1/*
2 * Copyright (c) 1989, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * This code is derived from software contributed to Berkeley by
6 * Guido van Rossum.
7 *
8 * Copyright (c) 2011 The FreeBSD Foundation
9 * All rights reserved.
10 * Portions of this software were developed by David Chisnall
11 * under sponsorship from the FreeBSD Foundation.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 *    notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 *    notice, this list of conditions and the following disclaimer in the
20 *    documentation and/or other materials provided with the distribution.
21 * 4. Neither the name of the University nor the names of its contributors
22 *    may be used to endorse or promote products derived from this software
23 *    without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 */
37
38#if defined(LIBC_SCCS) && !defined(lint)
39static char sccsid[] = "@(#)glob.c	8.3 (Berkeley) 10/13/93";
40#endif /* LIBC_SCCS and not lint */
41#include <sys/cdefs.h>
42__FBSDID("$FreeBSD: stable/11/lib/libc/gen/glob.c 316613 2017-04-07 16:08:04Z pfg $");
43
44/*
45 * glob(3) -- a superset of the one defined in POSIX 1003.2.
46 *
47 * The [!...] convention to negate a range is supported (SysV, Posix, ksh).
48 *
49 * Optional extra services, controlled by flags not defined by POSIX:
50 *
51 * GLOB_QUOTE:
52 *	Escaping convention: \ inhibits any special meaning the following
53 *	character might have (except \ at end of string is retained).
54 * GLOB_MAGCHAR:
55 *	Set in gl_flags if pattern contained a globbing character.
56 * GLOB_NOMAGIC:
57 *	Same as GLOB_NOCHECK, but it will only append pattern if it did
58 *	not contain any magic characters.  [Used in csh style globbing]
59 * GLOB_ALTDIRFUNC:
60 *	Use alternately specified directory access functions.
61 * GLOB_TILDE:
62 *	expand ~user/foo to the /home/dir/of/user/foo
63 * GLOB_BRACE:
64 *	expand {1,2}{a,b} to 1a 1b 2a 2b
65 * gl_matchc:
66 *	Number of matches in the current invocation of glob.
67 */
68
69/*
70 * Some notes on multibyte character support:
71 * 1. Patterns with illegal byte sequences match nothing - even if
72 *    GLOB_NOCHECK is specified.
73 * 2. Illegal byte sequences in filenames are handled by treating them as
74 *    single-byte characters with a values of such bytes of the sequence
75 *    cast to wchar_t.
76 * 3. State-dependent encodings are not currently supported.
77 */
78
79#include <sys/param.h>
80#include <sys/stat.h>
81
82#include <ctype.h>
83#include <dirent.h>
84#include <errno.h>
85#include <glob.h>
86#include <limits.h>
87#include <pwd.h>
88#include <stdint.h>
89#include <stdio.h>
90#include <stdlib.h>
91#include <string.h>
92#include <unistd.h>
93#include <wchar.h>
94
95#include "collate.h"
96
97/*
98 * glob(3) expansion limits. Stop the expansion if any of these limits
99 * is reached. This caps the runtime in the face of DoS attacks. See
100 * also CVE-2010-2632
101 */
102#define	GLOB_LIMIT_BRACE	128	/* number of brace calls */
103#define	GLOB_LIMIT_PATH		65536	/* number of path elements */
104#define	GLOB_LIMIT_READDIR	16384	/* number of readdirs */
105#define	GLOB_LIMIT_STAT		1024	/* number of stat system calls */
106#define	GLOB_LIMIT_STRING	ARG_MAX	/* maximum total size for paths */
107
108struct glob_limit {
109	size_t	l_brace_cnt;
110	size_t	l_path_lim;
111	size_t	l_readdir_cnt;
112	size_t	l_stat_cnt;
113	size_t	l_string_cnt;
114};
115
116#define	DOT		L'.'
117#define	EOS		L'\0'
118#define	LBRACKET	L'['
119#define	NOT		L'!'
120#define	QUESTION	L'?'
121#define	QUOTE		L'\\'
122#define	RANGE		L'-'
123#define	RBRACKET	L']'
124#define	SEP		L'/'
125#define	STAR		L'*'
126#define	TILDE		L'~'
127#define	LBRACE		L'{'
128#define	RBRACE		L'}'
129#define	COMMA		L','
130
131#define	M_QUOTE		0x8000000000ULL
132#define	M_PROTECT	0x4000000000ULL
133#define	M_MASK		0xffffffffffULL
134#define	M_CHAR		0x00ffffffffULL
135
136typedef uint_fast64_t Char;
137
138#define	CHAR(c)		((Char)((c)&M_CHAR))
139#define	META(c)		((Char)((c)|M_QUOTE))
140#define	UNPROT(c)	((c) & ~M_PROTECT)
141#define	M_ALL		META(L'*')
142#define	M_END		META(L']')
143#define	M_NOT		META(L'!')
