Index: src/ftpcmd.y
===================================================================
RCS file: /cvsroot/wu-ftpd/src/ftpcmd.y,v
retrieving revision 1.27
retrieving revision 1.27.2.1
diff -u -r1.27 -r1.27.2.1
--- src/ftpcmd.y	2000/07/01 18:17:39	1.27
+++ src/ftpcmd.y	2001/11/28 12:05:42	1.27.2.1
@@ -20,7 +20,7 @@
   If you did not receive a copy of the license, it may be obtained online  
   at http://www.wu-ftpd.org/license.html.  
    
-  $Id: ftpcmd.y,v 1.27 2000/07/01 18:17:39 wuftpd Exp $  
+  $Id: ftpcmd.y,v 1.27.2.1 2001/11/28 12:05:42 wuftpd Exp $  
    
 ****************************************************************************/ 
 /*
@@ -1128,19 +1128,23 @@
 			strcpy(t + 1, $1);
 		    globlist = ftpglob(t);
 		    if (globerr) {
-			reply(550, globerr);
+			reply(550, "%s", globerr);
 			$$ = NULL;
 			if (globlist) {
 			    blkfree(globlist);
 			    free((char *) globlist);
 			}
 		    }
-		    else if (globlist) {
+		    else if (globlist && *globlist) {
 			$$ = *globlist;
 			blkfree(&globlist[1]);
 			free((char *) globlist);
 		    }
 		    else {
+			if (globlist) {
+			    blkfree(globlist);
+			    free((char *) globlist);
+			}
 			errno = ENOENT;
 			perror_reply(550, $1);
 			$$ = NULL;
@@ -1154,19 +1158,23 @@
 
 		globlist = ftpglob($1);
 		if (globerr) {
-		    reply(550, globerr);
+		    reply(550, "%s", globerr);
 		    $$ = NULL;
 		    if (globlist) {
 			blkfree(globlist);
 			free((char *) globlist);
 		    }
 		}
-		else if (globlist) {
+		else if (globlist && *globlist) {
 		    $$ = *globlist;
 		    blkfree(&globlist[1]);
 		    free((char *) globlist);
 		}
 		else {
+		    if (globlist) {
+			blkfree(globlist);
+			free((char *) globlist);
+		    }
 		    errno = ENOENT;
 		    perror_reply(550, $1);
 		    $$ = NULL;
Index: src/glob.c
===================================================================
RCS file: /cvsroot/wu-ftpd/src/glob.c,v
retrieving revision 1.14
retrieving revision 1.14.2.1
diff -u -r1.14 -r1.14.2.1
--- src/glob.c	2000/07/01 18:17:39	1.14
+++ src/glob.c	2001/11/28 12:20:53	1.14.2.1
@@ -20,7 +20,7 @@
   If you did not receive a copy of the license, it may be obtained online 
   at http://www.wu-ftpd.org/license.html. 
   
-  $Id: glob.c,v 1.14 2000/07/01 18:17:39 wuftpd Exp $ 
+  $Id: glob.c,v 1.14.2.1 2001/11/28 12:20:53 wuftpd Exp $ 
   
 ****************************************************************************/
 /*
@@ -174,19 +174,21 @@
 	sort();
 }
 
+static int
+argcmp(const void *p1, const void *p2)
+{
+    char *s1 = *(char **) p1;
+    char *s2 = *(char **) p2;
+
+    return (strcmp(s1, s2));
+}
+
 static void sort(void)
 {
-    register char **p1, **p2, *c;
     char **Gvp = &gargv[gargc];
 
-    p1 = sortbas;
-    while (p1 < Gvp - 1) {
-	p2 = p1;
-	while (++p2 < Gvp)
-	    if (strcmp(*p1, *p2) > 0)
-		c = *p1, *p1 = *p2, *p2 = c;
-	p1++;
-    }
+    if (!globerr)
+	qsort(sortbas, Gvp - sortbas, sizeof (*sortbas), argcmp);
     sortbas = Gvp;
 }
 
@@ -292,13 +294,16 @@
 static int execbrc(char *p, char *s)
 {
     char restbuf[BUFSIZ + 2];
+    char *restbufend = &restbuf[sizeof(restbuf)];
     register char *pe, *pm, *pl;
     int brclev = 0;
     char *lm, savec, *sgpathp;
 
