libclamav/mspack/mszipd.c
dc2e0dc7
 /* This file is part of libmspack.
  * (C) 2003-2004 Stuart Caie.
  *
  * The deflate method was created by Phil Katz. MSZIP is equivalent to the
  * deflate method.
  *
  * libmspack is free software; you can redistribute it and/or modify it under
  * the terms of the GNU Lesser General Public License (LGPL) version 2.1
  *
  * For further details, see the file COPYING.LIB distributed with libmspack
  */
 
 /* MS-ZIP decompression implementation. */
 
 #if HAVE_CONFIG_H
 #include "clamav-config.h"
 #endif
 
 #include <mspack.h>
 #include <system.h>
 #include <mszip.h>
 
7f7736bb
 #include "others.h"
 
dc2e0dc7
 /* match lengths for literal codes 257.. 285 */
 static const unsigned short lit_lengths[29] = {
   3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27,
   31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258
 };
 
 /* match offsets for distance codes 0 .. 29 */
 static const unsigned short dist_offsets[30] = {
   1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385,
   513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577
 };
 
 /* extra bits required for literal codes 257.. 285 */
 static const unsigned char lit_extrabits[29] = {
   0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2,
   2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0
 };
 
 /* extra bits required for distance codes 0 .. 29 */
 static const unsigned char dist_extrabits[30] = {
   0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6,
   6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13
 };
 
 /* the order of the bit length Huffman code lengths */
 static const unsigned char bitlen_order[19] = {
   16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15
 };
 
 /* ANDing with bit_mask[n] masks the lower n bits */
 static const unsigned short bit_mask[17] = {
  0x0000, 0x0001, 0x0003, 0x0007, 0x000f, 0x001f, 0x003f, 0x007f, 0x00ff,
  0x01ff, 0x03ff, 0x07ff, 0x0fff, 0x1fff, 0x3fff, 0x7fff, 0xffff
 };
 
 #define STORE_BITS do {                                                 \
   zip->i_ptr      = i_ptr;                                              \
   zip->i_end      = i_end;                                              \
   zip->bit_buffer = bit_buffer;                                         \
   zip->bits_left  = bits_left;                                          \
 } while (0)
 
 #define RESTORE_BITS do {                                               \
   i_ptr      = zip->i_ptr;                                              \
   i_end      = zip->i_end;                                              \
   bit_buffer = zip->bit_buffer;                                         \
   bits_left  = zip->bits_left;                                          \
 } while (0)
 
 #define ENSURE_BITS(nbits) do {                                         \
   while (bits_left < (nbits)) {                                         \
     if (i_ptr >= i_end) {                                               \
       if (zipd_read_input(zip)) return zip->error;                      \
       i_ptr = zip->i_ptr;                                               \
       i_end = zip->i_end;                                               \
     }                                                                   \
     bit_buffer |= *i_ptr++ << bits_left; bits_left  += 8;               \
   }                                                                     \
 } while (0)
 
 #define PEEK_BITS(nbits)   (bit_buffer & ((1<<(nbits))-1))
 #define PEEK_BITS_T(nbits) (bit_buffer & bit_mask[(nbits)])
 
 #define REMOVE_BITS(nbits) ((bit_buffer >>= (nbits)), (bits_left -= (nbits)))
 
 #define READ_BITS(val, nbits) do {                                      \
   ENSURE_BITS(nbits); (val) = PEEK_BITS(nbits); REMOVE_BITS(nbits);     \
 } while (0)
 
