glob.c revision 243779 
1/*
2 * Copyright (c) 1989, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * This code is derived from software contributed to Berkeley by
6 * Guido van Rossum.
7 *
8 * Copyright (c) 2011 The FreeBSD Foundation
9 * All rights reserved.
10 * Portions of this software were developed by David Chisnall
11 * under sponsorship from the FreeBSD Foundation.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 *    notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 *    notice, this list of conditions and the following disclaimer in the
20 *    documentation and/or other materials provided with the distribution.
21 * 4. Neither the name of the University nor the names of its contributors
22 *    may be used to endorse or promote products derived from this software
23 *    without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 */
37
38#if defined(LIBC_SCCS) && !defined(lint)
39static char sccsid[] = "@(#)glob.c	8.3 (Berkeley) 10/13/93";
40#endif /* LIBC_SCCS and not lint */
41#include <sys/cdefs.h>
42__FBSDID("$FreeBSD: head/lib/libc/gen/glob.c 243779 2012-12-01 21:26:46Z marcel $");
43
44/*
45 * glob(3) -- a superset of the one defined in POSIX 1003.2.
46 *
47 * The [!...] convention to negate a range is supported (SysV, Posix, ksh).
48 *
49 * Optional extra services, controlled by flags not defined by POSIX:
50 *
51 * GLOB_QUOTE:
52 *	Escaping convention: \ inhibits any special meaning the following
53 *	character might have (except \ at end of string is retained).
54 * GLOB_MAGCHAR:
55 *	Set in gl_flags if pattern contained a globbing character.
56 * GLOB_NOMAGIC:
57 *	Same as GLOB_NOCHECK, but it will only append pattern if it did
58 *	not contain any magic characters.  [Used in csh style globbing]
59 * GLOB_ALTDIRFUNC:
60 *	Use alternately specified directory access functions.
61 * GLOB_TILDE:
62 *	expand ~user/foo to the /home/dir/of/user/foo
63 * GLOB_BRACE:
64 *	expand {1,2}{a,b} to 1a 1b 2a 2b
65 * gl_matchc:
66 *	Number of matches in the current invocation of glob.
67 */
68
69/*
70 * Some notes on multibyte character support:
71 * 1. Patterns with illegal byte sequences match nothing - even if
72 *    GLOB_NOCHECK is specified.
73 * 2. Illegal byte sequences in filenames are handled by treating them as
74 *    single-byte characters with a value of the first byte of the sequence
75 *    cast to wchar_t.
76 * 3. State-dependent encodings are not currently supported.
77 */
78
79#include <sys/param.h>
80#include <sys/stat.h>
81
82#include <ctype.h>
83#include <dirent.h>
84#include <errno.h>
85#include <glob.h>
86#include <limits.h>
87#include <pwd.h>
88#include <stdint.h>
89#include <stdio.h>
90#include <stdlib.h>
91#include <string.h>
92#include <unistd.h>
93#include <wchar.h>
94
95#include "collate.h"
96
97/*
98 * glob(3) expansion limits. Stop the expansion if any of these limits
99 * is reached. This caps the runtime in the face of DoS attacks. See
100 * also CVE-2010-2632
101 */
102#define	GLOB_LIMIT_BRACE	128	/* number of brace calls */
103#define	GLOB_LIMIT_PATH		65536	/* number of path elements */
104#define	GLOB_LIMIT_READDIR	16384	/* number of readdirs */
105#define	GLOB_LIMIT_STAT		1024	/* number of stat system calls */
106#define	GLOB_LIMIT_STRING	ARG_MAX	/* maximum total size for paths */
107
108struct glob_limit {
109	size_t	l_brace_cnt;
110	size_t	l_path_lim;
111	size_t	l_readdir_cnt;
112	size_t	l_stat_cnt;
113	size_t	l_string_cnt;
114};
115
116#define	DOLLAR		'$'
117#define	DOT		'.'
