6307905 csh has a buffer overrun in its input routines

6311438 csh drops a character during filename completion if TIOCSTI doesn't succeed
6314637 csh bus error after applying patch 114224-04

15 files changed, 702 insertions, 608 deletions

diff --git a/usr/src/cmd/csh/sh.c b/usr/src/cmd/csh/sh.c
index bf7ddd946d..300e4e2d2e 100644
--- a/usr/src/cmd/csh/sh.c
+++ b/usr/src/cmd/csh/sh.c
@@ -31,14 +31,14 @@
  * We use these csh(1) private versions of the select macros, (see select(3C))
  * so as not to be limited by the size of struct fd_set (ie 1024).
  */
-#define CSH_FD_SET(n, p)    ((*((p) + ((n)/NFDBITS))) |= (1 << ((n) % NFDBITS)))
-#define CSH_FD_CLR(n, p)    ((*((p) + ((n)/NFDBITS))) &= ~(1 << ((n) % NFDBITS)))
-#define CSH_FD_ISSET(n, p)  ((*((p) + ((n)/NFDBITS))) & (1 << ((n) % NFDBITS)))
-#define CSH_FD_ZERO(p, n)      memset((void *)(p), 0,  (n))
-
-tchar *pathlist[] =	{ S_usrbin/*"/usr/bin"*/, S_DOT /*"."*/, 0 };
-tchar *dumphist[] =	{ S_history /*"history"*/, S_h /*"-h"*/, 0, 0 };
-tchar *loadhist[] =	{ S_source /*"source"*/, S_h /*"-h"*/, S_NDOThistory /*"~/.history"*/, 0 };
+#define	CSH_FD_SET(n, p)   ((*((p) + ((n)/NFDBITS))) |= (1 << ((n) % NFDBITS)))
+#define	CSH_FD_CLR(n, p)   ((*((p) + ((n)/NFDBITS))) &= ~(1 << ((n) % NFDBITS)))
+#define	CSH_FD_ISSET(n, p) ((*((p) + ((n)/NFDBITS))) & (1 << ((n) % NFDBITS)))
+#define	CSH_FD_ZERO(p, n)  memset((void *)(p), 0,  (n))
+
+tchar *pathlist[] =	{ S_usrbin /* "/usr/bin" */, S_DOT /* "." */, 0 };
+tchar *dumphist[] =	{ S_history /* "history" */, S_h /* "-h" */, 0, 0 };
+tchar *loadhist[] =	{ S_source /* "source" */, S_h /* "-h" */, S_NDOThistory /* "~/.history" */, 0 };
 tchar HIST = '!';
 tchar HISTSUB = '^';
 int	nofile;
@@ -130,7 +130,7 @@ main(int c, char **av)
 	 */
 	haderr = 0;
 	setexit();
-	if ( haderr ) {
+	if (haderr) {
 		/*
 		 *  if were here, there was an error in the csh
 		 *  startup so just punt
@@ -141,9 +141,9 @@ main(int c, char **av)
 	}
 
 
-	(void) setlocale(LC_ALL, "");	
+	(void) setlocale(LC_ALL, "");
 #if !defined(TEXT_DOMAIN)	/* Should be defined by cc -D */
-#define TEXT_DOMAIN "SYS_TEST"	/* Use this only if it weren't */
+#define	TEXT_DOMAIN "SYS_TEST"	/* Use this only if it weren't */
 #endif
 	(void) textdomain(TEXT_DOMAIN);
 
@@ -158,13 +158,13 @@ main(int c, char **av)
 		if (c > 0 && (eq(p, simple(q)) || eq(r, simple(q)))) {
 			pfcshflag = 1;
 		}
-		XFREE(q);
+		xfree(q);
 	}
 
 	if (p != NOSTR)
-		XFREE(p);
+		xfree(p);
 	if (r != NOSTR)
-		XFREE(r);
+		xfree(r);
 
 	if (pfcshflag == 1) {
 		secpolicy_init();
@@ -179,8 +179,8 @@ main(int c, char **av)
 	paraml.next = paraml.prev = &paraml;
 
 	settimes();			/* Immed. estab. timing base */
-	 
-	if (eq(v[0], S_aout/*"a.out"*/))	/* A.out's are quittable */
+
+	if (eq(v[0], S_aout /* "a.out" */))	/* A.out's are quittable */
 		quitit = 1;
 	uid = getuid();
 	loginsh = **v == '-';
@@ -226,7 +226,7 @@ main(int c, char **av)
 	 * Should we grab everything??
 	 */
 	if ((cp = getenvs_("USER")) != NOSTR)
-		set(S_user/*"user"*/, savestr(cp));
+		set(S_user /* "user" */, savestr(cp));
 	else {
 		/*
 		 * If USER is not defined, set it here.
@@ -235,23 +235,23 @@ main(int c, char **av)
 		pw = getpwuid(getuid());
 
 		if (pw != NULL) {
-			set(S_user, strtots((tchar *)0, pw->pw_name ));
+			set(S_user, strtots((tchar *)0, pw->pw_name));
 			local_setenv(S_USER, strtots((tchar *)0, pw->pw_name));
 		}
 		else if (loginsh) { /* Give up setting USER variable. */
-			printf("Warning: USER environment variable could not be set.\n");
+	printf("Warning: USER environment variable could not be set.\n");
 		}
 	}
 	if ((cp = getenvs_("TERM")) != NOSTR)
-		set(S_term/*"term"*/, savestr(cp));
+		set(S_term /* "term" */, savestr(cp));
 	/*
 	 * Re-initialize path if set in environment
 	 */
 	if ((cp = getenvs_("PATH")) == NOSTR)
-		set1(S_path/*"path"*/, saveblk(pathlist), &shvhed);
+		set1(S_path /* "path" */, saveblk(pathlist), &shvhed);
 	else
 		importpath(cp);
-	set(S_shell/*"shell"*/, S_SHELLPATH);
+	set(S_shell /* "shell" */, S_SHELLPATH);
 
 	doldol = putn(getpid());		/* For $$ */
 
@@ -349,11 +349,11 @@ main(int c, char **av)
 			break;
 
 		case 'V':		/* -V	Echo hist expanded input */
-			setNS(S_verbose/*"verbose"*/);		/* NOW! */
+			setNS(S_verbose /* "verbose" */);	/* NOW! */
 			break;
 
 		case 'X':		/* -X	Echo just before execution */
-			setNS(S_echo/*"echo"*/);			/* NOW! */
+			setNS(S_echo /* "echo" */);		/* NOW! */
 			break;
 
 		} while (*cp);
@@ -371,7 +371,7 @@ main(int c, char **av)
 	if (!batch && (uid != geteuid() || getgid() != getegid())) {
 		errno = EACCES;
 		child++;			/* So this ... */
-		Perror(S_csh/*"csh"*/);		/* ... doesn't return */
+		Perror(S_csh /* "csh" */);	/* ... doesn't return */
 	}
 
 	if (nofile == 0 && c > 0) {
@@ -408,15 +408,15 @@ main(int c, char **av)
 	/*
 	 * Save the remaining arguments in argv.
 	 */
-	setq(S_argv/*"argv"*/, v, &shvhed);
+	setq(S_argv /* "argv" */, v, &shvhed);
 
 	/*
 	 * Set up the prompt.
 	 */
 	if (prompt) {
 		gethostname_(s_prompt, MAXHOSTNAMELEN);
-		strcat_(s_prompt, uid == 0 ? S_SHARPSP/*"# "*/ : S_PERSENTSP/*"% "*/);
-		set(S_prompt/*"prompt"*/, s_prompt);
+		strcat_(s_prompt, uid == 0 ? S_SHARPSP /* "# " */ : S_PERSENTSP /* "% " */);
+		set(S_prompt /* "prompt" */, s_prompt);
 	}
 
 	/*
@@ -467,7 +467,7 @@ retry:
 				(void) fcntl(dcopy(f, FSHTTY), F_SETFD, 1);
 			} else {
 notty:
-  printf("Warning: no access to tty; thus no job control in this shell...\n");
+printf("Warning: no access to tty; thus no job control in this shell...\n");
 				tpgrp = -1;
 			}
 		}
@@ -481,7 +481,7 @@ notty:
 	sigemptyset(&sa.sa_mask);
 	sa.sa_handler = pchild;
 	sa.sa_flags = SA_RESTART;
-	(void) sigaction(SIGCHLD, &sa, (struct sigaction *) NULL);
+	(void) sigaction(SIGCHLD, &sa, (struct sigaction *)NULL);
 
 	/*
 	 * Set an exit here in case of an interrupt or error reading
@@ -492,26 +492,26 @@ notty:
 	if (!fast && reenter == 0) {
 		reenter++;
 
-                /*
-                 * If this is a login csh, and /etc/.login exists,
-                 * source /etc/.login first.
-                 */
-                if (loginsh) {
-			tchar tmp_etc[4+1];	/*strlen("/etc")+1 */
-			tchar tmp_login[7+1];	/*strlen("/.login")+1*/
+		/*
+		 * If this is a login csh, and /etc/.login exists,
+		 * source /etc/.login first.
+		 */
+		if (loginsh) {
+			tchar tmp_etc[4+1];	/* strlen("/etc")+1 */
+			tchar tmp_login[7+1];	/* strlen("/.login")+1 */
 
 			strtots(tmp_etc, "/etc");
 			strtots(tmp_login, "/.login");
-                        srccat_inlogin(tmp_etc, tmp_login);
-                }
+			srccat_inlogin(tmp_etc, tmp_login);
+		}
 
 		/* Will have value("home") here because set fast if don't */
-		srccat(value(S_home/*"home"*/), S_SLADOTcshrc/*"/.cshrc"*/);
+		srccat(value(S_home /* "home" */), S_SLADOTcshrc /* "/.cshrc" */);
 
-		/*Hash path*/
+		/* Hash path */
 		if (!fast && !arginp && !onelflg && !havhash)
 			dohash(xhash);
- 
+
 
 		/*
 		 * Reconstruct the history list now, so that it's
@@ -519,7 +519,7 @@ notty:
 		 */
 		dosource(loadhist);
 		if (loginsh) {
-			srccat_inlogin(value(S_home/*"home"*/), S_SLADOTlogin/*"/.login"*/);
+			srccat_inlogin(value(S_home /* "home" */), S_SLADOTlogin /* "/.login" */);
 		}
 
 		/*
@@ -530,7 +530,7 @@ notty:
 		 * cache $cdpath paths. xhash2 is global array
 		 * for $cdpath caching.
 		 */
-		if (!fast && !arginp && !onelflg && !havhash2 )
+		if (!fast && !arginp && !onelflg && !havhash2)
 				dohash(xhash2);
 	}
 
@@ -538,9 +538,9 @@ notty:
 	 * Now are ready for the -v and -x flags
 	 */
 	if (nverbose)
-		setNS(S_verbose/*"verbose"*/);
+		setNS(S_verbose /* "verbose" */);
 	if (nexececho)
-		setNS(S_echo/*"echo"*/);
+		setNS(S_echo /* "echo" */);
 
 	/*
 	 * All the rest of the world is inside this call.
@@ -590,7 +590,7 @@ importpath(tchar *cp)
 	 * There are i+1 directories in the path plus we need
 	 * room for a zero terminator.
 	 */
-	pv =  (tchar **) calloc((unsigned) (i + 2), sizeof  (tchar **));
+	pv =  (tchar **)xcalloc((unsigned)(i + 2), sizeof (tchar **));
 	dp = cp;
 	i = 0;
 	if (*dp)
@@ -607,7 +607,7 @@ importpath(tchar *cp)
 		dp++;
 	}
 	pv[i] = 0;
-	set1(S_path /*"path"*/, pv, &shvhed);
+	set1(S_path /* "path" */, pv, &shvhed);
 }
 
 /*
@@ -702,7 +702,7 @@ srcunit(int unit, bool onlyown, bool hflg)
 	reenter++;
 	if (reenter == 1) {
 		/* Setup the new values of the state stuff saved above */
-		copy( (char *)&saveB,  (char *)&B, sizeof saveB);
+		copy((char *)&saveB, (char *)&B, sizeof saveB);
 		fbuf =  (tchar **) 0;
 		fseekp = feobp = fblocks = 0;
 		oSHIN = SHIN, SHIN = unit, arginp = 0, onelflg = 0;
@@ -731,10 +731,10 @@ srcunit(int unit, bool onlyown, bool hflg)
 		/* This code could get run twice but xfree doesn't care */
 		for (i = 0; i < fblocks; i++)
 			xfree(fbuf[i]);
-		xfree( (char *)fbuf);
+		xfree((char *)fbuf);
 
 		/* Reset input arena */
-		copy( (char *)&B,  (char *)&saveB, sizeof B);
+		copy((char *)&B, (char *)&saveB, sizeof B);
 
 		(void) close(SHIN), SHIN = oSHIN;
 		unsetfd(SHIN);
@@ -765,10 +765,10 @@ rechist(void)
 	int fp, ftmp, oldidfds;
 
 	if (!fast) {
-		if (value(S_savehist/*"savehist"*/)[0] == '\0')
+		if (value(S_savehist /* "savehist" */)[0] == '\0')
 			return;
-		(void) strcpy_(buf, value(S_home/*"home"*/));
-		(void) strcat_(buf, S_SLADOThistory/*"/.history"*/);
+		(void) strcpy_(buf, value(S_home /* "home" */));
+		(void) strcat_(buf, S_SLADOThistory /* "/.history" */);
 		fp = creat_(buf, 0666);
 		if (fp == -1)
 			return;
@@ -776,7 +776,7 @@ rechist(void)
 		didfds = 0;
 		ftmp = SHOUT;
 		SHOUT = fp;
-		(void) strcpy_(buf, value(S_savehist/*"savehist"*/));
+		(void) strcpy_(buf, value(S_savehist /* "savehist" */));
 		dumphist[2] = buf;
 		dohist(dumphist);
 		(void) close(fp);
@@ -794,8 +794,8 @@ goodbye(void)
 		(void) signal(SIGINT, SIG_IGN);
 		(void) signal(SIGTERM, SIG_IGN);
 		setintr = 0;		/* No interrupts after "logout" */
-		if (adrof(S_home/*"home"*/))
-			srccat(value(S_home/*"home"*/), S_SLADOTlogout/*"/.logout"*/);
+		if (adrof(S_home /* "home" */))
+			srccat(value(S_home /* "home" */), S_SLADOTlogout /* "/.logout" */);
 	}
 	rechist();
 	exitstat();
@@ -815,7 +815,7 @@ exitstat(void)
 	 */
 	child++;
 	untty();
-	exit(getn(value(S_status/*"status"*/)));
+	exit(getn(value(S_status /* "status" */)));
 }
 
 /*
@@ -828,7 +828,7 @@ phup(void)
 	exit(1);
 }
 
-tchar *jobargv[2] = { S_jobs/*"jobs"*/, 0 };
+tchar *jobargv[2] = { S_jobs /* "jobs" */, 0 };
 /*
  * Catch an interrupt, e.g. during lexical input.
  * If we are an interactive shell, we reset the interrupt catch
@@ -902,8 +902,9 @@ process(bool catch)
 	getexit(osetexit);
 	for (;;) {
 		pendjob();
+		freelex(&paraml);
 		paraml.next = paraml.prev = &paraml;
-		paraml.word = S_ /*""*/;
+		paraml.word = S_ /* "" */;
 		t = 0;
 		setexit();
 		justpr = enterhist;	/* execute if not entering history */
@@ -964,7 +965,7 @@ process(bool catch)
 		 * Echo not only on VERBOSE, but also with history expansion.
 		 */
 		if (lex(&paraml) && intty ||
-		    adrof(S_verbose /*"verbose"*/)) {
+		    adrof(S_verbose /* "verbose" */)) {
 			haderr = 1;
 			prlex(&paraml);
 			haderr = 0;
@@ -977,7 +978,7 @@ process(bool catch)
 			(void) sigblock(sigmask(SIGINT));
 
 		/*
-		 * Save input text on the history list if 
+		 * Save input text on the history list if
 		 * reading in old history, or it
 		 * is from the terminal at the top level and not
 		 * in a loop.
@@ -1022,7 +1023,7 @@ process(bool catch)
 
 			omask = sigblock(sigmask(SIGCHLD));
 			execute(t, tpgrp);
-			(void)sigsetmask(omask &~ sigmask(SIGCHLD));
+			(void) sigsetmask(omask &~ sigmask(SIGCHLD));
 		}
 
 		if (err)
@@ -1044,7 +1045,7 @@ dosource(tchar **t)
 	tchar buf[BUFSIZ];
 
 	t++;
-	if (*t && eq(*t, S_h /*"-h"*/)) {
+	if (*t && eq(*t, S_h /* "-h" */)) {
 		if (*++t == NOSTR)
 			bferr("Too few arguments.");
 		hflg++;
@@ -1079,7 +1080,7 @@ mailchk(void)
 	struct stat stb;
 	bool new;
 
