unarch_tar.c

Go to the documentation of this file.

#include "unarch_tar.h"
 
#include <string.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "unarch_tar_internal.h"

static const char* const s_tag_tar = "unarch_tar";
 
/* The streaming ustar/pax/GNU walker is a dense sequential validator (per-block
 * type dispatch, meta-prelude handling, bounded reads): the walk and read
 * bodies clear clang-tidy's statement/nesting/cognitive thresholds while each
 * stays within the 60-line NASA Rule 4 gate. Same disposition as the other
 * decode state machines in the tree (ra8_jpeg_sw_encode, ra8_rmac_phy). */

typedef struct {
  char*    name_buf;  
  uint16_t name_cap;  
  uint16_t name_len;  
  bool     have_path; 
  uint64_t size_ovr;  
  bool     have_size; 
} tar_meta_t;
 
bool unarch_tar_probe(const uint8_t* block, size_t len)
{
  if (block == nullptr) {
    return false;
  }
  if (len < (size_t)k_unarch_tar_block) {
    return false;
  }
  if (!priv_unarch_tar_magic_ok(block)) {
    return false;
  }
  return priv_unarch_tar_checksum_ok(block);
}
 
ra8_err_t unarch_tar_open(unarch_tar_t*              t,
                          unarch_read_fn             read,
                          void*                      ctx,
                          uint64_t                   size,
                          const ra8_decomp_limits_t* limits)
{
  RA8_CHECK_NULL_PTR(t, s_tag_tar, "open: null t");
  *t = (unarch_tar_t){};
  if (read == nullptr) {
    ra8_log_error(s_tag_tar, "open: null read");
    return k_ra8_err_null_ptr;
  }
  if (size < (uint64_t)k_unarch_tar_block) {
    return k_ra8_err_invalid_size;
  }
  const ra8_err_t berr = ra8_decomp_budget_init(&t->budget, limits);
  if (berr != k_ra8_ok) {
    return berr;
  }
  uint8_t      block[k_unarch_tar_block] = {};
  const size_t got                       = read(ctx, 0U, block, sizeof(block));
  if (got != sizeof(block)) {
    return k_ra8_err_invalid_size;
  }
  if (!unarch_tar_probe(block, sizeof(block))) {
    return k_ra8_err_not_supported;
  }
  t->read = read;
  t->ctx  = ctx;
  t->size = size;
  t->live = true;
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_read_block(const unarch_tar_t* t, uint64_t off, uint8_t* block)
{
  const uint64_t need = (uint64_t)k_unarch_tar_block;
  if (off > (t->size - need)) {
    return k_ra8_err_validation_failed; /* partial trailing block */
  }
  const size_t got = t->read(t->ctx, off, block, (size_t)need);
  if ((uint64_t)got != need) {
    return k_ra8_err_validation_failed; /* backing truncated */
  }
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_next_off(uint64_t off, uint64_t dsize, uint64_t* next)
{
  const uint64_t blk = (uint64_t)k_unarch_tar_block;
  if (dsize > (UINT64_MAX - (blk - 1U))) {
    return k_ra8_err_validation_failed; /* rounding would wrap */
  }
  const uint64_t blocks = (dsize + (blk - 1U)) / blk;
  if (blocks > ((UINT64_MAX / blk) - 1U)) {
    return k_ra8_err_validation_failed; /* span would wrap */
  }
  const uint64_t span = (blocks + 1U) * blk;
  if (off > (UINT64_MAX - span)) {
    return k_ra8_err_validation_failed; /* next offset would wrap */
  }
  *next = off + span;
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_meta_consume(const unarch_tar_t* t,
                                       ra8_tar_type_t      type,
                                       uint64_t            doff,
                                       uint64_t            dsize,
                                       tar_meta_t*         meta)
{
  static uint8_t s_tar_meta_scratch[k_unarch_tar_pax_max];
  if (dsize > (uint64_t)k_unarch_tar_pax_max) {
    return k_ra8_err_validation_failed; /* meta flood: reject the member */
  }
  uint8_t* const data = s_tar_meta_scratch;
  const size_t   got  = t->read(t->ctx, doff, data, (size_t)dsize);
  if ((uint64_t)got != dsize) {
    return k_ra8_err_validation_failed; /* backing truncated */
  }
  if (type == k_ra8_tar_type_pax) {
    return priv_unarch_tar_pax_parse(data,
                                     (size_t)dsize,
                                     meta->name_buf,
                                     meta->name_cap,
                                     &meta->name_len,
                                     &meta->have_path,
                                     &meta->size_ovr,
                                     &meta->have_size);
  }
  /* GNU longname: the data is the member name, usually NUL-padded. */
  size_t nlen = (size_t)dsize;
  while (nlen > 0U) { /* bound: dsize */
    if (data[nlen - 1U] != 0U) {
      break;
    }
    nlen -= 1U;
  }
  const size_t want = (nlen > (size_t)meta->name_cap) ? (size_t)meta->name_cap : nlen;
  if (want > 0U) {
    (void)memcpy(meta->name_buf, data, want);
  }
  meta->name_len  = (uint16_t)want;
  meta->have_path = true;
  return k_ra8_ok;
}

