/*
 *  Copyright (C) 2013-2019 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
 *  Copyright (C) 2007-2013 Sourcefire, Inc.
 *
 *  Authors: Michal 'GiM' Spadlinski
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *  MA 02110-1301, USA.
 */

/*
 * lzma.c
 *
 * o2:28:18 CEST 2oo6-25-o6 		- initial 0xA4/0x536
 * oo:29:4o CEST 2oo6-26-o6 		- 0x1cd/0x536 [+0x129]
 * o2:13:19 CEST 2oo6-o1-o7, 2oo6-3o-o6 - 0x536/0x536
 *
 */

#if HAVE_CONFIG_H
#include "clamav-config.h"
#endif

#include <stdio.h>
#ifdef        HAVE_STDLIB_H
#include <stdlib.h>
#endif
#ifdef        HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#ifdef        HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
#ifdef        HAVE_UNISTD_H
#include <unistd.h>
#endif
#ifdef        HAVE_STRING_H
#include <string.h>
#endif

#include "clamav.h"
#include "pe.h"
#include "others.h"
#include "mew.h"
#include "packlibs.h"
#include "rebuildpe.h"

#define EC32(x) le32_to_host(x) /* Convert little endian to host */
#define CE32(x) be32_to_host(x) /* Convert big endian to host */
#define PEALIGN(o,a) (((a))?(((o)/(a))*(a)):(o))
#define PESALIGN(o,a) (((a))?(((o)/(a)+((o)%(a)!=0))*(a)):(o))

/* modifies all parameters */
/* northfox does this shitty way,
 * this should be done with just a bswap
 */
static const char *lzma_bswap_4861dc(struct lzmastate *p, const char *old_edx)
{
	/* dumb_dump_start
	 *

	old_edx was 'uint32_t *' before and in mew_lzma there was
	&new_edx where new_edx = var1C

	uint32_t loc_esi, loc_edi;
	uint8_t *loc_eax;

	p->p2 = loc_esi = 0;
	p->p0 = loc_eax = (uint8_t *)*old_edx;
	*old_edx = 5;
	do {
		loc_esi = p->p2 << 8;
		loc_edi = *(uint8_t *)((loc_eax)++);
		loc_esi |= loc_edi;
		(*old_edx)--;
		p->p2 = loc_esi;
	} while (*old_edx);
	p->p0 = loc_eax;
	p->p1 = 0xffffffff;

	* dumb_dump_end
	*/

	/* XXX, mine replacement */
	p->p2 = EC32(CE32(((uint32_t)cli_readint32(old_edx + 1))));
	p->p1 = 0xffffffff;
	p->p0 = old_edx + 5;

	return p->p0;
}

static uint32_t lzma_486248 (struct lzmastate *p,const char **old_ecx, char *src, uint32_t size)
{
	uint32_t loc_esi, loc_edi, loc_eax, loc_ecx, ret;
	if (!CLI_ISCONTAINED(src, size, *old_ecx, 4) || !CLI_ISCONTAINED(src, size, p->p0, 1))
		return 0xffffffff;
	loc_esi = p->p1;
	loc_eax = loc_esi >> 0xb;
	loc_ecx = cli_readint32(*old_ecx);
	ret = loc_ecx&0xffff;
	(loc_eax) *=  ret;
	loc_edi = p->p2;
	if (loc_edi < loc_eax)
	{
		/* 48625f */
		p->p1 = loc_eax;
		loc_esi = ret;
		loc_edi = ((int32_t)(0x800 - ret) >> 5) + ((loc_eax&0xffff0000) | ret); 
								/* signed<-sar, &|<-mov ax, [ecx] */
		loc_ecx = (loc_ecx&0xffff0000)|(loc_edi&0xffff);
		cli_writeint32(*old_ecx, loc_ecx);