-	v = adrof(S_mail /*"mail"*/);
+	v = adrof(S_mail /* "mail" */);
 	if (v == 0)
 		return;
 	(void) time(&t);
@@ -1118,7 +1119,7 @@ gethdir(tchar *home)
 	/* getpwname will not be modified, so we need temp. buffer */
 	char home_str[BUFSIZ];
 	tchar home_ts[BUFSIZ];
-	struct passwd *pp /*= getpwnam(home)*/;
+	struct passwd *pp /* = getpwnam(home) */;
 
 	pp = getpwnam(tstostr(home_str, home));
 	if (pp == 0)
@@ -1128,7 +1129,7 @@ gethdir(tchar *home)
 }
 
 
-/*
+#if 0
 void
 #ifdef PROF
 done(int i)
@@ -1140,7 +1141,7 @@ exit(int i)
 	untty();
 	_exit(i);
 }
-*/
+#endif
 
 void
 printprompt(void)
@@ -1151,7 +1152,7 @@ printprompt(void)
 		/*
 		 * Print the prompt string
 		 */
-		for (cp = value(S_prompt /*"prompt"*/); *cp; cp++)
+		for (cp = value(S_prompt /* "prompt" */); *cp; cp++)
 			if (*cp == HIST)
 				printf("%d", eventno + 1);
 			else {
@@ -1160,7 +1161,7 @@ printprompt(void)
 				Putchar(*cp | QUOTE);
 			}
 	} else
-		/* 
+		/*
 		 * Prompt for forward reading loop
 		 * body content.
 		 */
@@ -1175,11 +1176,11 @@ tchar **
 strblktotsblk(char **v, int num)
 {
 	tchar **newv =
-		 (tchar **) calloc((unsigned) (num+ 1), sizeof  (tchar **));
+		(tchar **)xcalloc((unsigned)(num+ 1), sizeof (tchar **));
 	tchar **onewv = newv;
 
 	while (*v && num--)
-		*newv++ = strtots(NOSTR,*v++);
+		*newv++ = strtots(NOSTR, *v++);
 	*newv = 0;
 	return (onewv);
 }
@@ -1193,7 +1194,7 @@ sigwaiting(void)
 void
 siglwp(void)
 {
-	_signal(SIGLWP, siglwp); 
+	_signal(SIGLWP, siglwp);
 }
 
 
@@ -1218,8 +1219,8 @@ static int NoFile = NOFILE;	/* The number of files I can use. */
  * hold of them. And initialize fdinuse list and set
  * the current process id.
  *
- * If this csh was invoked from setuid'ed script file, 
- * do not close the third argument passed. The file 
+ * If this csh was invoked from setuid'ed script file,
+ * do not close the third argument passed. The file
  * must be one of /dev/fd/0,1,2,,,
  *	(execv() always passes three arguments when it execs a script
  *	 file in a form of #! /bin/csh -b.)
@@ -1273,20 +1274,20 @@ initdesc_x(int argc, char *argv[], int is_reinit)
 	struct stat buf;
 	struct rlimit rlp;
 
-	 /*
-	  * Get pid of this shell
-	  */
+	/*
+	 * Get pid of this shell
+	 */
 	my_pid = getpid();
 
 	/*
 	 * Get the hard limit numbers of descriptors
 	 * this csh can use.
 	 */
-	if (getrlimit(RLIMIT_NOFILE, &rlp) == 0) 
+	if (getrlimit(RLIMIT_NOFILE, &rlp) == 0)
 		NoFile = rlp.rlim_cur;
-		
+
 	/*
-	 * If this csh was invoked for executing setuid script file, 
+	 * If this csh was invoked for executing setuid script file,
 	 * the third argument passed is the special file name
 	 * which should not be closed.  This special file name is
 	 * in the form /dev/fd/X.
@@ -1300,8 +1301,8 @@ initdesc_x(int argc, char *argv[], int is_reinit)
 						 */
 
 	if (fdinuse == NULL) {
-		nbytesused = sizeof(int) * howmany(NoFile, sizeof(int) * NBBY);
-		fdinuse = (int *) xalloc(nbytesused);
+		nbytesused = sizeof (int) * howmany(NoFile, sizeof (int) * NBBY);
+		fdinuse = (int *)xalloc(nbytesused);
 	}
 
 	/*
@@ -1314,7 +1315,7 @@ initdesc_x(int argc, char *argv[], int is_reinit)
 		(void) fdwalk(close_inuse, &script_fd);
 
 	didfds = 0;			/* 0, 1, 2 aren't set up */
-	
+
 	if (fstat(0, &buf) < 0)
 		open("/dev/null", 0);
 
@@ -1323,7 +1324,7 @@ initdesc_x(int argc, char *argv[], int is_reinit)
 	(void) fcntl(SHDIAG = dcopy(2, FSHDIAG), F_SETFD,  1);
 	(void) fcntl(OLDSTD = dcopy(SHIN, FOLDSTD), F_SETFD,  1);
 
-	/* 
+	/*
 	 * Open 0/1/2 to avoid Nis+ functions to pick them up.
 	 *	Now, 0/1/2 are saved, close them and open them.
 	 */
@@ -1335,7 +1336,7 @@ initdesc_x(int argc, char *argv[], int is_reinit)
 	/*
 	 * Clear fd_set mask
 	 */
-	if ( ! is_reinit)
+	if (!is_reinit)
 		CSH_FD_ZERO(fdinuse, nbytesused);
 }
 
@@ -1354,7 +1355,7 @@ closem(void)
 
 	for (f = 3; f <= max_fd; f++) {
 		if (CSH_FD_ISSET(f, fdinuse) &&
-		    f != SHIN && f != SHOUT && f != SHDIAG && 
+		    f != SHIN && f != SHOUT && f != SHDIAG &&
 		    f != OLDSTD && f != FSHTTY)
 			close(f);
 	}
@@ -1376,18 +1377,18 @@ new_process(void)
 
 /*
  * Whenever Csh open/create/dup/pipe a file or files,
- * Csh keeps track of its open files. The open files 
+ * Csh keeps track of its open files. The open files
  * are kept in "fdinuse, Fd In Use" list.
  *
  * When a file descriptor is newly allocated, setfd() is
  * used to mark the fact in "fdinuse" list.
- *	For example, 
+ *	For example,
  *		fd = open("newfile", 0);
  *		setfd(fd);
  *
  * When a file is freed by close() function, unsetfd() is
  * used to remove the fd from "fdinuse" list.
- *	For example, 
+ *	For example,
  *		close(fd);
  *		unsetfd(fd);
  */
@@ -1426,7 +1427,7 @@ unsetfd(int fd)
 
 	CSH_FD_CLR(fd, fdinuse);
 	if (fd == max_fd) {
-		for (i = max_fd-1; i >= 3; i--) 
+		for (i = max_fd-1; i >= 3; i--)
 			if (CSH_FD_ISSET(i, fdinuse)) {
 				max_fd = i;
 				return;
diff --git a/usr/src/cmd/csh/sh.dir.c b/usr/src/cmd/csh/sh.dir.c
index 00fa768e51..a7ee26fb4f 100644
--- a/usr/src/cmd/csh/sh.dir.c
+++ b/usr/src/cmd/csh/sh.dir.c
@@ -58,11 +58,11 @@ dinit(tchar *hp)
 	else {
 		cp = getwd_(path);
 		if (cp == NULL) {
-			printf ("Warning: cannot determine current directory\n");
+			printf("Warning: cannot determine current directory\n");
 			cp = S_DOT;
 		}
 	}
-	dp = (struct directory *)calloc(sizeof (struct directory), 1);
+	dp = (struct directory *)xcalloc(sizeof (struct directory), 1);
 	dp->di_name = savestr(cp);
 	dp->di_count = 0;
 	dhead.di_next = dhead.di_prev = dp;
@@ -147,7 +147,7 @@ dochngd(tchar **v)
 		goto flushcwd;
 	} else
 		cp = dfollow(*v);
-	dp = (struct directory *)calloc(sizeof (struct directory), 1);
+	dp = (struct directory *)xcalloc(sizeof (struct directory), 1);
 	dp->di_name = cp;
 	dp->di_count = 0;
 	dp->di_next = dcwd->di_next;
@@ -169,9 +169,9 @@ dfollow(tchar *cp)
 	struct varent *c;
 	int cdhashval, cdhashval1;
 	int index;
-	int slash; /*slashes in the argument*/
+	int slash; /* slashes in the argument */
 	tchar *fullpath;
-	tchar *slashcp; /*cp string prepended with a slash*/
+	tchar *slashcp; /* cp string prepended with a slash */
 
 #ifdef TRACE
 	tprintf("TRACE- dfollow()\n");
@@ -183,7 +183,7 @@ dfollow(tchar *cp)
 	/*
 	 * If the directory argument has a slash in it,
 	 * for example, directory/directory, then can't
-	 * find that in the cache table.  
+	 * find that in the cache table.
 	 */
 	slash = any('/', cp);
 
@@ -192,20 +192,20 @@ dfollow(tchar *cp)
 	 * cdpath caching is turned off or directory argument
 	 * has a slash in it.
 	 */
-	if (cp[0] != '/' 
-	    && !prefix(S_DOTSLA /* "./" */, cp) 
+	if (cp[0] != '/'
+	    && !prefix(S_DOTSLA /* "./" */, cp)
 	    && !prefix(S_DOTDOTSLA /* "../" */, cp)
 	    && (c = adrof(S_cdpath))
-            && ( !havhash2 || slash) ) {
+	    && (!havhash2 || slash)) {
 		tchar **cdp;
 		tchar *p;
 		tchar buf[MAXPATHLEN];
 
 		for (cdp = c->vec; *cdp; cdp++) {
-			for (dp = buf, p = *cdp; *dp++ = *p++;)
+			for (dp = buf, p = *cdp; *dp++ = *p++; )
 				;
 			dp[-1] = '/';
-			for (p = cp; *dp++ = *p++;)
+			for (p = cp; *dp++ = *p++; )
 				;
 			if (chdir_(buf) >= 0) {
 				printd = 1;
@@ -215,17 +215,17 @@ dfollow(tchar *cp)
 			}
 		}
 	}
-	
+
 	/* cdpath caching turned on */
-	if (cp[0] != '/' 
-	    && !prefix(S_DOTSLA /* "./" */, cp) 
+	if (cp[0] != '/'
+	    && !prefix(S_DOTSLA /* "./" */, cp)
 	    && !prefix(S_DOTDOTSLA /* "../" */, cp)
 	    && (c = adrof(S_cdpath))
-	    && havhash2 && !slash ) {
+	    && havhash2 && !slash) {
 		tchar **pv;
 
 		/* If no cdpath or no paths in cdpath, leave */
-		if ( c == 0 || c->vec[0]== 0 )
+		if (c == 0 || c->vec[0] == 0)
 			pv = justabs;
 		else
 			pv = c->vec;
@@ -234,8 +234,8 @@ dfollow(tchar *cp)
 
 		cdhashval = hashname(cp);
 
-		/*index points to next path component to test*/
-		index=0;
+		/* index points to next path component to test */
+		index = 0;
 
 		/*
 		 * Look at each path in cdpath until get a match.
@@ -243,7 +243,7 @@ dfollow(tchar *cp)
 		 */
 		do {
 			/* only check cache for absolute pathnames */
-			if ( pv[0][0] == '/' ) {
+			if (pv[0][0] == '/') {
 				cdhashval1 = hash(cdhashval, index);
 				if (bit(xhash2, cdhashval1)) {
 					/*
@@ -286,7 +286,7 @@ dfollow(tchar *cp)
 			index++;
 		} while (*pv);
 	}
-      
+
 	/*
 	 * Try dereferencing the variable named by the argument.
 	 */
@@ -310,13 +310,13 @@ gotcha:
 		 * All in the name of efficiency?
 		 */
 
-		if ( ( cwdlen = (strlen_(dcwd->di_name) ) ) == 1 ){
-			if ( *dcwd->di_name == '/' ) /* root */
+		if ((cwdlen = (strlen_(dcwd->di_name))) == 1) {
+			if (*dcwd->di_name == '/') /* root */
 				cwdlen = 0;
 			else
 			{
 				/*
-				 * if we are here, when the shell started 
+				 * if we are here, when the shell started
 				 * it was unable to getwd(), lets try it again
 				 */
 				tchar path[MAXPATHLEN];
@@ -342,14 +342,14 @@ gotcha:
 		 * dp = (tchar *)xalloc((unsigned) (cwdlen + (p - cp) + 1)*sizeof (tchar))
 		 */
 		len = strlen_(cp);
-		dp = (tchar *)xalloc((unsigned) (cwdlen + len + 2)*sizeof(tchar));
-		for (p = dp, q = dcwd->di_name; *p++ = *q++;)
+		dp = (tchar *)xalloc((unsigned)(cwdlen + len + 2) * sizeof (tchar));
+		for (p = dp, q = dcwd->di_name; *p++ = *q++; )
 			;
 		if (cwdlen)
 			p[-1] = '/';
 		else
 			p--;			/* don't add a / after root */
-		for (q = cp; *p++ = *q++;)
+		for (q = cp; *p++ = *q++; )
 			;
 		xfree(cp);
 		cp = dp;
@@ -393,7 +393,7 @@ dopushd(tchar **v)
 		tchar *cp;
 
 		cp = dfollow(*v);
-		dp = (struct directory *)calloc(sizeof (struct directory), 1);
+		dp = (struct directory *)xcalloc(sizeof (struct directory), 1);
 		dp->di_name = cp;
 		dp->di_count = 0;
 		dp->di_prev = dcwd;
@@ -482,7 +482,7 @@ dfree(struct directory *dp)
 	if (dp->di_count != 0)
 		dp->di_next = dp->di_prev = 0;
 	else
-		xfree(dp->di_name), xfree( (tchar *)dp);
+		xfree(dp->di_name), xfree((tchar *)dp);
 }
 
 /*
@@ -497,7 +497,7 @@ tchar *
 dcanon(tchar *cp, tchar *p)
 {
 	tchar *sp;	/* rightmost component currently under
-				   consideration */
+				consideration */
 	tchar *p1,	/* general purpose */
 	    *p2;
 	bool slash, dotdot, hardpaths;
@@ -527,7 +527,7 @@ dcanon(tchar *cp, tchar *p)
 		while (*++p == '/')	/* flush extra slashes */
 			;
 		if (p != ++sp)
-			for (p1 = sp, p2 = p; *p1++ = *p2++;)
+			for (p1 = sp, p2 = p; *p1++ = *p2++; )
 				;
 
 		p = sp;			/* save start of component */
@@ -552,7 +552,7 @@ dcanon(tchar *cp, tchar *p)
 		if (sp[0] == '.' && sp[1] == '\0') {
 			/* Squeeze out component consisting of "." */
 			if (slash) {
-				for (p1 = sp, p2 = p + 1; *p1++ = *p2++;)
+				for (p1 = sp, p2 = p + 1; *p1++ = *p2++; )
 					;
 				p = --sp;
 			} else if (--sp != cp)
@@ -623,7 +623,7 @@ dcanon(tchar *cp, tchar *p)
 				/*
 				 * Find length of p.
 				 */
-				for (p1 = p; *p1++;)
+				for (p1 = p; *p1++; )
 					;
 
 				if (*link != '/') {
@@ -650,15 +650,15 @@ dcanon(tchar *cp, tchar *p)
 					 * New length is: "x/" + link + "z"
 					 */
 					p1 = newcp = (tchar *)xalloc((unsigned)
-						((sp - cp) + cc + (p1 - p))*sizeof (tchar));
+						((sp - cp) + cc + (p1 - p)) * sizeof (tchar));
 					/*
 					 * Copy new path into newcp
 					 */
-					for (p2 = cp; *p1++ = *p2++;)
+					for (p2 = cp; *p1++ = *p2++; )
 						;
-					for (p1--, p2 = link; *p1++ = *p2++;)
+					for (p1--, p2 = link; *p1++ = *p2++; )
 						;
-					for (p1--, p2 = p; *p1++ = *p2++;)
+					for (p1--, p2 = p; *p1++ = *p2++; )
 						;
 					/*
 					 * Restart canonicalization at
@@ -674,9 +674,9 @@ dcanon(tchar *cp, tchar *p)
 					/*
 					 * Copy new path into newcp
 					 */
-					for (p2 = link; *p1++ = *p2++;)
+					for (p2 = link; *p1++ = *p2++; )
 						;
-					for (p1--, p2 = p; *p1++ = *p2++;)
+					for (p1--, p2 = p; *p1++ = *p2++; )
 						;
 					/*
 					 * Restart canonicalization at beginning
@@ -698,7 +698,7 @@ dcanon(tchar *cp, tchar *p)
 				while (*--sp != '/')
 					;
 			if (slash) {
-				for (p1 = sp + 1, p2 = p + 1; *p1++ = *p2++;)
+				for (p1 = sp + 1, p2 = p + 1; *p1++ = *p2++; )
 					;
 				p = sp;
 			} else if (cp == sp)
@@ -713,7 +713,7 @@ dcanon(tchar *cp, tchar *p)
 	}
 	return cp;
 }
- 
+
 /*
  * dnewcwd - make a new directory in the loop the current one
  *	and export its name to the PWD environment variable.
@@ -735,9 +735,9 @@ dnewcwd(struct directory *dp)
 	 */
 #endif /* notdef */
 