 #define READ_BITS_T(val, nbits) do {                                    \
   ENSURE_BITS(nbits); (val) = PEEK_BITS_T(nbits); REMOVE_BITS(nbits);   \
 } while (0)
 
 static int zipd_read_input(struct mszipd_stream *zip) {
   int read = zip->sys->read(zip->input, &zip->inbuf[0], (int)zip->inbuf_size);
fb0a4425
   if (read < 0) return zip->error = MSPACK_ERR_READ;
 
   if (read == 0) {
     if (zip->input_end) {
       D(("out of input bytes"))
       return zip->error = MSPACK_ERR_READ;
     }
     else {
       read = 1;
       zip->inbuf[0] = 0;
       zip->input_end = 1;
     }
   }
 
dc2e0dc7
   zip->i_ptr = &zip->inbuf[0];
   zip->i_end = &zip->inbuf[read];
 
   return MSPACK_ERR_OK;
 }
 
 /* inflate() error codes */
 #define INF_ERR_BLOCKTYPE   (-1)  /* unknown block type                      */
 #define INF_ERR_COMPLEMENT  (-2)  /* block size complement mismatch          */
 #define INF_ERR_FLUSH       (-3)  /* error from flush_window() callback      */
 #define INF_ERR_BITBUF      (-4)  /* too many bits in bit buffer             */
 #define INF_ERR_SYMLENS     (-5)  /* too many symbols in blocktype 2 header  */
 #define INF_ERR_BITLENTBL   (-6)  /* failed to build bitlens huffman table   */
 #define INF_ERR_LITERALTBL  (-7)  /* failed to build literals huffman table  */
 #define INF_ERR_DISTANCETBL (-8)  /* failed to build distance huffman table  */
 #define INF_ERR_BITOVERRUN  (-9)  /* bitlen RLE code goes over table size    */
 #define INF_ERR_BADBITLEN   (-10) /* invalid bit-length code                 */
 #define INF_ERR_LITCODE     (-11) /* out-of-range literal code               */
 #define INF_ERR_DISTCODE    (-12) /* out-of-range distance code              */
 #define INF_ERR_DISTANCE    (-13) /* somehow, distance is beyond 32k         */
 #define INF_ERR_HUFFSYM     (-14) /* out of bits decoding huffman symbol     */
 
 /* make_decode_table(nsyms, nbits, length[], table[])
  *
  * This function was coded by David Tritscher. It builds a fast huffman
  * decoding table out of just a canonical huffman code lengths table.
  *
  * NOTE: this is NOT identical to the make_decode_table() in lzxd.c. This
  * one reverses the quick-lookup bit pattern. Bits are read MSB to LSB in LZX,
  * but LSB to MSB in MSZIP.
  *
  * nsyms  = total number of symbols in this huffman tree.
  * nbits  = any symbols with a code length of nbits or less can be decoded
  *          in one lookup of the table.
  * length = A table to get code lengths from [0 to nsyms-1]
  * table  = The table to fill up with decoded symbols and pointers.
  *
  * Returns 0 for OK or 1 for error
  */
 static int make_decode_table(unsigned int nsyms, unsigned int nbits,
 			     unsigned char *length, unsigned short *table)
 {
   register unsigned int leaf, reverse, fill;
   register unsigned short sym, next_sym;
   register unsigned char bit_num;
   unsigned int pos         = 0; /* the current position in the decode table */
   unsigned int table_mask  = 1 << nbits;
   unsigned int bit_mask    = table_mask >> 1; /* don't do 0 length codes */
 
   /* fill entries for codes short enough for a direct mapping */
   for (bit_num = 1; bit_num <= nbits; bit_num++) {
     for (sym = 0; sym < nsyms; sym++) {
       if (length[sym] != bit_num) continue;
 
       /* reverse the significant bits */
       fill = length[sym]; reverse = pos >> (nbits - fill); leaf = 0;
       do {leaf <<= 1; leaf |= reverse & 1; reverse >>= 1;} while (--fill);
 
       if((pos += bit_mask) > table_mask) return 1; /* table overrun */
 
       /* fill all possible lookups of this symbol with the symbol itself */
       fill = bit_mask; next_sym = 1 << bit_num;
       do { table[leaf] = sym; leaf += next_sym; } while (--fill);
     }
     bit_mask >>= 1;
   }
 
   /* exit with success if table is now complete */
   if (pos == table_mask) return 0;
 
