1 files changed, 223 insertions, 83 deletions

diff --git a/openbsd-compat/glob.c b/openbsd-compat/glob.c
index 74b506403..0341225cd 100644
--- a/openbsd-compat/glob.c
+++ b/openbsd-compat/glob.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: glob.c,v 1.26 2005/11/28 17:50:12 deraadt Exp $ */
+/*      $OpenBSD: glob.c,v 1.35 2011/01/12 01:53:14 djm Exp $ */
 /*
  * Copyright (c) 1989, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -33,36 +33,6 @@
 
 /* OPENBSD ORIGINAL: lib/libc/gen/glob.c */
 
-#include "includes.h"
-
-#include <sys/types.h>
-#include <sys/stat.h>
-
-#include <dirent.h>
-#include <ctype.h>
-#include <errno.h>
-#include <pwd.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \
-    !defined(GLOB_HAS_GL_MATCHC) || \
-    !defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 || \
-    defined(BROKEN_GLOB)
-
-static long
-get_arg_max(void)
-{
-#ifdef ARG_MAX
-        return(ARG_MAX);
-#elif defined(HAVE_SYSCONF) && defined(_SC_ARG_MAX)
-        return(sysconf(_SC_ARG_MAX));
-#else
-        return(256); /* XXX: arbitrary */
-#endif
-}
-
 /*
  * glob(3) -- a superset of the one defined in POSIX 1003.2.
  *
@@ -88,6 +58,25 @@ get_arg_max(void)
  *      Number of matches in the current invocation of glob.
  */
 
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <dirent.h>
+#include <ctype.h>
+#include <errno.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \
+    !defined(GLOB_HAS_GL_MATCHC) || !defined(GLOB_HAS_GL_STATV) || \
+    !defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 || \
+    defined(BROKEN_GLOB)
+
+#include "charclass.h"
 
 #define DOLLAR          '$'
 #define DOT             '.'
@@ -100,7 +89,6 @@ get_arg_max(void)
 #define RBRACKET        ']'
 #define SEP             '/'
 #define STAR            '*'
-#undef TILDE                    /* Some platforms may already define it */
 #define TILDE           '~'
 #define UNDERSCORE      '_'
 #define LBRACE          '{'
@@ -137,26 +125,39 @@ typedef char Char;
 #define M_ONE           META('?')
 #define M_RNG           META('-')
 #define M_SET           META('[')
+#define M_CLASS         META(':')
 #define ismeta(c)       (((c)&M_QUOTE) != 0)
 
+#define GLOB_LIMIT_MALLOC       65536
+#define GLOB_LIMIT_STAT         128
+#define GLOB_LIMIT_READDIR      16384
+
+struct glob_lim {
+        size_t  glim_malloc;
+        size_t  glim_stat;
+        size_t  glim_readdir;
+};
 
 static int       compare(const void *, const void *);
 static int       g_Ctoc(const Char *, char *, u_int);
 static int       g_lstat(Char *, struct stat *, glob_t *);
 static DIR      *g_opendir(Char *, glob_t *);
-static Char     *g_strchr(Char *, int);
+static Char     *g_strchr(const Char *, int);
+static int       g_strncmp(const Char *, const char *, size_t);
 static int       g_stat(Char *, struct stat *, glob_t *);
-static int       glob0(const Char *, glob_t *);
-static int       glob1(Char *, Char *, glob_t *, size_t *);
+static int       glob0(const Char *, glob_t *, struct glob_lim *);
+static int       glob1(Char *, Char *, glob_t *, struct glob_lim *);
 static int       glob2(Char *, Char *, Char *, Char *, Char *, Char *,
-                    glob_t *, size_t *);
+                    glob_t *, struct glob_lim *);
 static int       glob3(Char *, Char *, Char *, Char *, Char *,
-                    Char *, Char *, glob_t *, size_t *);
-static int       globextend(const Char *, glob_t *, size_t *);
+                    Char *, Char *, glob_t *, struct glob_lim *);
+static int       globextend(const Char *, glob_t *, struct glob_lim *,
+                    struct stat *);
 static const Char *
                  globtilde(const Char *, Char *, size_t, glob_t *);
-static int       globexp1(const Char *, glob_t *);
-static int       globexp2(const Char *, const Char *, glob_t *, int *);
+static int       globexp1(const Char *, glob_t *, struct glob_lim *);
+static int       globexp2(const Char *, const Char *, glob_t *,
+                    struct glob_lim *);
 static int       match(Char *, Char *, Char *);
 #ifdef DEBUG
 static void      qprintf(const char *, Char *);
@@ -169,11 +170,13 @@ glob(const char *pattern, int flags, int (*errfunc)(const char *, int),
         const u_char *patnext;
         int c;
         Char *bufnext, *bufend, patbuf[MAXPATHLEN];
+        struct glob_lim limit = { 0, 0, 0 };
 
