43
44/*
45 * glob(3) -- a superset of the one defined in POSIX 1003.2.
46 *
47 * The [!...] convention to negate a range is supported (SysV, Posix, ksh).
48 *
49 * Optional extra services, controlled by flags not defined by POSIX:
50 *
51 * GLOB_QUOTE:
52 * Escaping convention: \ inhibits any special meaning the following
53 * character might have (except \ at end of string is retained).
54 * GLOB_MAGCHAR:
55 * Set in gl_flags if pattern contained a globbing character.
56 * GLOB_NOMAGIC:
57 * Same as GLOB_NOCHECK, but it will only append pattern if it did
58 * not contain any magic characters. [Used in csh style globbing]
59 * GLOB_ALTDIRFUNC:
60 * Use alternately specified directory access functions.
61 * GLOB_TILDE:
62 * expand ~user/foo to the /home/dir/of/user/foo
63 * GLOB_BRACE:
64 * expand {1,2}{a,b} to 1a 1b 2a 2b
65 * gl_matchc:
66 * Number of matches in the current invocation of glob.
67 */
68
69/*
70 * Some notes on multibyte character support:
71 * 1. Patterns with illegal byte sequences match nothing - even if
72 * GLOB_NOCHECK is specified.
73 * 2. Illegal byte sequences in filenames are handled by treating them as
74 * single-byte characters with a value of the first byte of the sequence
75 * cast to wchar_t.
76 * 3. State-dependent encodings are not currently supported.
77 */
78
79#include <sys/param.h>
80#include <sys/stat.h>
81
82#include <ctype.h>
83#include <dirent.h>
84#include <errno.h>
85#include <glob.h>
86#include <limits.h>
87#include <pwd.h>
88#include <stdint.h>
89#include <stdio.h>
90#include <stdlib.h>
91#include <string.h>
92#include <unistd.h>
93#include <wchar.h>
94
95#include "collate.h"
96
97/*
98 * glob(3) expansion limits. Stop the expansion if any of these limits
99 * is reached. This caps the runtime in the face of DoS attacks. See
100 * also CVE-2010-2632
101 */
102#define GLOB_LIMIT_BRACE 128 /* number of brace calls */
103#define GLOB_LIMIT_PATH 65536 /* number of path elements */
104#define GLOB_LIMIT_READDIR 16384 /* number of readdirs */
105#define GLOB_LIMIT_STAT 1024 /* number of stat system calls */
106#define GLOB_LIMIT_STRING ARG_MAX /* maximum total size for paths */
107
108struct glob_limit {
109 size_t l_brace_cnt;
110 size_t l_path_lim;
111 size_t l_readdir_cnt;
112 size_t l_stat_cnt;
113 size_t l_string_cnt;
114};
115
116#define DOLLAR '$'
117#define DOT '.'
118#define EOS '\0'
119#define LBRACKET '['
120#define NOT '!'
121#define QUESTION '?'
122#define QUOTE '\\'
123#define RANGE '-'
124#define RBRACKET ']'
125#define SEP '/'
126#define STAR '*'
127#define TILDE '~'
128#define UNDERSCORE '_'
129#define LBRACE '{'
130#define RBRACE '}'
131#define SLASH '/'
132#define COMMA ','
133
134#ifndef DEBUG
135
136#define M_QUOTE 0x8000000000ULL
137#define M_PROTECT 0x4000000000ULL
138#define M_MASK 0xffffffffffULL
139#define M_CHAR 0x00ffffffffULL
140
141typedef uint_fast64_t Char;
142
143#else
144
145#define M_QUOTE 0x80
146#define M_PROTECT 0x40
147#define M_MASK 0xff
148#define M_CHAR 0x7f
149
150typedef char Char;
151
152#endif
153
154
155#define CHAR(c) ((Char)((c)&M_CHAR))
156#define META(c) ((Char)((c)|M_QUOTE))
157#define M_ALL META('*')
158#define M_END META(']')
159#define M_NOT META('!')
160#define M_ONE META('?')
161#define M_RNG META('-')
162#define M_SET META('[')
163#define ismeta(c) (((c)&M_QUOTE) != 0)
164
165
166static int compare(const void *, const void *);
167static int g_Ctoc(const Char *, char *, size_t);
168static int g_lstat(Char *, struct stat *, glob_t *);
169static DIR *g_opendir(Char *, glob_t *);
170static const Char *g_strchr(const Char *, wchar_t);
171#ifdef notdef
172static Char *g_strcat(Char *, const Char *);
173#endif
174static int g_stat(Char *, struct stat *, glob_t *);
175static int glob0(const Char *, glob_t *, struct glob_limit *);
176static int glob1(Char *, glob_t *, struct glob_limit *);
177static int glob2(Char *, Char *, Char *, Char *, glob_t *,
178 struct glob_limit *);
179static int glob3(Char *, Char *, Char *, Char *, Char *, glob_t *,
180 struct glob_limit *);
181static int globextend(const Char *, glob_t *, struct glob_limit *);
182static const Char *
183 globtilde(const Char *, Char *, size_t, glob_t *);
184static int globexp1(const Char *, glob_t *, struct glob_limit *);
185static int globexp2(const Char *, const Char *, glob_t *, int *,
186 struct glob_limit *);
187static int match(Char *, Char *, Char *);
188#ifdef DEBUG
189static void qprintf(const char *, Char *);
190#endif
191
192int
193glob(const char * __restrict pattern, int flags,
194 int (*errfunc)(const char *, int), glob_t * __restrict pglob)
195{
196 struct glob_limit limit = { 0, 0, 0, 0, 0 };
197 const char *patnext;
198 Char *bufnext, *bufend, patbuf[MAXPATHLEN], prot;
199 mbstate_t mbs;
200 wchar_t wc;
201 size_t clen;
202
203 patnext = pattern;
204 if (!(flags & GLOB_APPEND)) {
205 pglob->gl_pathc = 0;
206 pglob->gl_pathv = NULL;
207 if (!(flags & GLOB_DOOFFS))
208 pglob->gl_offs = 0;
209 }
210 if (flags & GLOB_LIMIT) {
211 limit.l_path_lim = pglob->gl_matchc;
212 if (limit.l_path_lim == 0)
213 limit.l_path_lim = GLOB_LIMIT_PATH;
214 }
215 pglob->gl_flags = flags & ~GLOB_MAGCHAR;
216 pglob->gl_errfunc = errfunc;
217 pglob->gl_matchc = 0;
218
219 bufnext = patbuf;
220 bufend = bufnext + MAXPATHLEN - 1;
221 if (flags & GLOB_NOESCAPE) {
222 memset(&mbs, 0, sizeof(mbs));
223 while (bufend - bufnext >= MB_CUR_MAX) {
224 clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
225 if (clen == (size_t)-1 || clen == (size_t)-2)
226 return (GLOB_NOMATCH);
