contrib/libarchive/libarchive/archive_read_support_format_lha.c

   1 /*-
   2  * Copyright (c) 2008-2012 Michihiro NAKAJIMA
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include "archive_platform.h"
  27
  28 #ifdef HAVE_ERRNO_H
  29 #include <errno.h>
  30 #endif
  31 #ifdef HAVE_LIMITS_H
  32 #include <limits.h>
  33 #endif
  34 #ifdef HAVE_STDLIB_H
  35 #include <stdlib.h>
  36 #endif
  37 #ifdef HAVE_STRING_H
  38 #include <string.h>
  39 #endif
  40
  41 #include "archive.h"
  42 #include "archive_entry.h"
  43 #include "archive_entry_locale.h"
  44 #include "archive_private.h"
  45 #include "archive_read_private.h"
  46 #include "archive_endian.h"
  47
  48
  49 #define MAXMATCH                256     /* Maximum match length. */
  50 #define MINMATCH                3       /* Minimum match length. */
  51 /*
  52  * Literal table format:
  53  * +0              +256                      +510
  54  * +---------------+-------------------------+
  55  * | literal code  |       match length      |
  56  * |   0 ... 255   |  MINMATCH ... MAXMATCH  |
  57  * +---------------+-------------------------+
  58  *  <---          LT_BITLEN_SIZE         --->
  59  */
  60 /* Literal table size. */
  61 #define LT_BITLEN_SIZE          (UCHAR_MAX + 1 + MAXMATCH - MINMATCH + 1)
  62 /* Position table size.
  63  * Note: this used for both position table and pre literal table.*/
  64 #define PT_BITLEN_SIZE          (3 + 16)
  65
  66 struct lzh_dec {
  67         /* Decoding status. */
  68         int                      state;
  69
  70         /*
  71          * Window to see last 8Ki(lh5),32Ki(lh6),64Ki(lh7) bytes of decoded
  72          * data.
  73          */
  74         int                      w_size;
  75         int                      w_mask;
  76         /* Window buffer, which is a loop buffer. */
  77         unsigned char           *w_buff;
  78         /* The insert position to the window. */
  79         int                      w_pos;
  80         /* The position where we can copy decoded code from the window. */
  81         int                      copy_pos;
  82         /* The length how many bytes we can copy decoded code from
  83          * the window. */
  84         int                      copy_len;
  85         /* The remaining bytes that we have not copied decoded data from
  86          * the window to an output buffer. */
  87         int                      w_remaining;
  88
  89         /*
  90          * Bit stream reader.
  91          */
  92         struct lzh_br {
  93 #define CACHE_TYPE              uint64_t
  94 #define CACHE_BITS              (8 * sizeof(CACHE_TYPE))
  95                 /* Cache buffer. */
  96                 CACHE_TYPE       cache_buffer;
  97                 /* Indicates how many bits avail in cache_buffer. */
  98                 int              cache_avail;
  99         } br;
 100
 101         /*
 102          * Huffman coding.
 103          */
 104         struct huffman {
 105                 int              len_size;
 106                 int              len_avail;
 107                 int              len_bits;
 108                 int              freq[17];
 109                 unsigned char   *bitlen;
 110
 111                 /*
 112                  * Use a index table. It's faster than searching a huffman
 113                  * coding tree, which is a binary tree. But a use of a large
 114                  * index table causes L1 cache read miss many times.
 115                  */
 116 #define HTBL_BITS       10
 117                 int              max_bits;
 118                 int              shift_bits;
 119                 int              tbl_bits;
 120                 int              tree_used;
 121                 int              tree_avail;
 122                 /* Direct access table. */
 123                 uint16_t        *tbl;
 124                 /* Binary tree table for extra bits over the direct access. */
 125                 struct htree_t {
 126                         uint16_t left;
 127                         uint16_t right;
 128                 }               *tree;
 129         }                        lt, pt;
 130
 131         int                      blocks_avail;
 132         int                      pos_pt_len_size;
 133         int                      pos_pt_len_bits;
 134         int                      literal_pt_len_size;
 135         int                      literal_pt_len_bits;
 136         int                      reading_position;
 137         int                      loop;
 138         int                      error;
 139 };
 140
 141 struct lzh_stream {
 142         const unsigned char     *next_in;
 143         int64_t                  avail_in;
 144         int64_t                  total_in;
 145         unsigned char           *next_out;
 146         int64_t                  avail_out;
 147         int64_t                  total_out;
 148         struct lzh_dec          *ds;
 149 };
 150
 151 struct lha {
 152         /* entry_bytes_remaining is the number of bytes we expect.          */
 153         int64_t                  entry_offset;
 154         int64_t                  entry_bytes_remaining;
 155         int64_t                  entry_unconsumed;
 156         uint16_t                 entry_crc_calculated;
 157
 158         size_t                   header_size;   /* header size              */
 159         unsigned char            level;         /* header level             */
 160         char                     method[3];     /* compress type            */
 161         int64_t                  compsize;      /* compressed data size     */
 162         int64_t                  origsize;      /* original file size       */
 163         int                      setflag;
 164 #define BIRTHTIME_IS_SET        1
 165 #define ATIME_IS_SET            2
 166 #define UNIX_MODE_IS_SET        4
 167 #define CRC_IS_SET              8
 168         time_t                   birthtime;
 169         long                     birthtime_tv_nsec;
 170         time_t                   mtime;
 171         long                     mtime_tv_nsec;
 172         time_t                   atime;
 173         long                     atime_tv_nsec;
 174         mode_t                   mode;
 175         int64_t                  uid;
 176         int64_t                  gid;
 177         struct archive_string    uname;
 178         struct archive_string    gname;
 179         uint16_t                 header_crc;
 180         uint16_t                 crc;
 181         struct archive_string_conv *sconv;
 182         struct archive_string_conv *opt_sconv;
 183
 184         struct archive_string    dirname;
 185         struct archive_string    filename;
 186         struct archive_wstring   ws;
 187
 188         unsigned char            dos_attr;
 189
 190         /* Flag to mark progress that an archive was read their first header.*/
 191         char                     found_first_header;
 192         /* Flag to mark that indicates an empty directory. */
 193         char                     directory;
 194
 195         /* Flags to mark progress of decompression. */
 196         char                     decompress_init;
 197         char                     end_of_entry;
 198         char                     end_of_entry_cleanup;
 199         char                     entry_is_compressed;
 200
 201         unsigned char           *uncompressed_buffer;
 202         size_t                   uncompressed_buffer_size;
 203
 204         char                     format_name[64];
 205
 206         struct lzh_stream        strm;
 207 };
 208
 209 /*
 210  * LHA header common member offset.
 211  */
 212 #define H_METHOD_OFFSET 2       /* Compress type. */
 213 #define H_ATTR_OFFSET   19      /* DOS attribute. */
 214 #define H_LEVEL_OFFSET  20      /* Header Level.  */
 215 #define H_SIZE          22      /* Minimum header size. */
 216
 217 static const uint16_t crc16tbl[256] = {
 218         0x0000,0xC0C1,0xC181,0x0140,0xC301,0x03C0,0x0280,0xC241,
 219         0xC601,0x06C0,0x0780,0xC741,0x0500,0xC5C1,0xC481,0x0440,
 220         0xCC01,0x0CC0,0x0D80,0xCD41,0x0F00,0xCFC1,0xCE81,0x0E40,
 221         0x0A00,0xCAC1,0xCB81,0x0B40,0xC901,0x09C0,0x0880,0xC841,
 222         0xD801,0x18C0,0x1980,0xD941,0x1B00,0xDBC1,0xDA81,0x1A40,
 223         0x1E00,0xDEC1,0xDF81,0x1F40,0xDD01,0x1DC0,0x1C80,0xDC41,
 224         0x1400,0xD4C1,0xD581,0x1540,0xD701,0x17C0,0x1680,0xD641,
 225         0xD201,0x12C0,0x1380,0xD341,0x1100,0xD1C1,0xD081,0x1040,
 226         0xF001,0x30C0,0x3180,0xF141,0x3300,0xF3C1,0xF281,0x3240,
 227         0x3600,0xF6C1,0xF781,0x3740,0xF501,0x35C0,0x3480,0xF441,
 228         0x3C00,0xFCC1,0xFD81,0x3D40,0xFF01,0x3FC0,0x3E80,0xFE41,
 229         0xFA01,0x3AC0,0x3B80,0xFB41,0x3900,0xF9C1,0xF881,0x3840,
 230         0x2800,0xE8C1,0xE981,0x2940,0xEB01,0x2BC0,0x2A80,0xEA41,
 231         0xEE01,0x2EC0,0x2F80,0xEF41,0x2D00,0xEDC1,0xEC81,0x2C40,
 232         0xE401,0x24C0,0x2580,0xE541,0x2700,0xE7C1,0xE681,0x2640,
 233         0x2200,0xE2C1,0xE381,0x2340,0xE101,0x21C0,0x2080,0xE041,
 234         0xA001,0x60C0,0x6180,0xA141,0x6300,0xA3C1,0xA281,0x6240,
 235         0x6600,0xA6C1,0xA781,0x6740,0xA501,0x65C0,0x6480,0xA441,
 236         0x6C00,0xACC1,0xAD81,0x6D40,0xAF01,0x6FC0,0x6E80,0xAE41,
 237         0xAA01,0x6AC0,0x6B80,0xAB41,0x6900,0xA9C1,0xA881,0x6840,
 238         0x7800,0xB8C1,0xB981,0x7940,0xBB01,0x7BC0,0x7A80,0xBA41,
 239         0xBE01,0x7EC0,0x7F80,0xBF41,0x7D00,0xBDC1,0xBC81,0x7C40,
 240         0xB401,0x74C0,0x7580,0xB541,0x7700,0xB7C1,0xB681,0x7640,
 241         0x7200,0xB2C1,0xB381,0x7340,0xB101,0x71C0,0x7080,0xB041,
 242         0x5000,0x90C1,0x9181,0x5140,0x9301,0x53C0,0x5280,0x9241,
 243         0x9601,0x56C0,0x5780,0x9741,0x5500,0x95C1,0x9481,0x5440,
 244         0x9C01,0x5CC0,0x5D80,0x9D41,0x5F00,0x9FC1,0x9E81,0x5E40,
 245         0x5A00,0x9AC1,0x9B81,0x5B40,0x9901,0x59C0,0x5880,0x9841,
 246         0x8801,0x48C0,0x4980,0x8941,0x4B00,0x8BC1,0x8A81,0x4A40,
 247         0x4E00,0x8EC1,0x8F81,0x4F40,0x8D01,0x4DC0,0x4C80,0x8C41,
 248         0x4400,0x84C1,0x8581,0x4540,0x8701,0x47C0,0x4680,0x8641,
 249         0x8201,0x42C0,0x4380,0x8341,0x4100,0x81C1,0x8081,0x4040
 250 };
 251
 252 static int      archive_read_format_lha_bid(struct archive_read *, int);
 253 static int      archive_read_format_lha_options(struct archive_read *,
 254                     const char *, const char *);
 255 static int      archive_read_format_lha_read_header(struct archive_read *,
 256                     struct archive_entry *);
 257 static int      archive_read_format_lha_read_data(struct archive_read *,
 258                     const void **, size_t *, int64_t *);
 259 static int      archive_read_format_lha_read_data_skip(struct archive_read *);
 260 static int      archive_read_format_lha_cleanup(struct archive_read *);
 261
 262 static void     lha_replace_path_separator(struct lha *,
 263                     struct archive_entry *);
 264 static int      lha_read_file_header_0(struct archive_read *, struct lha *);
 265 static int      lha_read_file_header_1(struct archive_read *, struct lha *);
 266 static int      lha_read_file_header_2(struct archive_read *, struct lha *);
 267 static int      lha_read_file_header_3(struct archive_read *, struct lha *);
 268 static int      lha_read_file_extended_header(struct archive_read *,
 269                     struct lha *, uint16_t *, int, size_t, size_t *);
 270 static size_t   lha_check_header_format(const void *);
 271 static int      lha_skip_sfx(struct archive_read *);
 272 static time_t   lha_dos_time(const unsigned char *);
 273 static time_t   lha_win_time(uint64_t, long *);
 274 static unsigned char    lha_calcsum(unsigned char, const void *,
 275                     int, int);
 276 static int      lha_parse_linkname(struct archive_string *,
 277                     struct archive_string *);
 278 static int      lha_read_data_none(struct archive_read *, const void **,
 279                     size_t *, int64_t *);
 280 static int      lha_read_data_lzh(struct archive_read *, const void **,
 281                     size_t *, int64_t *);
 282 static uint16_t lha_crc16(uint16_t, const void *, size_t);
 283 static int      lzh_decode_init(struct lzh_stream *, const char *);
 284 static void     lzh_decode_free(struct lzh_stream *);
 285 static int      lzh_decode(struct lzh_stream *, int);
 286 static int      lzh_br_fillup(struct lzh_stream *, struct lzh_br *);
 287 static int      lzh_huffman_init(struct huffman *, size_t, int);
 288 static void     lzh_huffman_free(struct huffman *);
 289 static int      lzh_read_pt_bitlen(struct lzh_stream *, int start, int end);
 290 static int      lzh_make_fake_table(struct huffman *, uint16_t);
 291 static int      lzh_make_huffman_table(struct huffman *);
 292 static inline int lzh_decode_huffman(struct huffman *, unsigned);
 293 static int      lzh_decode_huffman_tree(struct huffman *, unsigned, int);
 294
 295
 296 int
 297 archive_read_support_format_lha(struct archive *_a)
 298 {
 299         struct archive_read *a = (struct archive_read *)_a;
 300         struct lha *lha;
 301         int r;
 302
 303         archive_check_magic(_a, ARCHIVE_READ_MAGIC,
 304             ARCHIVE_STATE_NEW, "archive_read_support_format_lha");
 305
 306         lha = (struct lha *)calloc(1, sizeof(*lha));
 307         if (lha == NULL) {
 308                 archive_set_error(&a->archive, ENOMEM,
 309                     "Can't allocate lha data");
 310                 return (ARCHIVE_FATAL);
 311         }
 312         archive_string_init(&lha->ws);
 313
 314         r = __archive_read_register_format(a,
 315             lha,
 316             "lha",
 317             archive_read_format_lha_bid,
 318             archive_read_format_lha_options,
 319             archive_read_format_lha_read_header,
 320             archive_read_format_lha_read_data,
 321             archive_read_format_lha_read_data_skip,
 322             archive_read_format_lha_cleanup);
 323
 324         if (r != ARCHIVE_OK)
 325                 free(lha);
 326         return (ARCHIVE_OK);
 327 }
 328
 329 static size_t
 330 lha_check_header_format(const void *h)
 331 {
 332         const unsigned char *p = h;
 333         size_t next_skip_bytes;
 334
 335         switch (p[H_METHOD_OFFSET+3]) {
 336         /*
 337          * "-lh0-" ... "-lh7-" "-lhd-"
 338          * "-lzs-" "-lz5-"
 339          */
 340         case '0': case '1': case '2': case '3':
 341         case '4': case '5': case '6': case '7':
 342         case 'd':
 343         case 's':
 344                 next_skip_bytes = 4;
 345
 346                 /* b0 == 0 means the end of an LHa archive file.        */
 347                 if (p[0] == 0)
 348                         break;