118#define	EOS		'\0'
119#define	LBRACKET	'['
120#define	NOT		'!'
121#define	QUESTION	'?'
122#define	QUOTE		'\\'
123#define	RANGE		'-'
124#define	RBRACKET	']'
125#define	SEP		'/'
126#define	STAR		'*'
127#define	TILDE		'~'
128#define	UNDERSCORE	'_'
129#define	LBRACE		'{'
130#define	RBRACE		'}'
131#define	SLASH		'/'
132#define	COMMA		','
133
134#ifndef DEBUG
135
136#define	M_QUOTE		0x8000000000ULL
137#define	M_PROTECT	0x4000000000ULL
138#define	M_MASK		0xffffffffffULL
139#define	M_CHAR		0x00ffffffffULL
140
141typedef uint_fast64_t Char;
142
143#else
144
145#define	M_QUOTE		0x80
146#define	M_PROTECT	0x40
147#define	M_MASK		0xff
148#define	M_CHAR		0x7f
149
150typedef char Char;
151
152#endif
153
154
155#define	CHAR(c)		((Char)((c)&M_CHAR))
156#define	META(c)		((Char)((c)|M_QUOTE))
157#define	M_ALL		META('*')
158#define	M_END		META(']')
159#define	M_NOT		META('!')
160#define	M_ONE		META('?')
161#define	M_RNG		META('-')
162#define	M_SET		META('[')
163#define	ismeta(c)	(((c)&M_QUOTE) != 0)
164
165
166static int	 compare(const void *, const void *);
167static int	 g_Ctoc(const Char *, char *, size_t);
168static int	 g_lstat(Char *, struct stat *, glob_t *);
169static DIR	*g_opendir(Char *, glob_t *);
170static const Char *g_strchr(const Char *, wchar_t);
171#ifdef notdef
172static Char	*g_strcat(Char *, const Char *);
173#endif
174static int	 g_stat(Char *, struct stat *, glob_t *);
175static int	 glob0(const Char *, glob_t *, struct glob_limit *);
176static int	 glob1(Char *, glob_t *, struct glob_limit *);
177static int	 glob2(Char *, Char *, Char *, Char *, glob_t *,
178    struct glob_limit *);
179static int	 glob3(Char *, Char *, Char *, Char *, Char *, glob_t *,
180    struct glob_limit *);
181static int	 globextend(const Char *, glob_t *, struct glob_limit *);
182static const Char *
183		 globtilde(const Char *, Char *, size_t, glob_t *);
184static int	 globexp1(const Char *, glob_t *, struct glob_limit *);
185static int	 globexp2(const Char *, const Char *, glob_t *, int *,
186    struct glob_limit *);
187static int	 match(Char *, Char *, Char *);
188#ifdef DEBUG
189static void	 qprintf(const char *, Char *);
190#endif
191
192int
193glob(const char * __restrict pattern, int flags,
194	 int (*errfunc)(const char *, int), glob_t * __restrict pglob)
195{
196	struct glob_limit limit = { 0, 0, 0, 0, 0 };
197	const char *patnext;
198	Char *bufnext, *bufend, patbuf[MAXPATHLEN], prot;
199	mbstate_t mbs;
200	wchar_t wc;
201	size_t clen;
202
203	patnext = pattern;
204	if (!(flags & GLOB_APPEND)) {
205		pglob->gl_pathc = 0;
206		pglob->gl_pathv = NULL;
207		if (!(flags & GLOB_DOOFFS))
208			pglob->gl_offs = 0;
209	}
210	if (flags & GLOB_LIMIT) {
211		limit.l_path_lim = pglob->gl_matchc;
212		if (limit.l_path_lim == 0)
213			limit.l_path_lim = GLOB_LIMIT_PATH;
214	}
215	pglob->gl_flags = flags & ~GLOB_MAGCHAR;
216	pglob->gl_errfunc = errfunc;
217	pglob->gl_matchc = 0;
218
219	bufnext = patbuf;
220	bufend = bufnext + MAXPATHLEN - 1;
221	if (flags & GLOB_NOESCAPE) {
222		memset(&mbs, 0, sizeof(mbs));
223		while (bufend - bufnext >= MB_CUR_MAX) {
224			clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
225			if (clen == (size_t)-1 || clen == (size_t)-2)
