Coverage Report

Created: 2025-08-12 07:37

/src/xz/src/liblzma/lz/lz_decoder.c
Line
Count
Source (jump to first uncovered line)
1
// SPDX-License-Identifier: 0BSD
2
3
///////////////////////////////////////////////////////////////////////////////
4
//
5
/// \file       lz_decoder.c
6
/// \brief      LZ out window
7
///
8
//  Authors:    Igor Pavlov
9
//              Lasse Collin
10
//
11
///////////////////////////////////////////////////////////////////////////////
12
13
// liblzma supports multiple LZ77-based filters. The LZ part is shared
14
// between these filters. The LZ code takes care of dictionary handling
15
// and passing the data between filters in the chain. The filter-specific
16
// part decodes from the input buffer to the dictionary.
17
18
19
#include "lz_decoder.h"
20
21
22
typedef struct {
23
  /// Dictionary (history buffer)
24
  lzma_dict dict;
25
26
  /// The actual LZ-based decoder e.g. LZMA
27
  lzma_lz_decoder lz;
28
29
  /// Next filter in the chain, if any. Note that LZMA and LZMA2 are
30
  /// only allowed as the last filter, but the long-range filter in
31
  /// future can be in the middle of the chain.
32
  lzma_next_coder next;
33
34
  /// True if the next filter in the chain has returned LZMA_STREAM_END.
35
  bool next_finished;
36
37
  /// True if the LZ decoder (e.g. LZMA) has detected end of payload
38
  /// marker. This may become true before next_finished becomes true.
39
  bool this_finished;
40
41
  /// Temporary buffer needed when the LZ-based filter is not the last
42
  /// filter in the chain. The output of the next filter is first
43
  /// decoded into buffer[], which is then used as input for the actual
44
  /// LZ-based decoder.
45
  struct {
46
    size_t pos;
47
    size_t size;
48
    uint8_t buffer[LZMA_BUFFER_SIZE];
49
  } temp;
50
} lzma_coder;
51
52
53
static void
54
lz_decoder_reset(lzma_coder *coder)
55
59.6k
{
56
59.6k
  coder->dict.pos = LZ_DICT_INIT_POS;
57
59.6k
  coder->dict.full = 0;
58
59.6k
  coder->dict.buf[LZ_DICT_INIT_POS - 1] = '\0';
59
59.6k
  coder->dict.has_wrapped = false;
60
59.6k
  coder->dict.need_reset = false;
61
59.6k
  return;
62
59.6k
}
63
64
65
static lzma_ret
66
decode_buffer(lzma_coder *coder,
67
    const uint8_t *restrict in, size_t *restrict in_pos,
68
    size_t in_size, uint8_t *restrict out,
69
    size_t *restrict out_pos, size_t out_size)
70
869k
{
71
915k
  while (true) {
72
    // Wrap the dictionary if needed.
73
915k
    if (coder->dict.pos == coder->dict.size) {
74
      // See the comment of #define LZ_DICT_REPEAT_MAX.
75
18.6k
      coder->dict.pos = LZ_DICT_REPEAT_MAX;
76
18.6k
      coder->dict.has_wrapped = true;
77
18.6k
      memcpy(coder->dict.buf, coder->dict.buf
78
18.6k
            + coder->dict.size
79
18.6k
            - LZ_DICT_REPEAT_MAX,
80
18.6k
          LZ_DICT_REPEAT_MAX);
81
18.6k
    }
82
83
    // Store the current dictionary position. It is needed to know
84
    // where to start copying to the out[] buffer.
85
915k
    const size_t dict_start = coder->dict.pos;
86
87
    // Calculate how much we allow coder->lz.code() to decode.
88
    // It must not decode past the end of the dictionary
89
    // buffer, and we don't want it to decode more than is
90
    // actually needed to fill the out[] buffer.
91
915k
    coder->dict.limit = coder->dict.pos
92
915k
        + my_min(out_size - *out_pos,
93
915k
          coder->dict.size - coder->dict.pos);
94
95
    // Call the coder->lz.code() to do the actual decoding.
96
915k
    const lzma_ret ret = coder->lz.code(
97
915k
        coder->lz.coder, &coder->dict,
98
915k
        in, in_pos, in_size);
99
100
    // Copy the decoded data from the dictionary to the out[]
101
    // buffer. Do it conditionally because out can be NULL
102
    // (in which case copy_size is always 0). Calling memcpy()
103
    // with a null-pointer is undefined even if the third
104
    // argument is 0.
105
915k
    const size_t copy_size = coder->dict.pos - dict_start;
106
915k
    assert(copy_size <= out_size - *out_pos);
107
108
915k
    if (copy_size > 0)
109
648k
      memcpy(out + *out_pos, coder->dict.buf + dict_start,
110
648k
          copy_size);
111
112
915k
    *out_pos += copy_size;
113
114
    // Reset the dictionary if so requested by coder->lz.code().