144#define	M_ONE		META(L'?')
145#define	M_RNG		META(L'-')
146#define	M_SET		META(L'[')
147#define	ismeta(c)	(((c)&M_QUOTE) != 0)
148#ifdef DEBUG
149#define	isprot(c)	(((c)&M_PROTECT) != 0)
150#endif
151
152static int	 compare(const void *, const void *);
153static int	 g_Ctoc(const Char *, char *, size_t);
154static int	 g_lstat(Char *, struct stat *, glob_t *);
155static DIR	*g_opendir(Char *, glob_t *);
156static const Char *g_strchr(const Char *, wchar_t);
157#ifdef notdef
158static Char	*g_strcat(Char *, const Char *);
159#endif
160static int	 g_stat(Char *, struct stat *, glob_t *);
161static int	 glob0(const Char *, glob_t *, struct glob_limit *,
162    const char *);
163static int	 glob1(Char *, glob_t *, struct glob_limit *);
164static int	 glob2(Char *, Char *, Char *, Char *, glob_t *,
165    struct glob_limit *);
166static int	 glob3(Char *, Char *, Char *, Char *, Char *, glob_t *,
167    struct glob_limit *);
168static int	 globextend(const Char *, glob_t *, struct glob_limit *,
169    const char *);
170static const Char *
171		 globtilde(const Char *, Char *, size_t, glob_t *);
172static int	 globexp0(const Char *, glob_t *, struct glob_limit *,
173    const char *);
174static int	 globexp1(const Char *, glob_t *, struct glob_limit *);
175static int	 globexp2(const Char *, const Char *, glob_t *,
176    struct glob_limit *);
177static int	 globfinal(glob_t *, struct glob_limit *, size_t,
178    const char *);
179static int	 match(Char *, Char *, Char *);
180static int	 err_nomatch(glob_t *, struct glob_limit *, const char *);
181static int	 err_aborted(glob_t *, int, char *);
182#ifdef DEBUG
183static void	 qprintf(const char *, Char *);
184#endif
185
186int
187glob(const char * __restrict pattern, int flags,
188	 int (*errfunc)(const char *, int), glob_t * __restrict pglob)
189{
190	struct glob_limit limit = { 0, 0, 0, 0, 0 };
191	const char *patnext;
192	Char *bufnext, *bufend, patbuf[MAXPATHLEN], prot;
193	mbstate_t mbs;
194	wchar_t wc;
195	size_t clen;
196	int too_long;
197
198	patnext = pattern;
199	if (!(flags & GLOB_APPEND)) {
200		pglob->gl_pathc = 0;
201		pglob->gl_pathv = NULL;
202		if (!(flags & GLOB_DOOFFS))
203			pglob->gl_offs = 0;
204	}
205	if (flags & GLOB_LIMIT) {
206		limit.l_path_lim = pglob->gl_matchc;
207		if (limit.l_path_lim == 0)
208			limit.l_path_lim = GLOB_LIMIT_PATH;
209	}
210	pglob->gl_flags = flags & ~GLOB_MAGCHAR;
211	pglob->gl_errfunc = errfunc;
212	pglob->gl_matchc = 0;
213
214	bufnext = patbuf;
215	bufend = bufnext + MAXPATHLEN - 1;
216	too_long = 1;
217	if (flags & GLOB_NOESCAPE) {
218		memset(&mbs, 0, sizeof(mbs));
219		while (bufnext <= bufend) {
220			clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
221			if (clen == (size_t)-1 || clen == (size_t)-2)
222				return (err_nomatch(pglob, &limit, pattern));
223			else if (clen == 0) {
224				too_long = 0;
225				break;
226			}
227			*bufnext++ = wc;
228			patnext += clen;
229		}
230	} else {
231		/* Protect the quoted characters. */
232		memset(&mbs, 0, sizeof(mbs));
233		while (bufnext <= bufend) {
234			if (*patnext == '\\') {
235				if (*++patnext == '\0') {
236					*bufnext++ = QUOTE;
237					continue;
238				}
239				prot = M_PROTECT;
240			} else
241				prot = 0;
242			clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
243			if (clen == (size_t)-1 || clen == (size_t)-2)
244				return (err_nomatch(pglob, &limit, pattern));
245			else if (clen == 0) {
246				too_long = 0;
247				break;
248			}
249			*bufnext++ = wc | prot;
250			patnext += clen;
251		}
252	}
253	if (too_long)
254		return (err_nomatch(pglob, &limit, pattern));
255	*bufnext = EOS;
256
257	if (flags & GLOB_BRACE)
258	    return (globexp0(patbuf, pglob, &limit, pattern));
259	else
260	    return (glob0(patbuf, pglob, &limit, pattern));
261}
262
263static int