227 else if (clen == 0)
228 break;
229 *bufnext++ = wc;
230 patnext += clen;
231 }
232 } else {
233 /* Protect the quoted characters. */
234 memset(&mbs, 0, sizeof(mbs));
235 while (bufend - bufnext >= MB_CUR_MAX) {
236 if (*patnext == QUOTE) {
237 if (*++patnext == EOS) {
238 *bufnext++ = QUOTE | M_PROTECT;
239 continue;
240 }
241 prot = M_PROTECT;
242 } else
243 prot = 0;
244 clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
245 if (clen == (size_t)-1 || clen == (size_t)-2)
246 return (GLOB_NOMATCH);
247 else if (clen == 0)
248 break;
249 *bufnext++ = wc | prot;
250 patnext += clen;
251 }
252 }
253 *bufnext = EOS;
254
255 if (flags & GLOB_BRACE)
256 return (globexp1(patbuf, pglob, &limit));
257 else
258 return (glob0(patbuf, pglob, &limit));
259}
260
261/*
262 * Expand recursively a glob {} pattern. When there is no more expansion
263 * invoke the standard globbing routine to glob the rest of the magic
264 * characters
265 */
266static int
267globexp1(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
268{
269 const Char* ptr = pattern;
270 int rv;
271
272 if ((pglob->gl_flags & GLOB_LIMIT) &&
273 limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
274 errno = 0;
275 return (GLOB_NOSPACE);
276 }
277
278 /* Protect a single {}, for find(1), like csh */
279 if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS)
280 return glob0(pattern, pglob, limit);
281
282 while ((ptr = g_strchr(ptr, LBRACE)) != NULL)
283 if (!globexp2(ptr, pattern, pglob, &rv, limit))
284 return rv;
285
286 return glob0(pattern, pglob, limit);
287}
288
289
290/*
291 * Recursive brace globbing helper. Tries to expand a single brace.
292 * If it succeeds then it invokes globexp1 with the new pattern.
293 * If it fails then it tries to glob the rest of the pattern and returns.
294 */
295static int
296globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv,
297 struct glob_limit *limit)
298{
299 int i;
300 Char *lm, *ls;
301 const Char *pe, *pm, *pm1, *pl;
302 Char patbuf[MAXPATHLEN];
303
304 /* copy part up to the brace */
305 for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
306 continue;
307 *lm = EOS;
308 ls = lm;
309
310 /* Find the balanced brace */
311 for (i = 0, pe = ++ptr; *pe; pe++)
312 if (*pe == LBRACKET) {
313 /* Ignore everything between [] */
314 for (pm = pe++; *pe != RBRACKET && *pe != EOS; pe++)
315 continue;
316 if (*pe == EOS) {
317 /*
318 * We could not find a matching RBRACKET.
319 * Ignore and just look for RBRACE
320 */
321 pe = pm;
322 }
323 }
324 else if (*pe == LBRACE)
325 i++;
326 else if (*pe == RBRACE) {
327 if (i == 0)
328 break;
329 i--;
330 }
331
332 /* Non matching braces; just glob the pattern */
333 if (i != 0 || *pe == EOS) {
334 *rv = glob0(patbuf, pglob, limit);
335 return (0);
336 }
337
338 for (i = 0, pl = pm = ptr; pm <= pe; pm++)
339 switch (*pm) {
340 case LBRACKET:
341 /* Ignore everything between [] */
342 for (pm1 = pm++; *pm != RBRACKET && *pm != EOS; pm++)
343 continue;
344 if (*pm == EOS) {
345 /*
346 * We could not find a matching RBRACKET.
347 * Ignore and just look for RBRACE
348 */
349 pm = pm1;
350 }
351 break;
352
353 case LBRACE:
354 i++;
355 break;
356
357 case RBRACE:
358 if (i) {
359 i--;
360 break;
361 }
362 /* FALLTHROUGH */
363 case COMMA:
364 if (i && *pm == COMMA)
365 break;
366 else {
367 /* Append the current string */
368 for (lm = ls; (pl < pm); *lm++ = *pl++)
369 continue;
370 /*
371 * Append the rest of the pattern after the
372 * closing brace
373 */
374 for (pl = pe + 1; (*lm++ = *pl++) != EOS;)
375 continue;
376
377 /* Expand the current pattern */
378#ifdef DEBUG
379 qprintf("globexp2:", patbuf);
380#endif
381 *rv = globexp1(patbuf, pglob, limit);
382
383 /* move after the comma, to the next string */
384 pl = pm + 1;
385 }
386 break;
387
388 default:
389 break;
390 }
391 *rv = 0;
392 return (0);
393}
394
395
396
397/*
398 * expand tilde from the passwd file.
399 */
400static const Char *
401globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
402{
403 struct passwd *pwd;
404 char *h;
405 const Char *p;
406 Char *b, *eb;
407
408 if (*pattern != TILDE || !(pglob->gl_flags & GLOB_TILDE))
409 return (pattern);
410
411 /*
412 * Copy up to the end of the string or /
413 */
414 eb = &patbuf[patbuf_len - 1];
415 for (p = pattern + 1, h = (char *) patbuf;
416 h < (char *)eb && *p && *p != SLASH; *h++ = *p++)
417 continue;
418
419 *h = EOS;
420
421 if (((char *) patbuf)[0] == EOS) {
422 /*
423 * handle a plain ~ or ~/ by expanding $HOME first (iff
424 * we're not running setuid or setgid) and then trying
425 * the password file
426 */
427 if (issetugid() != 0 ||
428 (h = getenv("HOME")) == NULL) {
429 if (((h = getlogin()) != NULL &&
430 (pwd = getpwnam(h)) != NULL) ||
431 (pwd = getpwuid(getuid())) != NULL)
432 h = pwd->pw_dir;
433 else
434 return (pattern);
435 }
436 }
437 else {
438 /*
439 * Expand a ~user
440 */
441 if ((pwd = getpwnam((char*) patbuf)) == NULL)
442 return (pattern);
443 else
444 h = pwd->pw_dir;
445 }
446
447 /* Copy the home directory */
448 for (b = patbuf; b < eb && *h; *b++ = *h++)
449 continue;
450
451 /* Append the rest of the pattern */
452 while (b < eb && (*b++ = *p++) != EOS)
453 continue;
454 *b = EOS;
455
456 return (patbuf);
457}
458
459
460/*
461 * The main glob() routine: compiles the pattern (optionally processing
462 * quotes), calls glob1() to do the real pattern matching, and finally
463 * sorts the list (unless unsorted operation is requested). Returns 0
464 * if things went well, nonzero if errors occurred.
