > PPMD7_MAX_ORDER ||
1171		    msize < PPMD7_MIN_MEM_SIZE || msize > PPMD7_MAX_MEM_SIZE) {
1172			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1173			    "Malformed PPMd parameter");
1174			return (ARCHIVE_FAILED);
1175		}
1176		__archive_ppmd7_functions.Ppmd7_Construct(&zip->ppmd7_context);
1177		r = __archive_ppmd7_functions.Ppmd7_Alloc(
1178			&zip->ppmd7_context, msize, &g_szalloc);
1179		if (r == 0) {
1180			archive_set_error(&a->archive, ENOMEM,
1181			    "Coludn't allocate memory for PPMd");
1182			return (ARCHIVE_FATAL);
1183		}
1184		__archive_ppmd7_functions.Ppmd7_Init(
1185			&zip->ppmd7_context, order);
1186		__archive_ppmd7_functions.Ppmd7z_RangeDec_CreateVTable(
1187			&zip->range_dec);
1188		zip->ppmd7_valid = 1;
1189		zip->ppmd7_stat = 0;
1190		zip->ppstream.overconsumed = 0;
1191		zip->ppstream.total_in = 0;
1192		zip->ppstream.total_out = 0;
1193		break;
1194	}
1195	case _7Z_X86:
1196	case _7Z_X86_BCJ2:
1197	case _7Z_POWERPC:
1198	case _7Z_IA64:
1199	case _7Z_ARM:
1200	case _7Z_ARMTHUMB:
1201	case _7Z_SPARC:
1202	case _7Z_DELTA:
1203		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1204		    "Unexpected codec ID: %lX", zip->codec);
1205		return (ARCHIVE_FAILED);
1206	default:
1207		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1208		    "Unknown codec ID: %lX", zip->codec);
1209		return (ARCHIVE_FAILED);
1210	}
1211
1212	return (ARCHIVE_OK);
1213}
1214
1215static int
1216decompress(struct archive_read *a, struct _7zip *zip,
1217    void *buff, size_t *outbytes, const void *b, size_t *used)
1218{
1219	const uint8_t *t_next_in;
1220	uint8_t *t_next_out;
1221	size_t o_avail_in, o_avail_out;
1222	size_t t_avail_in, t_avail_out;
1223	uint8_t *bcj2_next_out;
1224	size_t bcj2_avail_out;
1225	int r, ret = ARCHIVE_OK;
1226
1227	t_avail_in = o_avail_in = *used;
1228	t_avail_out = o_avail_out = *outbytes;
1229	t_next_in = b;
1230	t_next_out = buff;
1231
1232	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1233		int i;
1234
1235		/* Do not copy out the BCJ remaining bytes when the output
1236		 * buffer size is less than five bytes. */
1237		if (o_avail_in != 0 && t_avail_out < 5 && zip->odd_bcj_size) {
1238			*used = 0;
1239			*outbytes = 0;
1240			return (ret);
1241		}
1242		for (i = 0; zip->odd_bcj_size > 0 && t_avail_out; i++) {
1243			*t_next_out++ = zip->odd_bcj[i];
1244			t_avail_out--;
1245			zip->odd_bcj_size--;
1246		}
1247		if (o_avail_in == 0 || t_avail_out == 0) {
1248			*used = o_avail_in - t_avail_in;
1249			*outbytes = o_avail_out - t_avail_out;
1250			if (o_avail_in == 0)
1251				ret = ARCHIVE_EOF;
1252			return (ret);
1253		}
1254	}
1255
1256	bcj2_next_out = t_next_out;
1257	bcj2_avail_out = t_avail_out;
1258	if (zip->codec2 == _7Z_X86_BCJ2) {
1259		/*
1260		 * Decord a remaining decompressed main stream for BCJ2.
1261		 */
1262		if (zip->tmp_stream_bytes_remaining) {
1263			ssize_t bytes;
1264			size_t remaining = zip->tmp_stream_bytes_remaining;
1265			bytes = Bcj2_Decode(zip, t_next_out, t_avail_out);
1266			if (bytes < 0) {
1267				archive_set_error(&(a->archive),
1268				    ARCHIVE_ERRNO_MISC,
1269				    "BCJ2 conversion Failed");
1270				return (ARCHIVE_FAILED);
1271			}
1272			zip->main_stream_bytes_remaining -=
1273			    remaining - zip->tmp_stream_bytes_remaining;
1274			t_avail_out -= bytes;
1275			if (o_avail_in == 0 || t_avail_out == 0) {
1276				*used = 0;
1277				*outbytes = o_avail_out - t_avail_out;
1278				if (o_avail_in == 0 &&
1279				    zip->tmp_stream_bytes_remaining)
1280					ret = ARCHIVE_EOF;
1281				return (ret);
1282			}
1283			t_next_out += bytes;
1284			bcj2_next_out = t_next_out;
1285			bcj2_avail_out = t_avail_out;
1286		}
1287		t_next_out = zip->tmp_stream_buff;
1288		t_avail_out = zip->tmp_stream_buff_size;
1289	}
1290
1291	switch (zip->codec) {
1292	case _7Z_COPY:
1293	{
1294		size_t bytes =
1295		    (t_avail_in > t_avail_out)?t_avail_out:t_avail_in;
1296
1297		memcpy(t_next_out, t_next_in, bytes);
1298		t_avail_in -= bytes;
1299		t_avail_out -= bytes;
1300		if (o_avail_in == 0)
1301			ret = ARCHIVE_EOF;
1302		break;
1303	}
1304#ifdef HAVE_LZMA_H
1305	case _7Z_LZMA: case _7Z_LZMA2:
1306		zip->lzstream.next_in = t_next_in;
1307		zip->lzstream.avail_in = t_avail_in;
1308		zip->lzstream.next_out = t_next_out;
1309		zip->lzstream.avail_out = t_avail_out;
1310
1311		r = lzma_code(&(zip->lzstream), LZMA_RUN);
1312		switch (r) {
1313		case LZMA_STREAM_END: /* Found end of stream. */
1314			lzma_end(&(zip->lzstream));
1315			zip->lzstream_valid = 0;
1316			ret = ARCHIVE_EOF;
1317			break;
1318		case LZMA_OK: /* Decompressor made some progress. */
1319			break;
1320		default:
1321			archive_set_error(&(a->archive),
1322			    ARCHIVE_ERRNO_MISC,
1323				"Decompression failed(%d)",
1324			    r);
1325			return (ARCHIVE_FAILED);
1326		}
1327		t_avail_in = zip->lzstream.avail_in;
1328		t_avail_out = zip->lzstream.avail_out;
1329		break;
1330#endif
1331#if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1332	case _7Z_BZ2:
1333		zip->bzstream.next_in = (char *)(uintptr_t)t_next_in;
1334		zip->bzstream.avail_in = t_avail_in;
1335		zip->bzstream.next_out = (char *)(uintptr_t)t_next_out;
1336		zip->bzstream.avail_out = t_avail_out;
1337		r = BZ2_bzDecompress(&(zip->bzstream));
1338		switch (r) {
1339		case BZ_STREAM_END: /* Found end of stream. */
1340			switch (BZ2_bzDecompressEnd(&(zip->bzstream))) {
1341			case BZ_OK:
1342				break;
1343			default:
1344				archive_set_error(&(a->archive),
1345				    ARCHIVE_ERRNO_MISC,
1346				    "Failed to clean up decompressor");
1347				return (ARCHIVE_FAILED);
1348			}
1349			zip->bzstream_valid = 0;
1350			ret = ARCHIVE_EOF;
1351			break;
1352		case BZ_OK: /* Decompressor made some progress. */
1353			break;
1354		default:
1355			archive_set_error(&(a->archive),
1356			    ARCHIVE_ERRNO_MISC,
1357			    "bzip decompression failed");
1358			return (ARCHIVE_FAILED);
1359		}
1360		t_avail_in = zip->bzstream.avail_in;
1361		t_avail_out = zip->bzstream.avail_out;
1362		break;
1363#endif
1364#ifdef HAVE_ZLIB_H
1365	case _7Z_DEFLATE:
1366		zip->stream.next_in = (Bytef *)(uintptr_t)t_next_in;
1367		zip->stream.avail_in = (uInt)t_avail_in;
1368		zip->stream.next_out = t_next_out;
1369		zip->stream.avail_out = (uInt)t_avail_out;
1370		r = inflate(&(zip->stream), 0);
1371		switch (r) {
1372		case Z_STREAM_END: /* Found end of stream. */
1373			ret = ARCHIVE_EOF;
1374			break;
1375		case Z_OK: /* Decompressor made some progress.*/
1376			break;
1377		default:
1378			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1379			    "File decompression failed (%d)", r);
1380			return (ARCHIVE_FAILED);
1381		}
1382		t_avail_in = zip->stream.avail_in;
1383		t_avail_out = zip->stream.avail_out;
1384		break;
1385#endif
1386	case _7Z_PPMD:
1387	{
1388		uint64_t flush_bytes;
1389
1390		if (!zip->ppmd7_valid || zip->ppmd7_stat < 0 ||
1391		    t_avail_out <= 0) {
1392			archive_set_error(&(a->archive),
1393			    ARCHIVE_ERRNO_MISC,
1394			    "Decompression internal error");
1395			return (ARCHIVE_FAILED);
1396		}
1397		zip->ppstream.next_in = t_next_in;
1398		zip->ppstream.avail_in = t_avail_in;
1399		zip->ppstream.next_out = t_next_out;
1400		zip->ppstream.avail_out = t_avail_out;
1401		if (zip->ppmd7_stat == 0) {
1402			zip->bytein.a = a;
1403			zip->bytein.Read = &ppmd_read;
1404			zip->range_dec.Stream = &zip->bytein;
1405			r = __archive_ppmd7_functions.Ppmd7z_RangeDec_Init(
1406				&(zip->range_dec));
1407			if (r == 0) {
1408				zip->ppmd7_stat = -1;
1409				archive_set_error(&a->archive,
1410				    ARCHIVE_ERRNO_MISC,
1411				    "Failed to initialize PPMd range decorder");
1412				return (ARCHIVE_FAILED);
1413			}
1414			if (zip->ppstream.overconsumed) {
1415				zip->ppmd7_stat = -1;
1416				return (ARCHIVE_FAILED);
1417			}
1418			zip->ppmd7_stat = 1;
1419		}
1420
1421		if (t_avail_in == 0)
1422			/* XXX Flush out remaining decoded data XXX */
1423			flush_bytes = zip->folder_outbytes_remaining;
1424		else
1425			flush_bytes = 0;
1426
1427		do {
1428			int sym;
1429
1430			sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1431				&(zip->ppmd7_context), &(zip->range_dec.p));
1432			if (sym < 0) {
1433				zip->ppmd7_stat = -1;
1434				archive_set_error(&a->archive,
1435				    ARCHIVE_ERRNO_FILE_FORMAT,
1436				    "Failed to decode PPMd");
1437				return (ARCHIVE_FAILED);
1438			}
1439			if (zip->ppstream.overconsumed) {
1440				zip->ppmd7_stat = -1;
1441				return (ARCHIVE_FAILED);
1442			}
1443			*zip->ppstream.next_out++ = (unsigned char)sym;
1444			zip->ppstream.avail_out--;
1445			zip->ppstream.total_out++;
1446			if (flush_bytes)
1447				flush_bytes--;
1448		} while (zip->ppstream.avail_out &&
1449			(zip->ppstream.avail_in || flush_bytes));
1450
1451		t_avail_in = (size_t)zip->ppstream.avail_in;
1452		t_avail_out = (size_t)zip->ppstream.avail_out;
1453		break;
1454	}
1455	default:
1456		archive_set_error(&(a->archive), ARCHIVE_ERRNO_MISC,
1457		    "Decompression internal error");
1458		return (ARCHIVE_FAILED);
1459	}
1460	if (ret != ARCHIVE_OK && ret != ARCHIVE_EOF)
1461		return (ret);
1462
1463	*used = o_avail_in - t_avail_in;
1464	*outbytes = o_avail_out - t_avail_out;
1465
1466	/*
1467	 * Decord BCJ.