115
915k
    if (coder->dict.need_reset) {
116
28.4k
      lz_decoder_reset(coder);
117
118
      // Since we reset dictionary, we don't check if
119
      // dictionary became full.
120
28.4k
      if (ret != LZMA_OK || *out_pos == out_size)
121
475
        return ret;
122
887k
    } else {
123
      // Return if everything got decoded or an error
124
      // occurred, or if there's no more data to decode.
125
      //
126
      // Note that detecting if there's something to decode
127
      // is done by looking if dictionary become full
128
      // instead of looking if *in_pos == in_size. This
129
      // is because it is possible that all the input was
130
      // consumed already but some data is pending to be
131
      // written to the dictionary.
132
887k
      if (ret != LZMA_OK || *out_pos == out_size
133
887k
          || coder->dict.pos < coder->dict.size)
134
868k
        return ret;
135
887k
    }
136
915k
  }
137
869k
}
138
139
140
static lzma_ret
141
lz_decode(void *coder_ptr, const lzma_allocator *allocator,
142
    const uint8_t *restrict in, size_t *restrict in_pos,
143
    size_t in_size, uint8_t *restrict out,
144
    size_t *restrict out_pos, size_t out_size,
145
    lzma_action action)
146
869k
{
147
869k
  lzma_coder *coder = coder_ptr;
148
149
869k
  if (coder->next.code == NULL)
150
869k
    return decode_buffer(coder, in, in_pos, in_size,
151
869k
        out, out_pos, out_size);
152
153
  // We aren't the last coder in the chain, we need to decode
154
  // our input to a temporary buffer.
155
0
  while (*out_pos < out_size) {
156
    // Fill the temporary buffer if it is empty.
157
0
    if (!coder->next_finished
158
0
        && coder->temp.pos == coder->temp.size) {
159
0
      coder->temp.pos = 0;
160
0
      coder->temp.size = 0;
161
162
0
      const lzma_ret ret = coder->next.code(
163
0
          coder->next.coder,
164
0
          allocator, in, in_pos, in_size,
165
0
          coder->temp.buffer, &coder->temp.size,
166
0
          LZMA_BUFFER_SIZE, action);
167
168
0
      if (ret == LZMA_STREAM_END)
169
0
        coder->next_finished = true;
170
0
      else if (ret != LZMA_OK || coder->temp.size == 0)
171
0
        return ret;
172
0
    }
173
174
0
    if (coder->this_finished) {
175
0
      if (coder->temp.size != 0)
176
0
        return LZMA_DATA_ERROR;
177
178
0
      if (coder->next_finished)
179
0
        return LZMA_STREAM_END;
180
181
0
      return LZMA_OK;
182
0
    }
183
184
0
    const lzma_ret ret = decode_buffer(coder, coder->temp.buffer,
185
0
        &coder->temp.pos, coder->temp.size,
186
0
        out, out_pos, out_size);
187
188
0
    if (ret == LZMA_STREAM_END)
189
0
      coder->this_finished = true;
190
0
    else if (ret != LZMA_OK)
191
0
      return ret;
192
0
    else if (coder->next_finished && *out_pos < out_size)
193
0
      return LZMA_DATA_ERROR;
194
0
  }
195
196
0
  return LZMA_OK;
197
0
}
198
199
200
static void
201
lz_decoder_end(void *coder_ptr, const lzma_allocator *allocator)
202
14.1k
{
203
14.1k
  lzma_coder *coder = coder_ptr;
204
205
14.1k
  lzma_next_end(&coder->next, allocator);
206
14.1k
  lzma_free(coder->dict.buf, allocator);
207
208
14.1k
  if (coder->lz.end != NULL)
209
11.4k
    coder->lz.end(coder->lz.coder, allocator);
210
2.68k
  else
211
2.68k
    lzma_free(coder->lz.coder, allocator);
212
213
14.1k
  lzma_free(coder, allocator);
214
14.1k
  return;
215
14.1k
}
216
217
218
extern lzma_ret
219
lzma_lz_decoder_init(lzma_next_coder *next, const lzma_allocator *allocator,
220
    const lzma_filter_info *filters,
221
    lzma_ret (*lz_init)(lzma_lz_decoder *lz,
222
      const lzma_allocator *allocator,
223
      lzma_vli id, const void *options,
224
      lzma_lz_options *lz_options))
225
31.2k
{
226
  // Allocate the base structure if it isn't already allocated.
227
31.2k
  lzma_coder *coder = next->coder;
228
31.2k
  if (coder == NULL) {
229
14.1k
    coder = lzma_alloc(sizeof(lzma_coder), allocator);
230
14.1k
    if (coder == NULL)
231
0
      return LZMA_MEM_ERROR;
232
233
14.1k
    next->coder = coder;
234
14.1k
    next->code = &lz_decode;
235
14.1k
    next->end = &lz_decoder_end;
236
237
14.1k
    coder->dict.buf = NULL;
238
14.1k
    coder->dict.size = 0;
239
14.1k
    coder->lz = LZMA_LZ_DECODER_INIT;
240
14.1k
    coder->next = LZMA_NEXT_CODER_INIT;
241
14.1k
  }
242
243
  // Allocate and initialize the LZ-based decoder. It will also give
244
  // us the dictionary size.