465 */
466static int
467glob0(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
468{
469 const Char *qpatnext;
470 int err;
471 size_t oldpathc;
472 Char *bufnext, c, patbuf[MAXPATHLEN];
473
474 qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
475 oldpathc = pglob->gl_pathc;
476 bufnext = patbuf;
477
478 /* We don't need to check for buffer overflow any more. */
479 while ((c = *qpatnext++) != EOS) {
480 switch (c) {
481 case LBRACKET:
482 c = *qpatnext;
483 if (c == NOT)
484 ++qpatnext;
485 if (*qpatnext == EOS ||
486 g_strchr(qpatnext+1, RBRACKET) == NULL) {
487 *bufnext++ = LBRACKET;
488 if (c == NOT)
489 --qpatnext;
490 break;
491 }
492 *bufnext++ = M_SET;
493 if (c == NOT)
494 *bufnext++ = M_NOT;
495 c = *qpatnext++;
496 do {
497 *bufnext++ = CHAR(c);
498 if (*qpatnext == RANGE &&
499 (c = qpatnext[1]) != RBRACKET) {
500 *bufnext++ = M_RNG;
501 *bufnext++ = CHAR(c);
502 qpatnext += 2;
503 }
504 } while ((c = *qpatnext++) != RBRACKET);
505 pglob->gl_flags |= GLOB_MAGCHAR;
506 *bufnext++ = M_END;
507 break;
508 case QUESTION:
509 pglob->gl_flags |= GLOB_MAGCHAR;
510 *bufnext++ = M_ONE;
511 break;
512 case STAR:
513 pglob->gl_flags |= GLOB_MAGCHAR;
514 /* collapse adjacent stars to one,
515 * to avoid exponential behavior
516 */
517 if (bufnext == patbuf || bufnext[-1] != M_ALL)
518 *bufnext++ = M_ALL;
519 break;
520 default:
521 *bufnext++ = CHAR(c);
522 break;
523 }
524 }
525 *bufnext = EOS;
526#ifdef DEBUG
527 qprintf("glob0:", patbuf);
528#endif
529
530 if ((err = glob1(patbuf, pglob, limit)) != 0)
531 return(err);
532
533 /*
534 * If there was no match we are going to append the pattern
535 * if GLOB_NOCHECK was specified or if GLOB_NOMAGIC was specified
536 * and the pattern did not contain any magic characters
537 * GLOB_NOMAGIC is there just for compatibility with csh.
538 */
539 if (pglob->gl_pathc == oldpathc) {
540 if (((pglob->gl_flags & GLOB_NOCHECK) ||
541 ((pglob->gl_flags & GLOB_NOMAGIC) &&
542 !(pglob->gl_flags & GLOB_MAGCHAR))))
543 return (globextend(pattern, pglob, limit));
544 else
545 return (GLOB_NOMATCH);
546 }
547 if (!(pglob->gl_flags & GLOB_NOSORT))
548 qsort(pglob->gl_pathv + pglob->gl_offs + oldpathc,
549 pglob->gl_pathc - oldpathc, sizeof(char *), compare);
550 return (0);
551}
552
553static int
554compare(const void *p, const void *q)
555{
556 return (strcmp(*(char **)p, *(char **)q));
557}
558
559static int
560glob1(Char *pattern, glob_t *pglob, struct glob_limit *limit)
561{
562 Char pathbuf[MAXPATHLEN];
563
564 /* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
565 if (*pattern == EOS)
566 return (0);
567 return (glob2(pathbuf, pathbuf, pathbuf + MAXPATHLEN - 1,
568 pattern, pglob, limit));
569}
570
571/*
572 * The functions glob2 and glob3 are mutually recursive; there is one level
573 * of recursion for each segment in the pattern that contains one or more
574 * meta characters.
575 */
576static int
577glob2(Char *pathbuf, Char *pathend, Char *pathend_last, Char *pattern,
578 glob_t *pglob, struct glob_limit *limit)
579{
580 struct stat sb;
581 Char *p, *q;
582 int anymeta;
583
584 /*
585 * Loop over pattern segments until end of pattern or until
586 * segment with meta character found.
587 */
588 for (anymeta = 0;;) {
589 if (*pattern == EOS) { /* End of pattern? */
590 *pathend = EOS;
591 if (g_lstat(pathbuf, &sb, pglob))
592 return (0);
593
594 if ((pglob->gl_flags & GLOB_LIMIT) &&
595 limit->l_stat_cnt++ >= GLOB_LIMIT_STAT) {
596 errno = 0;
597 if (pathend + 1 > pathend_last)
598 return (GLOB_ABORTED);
599 *pathend++ = SEP;
600 *pathend = EOS;
601 return (GLOB_NOSPACE);
602 }
603 if (((pglob->gl_flags & GLOB_MARK) &&
604 pathend[-1] != SEP) && (S_ISDIR(sb.st_mode)
605 || (S_ISLNK(sb.st_mode) &&
606 (g_stat(pathbuf, &sb, pglob) == 0) &&
607 S_ISDIR(sb.st_mode)))) {
608 if (pathend + 1 > pathend_last)
609 return (GLOB_ABORTED);
610 *pathend++ = SEP;
611 *pathend = EOS;
612 }
613 ++pglob->gl_matchc;
614 return (globextend(pathbuf, pglob, limit));
615 }
616
617 /* Find end of next segment, copy tentatively to pathend. */
618 q = pathend;
619 p = pattern;
620 while (*p != EOS && *p != SEP) {
621 if (ismeta(*p))
622 anymeta = 1;
623 if (q + 1 > pathend_last)
624 return (GLOB_ABORTED);
625 *q++ = *p++;
626 }
627
628 if (!anymeta) { /* No expansion, do next segment. */
629 pathend = q;
630 pattern = p;
631 while (*pattern == SEP) {
632 if (pathend + 1 > pathend_last)
633 return (GLOB_ABORTED);
634 *pathend++ = *pattern++;
635 }
636 } else /* Need expansion, recurse. */
637 return (glob3(pathbuf, pathend, pathend_last, pattern,
638 p, pglob, limit));
639 }
640 /* NOTREACHED */
641}
642
643static int
644glob3(Char *pathbuf, Char *pathend, Char *pathend_last,
645 Char *pattern, Char *restpattern,
646 glob_t *pglob, struct glob_limit *limit)
647{
648 struct dirent *dp;
649 DIR *dirp;
650 int err;
651 char buf[MAXPATHLEN];
652
653 struct dirent *(*readdirfunc)(DIR *);
654
