From 05d82736bcd025a7bb63c533cd7e9ff9303234b0 Mon Sep 17 00:00:00 2001
From: tribby <tribby>
Date: Mon, 8 Feb 1999 17:26:51 +0000
Subject: [PATCH] Changes for gsh version 2.0d10:

Add check for buffer overflow when globbing, expanding variables, or
inserting aliases (PR#110).  Increase buffer size from 1024 to 4096.

Increase buffer for reading commands from 256 to 1024 bytes in order
to match the maximum length used when reading.
---
 bin/gsh/UpdateLog    |  28 +++++++
 bin/gsh/alias.asm    | 195 +++++++++++++++++++++++++++----------------
 bin/gsh/bufpool.asm  |  62 ++++++++------
 bin/gsh/cmd.asm      |  74 ++++++++--------
 bin/gsh/expand.asm   | 172 ++++++++++++++++++++++++++------------
 bin/gsh/gsh.mac      |   2 +-
 bin/gsh/gsh.rez      |   4 +-
 bin/gsh/history.asm  |  14 ++--
 bin/gsh/main.asm     |   4 +-
 bin/gsh/orca.asm     |  14 ++--
 bin/gsh/shell.asm    |   4 +-
 bin/gsh/shellvar.asm |  26 +++---
 12 files changed, 381 insertions(+), 218 deletions(-)

diff --git a/bin/gsh/UpdateLog b/bin/gsh/UpdateLog
index 5337144..5f90d36 100644
--- a/bin/gsh/UpdateLog
+++ b/bin/gsh/UpdateLog
@@ -1,6 +1,34 @@
 GSH 2.0 UPDATES
 ^^^^^^^^^^^^^^^
 
+Feb  2 99  [dmt] Changed maxline_size from 1024 to 4096.
+	   Recode copy loop in expandalias to be more efficient.
+
+Feb  1 99  [dmt] Change names of alloc1024 and free1024 to allocmaxline
+	   and freemaxline (many .asm files) in anticipation of changing
+	   the maximum line size from 1024. Reviewed all uses of 1024
+	   constants, and changed appropriately to use new bufpool.asm
+	   location maxline_size.
+	   While reviewing 1024 constants, determined that shell.asm was
+	   using "buffer" for reads with max len of 1024, when it really
+	   had a size of 256.  Changed "buffer" to "cmdline" and "1024"
+	   to "cmdbuflen".  Removed definitions of buffer and wordbuf
+	   (each ds 256) from global data area, since they were unused.
+
+Jan 30 99  [dmt] Add check for output buffer overflow when globbing, and
+	   print error message (PR#110). Code restructured to use
+	   base address and offset, so that offset could easily be checked
+	   against limit. Also moved allocation/deallocation of two buffers
+	   outside a loop. (expand.asm)
+	   Add check for overflow when expanding variables (expand.asm)
+	   and allow command processor to recognize error (cmd.asm).
+	   Modify alias expansion not to treat "." as escaped character,
+	   to truly eat leading blanks (per comments), and to check for
+	   buffer overflow (alias.cmd). (Also tightened up the code.)
+
+Jan 13 98  [dmt] Changes to this point checked-in to master archive.
+	   Released as version 2.0d9
+
 Jan 12 99  [dmt] Add debug routine DB~CHKBNK, which causes BRK B0 if
 	   program bank is not the same as data bank (mmdebug.asm).
 	   Modify lock and unlock macros to call DB~CHKBNK (gsh.mac).
diff --git a/bin/gsh/alias.asm b/bin/gsh/alias.asm
index 362cf06..88ce305 100644
--- a/bin/gsh/alias.asm
+++ b/bin/gsh/alias.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: alias.asm,v 1.8 1998/12/31 18:29:11 tribby Exp $
+* $Id: alias.asm,v 1.9 1999/02/08 17:26:49 tribby Exp $
 *
 **************************************************************************
 *
@@ -323,140 +323,167 @@ outbuf	equ	0
 sub	equ	outbuf+4
 word	equ	sub+4
 buf	equ	word+4
-space	equ	buf+4
+bufend	equ	buf+4
+inquote	equ	bufend+2
+bsflag	equ	inquote+2
+space	equ	bsflag+2
 	
