/*-

 * Copyright (c) 2003-2023 Tim Kientzle

 * Copyright (c) 2011-2012 Michihiro NAKAJIMA

 * Copyright (c) 2016 Martin Matuska

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "archive_platform.h"

#ifdef HAVE_ERRNO_H

#include <errno.h>

#endif

#include <stddef.h>

#ifdef HAVE_STDLIB_H

#include <stdlib.h>

#endif

#ifdef HAVE_STRING_H

#include <string.h>

#endif

#include "archive.h"

#include "archive_acl_private.h" /* For ACL parsing routines. */

#include "archive_entry.h"

#include "archive_entry_locale.h"

#include "archive_private.h"

#include "archive_read_private.h"

#define tar_min(a,b) ((a) < (b) ? (a) : (b))

/*

 * Layout of POSIX 'ustar' tar header.

 */

struct archive_entry_header_ustar {

  char  name[100];

  char  mode[8];

  char  uid[8];

  char  gid[8];

  char  size[12];

  char  mtime[12];

  char  checksum[8];

  char  typeflag[1];

  char  linkname[100];  /* "old format" header ends here */

  char  magic[6]; /* For POSIX: "ustar\0" */

  char  version[2]; /* For POSIX: "00" */

  char  uname[32];

  char  gname[32];

  char  rdevmajor[8];

  char  rdevminor[8];

  char  prefix[155];

};

/*

 * Structure of GNU tar header

 */

struct gnu_sparse {

  char  offset[12];

  char  numbytes[12];

};

struct archive_entry_header_gnutar {

  char  name[100];

  char  mode[8];

  char  uid[8];

  char  gid[8];

  char  size[12];

  char  mtime[12];

  char  checksum[8];

  char  typeflag[1];

  char  linkname[100];

  char  magic[8];  /* "ustar  \0" (note blank/blank/null at end) */

  char  uname[32];

  char  gname[32];

  char  rdevmajor[8];

  char  rdevminor[8];

  char  atime[12];

  char  ctime[12];

  char  offset[12];

  char  longnames[4];

  char  unused[1];

  struct gnu_sparse sparse[4];

  char  isextended[1];

  char  realsize[12];

  /*

   * Old GNU format doesn't use POSIX 'prefix' field; they use

   * the 'L' (longname) entry instead.

   */

};

/*

 * Data specific to this format.

 */

struct sparse_block {

  struct sparse_block *next;

  int64_t offset;

  int64_t remaining;

  int hole;

};

struct tar {

  struct archive_string  entry_pathname;

  /* For "GNU.sparse.name" and other similar path extensions. */

  struct archive_string  entry_pathname_override;

  struct archive_string  entry_uname;

  struct archive_string  entry_gname;

  struct archive_string  entry_linkpath;

  struct archive_string  longname;

  struct archive_string  pax_global;

  struct archive_string  line;

  int      pax_hdrcharset_utf8;

  int64_t      entry_bytes_remaining;

  int64_t      entry_offset;

  int64_t      entry_padding;

  int64_t      entry_bytes_unconsumed;

  int64_t      realsize;

  struct sparse_block *sparse_list;

  struct sparse_block *sparse_last;

  int64_t      sparse_offset;

  int64_t      sparse_numbytes;

  int      sparse_gnu_major;

  int      sparse_gnu_minor;

  char       sparse_gnu_attributes_seen;

  char       filetype;

  struct archive_string  localname;

  struct archive_string_conv *opt_sconv;

  struct archive_string_conv *sconv;

  struct archive_string_conv *sconv_acl;

  struct archive_string_conv *sconv_default;

  int      init_default_conversion;

  int      compat_2x;

  int      process_mac_extensions;

  int      read_concatenated_archives;

  int      realsize_override;

