/src/libfsntfs/libfwnt/libfwnt_lznt1.c

Source (jump to first uncovered line)
/*
 * LZNT1 (de)compression functions
 *
 * Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwnt_libcerror.h"
#include "libfwnt_libcnotify.h"
#include "libfwnt_lznt1.h"

/* Decompresses a LZNT1 compressed chunk
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress_chunk(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     size_t *compressed_data_offset,
     size_t compression_chunk_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function                   = "libfwnt_lznt1_decompress_chunk";
  size_t compression_tuple_index          = 0;
  size_t compression_tuple_threshold      = 0;
  size_t safe_compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size      = 0;
  size_t uncompressed_data_offset         = 0;
  uint16_t compression_tuple              = 0;
  uint16_t compression_tuple_offset_shift = 0;
  uint16_t compression_tuple_size         = 0;
  uint16_t compression_tuple_size_mask    = 0;
  int16_t compression_tuple_offset        = 0;
  uint8_t compression_flag_bit_index      = 0;
  uint8_t compression_flag_byte           = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compressed_data_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data offset.",
     function );

    return( -1 );
  }
  safe_compressed_data_offset = *compressed_data_offset;

  if( safe_compressed_data_offset >= compressed_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid compressed data offset value out of bounds.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compression chunk size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
     "%s: compressed data too small.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  compression_tuple_threshold    = 16;
  compression_tuple_offset_shift = 12;
  compression_tuple_size_mask    = 0x0fff;

  while( compression_chunk_size > 0 )
  {
    if( safe_compressed_data_offset >= compressed_data_size )
    {
      break;
    }
    compression_flag_byte = compressed_data[ safe_compressed_data_offset ];

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       safe_compressed_data_offset,
       safe_compressed_data_offset );

      libcnotify_printf(
       "%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
       function,
       compression_flag_byte );

      libcnotify_printf(
       "\n" );
    }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

    safe_compressed_data_offset += 1;
    compression_chunk_size      -= 1;

    for( compression_flag_bit_index = 0;
         compression_flag_bit_index < 8;
         compression_flag_bit_index++ )
    {
      /* Check if the data is compressed (tag bit is set)
       */
      if( ( compression_flag_byte & 0x01 ) != 0 )
      {
        if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        /* Read the compression ( size, offset ) tuple
         */
        byte_stream_copy_to_uint16_little_endian(
         &( compressed_data[ safe_compressed_data_offset ] ),
         compression_tuple );

        compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
        compression_tuple_size   = ( compression_tuple & compression_tuple_size_mask ) + 3;

#if defined( HAVE_DEBUG_OUTPUT )
        if( libcnotify_verbose != 0 )
        {
          libcnotify_printf(
           "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
           function,
           safe_compressed_data_offset,
           safe_compressed_data_offset );

          libcnotify_printf(
           "%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
           function,
           compression_tuple,
           compression_tuple_offset_shift,
           compression_tuple_size_mask );

          libcnotify_printf(
           "%s: compression tuple offset\t\t: %" PRIi16 "\n",
           function,
           compression_tuple_offset );

          libcnotify_printf(
           "%s: compression tuple size\t\t\t: %" PRIu16 "\n",
           function,
           compression_tuple_size );

          libcnotify_printf(
           "%s: uncompressed data offset\t\t: %" PRIzd "\n",
           function,
           uncompressed_data_offset );

          libcnotify_printf(
           "\n" );
        }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

        safe_compressed_data_offset += 2;
        compression_chunk_size      -= 2;