 	subroutine (4:cmd),space
 
-	ph4	#1024
+	ph4	maxline_size	Allocate result buffer.
 	~NEW
 	stx	buf+2
 	sta	buf
-	stx	outbuf+2
-	sta	outbuf
-	jsl	alloc1024
-	stx	word+2
+	stx	outbuf+2	Initialize "next
+	sta	outbuf	 output char" pointer.
+	clc		Calculate end of buffer-1;
+	adc	maxline_size	 note: it's allocated to be in one
+	dec	a	  bank, so only need low-order word.
+	sta	bufend
+
+	jsl	allocmaxline	Allocate buffer for word that
+	stx	word+2	 might be an alias.
 	sta	word
+
 	lda	#0
-	sta	[buf]	In case we're called with empty string
+	sta	[buf]	In case we're called with empty string.
 	sta	[word]
 ;
-; eat leading spaces
+; Eat leading space and tabs (just in case expanding a variable added them!)
 ;
+	bra	eatleader
+bump_cmd	inc	cmd
 eatleader	lda	[cmd]
 	and	#$FF
-	jeq	done
+	jeq	stringend
 	cmp	#' '
-	bne	getword
-	inc	cmd
-	sta	[outbuf]
-	inc	outbuf
-	bra	eatleader
+	beq	bump_cmd
+	cmp	#9
+	beq	bump_cmd
 ;
-; find the leading word
+; Parse the leading word
 ;
-getword	short	a
+	short	a
 	ldy	#0
+	bra	makeword1	First time, already checked 0, ' ', 9
 makeword	lda	[cmd],y
 	if2	@a,eq,#0,gotword
 	if2	@a,eq,#' ',gotword
-	if2	@a,eq,#';',gotword
+	if2	@a,eq,#9,gotword
+makeword1	if2	@a,eq,#';',gotword
 	if2	@a,eq,#'&',gotword
 	if2	@a,eq,#'|',gotword
 	if2	@a,eq,#'>',gotword
 	if2	@a,eq,#'<',gotword
 	if2	@a,eq,#13,gotword
-	if2	@a,eq,#9,gotword
 	if2	@a,eq,#10,gotword
 	sta	[word],y
 	iny
 	bra	makeword
 ;
-; we got a word, now check if it's an alias
+; We have a word. See if it's an alias.
 ;
 gotword	lda	#0
 	sta	[word],y	
 	long	a
-	add2	@y,cmd,cmd
+	cpy	#0	Check for 0 length.
+	beq	copyrest
 	phy
 	pei	(word+2)
 	pei	(word)
 	jsl	findalias
 	sta	sub
 	stx	sub+2
+	ply
 	ora	sub+2
-	beq	noalias
+	beq	copyrest
 ;
-; expand it, if you hadn't figured it out for yourself by now.
+; Yes, this is an alias. Copy it into the output buffer.
 ;
-	pla
+	add2	@y,cmd,cmd	Add length to cmd pointer.
+
+	pei	(sub+2)	Make sure that
+	pei	(sub)	 substituted string
+	jsr	cstrlen	  will fit into buffer.
+	sec
+	adc	outbuf
+	jge	overflow
+	cmp	bufend
+	jge	overflow
+
 	ldy	#0
-putalias	lda	[sub],y
-	and	#$FF
-	beq	next
-	sta	[outbuf]
+	short	a
+	lda	[sub]
+putalias	sta	[outbuf]
 	inc	outbuf
 	iny
-	bra	putalias
+	lda	[sub],y
+	bne	putalias
+	long	a
 ;
-; no alias, so just copy the original string
+; That alias is expanded. Copy until we reach the next command.
 ;
-noalias	plx
-	beq	next
-	ldy	#0
-noalias2	lda	[word],y
+copyrest	stz	inquote	Clear the "in quotes" flag
+	stz	bsflag	 and "backslashed" flag.
+
+next	anop
+	lda	outbuf	Check for output overflow.
+	cmp	bufend
+	jcs	overflow
+	lda	[cmd]	Transfer the character.
+	and	#$00FF
+	cmp	#13	If carriage-return,
+	bne	go8bits
+	lda	#0	 treat like end-of-string.
+go8bits	short	a
 	sta	[outbuf]
+	long	a
+	inc	cmd	Bump pointers.
 	inc	outbuf
-	iny
-	dex
-	bne	noalias2
+
+	if2	@a,eq,#0,done
 ;
-; the alias is expanded, now copy until we reach the next command
+; If that was a backslashed character, don't check for special chars.
 ;
-next	lda	[cmd]
-	inc	cmd
-	sta	[outbuf]
-	inc	outbuf
-	and	#$FF
-	beq	done
-	if2	@a,eq,#13,nextalias
+	ldx	bsflag
+	beq	testq
+	stz	bsflag
+	bra	next
+
+testq	if2	@a,eq,#"'",singquoter
+	if2	@a,eq,#'"',doubquoter
+;
+; Remaining characters aren't special if we are in a quoted string
+;
+	ldx	inquote
+	bne	next
 	if2	@a,eq,#';',nextalias
 	if2	@a,eq,#'&',nextalias
 	if2	@a,eq,#'|',nextalias
-	if2	@a,eq,#'\',backstabber
-	if2	@a,eq,#"'",singquoter
-	if2	@a,eq,#'"',doubquoter
-	bra	next
+	if2	@a,ne,#'\',next
 ;
 ; "\" found
 ;
-backstabber	lda	[cmd]
-	inc	cmd
-	sta	[outbuf]
-	inc	outbuf
-	and	#$FF
-	beq	done
+backstabber	sta	bsflag
 	bra	next
+
 ;
 ; "'" found
 ;
-singquoter	lda	[cmd]
-	inc	cmd
-	sta	[outbuf]
-	inc	outbuf
-	and	#$FF
-	beq	done
-	if2	@a,ne,#"'",singquoter
+singquoter	bit	inquote	Check "in quotes" flag.
+	bvs	next	In double quotes. Keep looking.
+	lda	inquote	Toggle single quote
+	eor	#$8000
+	sta	inquote
 	bra	next
 ;
 ; '"' found
 ;
-doubquoter	lda	[cmd]
-	inc	cmd
-	sta	[outbuf]
-	inc	outbuf
-	and	#$FF
-	beq	done
-	if2	@a,ne,#'"',doubquoter
+doubquoter	bit	inquote	Check "in quotes" flag.
+	bmi	next	In single quotes. Keep looking.
+	lda	inquote	Toggle single quote
+	eor	#$4000
+	sta	inquote
 	bra	next
 
