Apparently the length of a file path resulting from a glob() has always
been inadvertently limited to 127 on VMS, with unpredictable and dire
results for lengths greater than that. This happens because we are
looking at an unsigned 16-bit integer as if it were a signed 8-bit
integer and then promoting it to an unsigned 32-bit integer. So, for
example, a length of 128 (0x80) turns into 4294967168 (0xffffff80),
which gets used in pointer arithmetic and puts us in never-never land.
The attached patch corrects the cast and also does a sanity check so the
end of the string is never considered to be before the beginning of it.

--- doio.c;-0   Thu Oct 23 03:28:10 2003
+++ doio.c      Fri Dec  5 18:53:14 2003
@@ -2290,8 +2290,9 @@
                if (*cp == '?') *cp = '%';  /* VMS style single-char wildcard */
            while (ok && ((sts = lib$find_file(&wilddsc,&rsdsc,&cxt,
                                               &dfltdsc,NULL,NULL,NULL))&1)) {
-               end = rstr + (unsigned long int) *rslt;
-               if (!hasver) while (*end != ';') end--;
+               /* with varying string, 1st word of buffer contains result length */
+               end = rstr + *((unsigned short int*)rslt);
+               if (!hasver) while (*end != ';' && end > rstr) end--;
                *(end++) = '\n';  *end = '\0';
                for (cp = rstr; *cp; cp++) *cp = _tolower(*cp);
                if (hasdir) {

Reply via email to