         patnext = (u_char *) pattern;
         if (!(flags & GLOB_APPEND)) {
                 pglob->gl_pathc = 0;
                 pglob->gl_pathv = NULL;
+                pglob->gl_statv = NULL;
                 if (!(flags & GLOB_DOOFFS))
                         pglob->gl_offs = 0;
         }
@@ -181,6 +184,11 @@ glob(const char *pattern, int flags, int (*errfunc)(const char *, int),
         pglob->gl_errfunc = errfunc;
         pglob->gl_matchc = 0;
 
+        if (pglob->gl_offs < 0 || pglob->gl_pathc < 0 ||
+            pglob->gl_offs >= INT_MAX || pglob->gl_pathc >= INT_MAX ||
+            pglob->gl_pathc >= INT_MAX - pglob->gl_offs - 1)
+                return GLOB_NOSPACE;
+
         bufnext = patbuf;
         bufend = bufnext + MAXPATHLEN - 1;
         if (flags & GLOB_NOESCAPE)
@@ -201,9 +209,9 @@ glob(const char *pattern, int flags, int (*errfunc)(const char *, int),
         *bufnext = EOS;
 
         if (flags & GLOB_BRACE)
-                return globexp1(patbuf, pglob);
+                return globexp1(patbuf, pglob, &limit);
         else
-                return glob0(patbuf, pglob);
+                return glob0(patbuf, pglob, &limit);
 }
 
 /*
@@ -212,20 +220,18 @@ glob(const char *pattern, int flags, int (*errfunc)(const char *, int),
  * characters
  */
 static int
-globexp1(const Char *pattern, glob_t *pglob)
+globexp1(const Char *pattern, glob_t *pglob, struct glob_lim *limitp)
 {
         const Char* ptr = pattern;
-        int rv;
 
         /* Protect a single {}, for find(1), like csh */
         if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS)
-                return glob0(pattern, pglob);
+                return glob0(pattern, pglob, limitp);
 
-        while ((ptr = (const Char *) g_strchr((Char *) ptr, LBRACE)) != NULL)
-                if (!globexp2(ptr, pattern, pglob, &rv))
-                        return rv;
+        if ((ptr = (const Char *) g_strchr(ptr, LBRACE)) != NULL)
+                return globexp2(ptr, pattern, pglob, limitp);
 
-        return glob0(pattern, pglob);
+        return glob0(pattern, pglob, limitp);
 }
 
 
@@ -235,9 +241,10 @@ globexp1(const Char *pattern, glob_t *pglob)
  * If it fails then it tries to glob the rest of the pattern and returns.
  */
 static int
-globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv)
+globexp2(const Char *ptr, const Char *pattern, glob_t *pglob,
+    struct glob_lim *limitp)
 {
-        int     i;
+        int     i, rv;
         Char   *lm, *ls;
         const Char *pe, *pm, *pl;
         Char    patbuf[MAXPATHLEN];
@@ -270,10 +277,8 @@ globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv)
                 }
 
         /* Non matching braces; just glob the pattern */
-        if (i != 0 || *pe == EOS) {
-                *rv = glob0(patbuf, pglob);
-                return 0;
-        }
+        if (i != 0 || *pe == EOS)
+                return glob0(patbuf, pglob, limitp);
 
         for (i = 0, pl = pm = ptr; pm <= pe; pm++) {
                 switch (*pm) {
@@ -319,7 +324,9 @@ globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv)
 #ifdef DEBUG
                                 qprintf("globexp2:", patbuf);
 #endif
-                                *rv = globexp1(patbuf, pglob);
+                                rv = globexp1(patbuf, pglob, limitp);
+                                if (rv && rv != GLOB_NOMATCH)
+                                        return rv;
 
                                 /* move after the comma, to the next string */
                                 pl = pm + 1;
@@ -330,7 +337,6 @@ globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv)
                         break;
                 }
         }
-        *rv = 0;
         return 0;
 }
 
@@ -399,6 +405,47 @@ globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
         return patbuf;
 }
 