-	didchdir=1;
+	didchdir = 1;
 	set(S_cwd, savestr(dcwd->di_name));
-	didchdir=0;
+	didchdir = 0;
 	local_setenv(S_PWD, dcwd->di_name);
 	if (printd)
 		dodirs(fakev);
diff --git a/usr/src/cmd/csh/sh.dol.c b/usr/src/cmd/csh/sh.dol.c
index 57176d0ad6..fe0b88f4b0 100644
--- a/usr/src/cmd/csh/sh.dol.c
+++ b/usr/src/cmd/csh/sh.dol.c
@@ -38,7 +38,7 @@ tchar	*Dcp, **Dvp;			/* Input vector for Dreadc */
 
 #define	unDgetC(c)	Dpeekc = c
 
-#define QUOTES		(_Q|_Q1|_ESC)	/* \ ' " ` */
+#define	QUOTES		(_Q|_Q1|_ESC)	/* \ ' " ` */
 
 /*
  * The following variables give the information about the current
@@ -73,7 +73,7 @@ Dfix(struct command *t)
 	if (noexec)
 		return;
 	/* Note that t_dcom isn't trimmed thus !...:q's aren't lost */
-	for (pp = t->t_dcom; p = *pp++;)
+	for (pp = t->t_dcom; p = *pp++; )
 		while (*p)
 			if (cmap(*p++, _DOL|QUOTES)) {	/* $, \, ', ", ` */
 				Dfix2(t->t_dcom);	/* found one */
@@ -120,7 +120,7 @@ Dfix2(tchar **v)
 	tprintf("TRACE- Dfix2()\n");
 #endif
 	ginit(agargv);			/* Initialize glob's area pointers */
-	Dvp = v; Dcp = S_ /* "" */;/* Setup input vector for Dreadc */
+	Dvp = v; Dcp = S_ /* "" */;	/* Setup input vector for Dreadc */
 	unDgetC(0); unDredc(0);		/* Clear out any old peeks (at error) */
 	dolp = 0; dolcnt = 0;		/* Clear out residual $ expands (...) */
 	while (Dword())
@@ -340,7 +340,7 @@ Dgetdol(void)
 	int c, sc;
 	int subscr = 0, lwb = 1, upb = 0;
 	bool dimen = 0, bitset = 0;
-	tchar wbuf[BUFSIZ];
+	tchar wbuf[BUFSIZ + MB_LEN_MAX]; /* read_ may return extra bytes */
 
 #ifdef TRACE
 	tprintf("TRACE- Dgetdol()\n");
@@ -354,7 +354,7 @@ Dgetdol(void)
 	else if (c == '?')
 		bitset++, c = DgetC(0);		/* $? tests existence */
 	switch (c) {
-	
+
 	case '$':
 		if (dimen || bitset)
 syntax:
@@ -410,7 +410,7 @@ syntax:
 				error("Subscript out of range");
 			if (subscr == 0) {
 				if (bitset) {
-					dolp = file ? S_1/*"1"*/ : S_0/*"0"*/;
+					dolp = file ? S_1 /* "1" */ : S_0 /* "0" */;
 					goto eatbrac;
 				}
 				if (file == 0)
@@ -444,14 +444,18 @@ syntax:
 		vp = adrof(name);
 	}
 	if (bitset) {
-		/* getenv() to getenv_(), because 'name''s type is now tchar * */
-		/* no need to xalloc */
-		dolp = (vp || getenv_(name)) ? S_1 /*"1"*/ : S_0/*"0"*/;
+		/*
+		 * getenv() to getenv_(), because 'name''s type is now tchar *
+		 * no need to xalloc
+		 */
+		dolp = (vp || getenv_(name)) ? S_1 /* "1" */ : S_0 /* "0" */;
 		goto eatbrac;
 	}
 	if (vp == 0) {
-		/* getenv() to getenv_(), because 'name''s type is now tchar * */
-		/* no need to xalloc */
+		/*
+		 * getenv() to getenv_(), because 'name''s type is now tchar *
+		 * no need to xalloc
+		 */
 		np = getenv_(name);
 		if (np) {
 			addla(np);
@@ -484,15 +488,15 @@ syntax:
 
 			while (digit(*np))
 				i = i * 10 + *np++ - '0';
-/*			if ((i < 0 || i > upb) && !any(*np, "-*")) {*/
-			if ((i < 0 || i > upb) && (*np!='-') && (*np!='*')) {
+/*			if ((i < 0 || i > upb) && !any(*np, "-*")) { */
+			if ((i < 0 || i > upb) && (*np != '-') && (*np != '*')) {
 oob:
 				setname(vp->v_name);
 				error("Subscript out of range");
 			}
 			lwb = i;
 			if (!*np)
-				upb = lwb, np = S_AST/*"*"*/;
+				upb = lwb, np = S_AST /* "*" */;
 		}
 		if (*np == '*')
 			np++;
@@ -578,7 +582,7 @@ setDolp(tchar *cp)
 		xfree(dp);
 	} else
 		addla(cp);
-	dolp = S_/*""*/;
+	dolp = S_ /* "" */;
 }
 
 void
@@ -660,9 +664,9 @@ heredoc(tchar *term)
 			if (c &= TRIM) {
 				*lbp++ = c;
 				if (--lcnt < 0) {
-					setname(S_LESLES/*"<<"*/);
+					setname(S_LESLES /* "<<" */);
 					error("Line overflow");
-				} 
+				}
 			}
 		}
 		*lbp = 0;
@@ -681,7 +685,7 @@ heredoc(tchar *term)
 		 */
 		if (quoted || noexec) {
 			*lbp++ = '\n'; *lbp = 0;
-			for (lbp = lbuf; c = *lbp++;) {
+			for (lbp = lbuf; c = *lbp++; ) {
 				*obp++ = c;
 				if (--ocnt == 0) {
 					(void) write_(0, obuf, BUFSIZ);
@@ -703,17 +707,17 @@ heredoc(tchar *term)
 			if ((c &= TRIM) == 0)
 				continue;
 			/* \ quotes \ $ ` here */
-			if (c =='\\') {
+			if (c == '\\') {
 				c = DgetC(0);
-/*				if (!any(c, "$\\`"))*/
-				if ((c!='$')&&(c!='\\')&&(c!='`'))
+/*				if (!any(c, "$\\`")) */
+				if ((c != '$') && (c != '\\') && (c != '`'))
 					unDgetC(c | QUOTE), c = '\\';
 				else
 					c |= QUOTE;
 			}
 			*mbp++ = c;
 			if (--mcnt == 0) {
-				setname(S_LESLES/*"<<"*/);
+				setname(S_LESLES /* "<<" */);
 				bferr("Line overflow");
 			}
 		}
diff --git a/usr/src/cmd/csh/sh.exec.c b/usr/src/cmd/csh/sh.exec.c
index a696f77c5c..e80bfec8dc 100644
--- a/usr/src/cmd/csh/sh.exec.c
+++ b/usr/src/cmd/csh/sh.exec.c
@@ -32,7 +32,7 @@
  * If there is no search path then we execute only full path names.
  */
 
-/* 
+/*
  * As we search for the command we note the first non-trivial error
  * message for presentation to the user.  This allows us often
  * to show that a file has the wrong mode/no access when the file
@@ -75,7 +75,7 @@ doexec(struct command *t)
 	exerr = 0; t->t_dcom[0] = dp;
 	setname(dp);
 	xfree(sav);
-	v = adrof(S_path /*"path"*/);
+	v = adrof(S_path /* "path" */);
 	if (v == 0 && dp[0] != '/') {
 		pexerr();
 	}
@@ -123,7 +123,7 @@ doexec(struct command *t)
 		pv = justabs;
 	else
 		pv = v->vec;
-	sav = strspl(S_SLASH /* "/" */, *av);		/* / command name for postpending */
+	sav = strspl(S_SLASH /* "/" */, *av); /* / command name for postpending */
 #ifdef VFORK
 	Vsav = sav;
 #endif
@@ -140,7 +140,7 @@ doexec(struct command *t)
 				goto cont;
 		}
 
-		if (pv[0][0] == 0 || eq(pv[0], S_DOT/*"."*/)) {	/* don't make ./xxx */
+		if (pv[0][0] == 0 || eq(pv[0], S_DOT /* "." */)) { /* don't make ./xxx */
 			texec(t, *av, av);
 		} else {
 			dp = strspl(*pv, sav);
@@ -168,7 +168,7 @@ cont:
 	Vav = 0;
 #endif
 	xfree(sav);
-	xfree( (char *)av);
+	xfree((char *)av);
 	pexerr();
 }
 
@@ -197,7 +197,7 @@ texec(struct command *cmd, tchar *f, tchar **t)
 	struct	varent *v;
 	tchar	**vp;
 	tchar		*lastsh[2];
-	
+
 #ifdef TRACE
 	tprintf("TRACE- texec()\n");
 #endif
@@ -222,46 +222,46 @@ texec(struct command *cmd, tchar *f, tchar **t)
 	 */
 	xfree(cmd->cfname);
 	chr_blkfree(cmd->cargs);
-	cmd->cfname = (char *) 0;
-	cmd->cargs = (char **) 0;
+	cmd->cfname = (char *)0;
+	cmd->cargs = (char **)0;
 
 	switch (errno) {
 	case ENOEXEC:
 		/* check that this is not a binary file */
-		{       
+		{
 			int ff = open_(f, 0);
-			tchar ch;
+			tchar ch[MB_LEN_MAX];
 
-			if (ff != -1 && read_(ff, &ch, 1) == 1 && !isprint(ch)
-			       && !isspace(ch)) {
+			if (ff != -1 && read_(ff, ch, 1) == 1 &&
+			    !isprint(ch[0]) && !isspace(ch[0])) {
 				printf("Cannot execute binary file.\n");
 				Perror(f);
 				(void) close(ff);
 				unsetfd(ff);
 				return;
-			} 
+			}
 			(void) close(ff);
 			unsetfd(ff);
-		} 
+		}
 		/*
 		 * If there is an alias for shell, then
 		 * put the words of the alias in front of the
 		 * argument list replacing the command name.
 		 * Note no interpretation of the words at this point.
 		 */
-		v = adrof1(S_shell /*"shell"*/, &aliases);
+		v = adrof1(S_shell /* "shell" */, &aliases);
 		if (v == 0) {
 #ifdef OTHERSH
 			int ff = open_(f, 0);
-			tchar ch;
+			tchar ch[MB_LEN_MAX];
 #endif
 
 			vp = lastsh;
-			vp[0] = adrof(S_shell /*"shell"*/) ? value(S_shell /*"shell"*/) : S_SHELLPATH/*SHELLPATH*/;
+			vp[0] = adrof(S_shell /* "shell" */) ? value(S_shell /* "shell" */) : S_SHELLPATH /* SHELLPATH */;
 			vp[1] =  (tchar *) NULL;
 #ifdef OTHERSH
-			if (ff != -1 && read_(ff, &ch, 1) == 1 && ch != '#')
-				vp[0] = S_OTHERSH/*OTHERSH*/;
+			if (ff != -1 && read_(ff, ch, 1) == 1 && ch[0] != '#')
+				vp[0] = S_OTHERSH /* OTHERSH */;
 			(void) close(ff);
 			unsetfd(ff);
 #endif
@@ -277,15 +277,15 @@ texec(struct command *cmd, tchar *f, tchar **t)
 		 * now done with tchar arg list t,
 		 * free the space calloc'd by above blkspl()
 		 */
-		xfree((char *) t);
+		xfree((char *)t);
 
 		execv(cmd->cfname, cmd->cargs);	/* exec the command */
 
 		/* exec returned, same free'ing as above */
 		xfree(cmd->cfname);
 		chr_blkfree(cmd->cargs);
-		cmd->cfname = (char *) 0;
-		cmd->cargs = (char **) 0;
+		cmd->cfname = (char *)0;
+		cmd->cargs = (char **)0;
 
 		/* The sky is falling, the sky is falling! */
 
@@ -314,7 +314,7 @@ tconvert(struct command *cmd, tchar *fname, tchar **list)
 
 	len = blklen(list);
 	rc = cmd->cargs = (char **)
-		calloc((u_int) (len + 1), sizeof(char **));
+		xcalloc((uint_t)(len + 1), sizeof (char **));
 	while (len--)
 		*rc++ = tstostr(NULL, *list++);
 	*rc = NULL;
@@ -346,7 +346,7 @@ xechoit(tchar **t)
 	tprintf("TRACE- xechoit()\n");
 #endif
 
-	if (adrof(S_echo /*"echo"*/)) {
+	if (adrof(S_echo /* "echo" */)) {
 		flush();
 		haderr = 1;
 		blkpr(t), Putchar('\n');
@@ -354,7 +354,7 @@ xechoit(tchar **t)
 	}
 }
 
-/* 
+/*
  * This routine called when user enters "rehash".
  * Both the path and cdpath caching arrays will
  * be rehashed, via calling dohash.  If either
@@ -388,15 +388,15 @@ dohash(char cachearray[])
 	tprintf("TRACE- dohash()\n");
 #endif
 	/* Caching $path */
-	if ( cachearray == xhash ) {
+	if (cachearray == xhash) {
 		havhash = 1;
-		v = adrof(S_path /*"path"*/);
-	}else {    /* Caching $cdpath */
+		v = adrof(S_path /* "path" */);
+	} else {    /* Caching $cdpath */
 		havhash2 = 1;
-		v = adrof(S_cdpath /*"cdpath"*/);
+		v = adrof(S_cdpath /* "cdpath" */);
 	}
 
-	for (cnt = 0; cnt < ( HSHSIZ / 8 ); cnt++)
+	for (cnt = 0; cnt < (HSHSIZ / 8); cnt++)
 		cachearray[cnt] = 0;
 	if (v == 0)
 		{
@@ -418,9 +418,9 @@ dohash(char cachearray[])
 				continue;
 			if (dp->d_name[0] == '.' &&
 			    (dp->d_name[1] == '\0' ||
-			     dp->d_name[1] == '.' && dp->d_name[2] == '\0'))
+			    dp->d_name[1] == '.' && dp->d_name[2] == '\0'))
 				continue;
-			hashval = hash(hashname(strtots(curdir_,dp->d_name)), i);
+			hashval = hash(hashname(strtots(curdir_, dp->d_name)), i);
 			bis(cachearray, hashval);
 		}
 		unsetfd(dirp->dd_fd);
@@ -466,5 +466,5 @@ hashname(tchar *cp)
 #endif
 	while (*cp)
 		h = hash(h, *cp++);
-	return ((int) h);
+	return ((int)h);
 }
diff --git a/usr/src/cmd/csh/sh.exp.c b/usr/src/cmd/csh/sh.exp.c
index 9faffc568c..12eae9e96b 100644
--- a/usr/src/cmd/csh/sh.exp.c
+++ b/usr/src/cmd/csh/sh.exp.c
@@ -21,8 +21,8 @@
  * C shell
  */
 
-#define IGNORE	1	/* in ignore, it means to ignore value, just parse */
-#define NOGLOB	2	/* in ignore, it means not to globone */
+#define	IGNORE	1	/* in ignore, it means to ignore value, just parse */
+#define	NOGLOB	2	/* in ignore, it means not to globone */
 
 #define	ADDOP	1
 #define	MULOP	2
@@ -35,8 +35,8 @@
 #define	GTR	2
 #define	LSS	4
 #define	NOTEQ	6
-#define EQMATCH 7
-#define NOTEQMATCH 8
+#define	EQMATCH 7
+#define	NOTEQMATCH 8
 
 int	exp0(tchar ***, bool);
 int	exp1(tchar ***, bool);
@@ -64,36 +64,36 @@ void	evalav(tchar **);
 
 int
 chk_access(tchar *path, mode_t mode)
-{	
+{
 	static int flag;
-	static uid_t euid; 
+	static uid_t euid;
 	struct stat statb;
 	mode_t ftype;
 	unsigned char name[MAXPATHLEN*MB_LEN_MAX]; /* General use buffer. */
 
 	/* convert tchar * to char * */
 	tstostr(name, path);
-	
-	if(flag == 0) {
+
+	if (flag == 0) {
 		euid = geteuid();
 		flag = 1;
 	}
 	if (stat((char *)name, &statb) == 0) {
 		ftype = statb.st_mode & S_IFMT;
-		if(access((char *)name, 010|(mode>>6)) == 0) {
-			if(euid == 0) {
+		if (access((char *)name, 010|(mode>>6)) == 0) {
+			if (euid == 0) {
 				if (ftype != S_IFREG || mode != S_IEXEC)
-					return(0);
-		    		/* root can execute file as long as it has execute 
-			   	permission for someone */
+					return (0);
+				/* root can execute file as long as it has execute
+				permission for someone */
 				if (statb.st_mode & (S_IEXEC|(S_IEXEC>>3)|(S_IEXEC>>6)))
-					return(0);
-				return(-1);
+					return (0);
+				return (-1);
 			}
-			return(0);
+			return (0);
 		}
 	}
-	return(-1);
+	return (-1);
 }
 
 int
@@ -113,11 +113,11 @@ exp0(tchar ***vp, bool ignore)
 #ifdef TRACE
 	tprintf("TRACE- exp0()\n");
 #endif
-	
+
 #ifdef EDEBUG
 	etraci("exp0 p1", p1, vp);
 #endif
-	if (**vp && eq(**vp, S_BARBAR /*"||"*/)) {
+	if (**vp && eq(**vp, S_BARBAR /* "||" */)) {
 		int p2;
 