 ;
@@ -464,12 +491,40 @@ doubquoter	lda	[cmd]
 ;
 nextalias	jmp	eatleader
 
+;
+; Terminate string and exit
+;
+stringend	short	a
+	sta	[outbuf]
+	long	a
+;
+; All done: clean up and return to caller
+;
 done	ldx	word+2
 	lda	word
-	jsl	free1024
+	jsl	freemaxline
 
 	return 4:buf
 
+
+;
+; Report overflow error
+;
+overflow	anop
+	pei	(buf+2)	Free the output buffer.
+	pei	(buf)
+	jsl	nullfree
+	stz	buf
+	stz	buf+2
+
+	ldx	#^ovferr	Report overflow error.
+	lda	#ovferr
+	jsr	errputs
+
+	bra	done
+
+ovferr	dc	c'gsh: Alias overflowed line limit',h'0d00'
+
 	END
 
 ;=========================================================================
diff --git a/bin/gsh/bufpool.asm b/bin/gsh/bufpool.asm
index f0b498c..e4f4533 100644
--- a/bin/gsh/bufpool.asm
+++ b/bin/gsh/bufpool.asm
@@ -6,13 +6,13 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: bufpool.asm,v 1.6 1998/12/21 23:57:04 tribby Exp $
+* $Id: bufpool.asm,v 1.7 1999/02/08 17:26:50 tribby Exp $
 *
 **************************************************************************
 *
 * BUFPOOL
 *   By Tim Meekins
-*   Modified by Dave Tribby for GNO 2.0.6 (256-byte buffer code removed)
+*   Modified by Dave Tribby for GNO 2.0.6
 *
 * This is the buffer pool
 *
@@ -24,13 +24,13 @@
 * Interfaces defined in this file:
 *     The alloc routine is a jsl without any stack params.
 *         Pointer to requested buffer is returned in X/A registers.
-*   alloc1024	
+*   allocmaxline	
 *     The free routine takes the address from the X/A registers
-*   free1024	
+*   freemaxline	
 *
 * bufpool data:
-*    pool1024		dc   i4'0'
-*    pool1024mutex	key
+*    pmaxline		dc   i4'0'
+*    pmaxlinemutex	key
 *		          
 **************************************************************************
 
@@ -39,32 +39,34 @@
 dummybufpool	start		; ends up in .root
 	end
 
+	setcom 60
+
 **************************************************************************
 *
-* Get a buffer of size 1024
+* Get a buffer of size maxline_size
 *
 **************************************************************************
 
-alloc1024	START
+allocmaxline	START
 	
 	using	bufpool
 
-	lock	pool1024mutex
+	lock	pmaxlinemutex
 
-	lda	pool1024	If pool pointer
-	ora	pool1024+2	 isn't NULL,
+	lda	pmaxline	If pool pointer
+	ora	pmaxline+2	 isn't NULL,
 	beq	allocbuf
 
 	phd
-	ph4	pool1024		Push pool pointer on stack.
+	ph4	pmaxline		Push pool pointer on stack.
 	tsc
 	tcd
 	lda	[1]		Replace pool pointer with
-	sta	pool1024		 the address it points to.
+	sta	pmaxline		 the address it points to.
 	ldy	#2
 	lda	[1],y
-	sta	pool1024+2
-	unlock pool1024mutex
+	sta	pmaxline+2
+	unlock pmaxlinemutex
 	pla
 	plx
 	pld
@@ -73,20 +75,26 @@ alloc1024	START
 ;
 ; No memory in free pool; must allocate a new block.
 ;
-allocbuf	unlock pool1024mutex
-	ph4	#1024
+allocbuf	unlock pmaxlinemutex
+	ph4	maxline_size
 	~NEW
 	rtl
 
+;
+; Constant indicating # of bytes in a maxline buffer
+;
+maxline_size	entry		Make this easily seen.
+	dc	i4'4096'
+
 	END
 
 **************************************************************************
 *
-* Free a buffer of size 1024, putting it into the free pool
+* Free a buffer of size maxline_size, putting it into the free pool
 *
 **************************************************************************
 
-free1024	START
+freemaxline	START
 
 	using bufpool
 
@@ -95,17 +103,17 @@ free1024	START
 	pha
 	tsc
 	tcd
-	lock pool1024mutex
-	lda	pool1024	Move current head of pool list
+	lock	pmaxlinemutex
+	lda	pmaxline	Move current head of pool list
 	sta	[1]	 into the buffer being freed.
 	ldy	#2
-	lda	pool1024+2
+	lda	pmaxline+2
 	sta	[1],y
 	lda	1	Put address of buffer being freed
-	sta	pool1024	 into the pool list head.
+	sta	pmaxline	 into the pool list head.
 	lda	3
-	sta	pool1024+2
-	unlock pool1024mutex
+	sta	pmaxline+2
+	unlock pmaxlinemutex
 	pla
 	plx	
 	pld
@@ -121,8 +129,8 @@ free1024	START
 
 bufpool	DATA
 
-pool1024	dc	i4'0'	Head of free pool list.
+pmaxline	dc	i4'0'	Head of free pool list.
 
