/src/libfsntfs/libfwnt/libfwnt_lznt1.c

Source (jump to first uncovered line)
/*
 * LZNT1 (de)compression functions
 *
 * Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfwnt_libcerror.h"
#include "libfwnt_libcnotify.h"
#include "libfwnt_lznt1.h"

/* Decompresses a LZNT1 compressed chunk
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress_chunk(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     size_t *compressed_data_offset,
     size_t compression_chunk_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function                   = "libfwnt_lznt1_decompress_chunk";
  size_t compression_tuple_index          = 0;
  size_t compression_tuple_threshold      = 0;
  size_t safe_compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size      = 0;
  size_t uncompressed_data_offset         = 0;
  uint16_t compression_tuple              = 0;
  uint16_t compression_tuple_offset_shift = 0;
  uint16_t compression_tuple_size         = 0;
  uint16_t compression_tuple_size_mask    = 0;
  int16_t compression_tuple_offset        = 0;
  uint8_t compression_flag_bit_index      = 0;
  uint8_t compression_flag_byte           = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compressed_data_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data offset.",
     function );

    return( -1 );
  }
  safe_compressed_data_offset = *compressed_data_offset;

  if( safe_compressed_data_offset >= compressed_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid compressed data offset value out of bounds.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compression chunk size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
     "%s: compressed data too small.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  compression_tuple_threshold    = 16;
  compression_tuple_offset_shift = 12;
  compression_tuple_size_mask    = 0x0fff;

  while( compression_chunk_size > 0 )
  {
    if( safe_compressed_data_offset >= compressed_data_size )
    {
      break;
    }
    compression_flag_byte = compressed_data[ safe_compressed_data_offset ];

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       safe_compressed_data_offset,
       safe_compressed_data_offset );

      libcnotify_printf(
       "%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
       function,
       compression_flag_byte );

      libcnotify_printf(
       "\n" );
    }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

    safe_compressed_data_offset += 1;
    compression_chunk_size      -= 1;

    for( compression_flag_bit_index = 0;
         compression_flag_bit_index < 8;
         compression_flag_bit_index++ )
    {
      /* Check if the data is compressed (tag bit is set)
       */
      if( ( compression_flag_byte & 0x01 ) != 0 )
      {
        if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        /* Read the compression ( size, offset ) tuple
         */
        byte_stream_copy_to_uint16_little_endian(
         &( compressed_data[ safe_compressed_data_offset ] ),
         compression_tuple );

        compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
        compression_tuple_size   = ( compression_tuple & compression_tuple_size_mask ) + 3;

#if defined( HAVE_DEBUG_OUTPUT )
        if( libcnotify_verbose != 0 )
        {
          libcnotify_printf(
           "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
           function,
           safe_compressed_data_offset,
           safe_compressed_data_offset );

          libcnotify_printf(
           "%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
           function,
           compression_tuple,
           compression_tuple_offset_shift,
           compression_tuple_size_mask );

          libcnotify_printf(
           "%s: compression tuple offset\t\t: %" PRIi16 "\n",
           function,
           compression_tuple_offset );

          libcnotify_printf(
           "%s: compression tuple size\t\t\t: %" PRIu16 "\n",
           function,
           compression_tuple_size );

          libcnotify_printf(
           "%s: uncompressed data offset\t\t: %" PRIzd "\n",
           function,
           uncompressed_data_offset );

          libcnotify_printf(
           "\n" );
        }
#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */

        safe_compressed_data_offset += 2;
        compression_chunk_size      -= 2;

