21664: unmetafy ztat() argument

2 files changed, 19 insertions, 20 deletions

diff --git a/Src/Zle/compcore.c b/Src/Zle/compcore.c
index 0ae5fd3c5..4b6c7a3af 100644
--- a/Src/Zle/compcore.c
+++ b/Src/Zle/compcore.c
@@ -2471,24 +2471,17 @@ add_match_data(int alt, char *str, char *orig, Cline line,
     cm->modec = '\0';
     if ((flags & CMF_FILE) && orig[0] && orig[strlen(orig) - 1] != '/') {
         struct stat buf;
-	char *pb, *blah;
-	int blahl;
+	char *pb;
 
         pb = (char *) zhalloc((cm->prpre ? strlen(cm->prpre) : 0) +
                               3 + strlen(orig));
         sprintf(pb, "%s%s", (cm->prpre ? cm->prpre : "./"), orig);
 
-	blah = ztrdup(pb);
-
-	unmetafy(blah, &blahl);
-
-        if (!ztat(blah, &buf, 1)) {
+        if (!ztat(pb, &buf, 1)) {
             cm->mode = buf.st_mode;
             if ((cm->modec = file_type(buf.st_mode)) == ' ')
                 cm->modec = '\0';
         }
-
-	free(blah);
     }
     if ((*compqstack == '\\' && compqstack[1]) ||
 	(autoq && *compqstack && compqstack[1] == '\\'))
diff --git a/Src/Zle/compresult.c b/Src/Zle/compresult.c
index e3b7d0523..d80a60ac1 100644
--- a/Src/Zle/compresult.c
+++ b/Src/Zle/compresult.c
@@ -849,27 +849,33 @@ do_ambiguous(void)
  * parameter says if we have to do lstat() or stat().  I think this   *
  * should instead be done by use of a general function to expand a    *
  * filename (stripping backslashes), combined with the actual         *
- * (l)stat().                                                         */
+ * (l)stat().                                                         *
+ * Make sure input is unmetafied                                      */
 
 /**/
 mod_export int
 ztat(char *nam, struct stat *buf, int ls)
 {
-    if (!(ls ? lstat(nam, buf) : stat(nam, buf)))
-	return 0;
-    else {
-	char *p;
-	VARARR(char, b, strlen(nam) + 1);
+    int ret;
+
+    nam = unmeta(nam);
+    if (!nam)
+	return -1;
 
-	for (p = b; *nam; nam++)
-	    if (*nam == '\\' && nam[1])
-		*p++ = *++nam;
+    if ((ret = ls ? lstat(nam, buf) : stat(nam, buf))) {
+	char *p, *q;
+
+	for (p = q = nam; *q; q++)
+	    if (*q == '\\' && q[1])
+		*p++ = *++q;
 	    else
-		*p++ = *nam;
+		*p++ = *q;
 	*p = '\0';
 	
-	return ls ? lstat(b, buf) : stat(b, buf);
+	ret = ls ? lstat(nam, buf) : stat(nam, buf);
     }
+
+    return ret;
 }
 
 /* Insert all matches in the command line. */