/src/clamav/libclamav/unarj.c

Source (jump to first uncovered line)
/*
 *  Extract component parts of ARJ archives.
 *
 *  Copyright (C) 2013-2023 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
 *  Copyright (C) 2007-2013 Sourcefire, Inc.
 *
 *  Authors: Trog
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *  MA 02110-1301, USA.
 */

#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <ctype.h>

#include "clamav.h"
#include "str.h"
#include "others.h"
#include "unarj.h"
#include "textnorm.h"

#define FIRST_HDR_SIZE 30
#define COMMENT_MAX 2048
#define FNAME_MAX 512
#define HEADERSIZE_MAX (FIRST_HDR_SIZE + 10 + FNAME_MAX + COMMENT_MAX)
#define MAXDICBIT 16
#define DDICSIZ 26624
#define THRESHOLD 3
#ifndef UCHAR_MAX
#define UCHAR_MAX (255)
#endif
#ifndef CHAR_BIT
#define CHAR_BIT (8)
#endif
#define MAXMATCH 256
#ifndef FALSE
#define FALSE (0)
#define TRUE (1)
#endif

#define CODE_BIT 16
#define NT (CODE_BIT + 3)
#define PBIT 5
#define TBIT 5
#define NC (UCHAR_MAX + MAXMATCH + 2 - THRESHOLD)
#define NP (MAXDICBIT + 1)
#define CBIT 9
#define CTABLESIZE 4096
#define PTABLESIZE 256
#define STRTP 9
#define STOPP 13

#define STRTL 0
#define STOPL 7

#if NT > NP
#define NPT NT
#else
#define NPT NP
#endif

#define GARBLE_FLAG 0x01

#ifndef HAVE_ATTRIB_PACKED
#define __attribute__(x)
#endif

#ifdef HAVE_PRAGMA_PACK
#pragma pack(1)
#endif

#ifdef HAVE_PRAGMA_PACK_HPPA
#pragma pack 1
#endif

typedef struct arj_main_hdr_tag {
    uint8_t first_hdr_size; /* must be 30 bytes */
    uint8_t version;
    uint8_t min_version;
    uint8_t host_os;
    uint8_t flags;
    uint8_t security_version;
    uint8_t file_type;
    uint8_t pad;
    uint32_t time_created __attribute__((packed));
    uint32_t time_modified __attribute__((packed));
    uint32_t archive_size __attribute__((packed));
    uint32_t sec_env_file_position __attribute__((packed));
    uint16_t entryname_pos __attribute__((packed));
    uint16_t sec_trail_size __attribute__((packed));
    uint16_t host_data __attribute__((packed));
} arj_main_hdr_t;

typedef struct arj_file_hdr_tag {
    uint8_t first_hdr_size; /* must be 30 bytes */
    uint8_t version;
    uint8_t min_version;
    uint8_t host_os;
    uint8_t flags;
    uint8_t method;
    uint8_t file_type;
    uint8_t password_mod;
    uint32_t time_modified __attribute__((packed));
    uint32_t comp_size __attribute__((packed));
    uint32_t orig_size __attribute__((packed));
    uint32_t orig_crc __attribute__((packed));
    uint16_t entryname_pos __attribute__((packed));
    uint16_t file_mode __attribute__((packed));
    uint16_t host_data __attribute__((packed));
} arj_file_hdr_t;

#ifdef HAVE_PRAGMA_PACK
#pragma pack()
#endif

#ifdef HAVE_PRAGMA_PACK_HPPA
#pragma pack
#endif

typedef struct arj_decode_tag {
    unsigned char *text;
    fmap_t *map;
    size_t offset;
    const uint8_t *buf;
    const void *bufend;
    uint16_t blocksize;
    uint16_t bit_buf;
    int bit_count;
    uint32_t comp_size;
    int16_t getlen, getbuf;
    uint16_t left[2 * NC - 1];
    uint16_t right[2 * NC - 1];
    unsigned char c_len[NC];
    uint16_t c_table[CTABLESIZE];
    unsigned char pt_len[NPT];
    unsigned char sub_bit_buf;
    uint16_t pt_table[PTABLESIZE];
    int status;
} arj_decode_t;

static cl_error_t fill_buf(arj_decode_t *decode_data, int n)
{
    if (decode_data->status == CL_EFORMAT)
        return CL_EFORMAT;
    if (((uint64_t)decode_data->bit_buf) * (n > 0 ? 2 << (n - 1) : 0) > UINT32_MAX)
        return CL_EFORMAT;
    decode_data->bit_buf = (((uint64_t)decode_data->bit_buf) << n) & 0xFFFF;
    while (n > decode_data->bit_count) {
        decode_data->bit_buf |= decode_data->sub_bit_buf << (n -= decode_data->bit_count);
        if (decode_data->comp_size != 0) {
            decode_data->comp_size--;
            if (decode_data->buf == decode_data->bufend) {
                size_t len;
                decode_data->buf = fmap_need_off_once_len(decode_data->map, decode_data->offset, 8192, &len);
                if (!decode_data->buf || !len) {
                    /* the file is most likely corrupted, so
                     * we return CL_EFORMAT instead of CL_EREAD
                     */
                    decode_data->status = CL_EFORMAT;
                    return CL_EFORMAT;
                }
                decode_data->bufend = decode_data->buf + len;
            }
            decode_data->sub_bit_buf = *decode_data->buf++;
            decode_data->offset++;
        } else {
            decode_data->sub_bit_buf = 0;
        }
        decode_data->bit_count = CHAR_BIT;
    }
    decode_data->bit_buf |= decode_data->sub_bit_buf >> (decode_data->bit_count -= n);
    return CL_SUCCESS;
}