        /* The compression tuple offset refers to an offset in the uncompressed data
         */
        if( (size_t) compression_tuple_offset > uncompressed_data_offset )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;

        while( compression_tuple_size > 0 )
        {
          if( compression_tuple_index > uncompressed_data_offset )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid compression tuple index value out of bounds.",
             function );

            return( -1 );
          }
          if( uncompressed_data_offset >= safe_uncompressed_data_size )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid uncompressed data offset value out of bounds.",
             function );

            return( -1 );
          }
          uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];

          compression_tuple_size -= 1;
        }
      }
      else
      {
        if( uncompressed_data_offset >= safe_uncompressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid uncompressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        if( safe_compressed_data_offset >= compressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];

        compression_chunk_size -= 1;
      }
      compression_flag_byte >>= 1;

      if( compression_chunk_size == 0 )
      {
        break;
      }
      /* The compression tuple size mask and offset shift
       * are dependent on the current buffer offset in the uncompressed data
       */
      while( uncompressed_data_offset > compression_tuple_threshold )
      {
        if( compression_tuple_offset_shift == 0 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset shift value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_offset_shift -= 1;
        compression_tuple_size_mask   >>= 1;
        compression_tuple_threshold   <<= 1;
      }
    }
  }
  *compressed_data_offset = safe_compressed_data_offset;
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}

/* Decompresses data using LZNT1 compression
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function              = "libfwnt_lznt1_decompress";
  size_t compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size = 0;
  size_t uncompressed_chunk_size     = 0;
  size_t uncompressed_data_offset    = 0;
  uint16_t compression_chunk_header  = 0;
  uint16_t compression_chunk_size    = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  while( compressed_data_offset < compressed_data_size )
  {
    if( uncompressed_data_offset >= safe_uncompressed_data_size )
    {
      break;
    }
    if( ( compressed_data_offset + 1 ) >= compressed_data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
       LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
       "%s: compressed data size value too small.",
       function );

      return( -1 );
    }
    /* The first 2 bytes contain the compressed chunk header
     * 0  - 11  compressed chunk size
     * 12 - 14  signature value
     * 15   is compressed flag
     */
    byte_stream_copy_to_uint16_little_endian(
     &( compressed_data[ compressed_data_offset ] ),
     compression_chunk_header );

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       compressed_data_offset,
       compressed_data_offset );

      libcnotify_printf(
       "%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
       function,
       compression_chunk_header );

      libcnotify_printf(
       "%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header & 0x0fff ) + 1 );

      libcnotify_printf(
       "%s: signature value\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header >> 12 ) & 0x0007 );

      libcnotify_printf(
       "%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
       function,
       compression_chunk_header >> 15 );

      libcnotify_printf(
       "\n" );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    compressed_data_offset += 2;

    if( compression_chunk_header == 0 )
    {
      break;
    }
    compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;

    if( ( compression_chunk_header & 0x8000 ) != 0 )
    {
      /* Adjust the compression chunk size for the iteration
       */
      uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;

      if( libfwnt_lznt1_decompress_chunk(
           compressed_data,
           compressed_data_size,
           &compressed_data_offset,
           compression_chunk_size,
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &uncompressed_chunk_size,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_COMPRESSION,
         LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
         "%s: unable to decompress chunk.",
         function );

        return( -1 );
      }
      uncompressed_data_offset += uncompressed_chunk_size;
    }
    else
    {
      if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: compressed data too small.",
         function );

        return( -1 );
      }
      if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: uncompressed data too small.",
         function );

        return( -1 );
      }
      if( memory_copy(
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &( compressed_data[ compressed_data_offset ] ),
           compression_chunk_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy copy compressed data to uncompressed data.",
         function );

        return( -1 );
      }
      compressed_data_offset   += (size_t) compression_chunk_size;
      uncompressed_data_offset += (size_t) compression_chunk_size;
    }
  }
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}