		ret = 0;
	} else {
		/* 48629e */
		loc_esi -= loc_eax;
		loc_edi -= loc_eax;
		p->p1 = loc_esi;
		p->p2 = loc_edi;
		loc_eax = (loc_eax & 0xffff0000) | ret;
		loc_esi = (loc_esi & 0xffff0000) | (ret >> 5);
		loc_eax -= loc_esi;

		loc_ecx = (loc_ecx&0xffff0000)|(loc_eax&0xffff);
		cli_writeint32(*old_ecx, loc_ecx);

		ret = 1;
	}
	loc_eax = p->p1;
	if (loc_eax < 0x1000000)
	{
		*old_ecx = p->p0;
		loc_edi = (*(uint8_t *)(p->p0));
		loc_esi = ((p->p2) << 8) | loc_edi;
		(*old_ecx)++;
		loc_eax <<= 8;
		p->p2 = loc_esi;
		p->p1 = loc_eax;
		p->p0 = *old_ecx;
	}
	return ret;

}

static uint32_t lzma_48635C(uint8_t znaczek, const char **old_ecx, struct lzmastate *p, uint32_t *retval, char *src, uint32_t size)
{
	uint32_t loc_esi = (znaczek&0xff) >> 7, /* msb */
		loc_ebx, ret;
	const char *loc_edi;
	znaczek <<= 1;
	ret = loc_esi << 9;
	loc_edi = *old_ecx;
	*old_ecx = loc_edi + ret + 0x202;
	if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
		return 0xffffffff;
	loc_ebx = ret | 2;

	while (loc_esi == ret)
	{
		if (loc_ebx >= 0x100)
		{
			ret = (ret&0xffffff00) | (loc_ebx&0xff);
			*retval = ret;
			return 0;
		}
		loc_esi = (znaczek&0xff) >> 7;
		znaczek <<= 1;
		ret = ((loc_esi + 1) << 8) + loc_ebx;
		*old_ecx = loc_edi + ret*2;
		if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
			return 0xffffffff;
		loc_ebx += loc_ebx;
		loc_ebx |= ret;
	}
	loc_esi = 0x100;
	while (loc_ebx < loc_esi)
	{
		loc_ebx += loc_ebx;
		*old_ecx = loc_edi + loc_ebx;
		if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
			return 0xffffffff;
		loc_ebx |= ret;
	}
	ret = (ret&0xffffff00) | (loc_ebx&0xff);
	*retval = ret;
	return 0;
}

static uint32_t lzma_4862e0 (struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
	uint32_t loc_ebx, loc_esi, stack_ecx, ret;
	const char *loc_edi;

	loc_ebx = *old_edx;
	ret = 1;
	loc_edi = *old_ecx;
	if (loc_ebx && !(loc_ebx&0x80000000))
	{
		/* loc_4862f1 */
		stack_ecx = loc_ebx;
		do {
			loc_esi = ret+ret;
			*old_ecx = loc_edi + loc_esi;
			if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
				return 0xffffffff;
			ret += loc_esi;
			stack_ecx--;
		} while (stack_ecx);
	} 
	/* loc_48630b */
	  /* unneeded
	*old_ecx = (uint8_t *)loc_ebx;
	  */
	
	*old_edx = 1 << (loc_ebx&0xff);
	ret -= *old_edx;
	*retval = ret;
	return 0;
}

/* old_edx - write only */
static uint32_t lzma_4863da (uint32_t var0, struct lzmastate *p, const char  **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
	uint32_t ret;
	const char *loc_esi = *old_ecx;

	if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
		return -1;
	if (ret)
	{
		/* loc_4863ff */
		*old_ecx = loc_esi+2;
		if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
			return -1;
		if (ret)
		{
			/* loc_486429 */
			*old_edx = 8;
			*old_ecx = loc_esi + 0x204;
			if (lzma_4862e0 (p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
				return -1;
			ret += 0x10;
		} else {
			/* loc_48640e */
			ret = var0 << 4;
			*old_edx = 3;
			*old_ecx = loc_esi + 0x104 + ret;
			if (lzma_4862e0 (p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
				return -1;
			ret += 0x8;
		}
	} else {
		/* loc_4863e9 */
		ret = var0 << 4;
		*old_edx = 3;
		*old_ecx = loc_esi + 0x4 + ret;
		if (lzma_4862e0 (p, old_ecx, old_edx, &ret, src, size) == 0xffffffff)
			return -1;
	}
	*retval = ret;
	return 0;
}

