archive_read_support_format_rar.c revision 342360
1/*-
2* Copyright (c) 2003-2007 Tim Kientzle
3* Copyright (c) 2011 Andres Mejia
4* All rights reserved.
5*
6* Redistribution and use in source and binary forms, with or without
7* modification, are permitted provided that the following conditions
8* are met:
9* 1. Redistributions of source code must retain the above copyright
10*    notice, this list of conditions and the following disclaimer.
11* 2. Redistributions in binary form must reproduce the above copyright
12*    notice, this list of conditions and the following disclaimer in the
13*    documentation and/or other materials provided with the distribution.
14*
15* THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
16* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18* IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
19* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25*/
26
27#include "archive_platform.h"
28
29#ifdef HAVE_ERRNO_H
30#include <errno.h>
31#endif
32#include <time.h>
33#include <limits.h>
34#ifdef HAVE_ZLIB_H
35#include <zlib.h> /* crc32 */
36#endif
37
38#include "archive.h"
39#ifndef HAVE_ZLIB_H
40#include "archive_crc32.h"
41#endif
42#include "archive_endian.h"
43#include "archive_entry.h"
44#include "archive_entry_locale.h"
45#include "archive_ppmd7_private.h"
46#include "archive_private.h"
47#include "archive_read_private.h"
48
49/* RAR signature, also known as the mark header */
50#define RAR_SIGNATURE "\x52\x61\x72\x21\x1A\x07\x00"
51
52/* Header types */
53#define MARK_HEAD    0x72
54#define MAIN_HEAD    0x73
55#define FILE_HEAD    0x74
56#define COMM_HEAD    0x75
57#define AV_HEAD      0x76
58#define SUB_HEAD     0x77
59#define PROTECT_HEAD 0x78
60#define SIGN_HEAD    0x79
61#define NEWSUB_HEAD  0x7a
62#define ENDARC_HEAD  0x7b
63
64/* Main Header Flags */
65#define MHD_VOLUME       0x0001
66#define MHD_COMMENT      0x0002
67#define MHD_LOCK         0x0004
68#define MHD_SOLID        0x0008
69#define MHD_NEWNUMBERING 0x0010
70#define MHD_AV           0x0020
71#define MHD_PROTECT      0x0040
72#define MHD_PASSWORD     0x0080
73#define MHD_FIRSTVOLUME  0x0100
74#define MHD_ENCRYPTVER   0x0200
75
76/* Flags common to all headers */
77#define HD_MARKDELETION     0x4000
78#define HD_ADD_SIZE_PRESENT 0x8000
79
80/* File Header Flags */
81#define FHD_SPLIT_BEFORE 0x0001
82#define FHD_SPLIT_AFTER  0x0002
83#define FHD_PASSWORD     0x0004
84#define FHD_COMMENT      0x0008
85#define FHD_SOLID        0x0010
86#define FHD_LARGE        0x0100
87#define FHD_UNICODE      0x0200
88#define FHD_SALT         0x0400
89#define FHD_VERSION      0x0800
90#define FHD_EXTTIME      0x1000
91#define FHD_EXTFLAGS     0x2000
92
93/* File dictionary sizes */
94#define DICTIONARY_SIZE_64   0x00
95#define DICTIONARY_SIZE_128  0x20
96#define DICTIONARY_SIZE_256  0x40
97#define DICTIONARY_SIZE_512  0x60
98#define DICTIONARY_SIZE_1024 0x80
99#define DICTIONARY_SIZE_2048 0xA0
100#define DICTIONARY_SIZE_4096 0xC0
101#define FILE_IS_DIRECTORY    0xE0
102#define DICTIONARY_MASK      FILE_IS_DIRECTORY
103
104/* OS Flags */
105#define OS_MSDOS  0
106#define OS_OS2    1
107#define OS_WIN32  2
108#define OS_UNIX   3
109#define OS_MAC_OS 4
110#define OS_BEOS   5
111
112/* Compression Methods */
113#define COMPRESS_METHOD_STORE   0x30
114/* LZSS */
115#define COMPRESS_METHOD_FASTEST 0x31
116#define COMPRESS_METHOD_FAST    0x32
117#define COMPRESS_METHOD_NORMAL  0x33
118/* PPMd Variant H */
119#define COMPRESS_METHOD_GOOD    0x34
120#define COMPRESS_METHOD_BEST    0x35
121
122#define CRC_POLYNOMIAL 0xEDB88320
123
124#define NS_UNIT 10000000
125
126#define DICTIONARY_MAX_SIZE 0x400000
127
128#define MAINCODE_SIZE      299
129#define OFFSETCODE_SIZE    60
130#define LOWOFFSETCODE_SIZE 17
131#define LENGTHCODE_SIZE    28
132#define HUFFMAN_TABLE_SIZE \
133  MAINCODE_SIZE + OFFSETCODE_SIZE + LOWOFFSETCODE_SIZE + LENGTHCODE_SIZE
134
135#define MAX_SYMBOL_LENGTH 0xF
136#define MAX_SYMBOLS       20
137
138/*
139 * Considering L1,L2 cache miss and a calling of write system-call,
140 * the best size of the output buffer(uncompressed buffer) is 128K.
141 * If the structure of extracting process is changed, this value
142 * might be researched again.
143 */
144#define UNP_BUFFER_SIZE   (128 * 1024)
145
146/* Define this here for non-Windows platforms */
147#if !((defined(__WIN32__) || defined(_WIN32) || defined(__WIN32)) && !defined(__CYGWIN__))
148#define FILE_ATTRIBUTE_DIRECTORY 0x10
149#endif
150
151/* Fields common to all headers */
152struct rar_header
153{
154  char crc[2];
155  char type;
156  char flags[2];
157  char size[2];
158};
159
160/* Fields common to all file headers */
161struct rar_file_header
162{
163  char pack_size[4];
164  char unp_size[4];
165  char host_os;
166  char file_crc[4];
167  char file_time[4];
168  char unp_ver;
169  char method;
170  char name_size[2];
171  char file_attr[4];
172};
173
174struct huffman_tree_node
175{
176  int branches[2];
177};
178
179struct huffman_table_entry
180{
181  unsigned int length;
182  int value;
183};
184
185struct huffman_code
186{
187  struct huffman_tree_node *tree;
188  int numentries;
189  int numallocatedentries;
190  int minlength;
191  int maxlength;
192  int tablesize;
193  struct huffman_table_entry *table;
194};
195
196struct lzss
197{
198  unsigned char *window;
199  int mask;
200  int64_t position;
201};
202
203struct data_block_offsets
204{
205  int64_t header_size;
206  int64_t start_offset;
207  int64_t end_offset;
208};
209
210struct rar
211{
212  /* Entries from main RAR header */
213  unsigned main_flags;
214  unsigned long file_crc;
215  char reserved1[2];
216  char reserved2[4];
217  char encryptver;
218
219  /* File header entries */
220  char compression_method;
221  unsigned file_flags;
222  int64_t packed_size;
223  int64_t unp_size;
224  time_t mtime;
225  long mnsec;
226  mode_t mode;
227  char *filename;
228  char *filename_save;
229  size_t filename_save_size;
230  size_t filename_allocated;
231
232  /* File header optional entries */
233  char salt[8];
234  time_t atime;
235  long ansec;
236  time_t ctime;
237  long cnsec;
238  time_t arctime;
239  long arcnsec;
240
241  /* Fields to help with tracking decompression of files. */
242  int64_t bytes_unconsumed;
243  int64_t bytes_remaining;
244  int64_t bytes_uncopied;
245  int64_t offset;
246  int64_t offset_outgoing;
247  int64_t offset_seek;
248  char valid;
249  unsigned int unp_offset;
250  unsigned int unp_buffer_size;
251  unsigned char *unp_buffer;
252  unsigned int dictionary_size;
253  char start_new_block;
254  char entry_eof;
255  unsigned long crc_calculated;
256  int found_first_header;
257  char has_endarc_header;
258  struct data_block_offsets *dbo;
259  unsigned int cursor;
260  unsigned int nodes;
261  char filename_must_match;
262
263  /* LZSS members */
264  struct huffman_code maincode;
265  struct huffman_code offsetcode;
266  struct huffman_code lowoffsetcode;
267  struct huffman_code lengthcode;
268  unsigned char lengthtable[HUFFMAN_TABLE_SIZE];
269  struct lzss lzss;
270  char output_last_match;
271  unsigned int lastlength;
272  unsigned int lastoffset;
273  unsigned int oldoffset[4];
274  unsigned int lastlowoffset;
275  unsigned int numlowoffsetrepeats;
276  int64_t filterstart;
277  char start_new_table;
278
279  /* PPMd Variant H members */
280  char ppmd_valid;
281  char ppmd_eod;
282  char is_ppmd_block;
283  int ppmd_escape;
284  CPpmd7 ppmd7_context;
285  CPpmd7z_RangeDec range_dec;
286  IByteIn bytein;
287
288  /*
289   * String conversion object.
290   */
291  int init_default_conversion;
292  struct archive_string_conv *sconv_default;
293  struct archive_string_conv *opt_sconv;
294  struct archive_string_conv *sconv_utf8;
295  struct archive_string_conv *sconv_utf16be;
296
297  /*
298   * Bit stream reader.
299   */
300  struct rar_br {
301#define CACHE_TYPE	uint64_t
302#define CACHE_BITS	(8 * sizeof(CACHE_TYPE))
303    /* Cache buffer. */
304    CACHE_TYPE		 cache_buffer;
305    /* Indicates how many bits avail in cache_buffer. */
306    int			 cache_avail;
307    ssize_t		 avail_in;
308    const unsigned char *next_in;
309  } br;
310
311  /*
312   * Custom field to denote that this archive contains encrypted entries
313   */
314  int has_encrypted_entries;
315};
316
317static int archive_read_support_format_rar_capabilities(struct archive_read *);
318static int archive_read_format_rar_has_encrypted_entries(struct archive_read *);
319static int archive_read_format_rar_bid(struct archive_read *, int);
320static int archive_read_format_rar_options(struct archive_read *,
321    const char *, const char *);
322static int archive_read_format_rar_read_header(struct archive_read *,
323    struct archive_entry *);
324static int archive_read_format_rar_read_data(struct archive_read *,
325    const void **, size_t *, int64_t *);
326static int archive_read_format_rar_read_data_skip(struct archive_read *a);
327static int64_t archive_read_format_rar_seek_data(struct archive_read *, int64_t,
328    int);
329static int archive_read_format_rar_cleanup(struct archive_read *);
330
331/* Support functions */
332static int read_header(struct archive_read *, struct archive_entry *, char);
333static time_t get_time(int);
334static int read_exttime(const char *, struct rar *, const char *);
335static int read_symlink_stored(struct archive_read *, struct archive_entry *,
336                               struct archive_string_conv *);
337static int read_data_stored(struct archive_read *, const void **, size_t *,
338                            int64_t *);
339static int read_data_compressed(struct archive_read *, const void **, size_t *,
340                          int64_t *);
341static int rar_br_preparation(struct archive_read *, struct rar_br *);
342static int parse_codes(struct archive_read *);
343static void free_codes(struct archive_read *);
344static int read_next_symbol(struct archive_read *, struct huffman_code *);
345static int create_code(struct archive_read *, struct huffman_code *,
346                        unsigned char *, int, char);
347static int add_value(struct archive_read *, struct huffman_code *, int, int,
348                     int);
349static int new_node(struct huffman_code *);
350static int make_table(struct archive_read *, struct huffman_code *);
351static int make_table_recurse(struct archive_read *, struct huffman_code *, int,
352                              struct huffman_table_entry *, int, int);
353static int64_t expand(struct archive_read *, int64_t);
354static int copy_from_lzss_window(struct archive_read *, const void **,
355                                   int64_t, int);
356static const void *rar_read_ahead(struct archive_read *, size_t, ssize_t *);
357
358/*
359 * Bit stream reader.
360 */
361/* Check that the cache buffer has enough bits. */
362#define rar_br_has(br, n) ((br)->cache_avail >= n)
363/* Get compressed data by bit. */
364#define rar_br_bits(br, n)        \
365  (((uint32_t)((br)->cache_buffer >>    \
366    ((br)->cache_avail - (n)))) & cache_masks[n])
367#define rar_br_bits_forced(br, n)     \
368  (((uint32_t)((br)->cache_buffer <<    \
369    ((n) - (br)->cache_avail))) & cache_masks[n])
370/* Read ahead to make sure the cache buffer has enough compressed data we
371 * will use.
372 *  True  : completed, there is enough data in the cache buffer.