1468	 */
1469	if (zip->codec != _7Z_LZMA2 && zip->codec2 == _7Z_X86) {
1470		size_t l = x86_Convert(zip, buff, *outbytes);
1471		zip->odd_bcj_size = *outbytes - l;
1472		if (zip->odd_bcj_size > 0 && zip->odd_bcj_size <= 4 &&
1473		    o_avail_in && ret != ARCHIVE_EOF) {
1474			memcpy(zip->odd_bcj, ((unsigned char *)buff) + l,
1475			    zip->odd_bcj_size);
1476			*outbytes = l;
1477		} else
1478			zip->odd_bcj_size = 0;
1479	}
1480
1481	/*
1482	 * Decord BCJ2 with a decompressed main stream.
1483	 */
1484	if (zip->codec2 == _7Z_X86_BCJ2) {
1485		ssize_t bytes;
1486
1487		zip->tmp_stream_bytes_avail =
1488		    zip->tmp_stream_buff_size - t_avail_out;
1489		if (zip->tmp_stream_bytes_avail >
1490		      zip->main_stream_bytes_remaining)
1491			zip->tmp_stream_bytes_avail =
1492			    zip->main_stream_bytes_remaining;
1493		zip->tmp_stream_bytes_remaining = zip->tmp_stream_bytes_avail;
1494		bytes = Bcj2_Decode(zip, bcj2_next_out, bcj2_avail_out);
1495		if (bytes < 0) {
1496			archive_set_error(&(a->archive),
1497			    ARCHIVE_ERRNO_MISC, "BCJ2 conversion Failed");
1498			return (ARCHIVE_FAILED);
1499		}
1500		zip->main_stream_bytes_remaining -=
1501		    zip->tmp_stream_bytes_avail
1502		      - zip->tmp_stream_bytes_remaining;
1503		bcj2_avail_out -= bytes;
1504		*outbytes = o_avail_out - bcj2_avail_out;
1505	}
1506
1507	return (ret);
1508}
1509
1510static int
1511free_decompression(struct archive_read *a, struct _7zip *zip)
1512{
1513	int r = ARCHIVE_OK;
1514
1515#if !defined(HAVE_ZLIB_H) &&\
1516	!(defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR))
1517	(void)a;/* UNUSED */
1518#endif
1519#ifdef HAVE_LZMA_H
1520	if (zip->lzstream_valid)
1521		lzma_end(&(zip->lzstream));
1522#endif
1523#if defined(HAVE_BZLIB_H) && defined(BZ_CONFIG_ERROR)
1524	if (zip->bzstream_valid) {
1525		if (BZ2_bzDecompressEnd(&(zip->bzstream)) != BZ_OK) {
1526			archive_set_error(&a->archive,
1527			    ARCHIVE_ERRNO_MISC,
1528			    "Failed to clean up bzip2 decompressor");
1529			r = ARCHIVE_FATAL;
1530		}
1531		zip->bzstream_valid = 0;
1532	}
1533#endif
1534#ifdef HAVE_ZLIB_H
1535	if (zip->stream_valid) {
1536		if (inflateEnd(&(zip->stream)) != Z_OK) {
1537			archive_set_error(&a->archive,
1538			    ARCHIVE_ERRNO_MISC,
1539			    "Failed to clean up zlib decompressor");
1540			r = ARCHIVE_FATAL;
1541		}
1542		zip->stream_valid = 0;
1543	}
1544#endif
1545	if (zip->ppmd7_valid) {
1546		__archive_ppmd7_functions.Ppmd7_Free(
1547			&zip->ppmd7_context, &g_szalloc);
1548		zip->ppmd7_valid = 0;
1549	}
1550	return (r);
1551}
1552
1553static int
1554parse_7zip_uint64(struct archive_read *a, uint64_t *val)
1555{
1556	const unsigned char *p;
1557	unsigned char avail, mask;
1558	int i;
1559
1560	if ((p = header_bytes(a, 1)) == NULL)
1561		return (-1);
1562	avail = *p;
1563	mask = 0x80;
1564	*val = 0;
1565	for (i = 0; i < 8; i++) {
1566		if (avail & mask) {
1567			if ((p = header_bytes(a, 1)) == NULL)
1568				return (-1);
1569			*val |= ((uint64_t)*p) << (8 * i);
1570			mask >>= 1;
1571			continue;
1572		}
1573		*val += (avail & (mask -1)) << (8 * i);
1574		break;
1575	}
1576	return (0);
1577}
1578
1579static int
1580read_Bools(struct archive_read *a, unsigned char *data, size_t num)
1581{
1582	const unsigned char *p;
1583	unsigned i, mask = 0, avail = 0;
1584
1585	for (i = 0; i < num; i++) {
1586		if (mask == 0) {
1587			if ((p = header_bytes(a, 1)) == NULL)
1588				return (-1);
1589			avail = *p;
1590			mask = 0x80;
1591		}
1592		data[i] = (avail & mask)?1:0;
1593		mask >>= 1;
1594	}
1595	return (0);
1596}
1597
1598static void
1599free_Digest(struct _7z_digests *d)
1600{
1601	free(d->defineds);
1602	free(d->digests);
1603}
1604
1605static int
1606read_Digests(struct archive_read *a, struct _7z_digests *d, size_t num)
1607{
1608	const unsigned char *p;
1609	unsigned i;
1610
1611	if (num == 0)
1612		return (-1);
1613	memset(d, 0, sizeof(*d));
1614
1615	d->defineds = malloc(num);
1616	if (d->defineds == NULL)
1617		return (-1);
1618	/*
1619	 * Read Bools.
1620	 */
1621	if ((p = header_bytes(a, 1)) == NULL)
1622		return (-1);
1623	if (*p == 0) {
1624		if (read_Bools(a, d->defineds, num) < 0)
1625			return (-1);
1626	} else
1627		/* All are defined */
1628		memset(d->defineds, 1, num);
1629
1630	d->digests = calloc(num, sizeof(*d->digests));
1631	if (d->digests == NULL)
1632		return (-1);
1633	for (i = 0; i < num; i++) {
1634		if (d->defineds[i]) {
1635			if ((p = header_bytes(a, 4)) == NULL)
1636				return (-1);
1637			d->digests[i] = archive_le32dec(p);
1638		}
1639	}
1640
1641	return (0);
1642}
1643
1644static void
1645free_PackInfo(struct _7z_pack_info *pi)
1646{
1647	free(pi->sizes);
1648	free(pi->positions);
1649	free_Digest(&(pi->digest));
1650}
1651
1652static int
1653read_PackInfo(struct archive_read *a, struct _7z_pack_info *pi)
1654{
1655	const unsigned char *p;
1656	unsigned i;
1657
1658	memset(pi, 0, sizeof(*pi));
1659
1660	/*
1661	 * Read PackPos.
1662	 */
1663	if (parse_7zip_uint64(a, &(pi->pos)) < 0)
1664		return (-1);
1665
1666	/*
1667	 * Read NumPackStreams.
1668	 */
1669	if (parse_7zip_uint64(a, &(pi->numPackStreams)) < 0)
1670		return (-1);
1671	if (pi->numPackStreams == 0)
1672		return (-1);
1673	if (1000000 < pi->numPackStreams)
1674		return (-1);
1675
1676	/*
1677	 * Read PackSizes[num]
1678	 */
1679	if ((p = header_bytes(a, 1)) == NULL)
1680		return (-1);
1681	if (*p == kEnd)
1682		/* PackSizes[num] are not present. */
1683		return (0);
1684	if (*p != kSize)
1685		return (-1);
1686	pi->sizes = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1687	pi->positions = calloc((size_t)pi->numPackStreams, sizeof(uint64_t));
1688	if (pi->sizes == NULL || pi->positions == NULL)
1689		return (-1);
1690
1691	for (i = 0; i < pi->numPackStreams; i++) {
1692		if (parse_7zip_uint64(a, &(pi->sizes[i])) < 0)
1693			return (-1);
1694	}
1695
1696	/*
1697	 * Read PackStreamDigests[num]
1698	 */
1699	if ((p = header_bytes(a, 1)) == NULL)
1700		return (-1);
1701	if (*p == kEnd) {
1702		/* PackStreamDigests[num] are not present. */
1703		pi->digest.defineds =
1704		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.defineds));
1705		pi->digest.digests =
1706		    calloc((size_t)pi->numPackStreams, sizeof(*pi->digest.digests));
1707		if (pi->digest.defineds == NULL || pi->digest.digests == NULL)
1708			return (-1);
1709		return (0);
1710	}
1711
1712	if (*p != kSize)
1713		return (-1);
1714
1715	if (read_Digests(a, &(pi->digest), (size_t)pi->numPackStreams) < 0)
1716		return (-1);
1717
1718	/*
1719	 *  Must be marked by kEnd.
1720	 */
1721	if ((p = header_bytes(a, 1)) == NULL)
1722		return (-1);
1723	if (*p != kEnd)
1724		return (-1);
1725	return (0);
1726}
1727
1728static void
1729free_Folder(struct _7z_folder *f)
1730{
1731	unsigned i;
1732
1733	if (f->coders) {
1734		for (i = 0; i< f->numCoders; i++) {
1735			free(f->coders[i].properties);
1736		}
1737		free(f->coders);
1738	}
1739	free(f->bindPairs);
1740	free(f->packedStreams);
1741	free(f->unPackSize);
1742}
1743
1744static int
1745read_Folder(struct archive_read *a, struct _7z_folder *f)
1746{
1747	struct _7zip *zip = (struct _7zip *)a->format->data;
1748	const unsigned char *p;
1749	uint64_t numInStreamsTotal = 0;
1750	uint64_t numOutStreamsTotal = 0;
1751	unsigned i;
1752
1753	memset(f, 0, sizeof(*f));
1754
1755	/*
1756	 * Read NumCoders.
1757	 */
1758	if (parse_7zip_uint64(a, &(f->numCoders)) < 0)
1759		return (-1);
1760	if (f->numCoders > 4)
1761		/* Too many coders. */
1762		return (-1);
1763
1764	f->coders = calloc((size_t)f->numCoders, sizeof(*f->coders));
1765	if (f->coders == NULL)
1766		return (-1);
1767	for (i = 0; i< f->numCoders; i++) {
1768		size_t codec_size;
1769		int simple, attr;
1770
1771		if ((p = header_bytes(a, 1)) == NULL)
1772			return (-1);
1773		/*
1774		 * 0:3 CodecIdSize
1775		 * 4:  0 - IsSimple
1776		 *     1 - Is not Simple
1777		 * 5:  0 - No Attributes
1778		 *     1 - There are Attributes;
1779		 * 7:  Must be zero.
1780		 */
1781		codec_size = *p & 0xf;
1782		simple = (*p & 0x10)?0:1;
1783		attr = *p & 0x20;
1784		if (*p & 0x80)
1785			return (-1);/* Not supported. */
1786
1787		/*
1788		 * Read Decompression Method IDs.
