unarch_xz.c

Go to the documentation of this file.

#include "unarch_xz.h"
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "unarch_xz_pool.h"
#include "xz_config.h"

static const char* const s_tag_xz = "unarch_xz";
 
/* The XZ session driver pumps the vendored xz-embedded stream decoder through a
 * bounded refill/flush loop with fail-closed guards on every return code: the
 * run and unwrap bodies clear clang-tidy's statement/nesting/cognitive
 * thresholds while staying within the 60-line NASA Rule 4 gate. Same
 * disposition as the other decode state machines (ra8_jpeg_sw_encode). */

typedef enum : uint16_t {
  k_xz_chunk      = 512U,  
  k_xz_out_window = 4096U, 
} xz_wrap_dims_t;

typedef enum : uint8_t {
  k_xz_magic_b0 = 0xFDU, 
  k_xz_magic_b1 = 0x37U, 
  k_xz_magic_b2 = 0x7AU, 
  k_xz_magic_b3 = 0x58U, 
  k_xz_magic_b4 = 0x5AU, 
  k_xz_magic_b5 = 0x00U, 
} xz_magic_t;
 
bool unarch_xz_magic(const uint8_t* sig, size_t sig_len)
{
  if (sig == nullptr) {
    return false;
  }
  if (sig_len < (size_t)k_unarch_xz_sig_len) {
    return false;
  }
  const uint8_t want[k_unarch_xz_sig_len] = {
    (uint8_t)k_xz_magic_b0,
    (uint8_t)k_xz_magic_b1,
    (uint8_t)k_xz_magic_b2,
    (uint8_t)k_xz_magic_b3,
    (uint8_t)k_xz_magic_b4,
    (uint8_t)k_xz_magic_b5,
  };
  return memeq(sig, want, sizeof(want));
}
 
ra8_err_t unarch_xz_stream_begin(unarch_xz_stream_t* xs, void* scratch, uint32_t scratch_len)
{
  RA8_CHECK_NULL_PTR(xs, s_tag_xz, "begin: null session");
  *xs = (unarch_xz_stream_t){};
  RA8_CHECK_NULL_PTR(scratch, s_tag_xz, "begin: null scratch");
  if (scratch_len <= (uint32_t)k_unarch_xz_state_reserve) {
    return k_ra8_err_invalid_size;
  }
  const ra8_err_t perr = unarch_xz_pool_install(scratch, scratch_len);
  if (perr != k_ra8_ok) {
    return perr;
  }
  /* The CRC lookup tables must exist before any other xz_* call; both
   * initialisers are idempotent, so calling per-session is safe. */
  xz_crc32_init();
  xz_crc64_init();
  const uint32_t dict_max = scratch_len - (uint32_t)k_unarch_xz_state_reserve;
  xs->dec                 = xz_dec_init(XZ_PREALLOC, dict_max);
  if (xs->dec == nullptr) {
    unarch_xz_pool_reset();
    return k_ra8_err_no_mem;
  }
  xs->live = true;
  return k_ra8_ok;
}

RA8_INTERNAL
static ra8_err_t internal_xz_map_err(enum xz_ret ret)
{
  if (ret == XZ_MEMLIMIT_ERROR) {
    return k_ra8_err_no_mem;
  }
  if (ret == XZ_FORMAT_ERROR) {
    return k_ra8_err_not_supported;
  }
  if (ret == XZ_OPTIONS_ERROR) {
    return k_ra8_err_not_supported;
  }
  if (ret == XZ_DATA_ERROR) {
    return k_ra8_err_validation_failed;
  }
  if (ret == XZ_BUF_ERROR) {
    return k_ra8_err_validation_failed;
  }
  return k_ra8_err_validation_failed; /* GCOVR_EXCL_LINE -- XZ_MEM_ERROR /
                                       * XZ_UNSUPPORTED_CHECK are impossible in
                                       * this XZ_PREALLOC, no-ANY_CHECK build */
}
// NOLINTNEXTLINE(readability-function-size) -- atomic decoder cursor transaction.
ra8_err_t unarch_xz_stream_run(unarch_xz_stream_t* xs,
                               const uint8_t*      in,
                               size_t              in_len,
                               size_t*             in_used,
                               uint8_t*            out,
                               size_t              out_cap,
                               size_t*             out_used,
                               bool*               end)
{
  RA8_CHECK_NULL_PTR(xs, s_tag_xz, "run: null session");
  RA8_CHECK_NULL_PTR(in_used, s_tag_xz, "run: null in_used");
  RA8_CHECK_NULL_PTR(out, s_tag_xz, "run: null out");
  RA8_CHECK_NULL_PTR(out_used, s_tag_xz, "run: null out_used");
  RA8_CHECK_NULL_PTR(end, s_tag_xz, "run: null end");
  *in_used  = 0U;
  *out_used = 0U;
  *end      = false;
  if (in_len > 0U) {
    RA8_CHECK_NULL_PTR(in, s_tag_xz, "run: null in with input");
  }
  if (!xs->live) {
    return k_ra8_err_invalid_state;
  }
  struct xz_buf b = {
    .in       = in,
    .in_pos   = 0U,
    .in_size  = in_len,
    .out      = out,
    .out_pos  = 0U,
    .out_size = out_cap,
  };
  const enum xz_ret ret = xz_dec_run(xs->dec, &b);
  *in_used              = b.in_pos;
  *out_used             = b.out_pos;
  if (ret == XZ_STREAM_END) {
    *end = true;
    return k_ra8_ok;
  }
  if (ret == XZ_OK) {
    return k_ra8_ok;
  }
  return internal_xz_map_err(ret);
}
 
void unarch_xz_stream_end(unarch_xz_stream_t* xs)
{
  if (xs == nullptr) {
    return; /* teardown paths call unconditionally */
  }
  if (!xs->live) {
    return; /* never begun (or already ended): nothing to release */
  }
  xz_dec_end(xs->dec); /* frees are no-ops; the pool reset reclaims all */
  unarch_xz_pool_reset();
  xs->dec  = nullptr;
  xs->live = false;
}