264globexp0(const Char *pattern, glob_t *pglob, struct glob_limit *limit,
265    const char *origpat) {
266	int rv;
267	size_t oldpathc;
268
269	/* Protect a single {}, for find(1), like csh */
270	if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS) {
271		if ((pglob->gl_flags & GLOB_LIMIT) &&
272		    limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
273			errno = E2BIG;
274			return (GLOB_NOSPACE);
275		}
276		return (glob0(pattern, pglob, limit, origpat));
277	}
278
279	oldpathc = pglob->gl_pathc;
280
281	if ((rv = globexp1(pattern, pglob, limit)) != 0)
282		return rv;
283
284	return (globfinal(pglob, limit, oldpathc, origpat));
285}
286
287/*
288 * Expand recursively a glob {} pattern. When there is no more expansion
289 * invoke the standard globbing routine to glob the rest of the magic
290 * characters
291 */
292static int
293globexp1(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
294{
295	const Char* ptr;
296
297	if ((ptr = g_strchr(pattern, LBRACE)) != NULL) {
298		if ((pglob->gl_flags & GLOB_LIMIT) &&
299		    limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
300			errno = E2BIG;
301			return (GLOB_NOSPACE);
302		}
303		return (globexp2(ptr, pattern, pglob, limit));
304	}
305
306	return (glob0(pattern, pglob, limit, NULL));
307}
308
309
310/*
311 * Recursive brace globbing helper. Tries to expand a single brace.
312 * If it succeeds then it invokes globexp1 with the new pattern.
313 * If it fails then it tries to glob the rest of the pattern and returns.
314 */
315static int
316globexp2(const Char *ptr, const Char *pattern, glob_t *pglob,
317    struct glob_limit *limit)
318{
319	int     i, rv;
320	Char   *lm, *ls;
321	const Char *pe, *pm, *pm1, *pl;
322	Char    patbuf[MAXPATHLEN];
323
324	/* copy part up to the brace */
325	for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
326		continue;
327	*lm = EOS;
328	ls = lm;
329
330	/* Find the balanced brace */
331	for (i = 0, pe = ++ptr; *pe != EOS; pe++)
332		if (*pe == LBRACKET) {
333			/* Ignore everything between [] */
334			for (pm = pe++; *pe != RBRACKET && *pe != EOS; pe++)
335				continue;
336			if (*pe == EOS) {
337				/*
338				 * We could not find a matching RBRACKET.
339				 * Ignore and just look for RBRACE
340				 */
341				pe = pm;
342			}
343		}
344		else if (*pe == LBRACE)
345			i++;
346		else if (*pe == RBRACE) {
347			if (i == 0)
348				break;
349			i--;
350		}
351
352	/* Non matching braces; just glob the pattern */
353	if (i != 0 || *pe == EOS)
354		return (glob0(pattern, pglob, limit, NULL));
355
356	for (i = 0, pl = pm = ptr; pm <= pe; pm++)
357		switch (*pm) {
358		case LBRACKET:
359			/* Ignore everything between [] */
360			for (pm1 = pm++; *pm != RBRACKET && *pm != EOS; pm++)
361				continue;
362			if (*pm == EOS) {
363				/*
364				 * We could not find a matching RBRACKET.
365				 * Ignore and just look for RBRACE
366				 */
367				pm = pm1;
368			}
369			break;
370
371		case LBRACE:
372			i++;
373			break;
374
375		case RBRACE:
376			if (i) {
377			    i--;
378			    break;
379			}
380			/* FALLTHROUGH */
381		case COMMA:
382			if (i && *pm == COMMA)
383				break;
384			else {
385				/* Append the current string */
386				for (lm = ls; (pl < pm); *lm++ = *pl++)
387					continue;
388				/*
389				 * Append the rest of the pattern after the
390				 * closing brace
391				 */
392				for (pl = pe + 1; (*lm++ = *pl++) != EOS;)
393					continue;
394
395				/* Expand the current pattern */
396#ifdef DEBUG
397				qprintf("globexp2:", patbuf);
398#endif
399				rv = globexp1(patbuf, pglob, limit);
400				if (rv)
401					return (rv);
402
403				/* move after the comma, to the next string */
404				pl = pm + 1;
405			}
406			break;
407
408		default:
409			break;
410		}
411	return (0);
412}
413
414
415
416/*
417 * expand tilde from the passwd file.