static uint32_t lzma_486204 (struct lzmastate *p, uint32_t old_edx, uint32_t *retval, char *src, uint32_t size)
{
	uint32_t loc_esi, loc_edi, loc_ebx, loc_eax;
	const char *loc_edx;
	loc_esi = p->p1;
	loc_edi = p->p2;
	loc_eax = 0;
	if (old_edx && !(old_edx&0x80000000))
	{
		/* loc_4866212 */
		loc_ebx = old_edx;
		do {
			loc_esi >>= 1;
			loc_eax <<= 1;
			if (loc_edi >= loc_esi)
			{
				loc_edi -= loc_esi;
				loc_eax |= 1;
			}
			/* loc_486222 */
			if (loc_esi < 0x1000000)
			{
				if (!CLI_ISCONTAINED(src, size, p->p0, 1))
					return 0xffffffff;
				loc_edx = p->p0;
				loc_edi <<= 8;
				loc_esi <<= 8;
				loc_edi |= (*loc_edx)&0xff; /* movzx ebp, byte ptr [edx] */
				p->p0 = ++loc_edx;
			}
			loc_ebx--;
		} while (loc_ebx);

	}
	p->p2 = loc_edi;
	p->p1 = loc_esi;
	*retval = loc_eax;
	return 0;
}

static uint32_t lzma_48631a (struct lzmastate *p, const char **old_ecx, uint32_t *old_edx, uint32_t *retval, char *src, uint32_t size)
{
	uint32_t copy1, copy2;
	uint32_t loc_esi, loc_edi, ret;
	const char *loc_ebx;

	copy1 = *old_edx;
	loc_edi = 0;
	loc_ebx = *old_ecx;
	*old_edx = 1;
	copy2 = (uint32_t)loc_edi;

	if (copy1 <= (uint32_t)loc_edi)
	{
		*retval = copy2;
		return 0;
	}

	do {
		loc_esi = *old_edx + *old_edx;
		*old_ecx = loc_esi + loc_ebx;
		if ((ret = lzma_486248 (p, old_ecx, src, size)) == 0xffffffff)
			return 0xffffffff;
		/* unneeded *old_ecx  = loc_edi; */
		*old_edx = loc_esi + ret;
		/* ret <<= (uint32_t)(*old_ecx)&0xff; */
		ret <<= (loc_edi&0xff);
		copy2 |= ret;
		loc_edi++;
	} while (loc_edi < copy1);

	*retval = copy2;
	return 0;
}


int mew_lzma(char *orgsource, const char *buf, uint32_t size_sum, uint32_t vma, uint32_t special)
{
	uint32_t var08, var0C, var10, var14, var20, var24, var28, var34;
	struct lzmastate var40;
	uint32_t new_eax, new_edx, temp;
	int i, mainloop;

	char var1, var30;
	const char *source = buf;
	char *dest, *new_ebx;
	const char *new_ecx, *var0C_ecxcopy;
	const char *var2C;
	char *pushed_esi = NULL;
	const char *pushed_ebx = NULL;
	uint32_t pushed_edx=0;

	uint32_t loc_esi, loc_edi;
	uint8_t *var18;

	if (special)
	{
		pushed_edx = cli_readint32(source);
		source += 4;
	}
	temp = cli_readint32(source) - vma;
	source += 4;
	if (!special) pushed_ebx = source;
	new_ebx = orgsource + temp;

    do {
        mainloop = 1;
	do {
		/* loc_486450 */
		if (!special)
		{
			source = pushed_ebx;
			if (!CLI_ISCONTAINED(orgsource, size_sum, source, 16))
				return -1;