+static int
+g_strncmp(const Char *s1, const char *s2, size_t n)
+{
+        int rv = 0;
+
+        while (n--) {
+                rv = *(Char *)s1 - *(const unsigned char *)s2++;
+                if (rv)
+                        break;
+                if (*s1++ == '\0')
+                        break;
+        }
+        return rv;
+}
+
+static int
+g_charclass(const Char **patternp, Char **bufnextp)
+{
+        const Char *pattern = *patternp + 1;
+        Char *bufnext = *bufnextp;
+        const Char *colon;
+        struct cclass *cc;
+        size_t len;
+
+        if ((colon = g_strchr(pattern, ':')) == NULL || colon[1] != ']')
+                return 1;       /* not a character class */
+
+        len = (size_t)(colon - pattern);
+        for (cc = cclasses; cc->name != NULL; cc++) {
+                if (!g_strncmp(pattern, cc->name, len) && cc->name[len] == '\0')
+                        break;
+        }
+        if (cc->name == NULL)
+                return -1;      /* invalid character class */
+        *bufnext++ = M_CLASS;
+        *bufnext++ = (Char)(cc - &cclasses[0]);
+        *bufnextp = bufnext;
+        *patternp += len + 3;
+
+        return 0;
+}
 
 /*
  * The main glob() routine: compiles the pattern (optionally processing
@@ -408,12 +455,11 @@ globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
  * to find no matches.
  */
 static int
-glob0(const Char *pattern, glob_t *pglob)
+glob0(const Char *pattern, glob_t *pglob, struct glob_lim *limitp)
 {
         const Char *qpatnext;
         int c, err, oldpathc;
         Char *bufnext, patbuf[MAXPATHLEN];
-        size_t limit = 0;
 
         qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
         oldpathc = pglob->gl_pathc;
@@ -427,7 +473,7 @@ glob0(const Char *pattern, glob_t *pglob)
                         if (c == NOT)
                                 ++qpatnext;
                         if (*qpatnext == EOS ||
-                            g_strchr((Char *) qpatnext+1, RBRACKET) == NULL) {
+                            g_strchr(qpatnext+1, RBRACKET) == NULL) {
                                 *bufnext++ = LBRACKET;
                                 if (c == NOT)
                                         --qpatnext;
@@ -438,6 +484,20 @@ glob0(const Char *pattern, glob_t *pglob)
                                 *bufnext++ = M_NOT;
                         c = *qpatnext++;
                         do {
+                                if (c == LBRACKET && *qpatnext == ':') {
+                                        do {
+                                                err = g_charclass(&qpatnext,
+                                                    &bufnext);
+                                                if (err)
+                                                        break;
+                                                c = *qpatnext++;
+                                        } while (c == LBRACKET && *qpatnext == ':');
+                                        if (err == -1 &&
+                                            !(pglob->gl_flags & GLOB_NOCHECK))
+                                                return GLOB_NOMATCH;
+                                        if (c == RBRACKET)
+                                                break;
+                                }
                                 *bufnext++ = CHAR(c);
                                 if (*qpatnext == RANGE &&
                                     (c = qpatnext[1]) != RBRACKET) {
@@ -471,7 +531,7 @@ glob0(const Char *pattern, glob_t *pglob)
         qprintf("glob0:", patbuf);
 #endif
 
-        if ((err = glob1(patbuf, patbuf+MAXPATHLEN-1, pglob, &limit)) != 0)
+        if ((err = glob1(patbuf, patbuf+MAXPATHLEN-1, pglob, limitp)) != 0)
                 return(err);
 
         /*
@@ -484,7 +544,7 @@ glob0(const Char *pattern, glob_t *pglob)
                 if ((pglob->gl_flags & GLOB_NOCHECK) ||
                     ((pglob->gl_flags & GLOB_NOMAGIC) &&
                     !(pglob->gl_flags & GLOB_MAGCHAR)))
-                        return(globextend(pattern, pglob, &limit));
+                        return(globextend(pattern, pglob, limitp, NULL));
                 else
                         return(GLOB_NOMATCH);
         }
@@ -501,7 +561,7 @@ compare(const void *p, const void *q)
 }
 
 static int
-glob1(Char *pattern, Char *pattern_last, glob_t *pglob, size_t *limitp)
+glob1(Char *pattern, Char *pattern_last, glob_t *pglob, struct glob_lim *limitp)
 {
         Char pathbuf[MAXPATHLEN];
 