RA8_INTERNAL
static size_t internal_field_length(const uint8_t* block, uint32_t offset, uint32_t capacity)
{
  size_t length = 0U;
  while ((length < (size_t)capacity) && (block[offset + length] != 0U)) {
    length++;
  }
  return length;
}

RA8_INTERNAL
static void internal_ustar_name(const uint8_t* block, tar_meta_t* meta)
{
  const size_t n_len =
    internal_field_length(block, (uint32_t)k_ra8_tar_off_name, (uint32_t)k_ra8_tar_len_name);
  const size_t p_len =
    internal_field_length(block, (uint32_t)k_ra8_tar_off_prefix, (uint32_t)k_ra8_tar_len_prefix);
  size_t used = 0U;
  if (p_len > 0U) {
    const size_t pw = (p_len > (size_t)meta->name_cap) ? (size_t)meta->name_cap : p_len;
    if (pw > 0U) {
      (void)memcpy(meta->name_buf, &block[k_ra8_tar_off_prefix], pw);
    }
    used = pw;
    if (used < (size_t)meta->name_cap) {
      meta->name_buf[used] = '/';
      used += 1U;
    }
  }
  const size_t room = (size_t)meta->name_cap - used;
  const size_t nw   = (n_len > room) ? room : n_len;
  if (nw > 0U) {
    (void)memcpy(&meta->name_buf[used], &block[k_ra8_tar_off_name], nw);
  }
  meta->name_len = (uint16_t)(used + nw);
}

RA8_INTERNAL
static ra8_err_t internal_decode_header(const uint8_t*  block,
                                        uint64_t        off,
                                        ra8_tar_type_t* type,
                                        uint64_t*       dsize,
                                        uint64_t*       next)
{
  if (!priv_unarch_tar_checksum_ok(block)) {
    return k_ra8_err_validation_failed;
  }
  if (!priv_unarch_tar_magic_ok(block)) {
    return k_ra8_err_validation_failed;
  }
  const ra8_err_t serr =
    priv_unarch_tar_num(&block[k_ra8_tar_off_size], (size_t)k_ra8_tar_len_size, dsize);
  if (serr != k_ra8_ok) {
    return serr;
  }
  *type = priv_unarch_tar_classify(block[k_ra8_tar_off_type]);
  return internal_next_off(off, *dsize, next);
}