};

static int  archive_block_is_null(const char *p);

static char *base64_decode(const char *, size_t, size_t *);

static int  gnu_add_sparse_entry(struct archive_read *, struct tar *,

        int64_t offset, int64_t remaining);

static void gnu_clear_sparse_list(struct tar *);

static int  gnu_sparse_old_read(struct archive_read *, struct tar *,

        const struct archive_entry_header_gnutar *header, size_t *);

static int  gnu_sparse_old_parse(struct archive_read *, struct tar *,

        const struct gnu_sparse *sparse, int length);

static int  gnu_sparse_01_parse(struct archive_read *, struct tar *,

        const char *, size_t);

static ssize_t  gnu_sparse_10_read(struct archive_read *, struct tar *,

        size_t *);

static int  header_Solaris_ACL(struct archive_read *,  struct tar *,

        struct archive_entry *, const void *, size_t *);

static int  header_common(struct archive_read *,  struct tar *,

        struct archive_entry *, const void *);

static int  header_old_tar(struct archive_read *, struct tar *,

        struct archive_entry *, const void *);

static int  header_pax_extension(struct archive_read *, struct tar *,

        struct archive_entry *, const void *, size_t *);

static int  header_pax_global(struct archive_read *, struct tar *,

        struct archive_entry *, const void *h, size_t *);

static int  header_gnu_longlink(struct archive_read *, struct tar *,

        struct archive_entry *, const void *h, size_t *);

static int  header_gnu_longname(struct archive_read *, struct tar *,

        struct archive_entry *, const void *h, size_t *);

static int  is_mac_metadata_entry(struct archive_entry *entry);

static int  read_mac_metadata_blob(struct archive_read *,

        struct archive_entry *, size_t *);

static int  header_volume(struct archive_read *, struct tar *,

        struct archive_entry *, const void *h, size_t *);

static int  header_ustar(struct archive_read *, struct tar *,

        struct archive_entry *, const void *h);

static int  header_gnutar(struct archive_read *, struct tar *,

        struct archive_entry *, const void *h, size_t *);

static int  archive_read_format_tar_bid(struct archive_read *, int);

static int  archive_read_format_tar_options(struct archive_read *,

        const char *, const char *);

static int  archive_read_format_tar_cleanup(struct archive_read *);

static int  archive_read_format_tar_read_data(struct archive_read *a,

        const void **buff, size_t *size, int64_t *offset);

static int  archive_read_format_tar_skip(struct archive_read *a);

static int  archive_read_format_tar_read_header(struct archive_read *,

        struct archive_entry *);

static int  checksum(struct archive_read *, const void *);

static int  pax_attribute(struct archive_read *, struct tar *,

        struct archive_entry *, const char *key, size_t key_length,

        size_t value_length, size_t *unconsumed);

static int  pax_attribute_LIBARCHIVE_xattr(struct archive_entry *,

        const char *, size_t, const char *, size_t);

static int  pax_attribute_SCHILY_acl(struct archive_read *, struct tar *,

        struct archive_entry *, size_t, int);

static int  pax_attribute_SUN_holesdata(struct archive_read *, struct tar *,

        struct archive_entry *, const char *, size_t);

static void pax_time(const char *, size_t, int64_t *sec, long *nanos);

static ssize_t  readline(struct archive_read *, struct tar *, const char **,

        ssize_t limit, size_t *);

static int  read_body_to_string(struct archive_read *, struct tar *,

        struct archive_string *, const void *h, size_t *);

static int  read_bytes_to_string(struct archive_read *,

        struct archive_string *, size_t, size_t *);

static int64_t  tar_atol(const char *, size_t);

static int64_t  tar_atol10(const char *, size_t);

static int64_t  tar_atol256(const char *, size_t);

static int64_t  tar_atol8(const char *, size_t);

static int  tar_read_header(struct archive_read *, struct tar *,

        struct archive_entry *, size_t *);

static int  tohex(int c);

static char *url_decode(const char *, size_t);

static void tar_flush_unconsumed(struct archive_read *, size_t *);

/* Sanity limits:  These numbers should be low enough to

 * prevent a maliciously-crafted archive from forcing us to

 * allocate extreme amounts of memory.  But of course, they

 * need to be high enough for any correct value.  These

 * will likely need some adjustment as we get more experience. */

static const size_t guname_limit = 65536; /* Longest uname or gname: 64kiB */

static const size_t pathname_limit = 1048576; /* Longest path name: 1MiB */

static const size_t sparse_map_limit = 8 * 1048576; /* Longest sparse map: 8MiB */

static const size_t xattr_limit = 16 * 1048576; /* Longest xattr: 16MiB */

static const size_t fflags_limit = 512; /* Longest fflags */

static const size_t acl_limit = 131072; /* Longest textual ACL: 128kiB */

static const int64_t entry_limit = 0xfffffffffffffffLL; /* 2^60 bytes = 1 ExbiByte */

int

archive_read_support_format_gnutar(struct archive *a)