-pool1024mutex	key		Mutual exclusion when modifying list.
+pmaxlinemutex	key		Mutual exclusion when modifying list.
 		         
 	END
diff --git a/bin/gsh/cmd.asm b/bin/gsh/cmd.asm
index b1caa5f..2781551 100644
--- a/bin/gsh/cmd.asm
+++ b/bin/gsh/cmd.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: cmd.asm,v 1.10 1999/01/14 17:44:22 tribby Exp $
+* $Id: cmd.asm,v 1.11 1999/02/08 17:26:50 tribby Exp $
 *
 **************************************************************************
 *
@@ -367,14 +367,14 @@ end	equ	waitpid+4
 	phd
 	tcd
 
-	ph4	#1024	Allocate 1024 bytes
+	ph4	maxline_size	Allocate maxline_size bytes
 	~NEW		 and pointer in cmdline.
 	sta	cmdline
 	stx	cmdline+2
 	lda	#0	Initialize to null C string.
 	sta	[cmdline]
 
-	jsl	alloc1024	Allocate memory for token.
+	jsl	allocmaxline	Allocate memory for token.
 	sta	word
 	stx	word+2
 
@@ -531,7 +531,7 @@ lt1	lda	inpipe
 	beq	lt2
 	lda	#err09	;< conflicts with |
 	jmp	error
-lt2	jsl	alloc1024
+lt2	jsl	allocmaxline
 	stx	srcfile+2
 	sta	srcfile
 	phx
@@ -551,7 +551,7 @@ tok_gtgt	lda	dstfile
 	beq	gt1
 	lda	#err04	;Extra > or >> encountered
 	jmp	error
-gt1	jsl	alloc1024
+gt1	jsl	allocmaxline
 	stx	dstfile+2
 	sta	dstfile
 	phx
@@ -575,7 +575,7 @@ tok_gtgtamp	lda	errfile
 	beq	ga1
 	lda	#err06	;Extra >& or >>& encountered
 	jmp	error
-ga1	jsl	alloc1024
+ga1	jsl	allocmaxline
 	stx	errfile+2
 	sta	errfile
 	phx
@@ -724,7 +724,7 @@ exit	pha		Hold return status on stack.
 	beq	ex1
 	ldx	dstfile+2
 	lda	dstfile
-	jsl	free1024
+	jsl	freemaxline
 ex1	anop
 
 	lda	srcfile
@@ -732,7 +732,7 @@ ex1	anop
 	beq	ex2
 	ldx	srcfile+2
 	lda	srcfile
-	jsl	free1024
+	jsl	freemaxline
 ex2	anop
 
 	lda	errfile
@@ -740,12 +740,12 @@ ex2	anop
 	beq	ex3
 	ldx	errfile+2
 	lda	errfile
-	jsl	free1024
+	jsl	freemaxline
 ex3	anop
 		   
 	ldx	word+2
 	lda	word
-	jsl	free1024
+	jsl	freemaxline
 
 	ply		Get return value.
 
@@ -1354,22 +1354,36 @@ expand	anop
 	sta	ptr_envexp
 	stx	ptr_envexp+2
 
+; Was there a variable error?
+	ora	ptr_envexp+2
+	bne	expglob
+	pha		Put null pointer
+	pha		 on stack
+	jmp	errexit	  and go to error exit.
+
 ; Expand wildcard characters in the modified command line
-	phx
+expglob	phx
+	lda	ptr_envexp
 	pha
 	jsl	glob
 	sta	ptr_glob
 	stx	ptr_glob+2
 
+	ldx	ptr_envexp+2	Free memory allocated
+	lda	ptr_envexp	 for env var expansion
+	jsl	freemaxline
+
 ; Was there a globbing error?
+	lda	ptr_glob
 	ora	ptr_glob+2
 	bne	expalias
 	pha		Put null pointer
 	pha		 on stack
-	jmp	errexit	  and go to error exit.
+	jmp	errexit	Go to error exit.
 
 ; Expand aliases in the modified command line (final expansion)
-expalias	phx
+expalias	ldx	ptr_glob+2
+	phx
 	lda	ptr_glob
 	pha
 	jsl	expandalias
@@ -1379,35 +1393,25 @@ expalias	phx
 	phx		Put exebuf on stack for
 	pha		 nullfree at endcmd.
 