226				return (GLOB_NOMATCH);
227			else if (clen == 0)
228				break;
229			*bufnext++ = wc;
230			patnext += clen;
231		}
232	} else {
233		/* Protect the quoted characters. */
234		memset(&mbs, 0, sizeof(mbs));
235		while (bufend - bufnext >= MB_CUR_MAX) {
236			if (*patnext == QUOTE) {
237				if (*++patnext == EOS) {
238					*bufnext++ = QUOTE | M_PROTECT;
239					continue;
240				}
241				prot = M_PROTECT;
242			} else
243				prot = 0;
244			clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
245			if (clen == (size_t)-1 || clen == (size_t)-2)
246				return (GLOB_NOMATCH);
247			else if (clen == 0)
248				break;
249			*bufnext++ = wc | prot;
250			patnext += clen;
251		}
252	}
253	*bufnext = EOS;
254
255	if (flags & GLOB_BRACE)
256	    return (globexp1(patbuf, pglob, &limit));
257	else
258	    return (glob0(patbuf, pglob, &limit));
259}
260
261/*
262 * Expand recursively a glob {} pattern. When there is no more expansion
263 * invoke the standard globbing routine to glob the rest of the magic
264 * characters
265 */
266static int
267globexp1(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
268{
269	const Char* ptr = pattern;
270	int rv;
271
272	if ((pglob->gl_flags & GLOB_LIMIT) &&
273	    limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
274		errno = 0;
275		return (GLOB_NOSPACE);
276	}
277
278	/* Protect a single {}, for find(1), like csh */
279	if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS)
280		return glob0(pattern, pglob, limit);
281
282	while ((ptr = g_strchr(ptr, LBRACE)) != NULL)
283		if (!globexp2(ptr, pattern, pglob, &rv, limit))
284			return rv;
285
286	return glob0(pattern, pglob, limit);
287}
288
289
290/*
291 * Recursive brace globbing helper. Tries to expand a single brace.
292 * If it succeeds then it invokes globexp1 with the new pattern.
293 * If it fails then it tries to glob the rest of the pattern and returns.
294 */
295static int
296globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv,
297    struct glob_limit *limit)
298{
299	int     i;
300	Char   *lm, *ls;
301	const Char *pe, *pm, *pm1, *pl;
302	Char    patbuf[MAXPATHLEN];
303
304	/* copy part up to the brace */
305	for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
306		continue;
307	*lm = EOS;
308	ls = lm;
309
310	/* Find the balanced brace */
311	for (i = 0, pe = ++ptr; *pe; pe++)
312		if (*pe == LBRACKET) {
313			/* Ignore everything between [] */
314			for (pm = pe++; *pe != RBRACKET && *pe != EOS; pe++)
315				continue;
316			if (*pe == EOS) {
317				/*
318				 * We could not find a matching RBRACKET.
319				 * Ignore and just look for RBRACE
320				 */
321				pe = pm;
322			}
323		}
324		else if (*pe == LBRACE)
325			i++;
326		else if (*pe == RBRACE) {
327			if (i == 0)
328				break;
329			i--;
330		}
331
332	/* Non matching braces; just glob the pattern */
333	if (i != 0 || *pe == EOS) {
334		*rv = glob0(patbuf, pglob, limit);
335		return (0);
336	}
337
338	for (i = 0, pl = pm = ptr; pm <= pe; pm++)
339		switch (*pm) {
340		case LBRACKET:
341			/* Ignore everything between [] */
342			for (pm1 = pm++; *pm != RBRACKET && *pm != EOS; pm++)
343				continue;
344			if (*pm == EOS) {
345				/*
346				 * We could not find a matching RBRACKET.
