xref: /freebsd/lib/libc/gen/glob-compat11.c (revision 315ee00f)
1 /*
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Guido van Rossum.
7  *
8  * Copyright (c) 2011 The FreeBSD Foundation
9  * All rights reserved.
10  * Portions of this software were developed by David Chisnall
11  * under sponsorship from the FreeBSD Foundation.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  *
37  * From: @(#)glob.c	8.3 (Berkeley) 10/13/93
38  * From: FreeBSD: head/lib/libc/gen/glob.c 317913 2017-05-07 19:52:56Z jilles
39  */
40 
41 #include <sys/cdefs.h>
42 #include <sys/param.h>
43 #define	_WANT_FREEBSD11_STAT
44 #include <sys/stat.h>
45 
46 #include <ctype.h>
47 #define	_WANT_FREEBSD11_DIRENT
48 #include <dirent.h>
49 #include <errno.h>
50 #include <glob.h>
51 #include <limits.h>
52 #include <pwd.h>
53 #include <stdint.h>
54 #include <stdio.h>
55 #include <stdlib.h>
56 #include <string.h>
57 #include <unistd.h>
58 #include <wchar.h>
59 
60 #include "collate.h"
61 #include "gen-compat.h"
62 #include "glob-compat11.h"
63 
64 /*
65  * glob(3) expansion limits. Stop the expansion if any of these limits
66  * is reached. This caps the runtime in the face of DoS attacks. See
67  * also CVE-2010-2632
68  */
69 #define	GLOB_LIMIT_BRACE	128	/* number of brace calls */
70 #define	GLOB_LIMIT_PATH		65536	/* number of path elements */
71 #define	GLOB_LIMIT_READDIR	16384	/* number of readdirs */
72 #define	GLOB_LIMIT_STAT		1024	/* number of stat system calls */
73 #define	GLOB_LIMIT_STRING	ARG_MAX	/* maximum total size for paths */
74 
75 struct glob_limit {
76 	size_t	l_brace_cnt;
77 	size_t	l_path_lim;
78 	size_t	l_readdir_cnt;
79 	size_t	l_stat_cnt;
80 	size_t	l_string_cnt;
81 };
82 
83 #define	DOT		L'.'
84 #define	EOS		L'\0'
85 #define	LBRACKET	L'['
86 #define	NOT		L'!'
87 #define	QUESTION	L'?'
88 #define	QUOTE		L'\\'
89 #define	RANGE		L'-'
90 #define	RBRACKET	L']'
91 #define	SEP		L'/'
92 #define	STAR		L'*'
93 #define	TILDE		L'~'
94 #define	LBRACE		L'{'
95 #define	RBRACE		L'}'
96 #define	COMMA		L','
97 
98 #define	M_QUOTE		0x8000000000ULL
99 #define	M_PROTECT	0x4000000000ULL
100 #define	M_MASK		0xffffffffffULL
101 #define	M_CHAR		0x00ffffffffULL
102 
103 typedef uint_fast64_t Char;
104 
105 #define	CHAR(c)		((Char)((c)&M_CHAR))
106 #define	META(c)		((Char)((c)|M_QUOTE))
107 #define	UNPROT(c)	((c) & ~M_PROTECT)
108 #define	M_ALL		META(L'*')
109 #define	M_END		META(L']')
110 #define	M_NOT		META(L'!')
111 #define	M_ONE		META(L'?')