{

  archive_check_magic(a, ARCHIVE_READ_MAGIC,

      ARCHIVE_STATE_NEW, "archive_read_support_format_gnutar");

  return (archive_read_support_format_tar(a));

}

int

archive_read_support_format_tar(struct archive *_a)

{

  struct archive_read *a = (struct archive_read *)_a;

  struct tar *tar;

  int r;

  archive_check_magic(_a, ARCHIVE_READ_MAGIC,

      ARCHIVE_STATE_NEW, "archive_read_support_format_tar");

  tar = (struct tar *)calloc(1, sizeof(*tar));

  if (tar == NULL) {

    archive_set_error(&a->archive, ENOMEM,

        "Can't allocate tar data");

    return (ARCHIVE_FATAL);

  }

#ifdef HAVE_COPYFILE_H

  /* Set this by default on Mac OS. */

  tar->process_mac_extensions = 1;

#endif

  r = __archive_read_register_format(a, tar, "tar",

      archive_read_format_tar_bid,

      archive_read_format_tar_options,

      archive_read_format_tar_read_header,

      archive_read_format_tar_read_data,

      archive_read_format_tar_skip,

      NULL,

      archive_read_format_tar_cleanup,

      NULL,

      NULL);

  if (r != ARCHIVE_OK)

    free(tar);

  return (ARCHIVE_OK);

}

static int

archive_read_format_tar_cleanup(struct archive_read *a)

{

  struct tar *tar;

  tar = (struct tar *)(a->format->data);

  gnu_clear_sparse_list(tar);

  archive_string_free(&tar->entry_pathname);

  archive_string_free(&tar->entry_pathname_override);

  archive_string_free(&tar->entry_uname);

  archive_string_free(&tar->entry_gname);

  archive_string_free(&tar->line);

  archive_string_free(&tar->pax_global);

  archive_string_free(&tar->longname);

  archive_string_free(&tar->localname);

  free(tar);

  (a->format->data) = NULL;

  return (ARCHIVE_OK);

}

/*

 * Validate number field

 *

 * This has to be pretty lenient in order to accommodate the enormous

 * variety of tar writers in the world:

 *  = POSIX (IEEE Std 1003.1-1988) ustar requires octal values with leading

 *    zeros and allows fields to be terminated with space or null characters

 *  = Many writers use different termination (in particular, libarchive

 *    omits terminator bytes to squeeze one or two more digits)

 *  = Many writers pad with space and omit leading zeros

 *  = GNU tar and star write base-256 values if numbers are too

 *    big to be represented in octal

 *

 *  Examples of specific tar headers that we should support:

 *  = Perl Archive::Tar terminates uid, gid, devminor and devmajor with two

 *    null bytes, pads size with spaces and other numeric fields with zeroes

 *  = plexus-archiver prior to 2.6.3 (before switching to commons-compress)

 *    may have uid and gid fields filled with spaces without any octal digits

 *    at all and pads all numeric fields with spaces

 *

 * This should tolerate all variants in use.  It will reject a field

 * where the writer just left garbage after a trailing NUL.

 */

static int

validate_number_field(const char* p_field, size_t i_size)

{

  unsigned char marker = (unsigned char)p_field[0];

  if (marker == 128 || marker == 255 || marker == 0) {

    /* Base-256 marker, there's nothing we can check. */

    return 1;

  } else {

    /* Must be octal */

    size_t i = 0;

    /* Skip any leading spaces */

    while (i < i_size && p_field[i] == ' ') {

      ++i;

    }

    /* Skip octal digits. */

    while (i < i_size && p_field[i] >= '0' && p_field[i] <= '7') {

      ++i;

    }

    /* Any remaining characters must be space or NUL padding. */

    while (i < i_size) {

      if (p_field[i] != ' ' && p_field[i] != 0) {

        return 0;

      }

      ++i;

    }

    return 1;

  }

}

static int

archive_read_format_tar_bid(struct archive_read *a, int best_bid)

{

  int bid;

  const char *h;

  const struct archive_entry_header_ustar *header;

  (void)best_bid; /* UNUSED */

  bid = 0;

  /* Now let's look at the actual header and see if it matches. */

  h = __archive_read_ahead(a, 512, NULL);

  if (h == NULL)

    return (-1);

  /* If it's an end-of-archive mark, we can handle it. */

  if (h[0] == 0 && archive_block_is_null(h)) {

    /*

     * Usually, I bid the number of bits verified, but

     * in this case, 4096 seems excessive so I picked 10 as

     * an arbitrary but reasonable-seeming value.