347				 * Ignore and just look for RBRACE
348				 */
349				pm = pm1;
350			}
351			break;
352
353		case LBRACE:
354			i++;
355			break;
356
357		case RBRACE:
358			if (i) {
359			    i--;
360			    break;
361			}
362			/* FALLTHROUGH */
363		case COMMA:
364			if (i && *pm == COMMA)
365				break;
366			else {
367				/* Append the current string */
368				for (lm = ls; (pl < pm); *lm++ = *pl++)
369					continue;
370				/*
371				 * Append the rest of the pattern after the
372				 * closing brace
373				 */
374				for (pl = pe + 1; (*lm++ = *pl++) != EOS;)
375					continue;
376
377				/* Expand the current pattern */
378#ifdef DEBUG
379				qprintf("globexp2:", patbuf);
380#endif
381				*rv = globexp1(patbuf, pglob, limit);
382
383				/* move after the comma, to the next string */
384				pl = pm + 1;
385			}
386			break;
387
388		default:
389			break;
390		}
391	*rv = 0;
392	return (0);
393}
394
395
396
397/*
398 * expand tilde from the passwd file.
399 */
400static const Char *
401globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
402{
403	struct passwd *pwd;
404	char *h;
405	const Char *p;
406	Char *b, *eb;
407
408	if (*pattern != TILDE || !(pglob->gl_flags & GLOB_TILDE))
409		return (pattern);
410
411	/*
412	 * Copy up to the end of the string or /
413	 */
414	eb = &patbuf[patbuf_len - 1];
415	for (p = pattern + 1, h = (char *) patbuf;
416	    h < (char *)eb && *p && *p != SLASH; *h++ = *p++)
417		continue;
418
419	*h = EOS;
420
421	if (((char *) patbuf)[0] == EOS) {
422		/*
423		 * handle a plain ~ or ~/ by expanding $HOME first (iff
424		 * we're not running setuid or setgid) and then trying
425		 * the password file
426		 */
427		if (issetugid() != 0 ||
428		    (h = getenv("HOME")) == NULL) {
429			if (((h = getlogin()) != NULL &&
430			     (pwd = getpwnam(h)) != NULL) ||
431			    (pwd = getpwuid(getuid())) != NULL)
432				h = pwd->pw_dir;
433			else
434				return (pattern);
435		}
436	}
437	else {
438		/*
439		 * Expand a ~user
440		 */
441		if ((pwd = getpwnam((char*) patbuf)) == NULL)
442			return (pattern);
443		else
444			h = pwd->pw_dir;
445	}
446
447	/* Copy the home directory */
448	for (b = patbuf; b < eb && *h; *b++ = *h++)
449		continue;
450
451	/* Append the rest of the pattern */
452	while (b < eb && (*b++ = *p++) != EOS)
453		continue;
454	*b = EOS;
455
456	return (patbuf);
457}
458
459
460/*
461 * The main glob() routine: compiles the pattern (optionally processing
462 * quotes), calls glob1() to do the real pattern matching, and finally
463 * sorts the list (unless unsorted operation is requested).  Returns 0
464 * if things went well, nonzero if errors occurred.