112 #define	M_RNG		META(L'-')
113 #define	M_SET		META(L'[')
114 #define	ismeta(c)	(((c)&M_QUOTE) != 0)
115 #ifdef DEBUG
116 #define	isprot(c)	(((c)&M_PROTECT) != 0)
117 #endif
118 
119 static int	 compare(const void *, const void *);
120 static int	 g_Ctoc(const Char *, char *, size_t);
121 static int	 g_lstat(Char *, struct freebsd11_stat *, glob11_t *);
122 static DIR	*g_opendir(Char *, glob11_t *);
123 static const Char *g_strchr(const Char *, wchar_t);
124 #ifdef notdef
125 static Char	*g_strcat(Char *, const Char *);
126 #endif
127 static int	 g_stat(Char *, struct freebsd11_stat *, glob11_t *);
128 static int	 glob0(const Char *, glob11_t *, struct glob_limit *,
129     const char *);
130 static int	 glob1(Char *, glob11_t *, struct glob_limit *);
131 static int	 glob2(Char *, Char *, Char *, Char *, glob11_t *,
132     struct glob_limit *);
133 static int	 glob3(Char *, Char *, Char *, Char *, Char *, glob11_t *,
134     struct glob_limit *);
135 static int	 globextend(const Char *, glob11_t *, struct glob_limit *,
136     const char *);
137 static const Char *
138 		 globtilde(const Char *, Char *, size_t, glob11_t *);
139 static int	 globexp0(const Char *, glob11_t *, struct glob_limit *,
140     const char *);
141 static int	 globexp1(const Char *, glob11_t *, struct glob_limit *);
142 static int	 globexp2(const Char *, const Char *, glob11_t *,
143     struct glob_limit *);
144 static int	 globfinal(glob11_t *, struct glob_limit *, size_t,
145     const char *);
146 static int	 match(Char *, Char *, Char *);
147 static int	 err_nomatch(glob11_t *, struct glob_limit *, const char *);
148 static int	 err_aborted(glob11_t *, int, char *);
149 #ifdef DEBUG
150 static void	 qprintf(const char *, Char *);
151 #endif
152 
153 int
154 freebsd11_glob(const char * __restrict pattern, int flags,
155 	 int (*errfunc)(const char *, int), glob11_t * __restrict pglob)
156 {
157 	struct glob_limit limit = { 0, 0, 0, 0, 0 };
158 	const char *patnext;
159 	Char *bufnext, *bufend, patbuf[MAXPATHLEN], prot;
160 	mbstate_t mbs;
161 	wchar_t wc;
162 	size_t clen;
163 	int too_long;
164 
165 	patnext = pattern;
166 	if (!(flags & GLOB_APPEND)) {
167 		pglob->gl_pathc = 0;
168 		pglob->gl_pathv = NULL;
169 		if (!(flags & GLOB_DOOFFS))
170 			pglob->gl_offs = 0;
171 	}
172 	if (flags & GLOB_LIMIT) {
173 		limit.l_path_lim = pglob->gl_matchc;
174 		if (limit.l_path_lim == 0)
175 			limit.l_path_lim = GLOB_LIMIT_PATH;
176 	}
177 	pglob->gl_flags = flags & ~GLOB_MAGCHAR;
178 	pglob->gl_errfunc = errfunc;
179 	pglob->gl_matchc = 0;
180 
181 	bufnext = patbuf;
182 	bufend = bufnext + MAXPATHLEN - 1;
183 	too_long = 1;
184 	if (flags & GLOB_NOESCAPE) {
185 		memset(&mbs, 0, sizeof(mbs));
186 		while (bufnext <= bufend) {
187 			clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
188 			if (clen == (size_t)-1 || clen == (size_t)-2)
189 				return (err_nomatch(pglob, &limit, pattern));
190 			else if (clen == 0) {
191 				too_long = 0;
192 				break;
193 			}
194 			*bufnext++ = wc;
195 			patnext += clen;
196 		}
197 	} else {
198 		/* Protect the quoted characters. */
199 		memset(&mbs, 0, sizeof(mbs));
200 		while (bufnext <= bufend) {
201 			if (*patnext == '\\') {
202 				if (*++patnext == '\0') {
203 					*bufnext++ = QUOTE;
204 					continue;
205 				}
206 				prot = M_PROTECT;
207 			} else
208 				prot = 0;
209 			clen = mbrtowc(&wc, patnext, MB_LEN_MAX, &mbs);
210 			if (clen == (size_t)-1 || clen == (size_t)-2)
211 				return (err_nomatch(pglob, &limit, pattern));
212 			else if (clen == 0) {
213 				too_long = 0;
214 				break;
215 			}
216 			*bufnext++ = wc | prot;
217 			patnext += clen;
218 		}
219 	}
220 	if (too_long)
221 		return (err_nomatch(pglob, &limit, pattern));
222 	*bufnext = EOS;
223 
224 	if (flags & GLOB_BRACE)
225 	    return (globexp0(patbuf, pglob, &limit, pattern));
226 	else
227 	    return (glob0(patbuf, pglob, &limit, pattern));
228 }
229 
230 static int
231 globexp0(const Char *pattern, glob11_t *pglob, struct glob_limit *limit,
232     const char *origpat) {
233 	int rv;
234 	size_t oldpathc;
235 
236 	/* Protect a single {}, for find(1), like csh */
237 	if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS) {
238 		if ((pglob->gl_flags & GLOB_LIMIT) &&
239 		    limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
240 			errno = E2BIG;
241 			return (GLOB_NOSPACE);
242 		}
243 		return (glob0(pattern, pglob, limit, origpat));
244 	}
245 
246 	oldpathc = pglob->gl_pathc;
247 
248 	if ((rv = globexp1(pattern, pglob, limit)) != 0)
249 		return rv;
250 
251 	return (globfinal(pglob, limit, oldpathc, origpat));
252 }
253 
254 /*
255  * Expand recursively a glob {} pattern. When there is no more expansion
256  * invoke the standard globbing routine to glob the rest of the magic
257  * characters
258  */
259 static int
260 globexp1(const Char *pattern, glob11_t *pglob, struct glob_limit *limit)
261 {
262 	const Char* ptr;
263 
264 	if ((ptr = g_strchr(pattern, LBRACE)) != NULL) {
265 		if ((pglob->gl_flags & GLOB_LIMIT) &&
266 		    limit->l_brace_cnt++ >= GLOB_LIMIT_BRACE) {
267 			errno = E2BIG;
268 			return (GLOB_NOSPACE);
269 		}
270 		return (globexp2(ptr, pattern, pglob, limit));
271 	}
272 
273 	return (glob0(pattern, pglob, limit, NULL));
274 }
275 
276 
277 /*
278  * Recursive brace globbing helper. Tries to expand a single brace.