static cl_error_t init_getbits(arj_decode_t *decode_data)
{
    decode_data->bit_buf     = 0;
    decode_data->sub_bit_buf = 0;
    decode_data->bit_count   = 0;
    return fill_buf(decode_data, 2 * CHAR_BIT);
}

static unsigned short arj_getbits(arj_decode_t *decode_data, int n)
{
    unsigned short x;

    x = decode_data->bit_buf >> (2 * CHAR_BIT - n);
    fill_buf(decode_data, n);
    return x;
}

static cl_error_t decode_start(arj_decode_t *decode_data)
{
    decode_data->blocksize = 0;
    return init_getbits(decode_data);
}

static cl_error_t write_text(int ofd, unsigned char *data, size_t length)
{
    size_t count;

    count = cli_writen(ofd, data, length);
    if (count != length) {
        return CL_EWRITE;
    }
    return CL_SUCCESS;
}

static cl_error_t make_table(arj_decode_t *decode_data, int nchar, unsigned char *bitlen, int tablebits,
                             unsigned short *table, int tablesize)
{
    unsigned short count[17], weight[17], start[18], *p;
    unsigned int i, k, len, ch, jutbits, avail, nextcode, mask;

    for (i = 1; i <= 16; i++) {
        count[i] = 0;
    }
    for (i = 0; (int)i < nchar; i++) {
        if (bitlen[i] >= 17) {
            cli_dbgmsg("UNARJ: bounds exceeded\n");
            decode_data->status = CL_EUNPACK;
            return CL_EUNPACK;
        }
        count[bitlen[i]]++;
    }

    start[1] = 0;
    for (i = 1; i <= 16; i++) {
        start[i + 1] = start[i] + (count[i] << (16 - i));
    }
    if (start[17] != (unsigned short)(1 << 16)) {
        decode_data->status = CL_EUNPACK;
        return CL_EUNPACK;
    }

    jutbits = 16 - tablebits;
    if (tablebits >= 17) {
        cli_dbgmsg("UNARJ: bounds exceeded\n");
        decode_data->status = CL_EUNPACK;
        return CL_EUNPACK;
    }
    for (i = 1; (int)i <= tablebits; i++) {
        start[i] >>= jutbits;
        weight[i] = 1 << (tablebits - i);
    }
    while (i <= 16) {
        weight[i] = 1 << (16 - i);
        i++;
    }

    i = start[tablebits + 1] >> jutbits;
    if (i != (unsigned short)(1 << 16)) {
        k = 1 << tablebits;
        while (i != k) {
            if (i >= (unsigned int)tablesize) {
                cli_dbgmsg("UNARJ: bounds exceeded\n");
                decode_data->status = CL_EUNPACK;
                return CL_EUNPACK;
            }
            table[i++] = 0;
        }
    }

    avail = nchar;
    mask  = 1 << (15 - tablebits);
    for (ch = 0; (int)ch < nchar; ch++) {
        if ((len = bitlen[ch]) == 0) {
            continue;
        }
        if (len >= 17) {
            cli_dbgmsg("UNARJ: bounds exceeded\n");
            decode_data->status = CL_EUNPACK;
            return CL_EUNPACK;
        }
        k        = start[len];
        nextcode = k + weight[len];
        if ((int)len <= tablebits) {
            if (nextcode > (unsigned int)tablesize) {
                decode_data->status = CL_EUNPACK;
                return CL_EUNPACK;
            }
            for (i = start[len]; i < nextcode; i++) {
                table[i] = ch;
            }
        } else {
            p = &table[k >> jutbits];
            i = len - tablebits;
            while (i != 0) {
                if (*p == 0) {
                    if (avail >= (2 * NC - 1)) {
                        cli_dbgmsg("UNARJ: bounds exceeded\n");
                        decode_data->status = CL_EUNPACK;
                        return CL_EUNPACK;
                    }
                    decode_data->right[avail] = decode_data->left[avail] = 0;
                    *p                                                   = avail++;
                }
                if (*p >= (2 * NC - 1)) {
                    cli_dbgmsg("UNARJ: bounds exceeded\n");
                    decode_data->status = CL_EUNPACK;
                    return CL_EUNPACK;
                }
                if (k & mask) {
                    p = &decode_data->right[*p];
                } else {
                    p = &decode_data->left[*p];
                }
                k <<= 1;
                i--;
            }
            *p = ch;
        }
        start[len] = nextcode;
    }
    return CL_SUCCESS;
}

