Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/external/source/exploits/CVE-2017-13861/liboffsetfinder64/lzssdec.c
Views: 11784
//1// lzssdec.h2// img4tool3//4// Code borrowed from: http://newosxbook.com/src.jl?tree=listings&file=joker.c5// Coded by Jonathan Levin (a.k.a @Morpheus______), http://newosxbook.com67#include "lzssdec.h"8#include <string.h>9#include <stdlib.h>1011/**************************************************************12LZSS.C -- A Data Compression Program13***************************************************************144/6/1989 Haruhiko Okumura15Use, distribute, and modify this program freely.16Please send me your improved versions.17PC-VAN SCIENCE18NIFTY-Serve PAF0102219CompuServe 74050,102220**************************************************************/21/*22* lzss.c - Package for decompressing lzss compressed objects23*24* Copyright (c) 2003 Apple Computer, Inc.25*26* DRI: Josh de Cesare27*/28#define N 4096 /* size of ring buffer - must be power of 2 */29#define F 18 /* upper limit for match_length */30#define THRESHOLD 2 /* encode string into position and length31if match_length is greater than this */32#define NIL N /* index for root of binary search trees */3334int decompress_lzss(u_int8_t *dst, u_int8_t *src, u_int32_t srclen){35/* ring buffer of size N, with extra F-1 bytes to aid string comparison */36u_int8_t text_buf[N + F - 1];37u_int8_t *dststart = dst;38u_int8_t *srcend = src + srclen;39int i, j, k, r, c;40unsigned int flags;4142dst = dststart;43srcend = src + srclen;44for (i = 0; i < N - F; i++)45text_buf[i] = ' ';46r = N - F;47flags = 0;48for ( ; ; ) {49if (((flags >>= 1) & 0x100) == 0) {50if (src < srcend) c = *src++; else break;51flags = c | 0xFF00; /* uses higher byte cleverly */52} /* to count eight */53if (flags & 1) {54if (src < srcend) c = *src++; else break;55*dst++ = c;56text_buf[r++] = c;57r &= (N - 1);58} else {59if (src < srcend) i = *src++; else break;60if (src < srcend) j = *src++; else break;61i |= ((j & 0xF0) << 4);62j = (j & 0x0F) + THRESHOLD;63for (k = 0; k <= j; k++) {64c = text_buf[(i + k) & (N - 1)];65*dst++ = c;66text_buf[r++] = c;67r &= (N - 1);68}69}70}7172return (int)(dst - dststart);73}7475struct compHeader {76char sig[8] ; // "complzss"77uint32_t unknown; // Likely CRC32. But who cares, anyway?78uint32_t uncompressedSize;79uint32_t compressedSize;80uint32_t unknown1; // 181};8283char *tryLZSS(char *compressed, size_t *filesize){84struct compHeader *compHeader = (struct compHeader*)compressed;85if (!compHeader) return NULL;86int sig[2] = { 0xfeedfacf, 0x0100000c };8788char *decomp = malloc (ntohl(compHeader->uncompressedSize));8990char *feed = memmem(compressed+64, 1024, sig, sizeof(sig));9192if (!feed)93return NULL;9495feed--;96int rc = decompress_lzss((void*)decomp, (void*)feed, ntohl(compHeader->compressedSize));97if (rc != ntohl(compHeader->uncompressedSize)) {98return NULL;99}100101*filesize = rc;102return (decomp);103104} // compLZSS105106107