 349                 if (p[H_METHOD_OFFSET] != '-' || p[H_METHOD_OFFSET+1] != 'l'
 350                     ||  p[H_METHOD_OFFSET+4] != '-')
 351                         break;
 352
 353                 if (p[H_METHOD_OFFSET+2] == 'h') {
 354                         /* "-lh?-" */
 355                         if (p[H_METHOD_OFFSET+3] == 's')
 356                                 break;
 357                         if (p[H_LEVEL_OFFSET] == 0)
 358                                 return (0);
 359                         if (p[H_LEVEL_OFFSET] <= 3 && p[H_ATTR_OFFSET] == 0x20)
 360                                 return (0);
 361                 }
 362                 if (p[H_METHOD_OFFSET+2] == 'z') {
 363                         /* LArc extensions: -lzs-,-lz4- and -lz5- */
 364                         if (p[H_LEVEL_OFFSET] != 0)
 365                                 break;
 366                         if (p[H_METHOD_OFFSET+3] == 's'
 367                             || p[H_METHOD_OFFSET+3] == '4'
 368                             || p[H_METHOD_OFFSET+3] == '5')
 369                                 return (0);
 370                 }
 371                 break;
 372         case 'h': next_skip_bytes = 1; break;
 373         case 'z': next_skip_bytes = 1; break;
 374         case 'l': next_skip_bytes = 2; break;
 375         case '-': next_skip_bytes = 3; break;
 376         default : next_skip_bytes = 4; break;
 377         }
 378
 379         return (next_skip_bytes);
 380 }
 381
 382 static int
 383 archive_read_format_lha_bid(struct archive_read *a, int best_bid)
 384 {
 385         const char *p;
 386         const void *buff;
 387         ssize_t bytes_avail, offset, window;
 388         size_t next;
 389
 390         /* If there's already a better bid than we can ever
 391            make, don't bother testing. */
 392         if (best_bid > 30)
 393                 return (-1);
 394
 395         if ((p = __archive_read_ahead(a, H_SIZE, NULL)) == NULL)
 396                 return (-1);
 397
 398         if (lha_check_header_format(p) == 0)
 399                 return (30);
 400
 401         if (p[0] == 'M' && p[1] == 'Z') {
 402                 /* PE file */
 403                 offset = 0;
 404                 window = 4096;
 405                 while (offset < (1024 * 20)) {
 406                         buff = __archive_read_ahead(a, offset + window,
 407                             &bytes_avail);
 408                         if (buff == NULL) {
 409                                 /* Remaining bytes are less than window. */
 410                                 window >>= 1;
 411                                 if (window < (H_SIZE + 3))
 412                                         return (0);
 413                                 continue;
 414                         }
 415                         p = (const char *)buff + offset;
 416                         while (p + H_SIZE < (const char *)buff + bytes_avail) {
 417                                 if ((next = lha_check_header_format(p)) == 0)
 418                                         return (30);
 419                                 p += next;
 420                         }
 421                         offset = p - (const char *)buff;
 422                 }
 423         }
 424         return (0);
 425 }
 426
 427 static int
 428 archive_read_format_lha_options(struct archive_read *a,
 429     const char *key, const char *val)
 430 {
 431         struct lha *lha;
 432         int ret = ARCHIVE_FAILED;
 433
 434         lha = (struct lha *)(a->format->data);
 435         if (strcmp(key, "hdrcharset")  == 0) {
 436                 if (val == NULL || val[0] == 0)
 437                         archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
 438                             "lha: hdrcharset option needs a character-set name");
 439                 else {
 440                         lha->opt_sconv =
 441                             archive_string_conversion_from_charset(
 442                                 &a->archive, val, 0);
 443                         if (lha->opt_sconv != NULL)
 444                                 ret = ARCHIVE_OK;
 445                         else
 446                                 ret = ARCHIVE_FATAL;
 447                 }
 448                 return (ret);
 449         }
 450
 451         /* Note: The "warn" return is just to inform the options
 452          * supervisor that we didn't handle it.  It will generate
 453          * a suitable error if no one used this option. */
 454         return (ARCHIVE_WARN);
 455 }
 456
 457 static int
 458 lha_skip_sfx(struct archive_read *a)
 459 {
 460         const void *h;
 461         const char *p, *q;
 462         size_t next, skip;
 463         ssize_t bytes, window;
 464
 465         window = 4096;
 466         for (;;) {
 467                 h = __archive_read_ahead(a, window, &bytes);
 468                 if (h == NULL) {
 469                         /* Remaining bytes are less than window. */
 470                         window >>= 1;
 471                         if (window < (H_SIZE + 3))
 472                                 goto fatal;
 473                         continue;
 474                 }
 475                 if (bytes < H_SIZE)
 476                         goto fatal;
 477                 p = h;
 478                 q = p + bytes;
 479
 480                 /*
 481                  * Scan ahead until we find something that looks
 482                  * like the lha header.
 483                  */
 484                 while (p + H_SIZE < q) {
 485                         if ((next = lha_check_header_format(p)) == 0) {
 486                                 skip = p - (const char *)h;
 487                                 __archive_read_consume(a, skip);
 488                                 return (ARCHIVE_OK);
 489                         }
 490                         p += next;
 491                 }
 492                 skip = p - (const char *)h;
 493                 __archive_read_consume(a, skip);
 494         }
 495 fatal:
 496         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 497             "Couldn't find out LHa header");
 498         return (ARCHIVE_FATAL);
 499 }
 500
 501 static int
 502 truncated_error(struct archive_read *a)
 503 {
 504         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 505             "Truncated LHa header");
 506         return (ARCHIVE_FATAL);
 507 }
 508
 509 static int
 510 archive_read_format_lha_read_header(struct archive_read *a,
 511     struct archive_entry *entry)
 512 {
 513         struct archive_string linkname;
 514         struct archive_string pathname;
 515         struct lha *lha;
 516         const unsigned char *p;
 517         const char *signature;
 518         int err;
 519
 520         a->archive.archive_format = ARCHIVE_FORMAT_LHA;
 521         if (a->archive.archive_format_name == NULL)
 522                 a->archive.archive_format_name = "lha";
 523
 524         lha = (struct lha *)(a->format->data);
 525         lha->decompress_init = 0;
 526         lha->end_of_entry = 0;
 527         lha->end_of_entry_cleanup = 0;
 528         lha->entry_unconsumed = 0;
 529
 530         if ((p = __archive_read_ahead(a, H_SIZE, NULL)) == NULL) {
 531                 /*
 532                  * LHa archiver added 0 to the tail of its archive file as
 533                  * the mark of the end of the archive.
 534                  */
 535                 signature = __archive_read_ahead(a, sizeof(signature[0]), NULL);
 536                 if (signature == NULL || signature[0] == 0)
 537                         return (ARCHIVE_EOF);
 538                 return (truncated_error(a));
 539         }
 540
 541         signature = (const char *)p;
 542         if (lha->found_first_header == 0 &&
 543             signature[0] == 'M' && signature[1] == 'Z') {
 544                 /* This is an executable?  Must be self-extracting...   */
 545                 err = lha_skip_sfx(a);
 546                 if (err < ARCHIVE_WARN)
 547                         return (err);
 548
 549                 if ((p = __archive_read_ahead(a, sizeof(*p), NULL)) == NULL)
 550                         return (truncated_error(a));
 551                 signature = (const char *)p;
 552         }
 553         /* signature[0] == 0 means the end of an LHa archive file. */
 554         if (signature[0] == 0)
 555                 return (ARCHIVE_EOF);
 556
 557         /*
 558          * Check the header format and method type.
 559          */
 560         if (lha_check_header_format(p) != 0) {
 561                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 562                     "Bad LHa file");
 563                 return (ARCHIVE_FATAL);
 564         }
 565
 566         /* We've found the first header. */
 567         lha->found_first_header = 1;
 568         /* Set a default value and common data */
 569         lha->header_size = 0;
 570         lha->level = p[H_LEVEL_OFFSET];
 571         lha->method[0] = p[H_METHOD_OFFSET+1];
 572         lha->method[1] = p[H_METHOD_OFFSET+2];
 573         lha->method[2] = p[H_METHOD_OFFSET+3];
 574         if (memcmp(lha->method, "lhd", 3) == 0)
 575                 lha->directory = 1;
 576         else
 577                 lha->directory = 0;
 578         if (memcmp(lha->method, "lh0", 3) == 0 ||
 579             memcmp(lha->method, "lz4", 3) == 0)
 580                 lha->entry_is_compressed = 0;
 581         else
 582                 lha->entry_is_compressed = 1;
 583
 584         lha->compsize = 0;
 585         lha->origsize = 0;
 586         lha->setflag = 0;
 587         lha->birthtime = 0;
 588         lha->birthtime_tv_nsec = 0;
 589         lha->mtime = 0;
 590         lha->mtime_tv_nsec = 0;
 591         lha->atime = 0;
 592         lha->atime_tv_nsec = 0;
 593         lha->mode = (lha->directory)? 0777 : 0666;
 594         lha->uid = 0;
 595         lha->gid = 0;
 596         archive_string_empty(&lha->dirname);
 597         archive_string_empty(&lha->filename);
 598         lha->dos_attr = 0;
 599         if (lha->opt_sconv != NULL)
 600                 lha->sconv = lha->opt_sconv;
 601         else
 602                 lha->sconv = NULL;
 603
 604         switch (p[H_LEVEL_OFFSET]) {
 605         case 0:
 606                 err = lha_read_file_header_0(a, lha);
 607                 break;
 608         case 1:
 609                 err = lha_read_file_header_1(a, lha);
 610                 break;
 611         case 2:
 612                 err = lha_read_file_header_2(a, lha);
 613                 break;
 614         case 3:
 615                 err = lha_read_file_header_3(a, lha);
 616                 break;
 617         default:
 618                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 619                     "Unsupported LHa header level %d", p[H_LEVEL_OFFSET]);
 620                 err = ARCHIVE_FATAL;
 621                 break;
 622         }
 623         if (err < ARCHIVE_WARN)
 624                 return (err);
 625
 626
 627         if (!lha->directory && archive_strlen(&lha->filename) == 0)
 628                 /* The filename has not been set */
 629                 return (truncated_error(a));
 630
 631         /*
 632          * Make a pathname from a dirname and a filename.
 633          */
 634         archive_string_concat(&lha->dirname, &lha->filename);
 635         archive_string_init(&pathname);
 636         archive_string_init(&linkname);
 637         archive_string_copy(&pathname, &lha->dirname);
 638
 639         if ((lha->mode & AE_IFMT) == AE_IFLNK) {
 640                 /*
 641                  * Extract the symlink-name if it's included in the pathname.
 642                  */
 643                 if (!lha_parse_linkname(&linkname, &pathname)) {
 644                         /* We couldn't get the symlink-name. */
 645                         archive_set_error(&a->archive,
 646                             ARCHIVE_ERRNO_FILE_FORMAT,
 647                             "Unknown symlink-name");
 648                         archive_string_free(&pathname);
 649                         archive_string_free(&linkname);
 650                         return (ARCHIVE_FAILED);
 651                 }
 652         } else {
 653                 /*
 654                  * Make sure a file-type is set.
 655                  * The mode has been overridden if it is in the extended data.
 656                  */
 657                 lha->mode = (lha->mode & ~AE_IFMT) |
 658                     ((lha->directory)? AE_IFDIR: AE_IFREG);
 659         }
 660         if ((lha->setflag & UNIX_MODE_IS_SET) == 0 &&
 661             (lha->dos_attr & 1) != 0)
 662                 lha->mode &= ~(0222);/* read only. */
 663
 664         /*
 665          * Set basic file parameters.
 666          */
 667         if (archive_entry_copy_pathname_l(entry, pathname.s,
 668             pathname.length, lha->sconv) != 0) {
 669                 if (errno == ENOMEM) {
 670                         archive_set_error(&a->archive, ENOMEM,
 671                             "Can't allocate memory for Pathname");
 672                         return (ARCHIVE_FATAL);
 673                 }
 674                 archive_set_error(&a->archive,
 675                     ARCHIVE_ERRNO_FILE_FORMAT,
 676                     "Pathname cannot be converted "
 677                     "from %s to current locale.",
 678                     archive_string_conversion_charset_name(lha->sconv));
 679                 err = ARCHIVE_WARN;
 680         }
 681         archive_string_free(&pathname);
 682         if (archive_strlen(&linkname) > 0) {
 683                 if (archive_entry_copy_symlink_l(entry, linkname.s,
 684                     linkname.length, lha->sconv) != 0) {
 685                         if (errno == ENOMEM) {
 686                                 archive_set_error(&a->archive, ENOMEM,
 687                                     "Can't allocate memory for Linkname");
 688                                 return (ARCHIVE_FATAL);
 689                         }
 690                         archive_set_error(&a->archive,
 691                             ARCHIVE_ERRNO_FILE_FORMAT,
 692                             "Linkname cannot be converted "
 693                             "from %s to current locale.",
 694                             archive_string_conversion_charset_name(lha->sconv));
 695                         err = ARCHIVE_WARN;
 696                 }
 697         } else
 698                 archive_entry_set_symlink(entry, NULL);
 699         archive_string_free(&linkname);
 700         /*
 701          * When a header level is 0, there is a possibility that
 702          * a pathname and a symlink has '\' character, a directory
 703          * separator in DOS/Windows. So we should convert it to '/'.