+	ldx	ptr_glob+2	Free memory allocated
+	lda	ptr_glob            for globbing expansion.
+	jsl	freemaxline
+
+; Was there a alias error?
+	lda	exebuf
+	ora	exebuf+2
+	jeq	errexit
+
 * >> Temporary debug code: echo expanded command if echo is set.
 	using	vardata
 	ldy	varecho
 	beq	noecho
-	jsr	puts	NOTE: x/a = exebuf
+	ldx	exebuf+2
+	lda	exebuf
+	jsr	puts
 	jsr	newline
 noecho	anop
 
-	ldx	ptr_envexp+2	Free memory allocated
-	lda	ptr_envexp	 for env var expansion
-	jsl	free1024
-	ldx	ptr_glob+2	  and globbing.
-	lda	ptr_glob
-	jsl	free1024
-		         
-;
-; If exebuf pointer is null, bail out.
-;  >> NOTE: if exebuf is checked for null, shouldn't the other ptrs?
-;
-	lda	exebuf
-	ora	exebuf+2
-	bne	loop
-	pla
-	pla
-	stz	term
-	lda	#0
-	jmp	chk_cmd
-
-
 *   command	subroutine (4:waitpid,2:inpipe,2:jobflag,2:inpipe2,
 *		4:pipesem,4:stream,4:awaitstatus)
 loop	pea	0	;Bank 0		waitpid (hi)
diff --git a/bin/gsh/expand.asm b/bin/gsh/expand.asm
index 1adc168..63f8655 100644
--- a/bin/gsh/expand.asm
+++ b/bin/gsh/expand.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: expand.asm,v 1.7 1998/12/31 18:29:13 tribby Exp $
+* $Id: expand.asm,v 1.8 1999/02/08 17:26:50 tribby Exp $
 *
 **************************************************************************
 *
@@ -46,15 +46,16 @@ exppath	equ	eptr+4
 filesep	equ	exppath+4
 shallweglob	equ	filesep+2
 wordbuf	equ	shallweglob+2
-ptr	equ	wordbuf+4
-buf	equ	ptr+4
+index	equ	wordbuf+4
+buf	equ	index+2
 globflag	equ	buf+4
-space	equ	globflag+2
+overflag	equ	globflag+2
+space	equ	overflag+2
 
 	subroutine (4:cmd),space
 
 ; Allocate buffer to hold result
-	jsl	alloc1024
+	jsl	allocmaxline
 	sta	buf
 	stx	buf+2
 
@@ -73,14 +74,24 @@ space	equ	globflag+2
 ;
 ; noglob isn't set, so we can start globbing.
 ;
-doglob	sta	ptr	ptr points to next
-	stx	ptr+2	 position in buf.
+doglob	lda	#$FFFF	Start output index at -1.
+	sta	index
 
-	jsl	alloc1024	Create a word buffer.
+	jsl	allocmaxline	Create a word buffer.
 	sta	wordbuf
 	stx	wordbuf+2
 
+	jsl	allocmaxline	Alloc buffer for wildcard pattern.
+	sta	exppath
+	stx	exppath+2
+
+	ph4	#65	Allocate memory for
+	~NEW		expanded name.
+	sta	gname	Store in direct
+	stx	gname+2	 page pointer
+
 	stz	globflag	globflag = no globbing done (yet).
+	stz	overflag	Clear output buffer overflow flag.
 
 ;
 ; Find the beginning of the next word
@@ -108,7 +119,6 @@ findword	jsr	g_getbyte	Get character from command line.
 passthru	jsr	g_putbyte
 	bra	findword
 
-
 ;
 ; single out the next word [y is initialized above]
 ;
@@ -190,7 +200,10 @@ flushloop	lda	[wordbuf],y
 	jsr	g_putbyte
 	iny
 	bra	flushloop
-doneflush	jmp	findword
+doneflush	anop
+	lda	overflag	If buffer overflowed,
+	jne	errexit	 clean up and return null pointer.
+	jmp	findword
 
 ;
 ; Hello, boys and goils, velcome to Tim's Magik Shoppe
@@ -216,10 +229,9 @@ doneflush	jmp	findword
 ; filename separator... then we can isolate him!
 ;
 globword	stz	filesep	
-	jsl	alloc1024	Alloc buffer for wildcard pattern.
-	sta	exppath
-	stx	exppath+2
 
+	lda	exppath	Get addr of wildcard
+	ldx	exppath+2	 pattern buffer.
 	incad	@xa	Leave room for length word
 	incad	@xa
 	sta	eptr
@@ -296,18 +308,19 @@ copyback	lda	[wordbuf],y
 	mv4	exppath,initWCpath
 	InitWildcardGS initWCparm
 
-	ph4	#65	Allocate memory for
-	~NEW		expanded name.
-	sta	gname	Store in direct
-	stx	gname+2	 page pointer
-	sta	nWCname	  and in NextWildcardGS
+	lda	gname	Store expanded
+	ldx	gname+2	 name addr
+	sta	nWCname	  in NextWildcardGS
 	stx	nWCname+2	   parameter block.
 	lda	#65	Store maximum length at
 	sta	[gname]	 beginning of result buf.
 ;
 ; Call shell routine NextWildcardGS to get the next name that matches.
 ;
-WCloop	NextWildcardGS nWCparm
+WCloop	anop
+	lda	overflag	If buffer overflowed,
+	bne	nomore	 quit expanding.
+	NextWildcardGS nWCparm
 	ldy	#2
 	lda	[gname],y
 	beq	nomore
@@ -350,15 +363,9 @@ globoutta	lda	[gname],y	Copy next character
 nomore	anop
 
 	unlock glob_mutex
-;
-; Deallocate path buffers (we should probably alloc once, not each word... )
-;
-	pei	(gname+2)
-	pei	(gname)
-	jsl	nullfree
-	ldx	exppath+2
-	lda	exppath
-	jsl	free1024
+
+	lda	overflag	If buffer overflowed,
+	bne	errexit	 clean up and return null pointer.
 