279  * If it succeeds then it invokes globexp1 with the new pattern.
280  * If it fails then it tries to glob the rest of the pattern and returns.
281  */
282 static int
283 globexp2(const Char *ptr, const Char *pattern, glob11_t *pglob,
284     struct glob_limit *limit)
285 {
286 	int     i, rv;
287 	Char   *lm, *ls;
288 	const Char *pe, *pm, *pm1, *pl;
289 	Char    patbuf[MAXPATHLEN];
290 
291 	/* copy part up to the brace */
292 	for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
293 		continue;
294 	*lm = EOS;
295 	ls = lm;
296 
297 	/* Find the balanced brace */
298 	for (i = 0, pe = ++ptr; *pe != EOS; pe++)
299 		if (*pe == LBRACKET) {
300 			/* Ignore everything between [] */
301 			for (pm = pe++; *pe != RBRACKET && *pe != EOS; pe++)
302 				continue;
303 			if (*pe == EOS) {
304 				/*
305 				 * We could not find a matching RBRACKET.
306 				 * Ignore and just look for RBRACE
307 				 */
308 				pe = pm;
309 			}
310 		}
311 		else if (*pe == LBRACE)
312 			i++;
313 		else if (*pe == RBRACE) {
314 			if (i == 0)
315 				break;
316 			i--;
317 		}
318 
319 	/* Non matching braces; just glob the pattern */
320 	if (i != 0 || *pe == EOS)
321 		return (glob0(pattern, pglob, limit, NULL));
322 
323 	for (i = 0, pl = pm = ptr; pm <= pe; pm++)
324 		switch (*pm) {
325 		case LBRACKET:
326 			/* Ignore everything between [] */
327 			for (pm1 = pm++; *pm != RBRACKET && *pm != EOS; pm++)
328 				continue;
329 			if (*pm == EOS) {
330 				/*
331 				 * We could not find a matching RBRACKET.
332 				 * Ignore and just look for RBRACE
333 				 */
334 				pm = pm1;
335 			}
336 			break;
337 
338 		case LBRACE:
339 			i++;
340 			break;
341 
342 		case RBRACE:
343 			if (i) {
344 			    i--;
345 			    break;
346 			}
347 			/* FALLTHROUGH */
348 		case COMMA:
349 			if (i && *pm == COMMA)
350 				break;
351 			else {
352 				/* Append the current string */
353 				for (lm = ls; (pl < pm); *lm++ = *pl++)
354 					continue;
355 				/*
356 				 * Append the rest of the pattern after the
357 				 * closing brace
358 				 */
359 				for (pl = pe + 1; (*lm++ = *pl++) != EOS;)
360 					continue;
361 
362 				/* Expand the current pattern */
363 #ifdef DEBUG
364 				qprintf("globexp2:", patbuf);
365 #endif
366 				rv = globexp1(patbuf, pglob, limit);
367 				if (rv)
368 					return (rv);
369 
370 				/* move after the comma, to the next string */
371 				pl = pm + 1;
372 			}
373 			break;
374 
375 		default:
376 			break;
377 		}
378 	return (0);
379 }
380 
381 
382 
383 /*
384  * expand tilde from the passwd file.