655 if (pathend > pathend_last)
656 return (GLOB_ABORTED);
657 *pathend = EOS;
658 errno = 0;
659
660 if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
661 /* TODO: don't call for ENOENT or ENOTDIR? */
662 if (pglob->gl_errfunc) {
663 if (g_Ctoc(pathbuf, buf, sizeof(buf)))
664 return (GLOB_ABORTED);
665 if (pglob->gl_errfunc(buf, errno) ||
666 pglob->gl_flags & GLOB_ERR)
667 return (GLOB_ABORTED);
668 }
669 return (0);
670 }
671
672 err = 0;
673
674 /* pglob->gl_readdir takes a void *, fix this manually */
675 if (pglob->gl_flags & GLOB_ALTDIRFUNC)
676 readdirfunc = (struct dirent *(*)(DIR *))pglob->gl_readdir;
677 else
678 readdirfunc = readdir;
679
680 /* Search directory for matching names. */
681 while ((dp = (*readdirfunc)(dirp)) != NULL) {
682 char *sc;
683 Char *dc;
684 wchar_t wc;
685 size_t clen;
686 mbstate_t mbs;
687
688 if ((pglob->gl_flags & GLOB_LIMIT) &&
689 limit->l_readdir_cnt++ >= GLOB_LIMIT_READDIR) {
690 errno = 0;
691 if (pathend + 1 > pathend_last)
692 err = GLOB_ABORTED;
693 else {
694 *pathend++ = SEP;
695 *pathend = EOS;
696 err = GLOB_NOSPACE;
697 }
698 break;
699 }
700
701 /* Initial DOT must be matched literally. */
702 if (dp->d_name[0] == DOT && *pattern != DOT)
703 continue;
704 memset(&mbs, 0, sizeof(mbs));
705 dc = pathend;
706 sc = dp->d_name;
707 while (dc < pathend_last) {
708 clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
709 if (clen == (size_t)-1 || clen == (size_t)-2) {
710 wc = *sc;
711 clen = 1;
712 memset(&mbs, 0, sizeof(mbs));
713 }
714 if ((*dc++ = wc) == EOS)
715 break;
716 sc += clen;
717 }
718 if (!match(pathend, pattern, restpattern)) {
719 *pathend = EOS;
720 continue;
721 }
722 err = glob2(pathbuf, --dc, pathend_last, restpattern,
723 pglob, limit);
724 if (err)
725 break;
726 }
727
728 if (pglob->gl_flags & GLOB_ALTDIRFUNC)
729 (*pglob->gl_closedir)(dirp);
730 else
731 closedir(dirp);
732 return (err);
733}
734
735
736/*
737 * Extend the gl_pathv member of a glob_t structure to accommodate a new item,
738 * add the new item, and update gl_pathc.
739 *
740 * This assumes the BSD realloc, which only copies the block when its size
741 * crosses a power-of-two boundary; for v7 realloc, this would cause quadratic
742 * behavior.
743 *
744 * Return 0 if new item added, error code if memory couldn't be allocated.
745 *
746 * Invariant of the glob_t structure:
747 * Either gl_pathc is zero and gl_pathv is NULL; or gl_pathc > 0 and
748 * gl_pathv points to (gl_offs + gl_pathc + 1) items.
749 */
750static int
751globextend(const Char *path, glob_t *pglob, struct glob_limit *limit)
752{
753 char **pathv;
754 size_t i, newsize, len;
755 char *copy;
756 const Char *p;
757
758 if ((pglob->gl_flags & GLOB_LIMIT) &&
759 pglob->gl_matchc > limit->l_path_lim) {
760 errno = 0;
761 return (GLOB_NOSPACE);
762 }
763
764 newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs);
765 /* realloc(NULL, newsize) is equivalent to malloc(newsize). */
766 pathv = realloc((void *)pglob->gl_pathv, newsize);
767 if (pathv == NULL)
768 return (GLOB_NOSPACE);
769
770 if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
771 /* first time around -- clear initial gl_offs items */
772 pathv += pglob->gl_offs;
773 for (i = pglob->gl_offs + 1; --i > 0; )
774 *--pathv = NULL;
775 }
776 pglob->gl_pathv = pathv;
777
778 for (p = path; *p++;)
779 continue;
780 len = MB_CUR_MAX * (size_t)(p - path); /* XXX overallocation */
781 limit->l_string_cnt += len;
782 if ((pglob->gl_flags & GLOB_LIMIT) &&
783 limit->l_string_cnt >= GLOB_LIMIT_STRING) {
784 errno = 0;
785 return (GLOB_NOSPACE);
786 }
787 if ((copy = malloc(len)) != NULL) {
788 if (g_Ctoc(path, copy, len)) {
789 free(copy);
790 return (GLOB_NOSPACE);
791 }
792 pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
793 }
794 pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
795 return (copy == NULL ? GLOB_NOSPACE : 0);
796}
797
798/*
799 * pattern matching function for filenames. Each occurrence of the *
800 * pattern causes a recursion level.
801 */
802static int
803match(Char *name, Char *pat, Char *patend)
804{
805 int ok, negate_range;
806 Char c, k;
807 struct xlocale_collate *table =
808 (struct xlocale_collate*)__get_locale()->components[XLC_COLLATE];
809
810 while (pat < patend) {
811 c = *pat++;
812 switch (c & M_MASK) {
813 case M_ALL:
814 if (pat == patend)
815 return (1);
816 do
817 if (match(name, pat, patend))
818 return (1);
819 while (*name++ != EOS);
820 return (0);
821 case M_ONE:
822 if (*name++ == EOS)
823 return (0);
824 break;
825 case M_SET:
826 ok = 0;
827 if ((k = *name++) == EOS)
828 return (0);
829 if ((negate_range = ((*pat & M_MASK) == M_NOT)) != EOS)
830 ++pat;
831 while (((c = *pat++) & M_MASK) != M_END)
832 if ((*pat & M_MASK) == M_RNG) {
833 if (table->__collate_load_error ?
834 CHAR(c) <= CHAR(k) && CHAR(k) <= CHAR(pat[1]) :
| 43
44/*
45 * glob(3) -- a superset of the one defined in POSIX 1003.2.