1789		 */
1790		if ((p = header_bytes(a, codec_size)) == NULL)
1791			return (-1);
1792
1793		f->coders[i].codec = decode_codec_id(p, codec_size);
1794
1795		if (simple) {
1796			f->coders[i].numInStreams = 1;
1797			f->coders[i].numOutStreams = 1;
1798		} else {
1799			if (parse_7zip_uint64(
1800			    a, &(f->coders[i].numInStreams)) < 0)
1801				return (-1);
1802			if (1000000 < f->coders[i].numInStreams)
1803				return (-1);
1804			if (parse_7zip_uint64(
1805			    a, &(f->coders[i].numOutStreams)) < 0)
1806				return (-1);
1807			if (1000000 < f->coders[i].numOutStreams)
1808				return (-1);
1809		}
1810
1811		if (attr) {
1812			if (parse_7zip_uint64(
1813			    a, &(f->coders[i].propertiesSize)) < 0)
1814				return (-1);
1815			if ((p = header_bytes(
1816			    a, (size_t)f->coders[i].propertiesSize)) == NULL)
1817				return (-1);
1818			f->coders[i].properties =
1819			    malloc((size_t)f->coders[i].propertiesSize);
1820			if (f->coders[i].properties == NULL)
1821				return (-1);
1822			memcpy(f->coders[i].properties, p,
1823			    (size_t)f->coders[i].propertiesSize);
1824		}
1825
1826		numInStreamsTotal += f->coders[i].numInStreams;
1827		numOutStreamsTotal += f->coders[i].numOutStreams;
1828	}
1829
1830	if (numOutStreamsTotal == 0 ||
1831	    numInStreamsTotal < numOutStreamsTotal-1)
1832		return (-1);
1833
1834	f->numBindPairs = numOutStreamsTotal - 1;
1835	if (zip->header_bytes_remaining < f->numBindPairs)
1836			return (-1);
1837	if (f->numBindPairs > 0) {
1838		f->bindPairs =
1839			calloc((size_t)f->numBindPairs, sizeof(*f->bindPairs));
1840		if (f->bindPairs == NULL)
1841			return (-1);
1842	} else
1843		f->bindPairs = NULL;
1844	for (i = 0; i < f->numBindPairs; i++) {
1845		if (parse_7zip_uint64(a, &(f->bindPairs[i].inIndex)) < 0)
1846			return (-1);
1847		if (1000000 < f->bindPairs[i].inIndex)
1848			return (-1);
1849		if (parse_7zip_uint64(a, &(f->bindPairs[i].outIndex)) < 0)
1850			return (-1);
1851		if (1000000 < f->bindPairs[i].outIndex)
1852			return (-1);
1853	}
1854
1855	f->numPackedStreams = numInStreamsTotal - f->numBindPairs;
1856	f->packedStreams =
1857	    calloc((size_t)f->numPackedStreams, sizeof(*f->packedStreams));
1858	if (f->packedStreams == NULL)
1859		return (-1);
1860	if (f->numPackedStreams == 1) {
1861		for (i = 0; i < numInStreamsTotal; i++) {
1862			unsigned j;
1863			for (j = 0; j < f->numBindPairs; j++) {
1864				if (f->bindPairs[j].inIndex == i)
1865					break;
1866			}
1867			if (j == f->numBindPairs)
1868				break;
1869		}
1870		if (i == numInStreamsTotal)
1871			return (-1);
1872		f->packedStreams[0] = i;
1873	} else {
1874		for (i = 0; i < f->numPackedStreams; i++) {
1875			if (parse_7zip_uint64(a, &(f->packedStreams[i])) < 0)
1876				return (-1);
1877			if (1000000 < f->packedStreams[i])
1878				return (-1);
1879		}
1880	}
1881	f->numInStreams = numInStreamsTotal;
1882	f->numOutStreams = numOutStreamsTotal;
1883
1884	return (0);
1885}
1886
1887static void
1888free_CodersInfo(struct _7z_coders_info *ci)
1889{
1890	unsigned i;
1891
1892	if (ci->folders) {
1893		for (i = 0; i < ci->numFolders; i++)
1894			free_Folder(&(ci->folders[i]));
1895		free(ci->folders);
1896	}
1897}
1898
1899static int
1900read_CodersInfo(struct archive_read *a, struct _7z_coders_info *ci)
1901{
1902	const unsigned char *p;
1903	struct _7z_digests digest;
1904	unsigned i;
1905
1906	memset(ci, 0, sizeof(*ci));
1907	memset(&digest, 0, sizeof(digest));
1908
1909	if ((p = header_bytes(a, 1)) == NULL)
1910		goto failed;
1911	if (*p != kFolder)
1912		goto failed;
1913
1914	/*
1915	 * Read NumFolders.
1916	 */
1917	if (parse_7zip_uint64(a, &(ci->numFolders)) < 0)
1918		goto failed;
1919	if (1000000 < ci->numFolders)
1920			return (-1);
1921
1922	/*
1923	 * Read External.
1924	 */
1925	if ((p = header_bytes(a, 1)) == NULL)
1926		goto failed;
1927	switch (*p) {
1928	case 0:
1929		ci->folders =
1930			calloc((size_t)ci->numFolders, sizeof(*ci->folders));
1931		if (ci->folders == NULL)
1932			return (-1);
1933		for (i = 0; i < ci->numFolders; i++) {
1934			if (read_Folder(a, &(ci->folders[i])) < 0)
1935				goto failed;
1936		}
1937		break;
1938	case 1:
1939		if (parse_7zip_uint64(a, &(ci->dataStreamIndex)) < 0)
1940			return (-1);
1941		if (1000000 < ci->dataStreamIndex)
1942			return (-1);
1943		break;
1944	}
1945
1946	if ((p = header_bytes(a, 1)) == NULL)
1947		goto failed;
1948	if (*p != kCodersUnPackSize)
1949		goto failed;
1950
1951	for (i = 0; i < ci->numFolders; i++) {
1952		struct _7z_folder *folder = &(ci->folders[i]);
1953		unsigned j;
1954
1955		folder->unPackSize =
1956		    calloc((size_t)folder->numOutStreams, sizeof(*folder->unPackSize));
1957		if (folder->unPackSize == NULL)
1958			goto failed;
1959		for (j = 0; j < folder->numOutStreams; j++) {
1960			if (parse_7zip_uint64(a, &(folder->unPackSize[j])) < 0)
1961				goto failed;
1962		}
1963	}
1964
1965	/*
1966	 * Read CRCs.
1967	 */
1968	if ((p = header_bytes(a, 1)) == NULL)
1969		goto failed;
1970	if (*p == kEnd)
1971		return (0);
1972	if (*p != kCRC)
1973		goto failed;
1974	if (read_Digests(a, &digest, (size_t)ci->numFolders) < 0)
1975		goto failed;
1976	for (i = 0; i < ci->numFolders; i++) {
1977		ci->folders[i].digest_defined = digest.defineds[i];
1978		ci->folders[i].digest = digest.digests[i];
1979	}
1980
1981	/*
1982	 *  Must be kEnd.
1983	 */
1984	if ((p = header_bytes(a, 1)) == NULL)
1985		goto failed;
1986	if (*p != kEnd)
1987		goto failed;
1988	free_Digest(&digest);
1989	return (0);
1990failed:
1991	free_Digest(&digest);
1992	return (-1);
1993}
1994
1995static uint64_t
1996folder_uncompressed_size(struct _7z_folder *f)
1997{
1998	int n = (int)f->numOutStreams;
1999	unsigned pairs = (unsigned)f->numBindPairs;
2000
2001	while (--n >= 0) {
2002		unsigned i;
2003		for (i = 0; i < pairs; i++) {
2004			if (f->bindPairs[i].outIndex == (uint64_t)n)
2005				break;
2006		}
2007		if (i >= pairs)
2008			return (f->unPackSize[n]);
2009	}
2010	return (0);
2011}
2012
2013static void
2014free_SubStreamsInfo(struct _7z_substream_info *ss)
2015{
2016	free(ss->unpackSizes);
2017	free(ss->digestsDefined);
2018	free(ss->digests);
2019}
2020
2021static int
2022read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
2023    struct _7z_folder *f, size_t numFolders)
2024{
2025	const unsigned char *p;
2026	uint64_t *usizes;
2027	size_t unpack_streams;
2028	int type;
2029	unsigned i;
2030	uint32_t numDigests;
2031
2032	memset(ss, 0, sizeof(*ss));
2033
2034	for (i = 0; i < numFolders; i++)
2035		f[i].numUnpackStreams = 1;
2036
2037	if ((p = header_bytes(a, 1)) == NULL)
2038		return (-1);
2039	type = *p;
2040
2041	if (type == kNumUnPackStream) {
2042		unpack_streams = 0;
2043		for (i = 0; i < numFolders; i++) {
2044			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
2045				return (-1);
2046			if (1000000 < f[i].numUnpackStreams)
2047				return (-1);
2048			unpack_streams += (size_t)f[i].numUnpackStreams;
2049		}
2050		if ((p = header_bytes(a, 1)) == NULL)
2051			return (-1);
2052		type = *p;
2053	} else
2054		unpack_streams = numFolders;
2055
2056	ss->unpack_streams = unpack_streams;
2057	if (unpack_streams) {
2058		ss->unpackSizes = calloc(unpack_streams,
2059		    sizeof(*ss->unpackSizes));
2060		ss->digestsDefined = calloc(unpack_streams,
2061		    sizeof(*ss->digestsDefined));
2062		ss->digests = calloc(unpack_streams,
2063		    sizeof(*ss->digests));
2064		if (ss->unpackSizes == NULL || ss->digestsDefined == NULL ||
2065		    ss->digests == NULL)
2066			return (-1);
2067	}
2068
2069	usizes = ss->unpackSizes;
2070	for (i = 0; i < numFolders; i++) {
2071		unsigned pack;
2072		uint64_t sum;
2073
2074		if (f[i].numUnpackStreams == 0)
2075			continue;
2076
2077		sum = 0;
2078		if (type == kSize) {
2079			for (pack = 1; pack < f[i].numUnpackStreams; pack++) {
2080				if (parse_7zip_uint64(a, usizes) < 0)
2081					return (-1);
2082				sum += *usizes++;
2083			}
2084		}
2085		*usizes++ = folder_uncompressed_size(&f[i]) - sum;
2086	}
2087
2088	if (type == kSize) {
2089		if ((p = header_bytes(a, 1)) == NULL)
2090			return (-1);
2091		type = *p;
2092	}
2093
2094	for (i = 0; i < unpack_streams; i++) {
2095		ss->digestsDefined[i] = 0;
2096		ss->digests[i] = 0;
2097	}
2098
2099	numDigests = 0;
2100	for (i = 0; i < numFolders; i++) {
2101		if (f[i].numUnpackStreams != 1 || !f[i].digest_defined)
2102			numDigests += (uint32_t)f[i].numUnpackStreams;
2103	}
2104
2105	if (type == kCRC) {
2106		struct _7z_digests tmpDigests;
2107		unsigned char *digestsDefined = ss->digestsDefined;
2108		uint32_t * digests = ss->digests;
2109		int di = 0;
2110
2111		memset(&tmpDigests, 0, sizeof(tmpDigests));
2112		if (read_Digests(a, &(tmpDigests), numDigests) < 0) {
2113			free_Digest(&tmpDigests);
2114			return (-1);
2115		}
2116		for (i = 0; i < numFolders; i++) {
2117			if (f[i].numUnpackStreams == 1 && f[i].digest_defined) {
2118				*digestsDefined++ = 1;
2119				*digests++ = f[i].digest;
2120			} else {
2121				unsigned j;
2122
2123				for (j = 0; j < f[i].numUnpackStreams;
2124				    j++, di++) {
2125					*digestsDefined++ =
2126					    tmpDigests.defineds[di];
2127					*digests++ =
2128					    tmpDigests.digests[di];
2129				}
2130			}
2131		}
2132		free_Digest(&tmpDigests);
2133		if ((p = header_bytes(a, 1)) == NULL)
2134			return (-1);
2135		type = *p;
2136	}
2137
2138	/*
2139	 *  Must be kEnd.
2140	 */
2141	if (type != kEnd)
2142		return (-1);
2143	return (0);
2144}
2145
2146static void
2147free_StreamsInfo(struct _7z_stream_info *si)
2148{
2149	free_PackInfo(&(si->pi));
2150	free_CodersInfo(&(si->ci));
2151	free_SubStreamsInfo(&(si->ss));
2152}
2153
2154static int
2155read_StreamsInfo(struct archive_read *a, struct _7z_stream_info *si)
2156{
2157	struct _7zip *zip = (struct _7zip *)a->format->data;
2158	const unsigned char *p;
2159	unsigned i;
2160
2161	memset(si, 0, sizeof(*si));
2162
2163	if ((p = header_bytes(a, 1)) == NULL)
2164		return (-1);
2165	if (*p == kPackInfo) {
2166		uint64_t packPos;
2167
2168		if (read_PackInfo(a, &(si->pi)) < 0)
2169			return (-1);
2170
2171		if (si->pi.positions == NULL || si->pi.sizes == NULL)
2172			return (-1);
2173		/*
2174		 * Calculate packed stream positions.