465 */
466static int
467glob0(const Char *pattern, glob_t *pglob, struct glob_limit *limit)
468{
469	const Char *qpatnext;
470	int err;
471	size_t oldpathc;
472	Char *bufnext, c, patbuf[MAXPATHLEN];
473
474	qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
475	oldpathc = pglob->gl_pathc;
476	bufnext = patbuf;
477
478	/* We don't need to check for buffer overflow any more. */
479	while ((c = *qpatnext++) != EOS) {
480		switch (c) {
481		case LBRACKET:
482			c = *qpatnext;
483			if (c == NOT)
484				++qpatnext;
485			if (*qpatnext == EOS ||
486			    g_strchr(qpatnext+1, RBRACKET) == NULL) {
487				*bufnext++ = LBRACKET;
488				if (c == NOT)
489					--qpatnext;
490				break;
491			}
492			*bufnext++ = M_SET;
493			if (c == NOT)
494				*bufnext++ = M_NOT;
495			c = *qpatnext++;
496			do {
497				*bufnext++ = CHAR(c);
498				if (*qpatnext == RANGE &&
499				    (c = qpatnext[1]) != RBRACKET) {
500					*bufnext++ = M_RNG;
501					*bufnext++ = CHAR(c);
502					qpatnext += 2;
503				}
504			} while ((c = *qpatnext++) != RBRACKET);
505			pglob->gl_flags |= GLOB_MAGCHAR;
506			*bufnext++ = M_END;
507			break;
508		case QUESTION:
509			pglob->gl_flags |= GLOB_MAGCHAR;
510			*bufnext++ = M_ONE;
511			break;
512		case STAR:
513			pglob->gl_flags |= GLOB_MAGCHAR;
514			/* collapse adjacent stars to one,
515			 * to avoid exponential behavior
516			 */
517			if (bufnext == patbuf || bufnext[-1] != M_ALL)
518			    *bufnext++ = M_ALL;
519			break;
520		default:
521			*bufnext++ = CHAR(c);
522			break;
523		}
524	}
525	*bufnext = EOS;
526#ifdef DEBUG
527	qprintf("glob0:", patbuf);
528#endif
529
530	if ((err = glob1(patbuf, pglob, limit)) != 0)
531		return(err);
532
533	/*
534	 * If there was no match we are going to append the pattern
535	 * if GLOB_NOCHECK was specified or if GLOB_NOMAGIC was specified
536	 * and the pattern did not contain any magic characters
537	 * GLOB_NOMAGIC is there just for compatibility with csh.
538	 */
539	if (pglob->gl_pathc == oldpathc) {
540		if (((pglob->gl_flags & GLOB_NOCHECK) ||
541		    ((pglob->gl_flags & GLOB_NOMAGIC) &&
542			!(pglob->gl_flags & GLOB_MAGCHAR))))
543			return (globextend(pattern, pglob, limit));
544		else
545			return (GLOB_NOMATCH);
546	}
547	if (!(pglob->gl_flags & GLOB_NOSORT))
548		qsort(pglob->gl_pathv + pglob->gl_offs + oldpathc,
549		    pglob->gl_pathc - oldpathc, sizeof(char *), compare);
550	return (0);
551}
552
553static int
554compare(const void *p, const void *q)
555{
556	return (strcmp(*(char **)p, *(char **)q));
557}
558
559static int
560glob1(Char *pattern, glob_t *pglob, struct glob_limit *limit)
561{
562	Char pathbuf[MAXPATHLEN];
563
564	/* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
565	if (*pattern == EOS)
566		return (0);
567	return (glob2(pathbuf, pathbuf, pathbuf + MAXPATHLEN - 1,
568	    pattern, pglob, limit));
569}
570
571/*
572 * The functions glob2 and glob3 are mutually recursive; there is one level
573 * of recursion for each segment in the pattern that contains one or more
574 * meta characters.
575 */
576static int
577glob2(Char *pathbuf, Char *pathend, Char *pathend_last, Char *pattern,
578      glob_t *pglob, struct glob_limit *limit)
579{
580	struct stat sb;
581	Char *p, *q;
582	int anymeta;
583
584	/*
585	 * Loop over pattern segments until end of pattern or until
586	 * segment with meta character found.
