1 /* Lzma decompressor for Linux kernel. Shamelessly snarfed
2  * from busybox 1.1.1
3  *
4  * Linux kernel adaptation
5  * Copyright (C) 2006  Alain < alain@knaff.lu >
6  *
7  * Based on small lzma deflate implementation/Small range coder
8  * implementation for lzma.
9  * Copyright (C) 2006  Aurelien Jacobs < aurel@gnuage.org >
10  *
11  * Based on LzmaDecode.c from the LZMA SDK 4.22 (http://www.7-zip.org/)
12  * Copyright (C) 1999-2005  Igor Pavlov
13  *
14  * Copyrights of the parts, see headers below.
15  *
16  *
17  * This program is free software; you can redistribute it and/or
18  * modify it under the terms of the GNU Lesser General Public
19  * License as published by the Free Software Foundation; either
20  * version 2.1 of the License, or (at your option) any later version.
21  *
22  * This program is distributed in the hope that it will be useful,
23  * but WITHOUT ANY WARRANTY; without even the implied warranty of
24  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
25  * Lesser General Public License for more details.
26  *
27  * You should have received a copy of the GNU Lesser General Public
28  * License along with this library; If not, see <http://www.gnu.org/licenses/>.
29  */
30 
31 #include "decompress.h"
32 
33 #define	MIN(a, b) (((a) < (b)) ? (a) : (b))
34 
read_int(unsigned char * ptr,int size)35 static long long INIT read_int(unsigned char *ptr, int size)
36 {
37 	int i;
38 	long long ret = 0;
39 
40 	for (i = 0; i < size; i++)
41 		ret = (ret << 8) | ptr[size-i-1];
42 	return ret;
43 }
44 
45 #define ENDIAN_CONVERT(x) \
46   x = (typeof(x))read_int((unsigned char *)&x, sizeof(x))
47 
48 
49 /* Small range coder implementation for lzma.
50  * Copyright (C) 2006  Aurelien Jacobs < aurel@gnuage.org >
51  *
52  * Based on LzmaDecode.c from the LZMA SDK 4.22 (http://www.7-zip.org/)
53  * Copyright (c) 1999-2005  Igor Pavlov
54  */
55 
56 #ifdef __XEN__
57 #include <xen/compiler.h>
58 #endif
59 
60 #define LZMA_IOBUF_SIZE	0x10000
61 
62 struct rc {
63 	int (*fill)(void*, unsigned int);
64 	uint8_t *ptr;
65 	uint8_t *buffer;
66 	uint8_t *buffer_end;
67 	int buffer_size;
68 	uint32_t code;
69 	uint32_t range;
70 	uint32_t bound;
71 	void (*error)(const char *);
72 };
73 
74 
75 #define RC_TOP_BITS 24
76 #define RC_MOVE_BITS 5
77 #define RC_MODEL_TOTAL_BITS 11
78 
79 
nofill(void * buffer,unsigned int len)80 static int INIT nofill(void *buffer, unsigned int len)
81 {
82 	return -1;
83 }
84 
85 /* Called twice: once at startup and once in rc_normalize() */
rc_read(struct rc * rc)86 static void INIT rc_read(struct rc *rc)
87 {
88 	rc->buffer_size = rc->fill((char *)rc->buffer, LZMA_IOBUF_SIZE);
89 	if (rc->buffer_size <= 0)
90 		rc->error("unexpected EOF");
91 	rc->ptr = rc->buffer;
92 	rc->buffer_end = rc->buffer + rc->buffer_size;
93 }
94 
95 /* Called once */
rc_init(struct rc * rc,int (* fill)(void *,unsigned int),unsigned char * buffer,int buffer_size)96 static inline void INIT rc_init(struct rc *rc,
97 				       int (*fill)(void*, unsigned int),
98 				       unsigned char *buffer, int buffer_size)
99 {
100 	if (fill)
101 		rc->fill = fill;