 		(*vp)++;
@@ -141,7 +141,7 @@ exp1(tchar ***vp, bool ignore)
 #ifdef EDEBUG
 	etraci("exp1 p1", p1, vp);
 #endif
-	if (**vp && eq(**vp, S_ANDAND /*"&&" */)) {
+	if (**vp && eq(**vp, S_ANDAND /* "&&" */)) {
 		int p2;
 
 		(*vp)++;
@@ -165,7 +165,7 @@ exp2(tchar ***vp, bool ignore)
 #ifdef EDEBUG
 	etraci("exp3 p1", p1, vp);
 #endif
-	if (**vp && eq(**vp, S_BAR /*"|" */)) {
+	if (**vp && eq(**vp, S_BAR /* "|" */)) {
 		int p2;
 
 		(*vp)++;
@@ -189,7 +189,7 @@ exp2a(tchar ***vp, bool ignore)
 #ifdef EDEBUG
 	etraci("exp2a p1", p1, vp);
 #endif
-	if (**vp && eq(**vp, S_HAT /*"^" */)) {
+	if (**vp && eq(**vp, S_HAT /* "^" */)) {
 		int p2;
 
 		(*vp)++;
@@ -213,8 +213,8 @@ exp2b(tchar ***vp, bool ignore)
 #ifdef EDEBUG
 	etraci("exp2b p1", p1, vp);
 #endif
-	if (**vp && eq(**vp, S_AND /*"&"*/)) {
-		 int p2;
+	if (**vp && eq(**vp, S_AND /* "&" */)) {
+		int p2;
 
 		(*vp)++;
 		p2 = exp2b(vp, ignore);
@@ -288,7 +288,7 @@ exp3(tchar ***vp, bool ignore)
 #endif
 	if (i = isa(**vp, RELOP)) {
 		(*vp)++;
-		if (**vp && eq(**vp, S_EQ /*"=" */))
+		if (**vp && eq(**vp, S_EQ /* "=" */))
 			i |= 1, (*vp)++;
 		p2 = exp3(vp, ignore);
 #ifdef EDEBUG
@@ -452,7 +452,7 @@ exp6(tchar ***vp, bool ignore)
 		xfree(cp);
 		return (putn(!i));
 	}
-	if (eq(**vp, S_TIL /*"~" */)) {
+	if (eq(**vp, S_TIL /* "~" */)) {
 		(*vp)++;
 		cp = exp6(vp, ignore);
 #ifdef EDEBUG
@@ -462,7 +462,7 @@ exp6(tchar ***vp, bool ignore)
 		xfree(cp);
 		return (putn(~i));
 	}
-	if (eq(**vp, S_LPAR /*"(" */)) {
+	if (eq(**vp, S_LPAR /* "(" */)) {
 		(*vp)++;
 		ccode = exp0(vp, ignore);
 #ifdef EDEBUG
@@ -482,18 +482,18 @@ exp6(tchar ***vp, bool ignore)
 		faket.t_dflg = 0;
 		faket.t_dcar = faket.t_dcdr = faket.t_dspr = (struct command *)0;
 		faket.t_dcom = fakecom;
-		fakecom[0] = S_BRAPPPBRA /*"{ ... }" */;
+		fakecom[0] = S_BRAPPPBRA /* "{ ... }" */;
 		fakecom[1] = NOSTR;
 		(*vp)++;
 		v = *vp;
 		for (;;) {
 			if (!**vp)
 				bferr("Missing }");
-			if (eq(*(*vp)++, S_RBRA /*"}" */))
+			if (eq(*(*vp)++, S_RBRA /* "}" */))
 				break;
 		}
 		if (ignore&IGNORE)
-			return (S_ /*""*/);
+			return (S_ /* "" */);
 		psavejob();
 		if (pfork(&faket, -1) == 0) {
 			*--(*vp) = 0;
@@ -505,12 +505,12 @@ exp6(tchar ***vp, bool ignore)
 #ifdef EDEBUG
 		etraci("exp6 {} status", egetn(value("status")), vp);
 #endif
-		return (putn(egetn(value(S_status /*"status" */)) == 0));
+		return (putn(egetn(value(S_status /* "status" */)) == 0));
 	}
 	if (isa(**vp, ANYOP))
-		return (S_ /*""*/);
+		return (S_ /* "" */);
 	cp = *(*vp)++;
-	if (*cp == '-' && any(cp[1], S_erwxfdzo /*"erwxfdzo" */)) {
+	if (*cp == '-' && any(cp[1], S_erwxfdzo /* "erwxfdzo" */)) {
 		struct stat stb;
 
 		if (cp[2] != '\0')
@@ -529,7 +529,7 @@ exp6(tchar ***vp, bool ignore)
 		dp = *(*vp)++;
 
 		if (ignore&IGNORE)
-			return (S_ /*""*/);
+			return (S_ /* "" */);
 		ep = globone(dp);
 		switch (cp[1]) {
 
@@ -548,7 +548,7 @@ exp6(tchar ***vp, bool ignore)
 		default:
 			if (stat_(ep, &stb)) {
 				xfree(ep);
-				return (S_0 /*"0"*/);
+				return (S_0 /* "0" */);
 			}
 			switch (cp[1]) {
 
@@ -592,15 +592,15 @@ evalav(tchar **v)
 	struct wordent *hp = &paraml;
 	struct command *t;
 	struct wordent *wdp = hp;
-	
+
 #ifdef TRACE
 	tprintf("TRACE- evalav()\n");
 #endif
-	set(S_status /*"status" */, S_0 /*"0"*/);
+	set(S_status /* "status" */, S_0 /* "0" */);
 	hp->prev = hp->next = hp;
-	hp->word = S_ /*""*/;
+	hp->word = S_ /* "" */;
 	while (*v) {
-		struct wordent *new = (struct wordent *) calloc(1, sizeof *wdp);
+		struct wordent *new = (struct wordent *)xcalloc(1, sizeof *wdp);
 
 		new->prev = wdp;
 		new->next = hp;
@@ -632,7 +632,7 @@ isa(tchar *cp, int what)
 		if (what & MULOP && (*cp == '*' || *cp == '/' || *cp == '%'))
 			return (1);
 		if (what & RESTOP && (*cp == '(' || *cp == ')' || *cp == '!' ||
-				      *cp == '~' || *cp == '^' || *cp == '"'))
+					*cp == '~' || *cp == '^' || *cp == '"'))
 			return (1);
 	} else if (cp[2] == 0) {
 		if (what & RESTOP) {
diff --git a/usr/src/cmd/csh/sh.file.c b/usr/src/cmd/csh/sh.file.c
index 159ea65faa..e3c03756bb 100644
--- a/usr/src/cmd/csh/sh.file.c
+++ b/usr/src/cmd/csh/sh.file.c
@@ -28,12 +28,12 @@
 #include <pwd.h>
 #include "sh.tconst.h"
 
-#define TRUE	1
-#define FALSE	0
-#define ON	1
-#define OFF	0
+#define	TRUE	1
+#define	FALSE	0
+#define	ON	1
+#define	OFF	0
 
-#define ESC	'\033'
+#define	ESC	'\033'
 
 extern DIR *opendir_(tchar *);
 
@@ -156,7 +156,7 @@ pushback(tchar *string, int echoflag)
 {
 	tchar *p;
 	struct termios tty;
-	int omask;
+	int omask, retry = 0;
 
 #ifdef TRACE
 	tprintf("TRACE- pushback()\n");
@@ -165,19 +165,25 @@ pushback(tchar *string, int echoflag)
 	tty = tty_new;
 	if (!echoflag)
 		tty.c_lflag &= ~ECHO;
+
+again:
 	(void) ioctl(SHIN, TCSETSF, (char *)&tty);
 
-	for (p = string; *p; p++){
+	for (p = string; *p; p++) {
 		char	mbc[MB_LEN_MAX];
 		int	i, j = wctomb(mbc, (wchar_t)*p);
-		
+
 		if (j < 0) {
 			/* Error! But else what can we do? */
 			continue;
 		}
 		for (i = 0; i < j; ++i) {
-			/* XXX: no error recovery provision. */
-			(void) ioctl(SHIN, TIOCSTI, mbc + i);
+			if (ioctl(SHIN, TIOCSTI, mbc + i) != 0 &&
+			    errno == EAGAIN) {
+				if (retry++ < 5)
+					goto again;
+				/* probably no worth retrying any more */
+			}
 		}
 	}
 
@@ -342,9 +348,9 @@ tilde(tchar *new, tchar *old)
 		;
 	*p = '\0';
 	if (person[0] == '\0')
-		(void) strcpy_(new, value(S_home /*"home"*/));
+		(void) strcpy_(new, value(S_home /* "home" */));
 	else {
-		pw = getpwnam(tstostr(person_,person));
+		pw = getpwnam(tstostr(person_, person));
 		if (pw == NULL)
 			return (NULL);
 		pw_dir = strtots((tchar *)NULL, pw->pw_dir);	/* allocate */
@@ -363,7 +369,7 @@ sim_retype(void)
 {
 #ifdef notdef
 	struct termios tty_pending;
-	
+
 #ifdef TRACE
 	tprintf("TRACE- sim_retypr()\n");
 #endif
@@ -387,7 +393,7 @@ beep_outc(int c)
 
 	buf[0] = c;
 
-	(void) write (SHOUT, buf, 1);
+	(void) write(SHOUT, buf, 1);
 
 	return 0;
 }
@@ -399,8 +405,8 @@ beep(void)
 #ifdef TRACE
 	tprintf("TRACE- beep()\n");
 #endif
-	if (adrof(S_nobeep /*"nobeep" */) == 0)
-		(void) tputs (BELL, 0, beep_outc);
+	if (adrof(S_nobeep /* "nobeep" */) == 0)
+		(void) tputs(BELL, 0, beep_outc);
 }
 
 /*
@@ -422,7 +428,7 @@ print_recognized_stuff(tchar *recognized_part)
 	 * isn't necessary, but it turns out that the visual difference is
 	 * quite noticeable.
 	 */
-	flush();	
+	flush();
 	switch (tswidth(recognized_part)) {
 	case 0:
 		/* erase two characters: ^[ */
@@ -481,12 +487,12 @@ getentry(DIR *dir_fd, int looking_for_lognames)
 	tprintf("TRACE- getentry()\n");
 #endif
 	if (looking_for_lognames) {
-		if ((pw = getpwent ()) == NULL)
+		if ((pw = getpwent()) == NULL)
 			return (NULL);
-		return (strtots(strbuf,pw->pw_name));
+		return (strtots(strbuf, pw->pw_name));
 	}
 	if (dirp = readdir(dir_fd))
-		return (strtots(strbuf,dirp->d_name));
+		return (strtots(strbuf, dirp->d_name));
 	return (NULL);
 }
 
@@ -499,11 +505,11 @@ free_items(tchar **items)
 	tprintf("TRACE- free_items()\n");
 #endif
 	for (i = 0; items[i]; i++)
-		free(items[i]);
-	free( (char *)items);
+		xfree(items[i]);
+	xfree((char *)items);
 }
 
-#define FREE_ITEMS(items) { \
+#define	FREE_ITEMS(items) { \
 	int omask;\
 \
 	omask = sigblock(sigmask(SIGINT));\
@@ -525,7 +531,7 @@ search2(tchar *word, COMMAND command, int max_word_length)
 	tchar tilded_dir[MAXPATHLEN + 1], dir[MAXPATHLEN + 1];
 	tchar name[MAXNAMLEN + 1], extended_name[MAXNAMLEN+1];
 	tchar *entry;
-#define MAXITEMS 1024
+#define	MAXITEMS 1024
 #ifdef TRACE
 	tprintf("TRACE- search2()\n");
 #endif
@@ -541,7 +547,7 @@ search2(tchar *word, COMMAND command, int max_word_length)
 		extract_dir_and_name(word, dir, name);
 		if (tilde(tilded_dir, dir) == 0)
 			return (0);
-		dir_fd = opendir_(*tilded_dir ? tilded_dir : S_DOT /*"."*/);
+		dir_fd = opendir_(*tilded_dir ? tilded_dir : S_DOT /* "." */);
 		if (dir_fd == NULL)
 			return (0);
 	}
@@ -557,15 +563,15 @@ again:	/* search for matches */
 			continue;
 		if (command == LIST) {
 			if (numitems >= MAXITEMS) {
-				printf ("\nYikes!! Too many %s!!\n",
+				printf("\nYikes!! Too many %s!!\n",
 				    looking_for_lognames ?
 					"names in password file":"files");
 				break;
 			}
 			if (items == NULL)
-				items =  (tchar **) calloc(sizeof (items[1]),
+				items =  (tchar **)xcalloc(sizeof (items[1]),
 				    MAXITEMS+1);
-			items[numitems] = (tchar *)xalloc((unsigned)(strlen_(entry) + 1)*sizeof(tchar));
+			items[numitems] = (tchar *)xalloc((unsigned)(strlen_(entry) + 1) * sizeof (tchar));
 			copyn(items[numitems], entry, MAXNAMLEN);
 			numitems++;
 		} else {			/* RECOGNIZE command */
@@ -580,7 +586,7 @@ again:	/* search for matches */
 		ignoring = FALSE;
 		nignored = 0;
 		if (looking_for_lognames)
-			(void)setpwent();
+			(void) setpwent();
 		else
 			rewinddir(dir_fd);
 		goto again;
@@ -594,7 +600,7 @@ again:	/* search for matches */
 	}
 	if (command == RECOGNIZE && numitems > 0) {
 		if (looking_for_lognames)
-			 copyn(word, S_TIL /*"~" */, 1);
+			copyn(word, S_TIL /* "~" */, 1);
 		else
 			/* put back dir part */
 			copyn(word, dir, max_word_length);
@@ -603,8 +609,8 @@ again:	/* search for matches */
 		return (numitems);
 	}
 	if (command == LIST) {
-		qsort( (char *)items, numitems, sizeof(items[1]), 
-		      (int (*)(const void *, const void *))fcompare);
+		qsort((char *)items, numitems, sizeof (items[1]),
+		    (int (*)(const void *, const void *))fcompare);
 		/*
 		 * Never looking for commands in this version, so final
 		 * argument forced to 0.  If command name completion is
@@ -621,7 +627,7 @@ again:	/* search for matches */
 /*
  * Object: extend what user typed up to an ambiguity.
  * Algorithm:
- * On first match, copy full entry (assume it'll be the only match) 
+ * On first match, copy full entry (assume it'll be the only match)
  * On subsequent matches, shorten extended_name to the first
  * character mismatch between extended_name and entry.
  * If we shorten it back to the prefix length, stop searching.
@@ -680,9 +686,9 @@ is_suffix(tchar *check, tchar *template)
 #ifdef TRACE
 	tprintf("TRACE- is_suffix()\n");
 #endif
-	for (c = check; *c++;)
+	for (c = check; *c++; )
 		;
-	for (t = template; *t++;)
+	for (t = template; *t++; )
 		;
 	for (;;) {
 		if (t == template)
@@ -707,7 +713,7 @@ tenex(tchar *inputline, int inputline_size)
 	should_retype = FALSE;
 	while ((i = read_(SHIN, inputline+num_read, inputline_size-num_read))
 	    > 0) {
-		static tchar *delims = S_DELIM /*" '\"\t;&<>()|`"*/;
+		static tchar *delims = S_DELIM /* " '\"\t;&<>()|`" */;
 		tchar *str_end, *word_start, last_char;
 		int space_left;
 		struct termios tty;
@@ -717,7 +723,11 @@ tenex(tchar *inputline, int inputline_size)
 		inputline[num_read] = '\0';
 		last_char = inputline[num_read - 1] & TRIM;
 