			if (cli_readint32(source) == 0)
			{
				return 0;
			}
		} else {
			if (!CLI_ISCONTAINED(orgsource, size_sum, source, 12))
				return -1;
		}

		var28 = cli_readint32 (source);
		source += 4;
		temp = cli_readint32 (source) - vma;
		var18 = (uint8_t *)(orgsource + temp);
		if (special) pushed_esi = orgsource + temp;
		source += 4;
		temp = cli_readint32 (source);
		source += 5; /* yes, five */
		var2C = source;
		source += temp;
		if (special) pushed_ebx = source;
		else pushed_ebx = source;
		var1 = 0;
		dest = new_ebx;
		
		if(!CLI_ISCONTAINED(orgsource, size_sum, dest, 0x6E6C))
			return -1;
		for (i=0; i<0x1b9b; i++)
		{
			cli_writeint32(dest, 0x4000400);
			dest += 4;
		}
		loc_esi = 0;
		var08 = var20 = 0;
		loc_edi = 1;
		var14 = var10 = var24 = 1;

                if(!CLI_ISCONTAINED(orgsource, size_sum, var2C, 5))
                    return -1;
		lzma_bswap_4861dc(&var40, var2C);
		new_edx = 0;
	} while (var28 <= loc_esi); /* source = 0 */

	cli_dbgmsg("MEWlzma: entering do while loop\n");
	do {
		/* loc_4864a5 */
		new_eax = var08 & 3;
		new_ecx = (((loc_esi << 4) + new_eax)*2) + new_ebx;
		var0C = new_eax;
		if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
			return -1;
		if (new_eax)
		{
			/* loc_486549 */
			new_ecx = new_ebx + loc_esi*2 + 0x180;
			var20 = 1;
			/* eax=1 */
			if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
				return -1;
			if (new_eax != 1)
			{
				/* loc_486627 */
				var24 = var10;
				var10 = var14;
				/* xor eax,eax; cmp esi, 7; setnl al; dec eax; add eax, 0Ah */
				/* new_eax = (((loc_esi >= 7)-1)&0xFFFFFFFD) + 0xA; */
				new_eax = loc_esi>=7 ? 10:7;
				new_ecx = new_ebx + 0x664;
				var14 = loc_edi;
				loc_esi = new_eax;
				if (lzma_4863da (var0C, &var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
					return -1;
				var0C = new_eax;
				if (var0C >= 4)
					new_eax = 3;

				/* loc_486662 */
				new_edx = 6;
				new_eax <<= 7;
				new_ecx = new_eax + new_ebx + 0x360;
				if (lzma_4862e0 (&var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
					return -1;
				if (new_eax < 4)
				{ 
					/* loc_4866ca */
					loc_edi = new_eax;
				} else {
					/* loc_48667d */
					uint32_t loc_ecx;
					loc_ecx = ((int32_t)new_eax >> 1)-1; /* sar */
					loc_edi = ((new_eax&1)|2) << (loc_ecx&0xff);
					if (new_eax >= 0xe)
					{
						/* loc_4866ab */
						new_edx = loc_ecx - 4;
						if (lzma_486204 (&var40, new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
							return -1;
						loc_edi += new_eax << 4;