     */

    return (10);

  }

  /* If it's not an end-of-archive mark, it must have a valid checksum.*/

  if (!checksum(a, h))

    return (0);

  bid += 48;  /* Checksum is usually 6 octal digits. */

  header = (const struct archive_entry_header_ustar *)h;

  /* Recognize POSIX formats. */

  if ((memcmp(header->magic, "ustar\0", 6) == 0)

      && (memcmp(header->version, "00", 2) == 0))

    bid += 56;

  /* Recognize GNU tar format. */

  if ((memcmp(header->magic, "ustar ", 6) == 0)

      && (memcmp(header->version, " \0", 2) == 0))

    bid += 56;

  /* Type flag must be null, digit or A-Z, a-z. */

  if (header->typeflag[0] != 0 &&

      !( header->typeflag[0] >= '0' && header->typeflag[0] <= '9') &&

      !( header->typeflag[0] >= 'A' && header->typeflag[0] <= 'Z') &&

      !( header->typeflag[0] >= 'a' && header->typeflag[0] <= 'z') )

    return (0);

  bid += 2;  /* 6 bits of variation in an 8-bit field leaves 2 bits. */

  /*

   * Check format of mode/uid/gid/mtime/size/rdevmajor/rdevminor fields.

   */

  if (validate_number_field(header->mode, sizeof(header->mode)) == 0

      || validate_number_field(header->uid, sizeof(header->uid)) == 0

      || validate_number_field(header->gid, sizeof(header->gid)) == 0

      || validate_number_field(header->mtime, sizeof(header->mtime)) == 0

      || validate_number_field(header->size, sizeof(header->size)) == 0

      || validate_number_field(header->rdevmajor, sizeof(header->rdevmajor)) == 0

      || validate_number_field(header->rdevminor, sizeof(header->rdevminor)) == 0) {

    bid = 0;

  }

  return (bid);

}

static int

archive_read_format_tar_options(struct archive_read *a,

    const char *key, const char *val)

{

  struct tar *tar;

  int ret = ARCHIVE_FAILED;

  tar = (struct tar *)(a->format->data);

  if (strcmp(key, "compat-2x")  == 0) {

    /* Handle UTF-8 filenames as libarchive 2.x */

    tar->compat_2x = (val != NULL && val[0] != 0);

    tar->init_default_conversion = tar->compat_2x;

    return (ARCHIVE_OK);

  } else if (strcmp(key, "hdrcharset")  == 0) {

    if (val == NULL || val[0] == 0)

      archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,

          "tar: hdrcharset option needs a character-set name");

    else {

      tar->opt_sconv =

          archive_string_conversion_from_charset(

        &a->archive, val, 0);

      if (tar->opt_sconv != NULL)

        ret = ARCHIVE_OK;

      else

        ret = ARCHIVE_FATAL;

    }

    return (ret);

  } else if (strcmp(key, "mac-ext") == 0) {

    tar->process_mac_extensions = (val != NULL && val[0] != 0);

    return (ARCHIVE_OK);

  } else if (strcmp(key, "read_concatenated_archives") == 0) {

    tar->read_concatenated_archives = (val != NULL && val[0] != 0);

    return (ARCHIVE_OK);

  }

  /* Note: The "warn" return is just to inform the options

   * supervisor that we didn't handle it.  It will generate

   * a suitable error if no one used this option. */

  return (ARCHIVE_WARN);

}

/* utility function- this exists to centralize the logic of tracking

 * how much unconsumed data we have floating around, and to consume

 * anything outstanding since we're going to do read_aheads

 */

static void

tar_flush_unconsumed(struct archive_read *a, size_t *unconsumed)

{

  if (*unconsumed) {

/*

    void *data = (void *)__archive_read_ahead(a, *unconsumed, NULL);

     * this block of code is to poison claimed unconsumed space, ensuring

     * things break if it is in use still.

     * currently it WILL break things, so enable it only for debugging this issue

    if (data) {

      memset(data, 0xff, *unconsumed);

    }

*/

    __archive_read_consume(a, *unconsumed);

    *unconsumed = 0;

  }

}

/*

 * The function invoked by archive_read_next_header().  This

 * just sets up a few things and then calls the internal

 * tar_read_header() function below.