Coverage Report

Created: 2025-06-13 07:22

Line	Count	Source (jump to first uncovered line)
1		/*
2		* LZNT1 (de)compression functions
3		*
4		* Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwnt_libcerror.h"
28		#include "libfwnt_libcnotify.h"
29		#include "libfwnt_lznt1.h"
30
31		/* Decompresses a LZNT1 compressed chunk
32		* Returns 1 on success or -1 on error
33		*/
34		int libfwnt_lznt1_decompress_chunk(
35		const uint8_t *compressed_data,
36		size_t compressed_data_size,
37		size_t *compressed_data_offset,
38		size_t compression_chunk_size,
39		uint8_t *uncompressed_data,
40		size_t *uncompressed_data_size,
41		libcerror_error_t **error )
42	495	{
43	495	static char *function = "libfwnt_lznt1_decompress_chunk";
44	495	size_t compression_tuple_index = 0;
45	495	size_t compression_tuple_threshold = 0;
46	495	size_t safe_compressed_data_offset = 0;
47	495	size_t safe_uncompressed_data_size = 0;
48	495	size_t uncompressed_data_offset = 0;
49	495	uint16_t compression_tuple = 0;
50	495	uint16_t compression_tuple_offset_shift = 0;
51	495	uint16_t compression_tuple_size = 0;
52	495	uint16_t compression_tuple_size_mask = 0;
53	495	int16_t compression_tuple_offset = 0;
54	495	uint8_t compression_flag_bit_index = 0;
55	495	uint8_t compression_flag_byte = 0;
56
57	495	if( compressed_data == NULL )
58	0	{
59	0	libcerror_error_set(
60	0	error,
61	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
62	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
63	0	"%s: invalid compressed data.",
64	0	function );
65
66	0	return( -1 );
67	0	}
68	495	if( compressed_data_size > (size_t) SSIZE_MAX )
69	0	{
70	0	libcerror_error_set(
71	0	error,
72	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
73	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
74	0	"%s: invalid compressed data size value exceeds maximum.",
75	0	function );
76
77	0	return( -1 );
78	0	}
79	495	if( compressed_data_offset == NULL )
80	0	{
81	0	libcerror_error_set(
82	0	error,
83	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
84	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
85	0	"%s: invalid compressed data offset.",
86	0	function );
87
88	0	return( -1 );
89	0	}
90	495	safe_compressed_data_offset = *compressed_data_offset;
91
92	495	if( safe_compressed_data_offset >= compressed_data_size )
93	0	{
94	0	libcerror_error_set(
95	0	error,
96	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
97	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
98	0	"%s: invalid compressed data offset value out of bounds.",
99	0	function );
100
101	0	return( -1 );
102	0	}
103	495	if( compression_chunk_size > (size_t) SSIZE_MAX )
104	0	{
105	0	libcerror_error_set(
106	0	error,
107	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
108	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
109	0	"%s: invalid compression chunk size value exceeds maximum.",
110	0	function );
111
112	0	return( -1 );
113	0	}
114	495	if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
115	2	{
116	2	libcerror_error_set(
117	2	error,
118	2	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
119	2	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
120	2	"%s: compressed data too small.",
121	2	function );
122
123	2	return( -1 );
124	2	}
125	493	if( uncompressed_data == NULL )
126	0	{
127	0	libcerror_error_set(
128	0	error,
129	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
130	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
131	0	"%s: invalid uncompressed data.",
132	0	function );
133
134	0	return( -1 );
135	0	}
136	493	if( uncompressed_data_size == NULL )
137	0	{
138	0	libcerror_error_set(
139	0	error,
140	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
141	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
142	0	"%s: invalid uncompressed data size.",
143	0	function );
144
145	0	return( -1 );
146	0	}
147	493	safe_uncompressed_data_size = *uncompressed_data_size;
148
149	493	compression_tuple_threshold = 16;
150	493	compression_tuple_offset_shift = 12;
151	493	compression_tuple_size_mask = 0x0fff;
152