RA8_INTERNAL
static ra8_err_t internal_unwrap_reject_null(unarch_read_fn read,
                                             const uint8_t* out,
                                             const void*    scratch,
                                             const size_t*  out_len)
{
  if (read == nullptr) {
    ra8_log_error(s_tag_xz, "unwrap: null read");
    return k_ra8_err_null_ptr;
  }
  RA8_CHECK_NULL_PTR(out, s_tag_xz, "unwrap: null out");
  RA8_CHECK_NULL_PTR(scratch, s_tag_xz, "unwrap: null scratch");
  RA8_CHECK_NULL_PTR(out_len, s_tag_xz, "unwrap: null out_len");
  return k_ra8_ok;
}

typedef struct {
  unarch_read_fn      read;              
  void*               ctx;               
  uint64_t            size;              
  uint8_t*            out;               
  size_t              out_cap;           
  uint64_t            in_off;            
  size_t              total_out;         
  unarch_xz_stream_t  xs;                
  ra8_decomp_budget_t budget;            
  uint8_t             chunk[k_xz_chunk]; 
} xz_unwrap_state_t;

RA8_INTERNAL
static ra8_err_t internal_unwrap_pass(xz_unwrap_state_t* st, bool* end)
{
  const ra8_err_t ierr = ra8_decomp_budget_charge_iter(&st->budget);
  if (ierr != k_ra8_ok) {
    return ierr;
  }
  const uint64_t remain = st->size - st->in_off;
  const size_t   want   = (remain > (uint64_t)k_xz_chunk) ? (size_t)k_xz_chunk : (size_t)remain;
  size_t         got    = 0U;
  if (want > 0U) {
    got = st->read(st->ctx, st->in_off, st->chunk, want);
  }
  if (got > want) {
    got = want; /* clamp a misbehaving backing to the request */
  }
  if (got == 0U) {
    return k_ra8_err_validation_failed; /* backing truncated under the stream */
  }
  const size_t    space    = st->out_cap - st->total_out;
  const size_t    owin     = (space > (size_t)k_xz_out_window) ? (size_t)k_xz_out_window : space;
  size_t          used     = 0U;
  size_t          produced = 0U;
  const ra8_err_t rerr     = unarch_xz_stream_run(&st->xs,
                                                  st->chunk,
                                                  got,
                                                  &used,
                                                  &st->out[st->total_out],
                                                  owin,
                                                  &produced,
                                                  end);
  st->in_off += (uint64_t)used;
  st->total_out += produced;
  if (rerr != k_ra8_ok) {
    if (rerr == k_ra8_err_validation_failed) {
      if (st->total_out == st->out_cap) {
        return k_ra8_err_no_mem; /* stuck only because the arena is full */
      }
    }
    return rerr;
  }
  return ra8_decomp_budget_charge_output(&st->budget, st->in_off, (uint64_t)produced);
}
 
// NOLINTNEXTLINE(readability-function-size) -- contract macros expand the bounded decode driver.
ra8_err_t unarch_xz_unwrap(unarch_read_fn             read,
                           void*                      ctx,
                           uint64_t                   size,
                           uint8_t*                   out,
                           size_t                     out_cap,
                           void*                      scratch,
                           uint32_t                   scratch_len,
                           const ra8_decomp_limits_t* limits,
                           size_t*                    out_len)
{
  const ra8_err_t nerr = internal_unwrap_reject_null(read, out, scratch, out_len);
  if (nerr != k_ra8_ok) {
    return nerr;
  }
  *out_len = 0U;
  if (size == 0U) {
    return k_ra8_err_invalid_size;
  }
  if (out_cap == 0U) {
    return k_ra8_err_invalid_size;
  }
  xz_unwrap_state_t st = {};
  st.read              = read;
  st.ctx               = ctx;
  st.size              = size;
  st.out               = out;
  st.out_cap           = out_cap;
  const ra8_err_t berr = ra8_decomp_budget_init(&st.budget, limits);
  if (berr != k_ra8_ok) {
    return berr;
  }
  const ra8_err_t serr = unarch_xz_stream_begin(&st.xs, scratch, scratch_len);
  if (serr != k_ra8_ok) {
    return serr;
  }
  bool      end  = false;
  ra8_err_t perr = k_ra8_ok;
  while (!end) { /* bound: every pass charges the policy iteration budget */
    perr = internal_unwrap_pass(&st, &end);
    if (perr != k_ra8_ok) {
      break;
    }
  }
  unarch_xz_stream_end(&st.xs);
  if (perr != k_ra8_ok) {
    return perr;
  }
  if (st.in_off < size) {
    return k_ra8_err_validation_failed; /* trailing bytes after the footer */
  }
  *out_len = st.total_out;
  return k_ra8_ok;
}