/src/libfsntfs/libfwnt/libfwnt_lznt1.c

Source (jump to first uncovered line)
/*
 * LZNT1 (de)compression functions
 *
 * Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwnt_libcerror.h"
#include "libfwnt_libcnotify.h"
#include "libfwnt_lznt1.h"

/* Decompresses a LZNT1 compressed chunk
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress_chunk(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     size_t *compressed_data_offset,
     size_t compression_chunk_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function                   = "libfwnt_lznt1_decompress_chunk";
  size_t compression_tuple_index          = 0;
  size_t compression_tuple_threshold      = 0;
  size_t safe_compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size      = 0;
  size_t uncompressed_data_offset         = 0;
  uint16_t compression_tuple              = 0;
  uint16_t compression_tuple_offset_shift = 0;
  uint16_t compression_tuple_size         = 0;
  uint16_t compression_tuple_size_mask    = 0;
  int16_t compression_tuple_offset        = 0;
  uint8_t compression_flag_bit_index      = 0;
  uint8_t compression_flag_byte           = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compressed_data_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data offset.",
     function );

    return( -1 );
  }
  safe_compressed_data_offset = *compressed_data_offset;

  if( safe_compressed_data_offset >= compressed_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid compressed data offset value out of bounds.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compression chunk size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
     "%s: compressed data too small.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  compression_tuple_threshold    = 16;
  compression_tuple_offset_shift = 12;
  compression_tuple_size_mask    = 0x0fff;

  while( compression_chunk_size > 0 )
  {
    if( safe_compressed_data_offset >= compressed_data_size )
    {
      break;
    }
    compression_flag_byte = compressed_data[ safe_compressed_data_offset ];

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       safe_compressed_data_offset,
       safe_compressed_data_offset );

      libcnotify_printf(
       "%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
       function,
       compression_flag_byte );

      libcnotify_printf(
       "\n" );
    }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

    safe_compressed_data_offset += 1;
    compression_chunk_size      -= 1;

    for( compression_flag_bit_index = 0;
         compression_flag_bit_index < 8;
         compression_flag_bit_index++ )
    {
      /* Check if the data is compressed (tag bit is set)
       */
      if( ( compression_flag_byte & 0x01 ) != 0 )
      {
        if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        /* Read the compression ( size, offset ) tuple
         */
        byte_stream_copy_to_uint16_little_endian(
         &( compressed_data[ safe_compressed_data_offset ] ),
         compression_tuple );

        compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
        compression_tuple_size   = ( compression_tuple & compression_tuple_size_mask ) + 3;

#if defined( HAVE_DEBUG_OUTPUT )
        if( libcnotify_verbose != 0 )
        {
          libcnotify_printf(
           "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
           function,
           safe_compressed_data_offset,
           safe_compressed_data_offset );

          libcnotify_printf(
           "%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
           function,
           compression_tuple,
           compression_tuple_offset_shift,
           compression_tuple_size_mask );

          libcnotify_printf(
           "%s: compression tuple offset\t\t: %" PRIi16 "\n",
           function,
           compression_tuple_offset );

          libcnotify_printf(
           "%s: compression tuple size\t\t\t: %" PRIu16 "\n",
           function,
           compression_tuple_size );

          libcnotify_printf(
           "%s: uncompressed data offset\t\t: %" PRIzd "\n",
           function,
           uncompressed_data_offset );

          libcnotify_printf(
           "\n" );
        }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

        safe_compressed_data_offset += 2;
        compression_chunk_size      -= 2;