385  */
386 static const Char *
387 globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob11_t *pglob)
388 {
389 	struct passwd *pwd;
390 	char *h, *sc;
391 	const Char *p;
392 	Char *b, *eb;
393 	wchar_t wc;
394 	wchar_t wbuf[MAXPATHLEN];
395 	wchar_t *wbufend, *dc;
396 	size_t clen;
397 	mbstate_t mbs;
398 	int too_long;
399 
400 	if (*pattern != TILDE || !(pglob->gl_flags & GLOB_TILDE))
401 		return (pattern);
402 
403 	/*
404 	 * Copy up to the end of the string or /
405 	 */
406 	eb = &patbuf[patbuf_len - 1];
407 	for (p = pattern + 1, b = patbuf;
408 	    b < eb && *p != EOS && UNPROT(*p) != SEP; *b++ = *p++)
409 		continue;
410 
411 	if (*p != EOS && UNPROT(*p) != SEP)
412 		return (NULL);
413 
414 	*b = EOS;
415 	h = NULL;
416 
417 	if (patbuf[0] == EOS) {
418 		/*
419 		 * handle a plain ~ or ~/ by expanding $HOME first (iff
420 		 * we're not running setuid or setgid) and then trying
421 		 * the password file
422 		 */
423 		if ((h = secure_getenv("HOME")) == NULL) {
424 			if (((h = getlogin()) != NULL &&
425 			     (pwd = getpwnam(h)) != NULL) ||
426 			    (pwd = getpwuid(getuid())) != NULL)
427 				h = pwd->pw_dir;
428 			else
429 				return (pattern);
430 		}
431 	}
432 	else {
433 		/*
434 		 * Expand a ~user
435 		 */
436 		if (g_Ctoc(patbuf, (char *)wbuf, sizeof(wbuf)))
437 			return (NULL);
438 		if ((pwd = getpwnam((char *)wbuf)) == NULL)
439 			return (pattern);
440 		else
441 			h = pwd->pw_dir;
442 	}
443 
444 	/* Copy the home directory */
445 	dc = wbuf;
446 	sc = h;
447 	wbufend = wbuf + MAXPATHLEN - 1;
448 	too_long = 1;
449 	memset(&mbs, 0, sizeof(mbs));
450 	while (dc <= wbufend) {
451 		clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
452 		if (clen == (size_t)-1 || clen == (size_t)-2) {
453 			/* XXX See initial comment #2. */
454 			wc = (unsigned char)*sc;
455 			clen = 1;
456 			memset(&mbs, 0, sizeof(mbs));
457 		}
458 		if ((*dc++ = wc) == EOS) {
459 			too_long = 0;
460 			break;
461 		}
462 		sc += clen;
463 	}
464 	if (too_long)
465 		return (NULL);
466 
467 	dc = wbuf;
468 	for (b = patbuf; b < eb && *dc != EOS; *b++ = *dc++ | M_PROTECT)
469 		continue;
470 	if (*dc != EOS)
471 		return (NULL);
472 
473 	/* Append the rest of the pattern */
474 	if (*p != EOS) {
475 		too_long = 1;
476 		while (b <= eb) {
477 			if ((*b++ = *p++) == EOS) {
478 				too_long = 0;
479 				break;
480 			}
481 		}
482 		if (too_long)
483 			return (NULL);
484 	} else
485 		*b = EOS;
486 
487 	return (patbuf);
488 }
489 
490 
491 /*
492  * The main glob() routine: compiles the pattern (optionally processing
493  * quotes), calls glob1() to do the real pattern matching, and finally
494  * sorts the list (unless unsorted operation is requested).  Returns 0
495  * if things went well, nonzero if errors occurred.
496  */
497 static int
498 glob0(const Char *pattern, glob11_t *pglob, struct glob_limit *limit,
499     const char *origpat) {
500 	const Char *qpatnext;
501 	int err;
502 	size_t oldpathc;
503 	Char *bufnext, c, patbuf[MAXPATHLEN];
504 
505 	qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
506 	if (qpatnext == NULL) {
507 		errno = E2BIG;
508 		return (GLOB_NOSPACE);
509 	}
510 	oldpathc = pglob->gl_pathc;
511 	bufnext = patbuf;
512 
513 	/* We don't need to check for buffer overflow any more. */
514 	while ((c = *qpatnext++) != EOS) {
515 		switch (c) {
516 		case LBRACKET:
517 			c = *qpatnext;
518 			if (c == NOT)
519 				++qpatnext;
520 			if (*qpatnext == EOS ||
521 			    g_strchr(qpatnext+1, RBRACKET) == NULL) {
522 				*bufnext++ = LBRACKET;
523 				if (c == NOT)
524 					--qpatnext;
525 				break;
526 			}
527 			*bufnext++ = M_SET;
528 			if (c == NOT)
529 				*bufnext++ = M_NOT;
530 			c = *qpatnext++;
531 			do {
532 				*bufnext++ = CHAR(c);
533 				if (*qpatnext == RANGE &&
534 				    (c = qpatnext[1]) != RBRACKET) {