-    for (lm = restbuf; *p != '{'; *lm++ = *p++)
-	continue;
-    for (pe = ++p; *pe; pe++)
+    for (lm = restbuf; *p != '{'; *lm++ = *p++) {
+	if (lm >= restbufend)
+	    return (0);
+    }
+    for (pe = ++p; *pe; pe++) {
 	switch (*pe) {
 
 	case '{':
@@ -314,11 +319,19 @@
 	case '[':
 	    for (pe++; *pe && *pe != ']'; pe++)
 		continue;
+	    if (!*pe) {
+		globerr = "Missing ]";
+		return (0);
+	    }
 	    continue;
 	}
+    }
   pend:
-    brclev = 0;
-    for (pl = pm = p; pm <= pe; pm++)
+    if (brclev || !*pe) {
+	globerr = "Missing }";
+	return (0);
+    }
+    for (pl = pm = p; pm <= pe; pm++) {
 	switch (*pm & (QUOTE | TRIM)) {
 
 	case '{':
@@ -339,6 +352,8 @@
 	  doit:
 	    savec = *pm;
 	    *pm = 0;
+	    if (lm + strlen(pl) + strlen(pe + 1) >= restbufend)
+		return (0);
 	    (void) strcpy(lm, pl);
 	    (void) strcat(restbuf, pe + 1);
 	    *pm = savec;
@@ -352,19 +367,18 @@
 		return (1);
 	    sort();
 	    pl = pm + 1;
-	    if (brclev)
-		return (0);
 	    continue;
 
 	case '[':
 	    for (pm++; *pm && *pm != ']'; pm++)
 		continue;
-	    if (!*pm)
-		pm--;
+	    if (!*pm) {
+		globerr = "Missing ]";
+		return (0);
+	    }
 	    continue;
 	}
-    if (brclev)
-	goto doit;
+    }
     return (0);
 }
 
@@ -416,11 +430,10 @@
 		else if (scc == (lc = cc))
 		    ok++;
 	    }
-	    if (cc == 0)
-		if (ok)
-		    p--;
-		else
-		    return 0;
+	    if (cc == 0) {
+		globerr = "Missing ]";
+		return (0);
+	    }
 	    continue;
 
 	case '*':
@@ -473,73 +486,16 @@
     }
 }
 
-/* This function appears to be unused, so why waste time and space on it? */
-#if 0 == 1
-static int Gmatch(register char *s, register char *p)
-{
-    register int scc;
-    int ok, lc;
-    int c, cc;
-
-    for (;;) {
-	scc = *s++ & TRIM;
-	switch (c = *p++) {
-
-	case '[':
-	    ok = 0;
-	    lc = 077777;
-	    while (cc = *p++) {
-		if (cc == ']') {
-		    if (ok)
-			break;
-		    return (0);
-		}
-		if (cc == '-') {
-		    if (lc <= scc && scc <= *p++)
-			ok++;
-		}
-		else if (scc == (lc = cc))
-		    ok++;
-	    }
-	    if (cc == 0)
-		if (ok)
-		    p--;
-		else
-		    return 0;
-	    continue;
-
-	case '*':
-	    if (!*p)
-		return (1);
-	    for (s--; *s; s++)
-		if (Gmatch(s, p))
-		    return (1);
-	    return (0);
-
-	case 0:
-	    return (scc == 0);
-
-	default:
-	    if ((c & TRIM) != scc)
-		return (0);
-	    continue;
-
-	case '?':
-	    if (scc == 0)
-		return (0);
-	    continue;
-
-	}
-    }
-}
-#endif /* Gmatch exclusion */
-
 static void Gcat(register char *s1, register char *s2)
 {
     register size_t len = strlen(s1) + strlen(s2) + 1;
 
+    if (globerr)
+	return;
     if (len >= gnleft || gargc >= GAVSIZ - 1)
 	globerr = "Arguments too long";
+    else if (len > MAXPATHLEN)
+	globerr = "Pathname too long";
     else {
 	gargc++;
 	gnleft -= len;
@@ -620,8 +576,10 @@
 {
     register char **av = av0;
 
-    while (*av)
-	free(*av++);
+    if (av) {
+	while (*av)
+	    free(*av++);
+    }
 }
 
 char *strspl(register char *cp, register char *dp)