--- glob.c-rev Sun Jan 27 15:36:17 2013 +++ glob.c-len Tue Jan 29 13:16:05 2013 @@ -164,12 +164,12 @@ glob_t *pglob) { const char *patnext; - size_t n; + size_t n, patlen; wchar_t c; wcat_t *bufnext, *bufend, patbuf[MAXPATHLEN]; struct glob_lim limit = { 0, 0, 0 }; - if (strnlen(pattern, PATH_MAX) == PATH_MAX) + if ((patlen = strnlen(pattern, PATH_MAX)) == PATH_MAX) return (GLOB_NOMATCH); patnext = pattern; @@ -191,10 +191,12 @@ bufnext = patbuf; bufend = bufnext + MAXPATHLEN - 1; + patlen += 1; if (flags & GLOB_NOESCAPE) { while (bufnext < bufend) { - if ((n = mbtowc(&c, patnext, MB_LEN_MAX)) > 0) { + if ((n = mbtowc(&c, patnext, patlen)) > 0) { patnext += n; + patlen -= n; bufnext->w_at = 0; (bufnext++)->w_wc = c; } else if (n == 0) { @@ -206,14 +208,17 @@ } else { /* Protect the quoted characters. */ while (bufnext < bufend) { - if ((n = mbtowc(&c, patnext, MB_LEN_MAX)) > 0) { + if ((n = mbtowc(&c, patnext, patlen)) > 0) { patnext += n; + patlen -= n; if (c == QUOTE) { - n = mbtowc(&c, patnext, MB_LEN_MAX); + n = mbtowc(&c, patnext, patlen); if (n < 0) return (GLOB_NOMATCH); - if (n > 0) + if (n > 0) { patnext += n; + patlen -= n; + } if (n == 0) c = QUOTE; bufnext->w_at = M_PROTECT; @@ -380,7 +385,7 @@ char *h; const wcat_t *p; wcat_t *b, *eb, *q; - size_t n; + size_t n, lenh; wchar_t c; if (pattern->w_wc != TILDE || !(pglob->gl_flags & GLOB_TILDE)) @@ -421,9 +426,11 @@ } /* Copy the home directory */ + lenh = strlen(h) + 1; for (b = patbuf; b < eb && *h != EOS; b++) { - if ((n = mbtowc(&c, h, MB_LEN_MAX)) > 0) { + if ((n = mbtowc(&c, h, lenh)) > 0) { h += n; + lenh -= n; b->w_at = 0; b->w_wc = c; } else if (n < 0) { @@ -829,7 +836,7 @@ while ((dp = (*readdirfunc)(dirp))) { char *sc; wcat_t *dc; - size_t n; + size_t n, lensc; wchar_t w; if ((pglob->gl_flags & GLOB_LIMIT) && @@ -848,13 +855,16 @@ continue; dc = pathend; sc = dp->d_name; + lensc = strlen(sc) + 1; while (dc < pathend_last) { - if ((n = mbtowc(&w, sc, MB_LEN_MAX)) <= 0) { + if ((n = mbtowc(&w, sc, lensc)) <= 0) { sc += 1; + lensc -= 1; dc->w_at = 0; dc->w_wc = EOS; } else { sc += n; + lensc -= n; dc->w_at = 0; dc->w_wc = w; }