   /* mark all remaining table entries as unused */
   for (sym = pos; sym < table_mask; sym++) {
     reverse = sym; leaf = 0; fill = nbits;
     do { leaf <<= 1; leaf |= reverse & 1; reverse >>= 1; } while (--fill);
     table[leaf] = 0xFFFF;
   }
 
   /* where should the longer codes be allocated from? */
   next_sym = ((table_mask >> 1) < nsyms) ? nsyms : (table_mask >> 1);
 
   /* give ourselves room for codes to grow by up to 16 more bits.
    * codes now start at bit nbits+16 and end at (nbits+16-codelength) */
   pos <<= 16;
   table_mask <<= 16;
   bit_mask = 1 << 15;
 
   for (bit_num = nbits+1; bit_num <= MSZIP_MAX_HUFFBITS; bit_num++) {
     for (sym = 0; sym < nsyms; sym++) {
       if (length[sym] != bit_num) continue;
 
       /* leaf = the first nbits of the code, reversed */
       reverse = pos >> 16; leaf = 0; fill = nbits;
       do {leaf <<= 1; leaf |= reverse & 1; reverse >>= 1;} while (--fill);
 
       for (fill = 0; fill < (bit_num - nbits); fill++) {
 	/* if this path hasn't been taken yet, 'allocate' two entries */
 	if (table[leaf] == 0xFFFF) {
 	  table[(next_sym << 1)     ] = 0xFFFF;
 	  table[(next_sym << 1) + 1 ] = 0xFFFF;
 	  table[leaf] = next_sym++;
 	}
 	/* follow the path and select either left or right for next bit */
 	leaf = (table[leaf] << 1) | ((pos >> (15 - fill)) & 1);
       }
       table[leaf] = sym;
 
       if ((pos += bit_mask) > table_mask) return 1; /* table overflow */
     }
     bit_mask >>= 1;
   }
 
   /* full table? */
   return (pos != table_mask) ? 1 : 0;
 }
 
 /* READ_HUFFSYM(tablename, var) decodes one huffman symbol from the
  * bitstream using the stated table and puts it in var.
  */
 #define READ_HUFFSYM(tbl, var) do {                                     \
   /* huffman symbols can be up to 16 bits long */                       \
   ENSURE_BITS(MSZIP_MAX_HUFFBITS);                                      \
   /* immediate table lookup of [tablebits] bits of the code */          \
   sym = zip->tbl##_table[PEEK_BITS(MSZIP_##tbl##_TABLEBITS)];		\
   /* is the symbol is longer than [tablebits] bits? (i=node index) */   \
   if (sym >= MSZIP_##tbl##_MAXSYMBOLS) {                                \
     /* decode remaining bits by tree traversal */                       \
     i = MSZIP_##tbl##_TABLEBITS - 1;					\
     do {                                                                \
       /* check next bit. error if we run out of bits before decode */	\
       if (i++ > MSZIP_MAX_HUFFBITS) {					\
         D(("out of bits in huffman decode"))                            \
         return INF_ERR_HUFFSYM;                                         \
       }                                                                 \
       /* double node index and add 0 (left branch) or 1 (right) */	\
       sym = zip->tbl##_table[(sym << 1) | ((bit_buffer >> i) & 1)];	\
       /* while we are still in node indicies, not decoded symbols */    \
     } while (sym >= MSZIP_##tbl##_MAXSYMBOLS);                          \
   }                                                                     \
   /* result */                                                          \
   (var) = sym;                                                          \
   /* look up the code length of that symbol and discard those bits */   \
   i = zip->tbl##_len[sym];                                              \
   REMOVE_BITS(i);                                                       \
 } while (0)
 
 static int zip_read_lens(struct mszipd_stream *zip) {
   /* for the bit buffer and huffman decoding */
   register unsigned int bit_buffer;
   register int bits_left;
   unsigned char *i_ptr, *i_end;
 