 704          */
 705         if (p[H_LEVEL_OFFSET] == 0)
 706                 lha_replace_path_separator(lha, entry);
 707
 708         archive_entry_set_mode(entry, lha->mode);
 709         archive_entry_set_uid(entry, lha->uid);
 710         archive_entry_set_gid(entry, lha->gid);
 711         if (archive_strlen(&lha->uname) > 0)
 712                 archive_entry_set_uname(entry, lha->uname.s);
 713         if (archive_strlen(&lha->gname) > 0)
 714                 archive_entry_set_gname(entry, lha->gname.s);
 715         if (lha->setflag & BIRTHTIME_IS_SET) {
 716                 archive_entry_set_birthtime(entry, lha->birthtime,
 717                     lha->birthtime_tv_nsec);
 718                 archive_entry_set_ctime(entry, lha->birthtime,
 719                     lha->birthtime_tv_nsec);
 720         } else {
 721                 archive_entry_unset_birthtime(entry);
 722                 archive_entry_unset_ctime(entry);
 723         }
 724         archive_entry_set_mtime(entry, lha->mtime, lha->mtime_tv_nsec);
 725         if (lha->setflag & ATIME_IS_SET)
 726                 archive_entry_set_atime(entry, lha->atime,
 727                     lha->atime_tv_nsec);
 728         else
 729                 archive_entry_unset_atime(entry);
 730         if (lha->directory || archive_entry_symlink(entry) != NULL)
 731                 archive_entry_unset_size(entry);
 732         else
 733                 archive_entry_set_size(entry, lha->origsize);
 734
 735         /*
 736          * Prepare variables used to read a file content.
 737          */
 738         lha->entry_bytes_remaining = lha->compsize;
 739         lha->entry_offset = 0;
 740         lha->entry_crc_calculated = 0;
 741
 742         /*
 743          * This file does not have a content.
 744          */
 745         if (lha->directory || lha->compsize == 0)
 746                 lha->end_of_entry = 1;
 747
 748         sprintf(lha->format_name, "lha -%c%c%c-",
 749             lha->method[0], lha->method[1], lha->method[2]);
 750         a->archive.archive_format_name = lha->format_name;
 751
 752         return (err);
 753 }
 754
 755 /*
 756  * Replace a DOS path separator '\' by a character '/'.
 757  * Some multi-byte character set have  a character '\' in its second byte.
 758  */
 759 static void
 760 lha_replace_path_separator(struct lha *lha, struct archive_entry *entry)
 761 {
 762         const wchar_t *wp;
 763         size_t i;
 764
 765         if ((wp = archive_entry_pathname_w(entry)) != NULL) {
 766                 archive_wstrcpy(&(lha->ws), wp);
 767                 for (i = 0; i < archive_strlen(&(lha->ws)); i++) {
 768                         if (lha->ws.s[i] == L'\\')
 769                                 lha->ws.s[i] = L'/';
 770                 }
 771                 archive_entry_copy_pathname_w(entry, lha->ws.s);
 772         }
 773
 774         if ((wp = archive_entry_symlink_w(entry)) != NULL) {
 775                 archive_wstrcpy(&(lha->ws), wp);
 776                 for (i = 0; i < archive_strlen(&(lha->ws)); i++) {
 777                         if (lha->ws.s[i] == L'\\')
 778                                 lha->ws.s[i] = L'/';
 779                 }
 780                 archive_entry_copy_symlink_w(entry, lha->ws.s);
 781         }
 782 }
 783
 784 /*
 785  * Header 0 format
 786  *
 787  * +0              +1         +2               +7                  +11
 788  * +---------------+----------+----------------+-------------------+
 789  * |header size(*1)|header sum|compression type|compressed size(*2)|
 790  * +---------------+----------+----------------+-------------------+
 791  *                             <---------------------(*1)----------*
 792  *
 793  * +11               +15       +17       +19            +20              +21
 794  * +-----------------+---------+---------+--------------+----------------+
 795  * |uncompressed size|time(DOS)|date(DOS)|attribute(DOS)|header level(=0)|
 796  * +-----------------+---------+---------+--------------+----------------+
 797  * *--------------------------------(*1)---------------------------------*
 798  *
 799  * +21             +22       +22+(*3)   +22+(*3)+2       +22+(*3)+2+(*4)
 800  * +---------------+---------+----------+----------------+------------------+
 801  * |name length(*3)|file name|file CRC16|extra header(*4)|  compressed data |
 802  * +---------------+---------+----------+----------------+------------------+
 803  *                  <--(*3)->                             <------(*2)------>
 804  * *----------------------(*1)-------------------------->
 805  *
 806  */
 807 #define H0_HEADER_SIZE_OFFSET   0
 808 #define H0_HEADER_SUM_OFFSET    1
 809 #define H0_COMP_SIZE_OFFSET     7
 810 #define H0_ORIG_SIZE_OFFSET     11
 811 #define H0_DOS_TIME_OFFSET      15
 812 #define H0_NAME_LEN_OFFSET      21
 813 #define H0_FILE_NAME_OFFSET     22
 814 #define H0_FIXED_SIZE           24
 815 static int
 816 lha_read_file_header_0(struct archive_read *a, struct lha *lha)
 817 {
 818         const unsigned char *p;
 819         int extdsize, namelen;
 820         unsigned char headersum, sum_calculated;
 821
 822         if ((p = __archive_read_ahead(a, H0_FIXED_SIZE, NULL)) == NULL)
 823                 return (truncated_error(a));
 824         lha->header_size = p[H0_HEADER_SIZE_OFFSET] + 2;
 825         headersum = p[H0_HEADER_SUM_OFFSET];
 826         lha->compsize = archive_le32dec(p + H0_COMP_SIZE_OFFSET);
 827         lha->origsize = archive_le32dec(p + H0_ORIG_SIZE_OFFSET);
 828         lha->mtime = lha_dos_time(p + H0_DOS_TIME_OFFSET);
 829         namelen = p[H0_NAME_LEN_OFFSET];
 830         extdsize = (int)lha->header_size - H0_FIXED_SIZE - namelen;
 831         if ((namelen > 221 || extdsize < 0) && extdsize != -2) {
 832                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 833                     "Invalid LHa header");
 834                 return (ARCHIVE_FATAL);
 835         }
 836         if ((p = __archive_read_ahead(a, lha->header_size, NULL)) == NULL)
 837                 return (truncated_error(a));
 838
 839         archive_strncpy(&lha->filename, p + H0_FILE_NAME_OFFSET, namelen);
 840         /* When extdsize == -2, A CRC16 value is not present in the header. */
 841         if (extdsize >= 0) {
 842                 lha->crc = archive_le16dec(p + H0_FILE_NAME_OFFSET + namelen);
 843                 lha->setflag |= CRC_IS_SET;
 844         }
 845         sum_calculated = lha_calcsum(0, p, 2, lha->header_size - 2);
 846
 847         /* Read an extended header */
 848         if (extdsize > 0) {
 849                 /* This extended data is set by 'LHa for UNIX' only.
 850                  * Maybe fixed size.
 851                  */
 852                 p += H0_FILE_NAME_OFFSET + namelen + 2;
 853                 if (p[0] == 'U' && extdsize == 12) {
 854                         /* p[1] is a minor version. */
 855                         lha->mtime = archive_le32dec(&p[2]);
 856                         lha->mode = archive_le16dec(&p[6]);
 857                         lha->uid = archive_le16dec(&p[8]);
 858                         lha->gid = archive_le16dec(&p[10]);
 859                         lha->setflag |= UNIX_MODE_IS_SET;
 860                 }
 861         }
 862         __archive_read_consume(a, lha->header_size);
 863
 864         if (sum_calculated != headersum) {
 865                 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
 866                     "LHa header sum error");
 867                 return (ARCHIVE_FATAL);
 868         }
 869
 870         return (ARCHIVE_OK);
 871 }
 872
 873 /*
 874  * Header 1 format
 875  *
 876  * +0              +1         +2               +7            +11
 877  * +---------------+----------+----------------+-------------+
 878  * |header size(*1)|header sum|compression type|skip size(*2)|
 879  * +---------------+----------+----------------+-------------+
 880  *                             <---------------(*1)----------*
 881  *
 882  * +11               +15       +17       +19            +20              +21
 883  * +-----------------+---------+---------+--------------+----------------+
 884  * |uncompressed size|time(DOS)|date(DOS)|attribute(DOS)|header level(=1)|
 885  * +-----------------+---------+---------+--------------+----------------+
 886  * *-------------------------------(*1)----------------------------------*
 887  *
 888  * +21             +22       +22+(*3)   +22+(*3)+2  +22+(*3)+3  +22+(*3)+3+(*4)
 889  * +---------------+---------+----------+-----------+-----------+
 890  * |name length(*3)|file name|file CRC16|  creator  |padding(*4)|
 891  * +---------------+---------+----------+-----------+-----------+
 892  *                  <--(*3)->
 893  * *----------------------------(*1)----------------------------*
 894  *
 895  * +22+(*3)+3+(*4)  +22+(*3)+3+(*4)+2     +22+(*3)+3+(*4)+2+(*5)
 896  * +----------------+---------------------+------------------------+
 897  * |next header size| extended header(*5) |     compressed data    |
 898  * +----------------+---------------------+------------------------+
 899  * *------(*1)-----> <--------------------(*2)-------------------->
 900  */
 901 #define H1_HEADER_SIZE_OFFSET   0
 902 #define H1_HEADER_SUM_OFFSET    1
 903 #define H1_COMP_SIZE_OFFSET     7
 904 #define H1_ORIG_SIZE_OFFSET     11
 905 #define H1_DOS_TIME_OFFSET      15
 906 #define H1_NAME_LEN_OFFSET      21
 907 #define H1_FILE_NAME_OFFSET     22
 908 #define H1_FIXED_SIZE           27
 909 static int
 910 lha_read_file_header_1(struct archive_read *a, struct lha *lha)
 911 {
 912         const unsigned char *p;
 913         size_t extdsize;
 914         int i, err, err2;
 915         int namelen, padding;
 916         unsigned char headersum, sum_calculated;
 917
 918         err = ARCHIVE_OK;
 919
 920         if ((p = __archive_read_ahead(a, H1_FIXED_SIZE, NULL)) == NULL)
 921                 return (truncated_error(a));
 922
 923         lha->header_size = p[H1_HEADER_SIZE_OFFSET] + 2;
 924         headersum = p[H1_HEADER_SUM_OFFSET];
 925         /* Note: An extended header size is included in a compsize. */
 926         lha->compsize = archive_le32dec(p + H1_COMP_SIZE_OFFSET);
 927         lha->origsize = archive_le32dec(p + H1_ORIG_SIZE_OFFSET);
 928         lha->mtime = lha_dos_time(p + H1_DOS_TIME_OFFSET);
 929         namelen = p[H1_NAME_LEN_OFFSET];
 930         /* Calculate a padding size. The result will be normally 0 only(?) */
 931         padding = ((int)lha->header_size) - H1_FIXED_SIZE - namelen;
 932
 933         if (namelen > 230 || padding < 0)
 934                 goto invalid;
 935
 936         if ((p = __archive_read_ahead(a, lha->header_size, NULL)) == NULL)
 937                 return (truncated_error(a));
 938
 939         for (i = 0; i < namelen; i++) {
 940                 if (p[i + H1_FILE_NAME_OFFSET] == 0xff)
 941                         goto invalid;/* Invalid filename. */
 942         }
 943         archive_strncpy(&lha->filename, p + H1_FILE_NAME_OFFSET, namelen);
 944         lha->crc = archive_le16dec(p + H1_FILE_NAME_OFFSET + namelen);
 945         lha->setflag |= CRC_IS_SET;
 946
 947         sum_calculated = lha_calcsum(0, p, 2, lha->header_size - 2);
 948         /* Consume used bytes but not include `next header size' data
 949          * since it will be consumed in lha_read_file_extended_header(). */
 950         __archive_read_consume(a, lha->header_size - 2);
 951
 952         /* Read extended headers */
 953         err2 = lha_read_file_extended_header(a, lha, NULL, 2,
 954             (size_t)(lha->compsize + 2), &extdsize);
 955         if (err2 < ARCHIVE_WARN)
 956                 return (err2);
 957         if (err2 < err)
 958                 err = err2;
 959         /* Get a real compressed file size. */
 960         lha->compsize -= extdsize - 2;
 961
 962         if (sum_calculated != headersum) {
 963                 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
 964                     "LHa header sum error");
 965                 return (ARCHIVE_FATAL);
 966         }
 967         return (err);
 968 invalid:
 969         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 970             "Invalid LHa header");
 971         return (ARCHIVE_FATAL);
 972 }
 973
 974 /*
 975  * Header 2 format
 976  *
 977  * +0              +2               +7                  +11               +15
 978  * +---------------+----------------+-------------------+-----------------+
 979  * |header size(*1)|compression type|compressed size(*2)|uncompressed size|
 980  * +---------------+----------------+-------------------+-----------------+
 981  *  <--------------------------------(*1)---------------------------------*
 982  *
 983  * +15               +19          +20              +21        +23         +24
 984  * +-----------------+------------+----------------+----------+-----------+
 985  * |data/time(time_t)| 0x20 fixed |header level(=2)|file CRC16|  creator  |
 986  * +-----------------+------------+----------------+----------+-----------+
 987  * *---------------------------------(*1)---------------------------------*
 988  *
 989  * +24              +26                 +26+(*3)      +26+(*3)+(*4)
 990  * +----------------+-------------------+-------------+-------------------+
 991  * |next header size|extended header(*3)| padding(*4) |  compressed data  |
 992  * +----------------+-------------------+-------------+-------------------+
 993  * *--------------------------(*1)-------------------> <------(*2)------->
 994  *
 995  */
 996 #define H2_HEADER_SIZE_OFFSET   0
 997 #define H2_COMP_SIZE_OFFSET     7
 998 #define H2_ORIG_SIZE_OFFSET     11
 999 #define H2_TIME_OFFSET          15
1000 #define H2_CRC_OFFSET           21
1001 #define H2_FIXED_SIZE           24
1002 static int
1003 lha_read_file_header_2(struct archive_read *a, struct lha *lha)
1004 {
1005         const unsigned char *p;
1006         size_t extdsize;
1007         int err, padding;
1008         uint16_t header_crc;
1009
1010         if ((p = __archive_read_ahead(a, H2_FIXED_SIZE, NULL)) == NULL)
