>From 61c8264ee25d1e5ffdd3e867e1bb10f58875937f Mon Sep 17 00:00:00 2001
From: Rich Felker <dalias@aerifal.cx>
Date: Tue, 6 Oct 2026 13:35:11 -0400
Subject: [PATCH 5/6] fnmatch: honor escaping in bracket expressions

---
 src/regex/fnmatch.c | 46 +++++++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/src/regex/fnmatch.c b/src/regex/fnmatch.c
index 57394bdf..f93369e6 100644
--- a/src/regex/fnmatch.c
+++ b/src/regex/fnmatch.c
@@ -48,16 +48,17 @@ static int str_next(const char *str, size_t n, size_t *step)
 
 static int pat_next(const char *pat, size_t m, size_t *step, int flags)
 {
-	int esc = 0;
+	int esc_ch = (flags & FNM_NOESCAPE) ? 256 : '\\';
+	int is_esc = 0;
 	if (!m || !*pat) {
 		*step = 0;
 		return END;
 	}
 	*step = 1;
-	if (pat[0]=='\\' && pat[1] && !(flags & FNM_NOESCAPE)) {
+	if (pat[0]==esc_ch && pat[1]) {
 		*step = 2;
 		pat++;
-		esc = 1;
+		is_esc = 1;
 		goto escaped;
 	}
 	if (pat[0]=='[') {
@@ -69,9 +70,11 @@ static int pat_next(const char *pat, size_t m, size_t *step, int flags)
 				int z = pat[k+1];
 				k+=2;
 				if (k<m && pat[k]) k++;
-				while (k<m && pat[k] && (pat[k-1]!=z || pat[k]!=']')) k++;
+				while (k<m && pat[k] && (pat[k-1]!=z || pat[k]!=']'))
+					k += 1 + (pat[k-1]==esc_ch);
 				if (k==m || !pat[k]) break;
 			}
+			if (pat[k]==esc_ch && pat[k+1]) k++;
 		}
 		if (k==m || !pat[k]) {
 			*step = 1;
@@ -92,7 +95,7 @@ escaped:
 			*step = 0;
 			return UNMATCHABLE;
 		}
-		*step = k + esc;
+		*step = k + is_esc;
 		return wc;
 	}
 	return pat[0];
@@ -104,7 +107,7 @@ static int casefold(int k)
 	return c == k ? towlower(k) : c;
 }
 
-static int match_bracket(const char *p, int k, int kfold)
+static int match_bracket(const char *p, int k, int kfold, int esc_ch)
 {
 	wchar_t wc;
 	int inv = 0;
@@ -132,25 +135,31 @@ static int match_bracket(const char *p, int k, int kfold)
 			const char *p0 = p+2;
 			int z = p[1];
 			p+=3;
-			while (p[-1]!=z || p[0]!=']') p++;
+			while (p[-1]!=z || p[0]!=']') p += 1 + (p[-1]==esc_ch);
 			if (z == ':') {
+				int i;
 				char buf[16];
-				if (p-1-p0 >= sizeof buf) continue;
-				memcpy(buf, p0, p-1-p0);
-				buf[p-1-p0] = 0;
+				for (i=0; p0<p-1 && i<sizeof buf; i++, p0++)
+					buf[i] = *p0==esc_ch ? *++p0 : *p0;
+				if (i==sizeof buf) continue;
+				buf[i] = 0;
 				wctype_t type = wctype(buf);
 				if (iswctype(k, type) || iswctype(kfold, type))
 					return !inv;
 				continue;
 			}
+			if (*p0 == esc_ch) p0++;
 			int l = mbtowc(&wc, p0, 4);
 			if (l != p-1-p0) continue;
-		} else if (*p < 128U) {
-			wc = (unsigned char)*p;
 		} else {
-			int l = mbtowc(&wc, p, 4);
-			if (l < 0) continue;
-			p += l-1;
+			if (*p == esc_ch) p++;
+			if (*p < 128U) {
+				wc = (unsigned char)*p;
+			} else {
+				int l = mbtowc(&wc, p, 4);
+				if (l < 0) continue;
+				p += l-1;
+			}
 		}
 		if (is_range) {
 			if ((k>=wc0 && k<=wc) || (kfold>=wc0 && kfold<=wc))
@@ -169,6 +178,7 @@ static int fnmatch_internal(const char *pat, size_t m, const char *str, size_t n
 	const char *s, *stail, *endstr;
 	size_t pinc, sinc, tailcnt=0;
 	int c, k, kfold;
+	int esc_ch = (flags & FNM_NOESCAPE) ? 256 : '\\';
 
 	if (flags & FNM_PERIOD) {
 		if (*str == '.' && *pat != '.' && *pat != '\\')
@@ -190,7 +200,7 @@ static int fnmatch_internal(const char *pat, size_t m, const char *str, size_t n
 			n -= sinc;
 			kfold = flags & FNM_CASEFOLD ? casefold(k) : k;
 			if (c == BRACKET) {
-				if (!match_bracket(pat, k, kfold))
+				if (!match_bracket(pat, k, kfold, esc_ch))
 					return FNM_NOMATCH;
 			} else if (c != QUESTION && k != c && kfold != c) {
 				return FNM_NOMATCH;
@@ -251,7 +261,7 @@ static int fnmatch_internal(const char *pat, size_t m, const char *str, size_t n
 		s += sinc;
 		kfold = flags & FNM_CASEFOLD ? casefold(k) : k;
 		if (c == BRACKET) {
-			if (!match_bracket(p-pinc, k, kfold))
+			if (!match_bracket(p-pinc, k, kfold, esc_ch))
 				return FNM_NOMATCH;
 		} else if (c != QUESTION && k != c && kfold != c) {
 			return FNM_NOMATCH;
@@ -280,7 +290,7 @@ static int fnmatch_internal(const char *pat, size_t m, const char *str, size_t n
 				return FNM_NOMATCH;
 			kfold = flags & FNM_CASEFOLD ? casefold(k) : k;
 			if (c == BRACKET) {
-				if (!match_bracket(p-pinc, k, kfold))
+				if (!match_bracket(p-pinc, k, kfold, esc_ch))
 					break;
 			} else if (c != QUESTION && k != c && kfold != c) {
 				break;
-- 
2.21.0