-		if ((num_read == inputline_size) || (last_char == '\n'))
+		/*
+		 * read_() can return more than requested size if there
+		 * is multibyte character at the end.
+		 */
+		if ((num_read >= inputline_size) || (last_char == '\n'))
 			break;
 
 		str_end = &inputline[num_read];
@@ -794,7 +804,7 @@ ignored(tchar *entry)
 #ifdef TRACE
 	tprintf("TRACE- ignored()\n");
 #endif
-	if ((vp = adrof(S_fignore /*"fignore"*/)) == NULL ||
+	if ((vp = adrof(S_fignore /* "fignore" */)) == NULL ||
 	    (cp = vp->vec) == NULL)
 		return (FALSE);
 	for (; *cp != NULL; cp++)
diff --git a/usr/src/cmd/csh/sh.func.c b/usr/src/cmd/csh/sh.func.c
index 57db65037b..3796f9e4df 100644
--- a/usr/src/cmd/csh/sh.func.c
+++ b/usr/src/cmd/csh/sh.func.c
@@ -522,7 +522,7 @@ doforeach(tchar **v)
 	if (v == 0) {
 		bferr("No match");
 	}
-	nwp = (struct whyle *)calloc(1, sizeof (*nwp));
+	nwp = (struct whyle *)xcalloc(1, sizeof (*nwp));
 	nwp->w_fe = nwp->w_fe0 = v; gargv = 0;
 	nwp->w_start = btell();
 	nwp->w_fename = savestr(cp);
@@ -563,7 +563,7 @@ dowhile(tchar **v)
 		bferr("Expression syntax");
 	}
 	if (!again) {
-		struct whyle *nwp = (struct whyle *)calloc(1, sizeof (*nwp));
+		struct whyle *nwp = (struct whyle *)xcalloc(1, sizeof (*nwp));
 
 		nwp->w_start = lineloc;
 		nwp->w_end = 0;
diff --git a/usr/src/cmd/csh/sh.glob.c b/usr/src/cmd/csh/sh.glob.c
index df7b2adec8..a45e21f936 100644
--- a/usr/src/cmd/csh/sh.glob.c
+++ b/usr/src/cmd/csh/sh.glob.c
@@ -115,7 +115,7 @@ collect(tchar *as)
 		 * dobackp has the side effect of messing with
 		 * gflag, since it does more globbing, so check
 		 * if the results is still globbable
-		*/
+		 */
 		tglob(pargv);
 
 		for (i = 0; i < pargc; i++)
@@ -239,7 +239,7 @@ matchdir_(tchar *pattern)
 #endif
 	/*
 	 * BSD's opendir would open "." if argument is NULL, but not S5
- */
+	 */
 
 	if (*gpath == NULL)
 		dirp = opendir_(S_DOT /* "." */);
@@ -422,7 +422,7 @@ amatch(tchar *s, tchar *p, int *slproc)
 					if (sh_bracket_exp(scc, lc, rc))
 						ok++;
 #else /* !MBCHAR */
-					if (lc <= scc && scc <= (int) *p++)
+					if (lc <= scc && scc <= (int)*p++)
 						ok++;
 #endif /* !MBCHAR */
 				} else
@@ -523,7 +523,7 @@ Gmatch(tchar *s, tchar *p)
 					if (sh_bracket_exp(scc, lc, rc))
 						ok++;
 #else /* !MBCHAR */
-					if (lc <= scc && scc <= (int) *p++)
+					if (lc <= scc && scc <= (int)*p++)
 						ok++;
 #endif /* !MBCHAR */
 				} else
@@ -671,12 +671,12 @@ globone(tchar *str)
 			bferr("Ambiguous");
 		} else
 			cp = strip(cp);
-/*
+#if 0
 		if (cp == 0 || *gvp) {
 			setname(str);
 			bferr(cp ? "Ambiguous" : "No output");
 		}
-*/
+#endif
 		xfree((char *)gargv); gargv = 0;
 	} else {
 		trim(gv);
@@ -746,7 +746,7 @@ backeval(tchar *cp, bool literal)
 {
 	int pvec[2];
 	int quoted = (literal || (cp[0] & QUOTE)) ? QUOTE : 0;
-	tchar ibuf[BUFSIZ];
+	tchar ibuf[BUFSIZ + MB_LEN_MAX]; /* read_ can return extra bytes */
 	int icnt = 0, c;
 	tchar *ip;
 	bool hadnl = 0;
@@ -951,25 +951,25 @@ sh_bracket_exp(tchar t_ch, tchar t_fch, tchar t_lch)
 	int	i;
 
 	if ((t_ch == t_fch) || (t_ch == t_lch))
-		return(1);
-		
+		return (1);
+
 	p = t_patan;
 	if ((i = wctomb(t_char, (wchar_t)t_ch)) <= 0)
-		return(0);
+		return (0);
 	t_char[i] = 0;
 
 	*p++ = '[';
 	if ((i = wctomb(p, (wchar_t)t_fch)) <= 0)
-		return(0);
+		return (0);
 	p += i;
 	*p++ = '-';
 	if ((i = wctomb(p, (wchar_t)t_lch)) <= 0)
-		return(0);
+		return (0);
 	p += i;
 	*p++ = ']';
 	*p = 0;
 
 	if (fnmatch(t_patan, t_char, FNM_NOESCAPE))
-		return(0);
-	return(1);
+		return (0);
+	return (1);
 }
diff --git a/usr/src/cmd/csh/sh.h b/usr/src/cmd/csh/sh.h
index a8ba16c5ed..590f646834 100644
--- a/usr/src/cmd/csh/sh.h
+++ b/usr/src/cmd/csh/sh.h
@@ -38,24 +38,24 @@
 #define	MAXHOSTNAMELEN	64
 
 #ifdef MBCHAR
-# if !defined(MB_LEN_MAX) || !defined(MB_CUR_MAX)
+#if !defined(MB_LEN_MAX) || !defined(MB_CUR_MAX)
 	Error: I need both ANSI macros!
-# endif
+#endif
 #else
-# if !defined(MB_LEN_MAX)
-#  define MB_LEN_MAX	1
-# endif
-# if !defined(MB_CUR_MAX)
-#  define MB_CUR_MAX	1
-# endif
+#if !defined(MB_LEN_MAX)
+#define	MB_LEN_MAX	1
+#endif
+#if !defined(MB_CUR_MAX)
+#define	MB_CUR_MAX	1
+#endif
 #endif
 
 #ifndef MBCHAR /* Let's replace the ANSI functions with our own macro
 		* for efficiency!
 		*/
-#define	mbtowc(pwc, pmb, n_is_ignored)	((*(pwc)=*(pmb)), 1)
-#define	wctomb(pmb, wc)			((*(pmb)=((char)wc)), 1)
-#endif/*!MBCHAR*/
+#define	mbtowc(pwc, pmb, n_is_ignored)	((*(pwc) = *(pmb)), 1)
+#define	wctomb(pmb, wc)			((*(pmb) = ((char)wc)), 1)
+#endif /* !MBCHAR */
 
 /*
  * C shell
@@ -67,11 +67,12 @@
  * April, 1980
  */
 
-/*If we are setting the $cwd variable becuz we did a
-  cd, chdir, pushd, popd command, then set didchdir to
-  1.  This prevents globbing down when setting $cwd.  
-  However, if the user set $cwd, we want the globbing
-  done; so, didchdir would be equal to 0 in that case.
+/*
+ * If we are setting the $cwd variable becuz we did a
+ * cd, chdir, pushd, popd command, then set didchdir to
+ * 1.  This prevents globbing down when setting $cwd.
+ * However, if the user set $cwd, we want the globbing
+ * done; so, didchdir would be equal to 0 in that case.
  */
 int didchdir;
 
@@ -79,26 +80,27 @@ int didchdir;
 
 typedef	char	bool;
 
-/* tchar (Tagged CHARacter) is a place holder to keep a QUOTE bit and 
+/*
+ * tchar (Tagged CHARacter) is a place holder to keep a QUOTE bit and
  * a character.
  * For European language handling, lower 8 bits of tchar is used
  * to store a character.  For other languages, especially Asian, 16 bits
  * are used to store a character.
  * Following typedef's assume short int is a 16-bit entity and long int is
  * a 32-bit entity.
- * The QUOTE bit tells whether the character is subject to further 
- * interpretation such as history substitution, file mathing, command 
+ * The QUOTE bit tells whether the character is subject to further
+ * interpretation such as history substitution, file mathing, command
  * subsitution.  TRIM is a mask to strip off the QUOTE bit.
  */
 #ifdef MBCHAR		/* For multibyte character handling. */
 typedef long int	tchar;
-#define QUOTE	0x80000000
+#define	QUOTE	0x80000000
 #define	TRIM	0x7fffffff
-#else/*!MBCHAR*/	/* European language requires only 8 bits. */
+#else /* !MBCHAR */	/* European language requires only 8 bits. */
 typedef unsigned short int	tchar;
 #define	QUOTE	0x8000
 #define	TRIM	0x00ff
-#endif/*!MBCHAR*/
+#endif /* !MBCHAR */
 #define	eq(a, b)	(strcmp_(a, b) == 0)
 
 
@@ -224,7 +226,7 @@ struct	Bin {
 #define	fblocks	B.Bfblocks
 #define	fbuf	B.Bfbuf
 
-#define btell()	fseekp
+#define	btell()	fseekp
 
 #ifndef btell
 off_t	btell(void);
@@ -375,24 +377,24 @@ struct	varent {
 	struct	varent *v_link[3];	/* The links, see below */
 	int	v_bal;		/* Balance factor */
 } shvhed, aliases;
-#define v_left		v_link[0]
-#define v_right		v_link[1]
-#define v_parent	v_link[2]
+#define	v_left		v_link[0]
+#define	v_right		v_link[1]
+#define	v_parent	v_link[2]
 
 struct varent *adrof1();
-#define adrof(v)	adrof1(v, &shvhed)
-#define value(v)	value1(v, &shvhed)
+#define	adrof(v)	adrof1(v, &shvhed)
+#define	value(v)	value1(v, &shvhed)
 
 /*
  * MAX_VAR_LEN - maximum variable name defined by csh man page to be 20
  */
-#define MAX_VAR_LEN           20
+#define	MAX_VAR_LEN	20
 
 /*
  * MAX_VREF_LEN - maximum variable reference $name[...]
  * it can be as big as a csh word, which is 1024
  */
-#define MAX_VREF_LEN  1024
+#define	MAX_VREF_LEN	1024
 
 
 /*
@@ -466,32 +468,11 @@ int	lastev;				/* Last event reference (default) */
 tchar	HIST;				/* history invocation character */
 tchar	HISTSUB;			/* auto-substitute character */
 
-/*
- * In lines for frequently called functions
- *
- * WARNING: changes here also need to occur in the xfree() function in
- *	    sh.misc.c.
- */
-#if defined(sparc)
-#define XFREE(cp) { \
-	extern char end[]; \
-	char stack; \
-/*??*/	if (((char *)(cp)) >= end && ((char *)(cp)) < &stack) \
-/*??*/		free((void *)(cp)); \
-}
-#elif defined(i386)	
-#define XFREE(cp) { \
-	extern char end[]; \
-	if (((char *)(cp)) >= end) \
-		free((void *)(cp)); \
-}
-#else
-#error XFREE macro is machine dependant and no machine type is recognized
-#endif
-void	*alloctmp;
-#define xalloc(i) ((alloctmp = (void *)malloc(i)) ? alloctmp : (void *)nomem(i))/*??*/
-#define	xrealloc(buf, i) ((alloctmp = (void *)realloc(buf, i)) ? alloctmp : \
-				(void *)nomem(i))
+extern void	*xalloc(size_t);
+extern void	*xcalloc(size_t, size_t);
+extern void	*xrealloc(void *, size_t);
+extern void	xfree(void *);
+
 extern void	Putchar(tchar);
 extern void	bferr(char *)	__NORETURN;
 extern void	error()	__NORETURN;
@@ -571,9 +552,9 @@ char	*tstostr(/* char *  , tchar * */);
  * times (once for each path component checked).
  * Byte size is assumed to be 8.
  */
-#define HSHSIZ          (32*1024)       /* 4k bytes */
-#define HSHMASK         (HSHSIZ - 1)
-#define HSHMUL          243
+#define	HSHSIZ		(32*1024)	/* 4k bytes */
+#define	HSHMASK		(HSHSIZ - 1)
+#define	HSHMUL		243
 
 /*
  * The following two arrays are used for caching.  xhash
@@ -583,11 +564,9 @@ char	*tstostr(/* char *  , tchar * */);
 
 char xhash[HSHSIZ / 8];
 char xhash2[HSHSIZ / 8];
-#define hash(a, b)      ((a) * HSHMUL + (b) & HSHMASK)
-#define bit(h, b)       ((h)[(b) >> 3] & 1 << ((b) & 7))        /* bit test */
-#define bis(h, b)       ((h)[(b) >> 3] |= 1 << ((b) & 7))       /* bit set */
+#define	hash(a, b)	((a) * HSHMUL + (b) & HSHMASK)
+#define	bit(h, b)	((h)[(b) >> 3] & 1 << ((b) & 7))	/* bit test */
+#define	bis(h, b)	((h)[(b) >> 3] |= 1 << ((b) & 7))	/* bit set */
 #ifdef VFORK
-int     hits, misses;
+int	hits, misses;
 #endif
-
-
diff --git a/usr/src/cmd/csh/sh.lex.c b/usr/src/cmd/csh/sh.lex.c
index 322baff951..3998ad9a51 100644
--- a/usr/src/cmd/csh/sh.lex.c
+++ b/usr/src/cmd/csh/sh.lex.c
@@ -19,7 +19,7 @@
 #include "sh.tconst.h"
 #include <sys/filio.h>
 #include <sys/ttold.h>
-#define RAW 	O_RAW
+#define	RAW 	O_RAW
 /*
  * C shell
  */
@@ -80,7 +80,7 @@ tchar *alvecp;		/* "Globp" for alias resubstitution */
 bool	hadhist;
 
 tchar getCtmp;
-#define getC(f)		((getCtmp = peekc) ? (peekc = 0, getCtmp) : getC1(f))
+#define	getC(f)		((getCtmp = peekc) ? (peekc = 0, getCtmp) : getC1(f))
 #define	ungetC(c)	peekc = c
 #define	ungetD(c)	peekd = c
 
@@ -95,7 +95,7 @@ lex(struct wordent *hp)
 #endif
 	lineloc = btell();
 	hp->next = hp->prev = hp;
-	hp->word = S_ /*""*/;
+	hp->word = S_ /* "" */;
 	alvecp = 0, hadhist = 0;
 	do
 		c = readc(0);
@@ -113,7 +113,7 @@ lex(struct wordent *hp)
 	 * interrupted.
 	 */
 	do {
-		struct wordent *new = (struct wordent *) xalloc(sizeof *wdp);
+		struct wordent *new = (struct wordent *)xalloc(sizeof *wdp);
 
 		new->word = 0;
 		new->prev = wdp;
@@ -158,7 +158,7 @@ copylex(struct wordent *hp, struct wordent *fp)
 	wdp = hp;
 	fp = fp->next;
 	do {
-		struct wordent *new = (struct wordent *) xalloc(sizeof *wdp);
+		struct wordent *new = (struct wordent *)xalloc(sizeof *wdp);
 
 		new->prev = wdp;
 		new->next = hp;
@@ -181,8 +181,8 @@ freelex(struct wordent *vp)
 	while (vp->next != vp) {
 		fp = vp->next;
 		vp->next = fp->next;
-		XFREE(fp->word)
-		XFREE( (char *)fp)
+		xfree(fp->word);
+		xfree(fp);
 	}
 	vp->prev = vp;
 }
@@ -261,11 +261,11 @@ loop:
 					c |= QUOTE;
 				else {
 					if (c == '\n')
-						/*
+#if 0
 						if (c1 == '`')
 							c = ' ';
 						else
-						*/
+#endif
 							c |= QUOTE;
 					ungetC(c);
 					c = '\\';
@@ -326,9 +326,9 @@ top:
 			lap = 0;
 		else {
 			/*
-			 *	don't quote things if there was an error (err!=0)
-			 * 	the input is original, not from a substitution and
-			 *	therefore should not be quoted
+			 * don't quote things if there was an error (err!=0)
+			 * the input is original, not from a substitution and
+			 * therefore should not be quoted
 			 */
 			if (!err && cmap(c, _META|_Q|_Q1)||isauxsp(c))
 				c |= QUOTE;
@@ -395,7 +395,7 @@ getdol(void)
 		special++, *np++ = c, c = getC(DOEXCL);
 	*np++ = c;
 	switch (c) {
-	
+
 	case '<':
 	case '$':
 	case '*':
@@ -412,19 +412,19 @@ getdol(void)
 		p = np;
 		if (digit(c)) {
 			/* make sure the variable names are MAX_VAR_LEN chars or less */
-			while (digit(c = getC(DOEXCL)) && (np-p) < MAX_VAR_LEN) {
+			while (digit(c = getC(DOEXCL)) && (np - p) < MAX_VAR_LEN) {
 				*np++ = c;
 			}
 		} else if (letter(c)) {
 			while ((letter(c = getC(DOEXCL)) || digit(c)) &&
-				(np-p) < MAX_VAR_LEN ) {
+				(np - p) < MAX_VAR_LEN) {
 				*np++ = c;
 			}
 		}
 		else
 			goto vsyn;
 