587	 */
588	for (anymeta = 0;;) {
589		if (*pattern == EOS) {		/* End of pattern? */
590			*pathend = EOS;
591			if (g_lstat(pathbuf, &sb, pglob))
592				return (0);
593
594			if ((pglob->gl_flags & GLOB_LIMIT) &&
595			    limit->l_stat_cnt++ >= GLOB_LIMIT_STAT) {
596				errno = 0;
597				if (pathend + 1 > pathend_last)
598					return (GLOB_ABORTED);
599				*pathend++ = SEP;
600				*pathend = EOS;
601				return (GLOB_NOSPACE);
602			}
603			if (((pglob->gl_flags & GLOB_MARK) &&
604			    pathend[-1] != SEP) && (S_ISDIR(sb.st_mode)
605			    || (S_ISLNK(sb.st_mode) &&
606			    (g_stat(pathbuf, &sb, pglob) == 0) &&
607			    S_ISDIR(sb.st_mode)))) {
608				if (pathend + 1 > pathend_last)
609					return (GLOB_ABORTED);
610				*pathend++ = SEP;
611				*pathend = EOS;
612			}
613			++pglob->gl_matchc;
614			return (globextend(pathbuf, pglob, limit));
615		}
616
617		/* Find end of next segment, copy tentatively to pathend. */
618		q = pathend;
619		p = pattern;
620		while (*p != EOS && *p != SEP) {
621			if (ismeta(*p))
622				anymeta = 1;
623			if (q + 1 > pathend_last)
624				return (GLOB_ABORTED);
625			*q++ = *p++;
626		}
627
628		if (!anymeta) {		/* No expansion, do next segment. */
629			pathend = q;
630			pattern = p;
631			while (*pattern == SEP) {
632				if (pathend + 1 > pathend_last)
633					return (GLOB_ABORTED);
634				*pathend++ = *pattern++;
635			}
636		} else			/* Need expansion, recurse. */
637			return (glob3(pathbuf, pathend, pathend_last, pattern,
638			    p, pglob, limit));
639	}
640	/* NOTREACHED */
641}
642
643static int
644glob3(Char *pathbuf, Char *pathend, Char *pathend_last,
645      Char *pattern, Char *restpattern,
646      glob_t *pglob, struct glob_limit *limit)
647{
648	struct dirent *dp;
649	DIR *dirp;
650	int err;
651	char buf[MAXPATHLEN];
652
653	/*
654	 * The readdirfunc declaration can't be prototyped, because it is
655	 * assigned, below, to two functions which are prototyped in glob.h
656	 * and dirent.h as taking pointers to differently typed opaque
657	 * structures.
658	 */
659	struct dirent *(*readdirfunc)();
660
661	if (pathend > pathend_last)
662		return (GLOB_ABORTED);
663	*pathend = EOS;
664	errno = 0;
665
666	if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
667		/* TODO: don't call for ENOENT or ENOTDIR? */
668		if (pglob->gl_errfunc) {
669			if (g_Ctoc(pathbuf, buf, sizeof(buf)))
670				return (GLOB_ABORTED);
671			if (pglob->gl_errfunc(buf, errno) ||
672			    pglob->gl_flags & GLOB_ERR)
673				return (GLOB_ABORTED);
674		}
675		return (0);
676	}
677
678	err = 0;
679
680	/* Search directory for matching names. */
681	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
682		readdirfunc = pglob->gl_readdir;
683	else
684		readdirfunc = readdir;
685	while ((dp = (*readdirfunc)(dirp))) {
686		char *sc;
687		Char *dc;
688		wchar_t wc;
689		size_t clen;
690		mbstate_t mbs;
691
692		if ((pglob->gl_flags & GLOB_LIMIT) &&
693		    limit->l_readdir_cnt++ >= GLOB_LIMIT_READDIR) {
694			errno = 0;
695			if (pathend + 1 > pathend_last)
696				err = GLOB_ABORTED;
697			else {
698				*pathend++ = SEP;
699				*pathend = EOS;
700				err = GLOB_NOSPACE;
701			}
702			break;
703		}
704
705		/* Initial DOT must be matched literally. */
706		if (dp->d_name[0] == DOT && *pattern != DOT)
707			continue;
708		memset(&mbs, 0, sizeof(mbs));
709		dc = pathend;
710		sc = dp->d_name;
711		while (dc < pathend_last) {
712			clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
713			if (clen == (size_t)-1 || clen == (size_t)-2) {
714				wc = *sc;
715				clen = 1;
716				memset(&mbs, 0, sizeof(mbs));
717			}
718			if ((*dc++ = wc) == EOS)
719				break;
720			sc += clen;
721		}
722		if (!match(pathend, pattern, restpattern)) {
723			*pathend = EOS;
724			continue;
725		}
726		err = glob2(pathbuf, --dc, pathend_last, restpattern,
727		    pglob, limit);
728		if (err)
729			break;
730	}
731
732	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
733		(*pglob->gl_closedir)(dirp);
734	else
735		closedir(dirp);
736	return (err);
737}
738
739
740/*
741 * Extend the gl_pathv member of a glob_t structure to accomodate a new item,
742 * add the new item, and update gl_pathc.