   /* bitlen Huffman codes -- immediate lookup, 7 bit max code length */
   unsigned short bl_table[(1 << 7)];
   unsigned char bl_len[19];
 
   unsigned char lens[MSZIP_LITERAL_MAXSYMBOLS + MSZIP_DISTANCE_MAXSYMBOLS];
   unsigned int lit_codes, dist_codes, code, last_code=0, bitlen_codes, i, run;
 
   RESTORE_BITS;
 
   /* read the number of codes */
   READ_BITS(lit_codes,    5); lit_codes    += 257;
   READ_BITS(dist_codes,   5); dist_codes   += 1;
   READ_BITS(bitlen_codes, 4); bitlen_codes += 4;
   if (lit_codes  > MSZIP_LITERAL_MAXSYMBOLS)  return INF_ERR_SYMLENS;
   if (dist_codes > MSZIP_DISTANCE_MAXSYMBOLS) return INF_ERR_SYMLENS;
 
   /* read in the bit lengths in their unusual order */
   for (i = 0; i < bitlen_codes; i++) READ_BITS(bl_len[bitlen_order[i]], 3);
   while (i < 19) bl_len[bitlen_order[i++]] = 0;
 
   /* create decoding table with an immediate lookup */
   if (make_decode_table(19, 7, &bl_len[0], &bl_table[0])) {
     return INF_ERR_BITLENTBL;
   }
 
   /* read literal / distance code lengths */
   for (i = 0; i < (lit_codes + dist_codes); i++) {
     /* single-level huffman lookup */
     ENSURE_BITS(7);
     code = bl_table[PEEK_BITS(7)];
     REMOVE_BITS(bl_len[code]);
 
     if (code < 16) lens[i] = last_code = code;
     else {
       switch (code) {
       case 16: READ_BITS(run, 2); run += 3;  code = last_code; break;
       case 17: READ_BITS(run, 3); run += 3;  code = 0;         break;
       case 18: READ_BITS(run, 7); run += 11; code = 0;         break;
       default: D(("bad code!: %u", code)) return INF_ERR_BADBITLEN;
       }
       if ((i + run) > (lit_codes + dist_codes)) return INF_ERR_BITOVERRUN;
       while (run--) lens[i++] = code;
       i--;
     }
   }
 
   /* copy LITERAL code lengths and clear any remaining */
   i = lit_codes;
   zip->sys->copy(&lens[0], &zip->LITERAL_len[0], i);
   while (i < MSZIP_LITERAL_MAXSYMBOLS) zip->LITERAL_len[i++] = 0;
 
   i = dist_codes;
   zip->sys->copy(&lens[lit_codes], &zip->DISTANCE_len[0], i);
   while (i < MSZIP_DISTANCE_MAXSYMBOLS) zip->DISTANCE_len[i++] = 0;
 
   STORE_BITS;
   return 0;
 }
 
 /* a clean implementation of RFC 1951 / inflate */
 static int inflate(struct mszipd_stream *zip) {
   unsigned int last_block, block_type, distance, length, this_run, i;
 
   /* for the bit buffer and huffman decoding */
   register unsigned int bit_buffer;
   register int bits_left;
   register unsigned short sym;
   unsigned char *i_ptr, *i_end;
 
   RESTORE_BITS;
 
   do {
     /* read in last block bit */
     READ_BITS(last_block, 1);
 
     /* read in block type */
     READ_BITS(block_type, 2);
     D(("block_type=%u last_block=%u", block_type, last_block))
 
     if (block_type == 0) {
       /* uncompressed block */
       unsigned char lens_buf[4];
 
       /* go to byte boundary */
       i = bits_left & 7; REMOVE_BITS(i);
 