102 	else
103 		rc->fill = nofill;
104 	rc->buffer = (uint8_t *)buffer;
105 	rc->buffer_size = buffer_size;
106 	rc->buffer_end = rc->buffer + rc->buffer_size;
107 	rc->ptr = rc->buffer;
108 
109 	rc->code = 0;
110 	rc->range = 0xFFFFFFFF;
111 }
112 
rc_init_code(struct rc * rc)113 static inline void INIT rc_init_code(struct rc *rc)
114 {
115 	int i;
116 
117 	for (i = 0; i < 5; i++) {
118 		if (rc->ptr >= rc->buffer_end)
119 			rc_read(rc);
120 		rc->code = (rc->code << 8) | *rc->ptr++;
121 	}
122 }
123 
124 
125 /* Called twice, but one callsite is in inline'd rc_is_bit_0_helper() */
rc_do_normalize(struct rc * rc)126 static void INIT rc_do_normalize(struct rc *rc)
127 {
128 	if (rc->ptr >= rc->buffer_end)
129 		rc_read(rc);
130 	rc->range <<= 8;
131 	rc->code = (rc->code << 8) | *rc->ptr++;
132 }
rc_normalize(struct rc * rc)133 static inline void INIT rc_normalize(struct rc *rc)
134 {
135 	if (rc->range < (1 << RC_TOP_BITS))
136 		rc_do_normalize(rc);
137 }
138 
139 /* Called 9 times */
140 /* Why rc_is_bit_0_helper exists?
141  *Because we want to always expose (rc->code < rc->bound) to optimizer
142  */
rc_is_bit_0_helper(struct rc * rc,uint16_t * p)143 static inline uint32_t INIT rc_is_bit_0_helper(struct rc *rc, uint16_t *p)
144 {
145 	rc_normalize(rc);
146 	rc->bound = *p * (rc->range >> RC_MODEL_TOTAL_BITS);
147 	return rc->bound;
148 }
rc_is_bit_0(struct rc * rc,uint16_t * p)149 static inline int INIT rc_is_bit_0(struct rc *rc, uint16_t *p)
150 {
151 	uint32_t t = rc_is_bit_0_helper(rc, p);
152 	return rc->code < t;
153 }
154 
155 /* Called ~10 times, but very small, thus inlined */
rc_update_bit_0(struct rc * rc,uint16_t * p)156 static inline void INIT rc_update_bit_0(struct rc *rc, uint16_t *p)
157 {
158 	rc->range = rc->bound;
159 	*p += ((1 << RC_MODEL_TOTAL_BITS) - *p) >> RC_MOVE_BITS;
160 }
rc_update_bit_1(struct rc * rc,uint16_t * p)161 static inline void rc_update_bit_1(struct rc *rc, uint16_t *p)
162 {
163 	rc->range -= rc->bound;
164 	rc->code -= rc->bound;
165 	*p -= *p >> RC_MOVE_BITS;
166 }
167 
168 /* Called 4 times in unlzma loop */
rc_get_bit(struct rc * rc,uint16_t * p,int * symbol)169 static int INIT rc_get_bit(struct rc *rc, uint16_t *p, int *symbol)
170 {
171 	if (rc_is_bit_0(rc, p)) {
172 		rc_update_bit_0(rc, p);
173 		*symbol *= 2;
174 		return 0;
175 	} else {
176 		rc_update_bit_1(rc, p);
177 		*symbol = *symbol * 2 + 1;
178 		return 1;
179 	}
180 }
181 
182 /* Called once */
rc_direct_bit(struct rc * rc)183 static inline int INIT rc_direct_bit(struct rc *rc)
184 {
185 	rc_normalize(rc);
186 	rc->range >>= 1;
187 	if (rc->code >= rc->range) {
188 		rc->code -= rc->range;
189 		return 1;
190 	}
191 	return 0;
192 }
193 
194 /* Called twice */
195 static inline void INIT
rc_bit_tree_decode(struct rc * rc,uint16_t * p,int num_levels,int * symbol)196 rc_bit_tree_decode(struct rc *rc, uint16_t *p, int num_levels, int *symbol)
197 {
198 	int i = num_levels;
199 
200 	*symbol = 1;
201 	while (i--)
202 		rc_get_bit(rc, p + *symbol, symbol);
203 	*symbol -= 1 << num_levels;
204 }
205 
206 
207 /*
208  * Small lzma deflate implementation.