						new_edx = 4;
						new_ecx = new_ebx + 0x644;
					} else {
						/* loc_486691 */
						new_edx = loc_ecx;
						loc_ecx = loc_edi - new_eax;
						new_ecx =  new_ebx + loc_ecx*2 + 0x55e;
					}
					/* loc_4866a2 */
					if (lzma_48631a (&var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
						return -1;
					loc_edi += new_eax;
				}
				loc_edi++;
			} else {
				/* loc_486568 */
				new_ecx = new_ebx + loc_esi*2 + 0x198;
				if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
					return -1;
				if (new_eax)
				{
					/* loc_4865bd */
					new_ecx = new_ebx + loc_esi*2 + 0x1B0;
					if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
						return -1;
					if (new_eax)
					{
						/* loc_4865d2 */
						new_ecx = new_ebx + loc_esi*2 + 0x1C8;
						if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
							return -1;
						if (new_eax) {
							/* loc_4865ea */
							new_eax = var24;
							var24 = var10;
						} else {
							/* loc_4865e5 */
							new_eax = var10;
						}
						/* loc_4865f3 */
						var10 = var14;
					} else {
						/* loc_4865cd */
						new_eax = var14;
					}
					/* loc_4865f9 */
					var14 = loc_edi;
					loc_edi = new_eax;
				} else {
					/* loc_48657e */
					new_eax = ((loc_esi + 0xf) << 4) + var0C;
					new_ecx = new_ebx + new_eax*2;
					if ((new_eax = lzma_486248 (&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
						return -1;
					if (!new_eax) {
						uint32_t loc_ecx;
						/* loc_486593 */
						loc_ecx = var08;
						loc_ecx -= loc_edi;
						/* loc_esi = ((((loc_esi >= 7)-1)&0xFFFFFFFE) + 0xB); */
						loc_esi = loc_esi>=7 ? 11:9;
						if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + loc_ecx, 1))
							return -1;
						var1 = *(var18 + loc_ecx);
						loc_ecx = (loc_ecx&0xffffff00) | var1;
						/* loc_4865af */
						new_edx = var08++;
						if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_edx, 1))
							return -1;
						*(var18 + new_edx) = loc_ecx & 0xff;

						/* loc_4866fe */
						new_eax = var08;
						continue; /* !!! */
					}

				}
				/* loc_4865fe */
				new_ecx = new_ebx + 0xa68;
				if (lzma_4863da (var0C, &var40, &new_ecx, &new_edx, &new_eax, orgsource, size_sum) == 0xffffffff)
					return -1;
				var0C = new_eax;
				/* new_eax = (((loc_esi >= 7)-1)&0xFFFFFFFD) + 0xB; */
				new_eax = loc_esi>=7 ? 11:8;
				loc_esi = new_eax;
			}
			/* loc_4866cd */
			if (!loc_edi)
			{
				break;
			} else {
				var0C += 2;
				new_ecx = (char *)var18;
				new_edx = new_eax = var08;
				new_eax -= loc_edi;
				if ( ((var0C < var28 - new_edx) &&
						(!CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_eax), var0C) || 
						 !CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_edx), var0C))) ||
						(!CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_eax), var28 - new_edx) ||
						 !CLI_ISCONTAINED(orgsource, size_sum, (char*)(new_ecx + new_edx), var28 - new_edx)) )
					return -1;
				do {
					var1 = *(uint8_t *)(new_ecx + new_eax);
					*(uint8_t *)(new_ecx + new_edx) = var1;

					new_edx++;
					new_eax++;
					var0C--;
					if (var0C <= 0)
						break;
				} while (new_edx < var28);
				var08 = new_edx;
			}
		} else {
			/* loc_4864C8 */
			new_eax = (((var1 & 0xff) >> 4)*3) << 9;
			new_ecx = new_eax + new_ebx + 0xe6c;
			var0C_ecxcopy = new_ecx;
			if (loc_esi >= 4)
			{
				/* loc_4864e8 */
				if (loc_esi >= 10)
					loc_esi -= 6;
				else
					loc_esi -= 3;

			} else {
				/* loc_4864e4 */
				loc_esi = 0;
			}

			if (var20 == 0)	{
				/* loc_48651D */
				new_eax = 1;
				do {
					/* loc_486525 */
					/*new_ecx = var0C_ecxcopy;*/
					new_eax += new_eax;
					new_ecx += new_eax;
					var34 = new_eax;
					if ((new_eax = lzma_486248(&var40, &new_ecx, orgsource, size_sum)) == 0xffffffff)
						return -1;
					new_eax |= var34;
					/* loc_486522 */
					/* keeping it here instead of at the top
					 * seems to work faster
					 */
					if (new_eax < 0x100)
					{
						new_ecx = var0C_ecxcopy;
					}
				} while (new_eax < 0x100);
				/* loc_48653e */
				var1 = (uint8_t)(new_eax & 0xff);
			} else {
				int t;
				/* loc_4864FB */
				new_eax = var08 - loc_edi;
				if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_eax, 1))
					return -1;
				t = *(var18+new_eax);
				new_eax = (new_eax&0xffffff00) | t;

				var30 = t;
				if (lzma_48635C (t, &new_ecx, &var40, &new_eax, orgsource, size_sum) == 0xffffffff)
					return -1;
				var20 = 0;
				var1 = new_eax&0xff;
			}