46 *
47 * The [!...] convention to negate a range is supported (SysV, Posix, ksh).
48 *
49 * Optional extra services, controlled by flags not defined by POSIX:
50 *
51 * GLOB_QUOTE:
52 * Escaping convention: \ inhibits any special meaning the following
53 * character might have (except \ at end of string is retained).
54 * GLOB_MAGCHAR:
55 * Set in gl_flags if pattern contained a globbing character.
56 * GLOB_NOMAGIC:
57 * Same as GLOB_NOCHECK, but it will only append pattern if it did
58 * not contain any magic characters. [Used in csh style globbing]
59 * GLOB_ALTDIRFUNC:
60 * Use alternately specified directory access functions.
61 * GLOB_TILDE:
62 * expand ~user/foo to the /home/dir/of/user/foo
63 * GLOB_BRACE:
64 * expand {1,2}{a,b} to 1a 1b 2a 2b
65 * gl_matchc:
66 * Number of matches in the current invocation of glob.
67 */
68
69/*
70 * Some notes on multibyte character support:
71 * 1. Patterns with illegal byte sequences match nothing - even if
72 * GLOB_NOCHECK is specified.
73 * 2. Illegal byte sequences in filenames are handled by treating them as
74 * single-byte characters with a value of the first byte of the sequence
75 * cast to wchar_t.
76 * 3. State-dependent encodings are not currently supported.
77 */
78
79#include <sys/param.h>
80#include <sys/stat.h>
81
82#include <ctype.h>
83#include <dirent.h>
84#include <errno.h>
85#include <glob.h>
86#include <limits.h>
87#include <pwd.h>
88#include <stdint.h>
89#include <stdio.h>
90#include <stdlib.h>
91#include <string.h>
92#include <unistd.h>
93#include <wchar.h>
94
95#include "collate.h"
96
97/*
98 * glob(3) expansion limits. Stop the expansion if any of these limits
99 * is reached. This caps the runtime in the face of DoS attacks. See
100 * also CVE-2010-2632
101 */
102#define GLOB_LIMIT_BRACE 128 /* number of brace calls */
103#define GLOB_LIMIT_PATH 65536 /* number of path elements */
104#define GLOB_LIMIT_READDIR 16384 /* number of readdirs */
105#define GLOB_LIMIT_STAT 1024 /* number of stat system calls */
106#define GLOB_LIMIT_STRING ARG_MAX /* maximum total size for paths */
107
108struct glob_limit {
109 size_t l_brace_cnt;
110 size_t l_path_lim;
111 size_t l_readdir_cnt;
112 size_t l_stat_cnt;
113 size_t l_string_cnt;
114};
115
116#define DOLLAR '$'
117#define DOT '.'
118#define EOS '\0'
119#define LBRACKET '['
120#define NOT '!'
121#define QUESTION '?'
122#define QUOTE '\\'
123#define RANGE '-'
124#define RBRACKET ']'
125#define SEP '/'
126#define STAR '*'
127#define TILDE '~'
128#define UNDERSCORE '_'
129#define LBRACE '{'
130#define RBRACE '}'
131#define SLASH '/'
132#define COMMA ','
133
134#ifndef DEBUG
135
136#define M_QUOTE 0x8000000000ULL
137#define M_PROTECT 0x4000000000ULL
138#define M_MASK 0xffffffffffULL
139#define M_CHAR 0x00ffffffffULL
140
141typedef uint_fast64_t Char;
142
143#else
144
145#define M_QUOTE 0x80
146#define M_PROTECT 0x40
147#define M_MASK 0xff
148#define M_CHAR 0x7f
149
150typedef char Char;
151
152#endif
153
154
155#define CHAR(c) ((Char)((c)&M_CHAR))
156#define META(c) ((Char)((c)|M_QUOTE))
157#define M_ALL META('*')
158#define M_END META(']')
159#define M_NOT META('!')
160#define M_ONE META('?')
161#define M_RNG META('-')
162#define M_SET META('[')
163#define ismeta(c) (((c)&M_QUOTE) != 0)
164
165
166static int compare(const void *, const void *);
167static int g_Ctoc(const Char *, char *, size_t);
168static int g_lstat(Char *, struct stat *, glob_t *);
169static DIR *g_opendir(Char *, glob_t *);
170static const Char *g_strchr(const Char *, wchar_t);
171#ifdef notdef
172static Char *g_strcat(Char *, const Char *);
173#endif
174static int g_stat(Char *, struct stat *, glob_t *);
175static int glob0(const Char *, glob_t *, struct glob_limit *);
176static int glob1(Char *, glob_t *, struct glob_limit *);
177static int glob2(Char *, Char *, Char *, Char *, glob_t *,
178 struct glob_limit *);
179static int glob3(Char *, Char *, Char *, Char *, Char *, glob_t *,
180 struct glob_limit *);
181static int globextend(const Char *, glob_t *, struct glob_limit *);
182static const Char *
183 globtilde(const Char *, Char *, size_t, glob_t *);
184static int globexp1(const Char *, glob_t *, struct glob_limit *);
185static int globexp2(const Char *, const Char *, glob_t *, int *,
186 struct glob_limit *);
187static int match(Char *, Char *, Char *);
188#ifdef DEBUG
189static void qprintf(const char *, Char *);
190#endif
191
192int
193glob(const char * __restrict pattern, int flags,
194 int (*errfunc)(const char *, int), glob_t * __restrict pglob)
195{
196 struct glob_limit limit = { 0, 0, 0, 0, 0 };
197 const char *patnext;
198 Char *bufnext, *bufend, patbuf[MAXPATHLEN], prot;
199 mbstate_t mbs;
200 wchar_t wc;
201 size_t clen;
202
203 patnext = pattern;
204 if (!(flags & GLOB_APPEND)) {
205 pglob->gl_pathc = 0;
206 pglob->gl_pathv = NULL;
207 if (!(flags & GLOB_DOOFFS))
208 pglob->gl_offs = 0;
209 }
210 if (flags & GLOB_LIMIT) {
211 limit.l_path_lim = pglob->gl_matchc;
212 if (limit.l_path_lim == 0)
213 limit.l_path_lim = GLOB_LIMIT_PATH;
214 }
215 pglob->gl_flags = flags & ~GLOB_MAGCHAR;
216 pglob->gl_errfunc = errfunc;
217 pglob->gl_matchc = 0;
218
219 bufnext = patbuf;
220 bufend = bufnext + MAXPATHLEN - 1;
221 if (flags & GLOB_NOESCAPE) {
222 memset(&mbs, 0, sizeof(mbs));
223 while (bufend - bufnext >= MB_CUR_MAX) {
224 clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
225 if (clen == (size_t)-1 || clen == (size_t)-2)
226 return (GLOB_NOMATCH);
227 else if (clen == 0)
228 break;