        /* The compression tuple offset refers to an offset in the uncompressed data
         */
        if( (size_t) compression_tuple_offset > uncompressed_data_offset )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;

        while( compression_tuple_size > 0 )
        {
          if( compression_tuple_index > uncompressed_data_offset )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid compression tuple index value out of bounds.",
             function );

            return( -1 );
          }
          if( uncompressed_data_offset >= safe_uncompressed_data_size )
          {
            libcerror_error_set(
             error,
             LIBCERROR_ERROR_DOMAIN_RUNTIME,
             LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
             "%s: invalid uncompressed data offset value out of bounds.",
             function );

            return( -1 );
          }
          uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];

          compression_tuple_size -= 1;
        }
      }
      else
      {
        if( uncompressed_data_offset >= safe_uncompressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid uncompressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        if( safe_compressed_data_offset >= compressed_data_size )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compressed data offset value out of bounds.",
           function );

          return( -1 );
        }
        uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];

        compression_chunk_size -= 1;
      }
      compression_flag_byte >>= 1;

      if( compression_chunk_size == 0 )
      {
        break;
      }
      /* The compression tuple size mask and offset shift
       * are dependent on the current buffer offset in the uncompressed data
       */
      while( uncompressed_data_offset > compression_tuple_threshold )
      {
        if( compression_tuple_offset_shift == 0 )
        {
          libcerror_error_set(
           error,
           LIBCERROR_ERROR_DOMAIN_RUNTIME,
           LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
           "%s: invalid compression tuple offset shift value out of bounds.",
           function );

          return( -1 );
        }
        compression_tuple_offset_shift -= 1;
        compression_tuple_size_mask   >>= 1;
        compression_tuple_threshold   <<= 1;
      }
    }
  }
  *compressed_data_offset = safe_compressed_data_offset;
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}

/* Decompresses data using LZNT1 compression
 * Returns 1 on success or -1 on error
 */
int libfwnt_lznt1_decompress(
     const uint8_t *compressed_data,
     size_t compressed_data_size,
     uint8_t *uncompressed_data,
     size_t *uncompressed_data_size,
     libcerror_error_t **error )
{
  static char *function              = "libfwnt_lznt1_decompress";
  size_t compressed_data_offset      = 0;
  size_t safe_uncompressed_data_size = 0;
  size_t uncompressed_chunk_size     = 0;
  size_t uncompressed_data_offset    = 0;
  uint16_t compression_chunk_header  = 0;
  uint16_t compression_chunk_size    = 0;

  if( compressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid compressed data.",
     function );

    return( -1 );
  }
  if( compressed_data_size > (size_t) SSIZE_MAX )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
     "%s: invalid compressed data size value exceeds maximum.",
     function );

    return( -1 );
  }
  if( uncompressed_data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data.",
     function );

    return( -1 );
  }
  if( uncompressed_data_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid uncompressed data size.",
     function );

    return( -1 );
  }
  safe_uncompressed_data_size = *uncompressed_data_size;

  while( compressed_data_offset < compressed_data_size )
  {
    if( uncompressed_data_offset >= safe_uncompressed_data_size )
    {
      break;
    }
    if( ( compressed_data_offset + 1 ) >= compressed_data_size )
    {
      libcerror_error_set(
       error,
       LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
       LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
       "%s: compressed data size value too small.",
       function );

      return( -1 );
    }
    /* The first 2 bytes contain the compressed chunk header
     * 0  - 11  compressed chunk size
     * 12 - 14  signature value
     * 15   is compressed flag
     */
    byte_stream_copy_to_uint16_little_endian(
     &( compressed_data[ compressed_data_offset ] ),
     compression_chunk_header );

#if defined( HAVE_DEBUG_OUTPUT )
    if( libcnotify_verbose != 0 )
    {
      libcnotify_printf(
       "%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
       function,
       compressed_data_offset,
       compressed_data_offset );

      libcnotify_printf(
       "%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
       function,
       compression_chunk_header );

      libcnotify_printf(
       "%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header & 0x0fff ) + 1 );

      libcnotify_printf(
       "%s: signature value\t\t\t\t: %" PRIu16 "\n",
       function,
       ( compression_chunk_header >> 12 ) & 0x0007 );

      libcnotify_printf(
       "%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
       function,
       compression_chunk_header >> 15 );

      libcnotify_printf(
       "\n" );
    }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    compressed_data_offset += 2;

    if( compression_chunk_header == 0 )
    {
      break;
    }
    compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;