418 */
419static const Char *
420globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
421{
422	struct passwd *pwd;
423	char *h, *sc;
424	const Char *p;
425	Char *b, *eb;
426	wchar_t wc;
427	wchar_t wbuf[MAXPATHLEN];
428	wchar_t *wbufend, *dc;
429	size_t clen;
430	mbstate_t mbs;
431	int too_long;
432
433	if (*pattern != TILDE || !(pglob->gl_flags & GLOB_TILDE))
434		return (pattern);
435
436	/*
437	 * Copy up to the end of the string or /
438	 */
439	eb = &patbuf[patbuf_len - 1];
440	for (p = pattern + 1, b = patbuf;
441	    b < eb && *p != EOS && UNPROT(*p) != SEP; *b++ = *p++)
442		continue;
443
444	if (*p != EOS && UNPROT(*p) != SEP)
445		return (NULL);
446
447	*b = EOS;
448	h = NULL;
449
450	if (patbuf[0] == EOS) {
451		/*
452		 * handle a plain ~ or ~/ by expanding $HOME first (iff
453		 * we're not running setuid or setgid) and then trying
454		 * the password file
455		 */
456		if (issetugid() != 0 ||
457		    (h = getenv("HOME")) == NULL) {
458			if (((h = getlogin()) != NULL &&
459			     (pwd = getpwnam(h)) != NULL) ||
460			    (pwd = getpwuid(getuid())) != NULL)
461				h = pwd->pw_dir;
462			else
463				return (pattern);
464		}
465	}
466	else {
467		/*
468		 * Expand a ~user
469		 */
470		if (g_Ctoc(patbuf, (char *)wbuf, sizeof(wbuf)))
471			return (NULL);
472		if ((pwd = getpwnam((char *)wbuf)) == NULL)
473			return (pattern);
474		else
475			h = pwd->pw_dir;
476	}
477
478	/* Copy the home directory */
479	dc = wbuf;
480	sc = h;
481	wbufend = wbuf + MAXPATHLEN - 1;
482	too_long = 1;
483	memset(&mbs, 0, sizeof(mbs));
484	while (dc <= wbufend) {
485		clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
486		if (clen == (size_t)-1 || clen == (size_t)-2) {
487			/* XXX See initial comment #2. */
488			wc = (unsigned char)*sc;
489			clen = 1;
490			memset(&mbs, 0, sizeof(mbs));
491		}
492		if ((*dc++ = wc) == EOS) {
493			too_long = 0;
494			break;
495		}
496		sc += clen;
497	}
498	if (too_long)
499		return (NULL);
500
501	dc = wbuf;
502	for (b = patbuf; b < eb && *dc != EOS; *b++ = *dc++ | M_PROTECT)
503		continue;
504	if (*dc != EOS)
505		return (NULL);
506
507	/* Append the rest of the pattern */
508	if (*p != EOS) {
509		too_long = 1;
510		while (b <= eb) {
511			if ((*b++ = *p++) == EOS) {
512				too_long = 0;
513				break;
514			}
515		}
516		if (too_long)
517			return (NULL);
518	} else
519		*b = EOS;
520
521	return (patbuf);
522}
523
524
525/*
526 * The main glob() routine: compiles the pattern (optionally processing
527 * quotes), calls glob1() to do the real pattern matching, and finally
528 * sorts the list (unless unsorted operation is requested).  Returns 0
529 * if things went well, nonzero if errors occurred.