229 *bufnext++ = wc;
230 patnext += clen;
231 }
232 } else {
233 /* Protect the quoted characters. */
234 memset(&mbs, 0, sizeof(mbs));
235 while (bufend - bufnext >= MB_CUR_MAX) {
236 if (*patnext == QUOTE) {
237 if (*++patnext == EOS) {
238 *bufnext++ = QUOTE | M_PROTECT;
239 continue;
240 }
241 prot = M_PROTECT;
242 } else
243 prot = 0;
244 clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
245 if (clen == (size_t)-1 || clen == (size_t)-2)
246 return (GLOB_NOMATCH);
247 else if (clen == 0)
248 break;
249 *bufnext++ = wc | prot;
250 patnext += clen;
251 }
252 }
253 *bufnext = EOS;
254
255 if (flags & GLOB_BRACE)
256 return (globexp1(patbuf, pglob, &limit));
257 else
258 return (glob0(patbuf, pglob, &limit));
259}
260
261/*
262 * Expand recursively a glob {} pattern. When there is no more expansion
263 * invoke the standard globbing routine to glob the rest of the magic
264 * characters
265 */
266static int
267globexp1(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
268{
269 const Char* ptr = pattern;
270 int rv;
271
272 if ((pglob->gl_flags & GLOB_LIMIT) &&
273 limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
274 errno = 0;
275 return (GLOB_NOSPACE);
276 }
277
278 /* Protect a single {}, for find(1), like csh */
279 if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS)
280 return glob0(pattern, pglob, limit);
281
282 while ((ptr = g_strchr(ptr, LBRACE)) != NULL)
283 if (!globexp2(ptr, pattern, pglob, &rv, limit))
284 return rv;
285
286 return glob0(pattern, pglob, limit);
287}
288
289
290/*
291 * Recursive brace globbing helper. Tries to expand a single brace.
292 * If it succeeds then it invokes globexp1 with the new pattern.
293 * If it fails then it tries to glob the rest of the pattern and returns.
294 */
295static int
296globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv,
297 struct glob_limit *limit)
298{
299 int i;
300 Char *lm, *ls;
301 const Char *pe, *pm, *pm1, *pl;
302 Char patbuf[MAXPATHLEN];
303
304 /* copy part up to the brace */
305 for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
306 continue;
307 *lm = EOS;
308 ls = lm;
309
310 /* Find the balanced brace */
311 for (i = 0, pe = ++ptr; *pe; pe++)
312 if (*pe == LBRACKET) {
313 /* Ignore everything between [] */
314 for (pm = pe++; *pe != RBRACKET && *pe != EOS; pe++)
315 continue;
316 if (*pe == EOS) {
317 /*
318 * We could not find a matching RBRACKET.
319 * Ignore and just look for RBRACE
320 */
321 pe = pm;
322 }
323 }
324 else if (*pe == LBRACE)
325 i++;
326 else if (*pe == RBRACE) {
327 if (i == 0)
328 break;
329 i--;
330 }
331
332 /* Non matching braces; just glob the pattern */
333 if (i != 0 || *pe == EOS) {
334 *rv = glob0(patbuf, pglob, limit);
335 return (0);
336 }
337
338 for (i = 0, pl = pm = ptr; pm <= pe; pm++)
339 switch (*pm) {
340 case LBRACKET:
341 /* Ignore everything between [] */
342 for (pm1 = pm++; *pm != RBRACKET && *pm != EOS; pm++)
343 continue;
344 if (*pm == EOS) {
345 /*
346 * We could not find a matching RBRACKET.
347 * Ignore and just look for RBRACE
348 */
349 pm = pm1;
350 }
351 break;
352
353 case LBRACE:
354 i++;
355 break;
356
357 case RBRACE:
358 if (i) {
359 i--;
360 break;
361 }
362 /* FALLTHROUGH */
363 case COMMA:
364 if (i && *pm == COMMA)
365 break;
366 else {
367 /* Append the current string */
368 for (lm = ls; (pl < pm); *lm++ = *pl++)
369 continue;
370 /*
371 * Append the rest of the pattern after the
372 * closing brace
373 */
374 for (pl = pe + 1; (*lm++ = *pl++) != EOS;)
375 continue;
376
377 /* Expand the current pattern */
378#ifdef DEBUG
379 qprintf("globexp2:", patbuf);
380#endif
381 *rv = globexp1(patbuf, pglob, limit);
382
383 /* move after the comma, to the next string */
384 pl = pm + 1;
385 }
386 break;
387
388 default:
389 break;
390 }
391 *rv = 0;
392 return (0);
393}
394
395
396
397/*
398 * expand tilde from the passwd file.
399 */
400static const Char *
401globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
402{
403 struct passwd *pwd;
404 char *h;
405 const Char *p;
406 Char *b, *eb;
407
408 if (*pattern != TILDE || !(pglob->gl_flags & GLOB_TILDE))
409 return (pattern);
410
411 /*
412 * Copy up to the end of the string or /
413 */
414 eb = &patbuf[patbuf_len - 1];
415 for (p = pattern + 1, h = (char *) patbuf;
416 h < (char *)eb && *p && *p != SLASH; *h++ = *p++)
417 continue;
418
419 *h = EOS;
420
421 if (((char *) patbuf)[0] == EOS) {
422 /*
423 * handle a plain ~ or ~/ by expanding $HOME first (iff
424 * we're not running setuid or setgid) and then trying
425 * the password file
426 */
427 if (issetugid() != 0 ||
428 (h = getenv("HOME")) == NULL) {
429 if (((h = getlogin()) != NULL &&
430 (pwd = getpwnam(h)) != NULL) ||
431 (pwd = getpwuid(getuid())) != NULL)
432 h = pwd->pw_dir;
433 else
434 return (pattern);
435 }
436 }
437 else {
438 /*
439 * Expand a ~user
440 */
441 if ((pwd = getpwnam((char*) patbuf)) == NULL)
442 return (pattern);
443 else
444 h = pwd->pw_dir;
445 }
446
447 /* Copy the home directory */
448 for (b = patbuf; b < eb && *h; *b++ = *h++)
449 continue;
450
451 /* Append the rest of the pattern */
452 while (b < eb && (*b++ = *p++) != EOS)
453 continue;
454 *b = EOS;
455
456 return (patbuf);
457}
458
459
460/*
461 * The main glob() routine: compiles the pattern (optionally processing
462 * quotes), calls glob1() to do the real pattern matching, and finally
463 * sorts the list (unless unsorted operation is requested). Returns 0
464 * if things went well, nonzero if errors occurred.