    if( ( compression_chunk_header & 0x8000 ) != 0 )
    {
      /* Adjust the compression chunk size for the iteration
       */
      uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;

      if( libfwnt_lznt1_decompress_chunk(
           compressed_data,
           compressed_data_size,
           &compressed_data_offset,
           compression_chunk_size,
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &uncompressed_chunk_size,
           error ) != 1 )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_COMPRESSION,
         LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
         "%s: unable to decompress chunk.",
         function );

        return( -1 );
      }
      uncompressed_data_offset += uncompressed_chunk_size;
    }
    else
    {
      if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: compressed data too small.",
         function );

        return( -1 );
      }
      if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
         LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
         "%s: uncompressed data too small.",
         function );

        return( -1 );
      }
      if( memory_copy(
           &( uncompressed_data[ uncompressed_data_offset ] ),
           &( compressed_data[ compressed_data_offset ] ),
           compression_chunk_size ) == NULL )
      {
        libcerror_error_set(
         error,
         LIBCERROR_ERROR_DOMAIN_MEMORY,
         LIBCERROR_MEMORY_ERROR_COPY_FAILED,
         "%s: unable to copy copy compressed data to uncompressed data.",
         function );

        return( -1 );
      }
      compressed_data_offset   += (size_t) compression_chunk_size;
      uncompressed_data_offset += (size_t) compression_chunk_size;
    }
  }
  *uncompressed_data_size = uncompressed_data_offset;