static cl_error_t read_pt_len(arj_decode_t *decode_data, int nn, int nbit, int i_special)
{
    int i, n;
    short c;
    unsigned short mask;

    n = arj_getbits(decode_data, nbit);
    if (n == 0) {
        if (nn > NPT) {
            cli_dbgmsg("UNARJ: bounds exceeded\n");
            decode_data->status = CL_EUNPACK;
            return CL_EUNPACK;
        }
        c = arj_getbits(decode_data, nbit);
        for (i = 0; i < nn; i++) {
            decode_data->pt_len[i] = 0;
        }
        for (i = 0; i < 256; i++) {
            decode_data->pt_table[i] = c;
        }
    } else {
        i = 0;
        while ((i < n) && (i < NPT)) {
            c = decode_data->bit_buf >> 13;
            if (c == 7) {
                mask = 1 << 12;
                while (mask & decode_data->bit_buf) {
                    mask >>= 1;
                    c++;
                }
            }
            fill_buf(decode_data, (c < 7) ? 3 : (int)(c - 3));
            if (decode_data->status != CL_SUCCESS) {
                return decode_data->status;
            }
            decode_data->pt_len[i++] = (unsigned char)c;
            if (i == i_special) {
                c = arj_getbits(decode_data, 2);
                if (decode_data->status != CL_SUCCESS) {
                    return decode_data->status;
                }
                while ((--c >= 0) && (i < NPT)) {
                    decode_data->pt_len[i++] = 0;
                }
            }
        }
        while ((i < nn) && (i < NPT)) {
            decode_data->pt_len[i++] = 0;
        }
        if (make_table(decode_data, nn, decode_data->pt_len, 8, decode_data->pt_table, PTABLESIZE) != CL_SUCCESS) {
            return CL_EUNPACK;
        }
    }
    return CL_SUCCESS;
}

static cl_error_t read_c_len(arj_decode_t *decode_data)
{
    short i, c, n;
    unsigned short mask;

    n = arj_getbits(decode_data, CBIT);
    if (decode_data->status != CL_SUCCESS) {
        return decode_data->status;
    }
    if (n == 0) {
        c = arj_getbits(decode_data, CBIT);
        if (decode_data->status != CL_SUCCESS) {
            return decode_data->status;
        }
        for (i = 0; i < NC; i++) {
            decode_data->c_len[i] = 0;
        }
        for (i = 0; i < CTABLESIZE; i++) {
            decode_data->c_table[i] = c;
        }
    } else {
        i = 0;
        while (i < n) {
            c = decode_data->pt_table[decode_data->bit_buf >> 8];
            if (c >= NT) {
                mask = 1 << 7;
                do {
                    if (c >= (2 * NC - 1)) {
                        cli_dbgmsg("ERROR: bounds exceeded\n");
                        decode_data->status = CL_EFORMAT;
                        return CL_EFORMAT;
                    }
                    if (decode_data->bit_buf & mask) {
                        c = decode_data->right[c];
                    } else {
                        c = decode_data->left[c];
                    }
                    mask >>= 1;
                } while (c >= NT);
            }
            if (c >= 19) {
                cli_dbgmsg("UNARJ: bounds exceeded\n");
                decode_data->status = CL_EUNPACK;
                return CL_EUNPACK;
            }
            fill_buf(decode_data, (int)(decode_data->pt_len[c]));
            if (decode_data->status != CL_SUCCESS) {
                return decode_data->status;
            }
            if (c <= 2) {
                if (c == 0) {
                    c = 1;
                } else if (c == 1) {
                    c = arj_getbits(decode_data, 4) + 3;
                } else {
                    c = arj_getbits(decode_data, CBIT) + 20;
                }
                if (decode_data->status != CL_SUCCESS) {
                    return decode_data->status;
                }
                while (--c >= 0) {
                    if (i >= NC) {
                        cli_dbgmsg("ERROR: bounds exceeded\n");
                        decode_data->status = CL_EFORMAT;
                        return CL_EFORMAT;
                    }
                    decode_data->c_len[i++] = 0;
                }
            } else {
                if (i >= NC) {
                    cli_dbgmsg("ERROR: bounds exceeded\n");
                    decode_data->status = CL_EFORMAT;
                    return CL_EFORMAT;
                }
                decode_data->c_len[i++] = (unsigned char)(c - 2);
            }
        }
        while (i < NC) {
            decode_data->c_len[i++] = 0;
        }
        if (make_table(decode_data, NC, decode_data->c_len, 12, decode_data->c_table, CTABLESIZE) != CL_SUCCESS) {
            return CL_EUNPACK;
        }
    }
    return CL_SUCCESS;
}

static uint16_t decode_c(arj_decode_t *decode_data)
{
    uint16_t j, mask;