465 */
466static int
467glob0(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
468{
469 const Char *qpatnext;
470 int err;
471 size_t oldpathc;
472 Char *bufnext, c, patbuf[MAXPATHLEN];
473
474 qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
475 oldpathc = pglob->gl_pathc;
476 bufnext = patbuf;
477
478 /* We don't need to check for buffer overflow any more. */
479 while ((c = *qpatnext++) != EOS) {
480 switch (c) {
481 case LBRACKET:
482 c = *qpatnext;
483 if (c == NOT)
484 ++qpatnext;
485 if (*qpatnext == EOS ||
486 g_strchr(qpatnext+1, RBRACKET) == NULL) {
487 *bufnext++ = LBRACKET;
488 if (c == NOT)
489 --qpatnext;
490 break;
491 }
492 *bufnext++ = M_SET;
493 if (c == NOT)
494 *bufnext++ = M_NOT;
495 c = *qpatnext++;
496 do {
497 *bufnext++ = CHAR(c);
498 if (*qpatnext == RANGE &&
499 (c = qpatnext[1]) != RBRACKET) {
500 *bufnext++ = M_RNG;
501 *bufnext++ = CHAR(c);
502 qpatnext += 2;
503 }
504 } while ((c = *qpatnext++) != RBRACKET);
505 pglob->gl_flags |= GLOB_MAGCHAR;
506 *bufnext++ = M_END;
507 break;
508 case QUESTION:
509 pglob->gl_flags |= GLOB_MAGCHAR;
510 *bufnext++ = M_ONE;
511 break;
512 case STAR:
513 pglob->gl_flags |= GLOB_MAGCHAR;
514 /* collapse adjacent stars to one,
515 * to avoid exponential behavior
516 */
517 if (bufnext == patbuf || bufnext[-1] != M_ALL)
518 *bufnext++ = M_ALL;
519 break;
520 default:
521 *bufnext++ = CHAR(c);
522 break;
523 }
524 }
525 *bufnext = EOS;
526#ifdef DEBUG
527 qprintf("glob0:", patbuf);
528#endif
529
530 if ((err = glob1(patbuf, pglob, limit)) != 0)
531 return(err);
532
533 /*
534 * If there was no match we are going to append the pattern
535 * if GLOB_NOCHECK was specified or if GLOB_NOMAGIC was specified
536 * and the pattern did not contain any magic characters
537 * GLOB_NOMAGIC is there just for compatibility with csh.
538 */
539 if (pglob->gl_pathc == oldpathc) {
540 if (((pglob->gl_flags & GLOB_NOCHECK) ||
541 ((pglob->gl_flags & GLOB_NOMAGIC) &&
542 !(pglob->gl_flags & GLOB_MAGCHAR))))
543 return (globextend(pattern, pglob, limit));
544 else
545 return (GLOB_NOMATCH);
546 }
547 if (!(pglob->gl_flags & GLOB_NOSORT))
548 qsort(pglob->gl_pathv + pglob->gl_offs + oldpathc,
549 pglob->gl_pathc - oldpathc, sizeof(char *), compare);
550 return (0);
551}
552
553static int
554compare(const void *p, const void *q)
555{
556 return (strcmp(*(char **)p, *(char **)q));
557}
558
559static int
560glob1(Char *pattern, glob_t *pglob, struct glob_limit *limit)
561{
562 Char pathbuf[MAXPATHLEN];
563
564 /* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
565 if (*pattern == EOS)
566 return (0);
567 return (glob2(pathbuf, pathbuf, pathbuf + MAXPATHLEN - 1,
568 pattern, pglob, limit));
569}
570
571/*
572 * The functions glob2 and glob3 are mutually recursive; there is one level
573 * of recursion for each segment in the pattern that contains one or more
574 * meta characters.
575 */
576static int
577glob2(Char *pathbuf, Char *pathend, Char *pathend_last, Char *pattern,
578 glob_t *pglob, struct glob_limit *limit)
579{
580 struct stat sb;
581 Char *p, *q;
582 int anymeta;
583
584 /*
585 * Loop over pattern segments until end of pattern or until
586 * segment with meta character found.
587 */
588 for (anymeta = 0;;) {
589 if (*pattern == EOS) { /* End of pattern? */
590 *pathend = EOS;
591 if (g_lstat(pathbuf, &sb, pglob))
592 return (0);
593
594 if ((pglob->gl_flags & GLOB_LIMIT) &&
595 limit->l_stat_cnt++ >= GLOB_LIMIT_STAT) {
596 errno = 0;
597 if (pathend + 1 > pathend_last)
598 return (GLOB_ABORTED);
599 *pathend++ = SEP;
600 *pathend = EOS;
601 return (GLOB_NOSPACE);
602 }
603 if (((pglob->gl_flags & GLOB_MARK) &&
604 pathend[-1] != SEP) && (S_ISDIR(sb.st_mode)
605 || (S_ISLNK(sb.st_mode) &&
606 (g_stat(pathbuf, &sb, pglob) == 0) &&
607 S_ISDIR(sb.st_mode)))) {
608 if (pathend + 1 > pathend_last)
609 return (GLOB_ABORTED);
610 *pathend++ = SEP;
611 *pathend = EOS;
612 }
613 ++pglob->gl_matchc;
614 return (globextend(pathbuf, pglob, limit));
615 }
616
617 /* Find end of next segment, copy tentatively to pathend. */
618 q = pathend;
619 p = pattern;
620 while (*p != EOS && *p != SEP) {
621 if (ismeta(*p))
622 anymeta = 1;
623 if (q + 1 > pathend_last)
624 return (GLOB_ABORTED);
625 *q++ = *p++;
626 }
627
628 if (!anymeta) { /* No expansion, do next segment. */
629 pathend = q;
630 pattern = p;
631 while (*pattern == SEP) {
632 if (pathend + 1 > pathend_last)
633 return (GLOB_ABORTED);
634 *pathend++ = *pattern++;
635 }
636 } else /* Need expansion, recurse. */
637 return (glob3(pathbuf, pathend, pathend_last, pattern,
638 p, pglob, limit));
639 }
640 /* NOTREACHED */
641}
642
643static int
644glob3(Char *pathbuf, Char *pathend, Char *pathend_last,
645 Char *pattern, Char *restpattern,
646 glob_t *pglob, struct glob_limit *limit)
647{
648 struct dirent *dp;
649 DIR *dirp;
650 int err;
651 char buf[MAXPATHLEN];
652