@@ -520,7 +580,7 @@ glob1(Char *pattern, Char *pattern_last, glob_t *pglob, size_t *limitp)
  */
 static int
 glob2(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
-    Char *pattern, Char *pattern_last, glob_t *pglob, size_t *limitp)
+    Char *pattern, Char *pattern_last, glob_t *pglob, struct glob_lim *limitp)
 {
         struct stat sb;
         Char *p, *q;
@@ -536,6 +596,14 @@ glob2(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
                         if (g_lstat(pathbuf, &sb, pglob))
                                 return(0);
 
+                        if ((pglob->gl_flags & GLOB_LIMIT) &&
+                            limitp->glim_stat++ >= GLOB_LIMIT_STAT) {
+                                errno = 0;
+                                *pathend++ = SEP;
+                                *pathend = EOS;
+                                return(GLOB_NOSPACE);
+                        }
+
                         if (((pglob->gl_flags & GLOB_MARK) &&
                             pathend[-1] != SEP) && (S_ISDIR(sb.st_mode) ||
                             (S_ISLNK(sb.st_mode) &&
@@ -547,7 +615,7 @@ glob2(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
                                 *pathend = EOS;
                         }
                         ++pglob->gl_matchc;
-                        return(globextend(pathbuf, pglob, limitp));
+                        return(globextend(pathbuf, pglob, limitp, &sb));
                 }
 
                 /* Find end of next segment, copy tentatively to pathend. */
@@ -581,7 +649,7 @@ glob2(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
 static int
 glob3(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
     Char *pattern, Char *restpattern, Char *restpattern_last, glob_t *pglob,
-    size_t *limitp)
+    struct glob_lim *limitp)
 {
         struct dirent *dp;
         DIR *dirp;
@@ -624,6 +692,14 @@ glob3(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
                 u_char *sc;
                 Char *dc;
 
+                if ((pglob->gl_flags & GLOB_LIMIT) &&
+                    limitp->glim_readdir++ >= GLOB_LIMIT_READDIR) {
+                        errno = 0;
+                        *pathend++ = SEP;
+                        *pathend = EOS;
+                        return(GLOB_NOSPACE);
+                }
+
                 /* Initial DOT must be matched literally. */
                 if (dp->d_name[0] == DOT && *pattern != DOT)
                         continue;
@@ -670,25 +746,44 @@ glob3(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
  *      gl_pathv points to (gl_offs + gl_pathc + 1) items.
  */
 static int
-globextend(const Char *path, glob_t *pglob, size_t *limitp)
+globextend(const Char *path, glob_t *pglob, struct glob_lim *limitp,
+    struct stat *sb)
 {
         char **pathv;
-        int i;
-        u_int newsize, len;
-        char *copy;
+        ssize_t i;
+        size_t newn, len;
+        char *copy = NULL;
         const Char *p;
-
-        newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs);
-        pathv = pglob->gl_pathv ? realloc((char *)pglob->gl_pathv, newsize) :
-            malloc(newsize);
-        if (pathv == NULL) {
+        struct stat **statv;
+
+        newn = 2 + pglob->gl_pathc + pglob->gl_offs;
+        if (pglob->gl_offs >= INT_MAX ||
+            pglob->gl_pathc >= INT_MAX ||
+            newn >= INT_MAX ||
+            SIZE_MAX / sizeof(*pathv) <= newn ||
+            SIZE_MAX / sizeof(*statv) <= newn) {
+ nospace:
+                for (i = pglob->gl_offs; i < (ssize_t)(newn - 2); i++) {
+                        if (pglob->gl_pathv && pglob->gl_pathv[i])
+                                free(pglob->gl_pathv[i]);
+                        if ((pglob->gl_flags & GLOB_KEEPSTAT) != 0 &&
+                            pglob->gl_pathv && pglob->gl_pathv[i])
+                                free(pglob->gl_statv[i]);
+                }
                 if (pglob->gl_pathv) {
                         free(pglob->gl_pathv);
                         pglob->gl_pathv = NULL;
                 }
+                if (pglob->gl_statv) {
+                        free(pglob->gl_statv);
+                        pglob->gl_statv = NULL;
+                }
                 return(GLOB_NOSPACE);
         }
 
+        pathv = realloc(pglob->gl_pathv, newn * sizeof(*pathv));
+        if (pathv == NULL)
+                goto nospace;
         if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
                 /* first time around -- clear initial gl_offs items */
                 pathv += pglob->gl_offs;
@@ -697,10 +792,39 @@ globextend(const Char *path, glob_t *pglob, size_t *limitp)
         }
         pglob->gl_pathv = pathv;
 