 */

static int

archive_read_format_tar_read_header(struct archive_read *a,

    struct archive_entry *entry)

{

  /*

   * When converting tar archives to cpio archives, it is

   * essential that each distinct file have a distinct inode

   * number.  To simplify this, we keep a static count here to

   * assign fake dev/inode numbers to each tar entry.  Note that

   * pax format archives may overwrite this with something more

   * useful.

   *

   * Ideally, we would track every file read from the archive so

   * that we could assign the same dev/ino pair to hardlinks,

   * but the memory required to store a complete lookup table is

   * probably not worthwhile just to support the relatively

   * obscure tar->cpio conversion case.

   */

  /* TODO: Move this into `struct tar` to avoid conflicts

   * when reading multiple archives */

  static int default_inode;

  static int default_dev;

  struct tar *tar;

  const char *p;

  const wchar_t *wp;

  int r;

  size_t l, unconsumed = 0;

  /* Assign default device/inode values. */

  archive_entry_set_dev(entry, 1 + default_dev); /* Don't use zero. */

  archive_entry_set_ino(entry, ++default_inode); /* Don't use zero. */

  /* Limit generated st_ino number to 16 bits. */

  if (default_inode >= 0xffff) {

    ++default_dev;

    default_inode = 0;

  }

  tar = (struct tar *)(a->format->data);

  tar->entry_offset = 0;

  gnu_clear_sparse_list(tar);

  tar->realsize = -1; /* Mark this as "unset" */

  tar->realsize_override = 0;

  /* Setup default string conversion. */

  tar->sconv = tar->opt_sconv;

  if (tar->sconv == NULL) {

    if (!tar->init_default_conversion) {

      tar->sconv_default =

          archive_string_default_conversion_for_read(&(a->archive));

      tar->init_default_conversion = 1;

    }

    tar->sconv = tar->sconv_default;

  }

  r = tar_read_header(a, tar, entry, &unconsumed);

  tar_flush_unconsumed(a, &unconsumed);

  /*

   * "non-sparse" files are really just sparse files with

   * a single block.

   */

  if (tar->sparse_list == NULL) {

    if (gnu_add_sparse_entry(a, tar, 0, tar->entry_bytes_remaining)

        != ARCHIVE_OK)

      return (ARCHIVE_FATAL);

  } else {

    struct sparse_block *sb;

    for (sb = tar->sparse_list; sb != NULL; sb = sb->next) {

      if (!sb->hole)

        archive_entry_sparse_add_entry(entry,

            sb->offset, sb->remaining);

    }

  }

  if (r == ARCHIVE_OK && archive_entry_filetype(entry) == AE_IFREG) {

    /*

     * "Regular" entry with trailing '/' is really

     * directory: This is needed for certain old tar

     * variants and even for some broken newer ones.

     */

    if ((wp = archive_entry_pathname_w(entry)) != NULL) {

      l = wcslen(wp);

      if (l > 0 && wp[l - 1] == L'/') {

        archive_entry_set_filetype(entry, AE_IFDIR);

        tar->entry_bytes_remaining = 0;

        tar->entry_padding = 0;

      }

    } else if ((p = archive_entry_pathname(entry)) != NULL) {

      l = strlen(p);

      if (l > 0 && p[l - 1] == '/') {

        archive_entry_set_filetype(entry, AE_IFDIR);

        tar->entry_bytes_remaining = 0;

        tar->entry_padding = 0;

      }

    }

  }

  return (r);

}

static int

archive_read_format_tar_read_data(struct archive_read *a,

    const void **buff, size_t *size, int64_t *offset)

{

  ssize_t bytes_read;

  struct tar *tar;

  struct sparse_block *p;

  tar = (struct tar *)(a->format->data);

  for (;;) {

    /* Remove exhausted entries from sparse list. */

    while (tar->sparse_list != NULL &&

        tar->sparse_list->remaining == 0) {

      p = tar->sparse_list;

      tar->sparse_list = p->next;

      free(p);

    }

    if (tar->entry_bytes_unconsumed) {

      __archive_read_consume(a, tar->entry_bytes_unconsumed);

      tar->entry_bytes_unconsumed = 0;

    }

    /* If we're at end of file, return EOF. */

    if (tar->sparse_list == NULL ||

        tar->entry_bytes_remaining == 0) {

      if (__archive_read_consume(a, tar->entry_padding) < 0)

        return (ARCHIVE_FATAL);

      tar->entry_padding = 0;