209  * Copyright (C) 2006  Aurelien Jacobs < aurel@gnuage.org >
210  *
211  * Based on LzmaDecode.c from the LZMA SDK 4.22 (http://www.7-zip.org/)
212  * Copyright (C) 1999-2005  Igor Pavlov
213  */
214 
215 
216 struct lzma_header {
217 	uint8_t pos;
218 	uint32_t dict_size;
219 	uint64_t dst_size;
220 } __attribute__((packed)) ;
221 
222 
223 #define LZMA_BASE_SIZE 1846
224 #define LZMA_LIT_SIZE 768
225 
226 #define LZMA_NUM_POS_BITS_MAX 4
227 
228 #define LZMA_LEN_NUM_LOW_BITS 3
229 #define LZMA_LEN_NUM_MID_BITS 3
230 #define LZMA_LEN_NUM_HIGH_BITS 8
231 
232 #define LZMA_LEN_CHOICE 0
233 #define LZMA_LEN_CHOICE_2 (LZMA_LEN_CHOICE + 1)
234 #define LZMA_LEN_LOW (LZMA_LEN_CHOICE_2 + 1)
235 #define LZMA_LEN_MID (LZMA_LEN_LOW \
236 		      + (1 << (LZMA_NUM_POS_BITS_MAX + LZMA_LEN_NUM_LOW_BITS)))
237 #define LZMA_LEN_HIGH (LZMA_LEN_MID \
238 		       +(1 << (LZMA_NUM_POS_BITS_MAX + LZMA_LEN_NUM_MID_BITS)))
239 #define LZMA_NUM_LEN_PROBS (LZMA_LEN_HIGH + (1 << LZMA_LEN_NUM_HIGH_BITS))
240 
241 #define LZMA_NUM_STATES 12
242 #define LZMA_NUM_LIT_STATES 7
243 
244 #define LZMA_START_POS_MODEL_INDEX 4
245 #define LZMA_END_POS_MODEL_INDEX 14
246 #define LZMA_NUM_FULL_DISTANCES (1 << (LZMA_END_POS_MODEL_INDEX >> 1))
247 
248 #define LZMA_NUM_POS_SLOT_BITS 6
249 #define LZMA_NUM_LEN_TO_POS_STATES 4
250 
251 #define LZMA_NUM_ALIGN_BITS 4
252 
253 #define LZMA_MATCH_MIN_LEN 2
254 
255 #define LZMA_IS_MATCH 0
256 #define LZMA_IS_REP (LZMA_IS_MATCH + (LZMA_NUM_STATES << LZMA_NUM_POS_BITS_MAX))
257 #define LZMA_IS_REP_G0 (LZMA_IS_REP + LZMA_NUM_STATES)
258 #define LZMA_IS_REP_G1 (LZMA_IS_REP_G0 + LZMA_NUM_STATES)
259 #define LZMA_IS_REP_G2 (LZMA_IS_REP_G1 + LZMA_NUM_STATES)
260 #define LZMA_IS_REP_0_LONG (LZMA_IS_REP_G2 + LZMA_NUM_STATES)
261 #define LZMA_POS_SLOT (LZMA_IS_REP_0_LONG \
262 		       + (LZMA_NUM_STATES << LZMA_NUM_POS_BITS_MAX))
263 #define LZMA_SPEC_POS (LZMA_POS_SLOT \
264 		       +(LZMA_NUM_LEN_TO_POS_STATES << LZMA_NUM_POS_SLOT_BITS))
265 #define LZMA_ALIGN (LZMA_SPEC_POS \
266 		    + LZMA_NUM_FULL_DISTANCES - LZMA_END_POS_MODEL_INDEX)
267 #define LZMA_LEN_CODER (LZMA_ALIGN + (1 << LZMA_NUM_ALIGN_BITS))
268 #define LZMA_REP_LEN_CODER (LZMA_LEN_CODER + LZMA_NUM_LEN_PROBS)
269 #define LZMA_LITERAL (LZMA_REP_LEN_CODER + LZMA_NUM_LEN_PROBS)
270 
271 
272 struct writer {
273 	uint8_t *buffer;
274 	uint8_t previous_byte;
275 	size_t buffer_pos;
276 	int bufsize;
277 	size_t global_pos;
278 	int(*flush)(void*, unsigned int);
279 	struct lzma_header *header;
280 };
281 
282 struct cstate {
283 	int state;
284 	uint32_t rep0, rep1, rep2, rep3;
285 };
286 
get_pos(struct writer * wr)287 static inline size_t INIT get_pos(struct writer *wr)