530 */
531static int
532glob0(const Char *pattern, glob_t *pglob, struct glob_limit *limit,
533    const char *origpat) {
534	const Char *qpatnext;
535	int err;
536	size_t oldpathc;
537	Char *bufnext, c, patbuf[MAXPATHLEN];
538
539	qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
540	if (qpatnext == NULL) {
541		errno = E2BIG;
542		return (GLOB_NOSPACE);
543	}
544	oldpathc = pglob->gl_pathc;
545	bufnext = patbuf;
546
547	/* We don't need to check for buffer overflow any more. */
548	while ((c = *qpatnext++) != EOS) {
549		switch (c) {
550		case LBRACKET:
551			c = *qpatnext;
552			if (c == NOT)
553				++qpatnext;
554			if (*qpatnext == EOS ||
555			    g_strchr(qpatnext+1, RBRACKET) == NULL) {
556				*bufnext++ = LBRACKET;
557				if (c == NOT)
558					--qpatnext;
559				break;
560			}
561			*bufnext++ = M_SET;
562			if (c == NOT)
563				*bufnext++ = M_NOT;
564			c = *qpatnext++;
565			do {
566				*bufnext++ = CHAR(c);
567				if (*qpatnext == RANGE &&
568				    (c = qpatnext[1]) != RBRACKET) {
569					*bufnext++ = M_RNG;
570					*bufnext++ = CHAR(c);
571					qpatnext += 2;
572				}
573			} while ((c = *qpatnext++) != RBRACKET);
574			pglob->gl_flags |= GLOB_MAGCHAR;
575			*bufnext++ = M_END;
576			break;
577		case QUESTION:
578			pglob->gl_flags |= GLOB_MAGCHAR;
579			*bufnext++ = M_ONE;
580			break;
581		case STAR:
582			pglob->gl_flags |= GLOB_MAGCHAR;
583			/* collapse adjacent stars to one,
584			 * to avoid exponential behavior
585			 */
586			if (bufnext == patbuf || bufnext[-1] != M_ALL)
587			    *bufnext++ = M_ALL;
588			break;
589		default:
590			*bufnext++ = CHAR(c);
591			break;
592		}
593	}
594	*bufnext = EOS;
595#ifdef DEBUG
596	qprintf("glob0:", patbuf);
597#endif
598
599	if ((err = glob1(patbuf, pglob, limit)) != 0)
600		return(err);
601
602	if (origpat != NULL)
603		return (globfinal(pglob, limit, oldpathc, origpat));
604
605	return (0);
606}
607
608static int
609globfinal(glob_t *pglob, struct glob_limit *limit, size_t oldpathc,
610    const char *origpat) {
611	if (pglob->gl_pathc == oldpathc)
612		return (err_nomatch(pglob, limit, origpat));
613
614	if (!(pglob->gl_flags & GLOB_NOSORT))
615		qsort(pglob->gl_pathv + pglob->gl_offs + oldpathc,
616		    pglob->gl_pathc - oldpathc, sizeof(char *), compare);
617
618	return (0);
619}
620
621static int
622compare(const void *p, const void *q)
623{
624	return (strcoll(*(char **)p, *(char **)q));
625}
626
627static int
628glob1(Char *pattern, glob_t *pglob, struct glob_limit *limit)
629{
630	Char pathbuf[MAXPATHLEN];
631
632	/* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
633	if (*pattern == EOS)
634		return (0);
635	return (glob2(pathbuf, pathbuf, pathbuf + MAXPATHLEN - 1,
636	    pattern, pglob, limit));
637}
638
639/*
640 * The functions glob2 and glob3 are mutually recursive; there is one level
641 * of recursion for each segment in the pattern that contains one or more
642 * meta characters.
643 */
644static int
645glob2(Char *pathbuf, Char *pathend, Char *pathend_last, Char *pattern,
646      glob_t *pglob, struct glob_limit *limit)
647{
648	struct stat sb;
649	Char *p, *q;
650	int anymeta;
651
652	/*
653	 * Loop over pattern segments until end of pattern or until
654	 * segment with meta character found.