2175		 */
2176		packPos = si->pi.pos;
2177		for (i = 0; i < si->pi.numPackStreams; i++) {
2178			si->pi.positions[i] = packPos;
2179			packPos += si->pi.sizes[i];
2180			if (packPos > zip->header_offset)
2181				return (-1);
2182		}
2183		if ((p = header_bytes(a, 1)) == NULL)
2184			return (-1);
2185	}
2186	if (*p == kUnPackInfo) {
2187		uint32_t packIndex;
2188		struct _7z_folder *f;
2189
2190		if (read_CodersInfo(a, &(si->ci)) < 0)
2191			return (-1);
2192
2193		/*
2194		 * Calculate packed stream indexes.
2195		 */
2196		packIndex = 0;
2197		f = si->ci.folders;
2198		for (i = 0; i < si->ci.numFolders; i++) {
2199			f[i].packIndex = packIndex;
2200			packIndex += (uint32_t)f[i].numPackedStreams;
2201			if (packIndex > si->pi.numPackStreams)
2202				return (-1);
2203		}
2204		if ((p = header_bytes(a, 1)) == NULL)
2205			return (-1);
2206	}
2207
2208	if (*p == kSubStreamsInfo) {
2209		if (read_SubStreamsInfo(a, &(si->ss),
2210		    si->ci.folders, (size_t)si->ci.numFolders) < 0)
2211			return (-1);
2212		if ((p = header_bytes(a, 1)) == NULL)
2213			return (-1);
2214	}
2215
2216	/*
2217	 *  Must be kEnd.
2218	 */
2219	if (*p != kEnd)
2220		return (-1);
2221	return (0);
2222}
2223
2224static void
2225free_Header(struct _7z_header_info *h)
2226{
2227	free(h->emptyStreamBools);
2228	free(h->emptyFileBools);
2229	free(h->antiBools);
2230	free(h->attrBools);
2231}
2232
2233static int
2234read_Header(struct archive_read *a, struct _7z_header_info *h,
2235    int check_header_id)
2236{
2237	struct _7zip *zip = (struct _7zip *)a->format->data;
2238	const unsigned char *p;
2239	struct _7z_folder *folders;
2240	struct _7z_stream_info *si = &(zip->si);
2241	struct _7zip_entry *entries;
2242	uint32_t folderIndex, indexInFolder;
2243	unsigned i;
2244	int eindex, empty_streams, sindex;
2245
2246	if (check_header_id) {
2247		/*
2248		 * Read Header.
2249		 */
2250		if ((p = header_bytes(a, 1)) == NULL)
2251			return (-1);
2252		if (*p != kHeader)
2253			return (-1);
2254	}
2255
2256	/*
2257	 * Read ArchiveProperties.
2258	 */
2259	if ((p = header_bytes(a, 1)) == NULL)
2260		return (-1);
2261	if (*p == kArchiveProperties) {
2262		for (;;) {
2263			uint64_t size;
2264			if ((p = header_bytes(a, 1)) == NULL)
2265				return (-1);
2266			if (*p == 0)
2267				break;
2268			if (parse_7zip_uint64(a, &size) < 0)
2269				return (-1);
2270		}
2271		if ((p = header_bytes(a, 1)) == NULL)
2272			return (-1);
2273	}
2274
2275	/*
2276	 * Read MainStreamsInfo.
2277	 */
2278	if (*p == kMainStreamsInfo) {
2279		if (read_StreamsInfo(a, &(zip->si)) < 0)
2280			return (-1);
2281		if ((p = header_bytes(a, 1)) == NULL)
2282			return (-1);
2283	}
2284	if (*p == kEnd)
2285		return (0);
2286
2287	/*
2288	 * Read FilesInfo.
2289	 */
2290	if (*p != kFilesInfo)
2291		return (-1);
2292
2293	if (parse_7zip_uint64(a, &(zip->numFiles)) < 0)
2294		return (-1);
2295	if (1000000 < zip->numFiles)
2296			return (-1);
2297
2298	zip->entries = calloc((size_t)zip->numFiles, sizeof(*zip->entries));
2299	if (zip->entries == NULL)
2300		return (-1);
2301	entries = zip->entries;
2302
2303	empty_streams = 0;
2304	for (;;) {
2305		int type;
2306		uint64_t size;
2307		size_t ll;
2308
2309		if ((p = header_bytes(a, 1)) == NULL)
2310			return (-1);
2311		type = *p;
2312		if (type == kEnd)
2313			break;
2314
2315		if (parse_7zip_uint64(a, &size) < 0)
2316			return (-1);
2317		if (zip->header_bytes_remaining < size)
2318			return (-1);
2319		ll = (size_t)size;
2320
2321		switch (type) {
2322		case kEmptyStream:
2323			h->emptyStreamBools = calloc((size_t)zip->numFiles,
2324			    sizeof(*h->emptyStreamBools));
2325			if (h->emptyStreamBools == NULL)
2326				return (-1);
2327			if (read_Bools(
2328			    a, h->emptyStreamBools, (size_t)zip->numFiles) < 0)
2329				return (-1);
2330			empty_streams = 0;
2331			for (i = 0; i < zip->numFiles; i++) {
2332				if (h->emptyStreamBools[i])
2333					empty_streams++;
2334			}
2335			break;
2336		case kEmptyFile:
2337			if (empty_streams <= 0) {
2338				/* Unexcepted sequence. Skip this. */
2339				if (header_bytes(a, ll) == NULL)
2340					return (-1);
2341				break;
2342			}
2343			h->emptyFileBools = calloc(empty_streams,
2344			    sizeof(*h->emptyFileBools));
2345			if (h->emptyFileBools == NULL)
2346				return (-1);
2347			if (read_Bools(a, h->emptyFileBools, empty_streams) < 0)
2348				return (-1);
2349			break;
2350		case kAnti:
2351			if (empty_streams <= 0) {
2352				/* Unexcepted sequence. Skip this. */
2353				if (header_bytes(a, ll) == NULL)
2354					return (-1);
2355				break;
2356			}
2357			h->antiBools = calloc(empty_streams,
2358			    sizeof(*h->antiBools));
2359			if (h->antiBools == NULL)
2360				return (-1);
2361			if (read_Bools(a, h->antiBools, empty_streams) < 0)
2362				return (-1);
2363			break;
2364		case kCTime:
2365		case kATime:
2366		case kMTime:
2367			if (read_Times(a, h, type) < 0)
2368				return (-1);
2369			break;
2370		case kName:
2371		{
2372			unsigned char *np;
2373			size_t nl, nb;
2374
2375			/* Skip one byte. */
2376			if ((p = header_bytes(a, 1)) == NULL)
2377				return (-1);
2378			ll--;
2379
2380			if ((ll & 1) || ll < zip->numFiles * 4)
2381				return (-1);
2382
2383			zip->entry_names = malloc(ll);
2384			if (zip->entry_names == NULL)
2385				return (-1);
2386			np = zip->entry_names;
2387			nb = ll;
2388			/*
2389			 * Copy whole file names.
2390			 * NOTE: This loop prevents from expanding
2391			 * the uncompressed buffer in order not to
2392			 * use extra memory resource.
2393			 */
2394			while (nb) {
2395				size_t b;
2396				if (nb > UBUFF_SIZE)
2397					b = UBUFF_SIZE;
2398				else
2399					b = nb;
2400				if ((p = header_bytes(a, b)) == NULL)
2401					return (-1);
2402				memcpy(np, p, b);
2403				np += b;
2404				nb -= b;
2405			}
2406			np = zip->entry_names;
2407			nl = ll;
2408
2409			for (i = 0; i < zip->numFiles; i++) {
2410				entries[i].utf16name = np;
2411#if defined(_WIN32) && !defined(__CYGWIN__) && defined(_DEBUG)
2412				entries[i].wname = (wchar_t *)np;
2413#endif
2414
2415				/* Find a terminator. */
2416				while (nl >= 2 && (np[0] || np[1])) {
2417					np += 2;
2418					nl -= 2;
2419				}
2420				if (nl < 2)
2421					return (-1);/* Terminator not found */
2422				entries[i].name_len = np - entries[i].utf16name;
2423				np += 2;
2424				nl -= 2;
2425			}
2426			break;
2427		}
2428		case kAttributes:
2429		{
2430			int allAreDefined;
2431
2432			if ((p = header_bytes(a, 2)) == NULL)
2433				return (-1);
2434			allAreDefined = *p;
2435			h->attrBools = calloc((size_t)zip->numFiles,
2436			    sizeof(*h->attrBools));
2437			if (h->attrBools == NULL)
2438				return (-1);
2439			if (allAreDefined)
2440				memset(h->attrBools, 1, (size_t)zip->numFiles);
2441			else {
2442				if (read_Bools(a, h->attrBools,
2443				      (size_t)zip->numFiles) < 0)
2444					return (-1);
2445			}
2446			for (i = 0; i < zip->numFiles; i++) {
2447				if (h->attrBools[i]) {
2448					if ((p = header_bytes(a, 4)) == NULL)
2449						return (-1);
2450					entries[i].attr = archive_le32dec(p);
2451				}
2452			}
2453			break;
2454		}
2455		default:
2456			if (header_bytes(a, ll) == NULL)
2457				return (-1);
2458			break;
2459		}
2460	}
2461
2462	/*
2463	 * Set up entry's attributes.
2464	 */
2465	folders = si->ci.folders;
2466	eindex = sindex = 0;
2467	folderIndex = indexInFolder = 0;
2468	for (i = 0; i < zip->numFiles; i++) {
2469		if (h->emptyStreamBools == NULL || h->emptyStreamBools[i] == 0)
2470			entries[i].flg |= HAS_STREAM;
2471		/* The high 16 bits of attributes is a posix file mode. */
2472		entries[i].mode = entries[i].attr >> 16;
2473		if (entries[i].flg & HAS_STREAM) {
2474			if ((size_t)sindex >= si->ss.unpack_streams)
2475				return (-1);
2476			if (entries[i].mode == 0)
2477				entries[i].mode = AE_IFREG | 0666;
2478			if (si->ss.digestsDefined[sindex])
2479				entries[i].flg |= CRC32_IS_SET;
2480			entries[i].ssIndex = sindex;
2481			sindex++;
2482		} else {
2483			int dir;
2484			if (h->emptyFileBools == NULL)
2485				dir = 1;
2486			else {
2487				if (h->emptyFileBools[eindex])
2488					dir = 0;
2489				else
2490					dir = 1;
2491				eindex++;
2492			}
2493			if (entries[i].mode == 0) {
2494				if (dir)
2495					entries[i].mode = AE_IFDIR | 0777;
2496				else
2497					entries[i].mode = AE_IFREG | 0666;
2498			} else if (dir &&
2499			    (entries[i].mode & AE_IFMT) != AE_IFDIR) {
2500				entries[i].mode &= ~AE_IFMT;
2501				entries[i].mode |= AE_IFDIR;
2502			}
2503			if ((entries[i].mode & AE_IFMT) == AE_IFDIR &&
2504			    entries[i].name_len >= 2 &&
2505			    (entries[i].utf16name[entries[i].name_len-2] != '/' ||
2506			     entries[i].utf16name[entries[i].name_len-1] != 0)) {
2507				entries[i].utf16name[entries[i].name_len] = '/';
2508				entries[i].utf16name[entries[i].name_len+1] = 0;
2509				entries[i].name_len += 2;
2510			}
2511			entries[i].ssIndex = -1;
2512		}
2513		if (entries[i].attr & 0x01)
2514			entries[i].mode &= ~0222;/* Read only. */
2515
2516		if ((entries[i].flg & HAS_STREAM) == 0 && indexInFolder == 0) {
2517			/*
2518			 * The entry is an empty file or a directory file,
2519			 * those both have no contents.