    if (decode_data->blocksize == 0) {
        decode_data->blocksize = arj_getbits(decode_data, 16);
        read_pt_len(decode_data, NT, TBIT, 3);
        read_c_len(decode_data);
        read_pt_len(decode_data, NT, PBIT, -1);
    }
    decode_data->blocksize--;
    j = decode_data->c_table[decode_data->bit_buf >> 4];
    if (j >= NC) {
        mask = 1 << 3;
        do {
            if (j >= (2 * NC - 1)) {
                cli_dbgmsg("ERROR: bounds exceeded\n");
                decode_data->status = CL_EUNPACK;
                return 0;
            }
            if (decode_data->bit_buf & mask) {
                j = decode_data->right[j];
            } else {
                j = decode_data->left[j];
            }
            mask >>= 1;
        } while (j >= NC);
    }
    fill_buf(decode_data, (int)(decode_data->c_len[j]));
    return j;
}

static uint16_t decode_p(arj_decode_t *decode_data)
{
    unsigned short j, mask;

    j = decode_data->pt_table[decode_data->bit_buf >> 8];
    if (j >= NP) {
        mask = 1 << 7;
        do {
            if (j >= (2 * NC - 1)) {
                cli_dbgmsg("ERROR: bounds exceeded\n");
                decode_data->status = CL_EUNPACK;
                return 0;
            }
            if (decode_data->bit_buf & mask) {
                j = decode_data->right[j];
            } else {
                j = decode_data->left[j];
            }
            mask >>= 1;
        } while (j >= NP);
    }
    fill_buf(decode_data, (int)(decode_data->pt_len[j]));
    if (j != 0) {
        j--;
        j = (1 << j) + arj_getbits(decode_data, (int)j);
    }
    return j;
}

static cl_error_t decode(arj_metadata_t *metadata)
{
    cl_error_t ret;

    arj_decode_t decode_data;
    uint32_t count = 0, out_ptr = 0;
    int16_t chr, i, j;

    memset(&decode_data, 0, sizeof(decode_data));
    decode_data.text = (unsigned char *)cli_calloc(DDICSIZ, 1);
    if (!decode_data.text) {
        return CL_EMEM;
    }
    decode_data.map       = metadata->map;
    decode_data.offset    = metadata->offset;
    decode_data.comp_size = metadata->comp_size;
    ret                   = decode_start(&decode_data);
    if (ret != CL_SUCCESS) {
        free(decode_data.text);
        metadata->offset = decode_data.offset;
        return ret;
    }
    decode_data.status = CL_SUCCESS;

    while (count < metadata->orig_size) {
        if ((chr = decode_c(&decode_data)) <= UCHAR_MAX) {
            decode_data.text[out_ptr] = (unsigned char)chr;
            count++;
            if (++out_ptr >= DDICSIZ) {
                out_ptr = 0;
                if (write_text(metadata->ofd, decode_data.text, DDICSIZ) != CL_SUCCESS) {
                    free(decode_data.text);
                    metadata->offset = decode_data.offset;
                    return CL_EWRITE;
                }
            }
        } else {
            j = chr - (UCHAR_MAX + 1 - THRESHOLD);
            count += j;
            i = decode_p(&decode_data);
            if ((i = out_ptr - i - 1) < 0) {
                i += DDICSIZ;
            }
            if ((i >= DDICSIZ) || (i < 0)) {
                cli_dbgmsg("UNARJ: bounds exceeded - probably a corrupted file.\n");
                break;
            }
            if (out_ptr > (uint32_t)i && out_ptr < DDICSIZ - MAXMATCH - 1) {
                while ((--j >= 0) && (i < DDICSIZ) && (out_ptr < DDICSIZ)) {
                    decode_data.text[out_ptr++] = decode_data.text[i++];
                }
            } else {
                while (--j >= 0) {
                    decode_data.text[out_ptr] = decode_data.text[i];
                    if (++out_ptr >= DDICSIZ) {
                        out_ptr = 0;
                        if (write_text(metadata->ofd, decode_data.text, DDICSIZ) != CL_SUCCESS) {
                            free(decode_data.text);
                            metadata->offset = decode_data.offset;
                            return CL_EWRITE;
                        }
                    }
                    if (++i >= DDICSIZ) {
                        i = 0;
                    }
                }
            }
        }
        if (decode_data.status != CL_SUCCESS) {
            free(decode_data.text);
            metadata->offset = decode_data.offset;
            return decode_data.status;
        }
    }
    if (out_ptr != 0) {
        write_text(metadata->ofd, decode_data.text, out_ptr);
    }

    free(decode_data.text);
    metadata->offset = decode_data.offset;
    return CL_SUCCESS;
}