535 					*bufnext++ = M_RNG;
536 					*bufnext++ = CHAR(c);
537 					qpatnext += 2;
538 				}
539 			} while ((c = *qpatnext++) != RBRACKET);
540 			pglob->gl_flags |= GLOB_MAGCHAR;
541 			*bufnext++ = M_END;
542 			break;
543 		case QUESTION:
544 			pglob->gl_flags |= GLOB_MAGCHAR;
545 			*bufnext++ = M_ONE;
546 			break;
547 		case STAR:
548 			pglob->gl_flags |= GLOB_MAGCHAR;
549 			/* collapse adjacent stars to one,
550 			 * to avoid exponential behavior
551 			 */
552 			if (bufnext == patbuf || bufnext[-1] != M_ALL)
553 			    *bufnext++ = M_ALL;
554 			break;
555 		default:
556 			*bufnext++ = CHAR(c);
557 			break;
558 		}
559 	}
560 	*bufnext = EOS;
561 #ifdef DEBUG
562 	qprintf("glob0:", patbuf);
563 #endif
564 
565 	if ((err = glob1(patbuf, pglob, limit)) != 0)
566 		return(err);
567 
568 	if (origpat != NULL)
569 		return (globfinal(pglob, limit, oldpathc, origpat));
570 
571 	return (0);
572 }
573 
574 static int
575 globfinal(glob11_t *pglob, struct glob_limit *limit, size_t oldpathc,
576     const char *origpat) {
577 	if (pglob->gl_pathc == oldpathc)
578 		return (err_nomatch(pglob, limit, origpat));
579 
580 	if (!(pglob->gl_flags & GLOB_NOSORT))
581 		qsort(pglob->gl_pathv + pglob->gl_offs + oldpathc,
582 		    pglob->gl_pathc - oldpathc, sizeof(char *), compare);
583 
584 	return (0);
585 }
586 
587 static int
588 compare(const void *p, const void *q)
589 {
590 	return (strcoll(*(char **)p, *(char **)q));
591 }
592 
593 static int
594 glob1(Char *pattern, glob11_t *pglob, struct glob_limit *limit)
595 {
596 	Char pathbuf[MAXPATHLEN];
597 
598 	/* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
599 	if (*pattern == EOS)
600 		return (0);
601 	return (glob2(pathbuf, pathbuf, pathbuf + MAXPATHLEN - 1,
602 	    pattern, pglob, limit));
603 }
604 
605 /*
606  * The functions glob2 and glob3 are mutually recursive; there is one level
607  * of recursion for each segment in the pattern that contains one or more
608  * meta characters.
609  */
610 static int
611 glob2(Char *pathbuf, Char *pathend, Char *pathend_last, Char *pattern,
612       glob11_t *pglob, struct glob_limit *limit)
613 {
614 	struct freebsd11_stat sb;
615 	Char *p, *q;
616 	int anymeta;
617 
618 	/*
619 	 * Loop over pattern segments until end of pattern or until
620 	 * segment with meta character found.
621 	 */
622 	for (anymeta = 0;;) {
623 		if (*pattern == EOS) {		/* End of pattern? */
624 			*pathend = EOS;
625 			if (g_lstat(pathbuf, &sb, pglob))
626 				return (0);
627 
628 			if ((pglob->gl_flags & GLOB_LIMIT) &&
629 			    limit->l_stat_cnt++ >= GLOB_LIMIT_STAT) {
630 				errno = E2BIG;
631 				return (GLOB_NOSPACE);
632 			}
633 			if ((pglob->gl_flags & GLOB_MARK) &&
634 			    UNPROT(pathend[-1]) != SEP &&
635 			    (S_ISDIR(sb.st_mode) ||
636 			    (S_ISLNK(sb.st_mode) &&
637 			    g_stat(pathbuf, &sb, pglob) == 0 &&
638 			    S_ISDIR(sb.st_mode)))) {
639 				if (pathend + 1 > pathend_last) {
640 					errno = E2BIG;
641 					return (GLOB_NOSPACE);
642 				}
643 				*pathend++ = SEP;
644 				*pathend = EOS;
645 			}
646 			++pglob->gl_matchc;
647 			return (globextend(pathbuf, pglob, limit, NULL));
648 		}
649 
650 		/* Find end of next segment, copy tentatively to pathend. */
651 		q = pathend;
652 		p = pattern;
653 		while (*p != EOS && UNPROT(*p) != SEP) {
654 			if (ismeta(*p))
655 				anymeta = 1;
656 			if (q + 1 > pathend_last) {
657 				errno = E2BIG;
658 				return (GLOB_NOSPACE);
659 			}
660 			*q++ = *p++;
661 		}
662 
663 		if (!anymeta) {		/* No expansion, do next segment. */
664 			pathend = q;
665 			pattern = p;
666 			while (UNPROT(*pattern) == SEP) {
667 				if (pathend + 1 > pathend_last) {
668 					errno = E2BIG;
669 					return (GLOB_NOSPACE);
670 				}
671 				*pathend++ = *pattern++;
672 			}
673 		} else			/* Need expansion, recurse. */