2520			 */
2521			entries[i].folderIndex = -1;
2522			continue;
2523		}
2524		if (indexInFolder == 0) {
2525			for (;;) {
2526				if (folderIndex >= si->ci.numFolders)
2527					return (-1);
2528				if (folders[folderIndex].numUnpackStreams)
2529					break;
2530				folderIndex++;
2531			}
2532		}
2533		entries[i].folderIndex = folderIndex;
2534		if ((entries[i].flg & HAS_STREAM) == 0)
2535			continue;
2536		indexInFolder++;
2537		if (indexInFolder >= folders[folderIndex].numUnpackStreams) {
2538			folderIndex++;
2539			indexInFolder = 0;
2540		}
2541	}
2542
2543	return (0);
2544}
2545
2546#define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
2547static void
2548fileTimeToUtc(uint64_t fileTime, time_t *timep, long *ns)
2549{
2550
2551	if (fileTime >= EPOC_TIME) {
2552		fileTime -= EPOC_TIME;
2553		/* milli seconds base */
2554		*timep = (time_t)(fileTime / 10000000);
2555		/* nano seconds base */
2556		*ns = (long)(fileTime % 10000000) * 100;
2557	} else {
2558		*timep = 0;
2559		*ns = 0;
2560	}
2561}
2562
2563static int
2564read_Times(struct archive_read *a, struct _7z_header_info *h, int type)
2565{
2566	struct _7zip *zip = (struct _7zip *)a->format->data;
2567	const unsigned char *p;
2568	struct _7zip_entry *entries = zip->entries;
2569	unsigned char *timeBools;
2570	int allAreDefined;
2571	unsigned i;
2572
2573	timeBools = calloc((size_t)zip->numFiles, sizeof(*timeBools));
2574	if (timeBools == NULL)
2575		return (-1);
2576
2577	/* Read allAreDefined. */
2578	if ((p = header_bytes(a, 1)) == NULL)
2579		goto failed;
2580	allAreDefined = *p;
2581	if (allAreDefined)
2582		memset(timeBools, 1, (size_t)zip->numFiles);
2583	else {
2584		if (read_Bools(a, timeBools, (size_t)zip->numFiles) < 0)
2585			goto failed;
2586	}
2587
2588	/* Read external. */
2589	if ((p = header_bytes(a, 1)) == NULL)
2590		goto failed;
2591	if (*p) {
2592		if (parse_7zip_uint64(a, &(h->dataIndex)) < 0)
2593			goto failed;
2594		if (1000000 < h->dataIndex)
2595			goto failed;
2596	}
2597
2598	for (i = 0; i < zip->numFiles; i++) {
2599		if (!timeBools[i])
2600			continue;
2601		if ((p = header_bytes(a, 8)) == NULL)
2602			goto failed;
2603		switch (type) {
2604		case kCTime:
2605			fileTimeToUtc(archive_le64dec(p),
2606			    &(entries[i].ctime),
2607			    &(entries[i].ctime_ns));
2608			entries[i].flg |= CTIME_IS_SET;
2609			break;
2610		case kATime:
2611			fileTimeToUtc(archive_le64dec(p),
2612			    &(entries[i].atime),
2613			    &(entries[i].atime_ns));
2614			entries[i].flg |= ATIME_IS_SET;
2615			break;
2616		case kMTime:
2617			fileTimeToUtc(archive_le64dec(p),
2618			    &(entries[i].mtime),
2619			    &(entries[i].mtime_ns));
2620			entries[i].flg |= MTIME_IS_SET;
2621			break;
2622		}
2623	}
2624
2625	free(timeBools);
2626	return (0);
2627failed:
2628	free(timeBools);
2629	return (-1);
2630}
2631
2632static int
2633decode_encoded_header_info(struct archive_read *a, struct _7z_stream_info *si)
2634{
2635	struct _7zip *zip = (struct _7zip *)a->format->data;
2636
2637	errno = 0;
2638	if (read_StreamsInfo(a, si) < 0) {
2639		if (errno == ENOMEM)
2640			archive_set_error(&a->archive, -1,
2641			    "Couldn't allocate memory");
2642		else
2643			archive_set_error(&a->archive, -1,
2644			    "Malformed 7-Zip archive");
2645		return (ARCHIVE_FATAL);
2646	}
2647
2648	if (si->pi.numPackStreams == 0 || si->ci.numFolders == 0) {
2649		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2650		return (ARCHIVE_FATAL);
2651	}
2652
2653	if (zip->header_offset < si->pi.pos + si->pi.sizes[0] ||
2654	    (int64_t)(si->pi.pos + si->pi.sizes[0]) < 0 ||
2655	    si->pi.sizes[0] == 0 || (int64_t)si->pi.pos < 0) {
2656		archive_set_error(&a->archive, -1, "Malformed Header offset");
2657		return (ARCHIVE_FATAL);
2658	}
2659
2660	return (ARCHIVE_OK);
2661}
2662
2663static const unsigned char *
2664header_bytes(struct archive_read *a, size_t rbytes)
2665{
2666	struct _7zip *zip = (struct _7zip *)a->format->data;
2667	const unsigned char *p;
2668
2669	if (zip->header_bytes_remaining < rbytes)
2670		return (NULL);
2671	if (zip->pack_stream_bytes_unconsumed)
2672		read_consume(a);
2673
2674	if (zip->header_is_encoded == 0) {
2675		p = __archive_read_ahead(a, rbytes, NULL);
2676		if (p == NULL)
2677			return (NULL);
2678		zip->header_bytes_remaining -= rbytes;
2679		zip->pack_stream_bytes_unconsumed = rbytes;
2680	} else {
2681		const void *buff;
2682		ssize_t bytes;
2683
2684		bytes = read_stream(a, &buff, rbytes, rbytes);
2685		if (bytes <= 0)
2686			return (NULL);
2687		zip->header_bytes_remaining -= bytes;
2688		p = buff;
2689	}
2690
2691	/* Update checksum */
2692	zip->header_crc32 = crc32(zip->header_crc32, p, (unsigned)rbytes);
2693	return (p);
2694}
2695
2696static int
2697slurp_central_directory(struct archive_read *a, struct _7zip *zip,
2698    struct _7z_header_info *header)
2699{
2700	const unsigned char *p;
2701	uint64_t next_header_offset;
2702	uint64_t next_header_size;
2703	uint32_t next_header_crc;
2704	ssize_t bytes_avail;
2705	int check_header_crc, r;
2706
2707	if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2708		return (ARCHIVE_FATAL);
2709
2710	if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
2711		/* This is an executable ? Must be self-extracting... */
2712		r = skip_sfx(a, bytes_avail);
2713		if (r < ARCHIVE_WARN)
2714			return (r);
2715		if ((p = __archive_read_ahead(a, 32, &bytes_avail)) == NULL)
2716			return (ARCHIVE_FATAL);
2717	}
2718	zip->seek_base += 32;
2719
2720	if (memcmp(p, _7ZIP_SIGNATURE, 6) != 0) {
2721		archive_set_error(&a->archive, -1, "Not 7-Zip archive file");
2722		return (ARCHIVE_FATAL);
2723	}
2724
2725	/* CRC check. */
2726	if (crc32(0, (const unsigned char *)p + 12, 20)
2727	    != archive_le32dec(p + 8)) {
2728		archive_set_error(&a->archive, -1, "Header CRC error");
2729		return (ARCHIVE_FATAL);
2730	}
2731
2732	next_header_offset = archive_le64dec(p + 12);
2733	next_header_size = archive_le64dec(p + 20);
2734	next_header_crc = archive_le32dec(p + 28);
2735
2736	if (next_header_size == 0)
2737		/* There is no entry in an archive file. */
2738		return (ARCHIVE_EOF);
2739
2740	if (((int64_t)next_header_offset) < 0) {
2741		archive_set_error(&a->archive, -1, "Malformed 7-Zip archive");
2742		return (ARCHIVE_FATAL);
2743	}
2744	__archive_read_consume(a, 32);
2745	if (next_header_offset != 0) {
2746		if (bytes_avail >= (ssize_t)next_header_offset)
2747			__archive_read_consume(a, next_header_offset);
2748		else if (__archive_read_seek(a,
2749		    next_header_offset + zip->seek_base, SEEK_SET) < 0)
2750			return (ARCHIVE_FATAL);
2751	}
2752	zip->stream_offset = next_header_offset;
2753	zip->header_offset = next_header_offset;
2754	zip->header_bytes_remaining = next_header_size;
2755	zip->header_crc32 = 0;
2756	zip->header_is_encoded = 0;
2757	zip->header_is_being_read = 1;
2758	check_header_crc = 1;
2759
2760	if ((p = header_bytes(a, 1)) == NULL) {
2761		archive_set_error(&a->archive,
2762		    ARCHIVE_ERRNO_FILE_FORMAT,
2763		    "Truncated 7-Zip file body");
2764		return (ARCHIVE_FATAL);
2765	}
2766	/* Parse ArchiveProperties. */
2767	switch (p[0]) {
2768	case kEncodedHeader:
2769		/*
2770		 * The archive has an encoded header and we have to decode it
2771		 * in order to parse the header correctly.
2772		 */
2773		r = decode_encoded_header_info(a, &(zip->si));
2774
2775		/* Check the EncodedHeader CRC.*/
2776		if (r == 0 && zip->header_crc32 != next_header_crc) {
2777			archive_set_error(&a->archive, -1,
2778			    "Damaged 7-Zip archive");
2779			r = -1;
2780		}
2781		if (r == 0) {
2782			if (zip->si.ci.folders[0].digest_defined)
2783				next_header_crc = zip->si.ci.folders[0].digest;
2784			else
2785				check_header_crc = 0;
2786			if (zip->pack_stream_bytes_unconsumed)
2787				read_consume(a);
2788			r = setup_decode_folder(a, zip->si.ci.folders, 1);
2789			if (r == 0) {
2790				zip->header_bytes_remaining =
2791					zip->folder_outbytes_remaining;
2792				r = seek_pack(a);
2793			}
2794		}
2795		/* Clean up StreamsInfo. */
2796		free_StreamsInfo(&(zip->si));
2797		memset(&(zip->si), 0, sizeof(zip->si));
2798		if (r < 0)
2799			return (ARCHIVE_FATAL);
2800		zip->header_is_encoded = 1;
2801		zip->header_crc32 = 0;
2802		/* FALL THROUGH */
2803	case kHeader:
2804		/*
2805		 * Parse the header.
2806		 */
2807		errno = 0;
2808		r = read_Header(a, header, zip->header_is_encoded);
2809		if (r < 0) {
2810			if (errno == ENOMEM)
2811				archive_set_error(&a->archive, -1,
2812				    "Couldn't allocate memory");
2813			else
2814				archive_set_error(&a->archive, -1,
2815				    "Damaged 7-Zip archive");
2816			return (ARCHIVE_FATAL);
2817		}
2818
2819		/*
2820		 *  Must be kEnd.
2821		 */
2822		if ((p = header_bytes(a, 1)) == NULL ||*p != kEnd) {
2823			archive_set_error(&a->archive, -1,
2824			    "Malformed 7-Zip archive");
2825			return (ARCHIVE_FATAL);
2826		}
2827
2828		/* Check the Header CRC.*/
2829		if (check_header_crc && zip->header_crc32 != next_header_crc) {
2830			archive_set_error(&a->archive, -1,
2831			    "Malformed 7-Zip archive");
2832			return (ARCHIVE_FATAL);
2833		}
2834		break;
2835	default:
2836		archive_set_error(&a->archive, -1,
2837		    "Unexpected Property ID = %X", p[0]);
2838		return (ARCHIVE_FATAL);
2839	}
2840
2841	/* Clean up variables be used for decoding the archive header */
2842	zip->pack_stream_remaining = 0;
2843	zip->pack_stream_index = 0;
2844	zip->folder_outbytes_remaining = 0;
2845	zip->uncompressed_buffer_bytes_remaining = 0;
2846	zip->pack_stream_bytes_unconsumed = 0;
2847	zip->header_is_being_read = 0;
2848
2849	return (ARCHIVE_OK);
2850}
2851
2852static ssize_t
2853get_uncompressed_data(struct archive_read *a, const void **buff, size_t size,
2854    size_t minimum)
2855{
2856	struct _7zip *zip = (struct _7zip *)a->format->data;
2857	ssize_t bytes_avail;
2858
2859	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2860		/* Copy mode. */
2861
2862		/*
2863		 * Note: '1' here is a performance optimization.
2864		 * Recall that the decompression layer returns a count of
2865		 * available bytes; asking for more than that forces the
2866		 * decompressor to combine reads by copying data.