373 *  False : there is no data in the stream. */
374#define rar_br_read_ahead(a, br, n) \
375  ((rar_br_has(br, (n)) || rar_br_fillup(a, br)) || rar_br_has(br, (n)))
376/* Notify how many bits we consumed. */
377#define rar_br_consume(br, n) ((br)->cache_avail -= (n))
378#define rar_br_consume_unalined_bits(br) ((br)->cache_avail &= ~7)
379
380static const uint32_t cache_masks[] = {
381  0x00000000, 0x00000001, 0x00000003, 0x00000007,
382  0x0000000F, 0x0000001F, 0x0000003F, 0x0000007F,
383  0x000000FF, 0x000001FF, 0x000003FF, 0x000007FF,
384  0x00000FFF, 0x00001FFF, 0x00003FFF, 0x00007FFF,
385  0x0000FFFF, 0x0001FFFF, 0x0003FFFF, 0x0007FFFF,
386  0x000FFFFF, 0x001FFFFF, 0x003FFFFF, 0x007FFFFF,
387  0x00FFFFFF, 0x01FFFFFF, 0x03FFFFFF, 0x07FFFFFF,
388  0x0FFFFFFF, 0x1FFFFFFF, 0x3FFFFFFF, 0x7FFFFFFF,
389  0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
390};
391
392/*
393 * Shift away used bits in the cache data and fill it up with following bits.
394 * Call this when cache buffer does not have enough bits you need.
395 *
396 * Returns 1 if the cache buffer is full.
397 * Returns 0 if the cache buffer is not full; input buffer is empty.
398 */
399static int
400rar_br_fillup(struct archive_read *a, struct rar_br *br)
401{
402  struct rar *rar = (struct rar *)(a->format->data);
403  int n = CACHE_BITS - br->cache_avail;
404
405  for (;;) {
406    switch (n >> 3) {
407    case 8:
408      if (br->avail_in >= 8) {
409        br->cache_buffer =
410            ((uint64_t)br->next_in[0]) << 56 |
411            ((uint64_t)br->next_in[1]) << 48 |
412            ((uint64_t)br->next_in[2]) << 40 |
413            ((uint64_t)br->next_in[3]) << 32 |
414            ((uint32_t)br->next_in[4]) << 24 |
415            ((uint32_t)br->next_in[5]) << 16 |
416            ((uint32_t)br->next_in[6]) << 8 |
417             (uint32_t)br->next_in[7];
418        br->next_in += 8;
419        br->avail_in -= 8;
420        br->cache_avail += 8 * 8;
421        rar->bytes_unconsumed += 8;
422        rar->bytes_remaining -= 8;
423        return (1);
424      }
425      break;
426    case 7:
427      if (br->avail_in >= 7) {
428        br->cache_buffer =
429           (br->cache_buffer << 56) |
430            ((uint64_t)br->next_in[0]) << 48 |
431            ((uint64_t)br->next_in[1]) << 40 |
432            ((uint64_t)br->next_in[2]) << 32 |
433            ((uint32_t)br->next_in[3]) << 24 |
434            ((uint32_t)br->next_in[4]) << 16 |
435            ((uint32_t)br->next_in[5]) << 8 |
436             (uint32_t)br->next_in[6];
437        br->next_in += 7;
438        br->avail_in -= 7;
439        br->cache_avail += 7 * 8;
440        rar->bytes_unconsumed += 7;
441        rar->bytes_remaining -= 7;
442        return (1);
443      }
444      break;
445    case 6:
446      if (br->avail_in >= 6) {
447        br->cache_buffer =
448           (br->cache_buffer << 48) |
449            ((uint64_t)br->next_in[0]) << 40 |
450            ((uint64_t)br->next_in[1]) << 32 |
451            ((uint32_t)br->next_in[2]) << 24 |
452            ((uint32_t)br->next_in[3]) << 16 |
453            ((uint32_t)br->next_in[4]) << 8 |
454             (uint32_t)br->next_in[5];
455        br->next_in += 6;
456        br->avail_in -= 6;
457        br->cache_avail += 6 * 8;
458        rar->bytes_unconsumed += 6;
459        rar->bytes_remaining -= 6;
460        return (1);
461      }
462      break;
463    case 0:
464      /* We have enough compressed data in
465       * the cache buffer.*/
466      return (1);
467    default:
468      break;
469    }
470    if (br->avail_in <= 0) {
471
472      if (rar->bytes_unconsumed > 0) {
473        /* Consume as much as the decompressor
474         * actually used. */
475        __archive_read_consume(a, rar->bytes_unconsumed);
476        rar->bytes_unconsumed = 0;
477      }
478      br->next_in = rar_read_ahead(a, 1, &(br->avail_in));
479      if (br->next_in == NULL)
480        return (0);
481      if (br->avail_in == 0)
482        return (0);
483    }
484    br->cache_buffer =
485       (br->cache_buffer << 8) | *br->next_in++;
486    br->avail_in--;
487    br->cache_avail += 8;
488    n -= 8;
489    rar->bytes_unconsumed++;
490    rar->bytes_remaining--;
491  }
492}
493
494static int
495rar_br_preparation(struct archive_read *a, struct rar_br *br)
496{
497  struct rar *rar = (struct rar *)(a->format->data);
498
499  if (rar->bytes_remaining > 0) {
500    br->next_in = rar_read_ahead(a, 1, &(br->avail_in));
501    if (br->next_in == NULL) {
502      archive_set_error(&a->archive,
503          ARCHIVE_ERRNO_FILE_FORMAT,
504          "Truncated RAR file data");
505      return (ARCHIVE_FATAL);
506    }
507    if (br->cache_avail == 0)
508      (void)rar_br_fillup(a, br);
509  }
510  return (ARCHIVE_OK);
511}
512
513/* Find last bit set */
514static inline int
515rar_fls(unsigned int word)
516{
517  word |= (word >>  1);
518  word |= (word >>  2);
519  word |= (word >>  4);
520  word |= (word >>  8);
521  word |= (word >> 16);
522  return word - (word >> 1);
523}
524
525/* LZSS functions */
526static inline int64_t
527lzss_position(struct lzss *lzss)
528{
529  return lzss->position;
530}
531
532static inline int
533lzss_mask(struct lzss *lzss)
534{
535  return lzss->mask;
536}
537
538static inline int
539lzss_size(struct lzss *lzss)
540{
541  return lzss->mask + 1;
542}
543
544static inline int
545lzss_offset_for_position(struct lzss *lzss, int64_t pos)
546{
547  return (int)(pos & lzss->mask);
548}
549
550static inline unsigned char *
551lzss_pointer_for_position(struct lzss *lzss, int64_t pos)
552{
553  return &lzss->window[lzss_offset_for_position(lzss, pos)];
554}
555
556static inline int
557lzss_current_offset(struct lzss *lzss)
558{
559  return lzss_offset_for_position(lzss, lzss->position);
560}
561
562static inline uint8_t *
563lzss_current_pointer(struct lzss *lzss)
564{
565  return lzss_pointer_for_position(lzss, lzss->position);
566}
567
568static inline void
569lzss_emit_literal(struct rar *rar, uint8_t literal)
570{
571  *lzss_current_pointer(&rar->lzss) = literal;
572  rar->lzss.position++;
573}
574
575static inline void
576lzss_emit_match(struct rar *rar, int offset, int length)
577{
578  int dstoffs = lzss_current_offset(&rar->lzss);
579  int srcoffs = (dstoffs - offset) & lzss_mask(&rar->lzss);
580  int l, li, remaining;
581  unsigned char *d, *s;
582
583  remaining = length;
584  while (remaining > 0) {
585    l = remaining;
586    if (dstoffs > srcoffs) {
587      if (l > lzss_size(&rar->lzss) - dstoffs)
588        l = lzss_size(&rar->lzss) - dstoffs;
589    } else {
590      if (l > lzss_size(&rar->lzss) - srcoffs)
591        l = lzss_size(&rar->lzss) - srcoffs;
592    }
593    d = &(rar->lzss.window[dstoffs]);
594    s = &(rar->lzss.window[srcoffs]);
595    if ((dstoffs + l < srcoffs) || (srcoffs + l < dstoffs))
596      memcpy(d, s, l);
597    else {
598      for (li = 0; li < l; li++)
599        d[li] = s[li];
600    }
601    remaining -= l;
602    dstoffs = (dstoffs + l) & lzss_mask(&(rar->lzss));
603    srcoffs = (srcoffs + l) & lzss_mask(&(rar->lzss));
604  }
605  rar->lzss.position += length;
606}
607
608static Byte
609ppmd_read(void *p)
610{
611  struct archive_read *a = ((IByteIn*)p)->a;
612  struct rar *rar = (struct rar *)(a->format->data);
613  struct rar_br *br = &(rar->br);
614  Byte b;
615  if (!rar_br_read_ahead(a, br, 8))
616  {
617    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
618                      "Truncated RAR file data");
619    rar->valid = 0;
620    return 0;
621  }
622  b = rar_br_bits(br, 8);
623  rar_br_consume(br, 8);
624  return b;
625}
626
627int
628archive_read_support_format_rar(struct archive *_a)
629{
630  struct archive_read *a = (struct archive_read *)_a;
631  struct rar *rar;
632  int r;
633
634  archive_check_magic(_a, ARCHIVE_READ_MAGIC, ARCHIVE_STATE_NEW,
635                      "archive_read_support_format_rar");
636
637  rar = (struct rar *)calloc(sizeof(*rar), 1);
638  if (rar == NULL)
639  {
640    archive_set_error(&a->archive, ENOMEM, "Can't allocate rar data");
641    return (ARCHIVE_FATAL);
642  }
643
644	/*
645	 * Until enough data has been read, we cannot tell about
646	 * any encrypted entries yet.
647	 */
648	rar->has_encrypted_entries = ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
649
650  r = __archive_read_register_format(a,
651                                     rar,
652                                     "rar",
653                                     archive_read_format_rar_bid,
654                                     archive_read_format_rar_options,
655                                     archive_read_format_rar_read_header,
656                                     archive_read_format_rar_read_data,
657                                     archive_read_format_rar_read_data_skip,
658                                     archive_read_format_rar_seek_data,
659                                     archive_read_format_rar_cleanup,
660                                     archive_read_support_format_rar_capabilities,
661                                     archive_read_format_rar_has_encrypted_entries);
662
663  if (r != ARCHIVE_OK)
664    free(rar);
665  return (r);
666}
667
668static int
669archive_read_support_format_rar_capabilities(struct archive_read * a)
670{
671	(void)a; /* UNUSED */
672	return (ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA
673			| ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA);
674}
675
676static int
677archive_read_format_rar_has_encrypted_entries(struct archive_read *_a)
678{
679	if (_a && _a->format) {
680		struct rar * rar = (struct rar *)_a->format->data;
681		if (rar) {
682			return rar->has_encrypted_entries;
683		}
684	}
685	return ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW;
686}
687
688
689static int
690archive_read_format_rar_bid(struct archive_read *a, int best_bid)
691{
692  const char *p;
693
694  /* If there's already a bid > 30, we'll never win. */
695  if (best_bid > 30)
696	  return (-1);
697
698  if ((p = __archive_read_ahead(a, 7, NULL)) == NULL)
699    return (-1);
700
701  if (memcmp(p, RAR_SIGNATURE, 7) == 0)
702    return (30);
703
704  if ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0) {
705    /* This is a PE file */
706    ssize_t offset = 0x10000;
707    ssize_t window = 4096;
708    ssize_t bytes_avail;
709    while (offset + window <= (1024 * 128)) {
710      const char *buff = __archive_read_ahead(a, offset + window, &bytes_avail);
711      if (buff == NULL) {
712        /* Remaining bytes are less than window. */
713        window >>= 1;
714        if (window < 0x40)
715          return (0);
716        continue;
717      }
718      p = buff + offset;
719      while (p + 7 < buff + bytes_avail) {
720        if (memcmp(p, RAR_SIGNATURE, 7) == 0)
721          return (30);
722        p += 0x10;
723      }
724      offset = p - buff;
725    }
726  }
727  return (0);
728}
729
730static int
731skip_sfx(struct archive_read *a)
732{
733  const void *h;
734  const char *p, *q;
735  size_t skip, total;
736  ssize_t bytes, window;
737
738  total = 0;
739  window = 4096;
740  while (total + window <= (1024 * 128)) {
741    h = __archive_read_ahead(a, window, &bytes);
742    if (h == NULL) {
743      /* Remaining bytes are less than window. */
744      window >>= 1;
745      if (window < 0x40)
746      	goto fatal;
747      continue;
748    }
749    if (bytes < 0x40)
750      goto fatal;
751    p = h;
752    q = p + bytes;
753
754    /*
755     * Scan ahead until we find something that looks
756     * like the RAR header.