       /* read 4 bytes of data, emptying the bit-buffer if necessary */
       for (i = 0; (bits_left >= 8); i++) {
 	if (i == 4) return INF_ERR_BITBUF;
 	lens_buf[i] = PEEK_BITS(8);
 	REMOVE_BITS(8);
       }
       if (bits_left != 0) return INF_ERR_BITBUF;
       while (i < 4) {
 	if (i_ptr >= i_end) {
 	  if (zipd_read_input(zip)) return zip->error;
 	  i_ptr = zip->i_ptr;
 	  i_end = zip->i_end;
 	}
 	lens_buf[i++] = *i_ptr++;
       }
 
       /* get the length and its complement */
       length = lens_buf[0] | (lens_buf[1] << 8);
       i      = lens_buf[2] | (lens_buf[3] << 8);
       if (length != (~i & 0xFFFF)) return INF_ERR_COMPLEMENT;
 
       /* read and copy the uncompressed data into the window */
       while (length > 0) {
 	if (i_ptr >= i_end) {
 	  if (zipd_read_input(zip)) return zip->error;
 	  i_ptr = zip->i_ptr;
 	  i_end = zip->i_end;
 	}
 
 	this_run = length;
 	if (this_run > (unsigned int)(i_end - i_ptr)) this_run = i_end - i_ptr;
 	if (this_run > (MSZIP_FRAME_SIZE - zip->window_posn))
 	  this_run = MSZIP_FRAME_SIZE - zip->window_posn;
 
 	zip->sys->copy(i_ptr, &zip->window[zip->window_posn], this_run);
 	zip->window_posn += this_run;
 	i_ptr    += this_run;
 	length   -= this_run;
 
 	if (zip->window_posn == MSZIP_FRAME_SIZE) {
 	  if (zip->flush_window(zip, MSZIP_FRAME_SIZE)) return INF_ERR_FLUSH;
 	  zip->window_posn = 0;
 	}
       }
     }
     else if ((block_type == 1) || (block_type == 2)) {
       /* Huffman-compressed LZ77 block */
       unsigned int window_posn, match_posn, code;
 
       if (block_type == 1) {
 	/* block with fixed Huffman codes */
 	i = 0;
 	while (i < 144) zip->LITERAL_len[i++] = 8;
 	while (i < 256) zip->LITERAL_len[i++] = 9;
 	while (i < 280) zip->LITERAL_len[i++] = 7;
 	while (i < 288) zip->LITERAL_len[i++] = 8;
 	for (i = 0; i < 32; i++) zip->DISTANCE_len[i] = 5;
       }
       else {
 	/* block with dynamic Huffman codes */
 	STORE_BITS;
 	if ((i = zip_read_lens(zip))) return i;
 	RESTORE_BITS;
       }
 
       /* now huffman lengths are read for either kind of block, 
        * create huffman decoding tables */
       if (make_decode_table(MSZIP_LITERAL_MAXSYMBOLS, MSZIP_LITERAL_TABLEBITS,
 			    &zip->LITERAL_len[0], &zip->LITERAL_table[0]))
       {
 	return INF_ERR_LITERALTBL;
       }
 
       if (make_decode_table(MSZIP_DISTANCE_MAXSYMBOLS,MSZIP_DISTANCE_TABLEBITS,
 			    &zip->DISTANCE_len[0], &zip->DISTANCE_table[0]))
       {
 	return INF_ERR_DISTANCETBL;
       }
 
       /* decode forever until end of block code */
       window_posn = zip->window_posn;
       while (1) {
 	READ_HUFFSYM(LITERAL, code);
 	if (code < 256) {
 	  zip->window[window_posn++] = (unsigned char) code;
 	  if (window_posn == MSZIP_FRAME_SIZE) {
 	    if (zip->flush_window(zip, MSZIP_FRAME_SIZE)) return INF_ERR_FLUSH;
 	    window_posn = 0;
 	  }
 	}
 	else if (code == 256) {
 	  /* END OF BLOCK CODE: loop break point */
 	  break;
 	}
 	else {
 	  code -= 257;
 	  if (code > 29) return INF_ERR_LITCODE;
 	  READ_BITS_T(length, lit_extrabits[code]);
 	  length += lit_lengths[code];
 