			/* loc_486541 */

			/* unneeded: new_ecx = (new_ecx&0xffffff00) | var1; */

			/* loc_4865af */
			new_edx = var08++;

			if (!CLI_ISCONTAINED((uint8_t *)orgsource, size_sum, var18 + new_edx, 1))
				return -1;
			*(var18 + new_edx) = var1;
		}
		/* loc_4866fe */
		new_eax = var08;
	} while (new_eax < var28);

    	while(special) {
		uint32_t loc_ecx;
		/* let's fix calls */
		cli_dbgmsg("MEWlen: %08x ? %08x\n", new_edx, pushed_edx);

		if (pushed_edx < 5 || !CLI_ISCONTAINED(orgsource, size_sum, pushed_esi, pushed_edx))
		    return 0; /* No point in full failing just because we can't fixxup the calls */

		for(loc_ecx = 0; loc_ecx < pushed_edx - 5; loc_ecx++) {
			/* 0xe8, 0xe9 call opcodes */
			if (pushed_esi[loc_ecx] == '\xe8' || pushed_esi[loc_ecx] == '\xe9')
			{
				char *adr = (char *)(pushed_esi + loc_ecx + 1);

				cli_writeint32(adr, EC32(CE32((uint32_t)cli_readint32(adr)))-loc_ecx-1);
				loc_ecx += 4;
			}
		}
		return 0; /*pushed_edx;*/
	}
    } while (mainloop);

    return 0xbadc0de;
}


/* UPack lzma */

/* compare with 486248 */
uint32_t lzma_upack_esi_00(struct lzmastate *p, char *old_ecx, char *bb, uint32_t bl)
{
	uint32_t loc_eax, ret, loc_edi;
	loc_eax = p->p1 >> 0xb;
	if (!CLI_ISCONTAINED(bb, bl, old_ecx, 4) || !CLI_ISCONTAINED(bb, bl, p->p0, 4))
	{
		if (!CLI_ISCONTAINED(bb, bl, old_ecx, 4))
			cli_dbgmsg("contain error! %p %08x ecx: %p [%p]\n", bb, bl, old_ecx,bb+bl);
		else
			cli_dbgmsg("contain error! %p %08x p0: %p [%p]\n", bb, bl, p->p0,bb+bl);
		return 0xffffffff;
	}
	ret = cli_readint32(old_ecx);
	loc_eax *= ret;
	loc_edi = cli_readint32((char *)p->p0);
	loc_edi = EC32(CE32(loc_edi)); /* bswap */
	loc_edi -= p->p2;
	if (loc_edi < loc_eax)
	{
		p->p1 = loc_eax;
		loc_eax = (0x800 - ret) >> 5;
		cli_writeint32(old_ecx, cli_readint32(old_ecx) + loc_eax);
		ret = 0;
	} else {
		p->p2 += loc_eax;
		p->p1 -= loc_eax;
		loc_eax = ret >> 5;
		cli_writeint32(old_ecx, cli_readint32(old_ecx) - loc_eax);
		ret = 1;
	}
	if(((p->p1)&0xff000000) == 0)
	{
		p->p2 <<= 8;
		p->p1 <<= 8;
		p->p0++;
	}
	return ret;
}