757     */
758    while (p + 7 < q) {
759      if (memcmp(p, RAR_SIGNATURE, 7) == 0) {
760      	skip = p - (const char *)h;
761      	__archive_read_consume(a, skip);
762      	return (ARCHIVE_OK);
763      }
764      p += 0x10;
765    }
766    skip = p - (const char *)h;
767    __archive_read_consume(a, skip);
768	total += skip;
769  }
770fatal:
771  archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
772      "Couldn't find out RAR header");
773  return (ARCHIVE_FATAL);
774}
775
776static int
777archive_read_format_rar_options(struct archive_read *a,
778    const char *key, const char *val)
779{
780  struct rar *rar;
781  int ret = ARCHIVE_FAILED;
782
783  rar = (struct rar *)(a->format->data);
784  if (strcmp(key, "hdrcharset")  == 0) {
785    if (val == NULL || val[0] == 0)
786      archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
787          "rar: hdrcharset option needs a character-set name");
788    else {
789      rar->opt_sconv =
790          archive_string_conversion_from_charset(
791              &a->archive, val, 0);
792      if (rar->opt_sconv != NULL)
793        ret = ARCHIVE_OK;
794      else
795        ret = ARCHIVE_FATAL;
796    }
797    return (ret);
798  }
799
800  /* Note: The "warn" return is just to inform the options
801   * supervisor that we didn't handle it.  It will generate
802   * a suitable error if no one used this option. */
803  return (ARCHIVE_WARN);
804}
805
806static int
807archive_read_format_rar_read_header(struct archive_read *a,
808                                    struct archive_entry *entry)
809{
810  const void *h;
811  const char *p;
812  struct rar *rar;
813  size_t skip;
814  char head_type;
815  int ret;
816  unsigned flags;
817  unsigned long crc32_expected;
818
819  a->archive.archive_format = ARCHIVE_FORMAT_RAR;
820  if (a->archive.archive_format_name == NULL)
821    a->archive.archive_format_name = "RAR";
822
823  rar = (struct rar *)(a->format->data);
824
825  /*
826   * It should be sufficient to call archive_read_next_header() for
827   * a reader to determine if an entry is encrypted or not. If the
828   * encryption of an entry is only detectable when calling
829   * archive_read_data(), so be it. We'll do the same check there
830   * as well.
831   */
832  if (rar->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
833	  rar->has_encrypted_entries = 0;
834  }
835
836  /* RAR files can be generated without EOF headers, so return ARCHIVE_EOF if
837  * this fails.
838  */
839  if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
840    return (ARCHIVE_EOF);
841
842  p = h;
843  if (rar->found_first_header == 0 &&
844     ((p[0] == 'M' && p[1] == 'Z') || memcmp(p, "\x7F\x45LF", 4) == 0)) {
845    /* This is an executable ? Must be self-extracting... */
846    ret = skip_sfx(a);
847    if (ret < ARCHIVE_WARN)
848      return (ret);
849  }
850  rar->found_first_header = 1;
851
852  while (1)
853  {
854    unsigned long crc32_val;
855
856    if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
857      return (ARCHIVE_FATAL);
858    p = h;
859
860    head_type = p[2];
861    switch(head_type)
862    {
863    case MARK_HEAD:
864      if (memcmp(p, RAR_SIGNATURE, 7) != 0) {
865        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
866          "Invalid marker header");
867        return (ARCHIVE_FATAL);
868      }
869      __archive_read_consume(a, 7);
870      break;
871
872    case MAIN_HEAD:
873      rar->main_flags = archive_le16dec(p + 3);
874      skip = archive_le16dec(p + 5);
875      if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)) {
876        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
877          "Invalid header size");
878        return (ARCHIVE_FATAL);
879      }
880      if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
881        return (ARCHIVE_FATAL);
882      p = h;
883      memcpy(rar->reserved1, p + 7, sizeof(rar->reserved1));
884      memcpy(rar->reserved2, p + 7 + sizeof(rar->reserved1),
885             sizeof(rar->reserved2));
886      if (rar->main_flags & MHD_ENCRYPTVER) {
887        if (skip < 7 + sizeof(rar->reserved1) + sizeof(rar->reserved2)+1) {
888          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
889            "Invalid header size");
890          return (ARCHIVE_FATAL);
891        }
892        rar->encryptver = *(p + 7 + sizeof(rar->reserved1) +
893                            sizeof(rar->reserved2));
894      }
895
896      /* Main header is password encrypted, so we cannot read any
897         file names or any other info about files from the header. */
898      if (rar->main_flags & MHD_PASSWORD)
899      {
900        archive_entry_set_is_metadata_encrypted(entry, 1);
901        archive_entry_set_is_data_encrypted(entry, 1);
902        rar->has_encrypted_entries = 1;
903         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
904                          "RAR encryption support unavailable.");
905        return (ARCHIVE_FATAL);
906      }
907
908      crc32_val = crc32(0, (const unsigned char *)p + 2, (unsigned)skip - 2);
909      if ((crc32_val & 0xffff) != archive_le16dec(p)) {
910        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
911          "Header CRC error");
912        return (ARCHIVE_FATAL);
913      }
914      __archive_read_consume(a, skip);
915      break;
916
917    case FILE_HEAD:
918      return read_header(a, entry, head_type);
919
920    case COMM_HEAD:
921    case AV_HEAD:
922    case SUB_HEAD:
923    case PROTECT_HEAD:
924    case SIGN_HEAD:
925    case ENDARC_HEAD:
926      flags = archive_le16dec(p + 3);
927      skip = archive_le16dec(p + 5);
928      if (skip < 7) {
929        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
930          "Invalid header size too small");
931        return (ARCHIVE_FATAL);
932      }
933      if (flags & HD_ADD_SIZE_PRESENT)
934      {
935        if (skip < 7 + 4) {
936          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
937            "Invalid header size too small");
938          return (ARCHIVE_FATAL);
939        }
940        if ((h = __archive_read_ahead(a, skip, NULL)) == NULL)
941          return (ARCHIVE_FATAL);
942        p = h;
943        skip += archive_le32dec(p + 7);
944      }
945
946      /* Skip over the 2-byte CRC at the beginning of the header. */
947      crc32_expected = archive_le16dec(p);
948      __archive_read_consume(a, 2);
949      skip -= 2;
950
951      /* Skim the entire header and compute the CRC. */
952      crc32_val = 0;
953      while (skip > 0) {
954	      size_t to_read = skip;
955	      ssize_t did_read;
956	      if (to_read > 32 * 1024) {
957		      to_read = 32 * 1024;
958	      }
959	      if ((h = __archive_read_ahead(a, to_read, &did_read)) == NULL) {
960		      return (ARCHIVE_FATAL);
961	      }
962	      p = h;
963	      crc32_val = crc32(crc32_val, (const unsigned char *)p, (unsigned)did_read);
964	      __archive_read_consume(a, did_read);
965	      skip -= did_read;
966      }
967      if ((crc32_val & 0xffff) != crc32_expected) {
968	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
969		  "Header CRC error");
970	      return (ARCHIVE_FATAL);
971      }
972      if (head_type == ENDARC_HEAD)
973	      return (ARCHIVE_EOF);
974      break;
975
976    case NEWSUB_HEAD:
977      if ((ret = read_header(a, entry, head_type)) < ARCHIVE_WARN)
978        return ret;
979      break;
980
981    default:
982      archive_set_error(&a->archive,  ARCHIVE_ERRNO_FILE_FORMAT,
983                        "Bad RAR file");
984      return (ARCHIVE_FATAL);
985    }
986  }
987}
988
989static int
990archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
991                                  size_t *size, int64_t *offset)
992{
993  struct rar *rar = (struct rar *)(a->format->data);
994  int ret;
995
996  if (rar->has_encrypted_entries == ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW) {
997	  rar->has_encrypted_entries = 0;
998  }
999
1000  if (rar->bytes_unconsumed > 0) {
1001      /* Consume as much as the decompressor actually used. */
1002      __archive_read_consume(a, rar->bytes_unconsumed);
1003      rar->bytes_unconsumed = 0;
1004  }
1005
1006  *buff = NULL;
1007  if (rar->entry_eof || rar->offset_seek >= rar->unp_size) {
1008    *size = 0;
1009    *offset = rar->offset;
1010    if (*offset < rar->unp_size)
1011      *offset = rar->unp_size;
1012    return (ARCHIVE_EOF);
1013  }
1014
1015  switch (rar->compression_method)
1016  {
1017  case COMPRESS_METHOD_STORE:
1018    ret = read_data_stored(a, buff, size, offset);
1019    break;
1020
1021  case COMPRESS_METHOD_FASTEST:
1022  case COMPRESS_METHOD_FAST:
1023  case COMPRESS_METHOD_NORMAL:
1024  case COMPRESS_METHOD_GOOD:
1025  case COMPRESS_METHOD_BEST:
1026    ret = read_data_compressed(a, buff, size, offset);
1027    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
1028      __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1029    break;
1030
1031  default:
1032    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1033                      "Unsupported compression method for RAR file.");
1034    ret = ARCHIVE_FATAL;
1035    break;
1036  }
1037  return (ret);
1038}
1039
1040static int
1041archive_read_format_rar_read_data_skip(struct archive_read *a)
1042{
1043  struct rar *rar;
1044  int64_t bytes_skipped;
1045  int ret;
1046
1047  rar = (struct rar *)(a->format->data);
1048
1049  if (rar->bytes_unconsumed > 0) {
1050      /* Consume as much as the decompressor actually used. */
1051      __archive_read_consume(a, rar->bytes_unconsumed);
1052      rar->bytes_unconsumed = 0;
1053  }
1054
1055  if (rar->bytes_remaining > 0) {
1056    bytes_skipped = __archive_read_consume(a, rar->bytes_remaining);
1057    if (bytes_skipped < 0)
1058      return (ARCHIVE_FATAL);
1059  }
1060
1061  /* Compressed data to skip must be read from each header in a multivolume
1062   * archive.
1063   */
1064  if (rar->main_flags & MHD_VOLUME && rar->file_flags & FHD_SPLIT_AFTER)
1065  {
1066    ret = archive_read_format_rar_read_header(a, a->entry);
1067    if (ret == (ARCHIVE_EOF))
1068      ret = archive_read_format_rar_read_header(a, a->entry);
1069    if (ret != (ARCHIVE_OK))
1070      return ret;
1071    return archive_read_format_rar_read_data_skip(a);
1072  }
1073
1074  return (ARCHIVE_OK);
1075}
1076
1077static int64_t
1078archive_read_format_rar_seek_data(struct archive_read *a, int64_t offset,
1079    int whence)
1080{
1081  int64_t client_offset, ret;
1082  unsigned int i;
1083  struct rar *rar = (struct rar *)(a->format->data);
1084
1085  if (rar->compression_method == COMPRESS_METHOD_STORE)
1086  {
1087    /* Modify the offset for use with SEEK_SET */
1088    switch (whence)
1089    {
1090      case SEEK_CUR:
1091        client_offset = rar->offset_seek;
1092        break;
1093      case SEEK_END:
1094        client_offset = rar->unp_size;
1095        break;
1096      case SEEK_SET:
1097      default:
1098        client_offset = 0;
1099    }
1100    client_offset += offset;
1101    if (client_offset < 0)
1102    {
1103      /* Can't seek past beginning of data block */
1104      return -1;
1105    }
1106    else if (client_offset > rar->unp_size)
1107    {
1108      /*
1109       * Set the returned offset but only seek to the end of
1110       * the data block.
