unarch_gzip.c

Go to the documentation of this file.

#include "unarch_gzip.h"
 
#include <string.h>
 
#include "miniz.h"
#include "ra8_attributes.h"
#include "ra8_check.h"
 
/* The gzip member + windowed-inflate state machines are dense sequential
 * validators: many fail-closed guards and a bounded refill loop push several
 * bodies past clang-tidy's statement/nesting/cognitive thresholds while each
 * stays within the 60-line NASA Rule 4 gate. Same disposition as the other
 * decode state machines in the tree (ra8_jpeg_sw_encode, ra8_rmac_phy). */

typedef enum : uint32_t {
  k_gz_id1          = 0x1FU,       
  k_gz_id2          = 0x8BU,       
  k_gz_cm_deflate   = 8U,          
  k_gz_flg_fhcrc    = 0x02U,       
  k_gz_flg_fextra   = 0x04U,       
  k_gz_flg_fname    = 0x08U,       
  k_gz_flg_fcomment = 0x10U,       
  k_gz_flg_reserved = 0xE0U,       
  k_gz_hdr_fixed    = 10U,         
  k_gz_xlen_bytes   = 2U,          
  k_gz_fhcrc_bytes  = 2U,          
  k_gz_trailer_len  = 8U,          
  k_gz_idx_id1      = 0U,          
  k_gz_idx_id2      = 1U,          
  k_gz_idx_cm       = 2U,          
  k_gz_idx_flg      = 3U,          
  k_gz_in_chunk     = 512U,        
  k_gz_out_window   = 4096U,       
  k_gz_shift_byte   = 8U,          
  k_gz_crc16_mask   = 0xFFFFU,     
  k_gz_isize_mask   = 0xFFFFFFFFU, 
} gz_grammar_t;

typedef struct {
  unarch_read_fn read;      
  void*          ctx;       
  uint64_t       size;      
  uint64_t       pos;       
  uint32_t       crc;       
  bool           track_crc; 
} gz_src_t;

static tinfl_decompressor s_gz_inflator;

RA8_INTERNAL
static ra8_err_t internal_src_take(gz_src_t* s, uint8_t* dst, size_t n)
{
  if ((uint64_t)n > (s->size - s->pos)) {
    return k_ra8_err_validation_failed; /* runs past the member end */
  }
  const size_t got = s->read(s->ctx, s->pos, dst, n);
  if (got != n) {
    return k_ra8_err_validation_failed; /* backing truncated */
  }
  if (s->track_crc) {
    s->crc = (uint32_t)mz_crc32(s->crc, dst, n);
  }
  s->pos += (uint64_t)n;
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_skip_string(gz_src_t* s)
{
  for (uint32_t i = 0U; i < (uint32_t)k_unarch_gzip_str_max; ++i) { /* bound: string cap */
    uint8_t         b    = 0U;
    const ra8_err_t terr = internal_src_take(s, &b, 1U);
    if (terr != k_ra8_ok) {
      return terr;
    }
    if (b == 0U) {
      return k_ra8_ok;
    }
  }
  return k_ra8_err_validation_failed; /* string exceeds the fail-closed cap */
}

RA8_INTERNAL
static ra8_err_t internal_skip_fextra(gz_src_t* s)
{
  uint8_t         xl[k_gz_xlen_bytes] = {};
  const ra8_err_t xerr                = internal_src_take(s, xl, sizeof(xl));
  if (xerr != k_ra8_ok) {
    return xerr;
  }
  uint32_t xlen = (uint32_t)xl[0] | ((uint32_t)xl[1] << (uint32_t)k_gz_shift_byte);
  uint8_t  skip[k_gz_in_chunk];
  while (xlen > 0U) { /* bound: xlen <= 65535, consumed in chunks */
    const size_t    n    = (xlen > (uint32_t)sizeof(skip)) ? sizeof(skip) : (size_t)xlen;
    const ra8_err_t serr = internal_src_take(s, skip, n);
    if (serr != k_ra8_ok) {
      return serr;
    }
    xlen -= (uint32_t)n;
  }
  return k_ra8_ok;
}