      *buff = NULL;

      *size = 0;

      *offset = tar->realsize;

      return (ARCHIVE_EOF);

    }

    *buff = __archive_read_ahead(a, 1, &bytes_read);

    if (bytes_read < 0)

      return (ARCHIVE_FATAL);

    if (*buff == NULL) {

      archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,

          "Truncated tar archive"

          " detected while reading data");

      return (ARCHIVE_FATAL);

    }

    if (bytes_read > tar->entry_bytes_remaining)

      bytes_read = (ssize_t)tar->entry_bytes_remaining;

    /* Don't read more than is available in the

     * current sparse block. */

    if (tar->sparse_list->remaining < bytes_read)

      bytes_read = (ssize_t)tar->sparse_list->remaining;

    *size = bytes_read;

    *offset = tar->sparse_list->offset;

    tar->sparse_list->remaining -= bytes_read;

    tar->sparse_list->offset += bytes_read;

    tar->entry_bytes_remaining -= bytes_read;

    tar->entry_bytes_unconsumed = bytes_read;

    if (!tar->sparse_list->hole)

      return (ARCHIVE_OK);

    /* Current is hole data and skip this. */

  }

}

static int

archive_read_format_tar_skip(struct archive_read *a)

{

  int64_t bytes_skipped;

  int64_t request;

  struct sparse_block *p;

  struct tar* tar;

  tar = (struct tar *)(a->format->data);

  /* Do not consume the hole of a sparse file. */

  request = 0;

  for (p = tar->sparse_list; p != NULL; p = p->next) {

    if (!p->hole) {

      if (p->remaining >= INT64_MAX - request) {

        return ARCHIVE_FATAL;

      }

      request += p->remaining;

    }

  }

  if (request > tar->entry_bytes_remaining)

    request = tar->entry_bytes_remaining;

  request += tar->entry_padding + tar->entry_bytes_unconsumed;

  bytes_skipped = __archive_read_consume(a, request);

  if (bytes_skipped < 0)

    return (ARCHIVE_FATAL);

  tar->entry_bytes_remaining = 0;

  tar->entry_bytes_unconsumed = 0;

  tar->entry_padding = 0;

  /* Free the sparse list. */

  gnu_clear_sparse_list(tar);

  return (ARCHIVE_OK);

}

/*

 * This function reads and interprets all of the headers associated

 * with a single entry.

 */

static int

tar_read_header(struct archive_read *a, struct tar *tar,

    struct archive_entry *entry, size_t *unconsumed)

{

  ssize_t bytes;

  int err = ARCHIVE_OK, err2;

  int eof_fatal = 0; /* EOF is okay at some points... */

  const char *h;

  const struct archive_entry_header_ustar *header;

  const struct archive_entry_header_gnutar *gnuheader;

  /* Bitmask of what header types we've seen. */

  int32_t seen_headers = 0;

  static const int32_t seen_A_header = 1;

  static const int32_t seen_g_header = 2;

  static const int32_t seen_K_header = 4;

  static const int32_t seen_L_header = 8;

  static const int32_t seen_V_header = 16;

  static const int32_t seen_x_header = 32; /* Also X */

  static const int32_t seen_mac_metadata = 512;

  tar->pax_hdrcharset_utf8 = 1;

  tar->sparse_gnu_attributes_seen = 0;

  archive_string_empty(&(tar->entry_gname));

  archive_string_empty(&(tar->entry_pathname));

  archive_string_empty(&(tar->entry_pathname_override));

  archive_string_empty(&(tar->entry_uname));

  /* Ensure format is set. */

  if (a->archive.archive_format_name == NULL) {

    a->archive.archive_format = ARCHIVE_FORMAT_TAR;

    a->archive.archive_format_name = "tar";

  }

  /*

   * TODO: Write global/default pax options into

   * 'entry' struct here before overwriting with

   * file-specific options.