#define ARJ_BFIL(dd)                             \
    {                                            \
        dd->getbuf |= dd->bit_buf >> dd->getlen; \
        fill_buf(dd, CODE_BIT - dd->getlen);     \
        dd->getlen = CODE_BIT;                   \
    }
#define ARJ_GETBIT(dd, c)                 \
    {                                     \
        if (dd->getlen <= 0) ARJ_BFIL(dd) \
        c = (dd->getbuf & 0x8000) != 0;   \
        dd->getbuf *= 2;                  \
        dd->getlen--;                     \
    }
#define ARJ_BPUL(dd, l)           \
    do {                          \
        int i;                    \
        int j = l;                \
        for (i = 0; i < j; i++) { \
            dd->getbuf *= 2;      \
        }                         \
        dd->getlen -= l;          \
    } while (0)
#define ARJ_GETBITS(dd, c, l)                       \
    {                                               \
        if (dd->getlen < l) ARJ_BFIL(dd)            \
        c = (uint16_t)dd->getbuf >> (CODE_BIT - l); \
        ARJ_BPUL(dd, l);                            \
    }

static uint16_t decode_ptr(arj_decode_t *decode_data)
{
    uint16_t c, width, plus, pwr;

    plus = 0;
    pwr  = 1 << STRTP;
    for (width = STRTP; width < STOPP; width++) {
        ARJ_GETBIT(decode_data, c);
        if (c == 0) {
            break;
        }
        plus += pwr;
        pwr <<= 1;
    }
    if (width != 0) {
        ARJ_GETBITS(decode_data, c, width);
    }
    c += plus;
    return c;
}

static uint16_t decode_len(arj_decode_t *decode_data)
{
    uint16_t c, width, plus, pwr;

    plus = 0;
    pwr  = 1 << STRTL;
    for (width = STRTL; width < STOPL; width++) {
        ARJ_GETBIT(decode_data, c);
        if (c == 0) {
            break;
        }
        plus += pwr;
        pwr <<= 1;
    }
    if (width != 0) {
        ARJ_GETBITS(decode_data, c, width);
    }
    c += plus;
    return c;
}

static cl_error_t decode_f(arj_metadata_t *metadata)
{
    cl_error_t ret;

    arj_decode_t decode_data, *dd;
    uint32_t count = 0, out_ptr = 0;
    int16_t chr, i, j, pos;

    dd = &decode_data;
    memset(&decode_data, 0, sizeof(decode_data));
    decode_data.text = (unsigned char *)cli_calloc(DDICSIZ, 1);
    if (!decode_data.text) {
        return CL_EMEM;
    }
    decode_data.map       = metadata->map;
    decode_data.offset    = metadata->offset;
    decode_data.comp_size = metadata->comp_size;
    ret                   = init_getbits(&decode_data);
    if (ret != CL_SUCCESS) {
        free(decode_data.text);
        metadata->offset = decode_data.offset;
        return ret;
    }
    decode_data.getlen = decode_data.getbuf = 0;
    decode_data.status                      = CL_SUCCESS;

    while (count < metadata->orig_size) {
        chr = decode_len(&decode_data);
        if (decode_data.status != CL_SUCCESS) {
            free(decode_data.text);
            metadata->offset = decode_data.offset;
            return decode_data.status;
        }
        if (chr == 0) {
            ARJ_GETBITS(dd, chr, CHAR_BIT);
            if (decode_data.status != CL_SUCCESS) {
                free(decode_data.text);
                metadata->offset = decode_data.offset;
                return decode_data.status;
            }
            decode_data.text[out_ptr] = (unsigned char)chr;
            count++;
            if (++out_ptr >= DDICSIZ) {
                out_ptr = 0;
                if (write_text(metadata->ofd, decode_data.text, DDICSIZ) != CL_SUCCESS) {
                    free(decode_data.text);
                    metadata->offset = decode_data.offset;
                    return CL_EWRITE;
                }
            }
        } else {
            j = chr - 1 + THRESHOLD;
            count += j;
            pos = decode_ptr(&decode_data);
            if (decode_data.status != CL_SUCCESS) {
                free(decode_data.text);
                metadata->offset = decode_data.offset;
                return decode_data.status;
            }
            if ((i = out_ptr - pos - 1) < 0) {
                i += DDICSIZ;
            }
            if ((i >= DDICSIZ) || (i < 0)) {
                cli_dbgmsg("UNARJ: bounds exceeded - probably a corrupted file.\n");
                break;
            }
            while (j-- > 0) {
                decode_data.text[out_ptr] = decode_data.text[i];
                if (++out_ptr >= DDICSIZ) {
                    out_ptr = 0;
                    if (write_text(metadata->ofd, decode_data.text, DDICSIZ) != CL_SUCCESS) {
                        free(decode_data.text);
                        metadata->offset = decode_data.offset;
                        return CL_EWRITE;
                    }
                }
                if (++i >= DDICSIZ) {
                    i = 0;
                }
            }
        }
    }
    if (out_ptr != 0) {
        write_text(metadata->ofd, decode_data.text, out_ptr);
    }

    free(decode_data.text);
    metadata->offset = decode_data.offset;
    return CL_SUCCESS;
}

static cl_error_t arj_unstore(arj_metadata_t *metadata, int ofd, uint32_t len)
{
    const unsigned char *data;
    uint32_t rem;
    unsigned int todo;
    size_t count;

    cli_dbgmsg("in arj_unstore\n");
    rem = len;