RA8_INTERNAL
static ra8_err_t internal_finish_member(unarch_tar_t*       t,
                                        const uint8_t*      block,
                                        uint64_t            off,
                                        ra8_tar_type_t      type,
                                        uint64_t            dsize,
                                        tar_meta_t*         meta,
                                        unarch_tar_entry_t* out)
{
  uint64_t msize = dsize;
  if (meta->have_size) {
    msize = meta->size_ovr; /* pax size record overrides the header field */
  }
  uint64_t        next = 0U;
  const ra8_err_t aerr = internal_next_off(off, msize, &next);
  if (aerr != k_ra8_ok) {
    return aerr;
  }
  const uint64_t doff = off + (uint64_t)k_unarch_tar_block;
  if (msize > (t->size - doff)) {
    return k_ra8_err_validation_failed; /* lying size: data overruns archive */
  }
  const ra8_err_t derr = ra8_decomp_check_declared(&t->budget.limits, msize, msize);
  if (derr != k_ra8_ok) {
    return derr;
  }
  const ra8_err_t eerr = ra8_decomp_budget_charge_entry(&t->budget);
  if (eerr != k_ra8_ok) {
    return eerr;
  }
  if (!meta->have_path) {
    internal_ustar_name(block, meta);
  }
  out->data_off = doff;
  out->size     = msize;
  out->next_off = next;
  out->name_len = meta->name_len;
  out->is_file  = (type == k_ra8_tar_type_file) ? 1U : 0U;
  out->is_dir   = (type == k_ra8_tar_type_dir) ? 1U : 0U;
  return k_ra8_ok;
}
// NOLINTNEXTLINE(readability-function-size,readability-function-cognitive-complexity) -- one ustar header record is parsed field-by-field in declaration order; splitting it would scatter the bounds checks away from the fields they guard.
ra8_err_t unarch_tar_next(unarch_tar_t*       t,
                          uint64_t            off,
                          char*               name_buf,
                          uint16_t            name_cap,
                          unarch_tar_entry_t* out)
{
  RA8_CHECK_NULL_PTR(t, s_tag_tar, "next: null t");
  RA8_CHECK_NULL_PTR(out, s_tag_tar, "next: null out");
  *out = (unarch_tar_entry_t){};
  if (!t->live) {
    return k_ra8_err_invalid_state;
  }
  if (name_cap > 0U) {
    RA8_CHECK_NULL_PTR(name_buf, s_tag_tar, "next: null name_buf");
  }
  tar_meta_t meta = {.name_buf = name_buf, .name_cap = name_cap};
  uint64_t   cur  = off;
  for (uint32_t m = 0U; m <= (uint32_t)k_unarch_tar_meta_max; ++m) { /* bound: meta cap */
    const ra8_err_t ierr = ra8_decomp_budget_charge_iter(&t->budget);
    if (ierr != k_ra8_ok) {
      return ierr;
    }
    if (cur >= t->size) {
      return k_ra8_err_not_found; /* clean EOF without an end marker */
    }
    uint8_t         block[k_unarch_tar_block] = {};
    const ra8_err_t rerr                      = internal_read_block(t, cur, block);
    if (rerr != k_ra8_ok) {
      return rerr;
    }
    if (priv_unarch_tar_block_zero(block)) {
      return k_ra8_err_not_found; /* end-of-archive marker */
    }
    ra8_tar_type_t  type  = k_ra8_tar_type_other;
    uint64_t        dsize = 0U;
    uint64_t        next  = 0U;
    const ra8_err_t herr  = internal_decode_header(block, cur, &type, &dsize, &next);
    if (herr != k_ra8_ok) {
      return herr;
    }
    if ((type == k_ra8_tar_type_pax) || (type == k_ra8_tar_type_longname)) {
      const uint64_t doff = cur + (uint64_t)k_unarch_tar_block;
      if (dsize > (t->size - doff)) {
        return k_ra8_err_validation_failed; /* meta data overruns archive */
      }
      const ra8_err_t merr = internal_meta_consume(t, type, doff, dsize, &meta);
      if (merr != k_ra8_ok) {
        return merr;
      }
      cur = next;
      continue;
    }
    if (type == k_ra8_tar_type_meta) {
      cur = next; /* skipped meta ('g' global, 'K' longlink) */
      continue;
    }
    const ra8_err_t ferr = internal_finish_member(t, block, cur, type, dsize, &meta, out);
    if (ferr != k_ra8_ok) {
      *out = (unarch_tar_entry_t){};
      return ferr;
    }
    return k_ra8_ok;
  }
  return k_ra8_err_validation_failed; /* meta prelude longer than the cap */
}
 
// NOLINTNEXTLINE(readability-function-size) -- contract macros expand the linear read body.
ra8_err_t unarch_tar_read(const unarch_tar_t*       t,
                          const unarch_tar_entry_t* ent,
                          uint8_t*                  buf,
                          size_t                    cap,
                          size_t*                   got)
{
  RA8_CHECK_NULL_PTR(t, s_tag_tar, "read: null t");
  RA8_CHECK_NULL_PTR(ent, s_tag_tar, "read: null ent");
  RA8_CHECK_NULL_PTR(buf, s_tag_tar, "read: null buf");
  RA8_CHECK_NULL_PTR(got, s_tag_tar, "read: null got");
  *got = 0U;
  if (!t->live) {
    return k_ra8_err_invalid_state;
  }
  if (ent->is_file == 0U) {
    return k_ra8_err_not_supported;
  }
  if ((uint64_t)cap < ent->size) {
    return k_ra8_err_no_mem;
  }
  if (ent->data_off > t->size) {
    return k_ra8_err_invalid_size; /* forged entry: data area outside archive */
  }
  if (ent->size > (t->size - ent->data_off)) {
    return k_ra8_err_invalid_size; /* forged entry: data area overruns archive */
  }
  if (ent->size == 0U) {
    return k_ra8_ok; /* empty member: nothing to fetch */
  }
  const size_t n = t->read(t->ctx, ent->data_off, buf, (size_t)ent->size);
  if ((uint64_t)n != ent->size) {
    return k_ra8_err_invalid_size; /* backing truncated */
  }
  *got = n;
  return k_ra8_ok;
}