153	106k	while( compression_chunk_size > 0 )
154	105k	{
155	105k	if( safe_compressed_data_offset >= compressed_data_size )
156	5	{
157	5	break;
158	5	}
159	105k	compression_flag_byte = compressed_data[ safe_compressed_data_offset ];
160
161		#if defined( HAVE_DEBUG_OUTPUT )
162		if( libcnotify_verbose != 0 )
163		{
164		libcnotify_printf(
165		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
166		function,
167		safe_compressed_data_offset,
168		safe_compressed_data_offset );
169
170		libcnotify_printf(
171		"%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
172		function,
173		compression_flag_byte );
174
175		libcnotify_printf(
176		"\n" );
177		}
178		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
179
180	105k	safe_compressed_data_offset += 1;
181	105k	compression_chunk_size -= 1;
182
183	105k	for( compression_flag_bit_index = 0;
184	949k	compression_flag_bit_index < 8;
185	843k	compression_flag_bit_index++ )
186	843k	{
187		/* Check if the data is compressed (tag bit is set)
188		*/
189	843k	if( ( compression_flag_byte & 0x01 ) != 0 )
190	58.5k	{
191	58.5k	if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
192	0	{
193	0	libcerror_error_set(
194	0	error,
195	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
196	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
197	0	"%s: invalid compressed data offset value out of bounds.",
198	0	function );
199
200	0	return( -1 );
201	0	}
202		/* Read the compression ( size, offset ) tuple
203		*/
204	58.5k	byte_stream_copy_to_uint16_little_endian(
205	58.5k	&( compressed_data[ safe_compressed_data_offset ] ),
206	58.5k	compression_tuple );
207
208	58.5k	compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
209	58.5k	compression_tuple_size = ( compression_tuple & compression_tuple_size_mask ) + 3;
210
211		#if defined( HAVE_DEBUG_OUTPUT )
212		if( libcnotify_verbose != 0 )
213		{
214		libcnotify_printf(
215		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
216		function,
217		safe_compressed_data_offset,
218		safe_compressed_data_offset );
219
220		libcnotify_printf(
221		"%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
222		function,
223		compression_tuple,
224		compression_tuple_offset_shift,
225		compression_tuple_size_mask );
226
227		libcnotify_printf(
228		"%s: compression tuple offset\t\t: %" PRIi16 "\n",
229		function,
230		compression_tuple_offset );
231
232		libcnotify_printf(
233		"%s: compression tuple size\t\t\t: %" PRIu16 "\n",
234		function,
235		compression_tuple_size );
236
237		libcnotify_printf(
238		"%s: uncompressed data offset\t\t: %" PRIzd "\n",
239		function,
240		uncompressed_data_offset );
241
242		libcnotify_printf(
243		"\n" );
244		}
245		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
246
247	58.5k	safe_compressed_data_offset += 2;
248	58.5k	compression_chunk_size -= 2;
249
250		/* The compression tuple offset refers to an offset in the uncompressed data
251		*/
252	58.5k	if( (size_t) compression_tuple_offset > uncompressed_data_offset )
253	43	{
254	43	libcerror_error_set(
255	43	error,
256	43	LIBCERROR_ERROR_DOMAIN_RUNTIME,
257	43	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
258	43	"%s: invalid compression tuple offset value out of bounds.",
259	43	function );
260
261	43	return( -1 );
262	43	}
263	58.4k	compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;
264
265	501k	while( compression_tuple_size > 0 )
266	442k	{
267	442k	if( compression_tuple_index > uncompressed_data_offset )
268	0	{
269	0	libcerror_error_set(
270	0	error,
271	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
272	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
273	0	"%s: invalid compression tuple index value out of bounds.",
274	0	function );
275
276	0	return( -1 );
277	0	}
278	442k	if( uncompressed_data_offset >= safe_uncompressed_data_size )
279	3	{
280	3	libcerror_error_set(
281	3	error,
282	3	LIBCERROR_ERROR_DOMAIN_RUNTIME,
283	3	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
284	3	"%s: invalid uncompressed data offset value out of bounds.",
285	3	function );