674 			return (glob3(pathbuf, pathend, pathend_last, pattern,
675 			    p, pglob, limit));
676 	}
677 	/* NOTREACHED */
678 }
679 
680 static int
681 glob3(Char *pathbuf, Char *pathend, Char *pathend_last,
682       Char *pattern, Char *restpattern,
683       glob11_t *pglob, struct glob_limit *limit)
684 {
685 	struct freebsd11_dirent *dp;
686 	DIR *dirp;
687 	int err, too_long, saverrno, saverrno2;
688 	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
689 
690 	struct freebsd11_dirent *(*readdirfunc)(DIR *);
691 
692 	if (pathend > pathend_last) {
693 		errno = E2BIG;
694 		return (GLOB_NOSPACE);
695 	}
696 	*pathend = EOS;
697 	if (pglob->gl_errfunc != NULL &&
698 	    g_Ctoc(pathbuf, buf, sizeof(buf))) {
699 		errno = E2BIG;
700 		return (GLOB_NOSPACE);
701 	}
702 
703 	saverrno = errno;
704 	errno = 0;
705 	if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
706 		if (errno == ENOENT || errno == ENOTDIR)
707 			return (0);
708 		err = err_aborted(pglob, errno, buf);
709 		if (errno == 0)
710 			errno = saverrno;
711 		return (err);
712 	}
713 
714 	err = 0;
715 
716 	/* pglob->gl_readdir takes a void *, fix this manually */
717 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
718 		readdirfunc =
719 		    (struct freebsd11_dirent *(*)(DIR *))pglob->gl_readdir;
720 	else
721 		readdirfunc = freebsd11_readdir;
722 
723 	errno = 0;
724 	/* Search directory for matching names. */
725 	while ((dp = (*readdirfunc)(dirp)) != NULL) {
726 		char *sc;
727 		Char *dc;
728 		wchar_t wc;
729 		size_t clen;
730 		mbstate_t mbs;
731 
732 		if ((pglob->gl_flags & GLOB_LIMIT) &&
733 		    limit->l_readdir_cnt++ >= GLOB_LIMIT_READDIR) {
734 			errno = E2BIG;
735 			err = GLOB_NOSPACE;
736 			break;
737 		}
738 
739 		/* Initial DOT must be matched literally. */
740 		if (dp->d_name[0] == '.' && UNPROT(*pattern) != DOT) {
741 			errno = 0;
742 			continue;
743 		}
744 		memset(&mbs, 0, sizeof(mbs));
745 		dc = pathend;
746 		sc = dp->d_name;
747 		too_long = 1;
748 		while (dc <= pathend_last) {
749 			clen = mbrtowc(&wc, sc, MB_LEN_MAX, &mbs);
750 			if (clen == (size_t)-1 || clen == (size_t)-2) {
751 				/* XXX See initial comment #2. */
752 				wc = (unsigned char)*sc;
753 				clen = 1;
754 				memset(&mbs, 0, sizeof(mbs));
755 			}
756 			if ((*dc++ = wc) == EOS) {
757 				too_long = 0;
758 				break;
759 			}
760 			sc += clen;
761 		}
762 		if (too_long && (err = err_aborted(pglob, ENAMETOOLONG,
763 		    buf))) {
764 			errno = ENAMETOOLONG;
765 			break;
766 		}
767 		if (too_long || !match(pathend, pattern, restpattern)) {
768 			*pathend = EOS;
769 			errno = 0;
770 			continue;
771 		}
772 		if (errno == 0)
773 			errno = saverrno;
774 		err = glob2(pathbuf, --dc, pathend_last, restpattern,
775 		    pglob, limit);
776 		if (err)
777 			break;
778 		errno = 0;
779 	}
780 
781 	saverrno2 = errno;
782 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
783 		(*pglob->gl_closedir)(dirp);
784 	else
785 		closedir(dirp);
786 	errno = saverrno2;
787 
788 	if (err)
789 		return (err);
790 
791 	if (dp == NULL && errno != 0 &&
792 	    (err = err_aborted(pglob, errno, buf)))
793 		return (err);
794 
795 	if (errno == 0)
796 		errno = saverrno;
797 	return (0);
798 }
799 
800 
801 /*
802  * Extend the gl_pathv member of a glob11_t structure to accommodate a new item,
803  * add the new item, and update gl_pathc.
804  *
805  * This assumes the BSD realloc, which only copies the block when its size
806  * crosses a power-of-two boundary; for v7 realloc, this would cause quadratic
807  * behavior.
808  *
809  * Return 0 if new item added, error code if memory couldn't be allocated.
810  *
811  * Invariant of the glob11_t structure:
812  *	Either gl_pathc is zero and gl_pathv is NULL; or gl_pathc > 0 and
813  *	gl_pathv points to (gl_offs + gl_pathc + 1) items.