-		if( (np - p) > MAX_VAR_LEN )
+		if ((np - p) > MAX_VAR_LEN)
 		{
 			seterr("Variable name too long");
 			goto ret;
@@ -497,7 +497,7 @@ addla(tchar *cp)
 	(void) strcpy_(labuf, cp);
 	if (lap) {
 		(void) strcat_(labuf, buf);
-		free(buf);
+		xfree(buf);
 	}
 	lap = labuf;
 }
@@ -543,9 +543,9 @@ getexcl(tchar sc)
 		goto subst;
 	}
 	c = getC(0);
-	/* if (!any(c, ":^$*-%")) */		/* change needed for char -> tchar */
+	/* if (!any(c, ":^$*-%")) */	/* change needed for char -> tchar */
 	if (! (c == ':' || c == '^' || c == '$' || c == '*' ||
-	       c == '-' || c == '%' ))
+	    c == '-' || c == '%'))
 		goto subst;
 	left = right = -1;
 	if (c == ':') {
@@ -629,16 +629,16 @@ getsub(struct wordent *en)
 		(void) strcpy_(lhsb, slhs);
 		break;
 
-/*
+#if 0
 	case '~':
 		if (lhsb[0] == 0)
 			goto badlhs;
 		break;
-*/
+#endif
 
 	case 's':
 		delim = getC(0);
-		if (alnum(delim) || isspnl(delim)){
+		if (alnum(delim) || isspnl(delim)) {
 			unreadc(delim);
 bads:
 			lhsb[0] = 0;
@@ -666,7 +666,7 @@ bads:
 		if (cp != lhsb)
 			*cp++ = 0;
 		else if (lhsb[0] == 0) {
-/*badlhs:*/
+/* badlhs: */
 			seterr("No prev lhs");
 			goto ret;
 		}
@@ -680,18 +680,18 @@ bads:
 			}
 			if (c == delim)
 				break;
-/*
+#if 0
 			if (c == '~') {
-				if (&cp[strlen_(orhsb)] 
+				if (&cp[strlen_(orhsb)]
 				> &rhsb[(sizeof rhsb)/(sizeof rhsb[0]) - 2])
 					goto toorhs;
 				(void) strcpy_(cp, orhsb);
 				cp = strend(cp);
 				continue;
 			}
-*/
+#endif
 			if (cp > &rhsb[(sizeof rhsb)/(sizeof rhsb[0]) - 2]) {
-/*toorhs:*/
+/* toorhs: */
 				seterr("Rhs too long");
 				goto ret;
 			}
@@ -732,7 +732,7 @@ dosub(int sc, struct wordent *en, bool global)
 #endif
 	wdp = hp;
 	while (--i >= 0) {
-		struct wordent *new = (struct wordent *) calloc(1, sizeof *wdp);
+		struct wordent *new = (struct wordent *)xcalloc(1, sizeof *wdp);
 
 		new->prev = wdp;
 		new->next = hp;
@@ -777,7 +777,7 @@ subword(tchar *cp, int type, bool *adid)
 		i = BUFSIZ - 4;
 		for (mp = cp; *mp; mp++)
 			if (matchs(mp, lhsb)) {
-				for (np = cp; np < mp;)
+				for (np = cp; np < mp; )
 					*wp++ = *np++, --i;
 				for (np = rhsb; *np; np++) switch (*np) {
 
@@ -806,7 +806,7 @@ subword(tchar *cp, int type, bool *adid)
 				if (i < 0) {
 ovflo:
 					seterr("Subst buf ovflo");
-					return (S_ /*""*/);
+					return (S_ /* "" */);
 				}
 				*wp = 0;
 				(void) strcat_(wp, mp);
@@ -860,7 +860,7 @@ domod(tchar *cp, int type)
 					xp = savestr(cp), xp[wp - cp] = 0;
 				return (xp);
 			}
-		return (savestr(type == 'e' ? S_ /*""*/ : cp));
+		return (savestr(type == 'e' ? S_ /* "" */ : cp));
 	}
 	return (0);
 }
@@ -1002,10 +1002,10 @@ gethent(int sc)
 		goto number;
 
 	case '#':			/* !# is command being typed in (mrh) */
-		return(&paraml);
+		return (&paraml);
 
 	default:
-		/*if (any(c, "(=~")) {*/
+		/* if (any(c, "(=~")) { */
 		if (c == '(' || c == '=' || c == '~') {
 			unreadc(c);
 			ungetC(HIST);
@@ -1229,19 +1229,19 @@ reread:
 				if (++sincereal > 25)
 					goto oops;
 				if (tpgrp != -1 &&
-				    ioctl(FSHTTY, TIOCGPGRP,  (char *)&ctpgrp) == 0 &&
+				    ioctl(FSHTTY, TIOCGPGRP, (char *)&ctpgrp) == 0 &&
 				    tpgrp != ctpgrp) {
 					(void) ioctl(FSHTTY, TIOCSPGRP,
-						 (char *)&tpgrp);
+						(char *)&tpgrp);
 					(void) killpg(ctpgrp, SIGHUP);
 printf("Reset tty pgrp from %d to %d\n", ctpgrp, tpgrp);
 					goto reread;
 				}
-				if (adrof(S_ignoreeof/*"ignoreeof"*/)) {
+				if (adrof(S_ignoreeof /* "ignoreeof" */)) {
 					if (loginsh)
-						printf("\nUse \"logout\" to logout.\n");
+				printf("\nUse \"logout\" to logout.\n");
 					else
-						printf("\nUse \"exit\" to leave csh.\n");
+				printf("\nUse \"exit\" to leave csh.\n");
 					reset();
 				}
 				if (chkstop == 0) {
@@ -1259,13 +1259,29 @@ oops:
 	return (c);
 }
 
+static void
+expand_fbuf(void)
+{
+	tchar **nfbuf =
+	    (tchar **)xcalloc((unsigned)(fblocks + 2), sizeof (tchar **));
+
+	if (fbuf) {
+		(void) blkcpy(nfbuf, fbuf);
+		xfree((char *)fbuf);
+	}
+	fbuf = nfbuf;
+	fbuf[fblocks] = (tchar *)xcalloc(BUFSIZ + MB_LEN_MAX,
+		sizeof (tchar));
+	fblocks++;
+}
+
 int
 bgetc(void)
 {
 	int buf, off, c;
 #ifdef FILEC
-	tchar ttyline[BUFSIZ];
-	int numleft = 0, roomleft;
+	tchar ttyline[BUFSIZ + MB_LEN_MAX]; /* read_() can return extra bytes */
+	int roomleft;
 #endif
 
 #ifdef TELL
@@ -1289,24 +1305,14 @@ bgetc(void)
 	}
 #endif
 again:
-	buf = (int) fseekp / BUFSIZ;
+	buf = (int)fseekp / BUFSIZ;
 	if (buf >= fblocks) {
-		tchar **nfbuf =
-			 (tchar **) calloc((unsigned) (fblocks + 2),
-				sizeof  (tchar **));
-
-		if (fbuf) {
-			(void) blkcpy(nfbuf, fbuf);
-			xfree( (char *)fbuf);
-		}
-		fbuf = nfbuf;
-		fbuf[fblocks] = (tchar *)calloc(BUFSIZ, sizeof (tchar));
-		fblocks++;
+		expand_fbuf();
 		goto again;
 	}
 	if (fseekp >= feobp) {
-		buf = (int) feobp / BUFSIZ;
-		off = (int) feobp % BUFSIZ;
+		buf = (int)feobp / BUFSIZ;
+		off = (int)feobp % BUFSIZ;
 #ifndef FILEC
 		for (;;) {
 			c = read_(SHIN, fbuf[buf] + off, BUFSIZ - off);
@@ -1314,18 +1320,26 @@ again:
 		roomleft = BUFSIZ - off;
 		for (;;) {
 			if (filec && intty) {
-				c = numleft ? numleft : tenex(ttyline, BUFSIZ);
+				c = tenex(ttyline, BUFSIZ);
 				if (c > roomleft) {
-					/* start with fresh buffer */
-					feobp = fseekp = fblocks * BUFSIZ;
-					numleft = c;
-					goto again;
+					expand_fbuf();
+					copy(fbuf[buf] + off, ttyline,
+					    roomleft * sizeof (tchar));
+					copy(fbuf[buf + 1], ttyline + roomleft,
+					    (c - roomleft) * sizeof (tchar));
+				} else if (c > 0) {
+					copy(fbuf[buf] + off, ttyline,
+						c * sizeof (tchar));
 				}
-				if (c > 0)
-					copy(fbuf[buf] + off, ttyline, c*sizeof(tchar));
-				numleft = 0;
-			} else
+			} else {
 				c = read_(SHIN, fbuf[buf] + off, roomleft);
+				if (c > roomleft) {
+					expand_fbuf();
+					copy(fbuf[buf + 1],
+					    fbuf[buf] + off + roomleft,
+					    (c - roomleft) * sizeof (tchar));
+				}
+			}
 #endif
 			if (c >= 0)
 				break;
@@ -1346,12 +1360,12 @@ again:
 			goto again;
 #endif
 	}
-	c = fbuf[buf][(int) fseekp % BUFSIZ];
+	c = fbuf[buf][(int)fseekp % BUFSIZ];
 	fseekp++;
 	return (c);
 }
 
-void	
+void
 bfree(void)
 {
 	int sb, i;
@@ -1362,7 +1376,7 @@ bfree(void)
 #endif
 	if (whyles)
 		return;
-	sb = (int) (fseekp - 1) / BUFSIZ;
+	sb = (int)(fseekp - 1) / BUFSIZ;
 	if (sb > 0) {
 		for (i = 0; i < sb; i++)
 			xfree(fbuf[i]);
@@ -1423,11 +1437,10 @@ settell(void)
 		return;
 	if (lseek(SHIN, (off_t)0, 1) < 0 || errno == ESPIPE)
 		return;
-	fbuf =  (tchar **) calloc(2, sizeof  (tchar **));
+	fbuf = (tchar **)xcalloc(2, sizeof (tchar **));
 	fblocks = 1;
-	fbuf[0] = (tchar *)calloc(BUFSIZ, sizeof (tchar));
+	fbuf[0] = (tchar *)xcalloc(BUFSIZ + MB_LEN_MAX, sizeof (tchar));
 	fseekp = fbobp = feobp = lseek(SHIN, (off_t)0, 1);
 	cantell = 1;
 }
 #endif
-
diff --git a/usr/src/cmd/csh/sh.misc.c b/usr/src/cmd/csh/sh.misc.c
index 6ee722cc69..52db0dc8ff 100644
--- a/usr/src/cmd/csh/sh.misc.c
+++ b/usr/src/cmd/csh/sh.misc.c
@@ -43,26 +43,6 @@ onlyread(tchar *cp)
 	return ((char *)cp < end);
 }
 
-
-/*
- * WARNING: changes here also need to occur in the XFREE macro in sh.h.
- */
-void
-xfree(char *cp)
-{
-	extern char end[];
-
-#if defined(sparc)
-	if ((char *)cp >= end && (char *)cp <  (char *)&cp)
-		free(cp);
-#elif defined(i386)
-	if ((char *)cp >= end)
-		free(cp);
-#else
-#error xfree function is machine dependent and no machine type is recognized
-#endif
-}
-
 tchar *
 savestr(tchar *s)
 {
@@ -74,7 +54,7 @@ savestr(tchar *s)
 #ifndef m32
 	for (p = s; *p++; )
 		;
-	n = p = (tchar *)xalloc((unsigned) (p - s)*sizeof (tchar));
+	n = p = (tchar *)xalloc((unsigned)(p - s)*sizeof (tchar));
 	while (*p++ = *s++)
 		;
 	return (n);
@@ -85,19 +65,8 @@ savestr(tchar *s)
 #endif
 }
 
-void *
-calloc(size_t i, size_t j)
-{
-	char *cp;
-
-	i *= j;
-	cp = (char *)xalloc(i);
-	bzero(cp, (int)i);
-	return (cp);
-}
-
-int
-nomem(unsigned i)
+static void *
+nomem(size_t i)
 {
 #ifdef debug
 	static tchar *av[2] = {0, 0};
@@ -172,15 +141,15 @@ blkfree(tchar **av0)
 	tchar **av = av0;
 
 	for (; *av; av++)
-		XFREE(*av)
-	XFREE((tchar *)av0)
+		xfree(*av);
+	xfree(av0);
 }
 
 tchar **
 saveblk(tchar **v)
 {
 	tchar **newv =
-		(tchar **) calloc((unsigned) (blklen(v) + 1),
+		(tchar **)xcalloc((unsigned)(blklen(v) + 1),
 				sizeof (tchar **));
 	tchar **onewv = newv;
 
@@ -200,7 +169,7 @@ strspl(tchar *cp, tchar *dp)
 		;
 	for (q = dp; *q++; )
 		;
-	ep = (tchar *) xalloc((unsigned) (((p - cp) +
+	ep = (tchar *) xalloc((unsigned)(((p - cp) +
 			(q - dp) - 1))*sizeof (tchar));
 	for (p = ep, q = cp; *p++ = *q++; )
 		;
@@ -210,7 +179,7 @@ strspl(tchar *cp, tchar *dp)
 	int	len1 = strlen_(cp);
 	int	len2 = strlen_(dp);
 
-	ep = (tchar *)xalloc((unsigned) (len1 + len2 + 1)*sizeof (tchar));
+	ep = (tchar *)xalloc((unsigned)(len1 + len2 + 1)*sizeof (tchar));
 	strcpy_(ep, cp);
 	strcat_(ep, dp);
 #endif
@@ -221,7 +190,7 @@ tchar **
 blkspl(tchar **up, tchar **vp)
 {
 	tchar **wp =
-		(tchar **) calloc((unsigned) (blklen(up) + blklen(vp) + 1),
+		(tchar **)xcalloc((unsigned)(blklen(up) + blklen(vp) + 1),
 			sizeof (tchar **));
 
 	(void) blkcpy(wp, up);
@@ -363,7 +332,7 @@ tchar **
 copyblk(tchar **v)
 {
 	tchar **nv =
-		(tchar **) calloc((unsigned) (blklen(v) + 1),
+		(tchar **)xcalloc((unsigned)(blklen(v) + 1),
 				sizeof (tchar **));
 
 	return (blkcpy(nv, v));
@@ -455,9 +424,115 @@ char **
 blkspl_(char **up, char **vp)
 {
 	char **wp =
-		(char **) calloc((unsigned) (blklen_(up) + blklen_(vp) + 1),
+		(char **)xcalloc((unsigned)(blklen_(up) + blklen_(vp) + 1),
 			sizeof (char **));
 
 	(void) blkcpy_(wp, up);
 	return (blkcat_(wp, vp));
 }
+
+/*
+ * If stack address was passed to free(), we have no good way to see if
+ * they are really in the stack. Therefore, we record the bottom of heap,
+ * and filter out the address not within heap's top(end) and bottom
+ * (xalloc_bottom).
+ */
+extern char	end[];
+static char	*xalloc_bottom;
+
+void *
+xalloc(size_t size)
+{
+	char	*rptr, *bp;
+
+	if ((rptr = malloc(size)) == NULL)
+		return (nomem(size));
+	bp = rptr + size;
+	if (bp > xalloc_bottom)
+		xalloc_bottom = bp;
+	return (rptr);
+}
+
+void *
+xrealloc(void *ptr, size_t size)
+{
+	char	*rptr = ptr, *bp;
+
+	if (ptr == NULL)
+		return (xalloc(size));
+	if (rptr < end) {
+		/* data area, but not in heap area. don't touch it */
+oob:
+		if (size == 0)
+			return (NULL);
+		rptr = xalloc(size);
+		/* copy max size */
+		(void) memcpy(rptr, ptr, size);
+		return (rptr);
+	}
+	if (rptr < xalloc_bottom) {
+		/* address in the heap */
+inb:
+		if (size == 0) {
+			free(ptr);
+			return (NULL);
+		}
+		if ((rptr = realloc(ptr, size)) == NULL)
+			return (nomem(size));
+		bp = rptr + size;
+		if (bp > xalloc_bottom)
+			xalloc_bottom = bp;
+		return (rptr);
+	}
+#if defined(__sparc)
+	if (rptr > (char *)&rptr) {
+		/* in the stack frame */
+		goto oob;
+	}
+#endif
+	/*
+	 * can be a memory block returned indirectly from
+	 * library functions. update bottom, and check it again.
+	 */
+	xalloc_bottom = sbrk(0);
+	if (rptr <= xalloc_bottom)
+		goto inb;
+	else
+		goto oob;
+	/*NOTREACHED*/
+}
+
+void
+xfree(void *ptr)
+{
+	char	*rptr = ptr;
+
+	if (rptr < end) {
+		return;
+	}
+	if (rptr < xalloc_bottom) {
+		free(ptr);
+		return;
+	}
+#if defined(__sparc)
+	if (rptr > (char *)&rptr) {
+		/* in the stack frame */
+		return;
+	}
+#endif
+	xalloc_bottom = sbrk(0);
+	if (rptr <= xalloc_bottom) {
+		free(ptr);
+	}
+}
+
+void *
+xcalloc(size_t i, size_t j)
+{
+	char *cp;
+
+	i *= j;
+	cp = xalloc(i);
+	(void) memset(cp, '\0', i);
+	return (cp);
+}
diff --git a/usr/src/cmd/csh/sh.parse.c b/usr/src/cmd/csh/sh.parse.c
index e6e7231a9f..b936126c8d 100644
--- a/usr/src/cmd/csh/sh.parse.c
+++ b/usr/src/cmd/csh/sh.parse.c
@@ -157,8 +157,8 @@ asyn3(struct wordent *p1, struct wordent *p2)
 	if (p1->word[0] && eq(p1->word, alout.next->word)) {
 		tchar *cp = alout.next->word;
 