1011                 return (truncated_error(a));
1012
1013         lha->header_size =archive_le16dec(p + H2_HEADER_SIZE_OFFSET);
1014         lha->compsize = archive_le32dec(p + H2_COMP_SIZE_OFFSET);
1015         lha->origsize = archive_le32dec(p + H2_ORIG_SIZE_OFFSET);
1016         lha->mtime = archive_le32dec(p + H2_TIME_OFFSET);
1017         lha->crc = archive_le16dec(p + H2_CRC_OFFSET);
1018         lha->setflag |= CRC_IS_SET;
1019
1020         if (lha->header_size < H2_FIXED_SIZE) {
1021                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1022                     "Invalid LHa header size");
1023                 return (ARCHIVE_FATAL);
1024         }
1025
1026         header_crc = lha_crc16(0, p, H2_FIXED_SIZE);
1027         __archive_read_consume(a, H2_FIXED_SIZE);
1028
1029         /* Read extended headers */
1030         err = lha_read_file_extended_header(a, lha, &header_crc, 2,
1031                   lha->header_size - H2_FIXED_SIZE, &extdsize);
1032         if (err < ARCHIVE_WARN)
1033                 return (err);
1034
1035         /* Calculate a padding size. The result will be normally 0 or 1. */
1036         padding = (int)lha->header_size - (int)(H2_FIXED_SIZE + extdsize);
1037         if (padding > 0) {
1038                 if ((p = __archive_read_ahead(a, padding, NULL)) == NULL)
1039                         return (truncated_error(a));
1040                 header_crc = lha_crc16(header_crc, p, padding);
1041                 __archive_read_consume(a, padding);
1042         }
1043
1044         if (header_crc != lha->header_crc) {
1045                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1046                     "LHa header CRC error");
1047                 return (ARCHIVE_FATAL);
1048         }
1049         return (err);
1050 }
1051
1052 /*
1053  * Header 3 format
1054  *
1055  * +0           +2               +7                  +11               +15
1056  * +------------+----------------+-------------------+-----------------+
1057  * | 0x04 fixed |compression type|compressed size(*2)|uncompressed size|
1058  * +------------+----------------+-------------------+-----------------+
1059  *  <-------------------------------(*1)-------------------------------*
1060  *
1061  * +15               +19          +20              +21        +23         +24
1062  * +-----------------+------------+----------------+----------+-----------+
1063  * |date/time(time_t)| 0x20 fixed |header level(=3)|file CRC16|  creator  |
1064  * +-----------------+------------+----------------+----------+-----------+
1065  * *--------------------------------(*1)----------------------------------*
1066  *
1067  * +24             +28              +32                 +32+(*3)
1068  * +---------------+----------------+-------------------+-----------------+
1069  * |header size(*1)|next header size|extended header(*3)| compressed data |
1070  * +---------------+----------------+-------------------+-----------------+
1071  * *------------------------(*1)-----------------------> <------(*2)----->
1072  *
1073  */
1074 #define H3_FIELD_LEN_OFFSET     0
1075 #define H3_COMP_SIZE_OFFSET     7
1076 #define H3_ORIG_SIZE_OFFSET     11
1077 #define H3_TIME_OFFSET          15
1078 #define H3_CRC_OFFSET           21
1079 #define H3_HEADER_SIZE_OFFSET   24
1080 #define H3_FIXED_SIZE           28
1081 static int
1082 lha_read_file_header_3(struct archive_read *a, struct lha *lha)
1083 {
1084         const unsigned char *p;
1085         size_t extdsize;
1086         int err;
1087         uint16_t header_crc;
1088
1089         if ((p = __archive_read_ahead(a, H3_FIXED_SIZE, NULL)) == NULL)
1090                 return (truncated_error(a));
1091
1092         if (archive_le16dec(p + H3_FIELD_LEN_OFFSET) != 4)
1093                 goto invalid;
1094         lha->header_size =archive_le32dec(p + H3_HEADER_SIZE_OFFSET);
1095         lha->compsize = archive_le32dec(p + H3_COMP_SIZE_OFFSET);
1096         lha->origsize = archive_le32dec(p + H3_ORIG_SIZE_OFFSET);
1097         lha->mtime = archive_le32dec(p + H3_TIME_OFFSET);
1098         lha->crc = archive_le16dec(p + H3_CRC_OFFSET);
1099         lha->setflag |= CRC_IS_SET;
1100
1101         if (lha->header_size < H3_FIXED_SIZE + 4)
1102                 goto invalid;
1103         header_crc = lha_crc16(0, p, H3_FIXED_SIZE);
1104         __archive_read_consume(a, H3_FIXED_SIZE);
1105
1106         /* Read extended headers */
1107         err = lha_read_file_extended_header(a, lha, &header_crc, 4,
1108                   lha->header_size - H3_FIXED_SIZE, &extdsize);
1109         if (err < ARCHIVE_WARN)
1110                 return (err);
1111
1112         if (header_crc != lha->header_crc) {
1113                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1114                     "LHa header CRC error");
1115                 return (ARCHIVE_FATAL);
1116         }
1117         return (err);
1118 invalid:
1119         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1120             "Invalid LHa header");
1121         return (ARCHIVE_FATAL);
1122 }
1123
1124 /*
1125  * Extended header format
1126  *
1127  * +0             +2        +3  -- used in header 1 and 2
1128  * +0             +4        +5  -- used in header 3
1129  * +--------------+---------+-------------------+--------------+--
1130  * |ex-header size|header id|        data       |ex-header size| .......
1131  * +--------------+---------+-------------------+--------------+--
1132  *  <-------------( ex-header size)------------> <-- next extended header --*
1133  *
1134  * If the ex-header size is zero, it is the make of the end of extended
1135  * headers.
1136  *
1137  */
1138 static int
1139 lha_read_file_extended_header(struct archive_read *a, struct lha *lha,
1140     uint16_t *crc, int sizefield_length, size_t limitsize, size_t *total_size)
1141 {
1142         const void *h;
1143         const unsigned char *extdheader;
1144         size_t  extdsize;
1145         size_t  datasize;
1146         unsigned int i;
1147         unsigned char extdtype;
1148
1149 #define EXT_HEADER_CRC          0x00            /* Header CRC and information*/
1150 #define EXT_FILENAME            0x01            /* Filename                 */
1151 #define EXT_DIRECTORY           0x02            /* Directory name           */
1152 #define EXT_DOS_ATTR            0x40            /* MS-DOS attribute         */
1153 #define EXT_TIMESTAMP           0x41            /* Windows time stamp       */
1154 #define EXT_FILESIZE            0x42            /* Large file size          */
1155 #define EXT_TIMEZONE            0x43            /* Time zone                */
1156 #define EXT_UTF16_FILENAME      0x44            /* UTF-16 filename          */
1157 #define EXT_UTF16_DIRECTORY     0x45            /* UTF-16 directory name    */
1158 #define EXT_CODEPAGE            0x46            /* Codepage                 */
1159 #define EXT_UNIX_MODE           0x50            /* File permission          */
1160 #define EXT_UNIX_GID_UID        0x51            /* gid,uid                  */
1161 #define EXT_UNIX_GNAME          0x52            /* Group name               */
1162 #define EXT_UNIX_UNAME          0x53            /* User name                */
1163 #define EXT_UNIX_MTIME          0x54            /* Modified time            */
1164 #define EXT_OS2_NEW_ATTR        0x7f            /* new attribute(OS/2 only) */
1165 #define EXT_NEW_ATTR            0xff            /* new attribute            */
1166
1167         *total_size = sizefield_length;
1168
1169         for (;;) {
1170                 /* Read an extended header size. */
1171                 if ((h =
1172                     __archive_read_ahead(a, sizefield_length, NULL)) == NULL)
1173                         return (truncated_error(a));
1174                 /* Check if the size is the zero indicates the end of the
1175                  * extended header. */
1176                 if (sizefield_length == sizeof(uint16_t))
1177                         extdsize = archive_le16dec(h);
1178                 else
1179                         extdsize = archive_le32dec(h);
1180                 if (extdsize == 0) {
1181                         /* End of extended header */
1182                         if (crc != NULL)
1183                                 *crc = lha_crc16(*crc, h, sizefield_length);
1184                         __archive_read_consume(a, sizefield_length);
1185                         return (ARCHIVE_OK);
1186                 }
1187
1188                 /* Sanity check to the extended header size. */
1189                 if (((uint64_t)*total_size + extdsize) >
1190                                     (uint64_t)limitsize ||
1191                     extdsize <= (size_t)sizefield_length)
1192                         goto invalid;
1193
1194                 /* Read the extended header. */
1195                 if ((h = __archive_read_ahead(a, extdsize, NULL)) == NULL)
1196                         return (truncated_error(a));
1197                 *total_size += extdsize;
1198
1199                 extdheader = (const unsigned char *)h;
1200                 /* Get the extended header type. */
1201                 extdtype = extdheader[sizefield_length];
1202                 /* Calculate an extended data size. */
1203                 datasize = extdsize - (1 + sizefield_length);
1204                 /* Skip an extended header size field and type field. */
1205                 extdheader += sizefield_length + 1;
1206
1207                 if (crc != NULL && extdtype != EXT_HEADER_CRC)
1208                         *crc = lha_crc16(*crc, h, extdsize);
1209                 switch (extdtype) {
1210                 case EXT_HEADER_CRC:
1211                         /* We only use a header CRC. Following data will not
1212                          * be used. */
1213                         if (datasize >= 2) {
1214                                 lha->header_crc = archive_le16dec(extdheader);
1215                                 if (crc != NULL) {
1216                                         static const char zeros[2] = {0, 0};
1217                                         *crc = lha_crc16(*crc, h,
1218                                             extdsize - datasize);
1219                                         /* CRC value itself as zero */
1220                                         *crc = lha_crc16(*crc, zeros, 2);
1221                                         *crc = lha_crc16(*crc,
1222                                             extdheader+2, datasize - 2);
1223                                 }
1224                         }
1225                         break;
1226                 case EXT_FILENAME:
1227                         if (datasize == 0) {
1228                                 /* maybe directory header */
1229                                 archive_string_empty(&lha->filename);
1230                                 break;
1231                         }
1232                         archive_strncpy(&lha->filename,
1233                             (const char *)extdheader, datasize);
1234                         break;
1235                 case EXT_DIRECTORY:
1236                         if (datasize == 0)
1237                                 /* no directory name data. exit this case. */
1238                                 break;
1239
1240                         archive_strncpy(&lha->dirname,
1241                             (const char *)extdheader, datasize);
1242                         /*
1243                          * Convert directory delimiter from 0xFF
1244                          * to '/' for local system.
1245                          */
1246                         for (i = 0; i < lha->dirname.length; i++) {
1247                                 if ((unsigned char)lha->dirname.s[i] == 0xFF)
1248                                         lha->dirname.s[i] = '/';
1249                         }
1250                         /* Is last character directory separator? */
1251                         if (lha->dirname.s[lha->dirname.length-1] != '/')
1252                                 /* invalid directory data */
1253                                 goto invalid;
1254                         break;
1255                 case EXT_DOS_ATTR:
1256                         if (datasize == 2)
1257                                 lha->dos_attr = (unsigned char)
1258                                     (archive_le16dec(extdheader) & 0xff);
1259                         break;
1260                 case EXT_TIMESTAMP:
1261                         if (datasize == (sizeof(uint64_t) * 3)) {
1262                                 lha->birthtime = lha_win_time(
1263                                     archive_le64dec(extdheader),
1264                                     &lha->birthtime_tv_nsec);
1265                                 extdheader += sizeof(uint64_t);
1266                                 lha->mtime = lha_win_time(
1267                                     archive_le64dec(extdheader),
1268                                     &lha->mtime_tv_nsec);
1269                                 extdheader += sizeof(uint64_t);
1270                                 lha->atime = lha_win_time(
1271                                     archive_le64dec(extdheader),
1272                                     &lha->atime_tv_nsec);
1273                                 lha->setflag |= BIRTHTIME_IS_SET |
1274                                     ATIME_IS_SET;
1275                         }
1276                         break;
1277                 case EXT_FILESIZE:
1278                         if (datasize == sizeof(uint64_t) * 2) {
1279                                 lha->compsize = archive_le64dec(extdheader);
1280                                 extdheader += sizeof(uint64_t);
1281                                 lha->origsize = archive_le64dec(extdheader);
1282                         }
1283                         break;
1284                 case EXT_CODEPAGE:
1285                         /* Get an archived filename charset from codepage.