245
31.2k
  lzma_lz_options lz_options;
246
31.2k
  return_if_error(lz_init(&coder->lz, allocator,
247
31.2k
      filters[0].id, filters[0].options, &lz_options));
248
249
  // If the dictionary size is very small, increase it to 4096 bytes.
250
  // This is to prevent constant wrapping of the dictionary, which
251
  // would slow things down. The downside is that since we don't check
252
  // separately for the real dictionary size, we may happily accept
253
  // corrupt files.
254
31.2k
  if (lz_options.dict_size < 4096)
255
1.64k
    lz_options.dict_size = 4096;
256
257
  // Make dictionary size a multiple of 16. Some LZ-based decoders like
258
  // LZMA use the lowest bits lzma_dict.pos to know the alignment of the
259
  // data. Aligned buffer is also good when memcpying from the
260
  // dictionary to the output buffer, since applications are
261
  // recommended to give aligned buffers to liblzma.
262
  //
263
  // Reserve 2 * LZ_DICT_REPEAT_MAX bytes of extra space which is
264
  // needed for alloc_size. Reserve also LZ_DICT_EXTRA bytes of extra
265
  // space which is *not* counted in alloc_size or coder->dict.size.
266
  //
267
  // Avoid integer overflow.
268
31.2k
  if (lz_options.dict_size > SIZE_MAX - 15 - 2 * LZ_DICT_REPEAT_MAX
269
31.2k
      - LZ_DICT_EXTRA)
270
0
    return LZMA_MEM_ERROR;
271
272
31.2k
  lz_options.dict_size = (lz_options.dict_size + 15) & ~((size_t)(15));
273
274
  // Reserve extra space as explained in the comment
275
  // of #define LZ_DICT_REPEAT_MAX.
276
31.2k
  const size_t alloc_size
277
31.2k
      = lz_options.dict_size + 2 * LZ_DICT_REPEAT_MAX;
278
279
  // Allocate and initialize the dictionary.
280
31.2k
  if (coder->dict.size != alloc_size) {
281
14.3k
    lzma_free(coder->dict.buf, allocator);
282
283
    // The LZ_DICT_EXTRA bytes at the end of the buffer aren't
284
    // included in alloc_size. These extra bytes allow
285
    // dict_repeat() to read and write more data than requested.
286
    // Otherwise this extra space is ignored.
287
14.3k
    coder->dict.buf = lzma_alloc(alloc_size + LZ_DICT_EXTRA,
288
14.3k
        allocator);
289
14.3k
    if (coder->dict.buf == NULL)
290
22
      return LZMA_MEM_ERROR;
291
292
    // NOTE: Yes, alloc_size, not lz_options.dict_size. The way
293
    // coder->dict.full is updated will take care that we will
294
    // still reject distances larger than lz_options.dict_size.
295
14.3k
    coder->dict.size = alloc_size;
296
14.3k
  }
297
298
31.2k
  lz_decoder_reset(next->coder);
299
300
  // Use the preset dictionary if it was given to us.
301
31.2k
  if (lz_options.preset_dict != NULL
302
31.2k
      && lz_options.preset_dict_size > 0) {
303
    // If the preset dictionary is bigger than the actual
304
    // dictionary, copy only the tail.
305
0
    const size_t copy_size = my_min(lz_options.preset_dict_size,
306
0
        lz_options.dict_size);
307
0
    const size_t offset = lz_options.preset_dict_size - copy_size;
308
0
    memcpy(coder->dict.buf + coder->dict.pos,
309
0
        lz_options.preset_dict + offset,
310
0
        copy_size);
311
312
    // dict.pos isn't zero after lz_decoder_reset().
313
0
    coder->dict.pos += copy_size;
314
0
    coder->dict.full = copy_size;
315
0
  }
316
317
  // Miscellaneous initializations
318
31.2k
  coder->next_finished = false;
319
31.2k
  coder->this_finished = false;
320
31.2k
  coder->temp.pos = 0;
321
31.2k
  coder->temp.size = 0;
322
323
  // Initialize the next filter in the chain, if any.
324
31.2k
  return lzma_next_filter_init(&coder->next, allocator, filters + 1);
325
31.2k
}
326
327
328
extern uint64_t
329
lzma_lz_decoder_memusage(size_t dictionary_size)
330
31.2k
{
331
31.2k
  return sizeof(lzma_coder) + (uint64_t)(dictionary_size)
332
31.2k
      + 2 * LZ_DICT_REPEAT_MAX + LZ_DICT_EXTRA;
333
31.2k
}