-		alout.next->word = strspl(S_TOPBIT /*"\200"*/, cp);
-		XFREE(cp)
+		alout.next->word = strspl(S_TOPBIT /* "\200" */, cp);
+		xfree(cp);
 	}
 	p1 = freenod(p1, redid ? p2 : p1->next);
 	if (alout.next != &alout) {
@@ -166,8 +166,8 @@ asyn3(struct wordent *p1, struct wordent *p2)
 		alout.prev->prev->next = p1->next;
 		alout.next->prev = p1;
 		p1->next = alout.next;
-		XFREE(alout.prev->word)
-		XFREE( (tchar *)alout.prev)
+		xfree(alout.prev->word);
+		xfree(alout.prev);
 	}
 	reset();		/* throw! */
 }
@@ -181,9 +181,9 @@ freenod(struct wordent *p1, struct wordent *p2)
 	tprintf("TRACE- freenod()\n");
 #endif
 	while (p1 != p2) {
-		XFREE(p1->word)
+		xfree(p1->word);
 		p1 = p1->next;
-		XFREE( (tchar *)p1->prev)
+		xfree(p1->prev);
 	}
 	retp->next = p2;
 	p2->prev = retp;
@@ -253,7 +253,7 @@ syn0(struct wordent *p1, struct wordent *p2, int flags)
 			/* fall into ... */
 
 		case '>':
-			if (p->next != p2 && eq(p->next->word, S_AND /*"&"*/))
+			if (p->next != p2 && eq(p->next->word, S_AND /* "&" */))
 				p = p->next;
 			continue;
 
@@ -264,21 +264,21 @@ syn0(struct wordent *p1, struct wordent *p2, int flags)
 				continue;
 			t1 = syn1(p1, p, flags);
 			if (t1->t_dtyp == TLST ||
-    			    t1->t_dtyp == TAND ||
-    			    t1->t_dtyp == TOR) {
-				t = (struct command *) calloc(1, sizeof (*t));
+			    t1->t_dtyp == TAND ||
+			    t1->t_dtyp == TOR) {
+				t = (struct command *)xcalloc(1, sizeof (*t));
 				t->t_dtyp = TPAR;
 				t->t_dflg = FAND|FINT;
 				t->t_dspr = t1;
 				t1 = t;
 			} else
 				t1->t_dflg |= FAND|FINT;
-			t = (struct command *) calloc(1, sizeof (*t));
+			t = (struct command *)xcalloc(1, sizeof (*t));
 			t->t_dtyp = TLST;
 			t->t_dflg = 0;
 			t->t_dcar = t1;
 			t->t_dcdr = syntax(p, p2, flags);
-			return(t);
+			return (t);
 		}
 	if (l == 0)
 		return (syn1(p1, p2, flags));
@@ -317,7 +317,7 @@ syn1(struct wordent *p1, struct wordent *p2, int flags)
 		case '\n':
 			if (l != 0)
 				break;
-			t = (struct command *) calloc(1, sizeof (*t));
+			t = (struct command *)xcalloc(1, sizeof (*t));
 			t->t_dtyp = TLST;
 			t->t_dcar = syn1a(p1, p, flags);
 			t->t_dcdr = syntax(p->next, p2, flags);
@@ -358,7 +358,7 @@ syn1a(struct wordent *p1, struct wordent *p2, int flags)
 			if (p->word[1] != '|')
 				continue;
 			if (l == 0) {
-				t = (struct command *) calloc(1, sizeof (*t));
+				t = (struct command *)xcalloc(1, sizeof (*t));
 				t->t_dtyp = TOR;
 				t->t_dcar = syn1b(p1, p, flags);
 				t->t_dcdr = syn1a(p->next, p2, flags);
@@ -399,7 +399,7 @@ syn1b(struct wordent *p1, struct wordent *p2, int flags)
 
 		case '&':
 			if (p->word[1] == '&' && l == 0) {
-				t = (struct command *) calloc(1, sizeof (*t));
+				t = (struct command *)xcalloc(1, sizeof (*t));
 				t->t_dtyp = TAND;
 				t->t_dcar = syn2(p1, p, flags);
 				t->t_dcdr = syn1b(p->next, p2, flags);
@@ -442,7 +442,7 @@ syn2(struct wordent *p1, struct wordent *p2, int flags)
 		case '|':
 			if (l != 0)
 				continue;
-			t = (struct command *) calloc(1, sizeof (*t));
+			t = (struct command *)xcalloc(1, sizeof (*t));
 			f = flags | POUT;
 			pn = p->next;
 			if (pn != p2 && pn->word[0] == '&') {
@@ -544,8 +544,8 @@ again:
 		}
 	if (n < 0)
 		n = 0;
-	t = (struct command *) calloc(1, sizeof (*t));
-	av =  (tchar **) calloc((unsigned) (n + 1), sizeof  (tchar **));
+	t = (struct command *)xcalloc(1, sizeof (*t));
+	av =  (tchar **)xcalloc((unsigned)(n + 1), sizeof (tchar **));
 	t->t_dcom = av;
 	n = 0;
 	if (p2->word[0] == ')')
@@ -577,12 +577,12 @@ again:
 				goto savep;
 			if (p->word[1] == '>')
 				t->t_dflg |= FCAT;
-			if (p->next != p2 && eq(p->next->word, S_AND /*"&"*/)) {
+			if (p->next != p2 && eq(p->next->word, S_AND /* "&" */)) {
 				t->t_dflg |= FDIAG, p = p->next;
 				if (flags & (POUT|PDIAG))
 					goto badout;
 			}
-			if (p->next != p2 && eq(p->next->word, S_EXAS /*"!"*/))
+			if (p->next != p2 && eq(p->next->word, S_EXAS /* "!" */))
 				t->t_dflg |= FANY, p = p->next;
 			if (p->next == p2) {
 missfile:
@@ -665,8 +665,8 @@ freesyn(struct command *t)
 		/* fall into ... */
 
 lr:
-		XFREE(t->t_dlef)
-		XFREE(t->t_drit)
+		xfree(t->t_dlef);
+		xfree(t->t_drit);
 		break;
 
 	case TAND:
@@ -676,7 +676,7 @@ lr:
 		freesyn(t->t_dcar), freesyn(t->t_dcdr);
 		break;
 	}
-	XFREE( (tchar *)t)
+	xfree(t);
 }
 
 
diff --git a/usr/src/cmd/csh/sh.proc.c b/usr/src/cmd/csh/sh.proc.c
index d29a5ae8d9..f9f8459b37 100644
--- a/usr/src/cmd/csh/sh.proc.c
+++ b/usr/src/cmd/csh/sh.proc.c
@@ -24,7 +24,7 @@
  * C Shell - functions that manage processes, handling hanging, termination
  */
 
-#define BIGINDEX	9	/* largest desirable job index */
+#define	BIGINDEX	9	/* largest desirable job index */
 
 void	pjwait(struct process *);
 void	pflush(struct process *);
@@ -60,12 +60,12 @@ pchild(void)
 #endif
 loop:
 	pid = csh_wait3(&w, (setintr ? WNOHANG|WUNTRACED:WNOHANG), &ru);
-        /*
-         * SysV sends a SIGCHLD when the child process
-         * receives a SIGCONT, and result of that action is ignored here
-         */
-        if ( w.w_status == WCONTFLG )
-                return;
+	/*
+	 * SysV sends a SIGCHLD when the child process
+	 * receives a SIGCONT, and result of that action is ignored here
+	 */
+	if (w.w_status == WCONTFLG)
+		return;
 	if (pid <= 0) {
 		if (errno == EINTR) {
 			errno = 0;
@@ -79,14 +79,14 @@ loop:
 			goto found;
 	goto loop;
 found:
-	if (pid == atoi_(value(S_child /*"child"*/)))
-		unsetv(S_child /*"child"*/);
+	if (pid == atoi_(value(S_child /* "child" */)))
+		unsetv(S_child /* "child" */);
 	pp->p_flags &= ~(PRUNNING|PSTOPPED|PREPORTED);
 	if (WIFSTOPPED(w)) {
 		pp->p_flags |= PSTOPPED;
 		pp->p_reason = w.w_stopsig;
 	} else {
-		if (pp->p_flags & (PTIME|PPTIME) || adrof(S_time /*"time"*/))
+		if (pp->p_flags & (PTIME|PPTIME) || adrof(S_time /* "time" */))
 			(void) gettimeofday(&pp->p_etime, (struct timezone *)0);
 		pp->p_rusage = ru;
 		if (WIFSIGNALED(w)) {
@@ -109,9 +109,9 @@ found:
 	fp = pp;
 	do {
 		if ((fp->p_flags & (PPTIME|PRUNNING|PSTOPPED)) == 0 &&
-		    !child && adrof(S_time /*"time"*/) &&
+		    !child && adrof(S_time /* "time" */) &&
 		    fp->p_rusage.ru_utime.tv_sec+fp->p_rusage.ru_stime.tv_sec >=
-		     atoi_(value(S_time /*"time"*/)))
+		    atoi_(value(S_time /* "time" */)))
 			fp->p_flags |= PTIME;
 		jobflags |= fp->p_flags;
 	} while ((fp = fp->p_friends) != pp);
@@ -125,8 +125,8 @@ found:
 		do {
 			if (fp->p_flags&PSTOPPED)
 				fp->p_flags |= PREPORTED;
-		} while((fp = fp->p_friends) != pp);
-		while(fp->p_pid != fp->p_jobid)
+		} while ((fp = fp->p_friends) != pp);
+		while (fp->p_pid != fp->p_jobid)
 			fp = fp->p_friends;
 		if (jobflags&PSTOPPED) {
 			if (pcurrent && pcurrent != fp)
@@ -143,7 +143,7 @@ found:
 				;	/* print in pjwait */
 			}
 		} else {
-			if (jobflags&PNOTIFY || adrof(S_notify /*"notify"*/)) {
+			if (jobflags&PNOTIFY || adrof(S_notify /* "notify" */)) {
 				write_string("\015\n");
 				flush();
 				(void) pprint(pp, NUMBER|NAME|REASON);
@@ -204,7 +204,7 @@ pwait(void)
 			if (pp->p_cwd && --pp->p_cwd->di_count == 0)
 				if (pp->p_cwd->di_next == 0)
 					dfree(pp->p_cwd);
-			xfree( (tchar *)pp);
+			xfree((tchar *)pp);
 			pp = fp;
 		}
 	(void) sigsetmask(omask);
@@ -272,13 +272,13 @@ pjwait(struct process *pp)
 	if (tpgrp > 0)			/* get tty back */
 		(void) ioctl(FSHTTY, TIOCSPGRP,  (char *)&tpgrp);
 	if ((jobflags&(PSIGNALED|PSTOPPED|PTIME)) ||
-	     !eq(dcwd->di_name, fp->p_cwd->di_name)) {
+	    !eq(dcwd->di_name, fp->p_cwd->di_name)) {
 		if (jobflags&PSTOPPED)
 			printf("\n");
 		(void) pprint(pp, AREASON|SHELLDIR);
 	}
 	if ((jobflags&(PINTERRUPTED|PSTOPPED)) && setintr &&
-	    (!gointr || !eq(gointr, S_MINUS /*"-"*/))) {
+	    (!gointr || !eq(gointr, S_MINUS /* "-" */))) {
 		if ((jobflags & PSTOPPED) == 0)
 			pflush(pp);
 		pintr1(0);
@@ -291,7 +291,7 @@ pjwait(struct process *pp)
 			reason = fp->p_flags & (PSIGNALED|PINTERRUPTED) ?
 				fp->p_reason | ABN_TERM : fp->p_reason;
 	} while ((fp = fp->p_friends) != pp);
-	set(S_status/*"status"*/, putn(reason));
+	set(S_status /* "status" */, putn(reason));
 	if (reason && exiterr)
 		exitstat();
 	pflush(pp);
@@ -415,7 +415,7 @@ palloc(int pid, struct command *t)
 #ifdef TRACE
 	tprintf("TRACE- palloc()\n");
 #endif
-	pp = (struct process *)calloc(1, sizeof(struct process));
+	pp = (struct process *)xcalloc(1, sizeof (struct process));
 	pp->p_pid = pid;
 	pp->p_flags = t->t_dflg & FAND ? PRUNNING : PRUNNING|PFOREGND;
 	if (t->t_dflg & FTIME)
@@ -458,7 +458,7 @@ palloc(int pid, struct command *t)
 				pp->p_index = i;
 				if (i > pmaxindex)
 					pmaxindex = i;
-				break;			
+				break;
 			tryagain:;
 			}
 		}
@@ -483,16 +483,16 @@ padd(struct command *t)
 	switch (t->t_dtyp) {
 
 	case TPAR:
-		pads(S_LBRASP /*"( "*/);
+		pads(S_LBRASP /* "( " */);
 		padd(t->t_dspr);
-		pads(S_SPRBRA /*" )"*/);
+		pads(S_SPRBRA /* " )" */);
 		break;
 
 	case TCOM:
 		for (argp = t->t_dcom; *argp; argp++) {
 			pads(*argp);
 			if (argp[1])
-				pads(S_SP /*" "*/);
+				pads(S_SP /* " " */);
 		}
 		break;
 
@@ -503,30 +503,30 @@ padd(struct command *t)
 		padd(t->t_dcar);
 		switch (t->t_dtyp) {
 		case TOR:
-			pads(S_SPBARBARSP /*" || " */);
+			pads(S_SPBARBARSP /* " || " */);
 			break;
 		case TAND:
-			pads(S_SPANDANDSP /*" && "*/);
+			pads(S_SPANDANDSP /* " && " */);
 			break;
 		case TFIL:
-			pads(S_SPBARSP /*" | "*/);
+			pads(S_SPBARSP /* " | " */);
 			break;
 		case TLST:
-			pads(S_SEMICOLONSP /*"; "*/);
+			pads(S_SEMICOLONSP /* "; " */);
 			break;
 		}
 		padd(t->t_dcdr);
 		return;
 	}
 	if ((t->t_dflg & FPIN) == 0 && t->t_dlef) {
-		pads((t->t_dflg & FHERE) ? S_SPLESLESSP /*" << " */ : S_SPLESSP /*" < "*/);
+		pads((t->t_dflg & FHERE) ? S_SPLESLESSP /* " << " */ : S_SPLESSP /* " < " */);
 		pads(t->t_dlef);
 	}
 	if ((t->t_dflg & FPOU) == 0 && t->t_drit) {
-		pads((t->t_dflg & FCAT) ? S_SPGTRGTRSP /*" >>" */ : S_SPGTR /*" >"*/);
+		pads((t->t_dflg & FCAT) ? S_SPGTRGTRSP /* " >>" */ : S_SPGTR /* " >" */);
 		if (t->t_dflg & FDIAG)
-			pads(S_AND /*"&"*/);
-		pads(S_SP /*" "*/);
+			pads(S_AND /* "&" */);
+		pads(S_SP /* " " */);
 		pads(t->t_drit);
 	}
 }
@@ -542,7 +542,7 @@ pads(tchar *cp)
 	if (cmdlen >= PMAXLEN)
 		return;
 	if (cmdlen + i >= PMAXLEN) {
-		(void) strcpy_(cmdp, S_SPPPP /*" ..."*/);
+		(void) strcpy_(cmdp, S_SPPPP /* " ..." */);
 		cmdlen = PMAXLEN;
 		cmdp += 4;
 		return;
@@ -632,23 +632,23 @@ pprint(struct process *pp, int flag)
 		pp->p_flags |= PTIME;
 	}
 	tp = pp;
-	status = reason = -1; 
+	status = reason = -1;
 	jobflags = 0;
 	do {
 		jobflags |= pp->p_flags;
 		pstatus = pp->p_flags & PALLSTATES;
 		if (tp != pp && linp != linbuf && !(flag&FANCY) &&
 		    (pstatus == status && pp->p_reason == reason ||
-		     !(flag&REASON)))
+		    !(flag&REASON)))
 			printf(" ");
 		else {
 			if (tp != pp && linp != linbuf)
 				printf("\n");
-			if(flag&NUMBER)
+			if (flag&NUMBER)
 				if (pp == tp)
 					printf("[%d]%s %c ", pp->p_index,
 					    pp->p_index < 10 ? " " : "",
-					    pp==pcurrent ? '+' :
+					    pp == pcurrent ? '+' :
 						(pp == pprevious ? (tchar) '-'
 							: (tchar) ' '));
 				else
@@ -716,7 +716,7 @@ prcomd:
 			if (flag&JOBDIR &&
 			    !eq(tp->p_cwd->di_name, dcwd->di_name)) {
 				printf(" (wd: ");
-				dtildepr(value(S_home /*"home"*/), tp->p_cwd->di_name);
+				dtildepr(value(S_home /* "home" */), tp->p_cwd->di_name);
 				printf(")");
 			}
 		}
@@ -724,7 +724,7 @@ prcomd:
 			if (linp != linbuf)
 				printf("\n\t");
 			{ static struct rusage zru;
-			  prusage(&zru, &pp->p_rusage, &pp->p_etime,
+			    prusage(&zru, &pp->p_rusage, &pp->p_etime,
 			    &pp->p_btime);
 			}
 		}
@@ -785,7 +785,7 @@ dojobs(tchar **v)
 	if (chkstop)
 		chkstop = 2;
 	if (*++v) {
-		if (v[1] || !eq(*v, S_DASHl /*"-l"*/))
+		if (v[1] || !eq(*v, S_DASHl /* "-l" */))
 			error("Usage: jobs [ -l ]");
 		flag |= FANCY|JOBDIR;
 	}
@@ -921,7 +921,7 @@ dokill(tchar **v)
 				signum = signo;
 				goto gotsig;
 			}
-			if (eq(name, S_IOT /*"IOT"*/)) {
+			if (eq(name, S_IOT /* "IOT" */)) {
 				signum = SIGABRT;
 				goto gotsig;
 			}
@@ -1024,21 +1024,21 @@ pstart(struct process *pp, int foregnd)
 			else
 				np->p_flags &= ~PFOREGND;
 		}
-	} while((np = np->p_friends) != pp);
+	} while ((np = np->p_friends) != pp);
 