1111       */
1112      rar->offset_seek = client_offset;
1113      client_offset = rar->unp_size;
1114    }
1115
1116    client_offset += rar->dbo[0].start_offset;
1117    i = 0;
1118    while (i < rar->cursor)
1119    {
1120      i++;
1121      client_offset += rar->dbo[i].start_offset - rar->dbo[i-1].end_offset;
1122    }
1123    if (rar->main_flags & MHD_VOLUME)
1124    {
1125      /* Find the appropriate offset among the multivolume archive */
1126      while (1)
1127      {
1128        if (client_offset < rar->dbo[rar->cursor].start_offset &&
1129          rar->file_flags & FHD_SPLIT_BEFORE)
1130        {
1131          /* Search backwards for the correct data block */
1132          if (rar->cursor == 0)
1133          {
1134            archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1135              "Attempt to seek past beginning of RAR data block");
1136            return (ARCHIVE_FAILED);
1137          }
1138          rar->cursor--;
1139          client_offset -= rar->dbo[rar->cursor+1].start_offset -
1140            rar->dbo[rar->cursor].end_offset;
1141          if (client_offset < rar->dbo[rar->cursor].start_offset)
1142            continue;
1143          ret = __archive_read_seek(a, rar->dbo[rar->cursor].start_offset -
1144            rar->dbo[rar->cursor].header_size, SEEK_SET);
1145          if (ret < (ARCHIVE_OK))
1146            return ret;
1147          ret = archive_read_format_rar_read_header(a, a->entry);
1148          if (ret != (ARCHIVE_OK))
1149          {
1150            archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1151              "Error during seek of RAR file");
1152            return (ARCHIVE_FAILED);
1153          }
1154          rar->cursor--;
1155          break;
1156        }
1157        else if (client_offset > rar->dbo[rar->cursor].end_offset &&
1158          rar->file_flags & FHD_SPLIT_AFTER)
1159        {
1160          /* Search forward for the correct data block */
1161          rar->cursor++;
1162          if (rar->cursor < rar->nodes &&
1163            client_offset > rar->dbo[rar->cursor].end_offset)
1164          {
1165            client_offset += rar->dbo[rar->cursor].start_offset -
1166              rar->dbo[rar->cursor-1].end_offset;
1167            continue;
1168          }
1169          rar->cursor--;
1170          ret = __archive_read_seek(a, rar->dbo[rar->cursor].end_offset,
1171                                    SEEK_SET);
1172          if (ret < (ARCHIVE_OK))
1173            return ret;
1174          ret = archive_read_format_rar_read_header(a, a->entry);
1175          if (ret == (ARCHIVE_EOF))
1176          {
1177            rar->has_endarc_header = 1;
1178            ret = archive_read_format_rar_read_header(a, a->entry);
1179          }
1180          if (ret != (ARCHIVE_OK))
1181          {
1182            archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1183              "Error during seek of RAR file");
1184            return (ARCHIVE_FAILED);
1185          }
1186          client_offset += rar->dbo[rar->cursor].start_offset -
1187            rar->dbo[rar->cursor-1].end_offset;
1188          continue;
1189        }
1190        break;
1191      }
1192    }
1193
1194    ret = __archive_read_seek(a, client_offset, SEEK_SET);
1195    if (ret < (ARCHIVE_OK))
1196      return ret;
1197    rar->bytes_remaining = rar->dbo[rar->cursor].end_offset - ret;
1198    i = rar->cursor;
1199    while (i > 0)
1200    {
1201      i--;
1202      ret -= rar->dbo[i+1].start_offset - rar->dbo[i].end_offset;
1203    }
1204    ret -= rar->dbo[0].start_offset;
1205
1206    /* Always restart reading the file after a seek */
1207    __archive_reset_read_data(&a->archive);
1208
1209    rar->bytes_unconsumed = 0;
1210    rar->offset = 0;
1211
1212    /*
1213     * If a seek past the end of file was requested, return the requested
1214     * offset.
1215     */
1216    if (ret == rar->unp_size && rar->offset_seek > rar->unp_size)
1217      return rar->offset_seek;
1218
1219    /* Return the new offset */
1220    rar->offset_seek = ret;
1221    return rar->offset_seek;
1222  }
1223  else
1224  {
1225    archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1226      "Seeking of compressed RAR files is unsupported");
1227  }
1228  return (ARCHIVE_FAILED);
1229}
1230
1231static int
1232archive_read_format_rar_cleanup(struct archive_read *a)
1233{
1234  struct rar *rar;
1235
1236  rar = (struct rar *)(a->format->data);
1237  free_codes(a);
1238  free(rar->filename);
1239  free(rar->filename_save);
1240  free(rar->dbo);
1241  free(rar->unp_buffer);
1242  free(rar->lzss.window);
1243  __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1244  free(rar);
1245  (a->format->data) = NULL;
1246  return (ARCHIVE_OK);
1247}
1248
1249static int
1250read_header(struct archive_read *a, struct archive_entry *entry,
1251            char head_type)
1252{
1253  const void *h;
1254  const char *p, *endp;
1255  struct rar *rar;
1256  struct rar_header rar_header;
1257  struct rar_file_header file_header;
1258  int64_t header_size;
1259  unsigned filename_size, end;
1260  char *filename;
1261  char *strp;
1262  char packed_size[8];
1263  char unp_size[8];
1264  int ttime;
1265  struct archive_string_conv *sconv, *fn_sconv;
1266  unsigned long crc32_val;
1267  int ret = (ARCHIVE_OK), ret2;
1268
1269  rar = (struct rar *)(a->format->data);
1270
1271  /* Setup a string conversion object for non-rar-unicode filenames. */
1272  sconv = rar->opt_sconv;
1273  if (sconv == NULL) {
1274    if (!rar->init_default_conversion) {
1275      rar->sconv_default =
1276          archive_string_default_conversion_for_read(
1277            &(a->archive));
1278      rar->init_default_conversion = 1;
1279    }
1280    sconv = rar->sconv_default;
1281  }
1282
1283
1284  if ((h = __archive_read_ahead(a, 7, NULL)) == NULL)
1285    return (ARCHIVE_FATAL);
1286  p = h;
1287  memcpy(&rar_header, p, sizeof(rar_header));
1288  rar->file_flags = archive_le16dec(rar_header.flags);
1289  header_size = archive_le16dec(rar_header.size);
1290  if (header_size < (int64_t)sizeof(file_header) + 7) {
1291    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1292      "Invalid header size");
1293    return (ARCHIVE_FATAL);
1294  }
1295  crc32_val = crc32(0, (const unsigned char *)p + 2, 7 - 2);
1296  __archive_read_consume(a, 7);
1297
1298  if (!(rar->file_flags & FHD_SOLID))
1299  {
1300    rar->compression_method = 0;
1301    rar->packed_size = 0;
1302    rar->unp_size = 0;
1303    rar->mtime = 0;
1304    rar->ctime = 0;
1305    rar->atime = 0;
1306    rar->arctime = 0;
1307    rar->mode = 0;
1308    memset(&rar->salt, 0, sizeof(rar->salt));
1309    rar->atime = 0;
1310    rar->ansec = 0;
1311    rar->ctime = 0;
1312    rar->cnsec = 0;
1313    rar->mtime = 0;
1314    rar->mnsec = 0;
1315    rar->arctime = 0;
1316    rar->arcnsec = 0;
1317  }
1318  else
1319  {
1320    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1321                      "RAR solid archive support unavailable.");
1322    return (ARCHIVE_FATAL);
1323  }
1324
1325  if ((h = __archive_read_ahead(a, (size_t)header_size - 7, NULL)) == NULL)
1326    return (ARCHIVE_FATAL);
1327
1328  /* File Header CRC check. */
1329  crc32_val = crc32(crc32_val, h, (unsigned)(header_size - 7));
1330  if ((crc32_val & 0xffff) != archive_le16dec(rar_header.crc)) {
1331    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1332      "Header CRC error");
1333    return (ARCHIVE_FATAL);
1334  }
1335  /* If no CRC error, Go on parsing File Header. */
1336  p = h;
1337  endp = p + header_size - 7;
1338  memcpy(&file_header, p, sizeof(file_header));
1339  p += sizeof(file_header);
1340
1341  rar->compression_method = file_header.method;
1342
1343  ttime = archive_le32dec(file_header.file_time);
1344  rar->mtime = get_time(ttime);
1345
1346  rar->file_crc = archive_le32dec(file_header.file_crc);
1347
1348  if (rar->file_flags & FHD_PASSWORD)
1349  {
1350	archive_entry_set_is_data_encrypted(entry, 1);
1351	rar->has_encrypted_entries = 1;
1352    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1353                      "RAR encryption support unavailable.");
1354    /* Since it is only the data part itself that is encrypted we can at least
1355       extract information about the currently processed entry and don't need
1356       to return ARCHIVE_FATAL here. */
1357    /*return (ARCHIVE_FATAL);*/
1358  }
1359
1360  if (rar->file_flags & FHD_LARGE)
1361  {
1362    memcpy(packed_size, file_header.pack_size, 4);
1363    memcpy(packed_size + 4, p, 4); /* High pack size */
1364    p += 4;
1365    memcpy(unp_size, file_header.unp_size, 4);
1366    memcpy(unp_size + 4, p, 4); /* High unpack size */
1367    p += 4;
1368    rar->packed_size = archive_le64dec(&packed_size);
1369    rar->unp_size = archive_le64dec(&unp_size);
1370  }
1371  else
1372  {
1373    rar->packed_size = archive_le32dec(file_header.pack_size);
1374    rar->unp_size = archive_le32dec(file_header.unp_size);
1375  }
1376
1377  if (rar->packed_size < 0 || rar->unp_size < 0)
1378  {
1379    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1380                      "Invalid sizes specified.");
1381    return (ARCHIVE_FATAL);
1382  }
1383
1384  rar->bytes_remaining = rar->packed_size;
1385
1386  /* TODO: RARv3 subblocks contain comments. For now the complete block is
1387   * consumed at the end.
1388   */
1389  if (head_type == NEWSUB_HEAD) {
1390    size_t distance = p - (const char *)h;
1391    header_size += rar->packed_size;
1392    /* Make sure we have the extended data. */
1393    if ((h = __archive_read_ahead(a, (size_t)header_size - 7, NULL)) == NULL)
1394        return (ARCHIVE_FATAL);
1395    p = h;
1396    endp = p + header_size - 7;
1397    p += distance;
1398  }
1399
1400  filename_size = archive_le16dec(file_header.name_size);
1401  if (p + filename_size > endp) {
1402    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1403      "Invalid filename size");
1404    return (ARCHIVE_FATAL);
1405  }
1406  if (rar->filename_allocated < filename_size * 2 + 2) {
1407    char *newptr;
1408    size_t newsize = filename_size * 2 + 2;
1409    newptr = realloc(rar->filename, newsize);
1410    if (newptr == NULL) {
1411      archive_set_error(&a->archive, ENOMEM,
1412                        "Couldn't allocate memory.");
1413      return (ARCHIVE_FATAL);
1414    }
1415    rar->filename = newptr;
1416    rar->filename_allocated = newsize;
1417  }
1418  filename = rar->filename;
1419  memcpy(filename, p, filename_size);
1420  filename[filename_size] = '\0';
1421  if (rar->file_flags & FHD_UNICODE)
1422  {
1423    if (filename_size != strlen(filename))
1424    {
1425      unsigned char highbyte, flagbits, flagbyte;
1426      unsigned fn_end, offset;
1427
1428      end = filename_size;
1429      fn_end = filename_size * 2;
1430      filename_size = 0;
1431      offset = (unsigned)strlen(filename) + 1;
1432      highbyte = *(p + offset++);
1433      flagbits = 0;
1434      flagbyte = 0;
1435      while (offset < end && filename_size < fn_end)
1436      {
1437        if (!flagbits)
1438        {
1439          flagbyte = *(p + offset++);
1440          flagbits = 8;
1441        }
1442
1443        flagbits -= 2;
1444        switch((flagbyte >> flagbits) & 3)
1445        {
1446          case 0:
1447            filename[filename_size++] = '\0';
1448            filename[filename_size++] = *(p + offset++);
1449            break;
1450          case 1:
1451            filename[filename_size++] = highbyte;
1452            filename[filename_size++] = *(p + offset++);
1453            break;
1454          case 2:
1455            filename[filename_size++] = *(p + offset + 1);
1456            filename[filename_size++] = *(p + offset);
1457            offset += 2;
1458            break;
1459          case 3:
1460          {
1461            char extra, high;
1462            uint8_t length = *(p + offset++);
1463
1464            if (length & 0x80) {
1465              extra = *(p + offset++);
1466              high = (char)highbyte;
1467            } else
1468              extra = high = 0;
1469            length = (length & 0x7f) + 2;
1470            while (length && filename_size < fn_end) {
1471              unsigned cp = filename_size >> 1;
1472              filename[filename_size++] = high;
1473              filename[filename_size++] = p[cp] + extra;
1474              length--;
1475            }
1476          }
1477          break;
1478        }
1479      }
1480      if (filename_size > fn_end) {
1481        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1482          "Invalid filename");
1483        return (ARCHIVE_FATAL);
1484      }
1485      filename[filename_size++] = '\0';
1486      /*
1487       * Do not increment filename_size here as the computations below
1488       * add the space for the terminating NUL explicitly.
1489       */
1490      filename[filename_size] = '\0';
1491
1492      /* Decoded unicode form is UTF-16BE, so we have to update a string
1493       * conversion object for it. */
1494      if (rar->sconv_utf16be == NULL) {
1495        rar->sconv_utf16be = archive_string_conversion_from_charset(
1496           &a->archive, "UTF-16BE", 1);
1497        if (rar->sconv_utf16be == NULL)
1498          return (ARCHIVE_FATAL);
1499      }
1500      fn_sconv = rar->sconv_utf16be;
1501
1502      strp = filename;
1503      while (memcmp(strp, "\x00\x00", 2))
1504      {
1505        if (!memcmp(strp, "\x00\\", 2))
1506          *(strp + 1) = '/';
1507        strp += 2;
1508      }
1509      p += offset;
1510    } else {
1511      /*
1512       * If FHD_UNICODE is set but no unicode data, this file name form
1513       * is UTF-8, so we have to update a string conversion object for
1514       * it accordingly.