814  */
815 static int
816 globextend(const Char *path, glob11_t *pglob, struct glob_limit *limit,
817     const char *origpat)
818 {
819 	char **pathv;
820 	size_t i, newn, len;
821 	char *copy;
822 	const Char *p;
823 
824 	if ((pglob->gl_flags & GLOB_LIMIT) &&
825 	    pglob->gl_matchc > limit->l_path_lim) {
826 		errno = E2BIG;
827 		return (GLOB_NOSPACE);
828 	}
829 
830 	newn = 2 + pglob->gl_pathc + pglob->gl_offs;
831 	/* reallocarray(NULL, newn, size) is equivalent to malloc(newn*size). */
832 	pathv = reallocarray(pglob->gl_pathv, newn, sizeof(*pathv));
833 	if (pathv == NULL)
834 		return (GLOB_NOSPACE);
835 
836 	if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
837 		/* first time around -- clear initial gl_offs items */
838 		pathv += pglob->gl_offs;
839 		for (i = pglob->gl_offs + 1; --i > 0; )
840 			*--pathv = NULL;
841 	}
842 	pglob->gl_pathv = pathv;
843 
844 	if (origpat != NULL)
845 		copy = strdup(origpat);
846 	else {
847 		for (p = path; *p++ != EOS;)
848 			continue;
849 		len = MB_CUR_MAX * (size_t)(p - path); /* XXX overallocation */
850 		if ((copy = malloc(len)) != NULL) {
851 			if (g_Ctoc(path, copy, len)) {
852 				free(copy);
853 				errno = E2BIG;
854 				return (GLOB_NOSPACE);
855 			}
856 		}
857 	}
858 	if (copy != NULL) {
859 		limit->l_string_cnt += strlen(copy) + 1;
860 		if ((pglob->gl_flags & GLOB_LIMIT) &&
861 		    limit->l_string_cnt >= GLOB_LIMIT_STRING) {
862 			free(copy);
863 			errno = E2BIG;
864 			return (GLOB_NOSPACE);
865 		}
866 		pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
867 	}
868 	pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
869 	return (copy == NULL ? GLOB_NOSPACE : 0);
870 }
871 
872 /*
873  * pattern matching function for filenames.
874  */
875 static int
876 match(Char *name, Char *pat, Char *patend)
877 {
878 	int ok, negate_range;
879 	Char c, k, *nextp, *nextn;
880 	struct xlocale_collate *table =
881 		(struct xlocale_collate*)__get_locale()->components[XLC_COLLATE];
882 
883 	nextn = NULL;
884 	nextp = NULL;
885 
886 	while (1) {
887 		while (pat < patend) {
888 			c = *pat++;
889 			switch (c & M_MASK) {
890 			case M_ALL:
891 				if (pat == patend)
892 					return (1);
893 				if (*name == EOS)
894 					return (0);
895 				nextn = name + 1;
896 				nextp = pat - 1;
897 				break;
898 			case M_ONE:
899 				if (*name++ == EOS)
900 					goto fail;
901 				break;
902 			case M_SET:
903 				ok = 0;
904 				if ((k = *name++) == EOS)
905 					goto fail;
906 				negate_range = ((*pat & M_MASK) == M_NOT);
907 				if (negate_range != 0)
908 					++pat;
909 				while (((c = *pat++) & M_MASK) != M_END)
910 					if ((*pat & M_MASK) == M_RNG) {
911 						if (table->__collate_load_error ?