655	 */
656	for (anymeta = 0;;) {
657		if (*pattern == EOS) {		/* End of pattern? */
658			*pathend = EOS;
659			if (g_lstat(pathbuf, &sb, pglob))
660				return (0);
661
662			if ((pglob->gl_flags & GLOB_LIMIT) &&
663			    limit->l_stat_cnt++ >= GLOB_LIMIT_STAT) {
664				errno = E2BIG;
665				return (GLOB_NOSPACE);
666			}
667			if ((pglob->gl_flags & GLOB_MARK) &&
668			    UNPROT(pathend[-1]) != SEP &&
669			    (S_ISDIR(sb.st_mode) ||
670			    (S_ISLNK(sb.st_mode) &&
671			    g_stat(pathbuf, &sb, pglob) == 0 &&
672			    S_ISDIR(sb.st_mode)))) {
673				if (pathend + 1 > pathend_last) {
674					errno = E2BIG;
675					return (GLOB_NOSPACE);
676				}
677				*pathend++ = SEP;
678				*pathend = EOS;
679			}
680			++pglob->gl_matchc;
681			return (globextend(pathbuf, pglob, limit, NULL));
682		}
683
684		/* Find end of next segment, copy tentatively to pathend. */
685		q = pathend;
686		p = pattern;
687		while (*p != EOS && UNPROT(*p) != SEP) {
688			if (ismeta(*p))
689				anymeta = 1;
690			if (q + 1 > pathend_last) {
691				errno = E2BIG;
692				return (GLOB_NOSPACE);
693			}
694			*q++ = *p++;
695		}
696
697		if (!anymeta) {		/* No expansion, do next segment. */
698			pathend = q;
699			pattern = p;
700			while (UNPROT(*pattern) == SEP) {
701				if (pathend + 1 > pathend_last) {
702					errno = E2BIG;
703					return (GLOB_NOSPACE);
704				}
705				*pathend++ = *pattern++;
706			}
707		} else			/* Need expansion, recurse. */
708			return (glob3(pathbuf, pathend, pathend_last, pattern,
709			    p, pglob, limit));
710	}
711	/* NOTREACHED */
712}
713
714static int
715glob3(Char *pathbuf, Char *pathend, Char *pathend_last,
716      Char *pattern, Char *restpattern,
717      glob_t *pglob, struct glob_limit *limit)
718{
719	struct dirent *dp;
720	DIR *dirp;
721	int err, too_long, saverrno, saverrno2;
722	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
723
724	struct dirent *(*readdirfunc)(DIR *);
725
726	if (pathend > pathend_last) {
727		errno = E2BIG;
728		return (GLOB_NOSPACE);
729	}
730	*pathend = EOS;
731	if (pglob->gl_errfunc != NULL &&
732	    g_Ctoc(pathbuf, buf, sizeof(buf))) {
733		errno = E2BIG;
734		return (GLOB_NOSPACE);
735	}
736
737	saverrno = errno;
738	errno = 0;
739	if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
740		if (errno == ENOENT || errno == ENOTDIR)
741			return (0);
742		err = err_aborted(pglob, errno, buf);
743		if (errno == 0)
744			errno = saverrno;
745		return (err);
746	}
747
748	err = 0;
749
750	/* pglob->gl_readdir takes a void *, fix this manually */
751	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
752		readdirfunc = (struct dirent *(*)(DIR *))pglob->gl_readdir;
753	else
754		readdirfunc = readdir;
755
756	errno = 0;
757	/* Search directory for matching names. */
758	while ((dp = (*readdirfunc)(dirp)) != NULL) {
759		char *sc;
760		Char *dc;
761		wchar_t wc;
762		size_t clen;
763		mbstate_t mbs;
764
765		if ((pglob->gl_flags & GLOB_LIMIT) &&
766		    limit->l_readdir_cnt++ >= GLOB_LIMIT_READDIR) {
767			errno = E2BIG;
768			err = GLOB_NOSPACE;
769			break;
770		}
771
772		/* Initial DOT must be matched literally. */
773		if (dp->d_name[0] == '.' && UNPROT(*pattern) != DOT) {
774			errno = 0;
775			continue;
776		}
777		memset(&mbs, 0, sizeof(mbs));
778		dc = pathend;
779		sc = dp->d_name;
780		too_long = 1;
781		while (dc <= pathend_last) {
782			clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
783			if (clen == (size_t)-1 || clen == (size_t)-2) {
784				/* XXX See initial comment #2. */
785				wc = (unsigned char)*sc;
786				clen = 1;
787				memset(&mbs, 0, sizeof(mbs));
788			}
789			if ((*dc++ = wc) == EOS) {
790				too_long = 0;
791				break;
792			}
793			sc += clen;
794		}
795		if (too_long && (err = err_aborted(pglob, ENAMETOOLONG,
796		    buf))) {
797			errno = ENAMETOOLONG;
798			break;
799		}
800		if (too_long || !match(pathend, pattern, restpattern)) {
801			*pathend = EOS;
802			errno = 0;
803			continue;
804		}
805		if (errno == 0)
806			errno = saverrno;
807		err = glob2(pathbuf, --dc, pathend_last, restpattern,
808		    pglob, limit);
809		if (err)
810			break;
811		errno = 0;
812	}
813
814	saverrno2 = errno;
815	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
816		(*pglob->gl_closedir)(dirp);
817	else
818		closedir(dirp);
819	errno = saverrno2;
820
821	if (err)
822		return (err);
823
824	if (dp == NULL && errno != 0 &&
825	    (err = err_aborted(pglob, errno, buf)))
826		return (err);
827
828	if (errno == 0)
829		errno = saverrno;
830	return (0);
831}
832
833
834/*
835 * Extend the gl_pathv member of a glob_t structure to accommodate a new item,
836 * add the new item, and update gl_pathc.