288 {
289 	return
290 		wr->global_pos + wr->buffer_pos;
291 }
292 
peek_old_byte(struct writer * wr,uint32_t offs)293 static inline uint8_t INIT peek_old_byte(struct writer *wr,
294 						uint32_t offs)
295 {
296 	if (!wr->flush) {
297 		int32_t pos;
298 		while (offs > wr->header->dict_size)
299 			offs -= wr->header->dict_size;
300 		pos = wr->buffer_pos - offs;
301 		return wr->buffer[pos];
302 	} else {
303 		uint32_t pos = wr->buffer_pos - offs;
304 		while (pos >= wr->header->dict_size)
305 			pos += wr->header->dict_size;
306 		return wr->buffer[pos];
307 	}
308 
309 }
310 
write_byte(struct writer * wr,uint8_t byte)311 static inline int INIT write_byte(struct writer *wr, uint8_t byte)
312 {
313 	wr->buffer[wr->buffer_pos++] = wr->previous_byte = byte;
314 	if (wr->flush && wr->buffer_pos == wr->header->dict_size) {
315 		wr->buffer_pos = 0;
316 		wr->global_pos += wr->header->dict_size;
317 		if (wr->flush((char *)wr->buffer, wr->header->dict_size)
318 				!= wr->header->dict_size)
319 			return -1;
320 	}
321 	return 0;
322 }
323 
324 
copy_byte(struct writer * wr,uint32_t offs)325 static inline int INIT copy_byte(struct writer *wr, uint32_t offs)
326 {
327 	return write_byte(wr, peek_old_byte(wr, offs));
328 }
329 
copy_bytes(struct writer * wr,uint32_t rep0,int len)330 static inline int INIT copy_bytes(struct writer *wr,
331 					 uint32_t rep0, int len)
332 {
333 	do {
334 		if (copy_byte(wr, rep0))
335 			return -1;
336 		len--;
337 	} while (len != 0 && wr->buffer_pos < wr->header->dst_size);
338 
339 	return len;
340 }
341 
process_bit0(struct writer * wr,struct rc * rc,struct cstate * cst,uint16_t * p,int pos_state,uint16_t * prob,int lc,uint32_t literal_pos_mask)342 static inline int INIT process_bit0(struct writer *wr, struct rc *rc,
343 				     struct cstate *cst, uint16_t *p,
344 				     int pos_state, uint16_t *prob,
345 				     int lc, uint32_t literal_pos_mask) {
346 	int mi = 1;
347 	rc_update_bit_0(rc, prob);
348 	prob = (p + LZMA_LITERAL +
349 		(LZMA_LIT_SIZE
350 		 * (((get_pos(wr) & literal_pos_mask) << lc)
351 		    + (wr->previous_byte >> (8 - lc))))
352 		);
353 
354 	if (cst->state >= LZMA_NUM_LIT_STATES) {
355 		int match_byte = peek_old_byte(wr, cst->rep0);
356 		do {
357 			int bit;
358 			uint16_t *prob_lit;
359 
360 			match_byte <<= 1;
361 			bit = match_byte & 0x100;
362 			prob_lit = prob + 0x100 + bit + mi;
363 			if (rc_get_bit(rc, prob_lit, &mi)) {
364 				if (!bit)
365 					break;
366 			} else {
367 				if (bit)
368 					break;
369 			}
370 		} while (mi < 0x100);
371 	}
372 	while (mi < 0x100) {
373 		uint16_t *prob_lit = prob + mi;
