/src/libfsntfs/libfwnt/libfwnt_lznt1.c

Source (jump to first uncovered line)
/*
 * LZNT1 (de)compression functions
 *
 * Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwnt_libcerror.h"
#include "libfwnt_libcnotify.h"
#include "libfwnt_lznt1.h"

/* Decompresses a LZNT1 compressed chunk
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress_chunk(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     size_t *compressed_data_offset,
     size_t compression_chunk_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function                   = "libfwnt_lznt1_decompress_chunk";
  size_t compression_tuple_index          = 0;
  size_t compression_tuple_threshold      = 0;
  size_t safe_compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size      = 0;
  size_t uncompressed_data_offset         = 0;
  uint16_t compression_tuple              = 0;
  uint16_t compression_tuple_offset_shift = 0;
  uint16_t compression_tuple_size         = 0;
  uint16_t compression_tuple_size_mask    = 0;
  int16_t compression_tuple_offset        = 0;
  uint8_t compression_flag_bit_index      = 0;
  uint8_t compression_flag_byte           = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compressed_data_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data offset.",
     function );

    return( -1 );
  }
  safe_compressed_data_offset = *compressed_data_offset;

  if( safe_compressed_data_offset >= compressed_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid compressed data offset value out of bounds.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compression chunk size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
     "%s: compressed data too small.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  compression_tuple_threshold    = 16;
  compression_tuple_offset_shift = 12;
  compression_tuple_size_mask    = 0x0fff;

  while( compression_chunk_size > 0 )
  {
    if( safe_compressed_data_offset >= compressed_data_size )
    {
      break;
    }
    compression_flag_byte = compressed_data[ safe_compressed_data_offset ];

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       safe_compressed_data_offset,
       safe_compressed_data_offset );

      libcnotify_printf(
       "%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
       function,
       compression_flag_byte );

      libcnotify_printf(
       "\n" );
    }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

    safe_compressed_data_offset += 1;
    compression_chunk_size      -= 1;

    for( compression_flag_bit_index = 0;
         compression_flag_bit_index < 8;
         compression_flag_bit_index++ )
    {
      /* Check if the data is compressed (tag bit is set)
       */
      if( ( compression_flag_byte & 0x01 ) != 0 )
      {
        if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        /* Read the compression ( size, offset ) tuple
         */
        byte_stream_copy_to_uint16_little_endian(
         &( compressed_data[ safe_compressed_data_offset ] ),
         compression_tuple );

        compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
        compression_tuple_size   = ( compression_tuple & compression_tuple_size_mask ) + 3;

#if defined( HAVE_DEBUG_OUTPUT )
        if( libcnotify_verbose != 0 )
        {
          libcnotify_printf(
           "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
           function,
           safe_compressed_data_offset,
           safe_compressed_data_offset );

          libcnotify_printf(
           "%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
           function,
           compression_tuple,
           compression_tuple_offset_shift,
           compression_tuple_size_mask );

          libcnotify_printf(
           "%s: compression tuple offset\t\t: %" PRIi16 "\n",
           function,
           compression_tuple_offset );

          libcnotify_printf(
           "%s: compression tuple size\t\t\t: %" PRIu16 "\n",
           function,
           compression_tuple_size );

          libcnotify_printf(
           "%s: uncompressed data offset\t\t: %" PRIzd "\n",
           function,
           uncompressed_data_offset );

          libcnotify_printf(
           "\n" );
        }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

        safe_compressed_data_offset += 2;
        compression_chunk_size      -= 2;