   */

  /* Loop over all the headers needed for the next entry */

  for (;;) {

    /* Find the next valid header record. */

    while (1) {

      tar_flush_unconsumed(a, unconsumed);

      /* Read 512-byte header record */

      h = __archive_read_ahead(a, 512, &bytes);

      if (bytes < 0)

        return ((int)bytes);

      if (bytes == 0) { /* EOF at a block boundary. */

        if (eof_fatal) {

          /* We've read a special header already;

           * if there's no regular header, then this is

           * a premature EOF. */

          archive_set_error(&a->archive, EINVAL,

                "Damaged tar archive");

          return (ARCHIVE_FATAL);

        } else {

          return (ARCHIVE_EOF);

        }

      }

      if (bytes < 512) {  /* Short block at EOF; this is bad. */

        archive_set_error(&a->archive,

            ARCHIVE_ERRNO_FILE_FORMAT,

            "Truncated tar archive"

            " detected while reading next heaader");

        return (ARCHIVE_FATAL);

      }

      *unconsumed += 512;

      if (h[0] == 0 && archive_block_is_null(h)) {

        /* We found a NULL block which indicates end-of-archive */

        if (tar->read_concatenated_archives) {

          /* We're ignoring NULL blocks, so keep going. */

          continue;

        }

        /* Try to consume a second all-null record, as well. */

        /* If we can't, that's okay. */

        tar_flush_unconsumed(a, unconsumed);

        h = __archive_read_ahead(a, 512, NULL);

        if (h != NULL && h[0] == 0 && archive_block_is_null(h))

            __archive_read_consume(a, 512);

        archive_clear_error(&a->archive);

        return (ARCHIVE_EOF);

      }

      /* This is NOT a null block, so it must be a valid header. */

      if (!checksum(a, h)) {

        tar_flush_unconsumed(a, unconsumed);

        archive_set_error(&a->archive, EINVAL, "Damaged tar archive");

        /* If we've read some critical information (pax headers, etc)

         * and _then_ see a bad header, we can't really recover. */

        if (eof_fatal) {

          return (ARCHIVE_FATAL);

        } else {

          return (ARCHIVE_RETRY);

        }

      }

      break;

    }

    /* Determine the format variant. */

    header = (const struct archive_entry_header_ustar *)h;

    switch(header->typeflag[0]) {

    case 'A': /* Solaris tar ACL */

      if (seen_headers & seen_A_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_A_header;

      a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;

      a->archive.archive_format_name = "Solaris tar";

      err2 = header_Solaris_ACL(a, tar, entry, h, unconsumed);

      break;

    case 'g': /* POSIX-standard 'g' header. */

      if (seen_headers & seen_g_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_g_header;

      a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;

      a->archive.archive_format_name = "POSIX pax interchange format";

      err2 = header_pax_global(a, tar, entry, h, unconsumed);

      break;

    case 'K': /* Long link name (GNU tar, others) */

      if (seen_headers & seen_K_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_K_header;

      err2 = header_gnu_longlink(a, tar, entry, h, unconsumed);

      break;

    case 'L': /* Long filename (GNU tar, others) */

      if (seen_headers & seen_L_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_L_header;

      err2 = header_gnu_longname(a, tar, entry, h, unconsumed);

      break;

    case 'V': /* GNU volume header */

      if (seen_headers & seen_V_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_V_header;

      err2 = header_volume(a, tar, entry, h, unconsumed);

      break;

    case 'X': /* Used by SUN tar; same as 'x'. */

      if (seen_headers & seen_x_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_x_header;

      a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;

      a->archive.archive_format_name =

        "POSIX pax interchange format (Sun variant)";

      err2 = header_pax_extension(a, tar, entry, h, unconsumed);

      break;

    case 'x': /* POSIX-standard 'x' header. */

      if (seen_headers & seen_x_header) {

        return (ARCHIVE_FATAL);

      }

      seen_headers |= seen_x_header;

      a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;

      a->archive.archive_format_name = "POSIX pax interchange format";

      err2 = header_pax_extension(a, tar, entry, h, unconsumed);

      break;

    default: /* Regular header: Legacy tar, GNU tar, or ustar */

      gnuheader = (const struct archive_entry_header_gnutar *)h;

      if (memcmp(gnuheader->magic, "ustar  \0", 8) == 0) {

        a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;

        a->archive.archive_format_name = "GNU tar format";

        err2 = header_gnutar(a, tar, entry, h, unconsumed);

      } else if (memcmp(header->magic, "ustar", 5) == 0) {

        if (a->archive.archive_format != ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE) {

          a->archive.archive_format = ARCHIVE_FORMAT_TAR_USTAR;

          a->archive.archive_format_name = "POSIX ustar format";

        }

        err2 = header_ustar(a, tar, entry, h);

      } else {

        a->archive.archive_format = ARCHIVE_FORMAT_TAR;

        a->archive.archive_format_name = "tar (non-POSIX)";

        err2 = header_old_tar(a, tar, entry, h);

      }

      err = err_combine(err, err2);

      /* We return warnings or success as-is.  Anything else is fatal. */

      if (err < ARCHIVE_WARN) {

        return (ARCHIVE_FATAL);

      }

      /* Filename of the form `._filename` is an AppleDouble

       * extension entry.  The body is the macOS metadata blob;

       * this is followed by another entry with the actual

       * regular file data.