653 struct dirent *(*readdirfunc)(DIR *);
654
655 if (pathend > pathend_last)
656 return (GLOB_ABORTED);
657 *pathend = EOS;
658 errno = 0;
659
660 if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
661 /* TODO: don't call for ENOENT or ENOTDIR? */
662 if (pglob->gl_errfunc) {
663 if (g_Ctoc(pathbuf, buf, sizeof(buf)))
664 return (GLOB_ABORTED);
665 if (pglob->gl_errfunc(buf, errno) ||
666 pglob->gl_flags & GLOB_ERR)
667 return (GLOB_ABORTED);
668 }
669 return (0);
670 }
671
672 err = 0;
673
674 /* pglob->gl_readdir takes a void *, fix this manually */
675 if (pglob->gl_flags & GLOB_ALTDIRFUNC)
676 readdirfunc = (struct dirent *(*)(DIR *))pglob->gl_readdir;
677 else
678 readdirfunc = readdir;
679
680 /* Search directory for matching names. */
681 while ((dp = (*readdirfunc)(dirp)) != NULL) {
682 char *sc;
683 Char *dc;
684 wchar_t wc;
685 size_t clen;
686 mbstate_t mbs;
687
688 if ((pglob->gl_flags & GLOB_LIMIT) &&
689 limit->l_readdir_cnt++ >= GLOB_LIMIT_READDIR) {
690 errno = 0;
691 if (pathend + 1 > pathend_last)
692 err = GLOB_ABORTED;
693 else {
694 *pathend++ = SEP;
695 *pathend = EOS;
696 err = GLOB_NOSPACE;
697 }
698 break;
699 }
700
701 /* Initial DOT must be matched literally. */
702 if (dp->d_name[0] == DOT && *pattern != DOT)
703 continue;
704 memset(&mbs, 0, sizeof(mbs));
705 dc = pathend;
706 sc = dp->d_name;
707 while (dc < pathend_last) {
708 clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
709 if (clen == (size_t)-1 || clen == (size_t)-2) {
710 wc = *sc;
711 clen = 1;
712 memset(&mbs, 0, sizeof(mbs));
713 }
714 if ((*dc++ = wc) == EOS)
715 break;
716 sc += clen;
717 }
718 if (!match(pathend, pattern, restpattern)) {
719 *pathend = EOS;
720 continue;
721 }
722 err = glob2(pathbuf, --dc, pathend_last, restpattern,
723 pglob, limit);
724 if (err)
725 break;
726 }
727
728 if (pglob->gl_flags & GLOB_ALTDIRFUNC)
729 (*pglob->gl_closedir)(dirp);
730 else
731 closedir(dirp);
732 return (err);
733}
734
735
736/*
737 * Extend the gl_pathv member of a glob_t structure to accommodate a new item,
738 * add the new item, and update gl_pathc.
739 *
740 * This assumes the BSD realloc, which only copies the block when its size
741 * crosses a power-of-two boundary; for v7 realloc, this would cause quadratic
742 * behavior.
743 *
744 * Return 0 if new item added, error code if memory couldn't be allocated.
745 *
746 * Invariant of the glob_t structure:
747 * Either gl_pathc is zero and gl_pathv is NULL; or gl_pathc > 0 and
748 * gl_pathv points to (gl_offs + gl_pathc + 1) items.
749 */
750static int
751globextend(const Char *path, glob_t *pglob, struct glob_limit *limit)
752{
753 char **pathv;
754 size_t i, newsize, len;
755 char *copy;
756 const Char *p;
757
758 if ((pglob->gl_flags & GLOB_LIMIT) &&
759 pglob->gl_matchc > limit->l_path_lim) {
760 errno = 0;
761 return (GLOB_NOSPACE);
762 }
763
764 newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs);
765 /* realloc(NULL, newsize) is equivalent to malloc(newsize). */
766 pathv = realloc((void *)pglob->gl_pathv, newsize);
767 if (pathv == NULL)
768 return (GLOB_NOSPACE);
769
770 if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
771 /* first time around -- clear initial gl_offs items */
772 pathv += pglob->gl_offs;
773 for (i = pglob->gl_offs + 1; --i > 0; )
774 *--pathv = NULL;
775 }
776 pglob->gl_pathv = pathv;
777
778 for (p = path; *p++;)
779 continue;
780 len = MB_CUR_MAX * (size_t)(p - path); /* XXX overallocation */
781 limit->l_string_cnt += len;
782 if ((pglob->gl_flags & GLOB_LIMIT) &&
783 limit->l_string_cnt >= GLOB_LIMIT_STRING) {
784 errno = 0;
785 return (GLOB_NOSPACE);
786 }
787 if ((copy = malloc(len)) != NULL) {
788 if (g_Ctoc(path, copy, len)) {
789 free(copy);
790 return (GLOB_NOSPACE);
791 }
792 pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
793 }
794 pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
795 return (copy == NULL ? GLOB_NOSPACE : 0);
796}
797
798/*
799 * pattern matching function for filenames. Each occurrence of the *
800 * pattern causes a recursion level.
801 */
802static int
803match(Char *name, Char *pat, Char *patend)
804{
805 int ok, negate_range;
806 Char c, k;
807 struct xlocale_collate *table =
808 (struct xlocale_collate*)__get_locale()->components[XLC_COLLATE];
809
810 while (pat < patend) {
811 c = *pat++;
812 switch (c & M_MASK) {
813 case M_ALL:
814 if (pat == patend)
815 return (1);
816 do
817 if (match(name, pat, patend))
818 return (1);
819 while (*name++ != EOS);
820 return (0);
821 case M_ONE:
822 if (*name++ == EOS)
823 return (0);
824 break;
825 case M_SET:
826 ok = 0;
827 if ((k = *name++) == EOS)
828 return (0);
829 if ((negate_range = ((*pat & M_MASK) == M_NOT)) != EOS)
830 ++pat;
831 while (((c = *pat++) & M_MASK) != M_END)
832 if ((*pat & M_MASK) == M_RNG) {
833 if (table->__collate_load_error ?
834 CHAR(c) <= CHAR(k) && CHAR(k) <= CHAR(pat[1]) :
|