 	lda	count	If something was expanded,
 	beq	nothingfound
@@ -381,8 +388,10 @@ nothingfound	anop
 ;
 ; Goodbye, cruel world, I'm leaving you today, Goodbye, goodbye.
 ;
-alldone	jsr	g_putbyte	Store null byte at end of string.
-
+alldone	anop
+	jsr	g_putbyte	Store null byte at end of string.
+	lda	overflag	If buffer overflowed,
+	bne	errexit	 clean up and return null ptr.
 ;
 ; Check globflag for no valid matches found in any pattern
 ;
@@ -394,16 +403,24 @@ alldone	jsr	g_putbyte	Store null byte at end of string.
 	lda	#nomatch
 	jsr	errputs
 
-	ldx	buf+2
+errexit	ldx	buf+2
 	lda	buf
-	jsl	free1024
+	jsl	freemaxline
 
-	stz	buf+2
-	stz	buf
+	stz	buf+2	Return NULL
+	stz	buf	 value from routine.
 
 alldone2	ldx	wordbuf+2
 	lda	wordbuf
-	jsl	free1024
+	jsl	freemaxline
+
+	pei	(gname+2)
+	pei	(gname)
+	jsl	nullfree
+
+	ldx	exppath+2
+	lda	exppath
+	jsl	freemaxline
 
 bye	return 4:buf
 
@@ -422,7 +439,7 @@ g_getbyte	lda	[cmd]
 ;
 g_putspecial	and	#$7F
 	if2	@a,eq,#' ',special
-	if2	@a,eq,#'.',special
+;	if2	@a,eq,#'.',special	>> NOTE: '.' isn't special!
 	if2	@a,eq,#013,special
 	if2	@a,eq,#009,special
 	if2	@a,eq,#';',special
@@ -438,12 +455,29 @@ special	pha
 ;
 ; Subroutine of glob: store a byte into the new command-line
 ;
-g_putbyte	short	a
-	sta	[ptr]
+g_putbyte	anop
+	phx		Hold X-reg on stack.
+	inc	index	Bump the buffer index.
+	ldx	index
+	cpx	maxline_size
+	bcc	nooverflow	If more chars than will fit in buffer:
+	lda	overflag		If already reported,
+	bne	ovflwreturn		  return to caller.
+	inc	overflag		Set overflow flag.
+	ldx	#^ovferr		Report overflow error.
+	lda	#ovferr
+	jsr	errputs
+	bra	ovflwreturn		Return to caller.
+nooverflow	phy		Hold Y-reg on stack.
+	txy
+	short	a
+	sta	[buf],y	Store character in output buffer.
 	long	a
-	incad	ptr
+	ply		Restore Y-reg.
+ovflwreturn	plx		Restore X-reg.
 	rts
 
+ovferr	dc	c'gsh: Globbing overflowed line limit',h'0d00'
 
 glob_mutex	key
 
@@ -476,10 +510,11 @@ expandvars	START
 MAXVAL	equ	512
 
 
-ptr	equ	1
-buf	equ	ptr+4
+index	equ	1
+buf	equ	index+2
 dflag	equ	buf+4
-space	equ	dflag+2
+overflag	equ	dflag+2
+space	equ	overflag+2
 cmd	equ	space+3
 end	equ	cmd+4
 
@@ -493,12 +528,13 @@ end	equ	cmd+4
 	tcd
 
 	stz	dflag	Delimiter flag = FALSE.
+	stz	overflag	Clear output buffer overflow flag.
+	lda	#$FFFF	Start output index at -1.
+	sta	index
 
-	jsl	alloc1024
+	jsl	allocmaxline
 	sta	buf
-	sta	ptr
 	stx	buf+2
-	stx	ptr+2
 
 loop	jsr	e_getbyte
 	jeq	done
@@ -665,14 +701,20 @@ putval	lda	value,x
 
 expanded	unlock exp_mutex
 	stz	dflag	Delimiter flag = FALSE.
-	jmp	loop
+	lda	overflag	If no buffer overflow,
+	jeq	loop	 stay in loop.
 
-done	jsr	e_putbyte
+done	jsr	e_putbyte	Store terminating null char.
+	ldx	buf+2	Set return value
+	ldy	buf	 to buffer pointer.
+	lda	overflag	If buffer overflowed,
+	beq	return
+	tya
+	jsl	freemaxline		Free the output buffer
+	ldx	#0		 and set return pointer
+	ldy	#0		  to NULL.
 