837 *
838 * This assumes the BSD realloc, which only copies the block when its size
839 * crosses a power-of-two boundary; for v7 realloc, this would cause quadratic
840 * behavior.
841 *
842 * Return 0 if new item added, error code if memory couldn't be allocated.
843 *
844 * Invariant of the glob_t structure:
845 *	Either gl_pathc is zero and gl_pathv is NULL; or gl_pathc > 0 and
846 *	gl_pathv points to (gl_offs + gl_pathc + 1) items.
847 */
848static int
849globextend(const Char *path, glob_t *pglob, struct glob_limit *limit,
850    const char *origpat)
851{
852	char **pathv;
853	size_t i, newn, len;
854	char *copy;
855	const Char *p;
856
857	if ((pglob->gl_flags & GLOB_LIMIT) &&
858	    pglob->gl_matchc > limit->l_path_lim) {
859		errno = E2BIG;
860		return (GLOB_NOSPACE);
861	}
862
863	newn = 2 + pglob->gl_pathc + pglob->gl_offs;
864	/* reallocarray(NULL, newn, size) is equivalent to malloc(newn*size). */
865	pathv = reallocarray(pglob->gl_pathv, newn, sizeof(*pathv));
866	if (pathv == NULL)
867		return (GLOB_NOSPACE);
868
869	if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
870		/* first time around -- clear initial gl_offs items */
871		pathv += pglob->gl_offs;
872		for (i = pglob->gl_offs + 1; --i > 0; )
873			*--pathv = NULL;
874	}
875	pglob->gl_pathv = pathv;
876
877	if (origpat != NULL)
878		copy = strdup(origpat);
879	else {
880		for (p = path; *p++ != EOS;)
881			continue;
882		len = MB_CUR_MAX * (size_t)(p - path); /* XXX overallocation */
883		if ((copy = malloc(len)) != NULL) {
884			if (g_Ctoc(path, copy, len)) {
885				free(copy);
886				errno = E2BIG;
887				return (GLOB_NOSPACE);
888			}
889		}
890	}
891	if (copy != NULL) {
892		limit->l_string_cnt += strlen(copy) + 1;
893		if ((pglob->gl_flags & GLOB_LIMIT) &&
894		    limit->l_string_cnt >= GLOB_LIMIT_STRING) {
895			free(copy);
896			errno = E2BIG;
897			return (GLOB_NOSPACE);
898		}
899		pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
900	}
901	pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
902	return (copy == NULL ? GLOB_NOSPACE : 0);
903}
904
905/*
906 * pattern matching function for filenames.  Each occurrence of the *
907 * pattern causes a recursion level.
908 */
909static int
910match(Char *name, Char *pat, Char *patend)
911{
912	int ok, negate_range;
913	Char c, k;
914	struct xlocale_collate *table =
915		(struct xlocale_collate*)__get_locale()->components[XLC_COLLATE];
916
917	while (pat < patend) {
918		c = *pat++;
919		switch (c & M_MASK) {
920		case M_ALL:
921			if (pat == patend)
922				return (1);
923			do
924			    if (match(name, pat, patend))
925				    return (1);
926			while (*name++ != EOS);
927			return (0);
928		case M_ONE:
929			if (*name++ == EOS)
930				return (0);
931			break;
932		case M_SET:
933			ok = 0;
934			if ((k = *name++) == EOS)
935				return (0);
936			if ((negate_range = ((*pat & M_MASK) == M_NOT)) != 0)
937				++pat;
938			while (((c = *pat++) & M_MASK) != M_END)
939				if ((*pat & M_MASK) == M_RNG) {
940					if (table->__collate_load_error ?