       * This design has two drawbacks:

       * = it's brittle; you might just have a file with such a name

       * = it duplicates any long pathname extensions

       *

       * TODO: This probably shouldn't be here at all.  Consider

       * just returning the contents as a regular entry here and

       * then dealing with it when we write data to disk.

       */

      if (tar->process_mac_extensions

          && ((seen_headers & seen_mac_metadata) == 0)

          && is_mac_metadata_entry(entry)) {

        err2 = read_mac_metadata_blob(a, entry, unconsumed);

        if (err2 < ARCHIVE_WARN) {

          return (ARCHIVE_FATAL);

        }

        err = err_combine(err, err2);

        /* Note: Other headers can appear again. */

        seen_headers = seen_mac_metadata;

        break;

      }

      /* Reconcile GNU sparse attributes */

      if (tar->sparse_gnu_attributes_seen) {

        /* Only 'S' (GNU sparse) and ustar '0' regular files can be sparse */

        if (tar->filetype != 'S' && tar->filetype != '0') {

          archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,

                "Non-regular file cannot be sparse");

          return (ARCHIVE_WARN);

        } else if (tar->sparse_gnu_major == 0 &&

            tar->sparse_gnu_minor == 0) {

          /* Sparse map already parsed from 'x' header */

        } else if (tar->sparse_gnu_major == 0 &&

            tar->sparse_gnu_minor == 1) {

          /* Sparse map already parsed from 'x' header */

        } else if (tar->sparse_gnu_major == 1 &&

            tar->sparse_gnu_minor == 0) {

          /* Sparse map is prepended to file contents */

          ssize_t bytes_read;

          bytes_read = gnu_sparse_10_read(a, tar, unconsumed);

          if (bytes_read < 0)

            return ((int)bytes_read);

          tar->entry_bytes_remaining -= bytes_read;

        } else {

          archive_set_error(&a->archive,

                ARCHIVE_ERRNO_MISC,

                "Unrecognized GNU sparse file format");

          return (ARCHIVE_WARN);

        }

      }

      return (err);

    }

    /* We're between headers ... */

    err = err_combine(err, err2);

    if (err == ARCHIVE_FATAL)

      return (err);

    /* The GNU volume header and the pax `g` global header

     * are both allowed to be the only header in an

     * archive.  If we've seen any other header, a

     * following EOF is fatal. */

    if ((seen_headers & ~seen_V_header & ~seen_g_header) != 0) {

      eof_fatal = 1;

    }

  }

}

/*

 * Return true if block checksum is correct.

 */

static int

checksum(struct archive_read *a, const void *h)

{

  const unsigned char *bytes;

  const struct archive_entry_header_ustar *header;

  int check, sum;

  size_t i;

  (void)a; /* UNUSED */

  bytes = (const unsigned char *)h;

  header = (const struct archive_entry_header_ustar *)h;

  /* Checksum field must hold an octal number */

  for (i = 0; i < sizeof(header->checksum); ++i) {

    char c = header->checksum[i];

    if (c != ' ' && c != '\0' && (c < '0' || c > '7'))

      return 0;

  }

  /*

   * Test the checksum.  Note that POSIX specifies _unsigned_

   * bytes for this calculation.

   */

  sum = (int)tar_atol(header->checksum, sizeof(header->checksum));

  check = 0;

  for (i = 0; i < 148; i++)

    check += (unsigned char)bytes[i];

  for (; i < 156; i++)

    check += 32;

  for (; i < 512; i++)

    check += (unsigned char)bytes[i];

  if (sum == check)

    return (1);

  /*

   * Repeat test with _signed_ bytes, just in case this archive

   * was created by an old BSD, Solaris, or HP-UX tar with a

   * broken checksum calculation.

   */

  check = 0;

  for (i = 0; i < 148; i++)

    check += (signed char)bytes[i];