  return( 1 );
}


Coverage Report

Created: 2025-06-24 07:14

Line	Count	Source (jump to first uncovered line)
1		/*
2		* LZNT1 (de)compression functions
3		*
4		* Copyright (C) 2009-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfwnt_libcerror.h"
28		#include "libfwnt_libcnotify.h"
29		#include "libfwnt_lznt1.h"
30
31		/* Decompresses a LZNT1 compressed chunk
32		* Returns 1 on success or -1 on error
33		*/
34		int libfwnt_lznt1_decompress_chunk(
35		const uint8_t *compressed_data,
36		size_t compressed_data_size,
37		size_t *compressed_data_offset,
38		size_t compression_chunk_size,
39		uint8_t *uncompressed_data,
40		size_t *uncompressed_data_size,
41		libcerror_error_t **error )
42	774k	{
43	774k	static char *function = "libfwnt_lznt1_decompress_chunk";
44	774k	size_t compression_tuple_index = 0;
45	774k	size_t compression_tuple_threshold = 0;
46	774k	size_t safe_compressed_data_offset = 0;
47	774k	size_t safe_uncompressed_data_size = 0;
48	774k	size_t uncompressed_data_offset = 0;
49	774k	uint16_t compression_tuple = 0;
50	774k	uint16_t compression_tuple_offset_shift = 0;
51	774k	uint16_t compression_tuple_size = 0;
52	774k	uint16_t compression_tuple_size_mask = 0;
53	774k	int16_t compression_tuple_offset = 0;
54	774k	uint8_t compression_flag_bit_index = 0;
55	774k	uint8_t compression_flag_byte = 0;
56
57	774k	if( compressed_data == NULL )
58	0	{
59	0	libcerror_error_set(
60	0	error,
61	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
62	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
63	0	"%s: invalid compressed data.",
64	0	function );
65
66	0	return( -1 );
67	0	}
68	774k	if( compressed_data_size > (size_t) SSIZE_MAX )
69	0	{
70	0	libcerror_error_set(
71	0	error,
72	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
73	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
74	0	"%s: invalid compressed data size value exceeds maximum.",
75	0	function );
76
77	0	return( -1 );
78	0	}
79	774k	if( compressed_data_offset == NULL )
80	0	{
81	0	libcerror_error_set(
82	0	error,
83	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
84	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
85	0	"%s: invalid compressed data offset.",
86	0	function );
87
88	0	return( -1 );
89	0	}
90	774k	safe_compressed_data_offset = *compressed_data_offset;
91
92	774k	if( safe_compressed_data_offset >= compressed_data_size )
93	30	{
94	30	libcerror_error_set(
95	30	error,
96	30	LIBCERROR_ERROR_DOMAIN_RUNTIME,
97	30	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
98	30	"%s: invalid compressed data offset value out of bounds.",
99	30	function );
100
101	30	return( -1 );
102	30	}
103	774k	if( compression_chunk_size > (size_t) SSIZE_MAX )
104	0	{
105	0	libcerror_error_set(
106	0	error,
107	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
108	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
109	0	"%s: invalid compression chunk size value exceeds maximum.",
110	0	function );
111
112	0	return( -1 );
113	0	}
114	774k	if( compression_chunk_size > ( compressed_data_size - safe_compressed_data_offset ) )
115	39	{
116	39	libcerror_error_set(
117	39	error,
118	39	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
119	39	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
120	39	"%s: compressed data too small.",
121	39	function );
122
123	39	return( -1 );
124	39	}
125	774k	if( uncompressed_data == NULL )
126	0	{
127	0	libcerror_error_set(
128	0	error,
129	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
130	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
131	0	"%s: invalid uncompressed data.",
132	0	function );
133
134	0	return( -1 );
135	0	}
136	774k	if( uncompressed_data_size == NULL )
137	0	{
138	0	libcerror_error_set(
139	0	error,
140	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
141	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
142	0	"%s: invalid uncompressed data size.",
143	0	function );
144
145	0	return( -1 );
146	0	}
147	774k	safe_uncompressed_data_size = *uncompressed_data_size;
148
149	774k	compression_tuple_threshold = 16;
150	774k	compression_tuple_offset_shift = 12;
151	774k	compression_tuple_size_mask = 0x0fff;
152