1286                          * This overwrites the charset specified by
1287                          * hdrcharset option. */
1288                         if (datasize == sizeof(uint32_t)) {
1289                                 struct archive_string cp;
1290                                 const char *charset;
1291
1292                                 archive_string_init(&cp);
1293                                 switch (archive_le32dec(extdheader)) {
1294                                 case 65001: /* UTF-8 */
1295                                         charset = "UTF-8";
1296                                         break;
1297                                 default:
1298                                         archive_string_sprintf(&cp, "CP%d",
1299                                             (int)archive_le32dec(extdheader));
1300                                         charset = cp.s;
1301                                         break;
1302                                 }
1303                                 lha->sconv =
1304                                     archive_string_conversion_from_charset(
1305                                         &(a->archive), charset, 1);
1306                                 archive_string_free(&cp);
1307                                 if (lha->sconv == NULL)
1308                                         return (ARCHIVE_FATAL);
1309                         }
1310                         break;
1311                 case EXT_UNIX_MODE:
1312                         if (datasize == sizeof(uint16_t)) {
1313                                 lha->mode = archive_le16dec(extdheader);
1314                                 lha->setflag |= UNIX_MODE_IS_SET;
1315                         }
1316                         break;
1317                 case EXT_UNIX_GID_UID:
1318                         if (datasize == (sizeof(uint16_t) * 2)) {
1319                                 lha->gid = archive_le16dec(extdheader);
1320                                 lha->uid = archive_le16dec(extdheader+2);
1321                         }
1322                         break;
1323                 case EXT_UNIX_GNAME:
1324                         if (datasize > 0)
1325                                 archive_strncpy(&lha->gname,
1326                                     (const char *)extdheader, datasize);
1327                         break;
1328                 case EXT_UNIX_UNAME:
1329                         if (datasize > 0)
1330                                 archive_strncpy(&lha->uname,
1331                                     (const char *)extdheader, datasize);
1332                         break;
1333                 case EXT_UNIX_MTIME:
1334                         if (datasize == sizeof(uint32_t))
1335                                 lha->mtime = archive_le32dec(extdheader);
1336                         break;
1337                 case EXT_OS2_NEW_ATTR:
1338                         /* This extended header is OS/2 depend. */
1339                         if (datasize == 16) {
1340                                 lha->dos_attr = (unsigned char)
1341                                     (archive_le16dec(extdheader) & 0xff);
1342                                 lha->mode = archive_le16dec(extdheader+2);
1343                                 lha->gid = archive_le16dec(extdheader+4);
1344                                 lha->uid = archive_le16dec(extdheader+6);
1345                                 lha->birthtime = archive_le32dec(extdheader+8);
1346                                 lha->atime = archive_le32dec(extdheader+12);
1347                                 lha->setflag |= UNIX_MODE_IS_SET
1348                                     | BIRTHTIME_IS_SET | ATIME_IS_SET;
1349                         }
1350                         break;
1351                 case EXT_NEW_ATTR:
1352                         if (datasize == 20) {
1353                                 lha->mode = (mode_t)archive_le32dec(extdheader);
1354                                 lha->gid = archive_le32dec(extdheader+4);
1355                                 lha->uid = archive_le32dec(extdheader+8);
1356                                 lha->birthtime = archive_le32dec(extdheader+12);
1357                                 lha->atime = archive_le32dec(extdheader+16);
1358                                 lha->setflag |= UNIX_MODE_IS_SET
1359                                     | BIRTHTIME_IS_SET | ATIME_IS_SET;
1360                         }
1361                         break;
1362                 case EXT_TIMEZONE:              /* Not supported */
1363                 case EXT_UTF16_FILENAME:        /* Not supported */
1364                 case EXT_UTF16_DIRECTORY:       /* Not supported */
1365                 default:
1366                         break;
1367                 }
1368
1369                 __archive_read_consume(a, extdsize);
1370         }
1371 invalid:
1372         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1373             "Invalid extended LHa header");
1374         return (ARCHIVE_FATAL);
1375 }
1376
1377 static int
1378 archive_read_format_lha_read_data(struct archive_read *a,
1379     const void **buff, size_t *size, int64_t *offset)
1380 {
1381         struct lha *lha = (struct lha *)(a->format->data);
1382         int r;
1383
1384         if (lha->entry_unconsumed) {
1385                 /* Consume as much as the decompressor actually used. */
1386                 __archive_read_consume(a, lha->entry_unconsumed);
1387                 lha->entry_unconsumed = 0;
1388         }
1389         if (lha->end_of_entry) {
1390                 if (!lha->end_of_entry_cleanup) {
1391                         if ((lha->setflag & CRC_IS_SET) &&
1392                             lha->crc != lha->entry_crc_calculated) {
1393                                 archive_set_error(&a->archive,
1394                                     ARCHIVE_ERRNO_MISC,
1395                                     "LHa data CRC error");
1396                                 return (ARCHIVE_WARN);
1397                         }
1398
1399                         /* End-of-entry cleanup done. */
1400                         lha->end_of_entry_cleanup = 1;
1401                 }
1402                 *offset = lha->entry_offset;
1403                 *size = 0;
1404                 *buff = NULL;
1405                 return (ARCHIVE_EOF);
1406         }
1407
1408         if (lha->entry_is_compressed)
1409                 r =  lha_read_data_lzh(a, buff, size, offset);
1410         else
1411                 /* No compression. */
1412                 r =  lha_read_data_none(a, buff, size, offset);
1413         return (r);
1414 }
1415
1416 /*
1417  * Read a file content in no compression.
1418  *
1419  * Returns ARCHIVE_OK if successful, ARCHIVE_FATAL otherwise, sets
1420  * lha->end_of_entry if it consumes all of the data.
1421  */
1422 static int
1423 lha_read_data_none(struct archive_read *a, const void **buff,
1424     size_t *size, int64_t *offset)
1425 {
1426         struct lha *lha = (struct lha *)(a->format->data);
1427         ssize_t bytes_avail;
1428
1429         if (lha->entry_bytes_remaining == 0) {
1430                 *buff = NULL;
1431                 *size = 0;
1432                 *offset = lha->entry_offset;
1433                 lha->end_of_entry = 1;
1434                 return (ARCHIVE_OK);
1435         }
1436         /*
1437          * Note: '1' here is a performance optimization.
1438          * Recall that the decompression layer returns a count of
1439          * available bytes; asking for more than that forces the
1440          * decompressor to combine reads by copying data.
1441          */
1442         *buff = __archive_read_ahead(a, 1, &bytes_avail);
1443         if (bytes_avail <= 0) {
1444                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1445                     "Truncated LHa file data");
1446                 return (ARCHIVE_FATAL);
1447         }
1448         if (bytes_avail > lha->entry_bytes_remaining)
1449                 bytes_avail = (ssize_t)lha->entry_bytes_remaining;
1450         lha->entry_crc_calculated =
1451             lha_crc16(lha->entry_crc_calculated, *buff, bytes_avail);
1452         *size = bytes_avail;
1453         *offset = lha->entry_offset;
1454         lha->entry_offset += bytes_avail;
1455         lha->entry_bytes_remaining -= bytes_avail;
1456         if (lha->entry_bytes_remaining == 0)
1457                 lha->end_of_entry = 1;
1458         lha->entry_unconsumed = bytes_avail;
1459         return (ARCHIVE_OK);
1460 }
1461
1462 /*
1463  * Read a file content in LZHUFF encoding.
1464  *
1465  * Returns ARCHIVE_OK if successful, returns ARCHIVE_WARN if compression is
1466  * unsupported, ARCHIVE_FATAL otherwise, sets lha->end_of_entry if it consumes
1467  * all of the data.
1468  */
1469 static int
1470 lha_read_data_lzh(struct archive_read *a, const void **buff,
1471     size_t *size, int64_t *offset)
1472 {
1473         struct lha *lha = (struct lha *)(a->format->data);
1474         ssize_t bytes_avail;
1475         int r;
1476
1477         /* If the buffer hasn't been allocated, allocate it now. */
1478         if (lha->uncompressed_buffer == NULL) {
1479                 lha->uncompressed_buffer_size = 64 * 1024;
1480                 lha->uncompressed_buffer
1481                     = (unsigned char *)malloc(lha->uncompressed_buffer_size);
1482                 if (lha->uncompressed_buffer == NULL) {
1483                         archive_set_error(&a->archive, ENOMEM,
1484                             "No memory for lzh decompression");
1485                         return (ARCHIVE_FATAL);
1486                 }
1487         }
1488
1489         /* If we haven't yet read any data, initialize the decompressor. */
1490         if (!lha->decompress_init) {
1491                 r = lzh_decode_init(&(lha->strm), lha->method);
1492                 switch (r) {
1493                 case ARCHIVE_OK:
1494                         break;
1495                 case ARCHIVE_FAILED:
1496                         /* Unsupported compression. */
1497                         *buff = NULL;
1498                         *size = 0;
1499                         *offset = 0;
1500                         archive_set_error(&a->archive,
1501                             ARCHIVE_ERRNO_FILE_FORMAT,
1502                             "Unsupported lzh compression method -%c%c%c-",
1503                             lha->method[0], lha->method[1], lha->method[2]);
1504                         /* We know compressed size; just skip it. */
1505                         archive_read_format_lha_read_data_skip(a);
1506                         return (ARCHIVE_WARN);
1507                 default:
1508                         archive_set_error(&a->archive, ENOMEM,
1509                             "Couldn't allocate memory "
1510                             "for lzh decompression");
1511                         return (ARCHIVE_FATAL);
1512                 }
1513                 /* We've initialized decompression for this stream. */
1514                 lha->decompress_init = 1;
1515                 lha->strm.avail_out = 0;
1516                 lha->strm.total_out = 0;
1517         }
1518
1519         /*
1520          * Note: '1' here is a performance optimization.
1521          * Recall that the decompression layer returns a count of
1522          * available bytes; asking for more than that forces the
1523          * decompressor to combine reads by copying data.
1524          */
1525         lha->strm.next_in = __archive_read_ahead(a, 1, &bytes_avail);
1526         if (bytes_avail <= 0) {
1527                 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1528                     "Truncated LHa file body");
1529                 return (ARCHIVE_FATAL);
1530         }
1531         if (bytes_avail > lha->entry_bytes_remaining)
1532                 bytes_avail = (ssize_t)lha->entry_bytes_remaining;
1533
1534         lha->strm.avail_in = bytes_avail;
1535         lha->strm.total_in = 0;
1536         if (lha->strm.avail_out == 0) {
1537                 lha->strm.next_out = lha->uncompressed_buffer;
1538                 lha->strm.avail_out = lha->uncompressed_buffer_size;
1539         }
1540
1541         r = lzh_decode(&(lha->strm), bytes_avail == lha->entry_bytes_remaining);
1542         switch (r) {
1543         case ARCHIVE_OK:
1544                 break;
1545         case ARCHIVE_EOF:
1546                 lha->end_of_entry = 1;
1547                 break;
1548         default:
1549                 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1550                     "Bad lzh data");
1551                 return (ARCHIVE_FAILED);
1552         }
1553         lha->entry_unconsumed = lha->strm.total_in;
1554         lha->entry_bytes_remaining -= lha->strm.total_in;
1555
1556         if (lha->strm.avail_out == 0 || lha->end_of_entry) {
1557                 *offset = lha->entry_offset;
1558                 *size = lha->strm.next_out - lha->uncompressed_buffer;
1559                 *buff = lha->uncompressed_buffer;
1560                 lha->entry_crc_calculated =
1561                     lha_crc16(lha->entry_crc_calculated, *buff, *size);
1562                 lha->entry_offset += *size;
1563         } else {
1564                 *offset = lha->entry_offset;
1565                 *size = 0;
1566                 *buff = NULL;
1567         }
1568         return (ARCHIVE_OK);
1569 }
1570
1571 /*
1572  * Skip a file content.
1573  */
1574 static int
1575 archive_read_format_lha_read_data_skip(struct archive_read *a)
1576 {
1577         struct lha *lha;
1578         int64_t bytes_skipped;
1579
1580         lha = (struct lha *)(a->format->data);
1581
1582         if (lha->entry_unconsumed) {
1583                 /* Consume as much as the decompressor actually used. */
1584                 __archive_read_consume(a, lha->entry_unconsumed);
1585                 lha->entry_unconsumed = 0;
1586         }
1587
1588         /* if we've already read to end of data, we're done. */
1589         if (lha->end_of_entry_cleanup)
1590                 return (ARCHIVE_OK);
1591
1592         /*
1593          * If the length is at the beginning, we can skip the
1594          * compressed data much more quickly.
1595          */
1596         bytes_skipped = __archive_read_consume(a, lha->entry_bytes_remaining);
1597         if (bytes_skipped < 0)
1598                 return (ARCHIVE_FATAL);
1599
1600         /* This entry is finished and done. */
1601         lha->end_of_entry_cleanup = lha->end_of_entry = 1;
1602         return (ARCHIVE_OK);
1603 }
1604
1605 static int
1606 archive_read_format_lha_cleanup(struct archive_read *a)
1607 {
1608         struct lha *lha = (struct lha *)(a->format->data);
1609
1610         lzh_decode_free(&(lha->strm));
1611         free(lha->uncompressed_buffer);
1612         archive_string_free(&(lha->dirname));
1613         archive_string_free(&(lha->filename));
1614         archive_string_free(&(lha->uname));
1615         archive_string_free(&(lha->gname));
1616         archive_wstring_free(&(lha->ws));
1617         free(lha);
1618         (a->format->data) = NULL;
1619         return (ARCHIVE_OK);
1620 }
1621
1622 /*
1623  * 'LHa for UNIX' utility has archived a symbolic-link name after
1624  * a pathname with '|' character.
1625  * This function extracts the symbolic-link name from the pathname.
1626  *
1627  * example.
1628  *   1. a symbolic-name is 'aaa/bb/cc'
1629  *   2. a filename is 'xxx/bbb'
1630  *  then a archived pathname is 'xxx/bbb|aaa/bb/cc'
1631  */
1632 static int
1633 lha_parse_linkname(struct archive_string *linkname,
1634     struct archive_string *pathname)
1635 {
1636         char *  linkptr;
1637         int     symlen;
1638
1639         linkptr = strchr(pathname->s, '|');
1640         if (linkptr != NULL) {
1641                 symlen = strlen(linkptr + 1);
1642                 archive_strncpy(linkname, linkptr+1, symlen);
1643
1644                 *linkptr = 0;
1645                 pathname->length = strlen(pathname->s);
1646
1647                 return (1);
1648         }
1649         return (0);
1650 }
1651
1652 /* Convert an MSDOS-style date/time into Unix-style time. */
1653 static time_t
1654 lha_dos_time(const unsigned char *p)
1655 {
1656         int msTime, msDate;
1657         struct tm ts;
1658
1659         msTime = archive_le16dec(p);
1660         msDate = archive_le16dec(p+2);
1661
1662         memset(&ts, 0, sizeof(ts));
1663         ts.tm_year = ((msDate >> 9) & 0x7f) + 80;   /* Years since 1900. */
1664         ts.tm_mon = ((msDate >> 5) & 0x0f) - 1;     /* Month number.     */
1665         ts.tm_mday = msDate & 0x1f;                 /* Day of month.     */
1666         ts.tm_hour = (msTime >> 11) & 0x1f;
1667         ts.tm_min = (msTime >> 5) & 0x3f;
1668         ts.tm_sec = (msTime << 1) & 0x3e;
1669         ts.tm_isdst = -1;
1670         return (mktime(&ts));
1671 }
1672
1673 /* Convert an MS-Windows-style date/time into Unix-style time. */
1674 static time_t
1675 lha_win_time(uint64_t wintime, long *ns)
1676 {
1677 #define EPOC_TIME ARCHIVE_LITERAL_ULL(116444736000000000)
1678
1679         if (wintime >= EPOC_TIME) {
1680                 wintime -= EPOC_TIME;   /* 1970-01-01 00:00:00 (UTC) */
1681                 if (ns != NULL)
1682                         *ns = (long)(wintime % 10000000) * 100;
1683                 return (wintime / 10000000);
1684         } else {
1685                 if (ns != NULL)
1686                         *ns = 0;
1687                 return (0);
1688         }
1689 }
1690
1691 static unsigned char
1692 lha_calcsum(unsigned char sum, const void *pp, int offset, int size)
1693 {
1694         unsigned char const *p = (unsigned char const *)pp;
1695
1696         p += offset;
1697         while (--size >= 0)
1698                 sum += *p++;
1699         return (sum);
1700 }
1701
1702 #define CRC16(crc, v)   do {    \
1703         (crc) = crc16tbl[((crc) ^ v) & 0xFF] ^ ((crc) >> 8);    \
1704 } while (0)
1705
1706 static uint16_t
1707 lha_crc16(uint16_t crc, const void *pp, size_t len)
1708 {
1709         const unsigned char *buff = (const unsigned char *)pp;
1710
1711         while (len >= 8) {
1712                 CRC16(crc, *buff++); CRC16(crc, *buff++);
1713                 CRC16(crc, *buff++); CRC16(crc, *buff++);
1714                 CRC16(crc, *buff++); CRC16(crc, *buff++);
1715                 CRC16(crc, *buff++); CRC16(crc, *buff++);
1716                 len -= 8;
1717         }
1718         switch (len) {
1719         case 7:
1720                 CRC16(crc, *buff++);
1721                 /* FALL THROUGH */
1722         case 6:
1723                 CRC16(crc, *buff++);
1724                 /* FALL THROUGH */
1725         case 5:
1726                 CRC16(crc, *buff++);
1727                 /* FALL THROUGH */
1728         case 4:
1729                 CRC16(crc, *buff++);
1730                 /* FALL THROUGH */
1731         case 3:
1732                 CRC16(crc, *buff++);
1733                 /* FALL THROUGH */
1734         case 2:
1735                 CRC16(crc, *buff++);
1736                 /* FALL THROUGH */
1737         case 1:
1738                 CRC16(crc, *buff);
1739                 /* FALL THROUGH */
1740         case 0:
1741                 break;
1742         }
1743         return (crc);
1744 }
1745
1746
1747 /*
1748  * Initialize LZHUF decoder.