        /* The compression tuple offset refers to an offset in the uncompressed data
         */
        if( (size_t) compression_tuple_offset > uncompressed_data_offset )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;

        while( compression_tuple_size > 0 )
        {
          if( compression_tuple_index > uncompressed_data_offset )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid compression tuple index value out of bounds.",
             function );

            return( -1 );
          }
          if( uncompressed_data_offset >= safe_uncompressed_data_size )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid uncompressed data offset value out of bounds.",
             function );

            return( -1 );
          }
          uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];

          compression_tuple_size -= 1;
        }
      }
      else
      {
        if( uncompressed_data_offset >= safe_uncompressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid uncompressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        if( safe_compressed_data_offset >= compressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];

        compression_chunk_size -= 1;
      }
      compression_flag_byte >>= 1;

      if( compression_chunk_size == 0 )
      {
        break;
      }
      /* The compression tuple size mask and offset shift
       * are dependent on the current buffer offset in the uncompressed data
       */
      while( uncompressed_data_offset > compression_tuple_threshold )
      {
        if( compression_tuple_offset_shift == 0 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset shift value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_offset_shift -= 1;
        compression_tuple_size_mask   >>= 1;
        compression_tuple_threshold   <<= 1;
      }
    }
  }
  *compressed_data_offset = safe_compressed_data_offset;
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}

/* Decompresses data using LZNT1 compression
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function              = "libfwnt_lznt1_decompress";
  size_t compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size = 0;
  size_t uncompressed_chunk_size     = 0;
  size_t uncompressed_data_offset    = 0;
  uint16_t compression_chunk_header  = 0;
  uint16_t compression_chunk_size    = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  while( compressed_data_offset < compressed_data_size )
  {
    if( uncompressed_data_offset >= safe_uncompressed_data_size )
    {
      break;
    }
    if( ( compressed_data_offset + 1 ) >= compressed_data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
       LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
       "%s: compressed data size value too small.",
       function );

      return( -1 );
    }
    /* The first 2 bytes contain the compressed chunk header
     * 0  - 11  compressed chunk size
     * 12 - 14  signature value
     * 15   is compressed flag
     */
    byte_stream_copy_to_uint16_little_endian(
     &( compressed_data[ compressed_data_offset ] ),
     compression_chunk_header );

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       compressed_data_offset,
       compressed_data_offset );

      libcnotify_printf(
       "%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
       function,
       compression_chunk_header );

      libcnotify_printf(
       "%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header & 0x0fff ) + 1 );

      libcnotify_printf(
       "%s: signature value\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header >> 12 ) & 0x0007 );

      libcnotify_printf(
       "%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
       function,
       compression_chunk_header >> 15 );

      libcnotify_printf(
       "\n" );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    compressed_data_offset += 2;

    if( compression_chunk_header == 0 )
    {
      break;
    }
    compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;

    if( ( compression_chunk_header & 0x8000 ) != 0 )
    {
      /* Adjust the compression chunk size for the iteration
       */
      uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;

      if( libfwnt_lznt1_decompress_chunk(
           compressed_data,
           compressed_data_size,
           &compressed_data_offset,
           compression_chunk_size,
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &uncompressed_chunk_size,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_COMPRESSION,
         LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
         "%s: unable to decompress chunk.",
         function );

        return( -1 );
      }
      uncompressed_data_offset += uncompressed_chunk_size;
    }
    else
    {
      if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: compressed data too small.",
         function );

        return( -1 );
      }
      if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: uncompressed data too small.",
         function );

        return( -1 );
      }
      if( memory_copy(
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &( compressed_data[ compressed_data_offset ] ),
           compression_chunk_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy copy compressed data to uncompressed data.",
         function );

        return( -1 );
      }
      compressed_data_offset   += (size_t) compression_chunk_size;
      uncompressed_data_offset += (size_t) compression_chunk_size;
    }
  }
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}