/* compare with lzma_4862e0 */
/* lzma_upack_esi_4c 0x1 as eax!
 */
uint32_t lzma_upack_esi_50(struct lzmastate *p, uint32_t old_eax, uint32_t old_ecx, char **old_edx, char *old_ebp, uint32_t *retval, char *bs, uint32_t bl)
{
	uint32_t loc_eax = old_eax, ret;

	do {
		*old_edx = old_ebp + (loc_eax<<2);
		if ((ret = lzma_upack_esi_00(p, *old_edx, bs, bl)) == 0xffffffff)
			return 0xffffffff;
		loc_eax += loc_eax;
		loc_eax += ret;
	} while (loc_eax < old_ecx);

	*retval = loc_eax - old_ecx;
	return 0;
}

uint32_t lzma_upack_esi_54(struct lzmastate *p, uint32_t old_eax, uint32_t *old_ecx, char **old_edx, uint32_t *retval, char *bs, uint32_t bl)
{
	uint32_t ret, loc_eax = old_eax;

	*old_ecx = ((*old_ecx)&0xffffff00)|8;
	ret = lzma_upack_esi_00 (p, *old_edx, bs, bl);
	*old_edx = ((*old_edx) + 4);
	loc_eax = (loc_eax&0xffffff00)|1;
	if (ret)
	{
		ret = lzma_upack_esi_00 (p, *old_edx, bs, bl);
		loc_eax |= 8; /* mov al, 9 */
		if (ret)
		{
			*old_ecx <<= 5;
			loc_eax = 0x11; /* mov al, 11 */
		}
	}
	ret = loc_eax;
	if (lzma_upack_esi_50(p, 1, *old_ecx, old_edx, *old_edx + (loc_eax << 2), &loc_eax, bs, bl) == 0xffffffff)
		return 0xffffffff;

	*retval = ret + loc_eax;
	return 0;
}

/**
 * @brief 	Unpack MEW 11 packed PE file
 * 
 * @param src 		buffer to unpack
 * @param off 		offset of diff
 * @param ssize 	pe section size
 * @param dsize 	diff size
 * @param base 		OPTIONAL_HEADER32.ImageBase
 * @param vadd 		RVA of pe section
 * @param uselzma 	Bool - use LZMA
 * @param filedesc 	File descriptor
 * @return int 		Returns -1 on failure, 1 on success.
 */
int unmew11(char *src, uint32_t off, uint32_t ssize, uint32_t dsize, uint32_t base, uint32_t vadd, int uselzma, int filedesc)
{
	uint32_t entry_point, newedi, loc_ds=dsize, loc_ss=ssize;
	char *source = NULL;
	const char *lesi = NULL;
	char *ledi;
	const char *f1;
	char *f2;
	int i;
	struct cli_exe_section *section = NULL;
	uint32_t vma = base + vadd;
	uint32_t size_sum = ssize + dsize;

	/* Guard against integer overflows */
	if (base + vadd < base) {
	    cli_dbgmsg("MEW: base (%08x) + PE section RVA (%08x) exceeds max size of unsigned int (%08x)\n", 
			base, vadd, UINT32_MAX);
	    return -1;
	}
	if (ssize + dsize < ssize) {
	    cli_dbgmsg("MEW: section size (%08x) + diff size (%08x) exceeds max size of unsigned int (%08x)\n", 
			ssize, dsize, UINT32_MAX);
	    return -1;
	}
	if (((size_t)(src + off) < (size_t)(src)) || 
		((size_t)(src + off) < (size_t)(off)))
	{
	    cli_dbgmsg("MEW: Buffer pointer (%08zx) + offset (%08zx) exceeds max size of pointer (%08lx)\n", 
			(size_t)src, (size_t)off, SIZE_MAX);
	    return -1;
	}