1749  *
1750  * Returns ARCHIVE_OK if initialization was successful.
1751  * Returns ARCHIVE_FAILED if method is unsupported.
1752  * Returns ARCHIVE_FATAL if initialization failed; memory allocation
1753  * error occurred.
1754  */
1755 static int
1756 lzh_decode_init(struct lzh_stream *strm, const char *method)
1757 {
1758         struct lzh_dec *ds;
1759         int w_bits, w_size;
1760
1761         if (strm->ds == NULL) {
1762                 strm->ds = calloc(1, sizeof(*strm->ds));
1763                 if (strm->ds == NULL)
1764                         return (ARCHIVE_FATAL);
1765         }
1766         ds = strm->ds;
1767         ds->error = ARCHIVE_FAILED;
1768         if (method == NULL || method[0] != 'l' || method[1] != 'h')
1769                 return (ARCHIVE_FAILED);
1770         switch (method[2]) {
1771         case '5':
1772                 w_bits = 13;/* 8KiB for window */
1773                 break;
1774         case '6':
1775                 w_bits = 15;/* 32KiB for window */
1776                 break;
1777         case '7':
1778                 w_bits = 16;/* 64KiB for window */
1779                 break;
1780         default:
1781                 return (ARCHIVE_FAILED);/* Not supported. */
1782         }
1783         ds->error = ARCHIVE_FATAL;
1784         w_size = ds->w_size;
1785         ds->w_size = 1U << w_bits;
1786         ds->w_mask = ds->w_size -1;
1787         if (ds->w_buff == NULL || w_size != ds->w_size) {
1788                 free(ds->w_buff);
1789                 ds->w_buff = malloc(ds->w_size);
1790                 if (ds->w_buff == NULL)
1791                         return (ARCHIVE_FATAL);
1792         }
1793         memset(ds->w_buff, 0x20, ds->w_size);
1794         ds->w_pos = 0;
1795         ds->w_remaining = 0;
1796         ds->state = 0;
1797         ds->pos_pt_len_size = w_bits + 1;
1798         ds->pos_pt_len_bits = (w_bits == 15 || w_bits == 16)? 5: 4;
1799         ds->literal_pt_len_size = PT_BITLEN_SIZE;
1800         ds->literal_pt_len_bits = 5;
1801         ds->br.cache_buffer = 0;
1802         ds->br.cache_avail = 0;
1803
1804         if (lzh_huffman_init(&(ds->lt), LT_BITLEN_SIZE, 16)
1805             != ARCHIVE_OK)
1806                 return (ARCHIVE_FATAL);
1807         ds->lt.len_bits = 9;
1808         if (lzh_huffman_init(&(ds->pt), PT_BITLEN_SIZE, 16)
1809             != ARCHIVE_OK)
1810                 return (ARCHIVE_FATAL);
1811         ds->error = 0;
1812
1813         return (ARCHIVE_OK);
1814 }
1815
1816 /*
1817  * Release LZHUF decoder.
1818  */
1819 static void
1820 lzh_decode_free(struct lzh_stream *strm)
1821 {
1822
1823         if (strm->ds == NULL)
1824                 return;
1825         free(strm->ds->w_buff);
1826         lzh_huffman_free(&(strm->ds->lt));
1827         lzh_huffman_free(&(strm->ds->pt));
1828         free(strm->ds);
1829         strm->ds = NULL;
1830 }
1831
1832 /*
1833  * Bit stream reader.
1834  */
1835 /* Check that the cache buffer has enough bits. */
1836 #define lzh_br_has(br, n)       ((br)->cache_avail >= n)
1837 /* Get compressed data by bit. */
1838 #define lzh_br_bits(br, n)                              \
1839         (((uint16_t)((br)->cache_buffer >>              \
1840                 ((br)->cache_avail - (n)))) & cache_masks[n])
1841 #define lzh_br_bits_forced(br, n)                       \
1842         (((uint16_t)((br)->cache_buffer <<              \
1843                 ((n) - (br)->cache_avail))) & cache_masks[n])
1844 /* Read ahead to make sure the cache buffer has enough compressed data we
1845  * will use.
1846  *  True  : completed, there is enough data in the cache buffer.
1847  *  False : we met that strm->next_in is empty, we have to get following
1848  *          bytes. */
1849 #define lzh_br_read_ahead_0(strm, br, n)        \
1850         (lzh_br_has(br, (n)) || lzh_br_fillup(strm, br))
1851 /*  True  : the cache buffer has some bits as much as we need.
1852  *  False : there are no enough bits in the cache buffer to be used,
1853  *          we have to get following bytes if we could. */
1854 #define lzh_br_read_ahead(strm, br, n)  \
1855         (lzh_br_read_ahead_0((strm), (br), (n)) || lzh_br_has((br), (n)))
1856
1857 /* Notify how many bits we consumed. */
1858 #define lzh_br_consume(br, n)   ((br)->cache_avail -= (n))
1859 #define lzh_br_unconsume(br, n) ((br)->cache_avail += (n))
1860
1861 static const uint16_t cache_masks[] = {
1862         0x0000, 0x0001, 0x0003, 0x0007,
1863         0x000F, 0x001F, 0x003F, 0x007F,
1864         0x00FF, 0x01FF, 0x03FF, 0x07FF,
1865         0x0FFF, 0x1FFF, 0x3FFF, 0x7FFF,
1866         0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF
1867 };
1868
1869 /*
1870  * Shift away used bits in the cache data and fill it up with following bits.
1871  * Call this when cache buffer does not have enough bits you need.
1872  *
1873  * Returns 1 if the cache buffer is full.
1874  * Returns 0 if the cache buffer is not full; input buffer is empty.
1875  */
1876 static int
1877 lzh_br_fillup(struct lzh_stream *strm, struct lzh_br *br)
1878 {
1879         int n = CACHE_BITS - br->cache_avail;
1880
1881         for (;;) {
1882                 switch (n >> 3) {
1883                 case 8:
1884                         if (strm->avail_in >= 8) {
1885                                 br->cache_buffer =
1886                                     ((uint64_t)strm->next_in[0]) << 56 |
1887                                     ((uint64_t)strm->next_in[1]) << 48 |
1888                                     ((uint64_t)strm->next_in[2]) << 40 |
1889                                     ((uint64_t)strm->next_in[3]) << 32 |
1890                                     ((uint32_t)strm->next_in[4]) << 24 |
1891                                     ((uint32_t)strm->next_in[5]) << 16 |
1892                                     ((uint32_t)strm->next_in[6]) << 8 |
1893                                      (uint32_t)strm->next_in[7];
1894                                 strm->next_in += 8;
1895                                 strm->avail_in -= 8;
1896                                 br->cache_avail += 8 * 8;
1897                                 return (1);
1898                         }
1899                         break;
1900                 case 7:
1901                         if (strm->avail_in >= 7) {
1902                                 br->cache_buffer =
1903                                    (br->cache_buffer << 56) |
1904                                     ((uint64_t)strm->next_in[0]) << 48 |
1905                                     ((uint64_t)strm->next_in[1]) << 40 |
1906                                     ((uint64_t)strm->next_in[2]) << 32 |
1907                                     ((uint32_t)strm->next_in[3]) << 24 |
1908                                     ((uint32_t)strm->next_in[4]) << 16 |
1909                                     ((uint32_t)strm->next_in[5]) << 8 |
1910                                      (uint32_t)strm->next_in[6];
1911                                 strm->next_in += 7;
1912                                 strm->avail_in -= 7;
1913                                 br->cache_avail += 7 * 8;
1914                                 return (1);
1915                         }
1916                         break;
1917                 case 6:
1918                         if (strm->avail_in >= 6) {
1919                                 br->cache_buffer =
1920                                    (br->cache_buffer << 48) |
1921                                     ((uint64_t)strm->next_in[0]) << 40 |
1922                                     ((uint64_t)strm->next_in[1]) << 32 |
1923                                     ((uint32_t)strm->next_in[2]) << 24 |
1924                                     ((uint32_t)strm->next_in[3]) << 16 |
1925                                     ((uint32_t)strm->next_in[4]) << 8 |
1926                                      (uint32_t)strm->next_in[5];
1927                                 strm->next_in += 6;
1928                                 strm->avail_in -= 6;
1929                                 br->cache_avail += 6 * 8;
1930                                 return (1);
1931                         }
1932                         break;
1933                 case 0:
1934                         /* We have enough compressed data in
1935                          * the cache buffer.*/
1936                         return (1);
1937                 default:
1938                         break;
1939                 }
1940                 if (strm->avail_in == 0) {
1941                         /* There is not enough compressed data to fill up the
1942                          * cache buffer. */
1943                         return (0);
1944                 }
1945                 br->cache_buffer =
1946                    (br->cache_buffer << 8) | *strm->next_in++;
1947                 strm->avail_in--;
1948                 br->cache_avail += 8;
1949                 n -= 8;
1950         }
1951 }
1952
1953 /*
1954  * Decode LZHUF.
1955  *
1956  * 1. Returns ARCHIVE_OK if output buffer or input buffer are empty.
1957  *    Please set available buffer and call this function again.
1958  * 2. Returns ARCHIVE_EOF if decompression has been completed.
1959  * 3. Returns ARCHIVE_FAILED if an error occurred; compressed data
1960  *    is broken or you do not set 'last' flag properly.
1961  * 4. 'last' flag is very important, you must set 1 to the flag if there
1962  *    is no input data. The lha compressed data format does not provide how
1963  *    to know the compressed data is really finished.
1964  *    Note: lha command utility check if the total size of output bytes is
1965  *    reached the uncompressed size recorded in its header. it does not mind
1966  *    that the decoding process is properly finished.
1967  *    GNU ZIP can decompress another compressed file made by SCO LZH compress.
1968  *    it handles EOF as null to fill read buffer with zero until the decoding
1969  *    process meet 2 bytes of zeros at reading a size of a next chunk, so the
1970  *    zeros are treated as the mark of the end of the data although the zeros
1971  *    is dummy, not the file data.
1972  */
1973 static int      lzh_read_blocks(struct lzh_stream *, int);
1974 static int      lzh_decode_blocks(struct lzh_stream *, int);
1975 #define ST_RD_BLOCK             0
1976 #define ST_RD_PT_1              1
1977 #define ST_RD_PT_2              2
1978 #define ST_RD_PT_3              3
1979 #define ST_RD_PT_4              4
1980 #define ST_RD_LITERAL_1         5
1981 #define ST_RD_LITERAL_2         6
1982 #define ST_RD_LITERAL_3         7
1983 #define ST_RD_POS_DATA_1        8
1984 #define ST_GET_LITERAL          9
1985 #define ST_GET_POS_1            10
1986 #define ST_GET_POS_2            11
1987 #define ST_COPY_DATA            12
1988
1989 static int
1990 lzh_decode(struct lzh_stream *strm, int last)
1991 {
1992         struct lzh_dec *ds = strm->ds;
1993         int64_t avail_in;
1994         int r;
1995
1996         if (ds->error)
1997                 return (ds->error);
1998
1999         avail_in = strm->avail_in;
2000         do {
2001                 if (ds->state < ST_GET_LITERAL)
2002                         r = lzh_read_blocks(strm, last);
2003                 else
2004                         r = lzh_decode_blocks(strm, last);
2005         } while (r == 100);
2006         strm->total_in += avail_in - strm->avail_in;
2007         return (r);
2008 }
2009
2010 static int
2011 lzh_copy_from_window(struct lzh_stream *strm, struct lzh_dec *ds)
2012 {
2013         size_t copy_bytes;
2014
2015         if (ds->w_remaining == 0 && ds->w_pos > 0) {
2016                 if (ds->w_pos - ds->copy_pos <= strm->avail_out)
2017                         copy_bytes = ds->w_pos - ds->copy_pos;
2018                 else
2019                         copy_bytes = (size_t)strm->avail_out;
2020                 memcpy(strm->next_out,
2021                     ds->w_buff + ds->copy_pos, copy_bytes);
2022                 ds->copy_pos += copy_bytes;
2023         } else {
2024                 if (ds->w_remaining <= strm->avail_out)
2025                         copy_bytes = ds->w_remaining;
2026                 else
2027                         copy_bytes = (size_t)strm->avail_out;
2028                 memcpy(strm->next_out,
2029                     ds->w_buff + ds->w_size - ds->w_remaining, copy_bytes);
2030                 ds->w_remaining -= copy_bytes;
2031         }
2032         strm->next_out += copy_bytes;
2033         strm->avail_out -= copy_bytes;
2034         strm->total_out += copy_bytes;
2035         if (strm->avail_out == 0)
2036                 return (0);
2037         else
2038                 return (1);
2039 }
2040
2041 static int
2042 lzh_read_blocks(struct lzh_stream *strm, int last)
2043 {
2044         struct lzh_dec *ds = strm->ds;
2045         struct lzh_br *br = &(ds->br);
2046         int c = 0, i;
2047         unsigned rbits;
2048
2049         for (;;) {
2050                 switch (ds->state) {
2051                 case ST_RD_BLOCK:
2052                         /*
2053                          * Read a block number indicates how many blocks
2054                          * we will handle. The block is composed of a
2055                          * literal and a match, sometimes a literal only
2056                          * in particular, there are no reference data at
2057                          * the beginning of the decompression.