Coverage Report

Created: 2024-02-25 07:20

Line	Count	Source (jump to first uncovered line)
1		/*
2		* LZNT1 (de)compression functions
3		*
4		* Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwnt_libcerror.h"
28		#include "libfwnt_libcnotify.h"
29		#include "libfwnt_lznt1.h"
30
31		/* Decompresses a LZNT1 compressed chunk
32		* Returns 1 on success or -1 on error
33		*/
34		int libfwnt_lznt1_decompress_chunk(
35		const uint8_t *compressed_data,
36		size_t compressed_data_size,
37		size_t *compressed_data_offset,
38		size_t compression_chunk_size,
39		uint8_t *uncompressed_data,
40		size_t *uncompressed_data_size,
41		libcerror_error_t **error )
42	636k	{
43	636k	static char *function = "libfwnt_lznt1_decompress_chunk";
44	636k	size_t compression_tuple_index = 0;
45	636k	size_t compression_tuple_threshold = 0;
46	636k	size_t safe_compressed_data_offset = 0;
47	636k	size_t safe_uncompressed_data_size = 0;
48	636k	size_t uncompressed_data_offset = 0;
49	636k	uint16_t compression_tuple = 0;
50	636k	uint16_t compression_tuple_offset_shift = 0;
51	636k	uint16_t compression_tuple_size = 0;
52	636k	uint16_t compression_tuple_size_mask = 0;
53	636k	int16_t compression_tuple_offset = 0;
54	636k	uint8_t compression_flag_bit_index = 0;
55	636k	uint8_t compression_flag_byte = 0;
56
57	636k	if( compressed_data == NULL )
58	0	{
59	0	libcerror_error_set(
60	0	error,
61	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
62	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
63	0	"%s: invalid compressed data.",
64	0	function );
65
66	0	return( -1 );
67	0	}
68	636k	if( compressed_data_size > (size_t) SSIZE_MAX )
69	0	{
70	0	libcerror_error_set(
71	0	error,
72	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
73	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
74	0	"%s: invalid compressed data size value exceeds maximum.",
75	0	function );
76
77	0	return( -1 );
78	0	}
79	636k	if( compressed_data_offset == NULL )
80	0	{
81	0	libcerror_error_set(
82	0	error,
83	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
84	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
85	0	"%s: invalid compressed data offset.",
86	0	function );
87
88	0	return( -1 );
89	0	}
90	636k	safe_compressed_data_offset = *compressed_data_offset;
91
92	636k	if( safe_compressed_data_offset >= compressed_data_size )
93	20	{
94	20	libcerror_error_set(
95	20	error,
96	20	LIBCERROR_ERROR_DOMAIN_RUNTIME,
97	20	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
98	20	"%s: invalid compressed data offset value out of bounds.",
99	20	function );
100
101	20	return( -1 );
102	20	}
103	636k	if( compression_chunk_size > (size_t) SSIZE_MAX )
104	0	{
105	0	libcerror_error_set(
106	0	error,
107	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
108	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
109	0	"%s: invalid compression chunk size value exceeds maximum.",
110	0	function );
111
112	0	return( -1 );
113	0	}
114	636k	if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
115	35	{
116	35	libcerror_error_set(
117	35	error,
118	35	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
119	35	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
120	35	"%s: compressed data too small.",
121	35	function );
122
123	35	return( -1 );
124	35	}
125	636k	if( uncompressed_data == NULL )
126	0	{
127	0	libcerror_error_set(
128	0	error,
129	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
130	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
131	0	"%s: invalid uncompressed data.",
132	0	function );
133
134	0	return( -1 );
135	0	}
136	636k	if( uncompressed_data_size == NULL )
137	0	{
138	0	libcerror_error_set(
139	0	error,
140	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
141	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
142	0	"%s: invalid uncompressed data size.",
143	0	function );
144
145	0	return( -1 );
146	0	}
147	636k	safe_uncompressed_data_size = *uncompressed_data_size;
148
149	636k	compression_tuple_threshold = 16;
150	636k	compression_tuple_offset_shift = 12;
151	636k	compression_tuple_size_mask = 0x0fff;
152