2867		 */
2868		*buff = __archive_read_ahead(a, 1, &bytes_avail);
2869		if (bytes_avail <= 0) {
2870			archive_set_error(&a->archive,
2871			    ARCHIVE_ERRNO_FILE_FORMAT,
2872			    "Truncated 7-Zip file data");
2873			return (ARCHIVE_FATAL);
2874		}
2875		if ((size_t)bytes_avail >
2876		    zip->uncompressed_buffer_bytes_remaining)
2877			bytes_avail = (ssize_t)
2878			    zip->uncompressed_buffer_bytes_remaining;
2879		if ((size_t)bytes_avail > size)
2880			bytes_avail = (ssize_t)size;
2881
2882		zip->pack_stream_bytes_unconsumed = bytes_avail;
2883	} else if (zip->uncompressed_buffer_pointer == NULL) {
2884		/* Decompression has failed. */
2885		archive_set_error(&(a->archive),
2886		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
2887		return (ARCHIVE_FATAL);
2888	} else {
2889		/* Packed mode. */
2890		if (minimum > zip->uncompressed_buffer_bytes_remaining) {
2891			/*
2892			 * If remaining uncompressed data size is less than
2893			 * the minimum size, fill the buffer up to the
2894			 * minimum size.
2895			 */
2896			if (extract_pack_stream(a, minimum) < 0)
2897				return (ARCHIVE_FATAL);
2898		}
2899		if (size > zip->uncompressed_buffer_bytes_remaining)
2900			bytes_avail = (ssize_t)
2901			    zip->uncompressed_buffer_bytes_remaining;
2902		else
2903			bytes_avail = (ssize_t)size;
2904		*buff = zip->uncompressed_buffer_pointer;
2905		zip->uncompressed_buffer_pointer += bytes_avail;
2906	}
2907	zip->uncompressed_buffer_bytes_remaining -= bytes_avail;
2908	return (bytes_avail);
2909}
2910
2911static ssize_t
2912extract_pack_stream(struct archive_read *a, size_t minimum)
2913{
2914	struct _7zip *zip = (struct _7zip *)a->format->data;
2915	ssize_t bytes_avail;
2916	int r;
2917
2918	if (zip->codec == _7Z_COPY && zip->codec2 == (unsigned long)-1) {
2919		if (minimum == 0)
2920			minimum = 1;
2921		if (__archive_read_ahead(a, minimum, &bytes_avail) == NULL
2922		    || bytes_avail <= 0) {
2923			archive_set_error(&a->archive,
2924			    ARCHIVE_ERRNO_FILE_FORMAT,
2925			    "Truncated 7-Zip file body");
2926			return (ARCHIVE_FATAL);
2927		}
2928		if (bytes_avail > (ssize_t)zip->pack_stream_inbytes_remaining)
2929			bytes_avail = (ssize_t)zip->pack_stream_inbytes_remaining;
2930		zip->pack_stream_inbytes_remaining -= bytes_avail;
2931		if (bytes_avail > (ssize_t)zip->folder_outbytes_remaining)
2932			bytes_avail = (ssize_t)zip->folder_outbytes_remaining;
2933		zip->folder_outbytes_remaining -= bytes_avail;
2934		zip->uncompressed_buffer_bytes_remaining = bytes_avail;
2935		return (ARCHIVE_OK);
2936	}
2937
2938	/* If the buffer hasn't been allocated, allocate it now. */
2939	if (zip->uncompressed_buffer == NULL) {
2940		zip->uncompressed_buffer_size = UBUFF_SIZE;
2941		if (zip->uncompressed_buffer_size < minimum) {
2942			zip->uncompressed_buffer_size = minimum + 1023;
2943			zip->uncompressed_buffer_size &= ~0x3ff;
2944		}
2945		zip->uncompressed_buffer =
2946		    malloc(zip->uncompressed_buffer_size);
2947		if (zip->uncompressed_buffer == NULL) {
2948			archive_set_error(&a->archive, ENOMEM,
2949			    "No memory for 7-Zip decompression");
2950			return (ARCHIVE_FATAL);
2951		}
2952		zip->uncompressed_buffer_bytes_remaining = 0;
2953	} else if (zip->uncompressed_buffer_size < minimum ||
2954	    zip->uncompressed_buffer_bytes_remaining < minimum) {
2955		/*
2956		 * Make sure the uncompressed buffer can have bytes
2957		 * at least `minimum' bytes.
2958		 * NOTE: This case happen when reading the header.
2959		 */
2960		size_t used;
2961		if (zip->uncompressed_buffer_pointer != 0)
2962			used = zip->uncompressed_buffer_pointer -
2963				zip->uncompressed_buffer;
2964		else
2965			used = 0;
2966		if (zip->uncompressed_buffer_size < minimum) {
2967			/*
2968			 * Expand the uncompressed buffer up to
2969			 * the minimum size.
2970			 */
2971			void *p;
2972			size_t new_size;
2973
2974			new_size = minimum + 1023;
2975			new_size &= ~0x3ff;
2976			p = realloc(zip->uncompressed_buffer, new_size);
2977			if (p == NULL) {
2978				archive_set_error(&a->archive, ENOMEM,
2979				    "No memory for 7-Zip decompression");
2980				return (ARCHIVE_FATAL);
2981			}
2982			zip->uncompressed_buffer = (unsigned char *)p;
2983			zip->uncompressed_buffer_size = new_size;
2984		}
2985		/*
2986		 * Move unconsumed bytes to the head.
2987		 */
2988		if (used) {
2989			memmove(zip->uncompressed_buffer,
2990				zip->uncompressed_buffer + used,
2991				zip->uncompressed_buffer_bytes_remaining);
2992		}
2993	} else
2994		zip->uncompressed_buffer_bytes_remaining = 0;
2995	zip->uncompressed_buffer_pointer = NULL;
2996	for (;;) {
2997		size_t bytes_in, bytes_out;
2998		const void *buff_in;
2999		unsigned char *buff_out;
3000		int end_of_data;
3001
3002		/*
3003		 * Note: '1' here is a performance optimization.
3004		 * Recall that the decompression layer returns a count of
3005		 * available bytes; asking for more than that forces the
3006		 * decompressor to combine reads by copying data.
3007		 */
3008		buff_in = __archive_read_ahead(a, 1, &bytes_avail);
3009		if (bytes_avail <= 0) {
3010			archive_set_error(&a->archive,
3011			    ARCHIVE_ERRNO_FILE_FORMAT,
3012			    "Truncated 7-Zip file body");
3013			return (ARCHIVE_FATAL);
3014		}
3015
3016		buff_out = zip->uncompressed_buffer
3017			+ zip->uncompressed_buffer_bytes_remaining;
3018		bytes_out = zip->uncompressed_buffer_size
3019			- zip->uncompressed_buffer_bytes_remaining;
3020		bytes_in = bytes_avail;
3021		if (bytes_in > zip->pack_stream_inbytes_remaining)
3022			bytes_in = (size_t)zip->pack_stream_inbytes_remaining;
3023		/* Drive decompression. */
3024		r = decompress(a, zip, buff_out, &bytes_out,
3025			buff_in, &bytes_in);
3026		switch (r) {
3027		case ARCHIVE_OK:
3028			end_of_data = 0;
3029			break;
3030		case ARCHIVE_EOF:
3031			end_of_data = 1;
3032			break;
3033		default:
3034			return (ARCHIVE_FATAL);
3035		}
3036		zip->pack_stream_inbytes_remaining -= bytes_in;
3037		if (bytes_out > zip->folder_outbytes_remaining)
3038			bytes_out = (size_t)zip->folder_outbytes_remaining;
3039		zip->folder_outbytes_remaining -= bytes_out;
3040		zip->uncompressed_buffer_bytes_remaining += bytes_out;
3041		zip->pack_stream_bytes_unconsumed = bytes_in;
3042
3043		/*
3044		 * Continue decompression until uncompressed_buffer is full.
3045		 */
3046		if (zip->uncompressed_buffer_bytes_remaining ==
3047		    zip->uncompressed_buffer_size)
3048			break;
3049		if (zip->codec2 == _7Z_X86 && zip->odd_bcj_size &&
3050		    zip->uncompressed_buffer_bytes_remaining + 5 >
3051		    zip->uncompressed_buffer_size)
3052			break;
3053		if (zip->pack_stream_inbytes_remaining == 0 &&
3054		    zip->folder_outbytes_remaining == 0)
3055			break;
3056		if (end_of_data || (bytes_in == 0 && bytes_out == 0)) {
3057			archive_set_error(&(a->archive),
3058			    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3059			return (ARCHIVE_FATAL);
3060		}
3061		read_consume(a);
3062	}
3063	if (zip->uncompressed_buffer_bytes_remaining < minimum) {
3064		archive_set_error(&(a->archive),
3065		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3066		return (ARCHIVE_FATAL);
3067	}
3068	zip->uncompressed_buffer_pointer = zip->uncompressed_buffer;
3069	return (ARCHIVE_OK);
3070}
3071
3072static int
3073seek_pack(struct archive_read *a)
3074{
3075	struct _7zip *zip = (struct _7zip *)a->format->data;
3076	int64_t pack_offset;
3077
3078	if (zip->pack_stream_remaining <= 0) {
3079		archive_set_error(&(a->archive),
3080		    ARCHIVE_ERRNO_MISC, "Damaged 7-Zip archive");
3081		return (ARCHIVE_FATAL);
3082	}
3083	zip->pack_stream_inbytes_remaining =
3084	    zip->si.pi.sizes[zip->pack_stream_index];
3085	pack_offset = zip->si.pi.positions[zip->pack_stream_index];
3086	if (zip->stream_offset != pack_offset) {
3087		if (0 > __archive_read_seek(a, pack_offset + zip->seek_base,
3088		    SEEK_SET))
3089			return (ARCHIVE_FATAL);
3090		zip->stream_offset = pack_offset;
3091	}
3092	zip->pack_stream_index++;
3093	zip->pack_stream_remaining--;
3094	return (ARCHIVE_OK);
3095}
3096
3097static ssize_t
3098read_stream(struct archive_read *a, const void **buff, size_t size,
3099    size_t minimum)
3100{
3101	struct _7zip *zip = (struct _7zip *)a->format->data;
3102	uint64_t skip_bytes = 0;
3103	ssize_t r;
3104
3105	if (zip->uncompressed_buffer_bytes_remaining == 0) {
3106		if (zip->pack_stream_inbytes_remaining > 0) {
3107			r = extract_pack_stream(a, 0);
3108			if (r < 0)
3109				return (r);
3110			return (get_uncompressed_data(a, buff, size, minimum));
3111		} else if (zip->folder_outbytes_remaining > 0) {
3112			/* Extract a remaining pack stream. */
3113			r = extract_pack_stream(a, 0);
3114			if (r < 0)
3115				return (r);
3116			return (get_uncompressed_data(a, buff, size, minimum));
3117		}
3118	} else
3119		return (get_uncompressed_data(a, buff, size, minimum));
3120
3121	/*
3122	 * Current pack stream has been consumed.
3123	 */
3124	if (zip->pack_stream_remaining == 0) {
3125		if (zip->header_is_being_read) {
3126			/* Invalid sequence. This might happen when
3127			 * reading a malformed archive. */
3128			archive_set_error(&(a->archive),
3129			    ARCHIVE_ERRNO_MISC, "Malformed 7-Zip archive");
3130			return (ARCHIVE_FATAL);
3131		}
3132
3133		/*
3134		 * All current folder's pack streams have been
3135		 * consumed. Switch to next folder.
3136		 */
3137		if (zip->folder_index == 0 &&
3138		    (zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3139		     || zip->folder_index != zip->entry->folderIndex)) {
3140			zip->folder_index = zip->entry->folderIndex;
3141			skip_bytes =
3142			    zip->si.ci.folders[zip->folder_index].skipped_bytes;
3143		}
3144
3145		if (zip->folder_index >= zip->si.ci.numFolders) {
3146			/*
3147			 * We have consumed all folders and its pack streams.