1515       */
1516      if (rar->sconv_utf8 == NULL) {
1517        rar->sconv_utf8 = archive_string_conversion_from_charset(
1518           &a->archive, "UTF-8", 1);
1519        if (rar->sconv_utf8 == NULL)
1520          return (ARCHIVE_FATAL);
1521      }
1522      fn_sconv = rar->sconv_utf8;
1523      while ((strp = strchr(filename, '\\')) != NULL)
1524        *strp = '/';
1525      p += filename_size;
1526    }
1527  }
1528  else
1529  {
1530    fn_sconv = sconv;
1531    while ((strp = strchr(filename, '\\')) != NULL)
1532      *strp = '/';
1533    p += filename_size;
1534  }
1535
1536  /* Split file in multivolume RAR. No more need to process header. */
1537  if (rar->filename_save &&
1538    filename_size == rar->filename_save_size &&
1539    !memcmp(rar->filename, rar->filename_save, filename_size + 1))
1540  {
1541    __archive_read_consume(a, header_size - 7);
1542    rar->cursor++;
1543    if (rar->cursor >= rar->nodes)
1544    {
1545      rar->nodes++;
1546      if ((rar->dbo =
1547        realloc(rar->dbo, sizeof(*rar->dbo) * rar->nodes)) == NULL)
1548      {
1549        archive_set_error(&a->archive, ENOMEM, "Couldn't allocate memory.");
1550        return (ARCHIVE_FATAL);
1551      }
1552      rar->dbo[rar->cursor].header_size = header_size;
1553      rar->dbo[rar->cursor].start_offset = -1;
1554      rar->dbo[rar->cursor].end_offset = -1;
1555    }
1556    if (rar->dbo[rar->cursor].start_offset < 0)
1557    {
1558      rar->dbo[rar->cursor].start_offset = a->filter->position;
1559      rar->dbo[rar->cursor].end_offset = rar->dbo[rar->cursor].start_offset +
1560        rar->packed_size;
1561    }
1562    return ret;
1563  }
1564  else if (rar->filename_must_match)
1565  {
1566    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1567      "Mismatch of file parts split across multi-volume archive");
1568    return (ARCHIVE_FATAL);
1569  }
1570
1571  rar->filename_save = (char*)realloc(rar->filename_save,
1572                                      filename_size + 1);
1573  memcpy(rar->filename_save, rar->filename, filename_size + 1);
1574  rar->filename_save_size = filename_size;
1575
1576  /* Set info for seeking */
1577  free(rar->dbo);
1578  if ((rar->dbo = calloc(1, sizeof(*rar->dbo))) == NULL)
1579  {
1580    archive_set_error(&a->archive, ENOMEM, "Couldn't allocate memory.");
1581    return (ARCHIVE_FATAL);
1582  }
1583  rar->dbo[0].header_size = header_size;
1584  rar->dbo[0].start_offset = -1;
1585  rar->dbo[0].end_offset = -1;
1586  rar->cursor = 0;
1587  rar->nodes = 1;
1588
1589  if (rar->file_flags & FHD_SALT)
1590  {
1591    if (p + 8 > endp) {
1592      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1593        "Invalid header size");
1594      return (ARCHIVE_FATAL);
1595    }
1596    memcpy(rar->salt, p, 8);
1597    p += 8;
1598  }
1599
1600  if (rar->file_flags & FHD_EXTTIME) {
1601    if (read_exttime(p, rar, endp) < 0) {
1602      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1603        "Invalid header size");
1604      return (ARCHIVE_FATAL);
1605    }
1606  }
1607
1608  __archive_read_consume(a, header_size - 7);
1609  rar->dbo[0].start_offset = a->filter->position;
1610  rar->dbo[0].end_offset = rar->dbo[0].start_offset + rar->packed_size;
1611
1612  switch(file_header.host_os)
1613  {
1614  case OS_MSDOS:
1615  case OS_OS2:
1616  case OS_WIN32:
1617    rar->mode = archive_le32dec(file_header.file_attr);
1618    if (rar->mode & FILE_ATTRIBUTE_DIRECTORY)
1619      rar->mode = AE_IFDIR | S_IXUSR | S_IXGRP | S_IXOTH;
1620    else
1621      rar->mode = AE_IFREG;
1622    rar->mode |= S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
1623    break;
1624
1625  case OS_UNIX:
1626  case OS_MAC_OS:
1627  case OS_BEOS:
1628    rar->mode = archive_le32dec(file_header.file_attr);
1629    break;
1630
1631  default:
1632    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1633                      "Unknown file attributes from RAR file's host OS");
1634    return (ARCHIVE_FATAL);
1635  }
1636
1637  rar->bytes_uncopied = rar->bytes_unconsumed = 0;
1638  rar->lzss.position = rar->offset = 0;
1639  rar->offset_seek = 0;
1640  rar->dictionary_size = 0;
1641  rar->offset_outgoing = 0;
1642  rar->br.cache_avail = 0;
1643  rar->br.avail_in = 0;
1644  rar->crc_calculated = 0;
1645  rar->entry_eof = 0;
1646  rar->valid = 1;
1647  rar->is_ppmd_block = 0;
1648  rar->start_new_table = 1;
1649  free(rar->unp_buffer);
1650  rar->unp_buffer = NULL;
1651  rar->unp_offset = 0;
1652  rar->unp_buffer_size = UNP_BUFFER_SIZE;
1653  memset(rar->lengthtable, 0, sizeof(rar->lengthtable));
1654  __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
1655  rar->ppmd_valid = rar->ppmd_eod = 0;
1656
1657  /* Don't set any archive entries for non-file header types */
1658  if (head_type == NEWSUB_HEAD)
1659    return ret;
1660
1661  archive_entry_set_mtime(entry, rar->mtime, rar->mnsec);
1662  archive_entry_set_ctime(entry, rar->ctime, rar->cnsec);
1663  archive_entry_set_atime(entry, rar->atime, rar->ansec);
1664  archive_entry_set_size(entry, rar->unp_size);
1665  archive_entry_set_mode(entry, rar->mode);
1666
1667  if (archive_entry_copy_pathname_l(entry, filename, filename_size, fn_sconv))
1668  {
1669    if (errno == ENOMEM)
1670    {
1671      archive_set_error(&a->archive, ENOMEM,
1672                        "Can't allocate memory for Pathname");
1673      return (ARCHIVE_FATAL);
1674    }
1675    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1676                      "Pathname cannot be converted from %s to current locale.",
1677                      archive_string_conversion_charset_name(fn_sconv));
1678    ret = (ARCHIVE_WARN);
1679  }
1680
1681  if (((rar->mode) & AE_IFMT) == AE_IFLNK)
1682  {
1683    /* Make sure a symbolic-link file does not have its body. */
1684    rar->bytes_remaining = 0;
1685    archive_entry_set_size(entry, 0);
1686
1687    /* Read a symbolic-link name. */
1688    if ((ret2 = read_symlink_stored(a, entry, sconv)) < (ARCHIVE_WARN))
1689      return ret2;
1690    if (ret > ret2)
1691      ret = ret2;
1692  }
1693
1694  if (rar->bytes_remaining == 0)
1695    rar->entry_eof = 1;
1696
1697  return ret;
1698}
1699
1700static time_t
1701get_time(int ttime)
1702{
1703  struct tm tm;
1704  tm.tm_sec = 2 * (ttime & 0x1f);
1705  tm.tm_min = (ttime >> 5) & 0x3f;
1706  tm.tm_hour = (ttime >> 11) & 0x1f;
1707  tm.tm_mday = (ttime >> 16) & 0x1f;
1708  tm.tm_mon = ((ttime >> 21) & 0x0f) - 1;
1709  tm.tm_year = ((ttime >> 25) & 0x7f) + 80;
1710  tm.tm_isdst = -1;
1711  return mktime(&tm);
1712}
1713
1714static int
1715read_exttime(const char *p, struct rar *rar, const char *endp)
1716{
1717  unsigned rmode, flags, rem, j, count;
1718  int ttime, i;
1719  struct tm *tm;
1720  time_t t;
1721  long nsec;
1722
1723  if (p + 2 > endp)
1724    return (-1);
1725  flags = archive_le16dec(p);
1726  p += 2;
1727
1728  for (i = 3; i >= 0; i--)
1729  {
1730    t = 0;
1731    if (i == 3)
1732      t = rar->mtime;
1733    rmode = flags >> i * 4;
1734    if (rmode & 8)
1735    {
1736      if (!t)
1737      {
1738        if (p + 4 > endp)
1739          return (-1);
1740        ttime = archive_le32dec(p);
1741        t = get_time(ttime);
1742        p += 4;
1743      }
1744      rem = 0;
1745      count = rmode & 3;
1746      if (p + count > endp)
1747        return (-1);
1748      for (j = 0; j < count; j++)
1749      {
1750        rem = (((unsigned)(unsigned char)*p) << 16) | (rem >> 8);
1751        p++;
1752      }
1753      tm = localtime(&t);
1754      nsec = tm->tm_sec + rem / NS_UNIT;
1755      if (rmode & 4)
1756      {
1757        tm->tm_sec++;
1758        t = mktime(tm);
1759      }
1760      if (i == 3)
1761      {
1762        rar->mtime = t;
1763        rar->mnsec = nsec;
1764      }
1765      else if (i == 2)
1766      {
1767        rar->ctime = t;
1768        rar->cnsec = nsec;
1769      }
1770      else if (i == 1)
1771      {
1772        rar->atime = t;
1773        rar->ansec = nsec;
1774      }
1775      else
1776      {
1777        rar->arctime = t;
1778        rar->arcnsec = nsec;
1779      }
1780    }
1781  }
1782  return (0);
1783}
1784
1785static int
1786read_symlink_stored(struct archive_read *a, struct archive_entry *entry,
1787                    struct archive_string_conv *sconv)
1788{
1789  const void *h;
1790  const char *p;
1791  struct rar *rar;
1792  int ret = (ARCHIVE_OK);
1793
1794  rar = (struct rar *)(a->format->data);
1795  if ((h = rar_read_ahead(a, (size_t)rar->packed_size, NULL)) == NULL)
1796    return (ARCHIVE_FATAL);
1797  p = h;
1798
1799  if (archive_entry_copy_symlink_l(entry,
1800      p, (size_t)rar->packed_size, sconv))
1801  {
1802    if (errno == ENOMEM)
1803    {
1804      archive_set_error(&a->archive, ENOMEM,
1805                        "Can't allocate memory for link");
1806      return (ARCHIVE_FATAL);
1807    }
1808    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1809                      "link cannot be converted from %s to current locale.",
1810                      archive_string_conversion_charset_name(sconv));
1811    ret = (ARCHIVE_WARN);
1812  }
1813  __archive_read_consume(a, rar->packed_size);
1814  return ret;
1815}
1816
1817static int
1818read_data_stored(struct archive_read *a, const void **buff, size_t *size,
1819                 int64_t *offset)
1820{
1821  struct rar *rar;
1822  ssize_t bytes_avail;
1823
1824  rar = (struct rar *)(a->format->data);
1825  if (rar->bytes_remaining == 0 &&
1826    !(rar->main_flags & MHD_VOLUME && rar->file_flags & FHD_SPLIT_AFTER))
1827  {
1828    *buff = NULL;
1829    *size = 0;
1830    *offset = rar->offset;
1831    if (rar->file_crc != rar->crc_calculated) {
1832      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1833                        "File CRC error");
1834      return (ARCHIVE_FATAL);
1835    }
1836    rar->entry_eof = 1;
1837    return (ARCHIVE_EOF);
1838  }
1839
1840  *buff = rar_read_ahead(a, 1, &bytes_avail);
1841  if (bytes_avail <= 0)
1842  {
1843    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1844                      "Truncated RAR file data");
1845    return (ARCHIVE_FATAL);
1846  }
1847
1848  *size = bytes_avail;
1849  *offset = rar->offset;
1850  rar->offset += bytes_avail;
1851  rar->offset_seek += bytes_avail;
1852  rar->bytes_remaining -= bytes_avail;
1853  rar->bytes_unconsumed = bytes_avail;
1854  /* Calculate File CRC. */
1855  rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1856    (unsigned)bytes_avail);
1857  return (ARCHIVE_OK);
1858}
1859
1860static int
1861read_data_compressed(struct archive_read *a, const void **buff, size_t *size,
1862               int64_t *offset)
1863{
1864  struct rar *rar;
1865  int64_t start, end, actualend;
1866  size_t bs;
1867  int ret = (ARCHIVE_OK), sym, code, lzss_offset, length, i;
1868
1869  rar = (struct rar *)(a->format->data);
1870
1871  do {
1872    if (!rar->valid)
1873      return (ARCHIVE_FATAL);
1874    if (rar->ppmd_eod ||
1875       (rar->dictionary_size && rar->offset >= rar->unp_size))
1876    {
1877      if (rar->unp_offset > 0) {
1878        /*
1879         * We have unprocessed extracted data. write it out.
