--- glob.c-rev	Sun Jan 27 15:36:17 2013
+++ glob.c-len	Tue Jan 29 13:16:05 2013
@@ -164,12 +164,12 @@
     glob_t *pglob)
 {
 	const char *patnext;
-	size_t n;
+	size_t n, patlen;
 	wchar_t c;
 	wcat_t *bufnext, *bufend, patbuf[MAXPATHLEN];
 	struct glob_lim limit = { 0, 0, 0 };
 
-	if (strnlen(pattern, PATH_MAX) == PATH_MAX)
+	if ((patlen = strnlen(pattern, PATH_MAX)) == PATH_MAX)
 		return (GLOB_NOMATCH);
 
 	patnext = pattern;
@@ -191,10 +191,12 @@
 
 	bufnext = patbuf;
 	bufend = bufnext + MAXPATHLEN - 1;
+	patlen += 1;
 	if (flags & GLOB_NOESCAPE) {
 		while (bufnext < bufend) {
-			if ((n = mbtowc(&c, patnext, MB_LEN_MAX)) > 0) {
+			if ((n = mbtowc(&c, patnext, patlen)) > 0) {
 				patnext += n;
+				patlen -= n;
 				bufnext->w_at = 0;
 				(bufnext++)->w_wc = c;
 			} else if (n == 0) {
@@ -206,14 +208,17 @@
 	} else {
 		/* Protect the quoted characters. */
 		while (bufnext < bufend) {
-			if ((n = mbtowc(&c, patnext, MB_LEN_MAX)) > 0) {
+			if ((n = mbtowc(&c, patnext, patlen)) > 0) {
 				patnext += n;
+				patlen -= n;
 				if (c == QUOTE) {
-					n = mbtowc(&c, patnext, MB_LEN_MAX);
+					n = mbtowc(&c, patnext, patlen);
 					if (n < 0)
 						return (GLOB_NOMATCH);
-					if (n > 0)
+					if (n > 0) {
 						patnext += n;
+						patlen -= n;
+					}
 					if (n == 0)
 						c = QUOTE;
 					bufnext->w_at = M_PROTECT;
@@ -380,7 +385,7 @@
 	char *h;
 	const wcat_t *p;
 	wcat_t *b, *eb, *q;
-	size_t n;
+	size_t n, lenh;
 	wchar_t c;
 
 	if (pattern->w_wc != TILDE || !(pglob->gl_flags & GLOB_TILDE))
@@ -421,9 +426,11 @@
 	}
 
 	/* Copy the home directory */
+	lenh = strlen(h) + 1;
 	for (b = patbuf; b < eb && *h != EOS; b++) {
-		if ((n = mbtowc(&c, h, MB_LEN_MAX)) > 0) {
+		if ((n = mbtowc(&c, h, lenh)) > 0) {
 			h += n;
+			lenh -= n;
 			b->w_at = 0;
 			b->w_wc = c;
 		} else if (n < 0) {
@@ -829,7 +836,7 @@
 	while ((dp = (*readdirfunc)(dirp))) {
 		char *sc;
 		wcat_t *dc;
-		size_t n;
+		size_t n, lensc;
 		wchar_t w;
 
 		if ((pglob->gl_flags & GLOB_LIMIT) &&
@@ -848,13 +855,16 @@
 			continue;
 		dc = pathend;
 		sc = dp->d_name;
+		lensc = strlen(sc) + 1;
 		while (dc < pathend_last) {
-			if ((n = mbtowc(&w, sc, MB_LEN_MAX)) <= 0) {
+			if ((n = mbtowc(&w, sc, lensc)) <= 0) {
 				sc += 1;
+				lensc -= 1;
 				dc->w_at = 0;
 				dc->w_wc = EOS;
 			} else {
 				sc += n;
+				lensc -= n;
 				dc->w_at = 0;
 				dc->w_wc = w;
 			}