743 *
744 * This assumes the BSD realloc, which only copies the block when its size
745 * crosses a power-of-two boundary; for v7 realloc, this would cause quadratic
746 * behavior.
747 *
748 * Return 0 if new item added, error code if memory couldn't be allocated.
749 *
750 * Invariant of the glob_t structure:
751 *	Either gl_pathc is zero and gl_pathv is NULL; or gl_pathc > 0 and
752 *	gl_pathv points to (gl_offs + gl_pathc + 1) items.
753 */
754static int
755globextend(const Char *path, glob_t *pglob, struct glob_limit *limit)
756{
757	char **pathv;
758	size_t i, newsize, len;
759	char *copy;
760	const Char *p;
761
762	if ((pglob->gl_flags & GLOB_LIMIT) &&
763	    pglob->gl_matchc > limit->l_path_lim) {
764		errno = 0;
765		return (GLOB_NOSPACE);
766	}
767
768	newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs);
769	/* realloc(NULL, newsize) is equivalent to malloc(newsize). */
770	pathv = realloc((void *)pglob->gl_pathv, newsize);
771	if (pathv == NULL)
772		return (GLOB_NOSPACE);
773
774	if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
775		/* first time around -- clear initial gl_offs items */
776		pathv += pglob->gl_offs;
777		for (i = pglob->gl_offs + 1; --i > 0; )
778			*--pathv = NULL;
779	}
780	pglob->gl_pathv = pathv;
781
782	for (p = path; *p++;)
783		continue;
784	len = MB_CUR_MAX * (size_t)(p - path);	/* XXX overallocation */
785	limit->l_string_cnt += len;
786	if ((pglob->gl_flags & GLOB_LIMIT) &&
787	    limit->l_string_cnt >= GLOB_LIMIT_STRING) {
788		errno = 0;
789		return (GLOB_NOSPACE);
790	}
791	if ((copy = malloc(len)) != NULL) {
792		if (g_Ctoc(path, copy, len)) {
793			free(copy);
794			return (GLOB_NOSPACE);
795		}
796		pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
797	}
798	pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
799	return (copy == NULL ? GLOB_NOSPACE : 0);
800}
801
802/*
803 * pattern matching function for filenames.  Each occurrence of the *
804 * pattern causes a recursion level.
805 */
806static int
807match(Char *name, Char *pat, Char *patend)
808{
809	int ok, negate_range;
810	Char c, k;
811	struct xlocale_collate *table =
812		(struct xlocale_collate*)__get_locale()->components[XLC_COLLATE];
813
814	while (pat < patend) {
815		c = *pat++;
816		switch (c & M_MASK) {
817		case M_ALL:
818			if (pat == patend)
819				return (1);
820			do
821			    if (match(name, pat, patend))
822				    return (1);
823			while (*name++ != EOS);
824			return (0);
825		case M_ONE:
826			if (*name++ == EOS)
827				return (0);
828			break;
829		case M_SET:
830			ok = 0;
831			if ((k = *name++) == EOS)
832				return (0);
833			if ((negate_range = ((*pat & M_MASK) == M_NOT)) != EOS)
834				++pat;
835			while (((c = *pat++) & M_MASK) != M_END)
836				if ((*pat & M_MASK) == M_RNG) {
837					if (table->__collate_load_error ?