374 		rc_get_bit(rc, prob_lit, &mi);
375 	}
376 	if (cst->state < 4)
377 		cst->state = 0;
378 	else if (cst->state < 10)
379 		cst->state -= 3;
380 	else
381 		cst->state -= 6;
382 
383 	return write_byte(wr, mi);
384 }
385 
process_bit1(struct writer * wr,struct rc * rc,struct cstate * cst,uint16_t * p,int pos_state,uint16_t * prob)386 static inline int INIT process_bit1(struct writer *wr, struct rc *rc,
387 					    struct cstate *cst, uint16_t *p,
388 					    int pos_state, uint16_t *prob) {
389   int offset;
390 	uint16_t *prob_len;
391 	int num_bits;
392 	int len;
393 
394 	rc_update_bit_1(rc, prob);
395 	prob = p + LZMA_IS_REP + cst->state;
396 	if (rc_is_bit_0(rc, prob)) {
397 		rc_update_bit_0(rc, prob);
398 		cst->rep3 = cst->rep2;
399 		cst->rep2 = cst->rep1;
400 		cst->rep1 = cst->rep0;
401 		cst->state = cst->state < LZMA_NUM_LIT_STATES ? 0 : 3;
402 		prob = p + LZMA_LEN_CODER;
403 	} else {
404 		rc_update_bit_1(rc, prob);
405 		prob = p + LZMA_IS_REP_G0 + cst->state;
406 		if (rc_is_bit_0(rc, prob)) {
407 			rc_update_bit_0(rc, prob);
408 			prob = (p + LZMA_IS_REP_0_LONG
409 				+ (cst->state <<
410 				   LZMA_NUM_POS_BITS_MAX) +
411 				pos_state);
412 			if (rc_is_bit_0(rc, prob)) {
413 				rc_update_bit_0(rc, prob);
414 
415 				cst->state = cst->state < LZMA_NUM_LIT_STATES ?
416 					9 : 11;
417 				return copy_byte(wr, cst->rep0);
418 			} else {
419 				rc_update_bit_1(rc, prob);
420 			}
421 		} else {
422 			uint32_t distance;
423 
424 			rc_update_bit_1(rc, prob);
425 			prob = p + LZMA_IS_REP_G1 + cst->state;
426 			if (rc_is_bit_0(rc, prob)) {
427 				rc_update_bit_0(rc, prob);
428 				distance = cst->rep1;
429 			} else {
430 				rc_update_bit_1(rc, prob);
431 				prob = p + LZMA_IS_REP_G2 + cst->state;
432 				if (rc_is_bit_0(rc, prob)) {
433 					rc_update_bit_0(rc, prob);
434 					distance = cst->rep2;
435 				} else {
436 					rc_update_bit_1(rc, prob);
437 					distance = cst->rep3;
438 					cst->rep3 = cst->rep2;
439 				}
440 				cst->rep2 = cst->rep1;
441 			}
442 			cst->rep1 = cst->rep0;
443 			cst->rep0 = distance;
444 		}
445 		cst->state = cst->state < LZMA_NUM_LIT_STATES ? 8 : 11;
446 		prob = p + LZMA_REP_LEN_CODER;
447 	}
448 
449 	prob_len = prob + LZMA_LEN_CHOICE;
450 	if (rc_is_bit_0(rc, prob_len)) {
451 		rc_update_bit_0(rc, prob_len);
452 		prob_len = (prob + LZMA_LEN_LOW
453 			    + (pos_state <<
454 			       LZMA_LEN_NUM_LOW_BITS));
455 		offset = 0;
456 		num_bits = LZMA_LEN_NUM_LOW_BITS;
457 	} else {
458 		rc_update_bit_1(rc, prob_len);
459 		prob_len = prob + LZMA_LEN_CHOICE_2;
460 		if (rc_is_bit_0(rc, prob_len)) {
461 			rc_update_bit_0(rc, prob_len);