3148			 */
3149			*buff = NULL;
3150			return (0);
3151		}
3152		r = setup_decode_folder(a,
3153			&(zip->si.ci.folders[zip->folder_index]), 0);
3154		if (r != ARCHIVE_OK)
3155			return (ARCHIVE_FATAL);
3156
3157		zip->folder_index++;
3158	}
3159
3160	/*
3161	 * Switch to next pack stream.
3162	 */
3163	r = seek_pack(a);
3164	if (r < 0)
3165		return (r);
3166
3167	/* Extract a new pack stream. */
3168	r = extract_pack_stream(a, 0);
3169	if (r < 0)
3170		return (r);
3171
3172	/*
3173	 * Skip the bytes we alrady has skipped in skip_stream().
3174	 */
3175	while (skip_bytes) {
3176		ssize_t skipped;
3177
3178		if (zip->uncompressed_buffer_bytes_remaining == 0) {
3179			if (zip->pack_stream_inbytes_remaining > 0) {
3180				r = extract_pack_stream(a, 0);
3181				if (r < 0)
3182					return (r);
3183			} else if (zip->folder_outbytes_remaining > 0) {
3184				/* Extract a remaining pack stream. */
3185				r = extract_pack_stream(a, 0);
3186				if (r < 0)
3187					return (r);
3188			} else {
3189				archive_set_error(&a->archive,
3190				    ARCHIVE_ERRNO_FILE_FORMAT,
3191				    "Truncated 7-Zip file body");
3192				return (ARCHIVE_FATAL);
3193			}
3194		}
3195		skipped = get_uncompressed_data(
3196			a, buff, (size_t)skip_bytes, 0);
3197		if (skipped < 0)
3198			return (skipped);
3199		skip_bytes -= skipped;
3200		if (zip->pack_stream_bytes_unconsumed)
3201			read_consume(a);
3202	}
3203
3204	return (get_uncompressed_data(a, buff, size, minimum));
3205}
3206
3207static int
3208setup_decode_folder(struct archive_read *a, struct _7z_folder *folder,
3209    int header)
3210{
3211	struct _7zip *zip = (struct _7zip *)a->format->data;
3212	const struct _7z_coder *coder1, *coder2;
3213	const char *cname = (header)?"archive header":"file content";
3214	unsigned i;
3215	int r, found_bcj2 = 0;
3216
3217	/*
3218	 * Release the memory which the previous folder used for BCJ2.
3219	 */
3220	for (i = 0; i < 3; i++) {
3221		if (zip->sub_stream_buff[i] != NULL)
3222			free(zip->sub_stream_buff[i]);
3223		zip->sub_stream_buff[i] = NULL;
3224	}
3225
3226	/*
3227	 * Initialize a stream reader.
3228	 */
3229	zip->pack_stream_remaining = (unsigned)folder->numPackedStreams;
3230	zip->pack_stream_index = (unsigned)folder->packIndex;
3231	zip->folder_outbytes_remaining = folder_uncompressed_size(folder);
3232	zip->uncompressed_buffer_bytes_remaining = 0;
3233
3234	/*
3235	 * Check coder types.
3236	 */
3237	for (i = 0; i < folder->numCoders; i++) {
3238		if (folder->coders[i].codec == _7Z_CRYPTO) {
3239			archive_set_error(&(a->archive),
3240			    ARCHIVE_ERRNO_MISC,
3241			    "The %s is encrypted, "
3242			    "but currently not supported", cname);
3243			return (ARCHIVE_FATAL);
3244		}
3245		if (folder->coders[i].codec == _7Z_X86_BCJ2)
3246			found_bcj2++;
3247	}
3248	if ((folder->numCoders > 2 && !found_bcj2) || found_bcj2 > 1) {
3249		archive_set_error(&(a->archive),
3250		    ARCHIVE_ERRNO_MISC,
3251		    "The %s is encoded with many filters, "
3252		    "but currently not supported", cname);
3253		return (ARCHIVE_FATAL);
3254	}
3255	coder1 = &(folder->coders[0]);
3256	if (folder->numCoders == 2)
3257		coder2 = &(folder->coders[1]);
3258	else
3259		coder2 = NULL;
3260
3261	if (found_bcj2) {
3262		/*
3263		 * Preparation to decode BCJ2.
3264		 * Decoding BCJ2 requires four sources. Those are at least,
3265		 * as far as I know, two types of the storage form.
3266		 */
3267		const struct _7z_coder *fc = folder->coders;
3268		static const struct _7z_coder coder_copy = {0, 1, 1, 0, NULL};
3269		const struct _7z_coder *scoder[3] =
3270			{&coder_copy, &coder_copy, &coder_copy};
3271		const void *buff;
3272		ssize_t bytes;
3273		unsigned char *b[3] = {NULL, NULL, NULL};
3274		uint64_t sunpack[3] ={-1, -1, -1};
3275		size_t s[3] = {0, 0, 0};
3276		int idx[3] = {0, 1, 2};
3277
3278		if (folder->numCoders == 4 && fc[3].codec == _7Z_X86_BCJ2 &&
3279		    folder->numInStreams == 7 && folder->numOutStreams == 4 &&
3280		    zip->pack_stream_remaining == 4) {
3281			/* Source type 1 made by 7zr or 7z with -m options. */
3282			if (folder->bindPairs[0].inIndex == 5) {
3283				/* The form made by 7zr */
3284				idx[0] = 1; idx[1] = 2; idx[2] = 0;
3285				scoder[1] = &(fc[1]);
3286				scoder[2] = &(fc[0]);
3287				sunpack[1] = folder->unPackSize[1];
3288				sunpack[2] = folder->unPackSize[0];
3289				coder1 = &(fc[2]);
3290			} else {
3291				/*
3292				 * NOTE: Some patterns do not work.
3293				 * work:
3294				 *  7z a -m0=BCJ2 -m1=COPY -m2=COPY
3295				 *       -m3=(any)
3296				 *  7z a -m0=BCJ2 -m1=COPY -m2=(any)
3297				 *       -m3=COPY
3298				 *  7z a -m0=BCJ2 -m1=(any) -m2=COPY
3299				 *       -m3=COPY
3300				 * not work:
3301				 *  other patterns.
3302				 *
3303				 * We have to handle this like `pipe' or
3304				 * our libarchive7s filter frame work,
3305				 * decoding the BCJ2 main stream sequentially,
3306				 * m3 -> m2 -> m1 -> BCJ2.
3307				 *
3308				 */
3309				if (fc[0].codec == _7Z_COPY &&
3310				    fc[1].codec == _7Z_COPY)
3311					coder1 = &(folder->coders[2]);
3312				else if (fc[0].codec == _7Z_COPY &&
3313				    fc[2].codec == _7Z_COPY)
3314					coder1 = &(folder->coders[1]);
3315				else if (fc[1].codec == _7Z_COPY &&
3316				    fc[2].codec == _7Z_COPY)
3317					coder1 = &(folder->coders[0]);
3318				else {
3319					archive_set_error(&(a->archive),
3320					    ARCHIVE_ERRNO_MISC,
3321					    "Unsupported form of "
3322					    "BCJ2 streams");
3323					return (ARCHIVE_FATAL);
3324				}
3325			}
3326			coder2 = &(fc[3]);
3327			zip->main_stream_bytes_remaining =
3328				(size_t)folder->unPackSize[2];
3329		} else if (coder2 != NULL && coder2->codec == _7Z_X86_BCJ2 &&
3330		    zip->pack_stream_remaining == 4 &&
3331		    folder->numInStreams == 5 && folder->numOutStreams == 2) {
3332			/* Source type 0 made by 7z */
3333			zip->main_stream_bytes_remaining =
3334				(size_t)folder->unPackSize[0];
3335		} else {
3336			/* We got an unexpected form. */
3337			archive_set_error(&(a->archive),
3338			    ARCHIVE_ERRNO_MISC,
3339			    "Unsupported form of BCJ2 streams");
3340			return (ARCHIVE_FATAL);
3341		}
3342
3343		/* Skip the main stream at this time. */
3344		if ((r = seek_pack(a)) < 0)
3345			return (r);
3346		zip->pack_stream_bytes_unconsumed =
3347		    (size_t)zip->pack_stream_inbytes_remaining;
3348		read_consume(a);
3349
3350		/* Read following three sub streams. */
3351		for (i = 0; i < 3; i++) {
3352			const struct _7z_coder *coder = scoder[i];
3353
3354			if ((r = seek_pack(a)) < 0) {
3355				free(b[0]); free(b[1]); free(b[2]);
3356				return (r);
3357			}
3358
3359			if (sunpack[i] == (uint64_t)-1)
3360				zip->folder_outbytes_remaining =
3361				    zip->pack_stream_inbytes_remaining;
3362			else
3363				zip->folder_outbytes_remaining = sunpack[i];
3364
3365			r = init_decompression(a, zip, coder, NULL);
3366			if (r != ARCHIVE_OK) {
3367				free(b[0]); free(b[1]); free(b[2]);
3368				return (ARCHIVE_FATAL);
3369			}
3370
3371			/* Allocate memory for the decorded data of a sub
3372			 * stream. */
3373			b[i] = malloc((size_t)zip->folder_outbytes_remaining);
3374			if (b[i] == NULL) {
3375				free(b[0]); free(b[1]); free(b[2]);
3376				archive_set_error(&a->archive, ENOMEM,
3377				    "No memory for 7-Zip decompression");
3378				return (ARCHIVE_FATAL);
3379			}
3380
3381			/* Extract a sub stream. */
3382			while (zip->pack_stream_inbytes_remaining > 0) {
3383				r = (int)extract_pack_stream(a, 0);
3384				if (r < 0) {
3385					free(b[0]); free(b[1]); free(b[2]);
3386					return (r);
3387				}
3388				bytes = get_uncompressed_data(a, &buff,
3389				    zip->uncompressed_buffer_bytes_remaining,
3390				    0);
3391				if (bytes < 0) {
3392					free(b[0]); free(b[1]); free(b[2]);
3393					return ((int)bytes);
3394				}
3395				memcpy(b[i]+s[i], buff, bytes);
3396				s[i] += bytes;
3397				if (zip->pack_stream_bytes_unconsumed)
3398					read_consume(a);
3399			}
3400		}
3401
3402		/* Set the sub streams to the right place. */
3403		for (i = 0; i < 3; i++) {
3404			zip->sub_stream_buff[i] = b[idx[i]];
3405			zip->sub_stream_size[i] = s[idx[i]];
3406			zip->sub_stream_bytes_remaining[i] = s[idx[i]];
3407		}
3408
3409		/* Allocate memory used for decoded main stream bytes. */
3410		if (zip->tmp_stream_buff == NULL) {
3411			zip->tmp_stream_buff_size = 32 * 1024;
3412			zip->tmp_stream_buff =
3413			    malloc(zip->tmp_stream_buff_size);
3414			if (zip->tmp_stream_buff == NULL) {
3415				archive_set_error(&a->archive, ENOMEM,
3416				    "No memory for 7-Zip decompression");
3417				return (ARCHIVE_FATAL);
3418			}
3419		}
3420		zip->tmp_stream_bytes_avail = 0;
3421		zip->tmp_stream_bytes_remaining = 0;
3422		zip->odd_bcj_size = 0;
3423		zip->bcj2_outPos = 0;
3424
3425		/*
3426		 * Reset a stream reader in order to read the main stream
3427		 * of BCJ2.
3428		 */
3429		zip->pack_stream_remaining = 1;
3430		zip->pack_stream_index = (unsigned)folder->packIndex;
3431		zip->folder_outbytes_remaining =
3432		    folder_uncompressed_size(folder);
3433		zip->uncompressed_buffer_bytes_remaining = 0;
3434	}
3435
3436	/*
3437	 * Initialize the decompressor for the new folder's pack streams.
3438	 */
3439	r = init_decompression(a, zip, coder1, coder2);
3440	if (r != ARCHIVE_OK)
3441		return (ARCHIVE_FATAL);
3442	return (ARCHIVE_OK);
3443}
3444
3445static int64_t
3446skip_stream(struct archive_read *a, size_t skip_bytes)
3447{
3448	struct _7zip *zip = (struct _7zip *)a->format->data;
3449	const void *p;
3450	int64_t skipped_bytes;
3451	size_t bytes = skip_bytes;
3452
3453	if (zip->folder_index == 0) {
3454		/*
3455		 * Optimization for a list mode.