912 						    CHAR(c) <= CHAR(k) &&
913 						    CHAR(k) <= CHAR(pat[1]) :
914 						    __wcollate_range_cmp(CHAR(c),
915 						    CHAR(k)) <= 0 &&
916 						    __wcollate_range_cmp(CHAR(k),
917 						    CHAR(pat[1])) <= 0)
918 							ok = 1;
919 						pat += 2;
920 					} else if (c == k)
921 						ok = 1;
922 				if (ok == negate_range)
923 					goto fail;
924 				break;
925 			default:
926 				if (*name++ != c)
927 					goto fail;
928 				break;
929 			}
930 		}
931 		if (*name == EOS)
932 			return (1);
933 
934 	fail:
935 		if (nextn == NULL)
936 			break;
937 		pat = nextp;
938 		name = nextn;
939 	}
940 	return (0);
941 }
942 
943 /* Free allocated data belonging to a glob11_t structure. */
944 void
945 freebsd11_globfree(glob11_t *pglob)
946 {
947 	size_t i;
948 	char **pp;
949 
950 	if (pglob->gl_pathv != NULL) {
951 		pp = pglob->gl_pathv + pglob->gl_offs;
952 		for (i = pglob->gl_pathc; i--; ++pp)
953 			if (*pp)
954 				free(*pp);
955 		free(pglob->gl_pathv);
956 		pglob->gl_pathv = NULL;
957 	}
958 }
959 
960 static DIR *
961 g_opendir(Char *str, glob11_t *pglob)
962 {
963 	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
964 
965 	if (*str == EOS)
966 		strcpy(buf, ".");
967 	else {
968 		if (g_Ctoc(str, buf, sizeof(buf))) {
969 			errno = ENAMETOOLONG;
970 			return (NULL);
971 		}
972 	}
973 
974 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
975 		return ((*pglob->gl_opendir)(buf));
976 
977 	return (opendir(buf));
978 }
979 
980 static int
981 g_lstat(Char *fn, struct freebsd11_stat *sb, glob11_t *pglob)
982 {
983 	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
984 
985 	if (g_Ctoc(fn, buf, sizeof(buf))) {
986 		errno = ENAMETOOLONG;
987 		return (-1);
988 	}
989 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
990 		return((*pglob->gl_lstat)(buf, sb));
991 	return (freebsd11_lstat(buf, sb));
992 }
993 
994 static int
995 g_stat(Char *fn, struct freebsd11_stat *sb, glob11_t *pglob)
996 {
997 	char buf[MAXPATHLEN + MB_LEN_MAX - 1];
998 
999 	if (g_Ctoc(fn, buf, sizeof(buf))) {
1000 		errno = ENAMETOOLONG;
1001 		return (-1);
1002 	}
1003 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
1004 		return ((*pglob->gl_stat)(buf, sb));
1005 	return (freebsd11_stat(buf, sb));
1006 }
1007 
1008 static const Char *
1009 g_strchr(const Char *str, wchar_t ch)
1010 {
1011 
1012 	do {
1013 		if (*str == ch)
1014 			return (str);
1015 	} while (*str++);
1016 	return (NULL);
1017 }
1018 
1019 static int
1020 g_Ctoc(const Char *str, char *buf, size_t len)
1021 {
1022 	mbstate_t mbs;
1023 	size_t clen;
1024 
1025 	memset(&mbs, 0, sizeof(mbs));
1026 	while (len >= MB_CUR_MAX) {
1027 		clen = wcrtomb(buf, CHAR(*str), &mbs);
1028 		if (clen == (size_t)-1) {
1029 			/* XXX See initial comment #2. */
1030 			*buf = (char)CHAR(*str);
1031 			clen = 1;
1032 			memset(&mbs, 0, sizeof(mbs));
1033 		}
1034 		if (CHAR(*str) == EOS)
1035 			return (0);
1036 		str++;
1037 		buf += clen;
1038 		len -= clen;
1039 	}
1040 	return (1);
1041 }
1042 
1043 static int
1044 err_nomatch(glob11_t *pglob, struct glob_limit *limit, const char *origpat) {
1045 	/*
1046 	 * If there was no match we are going to append the origpat
1047 	 * if GLOB_NOCHECK was specified or if GLOB_NOMAGIC was specified
1048 	 * and the origpat did not contain any magic characters
1049 	 * GLOB_NOMAGIC is there just for compatibility with csh.
1050 	 */
1051 	if ((pglob->gl_flags & GLOB_NOCHECK) ||
1052 	    ((pglob->gl_flags & GLOB_NOMAGIC) &&
1053 	    !(pglob->gl_flags & GLOB_MAGCHAR)))
1054 		return (globextend(NULL, pglob, limit, origpat));
1055 	return (GLOB_NOMATCH);
1056 }
1057 
1058 static int
1059 err_aborted(glob11_t *pglob, int err, char *buf) {
1060 	if ((pglob->gl_errfunc != NULL && pglob->gl_errfunc(buf, err)) ||
1061 	    (pglob->gl_flags & GLOB_ERR))
1062 		return (GLOB_ABORTED);
1063 	return (0);
1064 }
1065 
1066 #ifdef DEBUG
1067 static void
1068 qprintf(const char *str, Char *s)
1069 {
1070 	Char *p;
1071 
1072 	(void)printf("%s\n", str);
1073 	if (s != NULL) {
1074 		for (p = s; *p != EOS; p++)
1075 			(void)printf("%c", (char)CHAR(*p));
1076 		(void)printf("\n");
1077 		for (p = s; *p != EOS; p++)
1078 			(void)printf("%c", (isprot(*p) ? '\\' : ' '));
1079 		(void)printf("\n");
1080 		for (p = s; *p != EOS; p++)
1081 			(void)printf("%c", (ismeta(*p) ? '_' : ' '));
1082 		(void)printf("\n");
1083 	}
1084 }
1085 #endif
1086 
1087 __sym_compat(glob, freebsd11_glob, FBSD_1.0);
1088 __sym_compat(globfree, freebsd11_globfree, FBSD_1.0);
1089