286
287	3	return( -1 );
288	3	}
289	442k	uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];
290
291	442k	compression_tuple_size -= 1;
292	442k	}
293	58.4k	}
294	785k	else
295	785k	{
296	785k	if( uncompressed_data_offset >= safe_uncompressed_data_size )
297	1	{
298	1	libcerror_error_set(
299	1	error,
300	1	LIBCERROR_ERROR_DOMAIN_RUNTIME,
301	1	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
302	1	"%s: invalid uncompressed data offset value out of bounds.",
303	1	function );
304
305	1	return( -1 );
306	1	}
307	785k	if( safe_compressed_data_offset >= compressed_data_size )
308	1	{
309	1	libcerror_error_set(
310	1	error,
311	1	LIBCERROR_ERROR_DOMAIN_RUNTIME,
312	1	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
313	1	"%s: invalid compressed data offset value out of bounds.",
314	1	function );
315
316	1	return( -1 );
317	1	}
318	785k	uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];
319
320	785k	compression_chunk_size -= 1;
321	785k	}
322	843k	compression_flag_byte >>= 1;
323
324	843k	if( compression_chunk_size == 0 )
325	437	{
326	437	break;
327	437	}
328		/* The compression tuple size mask and offset shift
329		* are dependent on the current buffer offset in the uncompressed data
330		*/
331	844k	while( uncompressed_data_offset > compression_tuple_threshold )
332	1.53k	{
333	1.53k	if( compression_tuple_offset_shift == 0 )
334	3	{
335	3	libcerror_error_set(
336	3	error,
337	3	LIBCERROR_ERROR_DOMAIN_RUNTIME,
338	3	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
339	3	"%s: invalid compression tuple offset shift value out of bounds.",
340	3	function );
341
342	3	return( -1 );
343	3	}
344	1.53k	compression_tuple_offset_shift -= 1;
345	1.53k	compression_tuple_size_mask >>= 1;
346	1.53k	compression_tuple_threshold <<= 1;
347	1.53k	}
348	843k	}
349	105k	}
350	442	*compressed_data_offset = safe_compressed_data_offset;
351	442	*uncompressed_data_size = uncompressed_data_offset;
352
353	442	return( 1 );
354	493	}
355
356		/* Decompresses data using LZNT1 compression
357		* Returns 1 on success or -1 on error
358		*/
359		int libfwnt_lznt1_decompress(
360		const uint8_t *compressed_data,
361		size_t compressed_data_size,
362		uint8_t *uncompressed_data,
363		size_t *uncompressed_data_size,
364		libcerror_error_t **error )
365	203	{
366	203	static char *function = "libfwnt_lznt1_decompress";
367	203	size_t compressed_data_offset = 0;
368	203	size_t safe_uncompressed_data_size = 0;
369	203	size_t uncompressed_chunk_size = 0;
370	203	size_t uncompressed_data_offset = 0;
371	203	uint16_t compression_chunk_header = 0;
372	203	uint16_t compression_chunk_size = 0;
373
374	203	if( compressed_data == NULL )
375	0	{
376	0	libcerror_error_set(
377	0	error,
378	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
379	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
380	0	"%s: invalid compressed data.",
381	0	function );
382
383	0	return( -1 );
384	0	}
385	203	if( compressed_data_size > (size_t) SSIZE_MAX )
386	0	{
387	0	libcerror_error_set(
388	0	error,
389	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
390	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
391	0	"%s: invalid compressed data size value exceeds maximum.",
392	0	function );
393
394	0	return( -1 );
395	0	}
396	203	if( uncompressed_data == NULL )
397	0	{
398	0	libcerror_error_set(
399	0	error,
400	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
401	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
402	0	"%s: invalid uncompressed data.",
403	0	function );
404
405	0	return( -1 );
406	0	}
407	203	if( uncompressed_data_size == NULL )
408	0	{
409	0	libcerror_error_set(
410	0	error,
411	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
412	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
413	0	"%s: invalid uncompressed data size.",
414	0	function );
415
416	0	return( -1 );
417	0	}
418	203	safe_uncompressed_data_size = *uncompressed_data_size;
419
420	2.48k	while( compressed_data_offset < compressed_data_size )
421	2.47k	{
422	2.47k	if( uncompressed_data_offset >= safe_uncompressed_data_size )