RA8_INTERNAL
// NOLINTNEXTLINE(readability-function-size) -- wire-order guards keep cursor and header CRC mutations auditable.
static ra8_err_t internal_parse_header(gz_src_t* s)
{
  uint8_t         fixed[k_gz_hdr_fixed] = {};
  const ra8_err_t ferr                  = internal_src_take(s, fixed, sizeof(fixed));
  if (ferr != k_ra8_ok) {
    return ferr;
  }
  if (fixed[k_gz_idx_id1] != (uint8_t)k_gz_id1) {
    return k_ra8_err_not_supported;
  }
  if (fixed[k_gz_idx_id2] != (uint8_t)k_gz_id2) {
    return k_ra8_err_not_supported;
  }
  if (fixed[k_gz_idx_cm] != (uint8_t)k_gz_cm_deflate) {
    return k_ra8_err_not_supported; /* only DEFLATE is defined */
  }
  const uint8_t flg = fixed[k_gz_idx_flg];
  if ((flg & (uint8_t)k_gz_flg_reserved) != 0U) {
    return k_ra8_err_not_supported; /* reserved bits: unknown format */
  }
  if ((flg & (uint8_t)k_gz_flg_fextra) != 0U) {
    const ra8_err_t xerr = internal_skip_fextra(s);
    if (xerr != k_ra8_ok) {
      return xerr;
    }
  }
  if ((flg & (uint8_t)k_gz_flg_fname) != 0U) {
    const ra8_err_t nerr = internal_skip_string(s);
    if (nerr != k_ra8_ok) {
      return nerr;
    }
  }
  if ((flg & (uint8_t)k_gz_flg_fcomment) != 0U) {
    const ra8_err_t cerr = internal_skip_string(s);
    if (cerr != k_ra8_ok) {
      return cerr;
    }
  }
  if ((flg & (uint8_t)k_gz_flg_fhcrc) != 0U) {
    const uint32_t  want                 = s->crc & (uint32_t)k_gz_crc16_mask;
    uint8_t         hc[k_gz_fhcrc_bytes] = {};
    const ra8_err_t herr                 = internal_src_take(s, hc, sizeof(hc));
    if (herr != k_ra8_ok) {
      return herr;
    }
    const uint32_t stored = (uint32_t)hc[0] | ((uint32_t)hc[1] << (uint32_t)k_gz_shift_byte);
    if (stored != want) {
      return k_ra8_err_checksum_mismatch;
    }
  }
  s->track_crc = false; /* header ends here; the payload CRC is separate */
  return k_ra8_ok;
}

typedef struct {
  gz_src_t*           src;                
  uint8_t*            out;                
  size_t              out_cap;            
  size_t              total;              
  uint32_t            crc;                
  ra8_decomp_budget_t budget;             
  uint8_t             win[k_gz_in_chunk]; 
  size_t              win_len;            
  size_t              win_ofs;            
  bool                done;               
} gz_inflate_t;

RA8_INTERNAL
// NOLINTNEXTLINE(readability-function-size) -- atomic miniz cursor and budget transaction.
static ra8_err_t internal_inflate_pass(gz_inflate_t* st)
{
  const ra8_err_t ierr = ra8_decomp_budget_charge_iter(&st->budget);
  if (ierr != k_ra8_ok) {
    return ierr;
  }
  if (st->win_ofs == st->win_len) {
    const uint64_t remain = st->src->size - st->src->pos;
    const size_t   want   = (remain > (uint64_t)sizeof(st->win)) ? sizeof(st->win) : (size_t)remain;
    if (want == 0U) {
      return k_ra8_err_validation_failed; /* input exhausted mid-stream */
    }
    const ra8_err_t rerr = internal_src_take(st->src, st->win, want);
    if (rerr != k_ra8_ok) {
      return rerr;
    }
    st->win_len = want;
    st->win_ofs = 0U;
  }
  const bool      more_input = (st->src->pos < st->src->size);
  size_t          in_bytes   = st->win_len - st->win_ofs;
  const size_t    space      = st->out_cap - st->total;
  size_t          out_bytes  = (space > (size_t)k_gz_out_window) ? (size_t)k_gz_out_window : space;
  const mz_uint32 flags      = (mz_uint32)TINFL_FLAG_USING_NON_WRAPPING_OUTPUT_BUF |
                               (more_input ? (mz_uint32)TINFL_FLAG_HAS_MORE_INPUT : 0U);
  const tinfl_status ts      = tinfl_decompress(&s_gz_inflator,
                                                &st->win[st->win_ofs],
                                                &in_bytes,
                                                st->out,
                                                &st->out[st->total],
                                                &out_bytes,
                                                flags);
  st->win_ofs += in_bytes;
  if (out_bytes > 0U) {
    st->crc = (uint32_t)mz_crc32(st->crc, &st->out[st->total], out_bytes);
  }
  st->total += out_bytes;
  const ra8_err_t oerr =
    ra8_decomp_budget_charge_output(&st->budget, st->src->pos, (uint64_t)out_bytes);
  if (oerr != k_ra8_ok) {
    return oerr;
  }
  if (ts == TINFL_STATUS_DONE) {
    st->done = true;
    return k_ra8_ok;
  }
  if (ts == TINFL_STATUS_NEEDS_MORE_INPUT) {
    return k_ra8_ok; /* the next pass refills */
  }
  if (ts == TINFL_STATUS_HAS_MORE_OUTPUT) {
    if (st->total == st->out_cap) {
      return k_ra8_err_no_mem; /* arena full with the stream still open */
    }
    return k_ra8_ok; /* output window filled; the next pass continues */
  }
  return k_ra8_err_validation_failed; /* corrupt DEFLATE stream */
}