        /* The compression tuple offset refers to an offset in the uncompressed data
         */
        if( (size_t) compression_tuple_offset > uncompressed_data_offset )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;

        while( compression_tuple_size > 0 )
        {
          if( compression_tuple_index > uncompressed_data_offset )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid compression tuple index value out of bounds.",
             function );

            return( -1 );
          }
          if( uncompressed_data_offset >= safe_uncompressed_data_size )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid uncompressed data offset value out of bounds.",
             function );

            return( -1 );
          }
          uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];

          compression_tuple_size -= 1;
        }
      }
      else
      {
        if( uncompressed_data_offset >= safe_uncompressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid uncompressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        if( safe_compressed_data_offset >= compressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];

        compression_chunk_size -= 1;
      }
      compression_flag_byte >>= 1;

      if( compression_chunk_size == 0 )
      {
        break;
      }
      /* The compression tuple size mask and offset shift
       * are dependent on the current buffer offset in the uncompressed data
       */
      while( uncompressed_data_offset > compression_tuple_threshold )
      {
        if( compression_tuple_offset_shift == 0 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset shift value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_offset_shift -= 1;
        compression_tuple_size_mask   >>= 1;
        compression_tuple_threshold   <<= 1;
      }
    }
  }
  *compressed_data_offset = safe_compressed_data_offset;
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}

/* Decompresses data using LZNT1 compression
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function              = "libfwnt_lznt1_decompress";
  size_t compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size = 0;
  size_t uncompressed_chunk_size     = 0;
  size_t uncompressed_data_offset    = 0;
  uint16_t compression_chunk_header  = 0;
  uint16_t compression_chunk_size    = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  while( compressed_data_offset < compressed_data_size )
  {
    if( uncompressed_data_offset >= safe_uncompressed_data_size )
    {
      break;
    }
    if( ( compressed_data_offset + 1 ) >= compressed_data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
       LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
       "%s: compressed data size value too small.",
       function );

      return( -1 );
    }
    /* The first 2 bytes contain the compressed chunk header
     * 0  - 11  compressed chunk size
     * 12 - 14  signature value
     * 15   is compressed flag
     */
    byte_stream_copy_to_uint16_little_endian(
     &( compressed_data[ compressed_data_offset ] ),
     compression_chunk_header );

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       compressed_data_offset,
       compressed_data_offset );

      libcnotify_printf(
       "%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
       function,
       compression_chunk_header );

      libcnotify_printf(
       "%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header & 0x0fff ) + 1 );

      libcnotify_printf(
       "%s: signature value\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header >> 12 ) & 0x0007 );

      libcnotify_printf(
       "%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
       function,
       compression_chunk_header >> 15 );

      libcnotify_printf(
       "\n" );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    compressed_data_offset += 2;

    if( compression_chunk_header == 0 )
    {
      break;
    }
    compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;

    if( ( compression_chunk_header & 0x8000 ) != 0 )
    {
      /* Adjust the compression chunk size for the iteration
       */
      uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;

      if( libfwnt_lznt1_decompress_chunk(
           compressed_data,
           compressed_data_size,
           &compressed_data_offset,
           compression_chunk_size,
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &uncompressed_chunk_size,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_COMPRESSION,
         LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
         "%s: unable to decompress chunk.",
         function );

        return( -1 );
      }
      uncompressed_data_offset += uncompressed_chunk_size;
    }
    else
    {
      if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: compressed data too small.",
         function );

        return( -1 );
      }
      if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: uncompressed data too small.",
         function );

        return( -1 );
      }
      if( memory_copy(
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &( compressed_data[ compressed_data_offset ] ),
           compression_chunk_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy copy compressed data to uncompressed data.",
         function );

        return( -1 );
      }
      compressed_data_offset   += (size_t) compression_chunk_size;
      uncompressed_data_offset += (size_t) compression_chunk_size;
    }
  }
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}