462 			prob_len = (prob + LZMA_LEN_MID
463 				    + (pos_state <<
464 				       LZMA_LEN_NUM_MID_BITS));
465 			offset = 1 << LZMA_LEN_NUM_LOW_BITS;
466 			num_bits = LZMA_LEN_NUM_MID_BITS;
467 		} else {
468 			rc_update_bit_1(rc, prob_len);
469 			prob_len = prob + LZMA_LEN_HIGH;
470 			offset = ((1 << LZMA_LEN_NUM_LOW_BITS)
471 				  + (1 << LZMA_LEN_NUM_MID_BITS));
472 			num_bits = LZMA_LEN_NUM_HIGH_BITS;
473 		}
474 	}
475 
476 	rc_bit_tree_decode(rc, prob_len, num_bits, &len);
477 	len += offset;
478 
479 	if (cst->state < 4) {
480 		int pos_slot;
481 
482 		cst->state += LZMA_NUM_LIT_STATES;
483 		prob =
484 			p + LZMA_POS_SLOT +
485 			((len <
486 			  LZMA_NUM_LEN_TO_POS_STATES ? len :
487 			  LZMA_NUM_LEN_TO_POS_STATES - 1)
488 			 << LZMA_NUM_POS_SLOT_BITS);
489 		rc_bit_tree_decode(rc, prob,
490 				   LZMA_NUM_POS_SLOT_BITS,
491 				   &pos_slot);
492 		if (pos_slot >= LZMA_START_POS_MODEL_INDEX) {
493 			int i, mi;
494 			num_bits = (pos_slot >> 1) - 1;
495 			cst->rep0 = 2 | (pos_slot & 1);
496 			if (pos_slot < LZMA_END_POS_MODEL_INDEX) {
497 				cst->rep0 <<= num_bits;
498 				prob = p + LZMA_SPEC_POS +
499 					cst->rep0 - pos_slot - 1;
500 			} else {
501 				num_bits -= LZMA_NUM_ALIGN_BITS;
502 				while (num_bits--)
503 					cst->rep0 = (cst->rep0 << 1) |
504 						rc_direct_bit(rc);
505 				prob = p + LZMA_ALIGN;
506 				cst->rep0 <<= LZMA_NUM_ALIGN_BITS;
507 				num_bits = LZMA_NUM_ALIGN_BITS;
508 			}
509 			i = 1;
510 			mi = 1;
511 			while (num_bits--) {
512 				if (rc_get_bit(rc, prob + mi, &mi))
513 					cst->rep0 |= i;
514 				i <<= 1;
515 			}
516 		} else
517 			cst->rep0 = pos_slot;
518 		if (++(cst->rep0) == 0)
519 			return 0;
520 		if (cst->rep0 > wr->header->dict_size
521 				|| cst->rep0 > get_pos(wr))
522 			return -1;
523 	}
524 
525 	len += LZMA_MATCH_MIN_LEN;
526 
527 	return copy_bytes(wr, cst->rep0, len);
528 }
529 
530 
531 
unlzma(unsigned char * buf,unsigned int in_len,int (* fill)(void *,unsigned int),int (* flush)(void *,unsigned int),unsigned char * output,unsigned int * posp,void (* error)(const char * x))532 STATIC int INIT unlzma(unsigned char *buf, unsigned int in_len,
533 		       int(*fill)(void*, unsigned int),
534 		       int(*flush)(void*, unsigned int),
535 		       unsigned char *output,
536 		       unsigned int *posp,
537 		       void(*error)(const char *x)
538 	)
539 {
540 	struct lzma_header header;
541 	int lc, pb, lp;
542 	uint32_t pos_state_mask;
543 	uint32_t literal_pos_mask;
544 	uint16_t *p;
545 	int num_probs;
546 	struct rc rc;
547 	int i, mi;
548 	struct writer wr;
549 	struct cstate cst;
550 	unsigned char *inbuf;
551 	int ret = -1;