153	1.83M	while( compression_chunk_size > 0 )
154	1.05M	{
155	1.05M	if( safe_compressed_data_offset >= compressed_data_size )
156	24	{
157	24	break;
158	24	}
159	1.05M	compression_flag_byte = compressed_data[ safe_compressed_data_offset ];
160
161		#if defined( HAVE_DEBUG_OUTPUT )
162		if( libcnotify_verbose != 0 )
163		{
164		libcnotify_printf(
165		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
166		function,
167		safe_compressed_data_offset,
168		safe_compressed_data_offset );
169
170		libcnotify_printf(
171		"%s: compression flag byte\t\t\t: 0x%02" PRIx8 "\n",
172		function,
173		compression_flag_byte );
174
175		libcnotify_printf(
176		"\n" );
177		}
178		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
179
180	1.05M	safe_compressed_data_offset += 1;
181	1.05M	compression_chunk_size -= 1;
182
183	1.05M	for( compression_flag_bit_index = 0;
184	3.33M	compression_flag_bit_index < 8;
185	2.27M	compression_flag_bit_index++ )
186	3.04M	{
187		/* Check if the data is compressed (tag bit is set)
188		*/
189	3.04M	if( ( compression_flag_byte & 0x01 ) != 0 )
190	283k	{
191	283k	if( safe_compressed_data_offset >= ( compressed_data_size - 1 ) )
192	71	{
193	71	libcerror_error_set(
194	71	error,
195	71	LIBCERROR_ERROR_DOMAIN_RUNTIME,
196	71	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
197	71	"%s: invalid compressed data offset value out of bounds.",
198	71	function );
199
200	71	return( -1 );
201	71	}
202		/* Read the compression ( size, offset ) tuple
203		*/
204	283k	byte_stream_copy_to_uint16_little_endian(
205	283k	&( compressed_data[ safe_compressed_data_offset ] ),
206	283k	compression_tuple );
207
208	283k	compression_tuple_offset = ( compression_tuple >> compression_tuple_offset_shift ) + 1;
209	283k	compression_tuple_size = ( compression_tuple & compression_tuple_size_mask ) + 3;
210
211		#if defined( HAVE_DEBUG_OUTPUT )
212		if( libcnotify_verbose != 0 )
213		{
214		libcnotify_printf(
215		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
216		function,
217		safe_compressed_data_offset,
218		safe_compressed_data_offset );
219
220		libcnotify_printf(
221		"%s: compression tuple\t\t\t: 0x%04" PRIx16 " (shift: %" PRIu16 ", mask: 0x%04" PRIx16 ")\n",
222		function,
223		compression_tuple,
224		compression_tuple_offset_shift,
225		compression_tuple_size_mask );
226
227		libcnotify_printf(
228		"%s: compression tuple offset\t\t: %" PRIi16 "\n",
229		function,
230		compression_tuple_offset );
231
232		libcnotify_printf(
233		"%s: compression tuple size\t\t\t: %" PRIu16 "\n",
234		function,
235		compression_tuple_size );
236
237		libcnotify_printf(
238		"%s: uncompressed data offset\t\t: %" PRIzd "\n",
239		function,
240		uncompressed_data_offset );
241
242		libcnotify_printf(
243		"\n" );
244		}
245		#endif /* #if defined( HAVE_DEBUG_OUTPUT ) */
246
247	283k	safe_compressed_data_offset += 2;
248	283k	compression_chunk_size -= 2;
249
250		/* The compression tuple offset refers to an offset in the uncompressed data
251		*/
252	283k	if( (size_t) compression_tuple_offset > uncompressed_data_offset )
253	224	{
254	224	libcerror_error_set(
255	224	error,
256	224	LIBCERROR_ERROR_DOMAIN_RUNTIME,
257	224	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
258	224	"%s: invalid compression tuple offset value out of bounds.",
259	224	function );
260
261	224	return( -1 );
262	224	}
263	282k	compression_tuple_index = uncompressed_data_offset - compression_tuple_offset;
264
265	6.49M	while( compression_tuple_size > 0 )
266	6.20M	{
267	6.20M	if( compression_tuple_index > uncompressed_data_offset )
268	0	{
269	0	libcerror_error_set(
270	0	error,
271	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
272	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
273	0	"%s: invalid compression tuple index value out of bounds.",
274	0	function );
275
276	0	return( -1 );
277	0	}
278	6.20M	if( uncompressed_data_offset >= safe_uncompressed_data_size )
279	9	{
280	9	libcerror_error_set(
281	9	error,
282	9	LIBCERROR_ERROR_DOMAIN_RUNTIME,
283	9	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
284	9	"%s: invalid uncompressed data offset value out of bounds.",
285	9	function );
286
287	9	return( -1 );
288	9	}