+        if ((pglob->gl_flags & GLOB_KEEPSTAT) != 0) {
+                statv = realloc(pglob->gl_statv, newn * sizeof(*statv));
+                if (statv == NULL)
+                        goto nospace;
+                if (pglob->gl_statv == NULL && pglob->gl_offs > 0) {
+                        /* first time around -- clear initial gl_offs items */
+                        statv += pglob->gl_offs;
+                        for (i = pglob->gl_offs; --i >= 0; )
+                                *--statv = NULL;
+                }
+                pglob->gl_statv = statv;
+                if (sb == NULL)
+                        statv[pglob->gl_offs + pglob->gl_pathc] = NULL;
+                else {
+                        limitp->glim_malloc += sizeof(**statv);
+                        if ((pglob->gl_flags & GLOB_LIMIT) &&
+                            limitp->glim_malloc >= GLOB_LIMIT_MALLOC) {
+                                errno = 0;
+                                return(GLOB_NOSPACE);
+                        }
+                        if ((statv[pglob->gl_offs + pglob->gl_pathc] =
+                            malloc(sizeof(**statv))) == NULL)
+                                goto copy_error;
+                        memcpy(statv[pglob->gl_offs + pglob->gl_pathc], sb,
+                            sizeof(*sb));
+                }
+                statv[pglob->gl_offs + pglob->gl_pathc + 1] = NULL;
+        }
+
         for (p = path; *p++;)
                 ;
         len = (size_t)(p - path);
-        *limitp += len;
+        limitp->glim_malloc += len;
         if ((copy = malloc(len)) != NULL) {
                 if (g_Ctoc(path, copy, len)) {
                         free(copy);
@@ -711,11 +835,12 @@ globextend(const Char *path, glob_t *pglob, size_t *limitp)
         pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
 
         if ((pglob->gl_flags & GLOB_LIMIT) &&
-            newsize + *limitp >= (u_int) get_arg_max()) {
+            (newn * sizeof(*pathv)) + limitp->glim_malloc >
+            GLOB_LIMIT_MALLOC) {
                 errno = 0;
                 return(GLOB_NOSPACE);
         }
-
+ copy_error:
         return(copy == NULL ? GLOB_NOSPACE : 0);
 }
 
@@ -751,13 +876,21 @@ match(Char *name, Char *pat, Char *patend)
                                 return(0);
                         if ((negate_range = ((*pat & M_MASK) == M_NOT)) != EOS)
                                 ++pat;
-                        while (((c = *pat++) & M_MASK) != M_END)
+                        while (((c = *pat++) & M_MASK) != M_END) {
+                                if ((c & M_MASK) == M_CLASS) {
+                                        Char idx = *pat & M_MASK;
+                                        if (idx < NCCLASSES &&
+                                            cclasses[idx].isctype(k))
+                                                ok = 1;
+                                        ++pat;
+                                }
                                 if ((*pat & M_MASK) == M_RNG) {
                                         if (c <= k && k <= pat[1])
                                                 ok = 1;
                                         pat += 2;
                                 } else if (c == k)
                                         ok = 1;
+                        }
                         if (ok == negate_range)
                                 return(0);
                         break;
@@ -785,6 +918,14 @@ globfree(glob_t *pglob)
                 free(pglob->gl_pathv);
                 pglob->gl_pathv = NULL;
         }
+        if (pglob->gl_statv != NULL) {
+                for (i = 0; i < pglob->gl_pathc; i++) {
+                        if (pglob->gl_statv[i] != NULL)
+                                free(pglob->gl_statv[i]);
+                }
+                free(pglob->gl_statv);
+                pglob->gl_statv = NULL;
+        }
 }
 
 static DIR *
@@ -830,11 +971,11 @@ g_stat(Char *fn, struct stat *sb, glob_t *pglob)
 }
 
 static Char *
-g_strchr(Char *str, int ch)
+g_strchr(const Char *str, int ch)
 {
         do {
                 if (*str == ch)
-                        return (str);
+                        return ((Char *)str);
         } while (*str++);
         return (NULL);
 }
@@ -870,5 +1011,4 @@ qprintf(const char *str, Char *s)
 #endif
 
 #endif /* !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) ||
-          !defined(GLOB_HAS_GL_MATCHC) */
-
+          !defined(GLOB_HAS_GL_MATCHC) || !defined(GLOB_HAS_GL_STATV) */