1880         */
1881        *buff = rar->unp_buffer;
1882        *size = rar->unp_offset;
1883        *offset = rar->offset_outgoing;
1884        rar->offset_outgoing += *size;
1885        /* Calculate File CRC. */
1886        rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1887          (unsigned)*size);
1888        rar->unp_offset = 0;
1889        return (ARCHIVE_OK);
1890      }
1891      *buff = NULL;
1892      *size = 0;
1893      *offset = rar->offset;
1894      if (rar->file_crc != rar->crc_calculated) {
1895        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1896                          "File CRC error");
1897        return (ARCHIVE_FATAL);
1898      }
1899      rar->entry_eof = 1;
1900      return (ARCHIVE_EOF);
1901    }
1902
1903    if (!rar->is_ppmd_block && rar->dictionary_size && rar->bytes_uncopied > 0)
1904    {
1905      if (rar->bytes_uncopied > (rar->unp_buffer_size - rar->unp_offset))
1906        bs = rar->unp_buffer_size - rar->unp_offset;
1907      else
1908        bs = (size_t)rar->bytes_uncopied;
1909      ret = copy_from_lzss_window(a, buff, rar->offset, (int)bs);
1910      if (ret != ARCHIVE_OK)
1911        return (ret);
1912      rar->offset += bs;
1913      rar->bytes_uncopied -= bs;
1914      if (*buff != NULL) {
1915        rar->unp_offset = 0;
1916        *size = rar->unp_buffer_size;
1917        *offset = rar->offset_outgoing;
1918        rar->offset_outgoing += *size;
1919        /* Calculate File CRC. */
1920        rar->crc_calculated = crc32(rar->crc_calculated, *buff,
1921          (unsigned)*size);
1922        return (ret);
1923      }
1924      continue;
1925    }
1926
1927    if (!rar->br.next_in &&
1928      (ret = rar_br_preparation(a, &(rar->br))) < ARCHIVE_WARN)
1929      return (ret);
1930    if (rar->start_new_table && ((ret = parse_codes(a)) < (ARCHIVE_WARN)))
1931      return (ret);
1932
1933    if (rar->is_ppmd_block)
1934    {
1935      if ((sym = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1936        &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1937      {
1938        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1939                          "Invalid symbol");
1940        return (ARCHIVE_FATAL);
1941      }
1942      if(sym != rar->ppmd_escape)
1943      {
1944        lzss_emit_literal(rar, sym);
1945        rar->bytes_uncopied++;
1946      }
1947      else
1948      {
1949        if ((code = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1950          &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1951        {
1952          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1953                            "Invalid symbol");
1954          return (ARCHIVE_FATAL);
1955        }
1956
1957        switch(code)
1958        {
1959          case 0:
1960            rar->start_new_table = 1;
1961            return read_data_compressed(a, buff, size, offset);
1962
1963          case 2:
1964            rar->ppmd_eod = 1;/* End Of ppmd Data. */
1965            continue;
1966
1967          case 3:
1968            archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1969                              "Parsing filters is unsupported.");
1970            return (ARCHIVE_FAILED);
1971
1972          case 4:
1973            lzss_offset = 0;
1974            for (i = 2; i >= 0; i--)
1975            {
1976              if ((code = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1977                &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1978              {
1979                archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1980                                  "Invalid symbol");
1981                return (ARCHIVE_FATAL);
1982              }
1983              lzss_offset |= code << (i * 8);
1984            }
1985            if ((length = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1986              &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1987            {
1988              archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1989                                "Invalid symbol");
1990              return (ARCHIVE_FATAL);
1991            }
1992            lzss_emit_match(rar, lzss_offset + 2, length + 32);
1993            rar->bytes_uncopied += length + 32;
1994            break;
1995
1996          case 5:
1997            if ((length = __archive_ppmd7_functions.Ppmd7_DecodeSymbol(
1998              &rar->ppmd7_context, &rar->range_dec.p)) < 0)
1999            {
2000              archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2001                                "Invalid symbol");
2002              return (ARCHIVE_FATAL);
2003            }
2004            lzss_emit_match(rar, 1, length + 4);
2005            rar->bytes_uncopied += length + 4;
2006            break;
2007
2008         default:
2009           lzss_emit_literal(rar, sym);
2010           rar->bytes_uncopied++;
2011        }
2012      }
2013    }
2014    else
2015    {
2016      start = rar->offset;
2017      end = start + rar->dictionary_size;
2018      rar->filterstart = INT64_MAX;
2019
2020      if ((actualend = expand(a, end)) < 0)
2021        return ((int)actualend);
2022
2023      rar->bytes_uncopied = actualend - start;
2024      if (rar->bytes_uncopied == 0) {
2025          /* Broken RAR files cause this case.
2026          * NOTE: If this case were possible on a normal RAR file
2027          * we would find out where it was actually bad and
2028          * what we would do to solve it. */
2029          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2030                            "Internal error extracting RAR file");
2031          return (ARCHIVE_FATAL);
2032      }
2033    }
2034    if (rar->bytes_uncopied > (rar->unp_buffer_size - rar->unp_offset))
2035      bs = rar->unp_buffer_size - rar->unp_offset;
2036    else
2037      bs = (size_t)rar->bytes_uncopied;
2038    ret = copy_from_lzss_window(a, buff, rar->offset, (int)bs);
2039    if (ret != ARCHIVE_OK)
2040      return (ret);
2041    rar->offset += bs;
2042    rar->bytes_uncopied -= bs;
2043    /*
2044     * If *buff is NULL, it means unp_buffer is not full.
2045     * So we have to continue extracting a RAR file.
2046     */
2047  } while (*buff == NULL);
2048
2049  rar->unp_offset = 0;
2050  *size = rar->unp_buffer_size;
2051  *offset = rar->offset_outgoing;
2052  rar->offset_outgoing += *size;
2053  /* Calculate File CRC. */
2054  rar->crc_calculated = crc32(rar->crc_calculated, *buff, (unsigned)*size);
2055  return ret;
2056}
2057
2058static int
2059parse_codes(struct archive_read *a)
2060{
2061  int i, j, val, n, r;
2062  unsigned char bitlengths[MAX_SYMBOLS], zerocount, ppmd_flags;
2063  unsigned int maxorder;
2064  struct huffman_code precode;
2065  struct rar *rar = (struct rar *)(a->format->data);
2066  struct rar_br *br = &(rar->br);
2067
2068  free_codes(a);
2069
2070  /* Skip to the next byte */
2071  rar_br_consume_unalined_bits(br);
2072
2073  /* PPMd block flag */
2074  if (!rar_br_read_ahead(a, br, 1))
2075    goto truncated_data;
2076  if ((rar->is_ppmd_block = rar_br_bits(br, 1)) != 0)
2077  {
2078    rar_br_consume(br, 1);
2079    if (!rar_br_read_ahead(a, br, 7))
2080      goto truncated_data;
2081    ppmd_flags = rar_br_bits(br, 7);
2082    rar_br_consume(br, 7);
2083
2084    /* Memory is allocated in MB */
2085    if (ppmd_flags & 0x20)
2086    {
2087      if (!rar_br_read_ahead(a, br, 8))
2088        goto truncated_data;
2089      rar->dictionary_size = (rar_br_bits(br, 8) + 1) << 20;
2090      rar_br_consume(br, 8);
2091    }
2092
2093    if (ppmd_flags & 0x40)
2094    {
2095      if (!rar_br_read_ahead(a, br, 8))
2096        goto truncated_data;
2097      rar->ppmd_escape = rar->ppmd7_context.InitEsc = rar_br_bits(br, 8);
2098      rar_br_consume(br, 8);
2099    }
2100    else
2101      rar->ppmd_escape = 2;
2102
2103    if (ppmd_flags & 0x20)
2104    {
2105      maxorder = (ppmd_flags & 0x1F) + 1;
2106      if(maxorder > 16)
2107        maxorder = 16 + (maxorder - 16) * 3;
2108
2109      if (maxorder == 1)
2110      {
2111        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2112                          "Truncated RAR file data");
2113        return (ARCHIVE_FATAL);
2114      }
2115
2116      /* Make sure ppmd7_contest is freed before Ppmd7_Construct
2117       * because reading a broken file cause this abnormal sequence. */
2118      __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
2119
2120      rar->bytein.a = a;
2121      rar->bytein.Read = &ppmd_read;
2122      __archive_ppmd7_functions.PpmdRAR_RangeDec_CreateVTable(&rar->range_dec);
2123      rar->range_dec.Stream = &rar->bytein;
2124      __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);
2125
2126      if (rar->dictionary_size == 0) {
2127	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2128                          "Invalid zero dictionary size");
2129	      return (ARCHIVE_FATAL);
2130      }
2131
2132      if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,
2133        rar->dictionary_size))
2134      {
2135        archive_set_error(&a->archive, ENOMEM,
2136                          "Out of memory");
2137        return (ARCHIVE_FATAL);
2138      }
2139      if (!__archive_ppmd7_functions.PpmdRAR_RangeDec_Init(&rar->range_dec))
2140      {
2141        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2142                          "Unable to initialize PPMd range decoder");
2143        return (ARCHIVE_FATAL);
2144      }
2145      __archive_ppmd7_functions.Ppmd7_Init(&rar->ppmd7_context, maxorder);
2146      rar->ppmd_valid = 1;
2147    }
2148    else
2149    {
2150      if (!rar->ppmd_valid) {
2151        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2152                          "Invalid PPMd sequence");
2153        return (ARCHIVE_FATAL);
2154      }
2155      if (!__archive_ppmd7_functions.PpmdRAR_RangeDec_Init(&rar->range_dec))
2156      {
2157        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2158                          "Unable to initialize PPMd range decoder");
2159        return (ARCHIVE_FATAL);
2160      }
2161    }
2162  }
2163  else
2164  {
2165    rar_br_consume(br, 1);
2166
2167    /* Keep existing table flag */
2168    if (!rar_br_read_ahead(a, br, 1))
2169      goto truncated_data;
2170    if (!rar_br_bits(br, 1))
2171      memset(rar->lengthtable, 0, sizeof(rar->lengthtable));
2172    rar_br_consume(br, 1);
2173
2174    memset(&bitlengths, 0, sizeof(bitlengths));
2175    for (i = 0; i < MAX_SYMBOLS;)
2176    {
2177      if (!rar_br_read_ahead(a, br, 4))
2178        goto truncated_data;
2179      bitlengths[i++] = rar_br_bits(br, 4);
2180      rar_br_consume(br, 4);
2181      if (bitlengths[i-1] == 0xF)
2182      {
2183        if (!rar_br_read_ahead(a, br, 4))
2184          goto truncated_data;
2185        zerocount = rar_br_bits(br, 4);
2186        rar_br_consume(br, 4);
2187        if (zerocount)
2188        {
2189          i--;
2190          for (j = 0; j < zerocount + 2 && i < MAX_SYMBOLS; j++)
2191            bitlengths[i++] = 0;
2192        }
2193      }
2194    }
2195
2196    memset(&precode, 0, sizeof(precode));
2197    r = create_code(a, &precode, bitlengths, MAX_SYMBOLS, MAX_SYMBOL_LENGTH);
2198    if (r != ARCHIVE_OK) {
2199      free(precode.tree);
2200      free(precode.table);
2201      return (r);
2202    }
2203
2204    for (i = 0; i < HUFFMAN_TABLE_SIZE;)
2205    {
2206      if ((val = read_next_symbol(a, &precode)) < 0) {
2207        free(precode.tree);
2208        free(precode.table);
2209        return (ARCHIVE_FATAL);
2210      }
2211      if (val < 16)
2212      {
2213        rar->lengthtable[i] = (rar->lengthtable[i] + val) & 0xF;
2214        i++;
2215      }
2216      else if (val < 18)
2217      {
2218        if (i == 0)
2219        {
2220          free(precode.tree);
2221          free(precode.table);
2222          archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2223                            "Internal error extracting RAR file.");
2224          return (ARCHIVE_FATAL);
2225        }
2226
2227        if(val == 16) {
2228          if (!rar_br_read_ahead(a, br, 3)) {
2229            free(precode.tree);
2230            free(precode.table);
2231            goto truncated_data;
2232          }
2233          n = rar_br_bits(br, 3) + 3;
2234          rar_br_consume(br, 3);
2235        } else {
2236          if (!rar_br_read_ahead(a, br, 7)) {
2237            free(precode.tree);
2238            free(precode.table);
2239            goto truncated_data;
2240          }
2241          n = rar_br_bits(br, 7) + 11;
2242          rar_br_consume(br, 7);
2243        }
2244
2245        for (j = 0; j < n && i < HUFFMAN_TABLE_SIZE; j++)
2246        {
2247          rar->lengthtable[i] = rar->lengthtable[i-1];
2248          i++;
2249        }
2250      }
2251      else
2252      {
2253        if(val == 18) {
2254          if (!rar_br_read_ahead(a, br, 3)) {
2255            free(precode.tree);
2256            free(precode.table);
2257            goto truncated_data;
2258          }
2259          n = rar_br_bits(br, 3) + 3;
2260          rar_br_consume(br, 3);
2261        } else {
2262          if (!rar_br_read_ahead(a, br, 7)) {
2263            free(precode.tree);
2264            free(precode.table);
2265            goto truncated_data;
2266          }
2267          n = rar_br_bits(br, 7) + 11;
2268          rar_br_consume(br, 7);
2269        }
2270
2271        for(j = 0; j < n && i < HUFFMAN_TABLE_SIZE; j++)
2272          rar->lengthtable[i++] = 0;
2273      }
2274    }
2275    free(precode.tree);
2276    free(precode.table);
2277
2278    r = create_code(a, &rar->maincode, &rar->lengthtable[0], MAINCODE_SIZE,
2279                MAX_SYMBOL_LENGTH);
2280    if (r != ARCHIVE_OK)
2281      return (r);
2282    r = create_code(a, &rar->offsetcode, &rar->lengthtable[MAINCODE_SIZE],
2283                OFFSETCODE_SIZE, MAX_SYMBOL_LENGTH);
2284    if (r != ARCHIVE_OK)
2285      return (r);
2286    r = create_code(a, &rar->lowoffsetcode,
2287                &rar->lengthtable[MAINCODE_SIZE + OFFSETCODE_SIZE],
2288                LOWOFFSETCODE_SIZE, MAX_SYMBOL_LENGTH);
2289    if (r != ARCHIVE_OK)
2290      return (r);
2291    r = create_code(a, &rar->lengthcode,
2292                &rar->lengthtable[MAINCODE_SIZE + OFFSETCODE_SIZE +
2293                LOWOFFSETCODE_SIZE], LENGTHCODE_SIZE, MAX_SYMBOL_LENGTH);
2294    if (r != ARCHIVE_OK)
2295      return (r);
2296  }
2297
2298  if (!rar->dictionary_size || !rar->lzss.window)
2299  {
2300    /* Seems as though dictionary sizes are not used. Even so, minimize
2301     * memory usage as much as possible.