2058                          */
2059                         if (!lzh_br_read_ahead_0(strm, br, 16)) {
2060                                 if (!last)
2061                                         /* We need following data. */
2062                                         return (ARCHIVE_OK);
2063                                 if (lzh_br_has(br, 8)) {
2064                                         /*
2065                                          * It seems there are extra bits.
2066                                          *  1. Compressed data is broken.
2067                                          *  2. `last' flag does not properly
2068                                          *     set.
2069                                          */
2070                                         goto failed;
2071                                 }
2072                                 if (ds->w_pos > 0) {
2073                                         if (!lzh_copy_from_window(strm, ds))
2074                                                 return (ARCHIVE_OK);
2075                                 }
2076                                 /* End of compressed data; we have completely
2077                                  * handled all compressed data. */
2078                                 return (ARCHIVE_EOF);
2079                         }
2080                         ds->blocks_avail = lzh_br_bits(br, 16);
2081                         if (ds->blocks_avail == 0)
2082                                 goto failed;
2083                         lzh_br_consume(br, 16);
2084                         /*
2085                          * Read a literal table compressed in huffman
2086                          * coding.
2087                          */
2088                         ds->pt.len_size = ds->literal_pt_len_size;
2089                         ds->pt.len_bits = ds->literal_pt_len_bits;
2090                         ds->reading_position = 0;
2091                         /* FALL THROUGH */
2092                 case ST_RD_PT_1:
2093                         /* Note: ST_RD_PT_1, ST_RD_PT_2 and ST_RD_PT_4 are
2094                          * used in reading both a literal table and a
2095                          * position table. */
2096                         if (!lzh_br_read_ahead(strm, br, ds->pt.len_bits)) {
2097                                 if (last)
2098                                         goto failed;/* Truncated data. */
2099                                 ds->state = ST_RD_PT_1;
2100                                 return (ARCHIVE_OK);
2101                         }
2102                         ds->pt.len_avail = lzh_br_bits(br, ds->pt.len_bits);
2103                         lzh_br_consume(br, ds->pt.len_bits);
2104                         /* FALL THROUGH */
2105                 case ST_RD_PT_2:
2106                         if (ds->pt.len_avail == 0) {
2107                                 /* There is no bitlen. */
2108                                 if (!lzh_br_read_ahead(strm, br,
2109                                     ds->pt.len_bits)) {
2110                                         if (last)
2111                                                 goto failed;/* Truncated data.*/
2112                                         ds->state = ST_RD_PT_2;
2113                                         return (ARCHIVE_OK);
2114                                 }
2115                                 if (!lzh_make_fake_table(&(ds->pt),
2116                                     lzh_br_bits(br, ds->pt.len_bits)))
2117                                         goto failed;/* Invalid data. */
2118                                 lzh_br_consume(br, ds->pt.len_bits);
2119                                 if (ds->reading_position)
2120                                         ds->state = ST_GET_LITERAL;
2121                                 else
2122                                         ds->state = ST_RD_LITERAL_1;
2123                                 break;
2124                         } else if (ds->pt.len_avail > ds->pt.len_size)
2125                                 goto failed;/* Invalid data. */
2126                         ds->loop = 0;
2127                         memset(ds->pt.freq, 0, sizeof(ds->pt.freq));
2128                         if (ds->pt.len_avail < 3 ||
2129                             ds->pt.len_size == ds->pos_pt_len_size) {
2130                                 ds->state = ST_RD_PT_4;
2131                                 break;
2132                         }
2133                         /* FALL THROUGH */
2134                 case ST_RD_PT_3:
2135                         ds->loop = lzh_read_pt_bitlen(strm, ds->loop, 3);
2136                         if (ds->loop < 3) {
2137                                 if (ds->loop < 0 || last)
2138                                         goto failed;/* Invalid data. */
2139                                 /* Not completed, get following data. */
2140                                 ds->state = ST_RD_PT_3;
2141                                 return (ARCHIVE_OK);
2142                         }
2143                         /* There are some null in bitlen of the literal. */
2144                         if (!lzh_br_read_ahead(strm, br, 2)) {
2145                                 if (last)
2146                                         goto failed;/* Truncated data. */
2147                                 ds->state = ST_RD_PT_3;
2148                                 return (ARCHIVE_OK);
2149                         }
2150                         c = lzh_br_bits(br, 2);
2151                         lzh_br_consume(br, 2);
2152                         if (c > ds->pt.len_avail - 3)
2153                                 goto failed;/* Invalid data. */
2154                         for (i = 3; c-- > 0 ;)
2155                                 ds->pt.bitlen[i++] = 0;
2156                         ds->loop = i;
2157                         /* FALL THROUGH */
2158                 case ST_RD_PT_4:
2159                         ds->loop = lzh_read_pt_bitlen(strm, ds->loop,
2160                             ds->pt.len_avail);
2161                         if (ds->loop < ds->pt.len_avail) {
2162                                 if (ds->loop < 0 || last)
2163                                         goto failed;/* Invalid data. */
2164                                 /* Not completed, get following data. */
2165                                 ds->state = ST_RD_PT_4;
2166                                 return (ARCHIVE_OK);
2167                         }
2168                         if (!lzh_make_huffman_table(&(ds->pt)))
2169                                 goto failed;/* Invalid data */
2170                         if (ds->reading_position) {
2171                                 ds->state = ST_GET_LITERAL;
2172                                 break;
2173                         }
2174                         /* FALL THROUGH */
2175                 case ST_RD_LITERAL_1:
2176                         if (!lzh_br_read_ahead(strm, br, ds->lt.len_bits)) {
2177                                 if (last)
2178                                         goto failed;/* Truncated data. */
2179                                 ds->state = ST_RD_LITERAL_1;
2180                                 return (ARCHIVE_OK);
2181                         }
2182                         ds->lt.len_avail = lzh_br_bits(br, ds->lt.len_bits);
2183                         lzh_br_consume(br, ds->lt.len_bits);
2184                         /* FALL THROUGH */
2185                 case ST_RD_LITERAL_2:
2186                         if (ds->lt.len_avail == 0) {
2187                                 /* There is no bitlen. */
2188                                 if (!lzh_br_read_ahead(strm, br,
2189                                     ds->lt.len_bits)) {
2190                                         if (last)
2191                                                 goto failed;/* Truncated data.*/
2192                                         ds->state = ST_RD_LITERAL_2;
2193                                         return (ARCHIVE_OK);
2194                                 }
2195                                 if (!lzh_make_fake_table(&(ds->lt),
2196                                     lzh_br_bits(br, ds->lt.len_bits)))
2197                                         goto failed;/* Invalid data */
2198                                 lzh_br_consume(br, ds->lt.len_bits);
2199                                 ds->state = ST_RD_POS_DATA_1;
2200                                 break;
2201                         } else if (ds->lt.len_avail > ds->lt.len_size)
2202                                 goto failed;/* Invalid data */
2203                         ds->loop = 0;
2204                         memset(ds->lt.freq, 0, sizeof(ds->lt.freq));
2205                         /* FALL THROUGH */
2206                 case ST_RD_LITERAL_3:
2207                         i = ds->loop;
2208                         while (i < ds->lt.len_avail) {
2209                                 if (!lzh_br_read_ahead(strm, br,
2210                                     ds->pt.max_bits)) {
2211                                         if (last)
2212                                                 goto failed;/* Truncated data.*/
2213                                         ds->loop = i;
2214                                         ds->state = ST_RD_LITERAL_3;
2215                                         return (ARCHIVE_OK);
2216                                 }
2217                                 rbits = lzh_br_bits(br, ds->pt.max_bits);
2218                                 c = lzh_decode_huffman(&(ds->pt), rbits);
2219                                 if (c > 2) {
2220                                         /* Note: 'c' will never be more than
2221                                          * eighteen since it's limited by
2222                                          * PT_BITLEN_SIZE, which is being set
2223                                          * to ds->pt.len_size through
2224                                          * ds->literal_pt_len_size. */
2225                                         lzh_br_consume(br, ds->pt.bitlen[c]);
2226                                         c -= 2;
2227                                         ds->lt.freq[c]++;
2228                                         ds->lt.bitlen[i++] = c;
2229                                 } else if (c == 0) {
2230                                         lzh_br_consume(br, ds->pt.bitlen[c]);
2231                                         ds->lt.bitlen[i++] = 0;
2232                                 } else {
2233                                         /* c == 1 or c == 2 */
2234                                         int n = (c == 1)?4:9;
2235                                         if (!lzh_br_read_ahead(strm, br,
2236                                              ds->pt.bitlen[c] + n)) {
2237                                                 if (last) /* Truncated data. */
2238                                                         goto failed;
2239                                                 ds->loop = i;
2240                                                 ds->state = ST_RD_LITERAL_3;
2241                                                 return (ARCHIVE_OK);
2242                                         }
2243                                         lzh_br_consume(br, ds->pt.bitlen[c]);
2244                                         c = lzh_br_bits(br, n);
2245                                         lzh_br_consume(br, n);
2246                                         c += (n == 4)?3:20;
2247                                         if (i + c > ds->lt.len_avail)
2248                                                 goto failed;/* Invalid data */
2249                                         memset(&(ds->lt.bitlen[i]), 0, c);
2250                                         i += c;
2251                                 }
2252                         }
2253                         if (i > ds->lt.len_avail ||
2254                             !lzh_make_huffman_table(&(ds->lt)))
2255                                 goto failed;/* Invalid data */
2256                         /* FALL THROUGH */
2257                 case ST_RD_POS_DATA_1:
2258                         /*
2259                          * Read a position table compressed in huffman
2260                          * coding.
2261                          */
2262                         ds->pt.len_size = ds->pos_pt_len_size;
2263                         ds->pt.len_bits = ds->pos_pt_len_bits;
2264                         ds->reading_position = 1;
2265                         ds->state = ST_RD_PT_1;
2266                         break;
2267                 case ST_GET_LITERAL:
2268                         return (100);
2269                 }
2270         }
2271 failed:
2272         return (ds->error = ARCHIVE_FAILED);
2273 }
2274
2275 static int
2276 lzh_decode_blocks(struct lzh_stream *strm, int last)
2277 {
2278         struct lzh_dec *ds = strm->ds;
2279         struct lzh_br bre = ds->br;
2280         struct huffman *lt = &(ds->lt);
2281         struct huffman *pt = &(ds->pt);
2282         unsigned char *w_buff = ds->w_buff;
2283         unsigned char *lt_bitlen = lt->bitlen;
2284         unsigned char *pt_bitlen = pt->bitlen;
2285         int blocks_avail = ds->blocks_avail, c = 0;
2286         int copy_len = ds->copy_len, copy_pos = ds->copy_pos;
2287         int w_pos = ds->w_pos, w_mask = ds->w_mask, w_size = ds->w_size;
2288         int lt_max_bits = lt->max_bits, pt_max_bits = pt->max_bits;
2289         int state = ds->state;
2290
2291         if (ds->w_remaining > 0) {
2292                 if (!lzh_copy_from_window(strm, ds))
2293                         goto next_data;
2294         }
2295         for (;;) {
2296                 switch (state) {
2297                 case ST_GET_LITERAL:
2298                         for (;;) {
2299                                 if (blocks_avail == 0) {
2300                                         /* We have decoded all blocks.
2301                                          * Let's handle next blocks. */
2302                                         ds->state = ST_RD_BLOCK;
2303                                         ds->br = bre;
2304                                         ds->blocks_avail = 0;
2305                                         ds->w_pos = w_pos;
2306                                         ds->copy_pos = 0;
2307                                         return (100);
2308                                 }
2309
2310                                 /* lzh_br_read_ahead() always try to fill the
2311                                  * cache buffer up. In specific situation we
2312                                  * are close to the end of the data, the cache
2313                                  * buffer will not be full and thus we have to
2314                                  * determine if the cache buffer has some bits
2315                                  * as much as we need after lzh_br_read_ahead()
2316                                  * failed. */
2317                                 if (!lzh_br_read_ahead(strm, &bre,
2318                                     lt_max_bits)) {
2319                                         if (!last)
2320                                                 goto next_data;
2321                                         /* Remaining bits are less than
2322                                          * maximum bits(lt.max_bits) but maybe
2323                                          * it still remains as much as we need,
2324                                          * so we should try to use it with
2325                                          * dummy bits. */
2326                                         c = lzh_decode_huffman(lt,
2327                                               lzh_br_bits_forced(&bre,
2328                                                 lt_max_bits));
2329                                         lzh_br_consume(&bre, lt_bitlen[c]);
2330                                         if (!lzh_br_has(&bre, 0))
2331                                                 goto failed;/* Over read. */
2332                                 } else {
2333                                         c = lzh_decode_huffman(lt,
2334                                               lzh_br_bits(&bre, lt_max_bits));
2335                                         lzh_br_consume(&bre, lt_bitlen[c]);
2336                                 }
2337                                 blocks_avail--;
2338                                 if (c > UCHAR_MAX)
2339                                         /* Current block is a match data. */
2340                                         break;
2341                                 /*
2342                                  * 'c' is exactly a literal code.
2343                                  */
2344                                 /* Save a decoded code to reference it
2345                                  * afterward. */
2346                                 w_buff[w_pos] = c;
2347                                 if (++w_pos >= w_size) {
2348                                         w_pos = 0;
2349                                         ds->w_remaining = w_size;
2350                                         if (!lzh_copy_from_window(strm, ds))
2351                                                 goto next_data;
2352                                 }
2353                         }
2354                         /* 'c' is the length of a match pattern we have
2355                          * already extracted, which has be stored in
2356                          * window(ds->w_buff). */
2357                         copy_len = c - (UCHAR_MAX + 1) + MINMATCH;
2358                         /* FALL THROUGH */
2359                 case ST_GET_POS_1:
2360                         /*
2361                          * Get a reference position.