    while (rem > 0) {
        todo = (unsigned int)MIN(8192, rem);
        data = fmap_need_off_once_len(metadata->map, metadata->offset, todo, &count);
        if (!data || !count) {
            /* Truncated file, not enough bytes available */
            return CL_EFORMAT;
        }
        metadata->offset += count;
        if (cli_writen(ofd, data, count) != count) {
            /* File writing problem */
            return CL_EWRITE;
        }
        rem -= count;
    }
    return CL_SUCCESS;
}

static int is_arj_archive(arj_metadata_t *metadata)
{
    const char header_id[2] = {0x60, 0xea};
    const char *mark;

    mark = fmap_need_off_once(metadata->map, metadata->offset, 2);
    if (!mark)
        return FALSE;
    metadata->offset += 2;
    if (memcmp(&mark[0], &header_id[0], 2) == 0) {
        return TRUE;
    }
    cli_dbgmsg("Not an ARJ archive\n");
    return FALSE;
}

static int arj_read_main_header(arj_metadata_t *metadata)
{
    uint16_t header_size, count;
    arj_main_hdr_t main_hdr;
    const char *filename = NULL;
    const char *comment  = NULL;
    struct text_norm_state fnstate, comstate;
    unsigned char *fnnorm  = NULL;
    unsigned char *comnorm = NULL;
    uint32_t ret           = TRUE;

    size_t filename_max_len = 0;
    size_t filename_len     = 0;
    size_t comment_max_len  = 0;
    size_t comment_len      = 0;
    size_t orig_offset      = metadata->offset;

    if (fmap_readn(metadata->map, &header_size, metadata->offset, 2) != 2)
        return FALSE;

    metadata->offset += 2;
    header_size = le16_to_host(header_size);
    cli_dbgmsg("Header Size: %d\n", header_size);
    if (header_size == 0) {
        /* End of archive */
        ret = FALSE;
        goto done;
    }
    if (header_size > HEADERSIZE_MAX) {
        cli_dbgmsg("arj_read_header: invalid header_size: %u\n ", header_size);
        ret = FALSE;
        goto done;
    }
    if ((header_size + sizeof(header_size)) > (metadata->map->len - metadata->offset)) {
        cli_dbgmsg("arj_read_header: invalid header_size: %u, exceeds length of file.\n", header_size);
        ret = FALSE;
        goto done;
    }
    if (fmap_readn(metadata->map, &main_hdr, metadata->offset, 30) != 30) {
        ret = FALSE;
        goto done;
    }
    metadata->offset += 30;

    cli_dbgmsg("ARJ Main File Header\n");
    cli_dbgmsg("First Header Size: %d\n", main_hdr.first_hdr_size);
    cli_dbgmsg("Version: %d\n", main_hdr.version);
    cli_dbgmsg("Min version: %d\n", main_hdr.min_version);
    cli_dbgmsg("Host OS: %d\n", main_hdr.host_os);
    cli_dbgmsg("Flags: 0x%x\n", main_hdr.flags);
    cli_dbgmsg("Security version: %d\n", main_hdr.security_version);
    cli_dbgmsg("File type: %d\n", main_hdr.file_type);

    if (main_hdr.first_hdr_size < 30) {
        cli_dbgmsg("Format error. First Header Size < 30\n");
        ret = FALSE;
        goto done;
    }
    if (main_hdr.first_hdr_size > 30) {
        metadata->offset += main_hdr.first_hdr_size - 30;
    }

    filename_max_len = (header_size + sizeof(header_size)) - (metadata->offset - orig_offset);
    if (filename_max_len > header_size) {
        cli_dbgmsg("UNARJ: Format error. First Header Size invalid\n");
        ret = FALSE;
        goto done;
    }
    if (filename_max_len > 0) {
        fnnorm   = cli_calloc(sizeof(unsigned char), filename_max_len + 1);
        filename = fmap_need_offstr(metadata->map, metadata->offset, filename_max_len + 1);
        if (!filename || !fnnorm) {
            cli_dbgmsg("UNARJ: Unable to allocate memory for filename\n");
            ret = FALSE;
            goto done;
        }
        filename_len = CLI_STRNLEN(filename, filename_max_len);
    }
    metadata->offset += filename_len + 1;

    comment_max_len = (header_size + sizeof(header_size)) - (metadata->offset - orig_offset);
    if (comment_max_len > header_size) {
        cli_dbgmsg("UNARJ: Format error. First Header Size invalid\n");
        ret = FALSE;
        goto done;
    }
    if (comment_max_len > 0) {
        comnorm = cli_calloc(sizeof(unsigned char), comment_max_len + 1);
        comment = fmap_need_offstr(metadata->map, metadata->offset, comment_max_len + 1);
        if (!comment || !comnorm) {
            cli_dbgmsg("UNARJ: Unable to allocate memory for comment\n");
            ret = FALSE;
            goto done;
        }
        comment_len = CLI_STRNLEN(comment, comment_max_len);
    }
    metadata->offset += comment_len + 1;

    text_normalize_init(&fnstate, fnnorm, filename_max_len);
    text_normalize_init(&comstate, comnorm, comment_max_len);

    text_normalize_buffer(&fnstate, (const unsigned char *)filename, filename_len);
    text_normalize_buffer(&comstate, (const unsigned char *)comment, comment_len);