RA8_INTERNAL
static ra8_err_t internal_verify_trailer(const gz_inflate_t* st)
{
  const uint64_t leftover    = (uint64_t)(st->win_len - st->win_ofs);
  const uint64_t trailer_pos = st->src->pos - leftover;
  const uint64_t remain      = st->src->size - trailer_pos;
  if (remain < (uint64_t)k_gz_trailer_len) {
    return k_ra8_err_validation_failed; /* truncated trailer */
  }
  if (remain > (uint64_t)k_gz_trailer_len) {
    return k_ra8_err_validation_failed; /* trailing bytes: no concatenation */
  }
  uint8_t      tr[k_gz_trailer_len] = {};
  const size_t got                  = st->src->read(st->src->ctx, trailer_pos, tr, sizeof(tr));
  if (got != sizeof(tr)) {
    return k_ra8_err_validation_failed; /* backing truncated */
  }
  uint32_t crc_stored   = 0U;
  uint32_t isize_stored = 0U;
  for (uint32_t i = 0U; i < 4U; ++i) { /* bound: fixed field width */
    crc_stored |= (uint32_t)tr[i] << ((uint32_t)k_gz_shift_byte * i);
    isize_stored |= (uint32_t)tr[i + 4U] << ((uint32_t)k_gz_shift_byte * i);
  }
  if (crc_stored != st->crc) {
    return k_ra8_err_checksum_mismatch;
  }
  if (isize_stored != ((uint32_t)st->total & (uint32_t)k_gz_isize_mask)) {
    return k_ra8_err_checksum_mismatch;
  }
  return k_ra8_ok;
}
 
bool unarch_gzip_magic(const uint8_t* sig, size_t sig_len)
{
  if (sig == nullptr) {
    return false;
  }
  if (sig_len < (size_t)k_unarch_gzip_sig_len) {
    return false;
  }
  if (sig[k_gz_idx_id1] != (uint8_t)k_gz_id1) {
    return false;
  }
  return sig[k_gz_idx_id2] == (uint8_t)k_gz_id2;
}
 
// NOLINTNEXTLINE(readability-function-size) -- fail-closed member transaction.
ra8_err_t unarch_gzip_unwrap(unarch_read_fn             read,
                             void*                      ctx,
                             uint64_t                   size,
                             uint8_t*                   out,
                             size_t                     out_cap,
                             const ra8_decomp_limits_t* limits,
                             size_t*                    out_len)
{
  static const char* const tag = "unarch_gzip";
  if (read == nullptr) {
    ra8_log_error(tag, "unwrap: null read");
    return k_ra8_err_null_ptr;
  }
  RA8_CHECK_NULL_PTR(out, tag, "unwrap: null out");
  RA8_CHECK_NULL_PTR(out_len, tag, "unwrap: null out_len");
  *out_len = 0U;
  if (size == 0U) {
    return k_ra8_err_invalid_size;
  }
  if (out_cap == 0U) {
    return k_ra8_err_invalid_size;
  }
  gz_src_t src = {
    .read      = read,
    .ctx       = ctx,
    .size      = size,
    .pos       = 0U,
    .crc       = (uint32_t)MZ_CRC32_INIT,
    .track_crc = true,
  };
  const ra8_err_t herr = internal_parse_header(&src);
  if (herr != k_ra8_ok) {
    return herr;
  }
  gz_inflate_t st      = {};
  st.src               = &src;
  st.out               = out;
  st.out_cap           = out_cap;
  st.crc               = (uint32_t)MZ_CRC32_INIT;
  const ra8_err_t berr = ra8_decomp_budget_init(&st.budget, limits);
  if (berr != k_ra8_ok) {
    return berr;
  }
  tinfl_init(&s_gz_inflator);
  while (!st.done) { /* bound: every pass charges the policy iteration budget */
    const ra8_err_t perr = internal_inflate_pass(&st);
    if (perr != k_ra8_ok) {
      return perr;
    }
  }
  const ra8_err_t terr = internal_verify_trailer(&st);
  if (terr != k_ra8_ok) {
    return terr;
  }
  *out_len = st.total;
  return k_ra8_ok;
}