2362                          */
2363                         if (!lzh_br_read_ahead(strm, &bre, pt_max_bits)) {
2364                                 if (!last) {
2365                                         state = ST_GET_POS_1;
2366                                         ds->copy_len = copy_len;
2367                                         goto next_data;
2368                                 }
2369                                 copy_pos = lzh_decode_huffman(pt,
2370                                     lzh_br_bits_forced(&bre, pt_max_bits));
2371                                 lzh_br_consume(&bre, pt_bitlen[copy_pos]);
2372                                 if (!lzh_br_has(&bre, 0))
2373                                         goto failed;/* Over read. */
2374                         } else {
2375                                 copy_pos = lzh_decode_huffman(pt,
2376                                     lzh_br_bits(&bre, pt_max_bits));
2377                                 lzh_br_consume(&bre, pt_bitlen[copy_pos]);
2378                         }
2379                         /* FALL THROUGH */
2380                 case ST_GET_POS_2:
2381                         if (copy_pos > 1) {
2382                                 /* We need an additional adjustment number to
2383                                  * the position. */
2384                                 int p = copy_pos - 1;
2385                                 if (!lzh_br_read_ahead(strm, &bre, p)) {
2386                                         if (last)
2387                                                 goto failed;/* Truncated data.*/
2388                                         state = ST_GET_POS_2;
2389                                         ds->copy_len = copy_len;
2390                                         ds->copy_pos = copy_pos;
2391                                         goto next_data;
2392                                 }
2393                                 copy_pos = (1 << p) + lzh_br_bits(&bre, p);
2394                                 lzh_br_consume(&bre, p);
2395                         }
2396                         /* The position is actually a distance from the last
2397                          * code we had extracted and thus we have to convert
2398                          * it to a position of the window. */
2399                         copy_pos = (w_pos - copy_pos - 1) & w_mask;
2400                         /* FALL THROUGH */
2401                 case ST_COPY_DATA:
2402                         /*
2403                          * Copy `copy_len' bytes as extracted data from
2404                          * the window into the output buffer.
2405                          */
2406                         for (;;) {
2407                                 int l;
2408
2409                                 l = copy_len;
2410                                 if (copy_pos > w_pos) {
2411                                         if (l > w_size - copy_pos)
2412                                                 l = w_size - copy_pos;
2413                                 } else {
2414                                         if (l > w_size - w_pos)
2415                                                 l = w_size - w_pos;
2416                                 }
2417                                 if ((copy_pos + l < w_pos)
2418                                     || (w_pos + l < copy_pos)) {
2419                                         /* No overlap. */
2420                                         memcpy(w_buff + w_pos,
2421                                             w_buff + copy_pos, l);
2422                                 } else {
2423                                         const unsigned char *s;
2424                                         unsigned char *d;
2425                                         int li;
2426
2427                                         d = w_buff + w_pos;
2428                                         s = w_buff + copy_pos;
2429                                         for (li = 0; li < l; li++)
2430                                                 d[li] = s[li];
2431                                 }
2432                                 w_pos = (w_pos + l) & w_mask;
2433                                 if (w_pos == 0) {
2434                                         ds->w_remaining = w_size;
2435                                         if (!lzh_copy_from_window(strm, ds)) {
2436                                                 if (copy_len <= l)
2437                                                         state = ST_GET_LITERAL;
2438                                                 else {
2439                                                         state = ST_COPY_DATA;
2440                                                         ds->copy_len =
2441                                                             copy_len - l;
2442                                                         ds->copy_pos =
2443                                                             (copy_pos + l)
2444                                                             & w_mask;
2445                                                 }
2446                                                 goto next_data;
2447                                         }
2448                                 }
2449                                 if (copy_len <= l)
2450                                         /* A copy of current pattern ended. */
2451                                         break;
2452                                 copy_len -= l;
2453                                 copy_pos = (copy_pos + l) & w_mask;
2454                         }
2455                         state = ST_GET_LITERAL;
2456                         break;
2457                 }
2458         }
2459 failed:
2460         return (ds->error = ARCHIVE_FAILED);
2461 next_data:
2462         ds->br = bre;
2463         ds->blocks_avail = blocks_avail;
2464         ds->state = state;
2465         ds->w_pos = w_pos;
2466         return (ARCHIVE_OK);
2467 }
2468
2469 static int
2470 lzh_huffman_init(struct huffman *hf, size_t len_size, int tbl_bits)
2471 {
2472         int bits;
2473
2474         if (hf->bitlen == NULL) {
2475                 hf->bitlen = malloc(len_size * sizeof(hf->bitlen[0]));
2476                 if (hf->bitlen == NULL)
2477                         return (ARCHIVE_FATAL);
2478         }
2479         if (hf->tbl == NULL) {
2480                 if (tbl_bits < HTBL_BITS)
2481                         bits = tbl_bits;
2482                 else
2483                         bits = HTBL_BITS;
2484                 hf->tbl = malloc((1 << bits) * sizeof(hf->tbl[0]));
2485                 if (hf->tbl == NULL)
2486                         return (ARCHIVE_FATAL);
2487         }
2488         if (hf->tree == NULL && tbl_bits > HTBL_BITS) {
2489                 hf->tree_avail = 1 << (tbl_bits - HTBL_BITS + 4);
2490                 hf->tree = malloc(hf->tree_avail * sizeof(hf->tree[0]));
2491                 if (hf->tree == NULL)
2492                         return (ARCHIVE_FATAL);
2493         }
2494         hf->len_size = len_size;
2495         hf->tbl_bits = tbl_bits;
2496         return (ARCHIVE_OK);
2497 }
2498
2499 static void
2500 lzh_huffman_free(struct huffman *hf)
2501 {
2502         free(hf->bitlen);
2503         free(hf->tbl);
2504         free(hf->tree);
2505 }
2506
2507 static int
2508 lzh_read_pt_bitlen(struct lzh_stream *strm, int start, int end)
2509 {
2510         struct lzh_dec *ds = strm->ds;
2511         struct lzh_br * br = &(ds->br);
2512         int c, i;
2513
2514         for (i = start; i < end;) {
2515                 /*
2516                  *  bit pattern     the number we need
2517                  *     000           ->  0
2518                  *     001           ->  1
2519                  *     010           ->  2
2520                  *     ...
2521                  *     110           ->  6
2522                  *     1110          ->  7
2523                  *     11110         ->  8
2524                  *     ...
2525                  *     1111111111110 ->  16
2526                  */
2527                 if (!lzh_br_read_ahead(strm, br, 3))
2528                         return (i);
2529                 if ((c = lzh_br_bits(br, 3)) == 7) {
2530                         int d;
2531                         if (!lzh_br_read_ahead(strm, br, 13))
2532                                 return (i);
2533                         d = lzh_br_bits(br, 13);
2534                         while (d & 0x200) {
2535                                 c++;
2536                                 d <<= 1;
2537                         }
2538                         if (c > 16)
2539                                 return (-1);/* Invalid data. */
2540                         lzh_br_consume(br, c - 3);
2541                 } else
2542                         lzh_br_consume(br, 3);
2543                 ds->pt.bitlen[i++] = c;
2544                 ds->pt.freq[c]++;
2545         }
2546         return (i);
2547 }
2548
2549 static int
2550 lzh_make_fake_table(struct huffman *hf, uint16_t c)
2551 {
2552         if (c >= hf->len_size)
2553                 return (0);
2554         hf->tbl[0] = c;
2555         hf->max_bits = 0;
2556         hf->shift_bits = 0;
2557         hf->bitlen[hf->tbl[0]] = 0;
2558         return (1);
2559 }
2560
2561 /*
2562  * Make a huffman coding table.
2563  */
2564 static int
2565 lzh_make_huffman_table(struct huffman *hf)
2566 {
2567         uint16_t *tbl;
2568         const unsigned char *bitlen;
2569         int bitptn[17], weight[17];
2570         int i, maxbits = 0, ptn, tbl_size, w;
2571         int diffbits, len_avail;
2572
2573         /*
2574          * Initialize bit patterns.
2575          */
2576         ptn = 0;
2577         for (i = 1, w = 1 << 15; i <= 16; i++, w >>= 1) {
2578                 bitptn[i] = ptn;
2579                 weight[i] = w;
2580                 if (hf->freq[i]) {
2581                         ptn += hf->freq[i] * w;
2582                         maxbits = i;
2583                 }
2584         }
2585         if (ptn != 0x10000 || maxbits > hf->tbl_bits)
2586                 return (0);/* Invalid */
2587
2588         hf->max_bits = maxbits;
2589
2590         /*
2591          * Cut out extra bits which we won't house in the table.
2592          * This preparation reduces the same calculation in the for-loop
2593          * making the table.
2594          */
2595         if (maxbits < 16) {
2596                 int ebits = 16 - maxbits;
2597                 for (i = 1; i <= maxbits; i++) {
2598                         bitptn[i] >>= ebits;
2599                         weight[i] >>= ebits;
2600                 }
2601         }
2602         if (maxbits > HTBL_BITS) {
2603                 int htbl_max;
2604                 uint16_t *p;
2605
2606                 diffbits = maxbits - HTBL_BITS;
2607                 for (i = 1; i <= HTBL_BITS; i++) {
2608                         bitptn[i] >>= diffbits;
2609                         weight[i] >>= diffbits;
2610                 }
2611                 htbl_max = bitptn[HTBL_BITS] +
2612                     weight[HTBL_BITS] * hf->freq[HTBL_BITS];
2613                 p = &(hf->tbl[htbl_max]);
2614                 while (p < &hf->tbl[1U<<HTBL_BITS])
2615                         *p++ = 0;
2616         } else
2617                 diffbits = 0;
2618         hf->shift_bits = diffbits;
2619
2620         /*
2621          * Make the table.
2622          */
2623         tbl_size = 1 << HTBL_BITS;
2624         tbl = hf->tbl;
2625         bitlen = hf->bitlen;
2626         len_avail = hf->len_avail;
2627         hf->tree_used = 0;
2628         for (i = 0; i < len_avail; i++) {
2629                 uint16_t *p;
2630                 int len, cnt;
2631                 uint16_t bit;
2632                 int extlen;
2633                 struct htree_t *ht;
2634
2635                 if (bitlen[i] == 0)
2636                         continue;
2637                 /* Get a bit pattern */
2638                 len = bitlen[i];
2639                 ptn = bitptn[len];
2640                 cnt = weight[len];
2641                 if (len <= HTBL_BITS) {
2642                         /* Calculate next bit pattern */
2643                         if ((bitptn[len] = ptn + cnt) > tbl_size)
2644                                 return (0);/* Invalid */
2645                         /* Update the table */
2646                         p = &(tbl[ptn]);
2647                         while (--cnt >= 0)
2648                                 p[cnt] = (uint16_t)i;
2649                         continue;
2650                 }
2651
2652                 /*
2653                  * A bit length is too big to be housed to a direct table,
2654                  * so we use a tree model for its extra bits.
2655                  */
2656                 bitptn[len] = ptn + cnt;
2657                 bit = 1U << (diffbits -1);
2658                 extlen = len - HTBL_BITS;
2659
2660                 p = &(tbl[ptn >> diffbits]);
2661                 if (*p == 0) {
2662                         *p = len_avail + hf->tree_used;
2663                         ht = &(hf->tree[hf->tree_used++]);
2664                         if (hf->tree_used > hf->tree_avail)
2665                                 return (0);/* Invalid */
2666                         ht->left = 0;
2667                         ht->right = 0;
2668                 } else {
2669                         if (*p < len_avail ||
2670                             *p >= (len_avail + hf->tree_used))
2671                                 return (0);/* Invalid */
2672                         ht = &(hf->tree[*p - len_avail]);
2673                 }
2674                 while (--extlen > 0) {
2675                         if (ptn & bit) {
2676                                 if (ht->left < len_avail) {
2677                                         ht->left = len_avail + hf->tree_used;
2678                                         ht = &(hf->tree[hf->tree_used++]);
2679                                         if (hf->tree_used > hf->tree_avail)
2680                                                 return (0);/* Invalid */
2681                                         ht->left = 0;
2682                                         ht->right = 0;
2683                                 } else {
2684                                         ht = &(hf->tree[ht->left - len_avail]);
2685                                 }
2686                         } else {
2687                                 if (ht->right < len_avail) {
2688                                         ht->right = len_avail + hf->tree_used;
2689                                         ht = &(hf->tree[hf->tree_used++]);
2690                                         if (hf->tree_used > hf->tree_avail)
2691                                                 return (0);/* Invalid */
2692                                         ht->left = 0;
2693                                         ht->right = 0;
2694                                 } else {
2695                                         ht = &(hf->tree[ht->right - len_avail]);
2696                                 }
2697                         }
2698                         bit >>= 1;
2699                 }
2700                 if (ptn & bit) {
2701                         if (ht->left != 0)
2702                                 return (0);/* Invalid */
2703                         ht->left = (uint16_t)i;
2704                 } else {
2705                         if (ht->right != 0)
2706                                 return (0);/* Invalid */
2707                         ht->right = (uint16_t)i;
2708                 }
2709         }
2710         return (1);
2711 }
2712
2713 static int
2714 lzh_decode_huffman_tree(struct huffman *hf, unsigned rbits, int c)
2715 {
2716         struct htree_t *ht;
2717         int extlen;
2718
2719         ht = hf->tree;
2720         extlen = hf->shift_bits;
2721         while (c >= hf->len_avail) {
2722                 c -= hf->len_avail;
2723                 if (extlen-- <= 0 || c >= hf->tree_used)
2724                         return (0);
2725                 if (rbits & (1U << extlen))
2726                         c = ht[c].left;
2727                 else
2728                         c = ht[c].right;
2729         }
2730         return (c);
2731 }
2732
2733 static inline int
2734 lzh_decode_huffman(struct huffman *hf, unsigned rbits)
2735 {
2736         int c;
2737         /*
2738          * At first search an index table for a bit pattern.
2739          * If it fails, search a huffman tree for.
2740          */
2741         c = hf->tbl[rbits >> hf->shift_bits];
2742         if (c < hf->len_avail)
2743                 return (c);
2744         /* This bit pattern needs to be found out at a huffman tree. */
2745         return (lzh_decode_huffman_tree(hf, rbits, c));
2746 }
2747