Coverage Report

Created: 2025-06-13 07:22

Line	Count	Source (jump to first uncovered line)
1		/*
2		* LZNT1 (de)compression functions
3		*
4		* Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwnt_libcerror.h"
28		#include "libfwnt_libcnotify.h"
29		#include "libfwnt_lznt1.h"
30
31		/* Decompresses a LZNT1 compressed chunk
32		* Returns 1 on success or -1 on error
33		*/
34		int libfwnt_lznt1_decompress_chunk(
35		const uint8_t *compressed_data,
36		size_t compressed_data_size,
37		size_t *compressed_data_offset,
38		size_t compression_chunk_size,
39		uint8_t *uncompressed_data,
40		size_t *uncompressed_data_size,
41		libcerror_error_t **error )
42	733k	{
43	733k	static char *function = "libfwnt_lznt1_decompress_chunk";
44	733k	size_t compression_tuple_index = 0;
45	733k	size_t compression_tuple_threshold = 0;
46	733k	size_t safe_compressed_data_offset = 0;
47	733k	size_t safe_uncompressed_data_size = 0;
48	733k	size_t uncompressed_data_offset = 0;
49	733k	uint16_t compression_tuple = 0;
50	733k	uint16_t compression_tuple_offset_shift = 0;
51	733k	uint16_t compression_tuple_size = 0;
52	733k	uint16_t compression_tuple_size_mask = 0;
53	733k	int16_t compression_tuple_offset = 0;
54	733k	uint8_t compression_flag_bit_index = 0;
55	733k	uint8_t compression_flag_byte = 0;
56
57	733k	if( compressed_data == NULL )
58	0	{
59	0	libcerror_error_set(
60	0	error,
61	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
62	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
63	0	"%s: invalid compressed data.",
64	0	function );
65
66	0	return( -1 );
67	0	}
68	733k	if( compressed_data_size > (size_t) SSIZE_MAX )
69	0	{
70	0	libcerror_error_set(
71	0	error,
72	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
73	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
74	0	"%s: invalid compressed data size value exceeds maximum.",
75	0	function );
76
77	0	return( -1 );
78	0	}
79	733k	if( compressed_data_offset == NULL )
80	0	{
81	0	libcerror_error_set(
82	0	error,
83	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
84	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
85	0	"%s: invalid compressed data offset.",
86	0	function );
87
88	0	return( -1 );
89	0	}
90	733k	safe_compressed_data_offset = *compressed_data_offset;
91
92	733k	if( safe_compressed_data_offset >= compressed_data_size )
93	26	{
94	26	libcerror_error_set(
95	26	error,
96	26	LIBCERROR_ERROR_DOMAIN_RUNTIME,
97	26	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
98	26	"%s: invalid compressed data offset value out of bounds.",
99	26	function );
100
101	26	return( -1 );
102	26	}
103	733k	if( compression_chunk_size > (size_t) SSIZE_MAX )
104	0	{
105	0	libcerror_error_set(
106	0	error,
107	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
108	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
109	0	"%s: invalid compression chunk size value exceeds maximum.",
110	0	function );
111
112	0	return( -1 );
113	0	}
114	733k	if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
115	37	{
116	37	libcerror_error_set(
117	37	error,
118	37	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
119	37	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
120	37	"%s: compressed data too small.",
121	37	function );
122
123	37	return( -1 );
124	37	}
125	733k	if( uncompressed_data == NULL )
126	0	{
127	0	libcerror_error_set(
128	0	error,
129	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
130	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
131	0	"%s: invalid uncompressed data.",
132	0	function );
133
134	0	return( -1 );
135	0	}
136	733k	if( uncompressed_data_size == NULL )
137	0	{
138	0	libcerror_error_set(
139	0	error,
140	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
141	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
142	0	"%s: invalid uncompressed data size.",
143	0	function );
144
145	0	return( -1 );
146	0	}
147	733k	safe_uncompressed_data_size = *uncompressed_data_size;
148
149	733k	compression_tuple_threshold = 16;
150	733k	compression_tuple_offset_shift = 12;
151	733k	compression_tuple_size_mask = 0x0fff;
152