    cli_dbgmsg("Filename: %s\n", fnnorm);
    cli_dbgmsg("Comment: %s\n", comnorm);

    metadata->offset += 4; /* crc */
    /* Skip past any extended header data */
    for (;;) {
        const uint16_t *countp = fmap_need_off_once(metadata->map, metadata->offset, 2);
        if (!countp) {
            ret = FALSE;
            goto done;
        }
        count = cli_readint16(countp);
        metadata->offset += 2;
        cli_dbgmsg("Extended header size: %d\n", count);
        if (count == 0) {
            break;
        }
        /* Skip extended header + 4byte CRC */
        metadata->offset += count + 4;
    }

done:

    if (fnnorm) {
        free(fnnorm);
        fnnorm = NULL;
    }

    if (comnorm) {
        free(comnorm);
        comnorm = NULL;
    }
    return ret;
}

static cl_error_t arj_read_file_header(arj_metadata_t *metadata)
{
    uint16_t header_size, count;
    const char *filename = NULL, *comment = NULL;
    arj_file_hdr_t file_hdr;
    struct text_norm_state fnstate, comstate;
    unsigned char *fnnorm  = NULL;
    unsigned char *comnorm = NULL;
    cl_error_t ret         = CL_SUCCESS;

    size_t filename_max_len = 0;
    size_t filename_len     = 0;
    size_t comment_max_len  = 0;
    size_t comment_len      = 0;
    size_t orig_offset      = metadata->offset;

    if (fmap_readn(metadata->map, &header_size, metadata->offset, 2) != 2)
        return CL_EFORMAT;
    header_size = le16_to_host(header_size);
    metadata->offset += 2;

    cli_dbgmsg("Header Size: %d\n", header_size);
    if (header_size == 0) {
        /* End of archive */
        ret = CL_BREAK;
        goto done;
    }
    if (header_size > HEADERSIZE_MAX) {
        cli_dbgmsg("arj_read_file_header: invalid header_size: %u\n ", header_size);
        ret = CL_EFORMAT;
        goto done;
    }
    if ((header_size + sizeof(header_size)) > (metadata->map->len - metadata->offset)) {
        cli_dbgmsg("arj_read_file_header: invalid header_size: %u, exceeds length of file.\n", header_size);
        ret = CL_EFORMAT;
        goto done;
    }
    if (fmap_readn(metadata->map, &file_hdr, metadata->offset, 30) != 30) {
        ret = CL_EFORMAT;
        goto done;
    }
    metadata->offset += 30;
    file_hdr.comp_size = le32_to_host(file_hdr.comp_size);
    file_hdr.orig_size = le32_to_host(file_hdr.orig_size);

    cli_dbgmsg("ARJ File Header\n");
    cli_dbgmsg("First Header Size: %d\n", file_hdr.first_hdr_size);
    cli_dbgmsg("Version: %d\n", file_hdr.version);
    cli_dbgmsg("Min version: %d\n", file_hdr.min_version);
    cli_dbgmsg("Host OS: %d\n", file_hdr.host_os);
    cli_dbgmsg("Flags: 0x%x\n", file_hdr.flags);
    cli_dbgmsg("Method: %d\n", file_hdr.method);
    cli_dbgmsg("File type: %d\n", file_hdr.file_type);
    cli_dbgmsg("File type: %d\n", file_hdr.password_mod);
    cli_dbgmsg("Compressed size: %u\n", file_hdr.comp_size);
    cli_dbgmsg("Original size: %u\n", file_hdr.orig_size);

    if (file_hdr.first_hdr_size < 30) {
        cli_dbgmsg("Format error. First Header Size < 30\n");
        ret = CL_EFORMAT;
        goto done;
    }

    /* Note: this skips past any extended file start position data (multi-volume) */
    if (file_hdr.first_hdr_size > 30) {
        metadata->offset += file_hdr.first_hdr_size - 30;
    }

    filename_max_len = (header_size + sizeof(header_size)) - (metadata->offset - orig_offset);
    if (filename_max_len > header_size) {
        cli_dbgmsg("UNARJ: Format error. First Header Size invalid\n");
        ret = CL_EFORMAT;
        goto done;
    }
    if (filename_max_len > 0) {
        fnnorm = cli_calloc(sizeof(unsigned char), filename_max_len + 1);
        if (!fnnorm) {
            cli_dbgmsg("UNARJ: Unable to allocate memory for filename\n");
            ret = CL_EMEM;
            goto done;
        }
        filename = fmap_need_offstr(metadata->map, metadata->offset, filename_max_len + 1);
        if (!filename) {
            cli_dbgmsg("UNARJ: Filename is out of file\n");
            ret = CL_EFORMAT;
            goto done;
        }
        filename_len = CLI_STRNLEN(filename, filename_max_len);
    }
    metadata->offset += filename_len + 1;