 	  READ_HUFFSYM(DISTANCE, code);
 	  if (code > 30) return INF_ERR_DISTCODE;
 	  READ_BITS_T(distance, dist_extrabits[code]);
 	  distance += dist_offsets[code];
 
 	  /* match position is window position minus distance. If distance
 	   * is more than window position numerically, it must 'wrap
 	   * around' the frame size. */ 
 	  match_posn = ((distance > window_posn) ? MSZIP_FRAME_SIZE : 0)
 	    + window_posn - distance;
 
 	  /* copy match */
 	  if (length < 12) {
 	    /* short match, use slower loop but no loop setup code */
 	    while (length--) {
 	      zip->window[window_posn++] = zip->window[match_posn++];
 	      match_posn &= MSZIP_FRAME_SIZE - 1;
 
 	      if (window_posn == MSZIP_FRAME_SIZE) {
 		if (zip->flush_window(zip, MSZIP_FRAME_SIZE))
 		  return INF_ERR_FLUSH;
 		window_posn = 0;
 	      }
 	    }
 	  }
 	  else {
 	    /* longer match, use faster loop but with setup expense */
 	    unsigned char *runsrc, *rundest;
 	    do {
 	      this_run = length;
 	      if ((match_posn + this_run) > MSZIP_FRAME_SIZE)
 		this_run = MSZIP_FRAME_SIZE - match_posn;
 	      if ((window_posn + this_run) > MSZIP_FRAME_SIZE)
 		this_run = MSZIP_FRAME_SIZE - window_posn;
 
 	      rundest = &zip->window[window_posn]; window_posn += this_run;
 	      runsrc  = &zip->window[match_posn];  match_posn  += this_run;
 	      length -= this_run;
 	      while (this_run--) *rundest++ = *runsrc++;
 
 	      /* flush if necessary */
 	      if (window_posn == MSZIP_FRAME_SIZE) {
 		if (zip->flush_window(zip, MSZIP_FRAME_SIZE))
 		  return INF_ERR_FLUSH;
 		window_posn = 0;
 	      }
 	      if (match_posn == MSZIP_FRAME_SIZE) match_posn = 0;
 	    } while (length > 0);
 	  }
 
 	} /* else (code >= 257) */
 
       } /* while (forever) -- break point at 'code == 256' */
       zip->window_posn = window_posn;
     }
     else {
       /* block_type == 3 -- bad block type */
       return INF_ERR_BLOCKTYPE;
     }
   } while (!last_block);
 
   /* flush the remaining data */
   if (zip->window_posn) {
     if (zip->flush_window(zip, zip->window_posn)) return INF_ERR_FLUSH;
   }
   STORE_BITS;
 
   /* return success */
   return 0;
 }
 
 /* inflate() calls this whenever the window should be flushed. As
  * MSZIP only expands to the size of the window, the implementation used
  * simply keeps track of the amount of data flushed, and if more than 32k
  * is flushed, an error is raised.
  */  
 static int mszipd_flush_window(struct mszipd_stream *zip,
 			       unsigned int data_flushed)
 {
   zip->bytes_output += data_flushed;
   if (zip->bytes_output > MSZIP_FRAME_SIZE) {
     D(("overflow: %u bytes flushed, total is now %u",
        data_flushed, zip->bytes_output))
     return 1;
   }
   return 0;
 }
 
 struct mszipd_stream *mszipd_init(struct mspack_system *system,
 				  struct mspack_file *input,
 				  struct mspack_file *output,
 				  int input_buffer_size,
 				  int repair_mode)
 {
   struct mszipd_stream *zip;
 
   if (!system) return NULL;
 
   input_buffer_size = (input_buffer_size + 1) & -2;
   if (!input_buffer_size) return NULL;
 
   /* allocate decompression state */
   if (!(zip = system->alloc(system, sizeof(struct mszipd_stream)))) {
     return NULL;
   }
 