289	6.20M	uncompressed_data[ uncompressed_data_offset++ ] = uncompressed_data[ compression_tuple_index++ ];
290
291	6.20M	compression_tuple_size -= 1;
292	6.20M	}
293	282k	}
294	2.76M	else
295	2.76M	{
296	2.76M	if( uncompressed_data_offset >= safe_uncompressed_data_size )
297	6	{
298	6	libcerror_error_set(
299	6	error,
300	6	LIBCERROR_ERROR_DOMAIN_RUNTIME,
301	6	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
302	6	"%s: invalid uncompressed data offset value out of bounds.",
303	6	function );
304
305	6	return( -1 );
306	6	}
307	2.76M	if( safe_compressed_data_offset >= compressed_data_size )
308	76	{
309	76	libcerror_error_set(
310	76	error,
311	76	LIBCERROR_ERROR_DOMAIN_RUNTIME,
312	76	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
313	76	"%s: invalid compressed data offset value out of bounds.",
314	76	function );
315
316	76	return( -1 );
317	76	}
318	2.76M	uncompressed_data[ uncompressed_data_offset++ ] = compressed_data[ safe_compressed_data_offset++ ];
319
320	2.76M	compression_chunk_size -= 1;
321	2.76M	}
322	3.04M	compression_flag_byte >>= 1;
323
324	3.04M	if( compression_chunk_size == 0 )
325	773k	{
326	773k	break;
327	773k	}
328		/* The compression tuple size mask and offset shift
329		* are dependent on the current buffer offset in the uncompressed data
330		*/
331	2.28M	while( uncompressed_data_offset > compression_tuple_threshold )
332	9.28k	{
333	9.28k	if( compression_tuple_offset_shift == 0 )
334	7	{
335	7	libcerror_error_set(
336	7	error,
337	7	LIBCERROR_ERROR_DOMAIN_RUNTIME,
338	7	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
339	7	"%s: invalid compression tuple offset shift value out of bounds.",
340	7	function );
341
342	7	return( -1 );
343	7	}
344	9.27k	compression_tuple_offset_shift -= 1;
345	9.27k	compression_tuple_size_mask >>= 1;
346	9.27k	compression_tuple_threshold <<= 1;
347	9.27k	}
348	2.27M	}
349	1.05M	}
350	773k	*compressed_data_offset = safe_compressed_data_offset;
351	773k	*uncompressed_data_size = uncompressed_data_offset;
352
353	773k	return( 1 );
354	774k	}
355
356		/* Decompresses data using LZNT1 compression
357		* Returns 1 on success or -1 on error
358		*/
359		int libfwnt_lznt1_decompress(
360		const uint8_t *compressed_data,
361		size_t compressed_data_size,
362		uint8_t *uncompressed_data,
363		size_t *uncompressed_data_size,
364		libcerror_error_t **error )
365	2.53k	{
366	2.53k	static char *function = "libfwnt_lznt1_decompress";
367	2.53k	size_t compressed_data_offset = 0;
368	2.53k	size_t safe_uncompressed_data_size = 0;
369	2.53k	size_t uncompressed_chunk_size = 0;
370	2.53k	size_t uncompressed_data_offset = 0;
371	2.53k	uint16_t compression_chunk_header = 0;
372	2.53k	uint16_t compression_chunk_size = 0;
373
374	2.53k	if( compressed_data == NULL )
375	0	{
376	0	libcerror_error_set(
377	0	error,
378	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
379	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
380	0	"%s: invalid compressed data.",
381	0	function );
382
383	0	return( -1 );
384	0	}
385	2.53k	if( compressed_data_size > (size_t) SSIZE_MAX )
386	0	{
387	0	libcerror_error_set(
388	0	error,
389	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
390	0	LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM,
391	0	"%s: invalid compressed data size value exceeds maximum.",
392	0	function );
393
394	0	return( -1 );
395	0	}
396	2.53k	if( uncompressed_data == NULL )
397	0	{
398	0	libcerror_error_set(
399	0	error,
400	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
401	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
402	0	"%s: invalid uncompressed data.",
403	0	function );
404
405	0	return( -1 );
406	0	}
407	2.53k	if( uncompressed_data_size == NULL )
408	0	{
409	0	libcerror_error_set(
410	0	error,
411	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
412	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
413	0	"%s: invalid uncompressed data size.",
414	0	function );
415
416	0	return( -1 );
417	0	}
418	2.53k	safe_uncompressed_data_size = *uncompressed_data_size;
419
420	796k	while( compressed_data_offset < compressed_data_size )
421	794k	{
422	794k	if( uncompressed_data_offset >= safe_uncompressed_data_size )