	/* Ensure that off + required data exists within buffer */
	if (!CLI_ISCONTAINED(src, size_sum, src + off, 12)) {
		cli_dbgmsg("MEW: Data reference exceeds size of provided buffer.\n");
		return -1;
	}

	source = src + dsize + off;
	lesi = source + 12;

	entry_point  = cli_readint32(source + 4);
	newedi = cli_readint32(source + 8);
	ledi = src + (newedi - vma);
	loc_ds = size_sum - (newedi - vma);

	i = 0;
	loc_ss -= 12;
	loc_ss -= off;
	while (1)
	{
  		cli_dbgmsg("MEW unpacking section %d (%p->%p)\n", i, lesi, ledi);
		if (!CLI_ISCONTAINED(src, size_sum, lesi, loc_ss) || !CLI_ISCONTAINED(src, size_sum, ledi, loc_ds))
		{
			cli_dbgmsg("Possibly programmer error or hand-crafted PE file, report to clamav team\n");
			if (section != NULL)
				 free(section);
			return -1;
		}
		if (unmew(lesi, ledi, loc_ss, loc_ds, &f1, &f2))
		{
			free(section);
			return -1;
		}

		/* we don't need last section in sections since this is information for fixing imptbl */
		if (!CLI_ISCONTAINED(src, size_sum, f1, 4))
		{
			free(section);
			return -1;
		}

		/* XXX */
		loc_ss -= (f1+4-lesi);
		lesi = f1+4;

		ledi = src + (cli_readint32(f1) - vma);
		loc_ds = size_sum - (cli_readint32(f1) - vma);

		if (!uselzma)
		{
			uint32_t val = PESALIGN(f2 - src, 0x1000);
			void *newsect;

			if (i && val < section[i].raw) {
			  cli_dbgmsg("MEW: WTF - please report\n");
			  free(section);
			  return -1;
			}

			if (!(newsect=cli_realloc(section, (i+2)*sizeof(struct cli_exe_section)))) {
			  cli_dbgmsg("MEW: Out of memory\n");
			  free(section);
			  return -1;
			}

			section = (struct cli_exe_section *)newsect;
			section[0].raw = 0;
			section[0].rva = vadd;
			section[i+1].raw = val;
			section[i+1].rva = val + vadd;
			section[i].rsz = section[i].vsz = ((i)?(val - section[i].raw):val);

            /*
             * bb#11212 - alternate fix, buffer is aligned
             * must validate that sections do not intersect with source
             * or, in other words, exceed the specified size of destination
             */
            if (section[i].raw + section[i].rsz > dsize) {
                cli_dbgmsg("MEW: Section %i [%d, %d] exceeds destination size %u\n",
                           i, section[i].raw, section[i].raw+section[i].rsz, dsize);
                free(section);
                return -1;
            }
		}
		i++;

		if (!cli_readint32(f1))
			break;
	}

	/* LZMA stuff */
	if (uselzma) {
		free(section);

		/* put everything in one section */
		i = 1;
		if (!CLI_ISCONTAINED(src, size_sum, src+uselzma+8, 1))
		{
			cli_dbgmsg("MEW: couldn't access lzma 'special' tag\n");
			return -1;
		}
		/* 0x50 -> push eax */
		cli_dbgmsg("MEW: lzma %swas used, unpacking\n", (*(src + uselzma+8) == '\x50')?"special ":"");
		if (!CLI_ISCONTAINED(src, size_sum, f1+4, 20 + 4 + 5))
		{
			cli_dbgmsg("MEW: lzma initialization data not available!\n");
			return -1;
		}

		if(mew_lzma(src, f1+4, size_sum, vma, *(src + uselzma+8) == '\x50'))
		{
			return -1;
		}
		loc_ds=PESALIGN(loc_ds, 0x1000);

		section = cli_calloc(1, sizeof(struct cli_exe_section));
		if(!section) {
			cli_dbgmsg("MEW: Out of memory\n");
			return -1;
		}

		section[0].raw = 0; section[0].rva = vadd;
		section[0].rsz = section[0].vsz = dsize;
	}
	if (!cli_rebuildpe_align(src, section, i, base, entry_point - base, 0, 0, filedesc, 0x1000))
	{
		cli_dbgmsg("MEW: Rebuilding failed\n");
		free(section);
		return -1;
	}
	free(section);
	return 1;
}