838					    CHAR(c) <= CHAR(k) && CHAR(k) <= CHAR(pat[1]) :
839					       __collate_range_cmp(table, CHAR(c), CHAR(k)) <= 0
840					    && __collate_range_cmp(table, CHAR(k), CHAR(pat[1])) <= 0
841					   )
842						ok = 1;
843					pat += 2;
844				} else if (c == k)
845					ok = 1;
846			if (ok == negate_range)
847				return (0);
848			break;
849		default:
850			if (*name++ != c)
851				return (0);
852			break;
853		}
854	}
855	return (*name == EOS);
856}
857
858/* Free allocated data belonging to a glob_t structure. */
859void
860globfree(glob_t *pglob)
861{
862	size_t i;
863	char **pp;
864
865	if (pglob->gl_pathv != NULL) {
866		pp = pglob->gl_pathv + pglob->gl_offs;
867		for (i = pglob->gl_pathc; i--; ++pp)
868			if (*pp)
869				free(*pp);
870		free(pglob->gl_pathv);
871		pglob->gl_pathv = NULL;
872	}
873}
874
875static DIR *
876g_opendir(Char *str, glob_t *pglob)
877{
878	char buf[MAXPATHLEN];
879
880	if (!*str)
881		strcpy(buf, ".");
882	else {
883		if (g_Ctoc(str, buf, sizeof(buf)))
884			return (NULL);
885	}
886
887	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
888		return ((*pglob->gl_opendir)(buf));
889
890	return (opendir(buf));
891}
892
893static int
894g_lstat(Char *fn, struct stat *sb, glob_t *pglob)
895{
896	char buf[MAXPATHLEN];
897
898	if (g_Ctoc(fn, buf, sizeof(buf))) {
899		errno = ENAMETOOLONG;
900		return (-1);
901	}
902	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
903		return((*pglob->gl_lstat)(buf, sb));
904	return (lstat(buf, sb));
905}
906
907static int
908g_stat(Char *fn, struct stat *sb, glob_t *pglob)
909{
910	char buf[MAXPATHLEN];
911
912	if (g_Ctoc(fn, buf, sizeof(buf))) {
913		errno = ENAMETOOLONG;
914		return (-1);
915	}
916	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
917		return ((*pglob->gl_stat)(buf, sb));
918	return (stat(buf, sb));
919}
920
921static const Char *
922g_strchr(const Char *str, wchar_t ch)
923{
924
925	do {
926		if (*str == ch)
927			return (str);
928	} while (*str++);
929	return (NULL);
930}
931
932static int
933g_Ctoc(const Char *str, char *buf, size_t len)
934{
935	mbstate_t mbs;
936	size_t clen;
937
938	memset(&mbs, 0, sizeof(mbs));
939	while (len >= MB_CUR_MAX) {
940		clen = wcrtomb(buf, *str, &mbs);
941		if (clen == (size_t)-1)
942			return (1);
943		if (*str == L'\0')
944			return (0);
945		str++;
946		buf += clen;
947		len -= clen;
948	}
949	return (1);
950}
951
952#ifdef DEBUG
953static void
954qprintf(const char *str, Char *s)
955{
956	Char *p;
957
958	(void)printf("%s:\n", str);
959	for (p = s; *p; p++)
960		(void)printf("%c", CHAR(*p));
961	(void)printf("\n");
962	for (p = s; *p; p++)
963		(void)printf("%c", *p & M_PROTECT ? '"' : ' ');
964	(void)printf("\n");
965	for (p = s; *p; p++)
966		(void)printf("%c", ismeta(*p) ? '_' : ' ');
967	(void)printf("\n");
968}
969#endif
970