153	1.51M	while( compression_chunk_size > 0 )
154	874k	{
155	874k	if( safe_compressed_data_offset >= compressed_data_size )
156	24	{
157	24	break;
158	24	}
159	874k	compression_flag_byte = compressed_data[ safe_compressed_data_offset ];
160
161		#if defined( HAVE_DEBUG_OUTPUT )
162		if( libcnotify_verbose != 0 )
163		{
164		libcnotify_printf(
165		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
166		function,
167		safe_compressed_data_offset,
168		safe_compressed_data_offset );
169
170		libcnotify_printf(
171		"%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
172		function,
173		compression_flag_byte );
174
175		libcnotify_printf(
176		"\n" );
177		}
178		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
179
180	874k	safe_compressed_data_offset += 1;
181	874k	compression_chunk_size -= 1;
182
183	874k	for( compression_flag_bit_index = 0;
184	2.78M	compression_flag_bit_index < 8;
185	1.91M	compression_flag_bit_index++ )
186	2.54M	{
187		/* Check if the data is compressed (tag bit is set)
188		*/
189	2.54M	if( ( compression_flag_byte & 0x01 ) != 0 )
190	260k	{
191	260k	if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
192	84	{
193	84	libcerror_error_set(
194	84	error,
195	84	LIBCERROR_ERROR_DOMAIN_RUNTIME,
196	84	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
197	84	"%s: invalid compressed data offset value out of bounds.",
198	84	function );
199
200	84	return( -1 );
201	84	}
202		/* Read the compression ( size, offset ) tuple
203		*/
204	260k	byte_stream_copy_to_uint16_little_endian(
205	260k	&( compressed_data[ safe_compressed_data_offset ] ),
206	260k	compression_tuple );
207
208	260k	compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
209	260k	compression_tuple_size = ( compression_tuple & compression_tuple_size_mask ) + 3;
210
211		#if defined( HAVE_DEBUG_OUTPUT )
212		if( libcnotify_verbose != 0 )
213		{
214		libcnotify_printf(
215		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
216		function,
217		safe_compressed_data_offset,
218		safe_compressed_data_offset );
219
220		libcnotify_printf(
221		"%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
222		function,
223		compression_tuple,
224		compression_tuple_offset_shift,
225		compression_tuple_size_mask );
226
227		libcnotify_printf(
228		"%s: compression tuple offset\t\t: %" PRIi16 "\n",
229		function,
230		compression_tuple_offset );
231
232		libcnotify_printf(
233		"%s: compression tuple size\t\t\t: %" PRIu16 "\n",
234		function,
235		compression_tuple_size );
236
237		libcnotify_printf(
238		"%s: uncompressed data offset\t\t: %" PRIzd "\n",
239		function,
240		uncompressed_data_offset );
241
242		libcnotify_printf(
243		"\n" );
244		}
245		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
246
247	260k	safe_compressed_data_offset += 2;
248	260k	compression_chunk_size -= 2;
249
250		/* The compression tuple offset refers to an offset in the uncompressed data
251		*/
252	260k	if( (size_t) compression_tuple_offset > uncompressed_data_offset )
253	157	{
254	157	libcerror_error_set(
255	157	error,
256	157	LIBCERROR_ERROR_DOMAIN_RUNTIME,
257	157	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
258	157	"%s: invalid compression tuple offset value out of bounds.",
259	157	function );
260
261	157	return( -1 );
262	157	}
263	260k	compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;
264
265	7.35M	while( compression_tuple_size > 0 )
266	7.09M	{
267	7.09M	if( compression_tuple_index > uncompressed_data_offset )
268	0	{
269	0	libcerror_error_set(
270	0	error,
271	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
272	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
273	0	"%s: invalid compression tuple index value out of bounds.",
274	0	function );
275
276	0	return( -1 );
277	0	}
278	7.09M	if( uncompressed_data_offset >= safe_uncompressed_data_size )
279	14	{
280	14	libcerror_error_set(
281	14	error,
282	14	LIBCERROR_ERROR_DOMAIN_RUNTIME,
283	14	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
284	14	"%s: invalid uncompressed data offset value out of bounds.",
285	14	function );
286
287	14	return( -1 );
288	14	}