552 
553 	rc.error = error;
554 
555 	if (buf)
556 		inbuf = buf;
557 	else
558 		inbuf = malloc(LZMA_IOBUF_SIZE);
559 	if (!inbuf) {
560 		error("Could not allocate input buffer");
561 		goto exit_0;
562 	}
563 
564 	cst.state = 0;
565 	cst.rep0 = cst.rep1 = cst.rep2 = cst.rep3 = 1;
566 
567 	wr.header = &header;
568 	wr.flush = flush;
569 	wr.global_pos = 0;
570 	wr.previous_byte = 0;
571 	wr.buffer_pos = 0;
572 
573 	rc_init(&rc, fill, inbuf, in_len);
574 
575 	for (i = 0; i < sizeof(header); i++) {
576 		if (rc.ptr >= rc.buffer_end)
577 			rc_read(&rc);
578 		((unsigned char *)&header)[i] = *rc.ptr++;
579 	}
580 
581 	if (header.pos >= (9 * 5 * 5)) {
582 		error("bad header");
583 		goto exit_1;
584 	}
585 
586 	mi = 0;
587 	lc = header.pos;
588 	while (lc >= 9) {
589 		mi++;
590 		lc -= 9;
591 	}
592 	pb = 0;
593 	lp = mi;
594 	while (lp >= 5) {
595 		pb++;
596 		lp -= 5;
597 	}
598 	pos_state_mask = (1 << pb) - 1;
599 	literal_pos_mask = (1 << lp) - 1;
600 
601 	ENDIAN_CONVERT(header.dict_size);
602 	ENDIAN_CONVERT(header.dst_size);
603 
604 	if (header.dict_size == 0)
605 		header.dict_size = 1;
606 
607 	if (output)
608 		wr.buffer = output;
609 	else {
610 		wr.bufsize = MIN(header.dst_size, header.dict_size);
611 		wr.buffer = large_malloc(wr.bufsize);
612 	}
613 	if (wr.buffer == NULL)
614 		goto exit_1;
615 
616 	num_probs = LZMA_BASE_SIZE + (LZMA_LIT_SIZE << (lc + lp));
617 	p = (uint16_t *) large_malloc(num_probs * sizeof(*p));
618 	if (p == 0)
619 		goto exit_2;
620 	num_probs = LZMA_LITERAL + (LZMA_LIT_SIZE << (lc + lp));
621 	for (i = 0; i < num_probs; i++)
622 		p[i] = (1 << RC_MODEL_TOTAL_BITS) >> 1;
623 
624 	rc_init_code(&rc);
625 
626 	while (get_pos(&wr) < header.dst_size) {
627 		int pos_state =	get_pos(&wr) & pos_state_mask;
628 		uint16_t *prob = p + LZMA_IS_MATCH +
629 			(cst.state << LZMA_NUM_POS_BITS_MAX) + pos_state;
630 		if (rc_is_bit_0(&rc, prob)) {
631 			if (process_bit0(&wr, &rc, &cst, p, pos_state, prob,
632 					lc, literal_pos_mask)) {
633 				error("LZMA data is corrupt");
634 				goto exit_3;
635 			}
636 		} else {
637 			if (process_bit1(&wr, &rc, &cst, p, pos_state, prob)) {
638 				error("LZMA data is corrupt");
639 				goto exit_3;
640 			}
641 			if (cst.rep0 == 0)
642 				break;
643 		}
644 		if (rc.buffer_size <= 0)
645 			goto exit_3;
646 	}
647 
648 	if (posp)
649 		*posp = rc.ptr-rc.buffer;
650 	if (!wr.flush || wr.flush(wr.buffer, wr.buffer_pos) == wr.buffer_pos)
651 		ret = 0;
652 exit_3:
653 	large_free(p);
654 exit_2:
655 	if (!output)
656 		large_free(wr.buffer);
657 exit_1:
658 	if (!buf)
659 		free(inbuf);
660 exit_0:
661 	return ret;
662 }
663