2302     */
2303    void *new_window;
2304    unsigned int new_size;
2305
2306    if (rar->unp_size >= DICTIONARY_MAX_SIZE)
2307      new_size = DICTIONARY_MAX_SIZE;
2308    else
2309      new_size = rar_fls((unsigned int)rar->unp_size) << 1;
2310    if (new_size == 0) {
2311      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2312                        "Zero window size is invalid.");
2313      return (ARCHIVE_FATAL);
2314    }
2315    new_window = realloc(rar->lzss.window, new_size);
2316    if (new_window == NULL) {
2317      archive_set_error(&a->archive, ENOMEM,
2318                        "Unable to allocate memory for uncompressed data.");
2319      return (ARCHIVE_FATAL);
2320    }
2321    rar->lzss.window = (unsigned char *)new_window;
2322    rar->dictionary_size = new_size;
2323    memset(rar->lzss.window, 0, rar->dictionary_size);
2324    rar->lzss.mask = rar->dictionary_size - 1;
2325  }
2326
2327  rar->start_new_table = 0;
2328  return (ARCHIVE_OK);
2329truncated_data:
2330  archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2331                    "Truncated RAR file data");
2332  rar->valid = 0;
2333  return (ARCHIVE_FATAL);
2334}
2335
2336static void
2337free_codes(struct archive_read *a)
2338{
2339  struct rar *rar = (struct rar *)(a->format->data);
2340  free(rar->maincode.tree);
2341  free(rar->offsetcode.tree);
2342  free(rar->lowoffsetcode.tree);
2343  free(rar->lengthcode.tree);
2344  free(rar->maincode.table);
2345  free(rar->offsetcode.table);
2346  free(rar->lowoffsetcode.table);
2347  free(rar->lengthcode.table);
2348  memset(&rar->maincode, 0, sizeof(rar->maincode));
2349  memset(&rar->offsetcode, 0, sizeof(rar->offsetcode));
2350  memset(&rar->lowoffsetcode, 0, sizeof(rar->lowoffsetcode));
2351  memset(&rar->lengthcode, 0, sizeof(rar->lengthcode));
2352}
2353
2354
2355static int
2356read_next_symbol(struct archive_read *a, struct huffman_code *code)
2357{
2358  unsigned char bit;
2359  unsigned int bits;
2360  int length, value, node;
2361  struct rar *rar;
2362  struct rar_br *br;
2363
2364  if (!code->table)
2365  {
2366    if (make_table(a, code) != (ARCHIVE_OK))
2367      return -1;
2368  }
2369
2370  rar = (struct rar *)(a->format->data);
2371  br = &(rar->br);
2372
2373  /* Look ahead (peek) at bits */
2374  if (!rar_br_read_ahead(a, br, code->tablesize)) {
2375    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2376                      "Truncated RAR file data");
2377    rar->valid = 0;
2378    return -1;
2379  }
2380  bits = rar_br_bits(br, code->tablesize);
2381
2382  length = code->table[bits].length;
2383  value = code->table[bits].value;
2384
2385  if (length < 0)
2386  {
2387    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2388                      "Invalid prefix code in bitstream");
2389    return -1;
2390  }
2391
2392  if (length <= code->tablesize)
2393  {
2394    /* Skip length bits */
2395    rar_br_consume(br, length);
2396    return value;
2397  }
2398
2399  /* Skip tablesize bits */
2400  rar_br_consume(br, code->tablesize);
2401
2402  node = value;
2403  while (!(code->tree[node].branches[0] ==
2404    code->tree[node].branches[1]))
2405  {
2406    if (!rar_br_read_ahead(a, br, 1)) {
2407      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2408                        "Truncated RAR file data");
2409      rar->valid = 0;
2410      return -1;
2411    }
2412    bit = rar_br_bits(br, 1);
2413    rar_br_consume(br, 1);
2414
2415    if (code->tree[node].branches[bit] < 0)
2416    {
2417      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2418                        "Invalid prefix code in bitstream");
2419      return -1;
2420    }
2421    node = code->tree[node].branches[bit];
2422  }
2423
2424  return code->tree[node].branches[0];
2425}
2426
2427static int
2428create_code(struct archive_read *a, struct huffman_code *code,
2429            unsigned char *lengths, int numsymbols, char maxlength)
2430{
2431  int i, j, codebits = 0, symbolsleft = numsymbols;
2432
2433  code->numentries = 0;
2434  code->numallocatedentries = 0;
2435  if (new_node(code) < 0) {
2436    archive_set_error(&a->archive, ENOMEM,
2437                      "Unable to allocate memory for node data.");
2438    return (ARCHIVE_FATAL);
2439  }
2440  code->numentries = 1;
2441  code->minlength = INT_MAX;
2442  code->maxlength = INT_MIN;
2443  codebits = 0;
2444  for(i = 1; i <= maxlength; i++)
2445  {
2446    for(j = 0; j < numsymbols; j++)
2447    {
2448      if (lengths[j] != i) continue;
2449      if (add_value(a, code, j, codebits, i) != ARCHIVE_OK)
2450        return (ARCHIVE_FATAL);
2451      codebits++;
2452      if (--symbolsleft <= 0) { break; break; }
2453    }
2454    codebits <<= 1;
2455  }
2456  return (ARCHIVE_OK);
2457}
2458
2459static int
2460add_value(struct archive_read *a, struct huffman_code *code, int value,
2461          int codebits, int length)
2462{
2463  int repeatpos, lastnode, bitpos, bit, repeatnode, nextnode;
2464
2465  free(code->table);
2466  code->table = NULL;
2467
2468  if(length > code->maxlength)
2469    code->maxlength = length;
2470  if(length < code->minlength)
2471    code->minlength = length;
2472
2473  repeatpos = -1;
2474  if (repeatpos == 0 || (repeatpos >= 0
2475    && (((codebits >> (repeatpos - 1)) & 3) == 0
2476    || ((codebits >> (repeatpos - 1)) & 3) == 3)))
2477  {
2478    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2479                      "Invalid repeat position");
2480    return (ARCHIVE_FATAL);
2481  }
2482
2483  lastnode = 0;
2484  for (bitpos = length - 1; bitpos >= 0; bitpos--)
2485  {
2486    bit = (codebits >> bitpos) & 1;
2487
2488    /* Leaf node check */
2489    if (code->tree[lastnode].branches[0] ==
2490      code->tree[lastnode].branches[1])
2491    {
2492      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2493                        "Prefix found");
2494      return (ARCHIVE_FATAL);
2495    }
2496
2497    if (bitpos == repeatpos)
2498    {
2499      /* Open branch check */
2500      if (!(code->tree[lastnode].branches[bit] < 0))
2501      {
2502        archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2503                          "Invalid repeating code");
2504        return (ARCHIVE_FATAL);
2505      }
2506
2507      if ((repeatnode = new_node(code)) < 0) {
2508        archive_set_error(&a->archive, ENOMEM,
2509                          "Unable to allocate memory for node data.");
2510        return (ARCHIVE_FATAL);
2511      }
2512      if ((nextnode = new_node(code)) < 0) {
2513        archive_set_error(&a->archive, ENOMEM,
2514                          "Unable to allocate memory for node data.");
2515        return (ARCHIVE_FATAL);
2516      }
2517
2518      /* Set branches */
2519      code->tree[lastnode].branches[bit] = repeatnode;
2520      code->tree[repeatnode].branches[bit] = repeatnode;
2521      code->tree[repeatnode].branches[bit^1] = nextnode;
2522      lastnode = nextnode;
2523
2524      bitpos++; /* terminating bit already handled, skip it */
2525    }
2526    else
2527    {
2528      /* Open branch check */
2529      if (code->tree[lastnode].branches[bit] < 0)
2530      {
2531        if (new_node(code) < 0) {
2532          archive_set_error(&a->archive, ENOMEM,
2533                            "Unable to allocate memory for node data.");
2534          return (ARCHIVE_FATAL);
2535        }
2536        code->tree[lastnode].branches[bit] = code->numentries++;
2537      }
2538
2539      /* set to branch */
2540      lastnode = code->tree[lastnode].branches[bit];
2541    }
2542  }
2543
2544  if (!(code->tree[lastnode].branches[0] == -1
2545    && code->tree[lastnode].branches[1] == -2))
2546  {
2547    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2548                      "Prefix found");
2549    return (ARCHIVE_FATAL);
2550  }
2551
2552  /* Set leaf value */
2553  code->tree[lastnode].branches[0] = value;
2554  code->tree[lastnode].branches[1] = value;
2555
2556  return (ARCHIVE_OK);
2557}
2558
2559static int
2560new_node(struct huffman_code *code)
2561{
2562  void *new_tree;
2563  if (code->numallocatedentries == code->numentries) {
2564    int new_num_entries = 256;
2565    if (code->numentries > 0) {
2566        new_num_entries = code->numentries * 2;
2567    }
2568    new_tree = realloc(code->tree, new_num_entries * sizeof(*code->tree));
2569    if (new_tree == NULL)
2570        return (-1);
2571    code->tree = (struct huffman_tree_node *)new_tree;
2572    code->numallocatedentries = new_num_entries;
2573  }
2574  code->tree[code->numentries].branches[0] = -1;
2575  code->tree[code->numentries].branches[1] = -2;
2576  return 1;
2577}
2578
2579static int
2580make_table(struct archive_read *a, struct huffman_code *code)
2581{
2582  if (code->maxlength < code->minlength || code->maxlength > 10)
2583    code->tablesize = 10;
2584  else
2585    code->tablesize = code->maxlength;
2586
2587  code->table =
2588    (struct huffman_table_entry *)calloc(1, sizeof(*code->table)
2589    * ((size_t)1 << code->tablesize));
2590
2591  return make_table_recurse(a, code, 0, code->table, 0, code->tablesize);
2592}
2593
2594static int
2595make_table_recurse(struct archive_read *a, struct huffman_code *code, int node,
2596                   struct huffman_table_entry *table, int depth,
2597                   int maxdepth)
2598{
2599  int currtablesize, i, ret = (ARCHIVE_OK);
2600
2601  if (!code->tree)
2602  {
2603    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2604                      "Huffman tree was not created.");
2605    return (ARCHIVE_FATAL);
2606  }
2607  if (node < 0 || node >= code->numentries)
2608  {
2609    archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2610                      "Invalid location to Huffman tree specified.");
2611    return (ARCHIVE_FATAL);
2612  }
2613
2614  currtablesize = 1 << (maxdepth - depth);
2615
2616  if (code->tree[node].branches[0] ==
2617    code->tree[node].branches[1])
2618  {
2619    for(i = 0; i < currtablesize; i++)
2620    {
2621      table[i].length = depth;
2622      table[i].value = code->tree[node].branches[0];
2623    }
2624  }
2625  else if (node < 0)
2626  {
2627    for(i = 0; i < currtablesize; i++)
2628      table[i].length = -1;
2629  }
2630  else
2631  {
2632    if(depth == maxdepth)
2633    {
2634      table[0].length = maxdepth + 1;
2635      table[0].value = node;
2636    }
2637    else
2638    {
2639      ret |= make_table_recurse(a, code, code->tree[node].branches[0], table,
2640                                depth + 1, maxdepth);
2641      ret |= make_table_recurse(a, code, code->tree[node].branches[1],
2642                         table + currtablesize / 2, depth + 1, maxdepth);
2643    }
2644  }
2645  return ret;
2646}
2647
2648static int64_t
2649expand(struct archive_read *a, int64_t end)
2650{
2651  static const unsigned char lengthbases[] =
2652    {   0,   1,   2,   3,   4,   5,   6,