941					    CHAR(c) <= CHAR(k) &&
942					    CHAR(k) <= CHAR(pat[1]) :
943					    __wcollate_range_cmp(CHAR(c),
944					    CHAR(k)) <= 0 &&
945					    __wcollate_range_cmp(CHAR(k),
946					    CHAR(pat[1])) <= 0)
947						ok = 1;
948					pat += 2;
949				} else if (c == k)
950					ok = 1;
951			if (ok == negate_range)
952				return (0);
953			break;
954		default:
955			if (*name++ != c)
956				return (0);
957			break;
958		}
959	}
960	return (*name == EOS);
961}
962
963/* Free allocated data belonging to a glob_t structure. */
964void
965globfree(glob_t *pglob)
966{
967	size_t i;
968	char **pp;
969
970	if (pglob->gl_pathv != NULL) {
971		pp = pglob->gl_pathv + pglob->gl_offs;
972		for (i = pglob->gl_pathc; i--; ++pp)
973			if (*pp)
974				free(*pp);
975		free(pglob->gl_pathv);
976		pglob->gl_pathv = NULL;
977	}
978}
979
980static DIR *
981g_opendir(Char *str, glob_t *pglob)
982{
983	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
984
985	if (*str == EOS)
986		strcpy(buf, ".");
987	else {
988		if (g_Ctoc(str, buf, sizeof(buf))) {
989			errno = ENAMETOOLONG;
990			return (NULL);
991		}
992	}
993
994	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
995		return ((*pglob->gl_opendir)(buf));
996
997	return (opendir(buf));
998}
999
1000static int
1001g_lstat(Char *fn, struct stat *sb, glob_t *pglob)
1002{
1003	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
1004
1005	if (g_Ctoc(fn, buf, sizeof(buf))) {
1006		errno = ENAMETOOLONG;
1007		return (-1);
1008	}
1009	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
1010		return((*pglob->gl_lstat)(buf, sb));
1011	return (lstat(buf, sb));
1012}
1013
1014static int
1015g_stat(Char *fn, struct stat *sb, glob_t *pglob)
1016{
1017	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
1018
1019	if (g_Ctoc(fn, buf, sizeof(buf))) {
1020		errno = ENAMETOOLONG;
1021		return (-1);
1022	}
1023	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
1024		return ((*pglob->gl_stat)(buf, sb));
1025	return (stat(buf, sb));
1026}
1027
1028static const Char *
1029g_strchr(const Char *str, wchar_t ch)
1030{
1031
1032	do {
1033		if (*str == ch)
1034			return (str);
1035	} while (*str++);
1036	return (NULL);
1037}
1038
1039static int
1040g_Ctoc(const Char *str, char *buf, size_t len)
1041{
1042	mbstate_t mbs;
1043	size_t clen;
1044
1045	memset(&mbs, 0, sizeof(mbs));
1046	while (len >= MB_CUR_MAX) {
1047		clen = wcrtomb(buf, CHAR(*str), &mbs);
1048		if (clen == (size_t)-1) {
1049			/* XXX See initial comment #2. */
1050			*buf = (char)CHAR(*str);
1051			clen = 1;
1052			memset(&mbs, 0, sizeof(mbs));
1053		}
1054		if (CHAR(*str) == EOS)
1055			return (0);
1056		str++;
1057		buf += clen;
1058		len -= clen;
1059	}
1060	return (1);
1061}
1062
1063static int
1064err_nomatch(glob_t *pglob, struct glob_limit *limit, const char *origpat) {
1065	/*
1066	 * If there was no match we are going to append the origpat
1067	 * if GLOB_NOCHECK was specified or if GLOB_NOMAGIC was specified
1068	 * and the origpat did not contain any magic characters
1069	 * GLOB_NOMAGIC is there just for compatibility with csh.
1070	 */
1071	if ((pglob->gl_flags & GLOB_NOCHECK) ||
1072	    ((pglob->gl_flags & GLOB_NOMAGIC) &&
1073	    !(pglob->gl_flags & GLOB_MAGCHAR)))
1074		return (globextend(NULL, pglob, limit, origpat));
1075	return (GLOB_NOMATCH);
1076}
1077
1078static int
1079err_aborted(glob_t *pglob, int err, char *buf) {
1080	if ((pglob->gl_errfunc != NULL && pglob->gl_errfunc(buf, err)) ||
1081	    (pglob->gl_flags & GLOB_ERR))
1082		return (GLOB_ABORTED);
1083	return (0);
1084}
1085
1086#ifdef DEBUG
1087static void
1088qprintf(const char *str, Char *s)
1089{
1090	Char *p;
1091
1092	(void)printf("%s\n", str);
1093	if (s != NULL) {
1094		for (p = s; *p != EOS; p++)
1095			(void)printf("%c", (char)CHAR(*p));
1096		(void)printf("\n");
1097		for (p = s; *p != EOS; p++)
1098			(void)printf("%c", (isprot(*p) ? '\\' : ' '));
1099		(void)printf("\n");
1100		for (p = s; *p != EOS; p++)
1101			(void)printf("%c", (ismeta(*p) ? '_' : ' '));
1102		(void)printf("\n");
1103	}
1104}
1105#endif
1106