    comment_max_len = (header_size + sizeof(header_size)) - (metadata->offset - orig_offset);
    if (comment_max_len > header_size) {
        cli_dbgmsg("UNARJ: Format error. First Header Size invalid\n");
        ret = CL_EFORMAT;
        goto done;
    }
    if (comment_max_len > 0) {
        comnorm = cli_calloc(sizeof(unsigned char), comment_max_len + 1);
        if (!comnorm) {
            cli_dbgmsg("UNARJ: Unable to allocate memory for comment\n");
            ret = CL_EMEM;
            goto done;
        }
        comment = fmap_need_offstr(metadata->map, metadata->offset, comment_max_len + 1);
        if (!comment) {
            cli_dbgmsg("UNARJ: comment is out of file\n");
            ret = CL_EFORMAT;
            goto done;
        }
        comment_len += CLI_STRNLEN(comment, comment_max_len);
    }
    metadata->offset += comment_len + 1;

    text_normalize_init(&fnstate, fnnorm, filename_max_len);
    text_normalize_init(&comstate, comnorm, comment_max_len);

    text_normalize_buffer(&fnstate, (const unsigned char *)filename, filename_len);
    text_normalize_buffer(&comstate, (const unsigned char *)comment, comment_len);

    cli_dbgmsg("Filename: %s\n", fnnorm);
    cli_dbgmsg("Comment: %s\n", comnorm);
    metadata->filename = CLI_STRNDUP(filename, filename_len);

    /* Skip CRC */
    metadata->offset += 4;

    /* Skip past any extended header data */
    for (;;) {
        const uint16_t *countp = fmap_need_off_once(metadata->map, metadata->offset, 2);
        if (!countp) {
            if (metadata->filename)
                free(metadata->filename);
            metadata->filename = NULL;
            ret                = CL_EFORMAT;
            goto done;
        }
        count = cli_readint16(countp);
        metadata->offset += 2;
        cli_dbgmsg("Extended header size: %d\n", count);
        if (count == 0) {
            break;
        }
        /* Skip extended header + 4byte CRC */
        metadata->offset += count + 4;
    }
    metadata->comp_size = file_hdr.comp_size;
    metadata->orig_size = file_hdr.orig_size;
    metadata->method    = file_hdr.method;
    metadata->encrypted = ((file_hdr.flags & GARBLE_FLAG) != 0) ? TRUE : FALSE;
    metadata->ofd       = -1;
    if (!metadata->filename) {
        ret = CL_EMEM;
        goto done;
    }

done:

    if (fnnorm) {
        free(fnnorm);
        fnnorm = NULL;
    }

    if (comnorm) {
        free(comnorm);
        comnorm = NULL;
    }
    return ret;
}

cl_error_t cli_unarj_open(fmap_t *map, const char *dirname, arj_metadata_t *metadata)
{
    UNUSEDPARAM(dirname);
    cli_dbgmsg("in cli_unarj_open\n");
    metadata->map    = map;
    metadata->offset = 0;
    if (!is_arj_archive(metadata)) {
        cli_dbgmsg("Not in ARJ format\n");
        return CL_EFORMAT;
    }
    if (!arj_read_main_header(metadata)) {
        cli_dbgmsg("Failed to read main header\n");
        return CL_EFORMAT;
    }
    return CL_SUCCESS;
}

cl_error_t cli_unarj_prepare_file(const char *dirname, arj_metadata_t *metadata)
{
    cli_dbgmsg("in cli_unarj_prepare_file\n");
    if (!metadata || !dirname) {
        return CL_ENULLARG;
    }
    /* Each file is preceded by the ARJ file marker */
    if (!is_arj_archive(metadata)) {
        cli_dbgmsg("Not in ARJ format\n");
        return CL_EFORMAT;
    }
    return arj_read_file_header(metadata);
}

cl_error_t cli_unarj_extract_file(const char *dirname, arj_metadata_t *metadata)
{
    cl_error_t ret = CL_SUCCESS;
    char filename[1024];

    cli_dbgmsg("in cli_unarj_extract_file\n");
    if (!metadata || !dirname) {
        return CL_ENULLARG;
    }

    if (metadata->encrypted) {
        cli_dbgmsg("PASSWORDed file (skipping)\n");
        metadata->offset += metadata->comp_size;
        cli_dbgmsg("Target offset: %lu\n", (unsigned long int)metadata->offset);
        return CL_SUCCESS;
    }

    snprintf(filename, 1024, "%s" PATHSEP "file.uar", dirname);
    cli_dbgmsg("Filename: %s\n", filename);
    metadata->ofd = open(filename, O_RDWR | O_CREAT | O_TRUNC | O_BINARY, 0600);
    if (metadata->ofd < 0) {
        return CL_EOPEN;
    }
    switch (metadata->method) {
        case 0:
            ret = arj_unstore(metadata, metadata->ofd, metadata->comp_size);
            break;
        case 1:
        case 2:
        case 3:
            ret = decode(metadata);
            break;
        case 4:
            ret = decode_f(metadata);
            break;
        default:
            ret = CL_EFORMAT;
            break;
    }
    return ret;
}

Coverage Report

Created: 2023-12-08 06:48