153	1.71M	while( compression_chunk_size > 0 )
154	985k	{
155	985k	if( safe_compressed_data_offset >= compressed_data_size )
156	25	{
157	25	break;
158	25	}
159	985k	compression_flag_byte = compressed_data[ safe_compressed_data_offset ];
160
161		#if defined( HAVE_DEBUG_OUTPUT )
162		if( libcnotify_verbose != 0 )
163		{
164		libcnotify_printf(
165		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
166		function,
167		safe_compressed_data_offset,
168		safe_compressed_data_offset );
169
170		libcnotify_printf(
171		"%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
172		function,
173		compression_flag_byte );
174
175		libcnotify_printf(
176		"\n" );
177		}
178		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
179
180	985k	safe_compressed_data_offset += 1;
181	985k	compression_chunk_size -= 1;
182
183	985k	for( compression_flag_bit_index = 0;
184	3.01M	compression_flag_bit_index < 8;
185	2.02M	compression_flag_bit_index++ )
186	2.75M	{
187		/* Check if the data is compressed (tag bit is set)
188		*/
189	2.75M	if( ( compression_flag_byte & 0x01 ) != 0 )
190	285k	{
191	285k	if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
192	67	{
193	67	libcerror_error_set(
194	67	error,
195	67	LIBCERROR_ERROR_DOMAIN_RUNTIME,
196	67	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
197	67	"%s: invalid compressed data offset value out of bounds.",
198	67	function );
199
200	67	return( -1 );
201	67	}
202		/* Read the compression ( size, offset ) tuple
203		*/
204	285k	byte_stream_copy_to_uint16_little_endian(
205	285k	&( compressed_data[ safe_compressed_data_offset ] ),
206	285k	compression_tuple );
207
208	285k	compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
209	285k	compression_tuple_size = ( compression_tuple & compression_tuple_size_mask ) + 3;
210
211		#if defined( HAVE_DEBUG_OUTPUT )
212		if( libcnotify_verbose != 0 )
213		{
214		libcnotify_printf(
215		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
216		function,
217		safe_compressed_data_offset,
218		safe_compressed_data_offset );
219
220		libcnotify_printf(
221		"%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
222		function,
223		compression_tuple,
224		compression_tuple_offset_shift,
225		compression_tuple_size_mask );
226
227		libcnotify_printf(
228		"%s: compression tuple offset\t\t: %" PRIi16 "\n",
229		function,
230		compression_tuple_offset );
231
232		libcnotify_printf(
233		"%s: compression tuple size\t\t\t: %" PRIu16 "\n",
234		function,
235		compression_tuple_size );
236
237		libcnotify_printf(
238		"%s: uncompressed data offset\t\t: %" PRIzd "\n",
239		function,
240		uncompressed_data_offset );
241
242		libcnotify_printf(
243		"\n" );
244		}
245		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
246
247	285k	safe_compressed_data_offset += 2;
248	285k	compression_chunk_size -= 2;
249
250		/* The compression tuple offset refers to an offset in the uncompressed data
251		*/
252	285k	if( (size_t) compression_tuple_offset > uncompressed_data_offset )
253	217	{
254	217	libcerror_error_set(
255	217	error,
256	217	LIBCERROR_ERROR_DOMAIN_RUNTIME,
257	217	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
258	217	"%s: invalid compression tuple offset value out of bounds.",
259	217	function );
260
261	217	return( -1 );
262	217	}
263	284k	compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;
264
265	6.52M	while( compression_tuple_size > 0 )
266	6.23M	{
267	6.23M	if( compression_tuple_index > uncompressed_data_offset )
268	0	{
269	0	libcerror_error_set(
270	0	error,
271	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
272	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
273	0	"%s: invalid compression tuple index value out of bounds.",
274	0	function );
275
276	0	return( -1 );
277	0	}
278	6.23M	if( uncompressed_data_offset >= safe_uncompressed_data_size )
279	10	{
280	10	libcerror_error_set(
281	10	error,
282	10	LIBCERROR_ERROR_DOMAIN_RUNTIME,
283	10	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
284	10	"%s: invalid uncompressed data offset value out of bounds.",
285	10	function );
286
287	10	return( -1 );
288	10	}