3456		 * Avoid unncecessary decoding operations.
3457		 */
3458		zip->si.ci.folders[zip->entry->folderIndex].skipped_bytes
3459		    += skip_bytes;
3460		return (skip_bytes);
3461	}
3462
3463	while (bytes) {
3464		skipped_bytes = read_stream(a, &p, bytes, 0);
3465		if (skipped_bytes < 0)
3466			return (skipped_bytes);
3467		if (skipped_bytes == 0) {
3468			archive_set_error(&a->archive,
3469			    ARCHIVE_ERRNO_FILE_FORMAT,
3470			    "Truncated 7-Zip file body");
3471			return (ARCHIVE_FATAL);
3472		}
3473		bytes -= (size_t)skipped_bytes;
3474		if (zip->pack_stream_bytes_unconsumed)
3475			read_consume(a);
3476	}
3477	return (skip_bytes);
3478}
3479
3480/*
3481 * Brought from LZMA SDK.
3482 *
3483 * Bra86.c -- Converter for x86 code (BCJ)
3484 * 2008-10-04 : Igor Pavlov : Public domain
3485 *
3486 */
3487
3488#define Test86MSByte(b) ((b) == 0 || (b) == 0xFF)
3489
3490static void
3491x86_Init(struct _7zip *zip)
3492{
3493	zip->bcj_state = 0;
3494	zip->bcj_prevPosT = (size_t)0 - 1;
3495	zip->bcj_prevMask = 0;
3496	zip->bcj_ip = 5;
3497}
3498
3499static size_t
3500x86_Convert(struct _7zip *zip, uint8_t *data, size_t size)
3501{
3502	static const uint8_t kMaskToAllowedStatus[8] = {1, 1, 1, 0, 1, 0, 0, 0};
3503	static const uint8_t kMaskToBitNumber[8] = {0, 1, 2, 2, 3, 3, 3, 3};
3504	size_t bufferPos, prevPosT;
3505	uint32_t ip, prevMask;
3506
3507	if (size < 5)
3508		return 0;
3509
3510	bufferPos = 0;
3511	prevPosT = zip->bcj_prevPosT;
3512	prevMask = zip->bcj_prevMask;
3513	ip = zip->bcj_ip;
3514
3515	for (;;) {
3516		uint8_t *p = data + bufferPos;
3517		uint8_t *limit = data + size - 4;
3518
3519		for (; p < limit; p++)
3520			if ((*p & 0xFE) == 0xE8)
3521				break;
3522		bufferPos = (size_t)(p - data);
3523		if (p >= limit)
3524			break;
3525		prevPosT = bufferPos - prevPosT;
3526		if (prevPosT > 3)
3527			prevMask = 0;
3528		else {
3529			prevMask = (prevMask << ((int)prevPosT - 1)) & 0x7;
3530			if (prevMask != 0) {
3531				unsigned char b =
3532					p[4 - kMaskToBitNumber[prevMask]];
3533				if (!kMaskToAllowedStatus[prevMask] ||
3534				    Test86MSByte(b)) {
3535					prevPosT = bufferPos;
3536					prevMask = ((prevMask << 1) & 0x7) | 1;
3537					bufferPos++;
3538					continue;
3539				}
3540			}
3541		}
3542		prevPosT = bufferPos;
3543
3544		if (Test86MSByte(p[4])) {
3545			uint32_t src = ((uint32_t)p[4] << 24) |
3546				((uint32_t)p[3] << 16) | ((uint32_t)p[2] << 8) |
3547				((uint32_t)p[1]);
3548			uint32_t dest;
3549			for (;;) {
3550				uint8_t b;
3551				int b_index;
3552
3553				dest = src - (ip + (uint32_t)bufferPos);
3554				if (prevMask == 0)
3555					break;
3556				b_index = kMaskToBitNumber[prevMask] * 8;
3557				b = (uint8_t)(dest >> (24 - b_index));
3558				if (!Test86MSByte(b))
3559					break;
3560				src = dest ^ ((1 << (32 - b_index)) - 1);
3561			}
3562			p[4] = (uint8_t)(~(((dest >> 24) & 1) - 1));
3563			p[3] = (uint8_t)(dest >> 16);
3564			p[2] = (uint8_t)(dest >> 8);
3565			p[1] = (uint8_t)dest;
3566			bufferPos += 5;
3567		} else {
3568			prevMask = ((prevMask << 1) & 0x7) | 1;
3569			bufferPos++;
3570		}
3571	}
3572	zip->bcj_prevPosT = prevPosT;
3573	zip->bcj_prevMask = prevMask;
3574	zip->bcj_ip += (uint32_t)bufferPos;
3575	return (bufferPos);
3576}
3577
3578/*
3579 * Brought from LZMA SDK.
3580 *
3581 * Bcj2.c -- Converter for x86 code (BCJ2)
3582 * 2008-10-04 : Igor Pavlov : Public domain
3583 *
3584 */
3585
3586#define SZ_ERROR_DATA	 ARCHIVE_FAILED
3587
3588#define IsJcc(b0, b1) ((b0) == 0x0F && ((b1) & 0xF0) == 0x80)
3589#define IsJ(b0, b1) ((b1 & 0xFE) == 0xE8 || IsJcc(b0, b1))
3590
3591#define kNumTopBits 24
3592#define kTopValue ((uint32_t)1 << kNumTopBits)
3593
3594#define kNumBitModelTotalBits 11
3595#define kBitModelTotal (1 << kNumBitModelTotalBits)
3596#define kNumMoveBits 5
3597
3598#define RC_READ_BYTE (*buffer++)
3599#define RC_TEST { if (buffer == bufferLim) return SZ_ERROR_DATA; }
3600#define RC_INIT2 zip->bcj2_code = 0; zip->bcj2_range = 0xFFFFFFFF; \
3601  { int ii; for (ii = 0; ii < 5; ii++) { RC_TEST; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }}
3602
3603#define NORMALIZE if (zip->bcj2_range < kTopValue) { RC_TEST; zip->bcj2_range <<= 8; zip->bcj2_code = (zip->bcj2_code << 8) | RC_READ_BYTE; }
3604
3605#define IF_BIT_0(p) ttt = *(p); bound = (zip->bcj2_range >> kNumBitModelTotalBits) * ttt; if (zip->bcj2_code < bound)
3606#define UPDATE_0(p) zip->bcj2_range = bound; *(p) = (CProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits)); NORMALIZE;
3607#define UPDATE_1(p) zip->bcj2_range -= bound; zip->bcj2_code -= bound; *(p) = (CProb)(ttt - (ttt >> kNumMoveBits)); NORMALIZE;
3608
3609static ssize_t
3610Bcj2_Decode(struct _7zip *zip, uint8_t *outBuf, size_t outSize)
3611{
3612	size_t inPos = 0, outPos = 0;
3613	const uint8_t *buf0, *buf1, *buf2, *buf3;
3614	size_t size0, size1, size2, size3;
3615	const uint8_t *buffer, *bufferLim;
3616	unsigned int i, j;
3617
3618	size0 = zip->tmp_stream_bytes_remaining;
3619	buf0 = zip->tmp_stream_buff + zip->tmp_stream_bytes_avail - size0;
3620	size1 = zip->sub_stream_bytes_remaining[0];
3621	buf1 = zip->sub_stream_buff[0] + zip->sub_stream_size[0] - size1;
3622	size2 = zip->sub_stream_bytes_remaining[1];
3623	buf2 = zip->sub_stream_buff[1] + zip->sub_stream_size[1] - size2;
3624	size3 = zip->sub_stream_bytes_remaining[2];
3625	buf3 = zip->sub_stream_buff[2] + zip->sub_stream_size[2] - size3;
3626
3627	buffer = buf3;
3628	bufferLim = buffer + size3;
3629
3630	if (zip->bcj_state == 0) {
3631		/*
3632		 * Initialize.
3633		 */
3634		zip->bcj2_prevByte = 0;
3635		for (i = 0;
3636		    i < sizeof(zip->bcj2_p) / sizeof(zip->bcj2_p[0]); i++)
3637			zip->bcj2_p[i] = kBitModelTotal >> 1;
3638		RC_INIT2;
3639		zip->bcj_state = 1;
3640	}
3641
3642	/*
3643	 * Gather the odd bytes of a previous call.
3644	 */
3645	for (i = 0; zip->odd_bcj_size > 0 && outPos < outSize; i++) {
3646		outBuf[outPos++] = zip->odd_bcj[i];
3647		zip->odd_bcj_size--;
3648	}
3649
3650	if (outSize == 0) {
3651		zip->bcj2_outPos += outPos;
3652		return (outPos);
3653	}
3654
3655	for (;;) {
3656		uint8_t b;
3657		CProb *prob;
3658		uint32_t bound;
3659		uint32_t ttt;
3660
3661		size_t limit = size0 - inPos;
3662		if (outSize - outPos < limit)
3663			limit = outSize - outPos;
3664
3665		if (zip->bcj_state == 1) {
3666			while (limit != 0) {
3667				uint8_t bb = buf0[inPos];
3668				outBuf[outPos++] = bb;
3669				if (IsJ(zip->bcj2_prevByte, bb)) {
3670					zip->bcj_state = 2;
3671					break;
3672				}
3673				inPos++;
3674				zip->bcj2_prevByte = bb;
3675				limit--;
3676			}
3677		}
3678
3679		if (limit == 0 || outPos == outSize)
3680			break;
3681		zip->bcj_state = 1;
3682
3683		b = buf0[inPos++];
3684
3685		if (b == 0xE8)
3686			prob = zip->bcj2_p + zip->bcj2_prevByte;
3687		else if (b == 0xE9)
3688			prob = zip->bcj2_p + 256;
3689		else
3690			prob = zip->bcj2_p + 257;
3691
3692		IF_BIT_0(prob) {
3693			UPDATE_0(prob)
3694			zip->bcj2_prevByte = b;
3695		} else {
3696			uint32_t dest;
3697			const uint8_t *v;
3698			uint8_t out[4];
3699
3700			UPDATE_1(prob)
3701			if (b == 0xE8) {
3702				v = buf1;
3703				if (size1 < 4)
3704					return SZ_ERROR_DATA;
3705				buf1 += 4;
3706				size1 -= 4;
3707			} else {
3708				v = buf2;
3709				if (size2 < 4)
3710					return SZ_ERROR_DATA;
3711				buf2 += 4;
3712				size2 -= 4;
3713			}
3714			dest = (((uint32_t)v[0] << 24) |
3715			    ((uint32_t)v[1] << 16) |
3716			    ((uint32_t)v[2] << 8) |
3717			    ((uint32_t)v[3])) -
3718			    ((uint32_t)zip->bcj2_outPos + (uint32_t)outPos + 4);
3719			out[0] = (uint8_t)dest;
3720			out[1] = (uint8_t)(dest >> 8);
3721			out[2] = (uint8_t)(dest >> 16);
3722			out[3] = zip->bcj2_prevByte = (uint8_t)(dest >> 24);
3723
3724			for (i = 0; i < 4 && outPos < outSize; i++)
3725				outBuf[outPos++] = out[i];
3726			if (i < 4) {
3727				/*
3728				 * Save odd bytes which we could not add into
3729				 * the output buffer because of out of space.
3730				 */
3731				zip->odd_bcj_size = 4 -i;
3732				for (; i < 4; i++) {
3733					j = i - 4 + (unsigned)zip->odd_bcj_size;
3734					zip->odd_bcj[j] = out[i];
3735				}
3736				break;
3737			}
3738		}
3739	}
3740	zip->tmp_stream_bytes_remaining -= inPos;
3741	zip->sub_stream_bytes_remaining[0] = size1;
3742	zip->sub_stream_bytes_remaining[1] = size2;
3743	zip->sub_stream_bytes_remaining[2] = bufferLim - buffer;
3744	zip->bcj2_outPos += outPos;
3745
3746	return ((ssize_t)outPos);
3747}
3748
3749