2653        7,   8,  10,  12,  14,  16,  20,
2654       24,  28,  32,  40,  48,  56,  64,
2655       80,  96, 112, 128, 160, 192, 224 };
2656  static const unsigned char lengthbits[] =
2657    { 0, 0, 0, 0, 0, 0, 0,
2658      0, 1, 1, 1, 1, 2, 2,
2659      2, 2, 3, 3, 3, 3, 4,
2660      4, 4, 4, 5, 5, 5, 5 };
2661  static const unsigned int offsetbases[] =
2662    {       0,       1,       2,       3,       4,       6,
2663            8,      12,      16,      24,      32,      48,
2664           64,      96,     128,     192,     256,     384,
2665          512,     768,    1024,    1536,    2048,    3072,
2666         4096,    6144,    8192,   12288,   16384,   24576,
2667        32768,   49152,   65536,   98304,  131072,  196608,
2668       262144,  327680,  393216,  458752,  524288,  589824,
2669       655360,  720896,  786432,  851968,  917504,  983040,
2670      1048576, 1310720, 1572864, 1835008, 2097152, 2359296,
2671      2621440, 2883584, 3145728, 3407872, 3670016, 3932160 };
2672  static const unsigned char offsetbits[] =
2673    {  0,  0,  0,  0,  1,  1,  2,  2,  3,  3,  4,  4,
2674       5,  5,  6,  6,  7,  7,  8,  8,  9,  9, 10, 10,
2675      11, 11, 12, 12, 13, 13, 14, 14, 15, 15, 16, 16,
2676      16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16,
2677      18, 18, 18, 18, 18, 18, 18, 18, 18, 18, 18, 18 };
2678  static const unsigned char shortbases[] =
2679    { 0, 4, 8, 16, 32, 64, 128, 192 };
2680  static const unsigned char shortbits[] =
2681    { 2, 2, 3, 4, 5, 6, 6, 6 };
2682
2683  int symbol, offs, len, offsindex, lensymbol, i, offssymbol, lowoffsetsymbol;
2684  unsigned char newfile;
2685  struct rar *rar = (struct rar *)(a->format->data);
2686  struct rar_br *br = &(rar->br);
2687
2688  if (rar->filterstart < end)
2689    end = rar->filterstart;
2690
2691  while (1)
2692  {
2693    if (rar->output_last_match &&
2694      lzss_position(&rar->lzss) + rar->lastlength <= end)
2695    {
2696      lzss_emit_match(rar, rar->lastoffset, rar->lastlength);
2697      rar->output_last_match = 0;
2698    }
2699
2700    if(rar->is_ppmd_block || rar->output_last_match ||
2701      lzss_position(&rar->lzss) >= end)
2702      return lzss_position(&rar->lzss);
2703
2704    if ((symbol = read_next_symbol(a, &rar->maincode)) < 0)
2705      return (ARCHIVE_FATAL);
2706    rar->output_last_match = 0;
2707
2708    if (symbol < 256)
2709    {
2710      lzss_emit_literal(rar, symbol);
2711      continue;
2712    }
2713    else if (symbol == 256)
2714    {
2715      if (!rar_br_read_ahead(a, br, 1))
2716        goto truncated_data;
2717      newfile = !rar_br_bits(br, 1);
2718      rar_br_consume(br, 1);
2719
2720      if(newfile)
2721      {
2722        rar->start_new_block = 1;
2723        if (!rar_br_read_ahead(a, br, 1))
2724          goto truncated_data;
2725        rar->start_new_table = rar_br_bits(br, 1);
2726        rar_br_consume(br, 1);
2727        return lzss_position(&rar->lzss);
2728      }
2729      else
2730      {
2731        if (parse_codes(a) != ARCHIVE_OK)
2732          return (ARCHIVE_FATAL);
2733        continue;
2734      }
2735    }
2736    else if(symbol==257)
2737    {
2738      archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2739                        "Parsing filters is unsupported.");
2740      return (ARCHIVE_FAILED);
2741    }
2742    else if(symbol==258)
2743    {
2744      if(rar->lastlength == 0)
2745        continue;
2746
2747      offs = rar->lastoffset;
2748      len = rar->lastlength;
2749    }
2750    else if (symbol <= 262)
2751    {
2752      offsindex = symbol - 259;
2753      offs = rar->oldoffset[offsindex];
2754
2755      if ((lensymbol = read_next_symbol(a, &rar->lengthcode)) < 0)
2756        goto bad_data;
2757      if (lensymbol > (int)(sizeof(lengthbases)/sizeof(lengthbases[0])))
2758        goto bad_data;
2759      if (lensymbol > (int)(sizeof(lengthbits)/sizeof(lengthbits[0])))
2760        goto bad_data;
2761      len = lengthbases[lensymbol] + 2;
2762      if (lengthbits[lensymbol] > 0) {
2763        if (!rar_br_read_ahead(a, br, lengthbits[lensymbol]))
2764          goto truncated_data;
2765        len += rar_br_bits(br, lengthbits[lensymbol]);
2766        rar_br_consume(br, lengthbits[lensymbol]);
2767      }
2768
2769      for (i = offsindex; i > 0; i--)
2770        rar->oldoffset[i] = rar->oldoffset[i-1];
2771      rar->oldoffset[0] = offs;
2772    }
2773    else if(symbol<=270)
2774    {
2775      offs = shortbases[symbol-263] + 1;
2776      if(shortbits[symbol-263] > 0) {
2777        if (!rar_br_read_ahead(a, br, shortbits[symbol-263]))
2778          goto truncated_data;
2779        offs += rar_br_bits(br, shortbits[symbol-263]);
2780        rar_br_consume(br, shortbits[symbol-263]);
2781      }
2782
2783      len = 2;
2784
2785      for(i = 3; i > 0; i--)
2786        rar->oldoffset[i] = rar->oldoffset[i-1];
2787      rar->oldoffset[0] = offs;
2788    }
2789    else
2790    {
2791      if (symbol-271 > (int)(sizeof(lengthbases)/sizeof(lengthbases[0])))
2792        goto bad_data;
2793      if (symbol-271 > (int)(sizeof(lengthbits)/sizeof(lengthbits[0])))
2794        goto bad_data;
2795      len = lengthbases[symbol-271]+3;
2796      if(lengthbits[symbol-271] > 0) {
2797        if (!rar_br_read_ahead(a, br, lengthbits[symbol-271]))
2798          goto truncated_data;
2799        len += rar_br_bits(br, lengthbits[symbol-271]);
2800        rar_br_consume(br, lengthbits[symbol-271]);
2801      }
2802
2803      if ((offssymbol = read_next_symbol(a, &rar->offsetcode)) < 0)
2804        goto bad_data;
2805      if (offssymbol > (int)(sizeof(offsetbases)/sizeof(offsetbases[0])))
2806        goto bad_data;
2807      if (offssymbol > (int)(sizeof(offsetbits)/sizeof(offsetbits[0])))
2808        goto bad_data;
2809      offs = offsetbases[offssymbol]+1;
2810      if(offsetbits[offssymbol] > 0)
2811      {
2812        if(offssymbol > 9)
2813        {
2814          if(offsetbits[offssymbol] > 4) {
2815            if (!rar_br_read_ahead(a, br, offsetbits[offssymbol] - 4))
2816              goto truncated_data;
2817            offs += rar_br_bits(br, offsetbits[offssymbol] - 4) << 4;
2818            rar_br_consume(br, offsetbits[offssymbol] - 4);
2819	  }
2820
2821          if(rar->numlowoffsetrepeats > 0)
2822          {
2823            rar->numlowoffsetrepeats--;
2824            offs += rar->lastlowoffset;
2825          }
2826          else
2827          {
2828            if ((lowoffsetsymbol =
2829              read_next_symbol(a, &rar->lowoffsetcode)) < 0)
2830              return (ARCHIVE_FATAL);
2831            if(lowoffsetsymbol == 16)
2832            {
2833              rar->numlowoffsetrepeats = 15;
2834              offs += rar->lastlowoffset;
2835            }
2836            else
2837            {
2838              offs += lowoffsetsymbol;
2839              rar->lastlowoffset = lowoffsetsymbol;
2840            }
2841          }
2842        }
2843        else {
2844          if (!rar_br_read_ahead(a, br, offsetbits[offssymbol]))
2845            goto truncated_data;
2846          offs += rar_br_bits(br, offsetbits[offssymbol]);
2847          rar_br_consume(br, offsetbits[offssymbol]);
2848        }
2849      }
2850
2851      if (offs >= 0x40000)
2852        len++;
2853      if (offs >= 0x2000)
2854        len++;
2855
2856      for(i = 3; i > 0; i--)
2857        rar->oldoffset[i] = rar->oldoffset[i-1];
2858      rar->oldoffset[0] = offs;
2859    }
2860
2861    rar->lastoffset = offs;
2862    rar->lastlength = len;
2863    rar->output_last_match = 1;
2864  }
2865truncated_data:
2866  archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2867                    "Truncated RAR file data");
2868  rar->valid = 0;
2869  return (ARCHIVE_FATAL);
2870bad_data:
2871  archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2872                    "Bad RAR file data");
2873  return (ARCHIVE_FATAL);
2874}
2875
2876static int
2877copy_from_lzss_window(struct archive_read *a, const void **buffer,
2878                        int64_t startpos, int length)
2879{
2880  int windowoffs, firstpart;
2881  struct rar *rar = (struct rar *)(a->format->data);
2882
2883  if (!rar->unp_buffer)
2884  {
2885    if ((rar->unp_buffer = malloc(rar->unp_buffer_size)) == NULL)
2886    {
2887      archive_set_error(&a->archive, ENOMEM,
2888                        "Unable to allocate memory for uncompressed data.");
2889      return (ARCHIVE_FATAL);
2890    }
2891  }
2892
2893  windowoffs = lzss_offset_for_position(&rar->lzss, startpos);
2894  if(windowoffs + length <= lzss_size(&rar->lzss)) {
2895    memcpy(&rar->unp_buffer[rar->unp_offset], &rar->lzss.window[windowoffs],
2896           length);
2897  } else if (length <= lzss_size(&rar->lzss)) {
2898    firstpart = lzss_size(&rar->lzss) - windowoffs;
2899    if (firstpart < 0) {
2900      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2901                        "Bad RAR file data");
2902      return (ARCHIVE_FATAL);
2903    }
2904    if (firstpart < length) {
2905      memcpy(&rar->unp_buffer[rar->unp_offset],
2906             &rar->lzss.window[windowoffs], firstpart);
2907      memcpy(&rar->unp_buffer[rar->unp_offset + firstpart],
2908             &rar->lzss.window[0], length - firstpart);
2909    } else {
2910      memcpy(&rar->unp_buffer[rar->unp_offset],
2911             &rar->lzss.window[windowoffs], length);
2912    }
2913  } else {
2914      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2915                        "Bad RAR file data");
2916      return (ARCHIVE_FATAL);
2917  }
2918  rar->unp_offset += length;
2919  if (rar->unp_offset >= rar->unp_buffer_size)
2920    *buffer = rar->unp_buffer;
2921  else
2922    *buffer = NULL;
2923  return (ARCHIVE_OK);
2924}
2925
2926static const void *
2927rar_read_ahead(struct archive_read *a, size_t min, ssize_t *avail)
2928{
2929  struct rar *rar = (struct rar *)(a->format->data);
2930  const void *h = __archive_read_ahead(a, min, avail);
2931  int ret;
2932  if (avail)
2933  {
2934    if (a->archive.read_data_is_posix_read && *avail > (ssize_t)a->archive.read_data_requested)
2935      *avail = a->archive.read_data_requested;
2936    if (*avail > rar->bytes_remaining)
2937      *avail = (ssize_t)rar->bytes_remaining;
2938    if (*avail < 0)
2939      return NULL;
2940    else if (*avail == 0 && rar->main_flags & MHD_VOLUME &&
2941      rar->file_flags & FHD_SPLIT_AFTER)
2942    {
2943      rar->filename_must_match = 1;
2944      ret = archive_read_format_rar_read_header(a, a->entry);
2945      if (ret == (ARCHIVE_EOF))
2946      {
2947        rar->has_endarc_header = 1;
2948        ret = archive_read_format_rar_read_header(a, a->entry);
2949      }
2950      rar->filename_must_match = 0;
2951      if (ret != (ARCHIVE_OK))
2952        return NULL;
2953      return rar_read_ahead(a, min, avail);
2954    }
2955  }
2956  return h;
2957}
2958