-	ldx	buf+2
-	ldy	buf
-
-	lda	space
+return	lda	space
 	sta	end-3
 	lda	space+1
 	sta	end-2
@@ -685,17 +727,39 @@ done	jsr	e_putbyte
 	tya
 	rtl
 
+;
+; expandvars internal subroutines to get and put bytes in buffers
+;
+
 e_getbyte	lda	[cmd]
 	incad	cmd
 	and	#$FF
 	rts
 
-e_putbyte	short	a
-	sta	[ptr]
+e_putbyte	anop
+	phx		Hold X-reg on stack.
+	inc	index	Bump the buffer index.
+	ldx	index
+	cpx	maxline_size
+	bcc	nooverflow	If more chars than will fit in buffer:
+	lda	overflag		If already reported,
+	bne	ovflwreturn		  return to caller.
+	inc	overflag		Set overflow flag.
+	ldx	#^ovferr		Report overflow error.
+	lda	#ovferr
+	jsr	errputs
+	bra	ovflwreturn		Return to caller.
+nooverflow	phy		Hold Y-reg on stack.
+	txy
+	short	a
+	sta	[buf],y	Store character in output buffer.
 	long	a
-	incad	ptr
+	ply		Restore Y-reg.
+ovflwreturn	plx		Restore X-reg.
 	rts
 
+ovferr	dc	c'gsh: Variable expansion overflowed line limit',h'0d00'
+
 exp_mutex	key
 
 
diff --git a/bin/gsh/gsh.mac b/bin/gsh/gsh.mac
index 293e0b4..0b4eb63 100644
--- a/bin/gsh/gsh.mac
+++ b/bin/gsh/gsh.mac
@@ -1945,7 +1945,7 @@ skip&syscnt	anop
 	using	memglobal
 	lock	memmutex
 *	jsl   DB~DISPOSE	; DEBUG VERSION
- 	jsl   ~DISPOSE	; NON-DEBUG VERSION
+	jsl   ~DISPOSE	; NON-DEBUG VERSION
 	unlock memmutex
 	MEND
 
diff --git a/bin/gsh/gsh.rez b/bin/gsh/gsh.rez
index 694d4d4..b6a56ff 100644
--- a/bin/gsh/gsh.rez
+++ b/bin/gsh/gsh.rez
@@ -1,7 +1,7 @@
 /*
  * Resources for version and comment
  *
- * $Id: gsh.rez,v 1.11 1999/01/14 17:44:24 tribby Exp $
+ * $Id: gsh.rez,v 1.12 1999/02/08 17:26:50 tribby Exp $
  */
 
 #define PROG "gsh"
@@ -16,7 +16,7 @@
 resource rVersion (1, purgeable3) {
 	{ 2, 0, 0,	/* Version 2.0.0 */
 	  development,	/* development|alpha|beta|final|release */
-	  9 },		/* non-final release number */
+	  10 },		/* non-final release number */
 	verUS,		/* Country */
 	PROG,		/* Program name */
         DESC
diff --git a/bin/gsh/history.asm b/bin/gsh/history.asm
index d4f4a1d..44a6436 100644
--- a/bin/gsh/history.asm
+++ b/bin/gsh/history.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: history.asm,v 1.7 1998/12/21 23:57:06 tribby Exp $
+* $Id: history.asm,v 1.8 1999/02/08 17:26:50 tribby Exp $
 *
 **************************************************************************
 *
@@ -58,6 +58,8 @@ dummyhistory	start		; ends up in .root
 histNext	gequ	0
 histCmd	gequ	4
 
+cmdbuflen	gequ	1024
+
 ;=========================================================================
 ;
 ; Add a C string to the head of the history buffer.
@@ -472,7 +474,7 @@ OpenRef	ds	2
 
 WriteParm	dc	i2'4'
 WriteRef	ds	2
-WriteBuf	dc	a4'buffer'
+WriteBuf	dc	a4'cmdline'
 WriteReq	ds	4
 	ds	4
 
@@ -524,8 +526,8 @@ loop	anop
 	beq	doneclose
 	dey
 	lda	#0
-	sta	buffer,y
-	ph4	#buffer
+	sta	cmdline,y
+	ph4	#cmdline
 	jsl	InsertHistory
 	bra	loop
 
@@ -546,8 +548,8 @@ NLTable	dc	i1'13'
 
 ReadParm	dc	i2'4'
 ReadRef	ds	2
-	dc	a4'buffer'
-	dc	i4'1024'
+	dc	a4'cmdline'
+	dc	i4'cmdbuflen'
 ReadTrans	ds	4
 
 CloseParm	dc	i2'1'
diff --git a/bin/gsh/main.asm b/bin/gsh/main.asm
index 8a26395..30bc6e8 100644
--- a/bin/gsh/main.asm
+++ b/bin/gsh/main.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: main.asm,v 1.8 1999/01/14 17:44:25 tribby Exp $
+* $Id: main.asm,v 1.9 1999/02/08 17:26:51 tribby Exp $
 *
 **************************************************************************
 *
@@ -102,7 +102,7 @@ argloop	dec	argc	Decrement argument count.
 
 	inc	ExecFlag
 	inc	FastFlag
-	ph4	#1024
+	ph4	maxline_size
 	~NEW
 	sta	ExecCmd
 	sta	p
diff --git a/bin/gsh/orca.asm b/bin/gsh/orca.asm
index 29090ed..3f028d1 100644
--- a/bin/gsh/orca.asm
+++ b/bin/gsh/orca.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: orca.asm,v 1.8 1998/12/31 18:29:14 tribby Exp $
+* $Id: orca.asm,v 1.9 1999/02/08 17:26:51 tribby Exp $
 *
 **************************************************************************
 *
@@ -75,19 +75,19 @@ space	equ	outPath+4
 ; Allocate memory for sFile, inPath, and outPath
 
 enoughparms	anop
-	jsl	alloc1024
+	jsl	allocmaxline
 	sta	sFile
 	stx	sFile+2
 	ora	sFile+2
 	beq	memerr1
 