423	4	{
424	4	break;
425	4	}
426	2.47k	if( ( compressed_data_offset + 1 ) >= compressed_data_size )
427	1	{
428	1	libcerror_error_set(
429	1	error,
430	1	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
431	1	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
432	1	"%s: compressed data size value too small.",
433	1	function );
434
435	1	return( -1 );
436	1	}
437		/* The first 2 bytes contain the compressed chunk header
438		* 0 - 11 compressed chunk size
439		* 12 - 14 signature value
440		* 15 is compressed flag
441		*/
442	2.47k	byte_stream_copy_to_uint16_little_endian(
443	2.47k	&( compressed_data[ compressed_data_offset ] ),
444	2.47k	compression_chunk_header );
445
446		#if defined( HAVE_DEBUG_OUTPUT )
447		if( libcnotify_verbose != 0 )
448		{
449		libcnotify_printf(
450		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
451		function,
452		compressed_data_offset,
453		compressed_data_offset );
454
455		libcnotify_printf(
456		"%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
457		function,
458		compression_chunk_header );
459
460		libcnotify_printf(
461		"%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
462		function,
463		( compression_chunk_header & 0x0fff ) + 1 );
464
465		libcnotify_printf(
466		"%s: signature value\t\t\t\t: %" PRIu16 "\n",
467		function,
468		( compression_chunk_header >> 12 ) & 0x0007 );
469
470		libcnotify_printf(
471		"%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
472		function,
473		compression_chunk_header >> 15 );
474
475		libcnotify_printf(
476		"\n" );
477		}
478		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
479
480	2.47k	compressed_data_offset += 2;
481
482	2.47k	if( compression_chunk_header == 0 )
483	136	{
484	136	break;
485	136	}
486	2.33k	compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;
487
488	2.33k	if( ( compression_chunk_header & 0x8000 ) != 0 )
489	495	{
490		/* Adjust the compression chunk size for the iteration
491		*/
492	495	uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;
493
494	495	if( libfwnt_lznt1_decompress_chunk(
495	495	compressed_data,
496	495	compressed_data_size,
497	495	&compressed_data_offset,
498	495	compression_chunk_size,
499	495	&( uncompressed_data[ uncompressed_data_offset ] ),
500	495	&uncompressed_chunk_size,
501	495	error ) != 1 )
502	53	{
503	53	libcerror_error_set(
504	53	error,
505	53	LIBCERROR_ERROR_DOMAIN_COMPRESSION,
506	53	LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
507	53	"%s: unable to decompress chunk.",
508	53	function );
509
510	53	return( -1 );
511	53	}
512	442	uncompressed_data_offset += uncompressed_chunk_size;
513	442	}
514	1.84k	else
515	1.84k	{
516	1.84k	if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
517	1	{
518	1	libcerror_error_set(
519	1	error,
520	1	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
521	1	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
522	1	"%s: compressed data too small.",
523	1	function );
524
525	1	return( -1 );
526	1	}
527	1.84k	if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
528	3	{
529	3	libcerror_error_set(
530	3	error,
531	3	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
532	3	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
533	3	"%s: uncompressed data too small.",
534	3	function );
535
536	3	return( -1 );
537	3	}
538	1.83k	if( memory_copy(
539	1.83k	&( uncompressed_data[ uncompressed_data_offset ] ),
540	1.83k	&( compressed_data[ compressed_data_offset ] ),
541	1.83k	compression_chunk_size ) == NULL )
542	0	{
543	0	libcerror_error_set(
544	0	error,
545	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
546	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
547	0	"%s: unable to copy copy compressed data to uncompressed data.",
548	0	function );
549
550	0	return( -1 );
551	0	}
552	1.83k	compressed_data_offset += (size_t) compression_chunk_size;
553	1.83k	uncompressed_data_offset += (size_t) compression_chunk_size;
554	1.83k	}
555	2.33k	}
556	145	*uncompressed_data_size = uncompressed_data_offset;
557
558	145	return( 1 );
559	203	}
560