289	7.09M	uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];
290
291	7.09M	compression_tuple_size -= 1;
292	7.09M	}
293	260k	}
294	2.28M	else
295	2.28M	{
296	2.28M	if( uncompressed_data_offset >= safe_uncompressed_data_size )
297	13	{
298	13	libcerror_error_set(
299	13	error,
300	13	LIBCERROR_ERROR_DOMAIN_RUNTIME,
301	13	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
302	13	"%s: invalid uncompressed data offset value out of bounds.",
303	13	function );
304
305	13	return( -1 );
306	13	}
307	2.28M	if( safe_compressed_data_offset >= compressed_data_size )
308	72	{
309	72	libcerror_error_set(
310	72	error,
311	72	LIBCERROR_ERROR_DOMAIN_RUNTIME,
312	72	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
313	72	"%s: invalid compressed data offset value out of bounds.",
314	72	function );
315
316	72	return( -1 );
317	72	}
318	2.28M	uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];
319
320	2.28M	compression_chunk_size -= 1;
321	2.28M	}
322	2.54M	compression_flag_byte >>= 1;
323
324	2.54M	if( compression_chunk_size == 0 )
325	636k	{
326	636k	break;
327	636k	}
328		/* The compression tuple size mask and offset shift
329		* are dependent on the current buffer offset in the uncompressed data
330		*/
331	1.92M	while( uncompressed_data_offset > compression_tuple_threshold )
332	7.64k	{
333	7.64k	if( compression_tuple_offset_shift == 0 )
334	7	{
335	7	libcerror_error_set(
336	7	error,
337	7	LIBCERROR_ERROR_DOMAIN_RUNTIME,
338	7	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
339	7	"%s: invalid compression tuple offset shift value out of bounds.",
340	7	function );
341
342	7	return( -1 );
343	7	}
344	7.64k	compression_tuple_offset_shift -= 1;
345	7.64k	compression_tuple_size_mask >>= 1;
346	7.64k	compression_tuple_threshold <<= 1;
347	7.64k	}
348	1.91M	}
349	874k	}
350	636k	*compressed_data_offset = safe_compressed_data_offset;
351	636k	*uncompressed_data_size = uncompressed_data_offset;
352
353	636k	return( 1 );
354	636k	}
355
356		/* Decompresses data using LZNT1 compression
357		* Returns 1 on success or -1 on error
358		*/
359		int libfwnt_lznt1_decompress(
360		const uint8_t *compressed_data,
361		size_t compressed_data_size,
362		uint8_t *uncompressed_data,
363		size_t *uncompressed_data_size,
364		libcerror_error_t **error )
365	2.43k	{
366	2.43k	static char *function = "libfwnt_lznt1_decompress";
367	2.43k	size_t compressed_data_offset = 0;
368	2.43k	size_t safe_uncompressed_data_size = 0;
369	2.43k	size_t uncompressed_chunk_size = 0;
370	2.43k	size_t uncompressed_data_offset = 0;
371	2.43k	uint16_t compression_chunk_header = 0;
372	2.43k	uint16_t compression_chunk_size = 0;
373
374	2.43k	if( compressed_data == NULL )
375	0	{
376	0	libcerror_error_set(
377	0	error,
378	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
379	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
380	0	"%s: invalid compressed data.",
381	0	function );
382
383	0	return( -1 );
384	0	}
385	2.43k	if( compressed_data_size > (size_t) SSIZE_MAX )
386	0	{
387	0	libcerror_error_set(
388	0	error,
389	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
390	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
391	0	"%s: invalid compressed data size value exceeds maximum.",
392	0	function );
393
394	0	return( -1 );
395	0	}
396	2.43k	if( uncompressed_data == NULL )
397	0	{
398	0	libcerror_error_set(
399	0	error,
400	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
401	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
402	0	"%s: invalid uncompressed data.",
403	0	function );
404
405	0	return( -1 );
406	0	}
407	2.43k	if( uncompressed_data_size == NULL )
408	0	{
409	0	libcerror_error_set(
410	0	error,
411	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
412	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
413	0	"%s: invalid uncompressed data size.",
414	0	function );
415
416	0	return( -1 );
417	0	}
418	2.43k	safe_uncompressed_data_size = *uncompressed_data_size;
419
420	654k	while( compressed_data_offset < compressed_data_size )
421	652k	{
422	652k	if( uncompressed_data_offset >= safe_uncompressed_data_size )