289	6.23M	uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];
290
291	6.23M	compression_tuple_size -= 1;
292	6.23M	}
293	284k	}
294	2.47M	else
295	2.47M	{
296	2.47M	if( uncompressed_data_offset >= safe_uncompressed_data_size )
297	6	{
298	6	libcerror_error_set(
299	6	error,
300	6	LIBCERROR_ERROR_DOMAIN_RUNTIME,
301	6	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
302	6	"%s: invalid uncompressed data offset value out of bounds.",
303	6	function );
304
305	6	return( -1 );
306	6	}
307	2.47M	if( safe_compressed_data_offset >= compressed_data_size )
308	73	{
309	73	libcerror_error_set(
310	73	error,
311	73	LIBCERROR_ERROR_DOMAIN_RUNTIME,
312	73	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
313	73	"%s: invalid compressed data offset value out of bounds.",
314	73	function );
315
316	73	return( -1 );
317	73	}
318	2.47M	uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];
319
320	2.47M	compression_chunk_size -= 1;
321	2.47M	}
322	2.75M	compression_flag_byte >>= 1;
323
324	2.75M	if( compression_chunk_size == 0 )
325	732k	{
326	732k	break;
327	732k	}
328		/* The compression tuple size mask and offset shift
329		* are dependent on the current buffer offset in the uncompressed data
330		*/
331	2.03M	while( uncompressed_data_offset > compression_tuple_threshold )
332	9.13k	{
333	9.13k	if( compression_tuple_offset_shift == 0 )
334	4	{
335	4	libcerror_error_set(
336	4	error,
337	4	LIBCERROR_ERROR_DOMAIN_RUNTIME,
338	4	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
339	4	"%s: invalid compression tuple offset shift value out of bounds.",
340	4	function );
341
342	4	return( -1 );
343	4	}
344	9.12k	compression_tuple_offset_shift -= 1;
345	9.12k	compression_tuple_size_mask >>= 1;
346	9.12k	compression_tuple_threshold <<= 1;
347	9.12k	}
348	2.02M	}
349	985k	}
350	732k	*compressed_data_offset = safe_compressed_data_offset;
351	732k	*uncompressed_data_size = uncompressed_data_offset;
352
353	732k	return( 1 );
354	733k	}
355
356		/* Decompresses data using LZNT1 compression
357		* Returns 1 on success or -1 on error
358		*/
359		int libfwnt_lznt1_decompress(
360		const uint8_t *compressed_data,
361		size_t compressed_data_size,
362		uint8_t *uncompressed_data,
363		size_t *uncompressed_data_size,
364		libcerror_error_t **error )
365	2.49k	{
366	2.49k	static char *function = "libfwnt_lznt1_decompress";
367	2.49k	size_t compressed_data_offset = 0;
368	2.49k	size_t safe_uncompressed_data_size = 0;
369	2.49k	size_t uncompressed_chunk_size = 0;
370	2.49k	size_t uncompressed_data_offset = 0;
371	2.49k	uint16_t compression_chunk_header = 0;
372	2.49k	uint16_t compression_chunk_size = 0;
373
374	2.49k	if( compressed_data == NULL )
375	0	{
376	0	libcerror_error_set(
377	0	error,
378	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
379	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
380	0	"%s: invalid compressed data.",
381	0	function );
382
383	0	return( -1 );
384	0	}
385	2.49k	if( compressed_data_size > (size_t) SSIZE_MAX )
386	0	{
387	0	libcerror_error_set(
388	0	error,
389	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
390	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
391	0	"%s: invalid compressed data size value exceeds maximum.",
392	0	function );
393
394	0	return( -1 );
395	0	}
396	2.49k	if( uncompressed_data == NULL )
397	0	{
398	0	libcerror_error_set(
399	0	error,
400	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
401	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
402	0	"%s: invalid uncompressed data.",
403	0	function );
404
405	0	return( -1 );
406	0	}
407	2.49k	if( uncompressed_data_size == NULL )
408	0	{
409	0	libcerror_error_set(
410	0	error,
411	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
412	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
413	0	"%s: invalid uncompressed data size.",
414	0	function );
415
416	0	return( -1 );
417	0	}
418	2.49k	safe_uncompressed_data_size = *uncompressed_data_size;
419
420	754k	while( compressed_data_offset < compressed_data_size )
421	752k	{
422	752k	if( uncompressed_data_offset >= safe_uncompressed_data_size )