   /* allocate input buffer */
   zip->inbuf  = system->alloc(system, (size_t) input_buffer_size);
   if (!zip->inbuf) {
     system->free(zip);
     return NULL;
   }
 
   /* initialise decompression state */
   zip->sys             = system;
   zip->input           = input;
   zip->output          = output;
   zip->inbuf_size      = input_buffer_size;
   zip->error           = MSPACK_ERR_OK;
   zip->repair_mode     = repair_mode;
   zip->flush_window    = &mszipd_flush_window;
fb0a4425
   zip->input_end       = 0;
dc2e0dc7
 
   zip->i_ptr = zip->i_end = &zip->inbuf[0];
   zip->o_ptr = zip->o_end = NULL;
   zip->bit_buffer = 0; zip->bits_left = 0;
   return zip;
 }
 
 int mszipd_decompress(struct mszipd_stream *zip, off_t out_bytes) {
   /* for the bit buffer */
   register unsigned int bit_buffer;
   register int bits_left;
   unsigned char *i_ptr, *i_end;
 
   int i, state, error;
 
   /* easy answers */
   if (!zip || (out_bytes < 0)) return MSPACK_ERR_ARGS;
   if (zip->error) return zip->error;
 
   /* flush out any stored-up bytes before we begin */
   i = zip->o_end - zip->o_ptr;
   if ((off_t) i > out_bytes) i = (int) out_bytes;
   if (i) {
     if (zip->sys->write(zip->output, zip->o_ptr, i) != i) {
       return zip->error = MSPACK_ERR_WRITE;
     }
     zip->o_ptr  += i;
     out_bytes   -= i;
   }
   if (out_bytes == 0) return MSPACK_ERR_OK;
 
 
   while (out_bytes > 0) {
     /* unpack another block */
     RESTORE_BITS;
 
     /* skip to next read 'CK' header */
     i = bits_left & 7; REMOVE_BITS(i); /* align to bytestream */
     state = 0;
     do {
       READ_BITS(i, 8);
       if (i == 'C') state = 1;
       else if ((state == 1) && (i == 'K')) state = 2;
       else state = 0;
     } while (state != 2);
 
     /* inflate a block, repair and realign if necessary */
     zip->window_posn = 0;
     zip->bytes_output = 0;
     STORE_BITS;
     if ((error = inflate(zip))) {
       D(("inflate error %d", i))
       if (zip->repair_mode) {
 	zip->sys->message(NULL, "MSZIP error, %u bytes of data lost.",
 			  MSZIP_FRAME_SIZE - zip->bytes_output);
 	for (i = zip->bytes_output; i < MSZIP_FRAME_SIZE; i++) {
 	  zip->window[i] = '\0';
 	}
 	zip->bytes_output = MSZIP_FRAME_SIZE;
       }
       else {
 	return zip->error = (error > 0) ? error : MSPACK_ERR_DECRUNCH;
       }
     }
     zip->o_ptr = &zip->window[0];
     zip->o_end = &zip->o_ptr[zip->bytes_output];
 
     /* write a frame */
     i = (out_bytes < (off_t)zip->bytes_output) ?
       (int)out_bytes : zip->bytes_output;
     if (zip->sys->write(zip->output, zip->o_ptr, i) != i) {
       return zip->error = MSPACK_ERR_WRITE;
     }
 
     /* mspack errors (i.e. read errors) are fatal and can't be recovered */
     if ((error > 0) && zip->repair_mode) return error;
 
     zip->o_ptr  += i;
     out_bytes   -= i;
   }
 
   if (out_bytes) {
     D(("bytes left to output"))
     return zip->error = MSPACK_ERR_DECRUNCH;
   }
   return MSPACK_ERR_OK;
 }
 
 void mszipd_free(struct mszipd_stream *zip) {
   struct mspack_system *sys;
   if (zip) {
     sys = zip->sys;
     sys->free(zip->inbuf);
     sys->free(zip);
   }
 }