423	21	{
424	21	break;
425	21	}
426	794k	if( ( compressed_data_offset + 1 ) >= compressed_data_size )
427	26	{
428	26	libcerror_error_set(
429	26	error,
430	26	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
431	26	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
432	26	"%s: compressed data size value too small.",
433	26	function );
434
435	26	return( -1 );
436	26	}
437		/* The first 2 bytes contain the compressed chunk header
438		* 0 - 11 compressed chunk size
439		* 12 - 14 signature value
440		* 15 is compressed flag
441		*/
442	794k	byte_stream_copy_to_uint16_little_endian(
443	794k	&( compressed_data[ compressed_data_offset ] ),
444	794k	compression_chunk_header );
445
446		#if defined( HAVE_DEBUG_OUTPUT )
447		if( libcnotify_verbose != 0 )
448		{
449		libcnotify_printf(
450		"%s: compressed data offset\t\t\t: %" PRIzd " (0x%08" PRIzx ")\n",
451		function,
452		compressed_data_offset,
453		compressed_data_offset );
454
455		libcnotify_printf(
456		"%s: compression chunk header\t\t\t: 0x%04" PRIx16 "\n",
457		function,
458		compression_chunk_header );
459
460		libcnotify_printf(
461		"%s: compressed chunk size\t\t\t\t: %" PRIu16 "\n",
462		function,
463		( compression_chunk_header & 0x0fff ) + 1 );
464
465		libcnotify_printf(
466		"%s: signature value\t\t\t\t: %" PRIu16 "\n",
467		function,
468		( compression_chunk_header >> 12 ) & 0x0007 );
469
470		libcnotify_printf(
471		"%s: is compressed flag\t\t\t\t: %" PRIu16 "\n",
472		function,
473		compression_chunk_header >> 15 );
474
475		libcnotify_printf(
476		"\n" );
477		}
478		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
479
480	794k	compressed_data_offset += 2;
481
482	794k	if( compression_chunk_header == 0 )
483	286	{
484	286	break;
485	286	}
486	794k	compression_chunk_size = ( compression_chunk_header & 0x0fff ) + 1;
487
488	794k	if( ( compression_chunk_header & 0x8000 ) != 0 )
489	774k	{
490		/* Adjust the compression chunk size for the iteration
491		*/
492	774k	uncompressed_chunk_size = safe_uncompressed_data_size - uncompressed_data_offset;
493
494	774k	if( libfwnt_lznt1_decompress_chunk(
495	774k	compressed_data,
496	774k	compressed_data_size,
497	774k	&compressed_data_offset,
498	774k	compression_chunk_size,
499	774k	&( uncompressed_data[ uncompressed_data_offset ] ),
500	774k	&uncompressed_chunk_size,
501	774k	error ) != 1 )
502	462	{
503	462	libcerror_error_set(
504	462	error,
505	462	LIBCERROR_ERROR_DOMAIN_COMPRESSION,
506	462	LIBCERROR_COMPRESSION_ERROR_DECOMPRESS_FAILED,
507	462	"%s: unable to decompress chunk.",
508	462	function );
509
510	462	return( -1 );
511	462	}
512	773k	uncompressed_data_offset += uncompressed_chunk_size;
513	773k	}
514	20.2k	else
515	20.2k	{
516	20.2k	if( compression_chunk_size > ( compressed_data_size - compressed_data_offset ) )
517	31	{
518	31	libcerror_error_set(
519	31	error,
520	31	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
521	31	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
522	31	"%s: compressed data too small.",
523	31	function );
524
525	31	return( -1 );
526	31	}
527	20.2k	if( compression_chunk_size > ( safe_uncompressed_data_size - uncompressed_data_offset ) )
528	15	{
529	15	libcerror_error_set(
530	15	error,
531	15	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
532	15	LIBCERROR_ARGUMENT_ERROR_VALUE_TOO_SMALL,
533	15	"%s: uncompressed data too small.",
534	15	function );
535
536	15	return( -1 );
537	15	}
538	20.2k	if( memory_copy(
539	20.2k	&( uncompressed_data[ uncompressed_data_offset ] ),
540	20.2k	&( compressed_data[ compressed_data_offset ] ),
541	20.2k	compression_chunk_size ) == NULL )
542	0	{
543	0	libcerror_error_set(
544	0	error,
545	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
546	0	LIBCERROR_MEMORY_ERROR_COPY_FAILED,
547	0	"%s: unable to copy copy compressed data to uncompressed data.",
548	0	function );
549
550	0	return( -1 );
551	0	}
552	20.2k	compressed_data_offset += (size_t) compression_chunk_size;
553	20.2k	uncompressed_data_offset += (size_t) compression_chunk_size;
554	20.2k	}
555	794k	}
556	1.99k	*uncompressed_data_size = uncompressed_data_offset;
557
558	1.99k	return( 1 );
559	2.53k	}
560