-	jsl	alloc1024
+	jsl	allocmaxline
 	sta	inPath
 	stx	inPath+2
 	ora	inPath+2
 	beq	memerr1
 
-	jsl	alloc1024
+	jsl	allocmaxline
 	sta	outPath
 	stx	outPath+2
 	ora	outPath+2
@@ -264,21 +264,21 @@ goaway	lda	sFile
 	beq	donedealloc
 	ldx	sFile+2
 	lda	sFile
-	jsl	free1024
+	jsl	freemaxline
 
 	lda	inPath
 	ora	inPath+2
 	beq	donedealloc
 	ldx	inPath+2
 	lda	inPath
-	jsl	free1024
+	jsl	freemaxline
 
 	lda	outPath
 	ora	outPath+2
 	beq	donedealloc
 	ldx	outPath+2
 	lda	outPath
-	jsl	free1024
+	jsl	freemaxline
 
 
 ; Return to caller with status set to value in retval
diff --git a/bin/gsh/shell.asm b/bin/gsh/shell.asm
index 58aa71f..43e8335 100644
--- a/bin/gsh/shell.asm
+++ b/bin/gsh/shell.asm
@@ -6,7 +6,7 @@
 *   Jawaid Bazyar
 *   Tim Meekins
 *
-* $Id: shell.asm,v 1.9 1998/12/31 18:29:14 tribby Exp $
+* $Id: shell.asm,v 1.10 1999/02/08 17:26:51 tribby Exp $
 *
 **************************************************************************
 *
@@ -577,9 +577,7 @@ GSOSDP	ds	2
 cmdloc	ds	2
 cmdlen	ds	2
 cmdline	ds	cmdbuflen
-buffer	ds	256
 wordlen	ds	2
-wordbuf	ds	256
 nummatch	ds	2
 matchbuf	ds	512*4
 cmdcontext	ds	2
diff --git a/bin/gsh/shellvar.asm b/bin/gsh/shellvar.asm
index 063b993..5929b77 100644
--- a/bin/gsh/shellvar.asm
+++ b/bin/gsh/shellvar.asm
@@ -7,7 +7,7 @@
 *   Tim Meekins
 *   Derek Taubert
 *
-* $Id: shellvar.asm,v 1.7 1998/12/21 23:57:08 tribby Exp $
+* $Id: shellvar.asm,v 1.8 1999/02/08 17:26:51 tribby Exp $
 *
 **************************************************************************
 *
@@ -142,8 +142,8 @@ showvars	anop
 	stx	varbuf+2
 	ora	varbuf+2
 	beq	svwhoops
-	jsl	alloc1024	Allocate 1024 bytes
-	sta	valbuf	 for result buffer.
+	jsl	allocmaxline	Allocate
+	sta	valbuf	 result buffer.
 	stx	valbuf+2
 	ora	valbuf+2	If memory was not allocated,
 	bne	startshow
@@ -155,8 +155,10 @@ svwhoops	ld2	$201,ErrError		report memory error
 	jmp	exit		  and exit.
 
 startshow	anop
-	lda	#1022	Store buffer len == 1022 in value
-	sta	[valbuf]	 buffer (save 2 bytes at end for 0).
+	lda	maxline_size	Store maxline_size - 2
+	dec	a                   in result buffer
+	dec	a                     (save 2 bytes
+	sta	[valbuf]	    at end for 0).
 	lda	#260	Store buffer len == 260 in name
 	sta	[varbuf]	 buffer.
 	lock	setmutex
@@ -194,7 +196,7 @@ showdone	anop
 	jsl	nullfree	Free the name buffer.
 	ldx	valbuf+2
 	lda	valbuf
-	jsl	free1024	Free the value buffer.
+	jsl	freemaxline	Free the value buffer.
 	jmp	exit	Exit.
 
 
@@ -291,15 +293,17 @@ skipvar	add2	argv,#4,argv
 ;
 showonevar	anop
 
-	jsl	alloc1024	Allocate 1024 bytes
-	sta	valbuf	 for result buffer.
+	jsl	allocmaxline	Allocate
+	sta	valbuf	 result buffer.
 	sta	RSvalue
 	stx	valbuf+2
 	stx	RSvalue+2
 	ora	valbuf+2	Check for memory error.
 	jeq	nextvar
-	lda	#1022	Store max len == 1022 in result
-	sta	[valbuf]	 buffer (save 2 bytes at end for 0).
+	lda	maxline_size	Store maxline_size - 2
+	dec	a                   in result buffer
+	dec	a                     (save 2 bytes
+	sta	[valbuf]	    at end for 0).
 
 	pei	(arg+2)	Create GS/OS string that
 	pei	(arg)	 contains the variable name.
@@ -334,7 +338,7 @@ def	ldx	RSexport	X = export flag.
 doneone	anop
 	ldx	valbuf+2
 	lda	valbuf
-	jsl	free1024	Free valbuf.
+	jsl	freemaxline	Free valbuf.
 	ph4	varbuf
 	jsl	nullfree	Free varbuf.