423	15	{
424	15	break;
425	15	}
426	652k	if( ( compressed_data_offset + 1 ) >= compressed_data_size )
427	41	{
428	41	libcerror_error_set(
429	41	error,
430	41	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
431	41	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
432	41	"%s: compressed data size value too small.",
433	41	function );
434
435	41	return( -1 );
436	41	}
437		/* The first 2 bytes contain the compressed chunk header
438		* 0 - 11 compressed chunk size
439		* 12 - 14 signature value
440		* 15 is compressed flag
441		*/
442	652k	byte_stream_copy_to_uint16_little_endian(
443	652k	&( compressed_data[ compressed_data_offset ] ),
444	652k	compression_chunk_header );
445
446		#if defined( HAVE_DEBUG_OUTPUT )
447		if( libcnotify_verbose != 0 )
448		{
449		libcnotify_printf(
450		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
451		function,
452		compressed_data_offset,
453		compressed_data_offset );
454
455		libcnotify_printf(
456		"%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
457		function,
458		compression_chunk_header );
459
460		libcnotify_printf(
461		"%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
462		function,
463		( compression_chunk_header & 0x0fff ) + 1 );
464
465		libcnotify_printf(
466		"%s: signature value\t\t\t\t: %" PRIu16 "\n",
467		function,
468		( compression_chunk_header >> 12 ) & 0x0007 );
469
470		libcnotify_printf(
471		"%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
472		function,
473		compression_chunk_header >> 15 );
474
475		libcnotify_printf(
476		"\n" );
477		}
478		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
479
480	652k	compressed_data_offset += 2;
481
482	652k	if( compression_chunk_header == 0 )
483	246	{
484	246	break;
485	246	}
486	652k	compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;
487
488	652k	if( ( compression_chunk_header & 0x8000 ) != 0 )
489	636k	{
490		/* Adjust the compression chunk size for the iteration
491		*/
492	636k	uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;
493
494	636k	if( libfwnt_lznt1_decompress_chunk(
495	636k	compressed_data,
496	636k	compressed_data_size,
497	636k	&compressed_data_offset,
498	636k	compression_chunk_size,
499	636k	&( uncompressed_data[ uncompressed_data_offset ] ),
500	636k	&uncompressed_chunk_size,
501	636k	error ) != 1 )
502	402	{
503	402	libcerror_error_set(
504	402	error,
505	402	LIBCERROR_ERROR_DOMAIN_COMPRESSION,
506	402	LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
507	402	"%s: unable to decompress chunk.",
508	402	function );
509
510	402	return( -1 );
511	402	}
512	636k	uncompressed_data_offset += uncompressed_chunk_size;
513	636k	}
514	15.4k	else
515	15.4k	{
516	15.4k	if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
517	31	{
518	31	libcerror_error_set(
519	31	error,
520	31	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
521	31	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
522	31	"%s: compressed data too small.",
523	31	function );
524
525	31	return( -1 );
526	31	}
527	15.3k	if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
528	10	{
529	10	libcerror_error_set(
530	10	error,
531	10	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
532	10	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
533	10	"%s: uncompressed data too small.",
534	10	function );
535
536	10	return( -1 );
537	10	}
538	15.3k	if( memory_copy(
539	15.3k	&( uncompressed_data[ uncompressed_data_offset ] ),
540	15.3k	&( compressed_data[ compressed_data_offset ] ),
541	15.3k	compression_chunk_size ) == NULL )
542	0	{
543	0	libcerror_error_set(
544	0	error,
545	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
546	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
547	0	"%s: unable to copy copy compressed data to uncompressed data.",
548	0	function );
549
550	0	return( -1 );
551	0	}
552	15.3k	compressed_data_offset += (size_t) compression_chunk_size;
553	15.3k	uncompressed_data_offset += (size_t) compression_chunk_size;
554	15.3k	}
555	652k	}
556	1.94k	*uncompressed_data_size = uncompressed_data_offset;
557
558	1.94k	return( 1 );
559	2.43k	}
560