423	19	{
424	19	break;
425	19	}
426	752k	if( ( compressed_data_offset + 1 ) >= compressed_data_size )
427	26	{
428	26	libcerror_error_set(
429	26	error,
430	26	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
431	26	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
432	26	"%s: compressed data size value too small.",
433	26	function );
434
435	26	return( -1 );
436	26	}
437		/* The first 2 bytes contain the compressed chunk header
438		* 0 - 11 compressed chunk size
439		* 12 - 14 signature value
440		* 15 is compressed flag
441		*/
442	752k	byte_stream_copy_to_uint16_little_endian(
443	752k	&( compressed_data[ compressed_data_offset ] ),
444	752k	compression_chunk_header );
445
446		#if defined( HAVE_DEBUG_OUTPUT )
447		if( libcnotify_verbose != 0 )
448		{
449		libcnotify_printf(
450		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
451		function,
452		compressed_data_offset,
453		compressed_data_offset );
454
455		libcnotify_printf(
456		"%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
457		function,
458		compression_chunk_header );
459
460		libcnotify_printf(
461		"%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
462		function,
463		( compression_chunk_header & 0x0fff ) + 1 );
464
465		libcnotify_printf(
466		"%s: signature value\t\t\t\t: %" PRIu16 "\n",
467		function,
468		( compression_chunk_header >> 12 ) & 0x0007 );
469
470		libcnotify_printf(
471		"%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
472		function,
473		compression_chunk_header >> 15 );
474
475		libcnotify_printf(
476		"\n" );
477		}
478		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
479
480	752k	compressed_data_offset += 2;
481
482	752k	if( compression_chunk_header == 0 )
483	255	{
484	255	break;
485	255	}
486	752k	compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;
487
488	752k	if( ( compression_chunk_header & 0x8000 ) != 0 )
489	733k	{
490		/* Adjust the compression chunk size for the iteration
491		*/
492	733k	uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;
493
494	733k	if( libfwnt_lznt1_decompress_chunk(
495	733k	compressed_data,
496	733k	compressed_data_size,
497	733k	&compressed_data_offset,
498	733k	compression_chunk_size,
499	733k	&( uncompressed_data[ uncompressed_data_offset ] ),
500	733k	&uncompressed_chunk_size,
501	733k	error ) != 1 )
502	440	{
503	440	libcerror_error_set(
504	440	error,
505	440	LIBCERROR_ERROR_DOMAIN_COMPRESSION,
506	440	LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
507	440	"%s: unable to decompress chunk.",
508	440	function );
509
510	440	return( -1 );
511	440	}
512	732k	uncompressed_data_offset += uncompressed_chunk_size;
513	732k	}
514	19.1k	else
515	19.1k	{
516	19.1k	if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
517	35	{
518	35	libcerror_error_set(
519	35	error,
520	35	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
521	35	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
522	35	"%s: compressed data too small.",
523	35	function );
524
525	35	return( -1 );
526	35	}
527	19.1k	if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
528	13	{
529	13	libcerror_error_set(
530	13	error,
531	13	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
532	13	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
533	13	"%s: uncompressed data too small.",
534	13	function );
535
536	13	return( -1 );
537	13	}
538	19.1k	if( memory_copy(
539	19.1k	&( uncompressed_data[ uncompressed_data_offset ] ),
540	19.1k	&( compressed_data[ compressed_data_offset ] ),
541	19.1k	compression_chunk_size ) == NULL )
542	0	{
543	0	libcerror_error_set(
544	0	error,
545	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
546	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
547	0	"%s: unable to copy copy compressed data to uncompressed data.",
548	0	function );
549
550	0	return( -1 );
551	0	}
552	19.1k	compressed_data_offset += (size_t) compression_chunk_size;
553	19.1k	uncompressed_data_offset += (size_t) compression_chunk_size;
554	19.1k	}
555	752k	}
556	1.97k	*uncompressed_data_size = uncompressed_data_offset;
557
558	1.97k	return( 1 );
559	2.49k	}
560