 	if (foregnd)
 		pclrcurr(pp);
 	else
 	{
-		if ( pprevious && (pprevious->p_flags & PSTOPPED) )
+		if (pprevious && (pprevious->p_flags & PSTOPPED))
 		{
 			pcurrent = pprevious;
 			pprevious = pgetcurr(PNULL);
 		}
 		else
-		{	
+		{
 			pcurrent = pgetcurr(pp);
-			if ( !pcurrent || (pcurrent->p_flags & PRUNNING) )
+			if (!pcurrent || (pcurrent->p_flags & PRUNNING))
 				pcurrent = pp;
 			else
 				pprevious = pp;
@@ -1074,15 +1074,15 @@ pfind(tchar *cp)
 #ifdef TRACE
 	tprintf("TRACE- pfind()\n");
 #endif
-	if (cp == 0 || cp[1] == 0 || eq(cp, S_PARCENTPARCENT /*"%%"*/) ||
-				     eq(cp, S_PARCENTPLUS /*"%+"*/)) {
+	if (cp == 0 || cp[1] == 0 || eq(cp, S_PARCENTPARCENT /* "%%" */) ||
+					eq(cp, S_PARCENTPLUS /* "%+" */)) {
 		if (pcurrent == PNULL)
-			if ( (pcurrent = pgetcurr(PNULL)) == PNULL )
+			if ((pcurrent = pgetcurr(PNULL)) == PNULL)
 				bferr("No current job");
 		return (pcurrent);
 	}
-	if (eq(cp, S_PARCENTMINUS /*"%-"*/) ||
-	    eq(cp, S_PARCENTSHARP /*"%#"*/)) {
+	if (eq(cp, S_PARCENTMINUS /* "%-" */) ||
+	    eq(cp, S_PARCENTSHARP /* "%#" */)) {
 		if (pprevious == PNULL)
 			bferr("No previous job");
 		return (pprevious);
@@ -1195,7 +1195,7 @@ pfork(struct command *t, int wanttty)
 	 */
 	if (setintr)
 		ignint = (tpgrp == -1 && (t->t_dflg&FINT))
-		    || (gointr && eq(gointr, S_MINUS /*"-"*/));
+		    || (gointr && eq(gointr, S_MINUS /* "-" */));
 	/*
 	 * Hold SIGCHLD until we have the process installed in our table.
 	 */
@@ -1245,11 +1245,11 @@ pfork(struct command *t, int wanttty)
 		if (wanttty >= 0 && tpgrp >= 0)
 			(void) setpgid(0, pgrp);
 		if (wanttty > 0) {
-			sigttou = sigblock (sigmask(SIGTTOU)|
-					    sigmask(SIGTTIN)|
+			sigttou = sigblock(sigmask(SIGTTOU) |
+					    sigmask(SIGTTIN) |
 					    sigmask(SIGTSTP));
 			(void) ioctl(FSHTTY, TIOCSPGRP,  (char *)&pgrp);
-			sigsetmask (sigttou);
+			sigsetmask(sigttou);
 		}
 		if (tpgrp > 0)
 			tpgrp = 0;		/* gave tty away */
@@ -1284,4 +1284,3 @@ okpcntl(void)
 	if (tpgrp == 0)
 		error("No job control in subshells");
 }
-
diff --git a/usr/src/cmd/csh/sh.set.c b/usr/src/cmd/csh/sh.set.c
index 5c8a070817..51f49ae4f4 100644
--- a/usr/src/cmd/csh/sh.set.c
+++ b/usr/src/cmd/csh/sh.set.c
@@ -66,7 +66,7 @@ doset(tchar **v)
 			continue;
 		if (vp == p || !letter(*vp))
 			goto setsyn;
-		if ( (p - vp) > MAX_VAR_LEN )
+		if ((p - vp) > MAX_VAR_LEN)
 			bferr("Variable name too long");
 		if (*p == '[') {
 			hadsub++;
@@ -76,7 +76,7 @@ doset(tchar **v)
 			*p++ = 0;
 			if (*p == 0 && *v && **v == '(')
 				p = *v++;
-		} else if (*v && eq(*v, S_EQ/*"="*/)) {
+		} else if (*v && eq(*v, S_EQ /* "=" */)) {
 			op = '=', v++;
 			if (*v)
 				p = *v++;
@@ -84,7 +84,7 @@ doset(tchar **v)
 		if (op && op != '=')
 setsyn:
 			bferr("Syntax error");
-		if (eq(p, S_LPAR/*"("*/)) {
+		if (eq(p, S_LPAR /* "(" */)) {
 			tchar **e = v;
 
 			if (hadsub)
@@ -109,23 +109,23 @@ setsyn:
 			retp = 0;
 		} else
 			set(vp, savestr(p));
-		if (eq(vp, S_path/*"path"*/)) {
-			exportpath(adrof(S_path/*"path"*/)->vec);
+		if (eq(vp, S_path /* "path" */)) {
+			exportpath(adrof(S_path /* "path" */)->vec);
 			dohash(xhash);
-		} else if (eq(vp, S_histchars/*"histchars"*/)) {
-			tchar *p = value(S_histchars/*"histchars"*/);
+		} else if (eq(vp, S_histchars /* "histchars" */)) {
+			tchar *p = value(S_histchars /* "histchars" */);
 			HIST = *p++;
 			HISTSUB = *p;
-		} else if (eq(vp, S_user/*"user"*/))
-			local_setenv(S_USER/*"USER"*/, value(vp));
-		else if (eq(vp, S_term/*"term"*/))
-			local_setenv(S_TERM/*"TERM"*/, value(vp));
-		else if (eq(vp, S_home/*"home"*/))
-			local_setenv(S_HOME/*"HOME"*/, value(vp));
+		} else if (eq(vp, S_user /* "user" */))
+			local_setenv(S_USER /* "USER" */, value(vp));
+		else if (eq(vp, S_term /* "term" */))
+			local_setenv(S_TERM /* "TERM" */, value(vp));
+		else if (eq(vp, S_home /* "home" */))
+			local_setenv(S_HOME /* "HOME" */, value(vp));
 #ifdef FILEC
-		else if (eq(vp, S_filec/*"filec"*/))
+		else if (eq(vp, S_filec /* "filec" */))
 			filec = 1;
-		else if (eq(vp, S_cdpath/*"cdpath"*/))
+		else if (eq(vp, S_cdpath /* "cdpath" */))
 			dohash(xhash2);
 #endif
 	} while (p = *v++);
@@ -218,7 +218,7 @@ dolet(tchar **v)
 					goto letsyn;
 				p = plusplus;
 			} else {
-				/*if (any(op, "<>")) {*/
+				/* if (any(op, "<>")) { */
 				if (op == '<' || op == '>') {
 					if (c != op)
 						goto letsyn;
@@ -250,17 +250,17 @@ letsyn:
 #endif
 			else
 				set(vp, operate(op, value(vp), p));
-		if (eq(vp, S_path/*"path"*/)) {
-			exportpath(adrof(S_path/*"path"*/)->vec);
+		if (eq(vp, S_path /* "path" */)) {
+			exportpath(adrof(S_path /* "path" */)->vec);
 			dohash(xhash);
 		}
 
-		if (eq(vp, S_cdpath/*"cdpath"*/))
+		if (eq(vp, S_cdpath /* "cdpath" */))
 			dohash(xhash2);
 
-		XFREE(vp)
+		xfree(vp);
 		if (c != '=')
-			XFREE(p)
+			xfree(p);
 	} while (p = *v++);
 }
 
@@ -308,7 +308,7 @@ operate(tchar op, tchar *vp, tchar *p)
 }
 
 static tchar *putp;
- 
+
 tchar *
 putn(int n)
 {
@@ -387,7 +387,7 @@ value1(tchar *var, struct varent *head)
 	tprintf("TRACE- value1()\n");
 #endif
 	vp = adrof1(var, head);
-	return (vp == 0 || vp->vec[0] == 0 ? S_/*""*/ : vp->vec[0]);
+	return (vp == 0 || vp->vec[0] == 0 ? S_ /* "" */ : vp->vec[0]);
 }
 
 struct varent *
@@ -417,7 +417,7 @@ adrof1(tchar *name, struct varent *v)
 #endif
 	v = v->v_left;
 	while (v && ((cmp = *name - *v->v_name) ||
-		     (cmp = strcmp_(name, v->v_name))))
+	    (cmp = strcmp_(name, v->v_name))))
 		if (cmp < 0)
 			v = v->v_left;
 		else
@@ -431,7 +431,7 @@ adrof1(tchar *name, struct varent *v)
 void
 set(tchar *var, tchar *val)
 {
-	tchar **vec =  (tchar **) xalloc(2 * sizeof  (tchar **));
+	tchar **vec =  (tchar **)xalloc(2 * sizeof (tchar **));
 
 #ifdef TRACE
 	tprintf("TRACE- set()\n");
@@ -450,13 +450,14 @@ set1(tchar *var, tchar **vec, struct varent *head)
 	tprintf("TRACE- set1()\n");
 #endif
 	gflag = 0;
-	/* If setting cwd variable via "set cwd=/tmp/something"
+	/*
+	 * If setting cwd variable via "set cwd=/tmp/something"
 	 * then do globbing.  But if we are setting the cwd
- 	 * becuz of a cd, chdir, pushd, popd, do not do globbing.
+	 * becuz of a cd, chdir, pushd, popd, do not do globbing.
 	 */
-	if ( (!(eq(var,S_cwd))) || (eq(var,S_cwd) && (didchdir == 0)) )
+	if ((!(eq(var, S_cwd))) || (eq(var, S_cwd) && (didchdir == 0)))
 		{
-        	tglob(oldv);
+		tglob(oldv);
 		}
 	if (gflag) {
 		vec = glob(oldv);
@@ -508,12 +509,12 @@ unset(tchar *v[])
 	tprintf("TRACE- unset()\n");
 #endif
 	unset1(v, &shvhed);
-	if (adrof(S_histchars/*"histchars"*/) == 0) {
+	if (adrof(S_histchars /* "histchars" */) == 0) {
 		HIST = '!';
 		HISTSUB = '^';
 	}
 #ifdef FILEC
-	if (adrof(S_filec/*"filec"*/) == 0)
+	if (adrof(S_filec /* "filec" */) == 0)
 		filec = 0;
 #endif
 }
@@ -562,7 +563,7 @@ unsetv1(struct varent *p)
 	 * Free associated memory first to avoid complications.
 	 */
 	blkfree(p->vec);
-	XFREE(p->v_name);
+	xfree(p->v_name);
 	/*
 	 * If p is missing one child, then we can move the other
 	 * into where p is.  Otherwise, we find the predecessor
@@ -591,7 +592,7 @@ unsetv1(struct varent *p)
 	/*
 	 * Free the deleted node, and rebalance.
 	 */
-	XFREE( (tchar *)p);
+	xfree(p);
 	balance(pp, f, 1);
 }
 
@@ -602,7 +603,7 @@ setNS(tchar *cp)
 	tprintf("TRACE- setNS()\n");
 #endif
 
-	set(cp, S_/*""*/);
+	set(cp, S_ /* "" */);
 }
 
 void
@@ -617,7 +618,7 @@ shift(tchar **v)
 	v++;
 	name = *v;
 	if (name == 0)
-		name = S_argv/*"argv"*/;
+		name = S_argv /* "argv" */;
 	else
 		(void) strip(name);
 	argv = adrof(name);
@@ -644,21 +645,21 @@ exportpath(tchar **val)
 				break;
 			}
 			(void) strcat_(exppath, *val++);
-			if (*val == 0 || eq(*val, S_RPAR/*")"*/))
+			if (*val == 0 || eq(*val, S_RPAR /* ")" */))
 				break;
-			(void) strcat_(exppath, S_COLON/*":"*/);
+			(void) strcat_(exppath, S_COLON /* ":" */);
 		}
-	local_setenv(S_PATH/*"PATH"*/, exppath);
+	local_setenv(S_PATH /* "PATH" */, exppath);
 }
 
 	/* macros to do single rotations on node p */
-#define rright(p) (\
+#define	rright(p) (\
 	t = (p)->v_left,\
 	(t)->v_parent = (p)->v_parent,\
 	((p)->v_left = t->v_right) ? (t->v_right->v_parent = (p)) : 0,\
 	(t->v_right = (p))->v_parent = t,\
 	(p) = t)
-#define rleft(p) (\
+#define	rleft(p) (\
 	t = (p)->v_right,\
 	(t)->v_parent = (p)->v_parent,\
 	((p)->v_right = t->v_left) ? (t->v_left->v_parent = (p)) : 0,\
diff --git a/usr/src/cmd/csh/sh.tchar.c b/usr/src/cmd/csh/sh.tchar.c
index 6672e36f1d..2eef970c8f 100644
--- a/usr/src/cmd/csh/sh.tchar.c
+++ b/usr/src/cmd/csh/sh.tchar.c
@@ -57,7 +57,7 @@
  *	'to' is assumed to have the enough size to hold the conversion result.
  *	When 'to' is NOSTR(=(tchar *)0), strtots() attempts to allocate a space
  *	automatically using xalloc().  It is caller's responsibility to
- *	free the space allocated in this way, by calling XFREE(ptr).
+ *	free the space allocated in this way, by calling xfree(ptr).
  *	In either case, strtots() returns the pointer to the conversion
  *	result (i.e. 'to', if 'to' wasn't NOSTR, or the allocated space.).
  *	When a conversion or allocateion failed,  NOSTR is returned.
@@ -344,7 +344,7 @@ getenvs_(char *name)
 	char	*val;
 
 	if (pbuf) {
-		XFREE((void *)pbuf);
+		xfree(pbuf);
 		pbuf = NOSTR;
 	}
 	val = getenv(name);
@@ -437,6 +437,7 @@ read_(int d, tchar *buf, int nchreq)
 	/* # of bytes needed to complete the last char just read. */
 	int		delta;
 	unsigned char	*q;	/* q points to the first invalid byte. */
+	int		mb_cur_max = MB_CUR_MAX;
 #ifdef DBG
 	tprintf("Entering read_(d=%d, buf=0x%x, nchreq=%d);\n",
 	    d, buf, nchreq);
@@ -521,11 +522,11 @@ retry:
 				continue;
 			}
 
-			if ((b_len = q - s) > (int)MB_CUR_MAX) {
-				b_len = MB_CUR_MAX;
+			if ((b_len = q - s) > mb_cur_max) {
+				b_len = mb_cur_max;
 			}
 			if ((j = mbtowc(&wc, (char *)s, b_len)) <=  0) {
-				if (b_len < (unsigned int)MB_CUR_MAX) {
+				if (mb_cur_max > 1 && b_len < mb_cur_max) {
 					/*
 					 * Needs more byte to complete this char
 					 * In order to read() more than delta
@@ -533,7 +534,6 @@ retry:
 					 */
 					break;
 				}
-
 				wc = (unsigned char)*s;
 				j = 1;
 			}
@@ -546,8 +546,8 @@ retry:
 		if (k < m) {
 			/* We've read as many bytes as possible. */
 			while (s < q) {
-				if ((b_len = q - s) > (int)MB_CUR_MAX) {
-					b_len = MB_CUR_MAX;
+				if ((b_len = q - s) > mb_cur_max) {
+					b_len = mb_cur_max;
 				}
 				if ((j = mbtowc(&wc, (char *)s, b_len)) <=  0) {
 					wc = (unsigned char)*s;
@@ -563,44 +563,55 @@ retry:
 		p = q;
 	}
 
-	if ((delta = q - s) == 0) {
+	if (mb_cur_max == 1 || (delta = q - s) == 0) {
 		return (nchread);
 	}
 
-	if (*(s + delta - 1) == '\n') {
-		while (s < q) {
-			if ((b_len = q - s) > (int)MB_CUR_MAX) {
-				b_len = MB_CUR_MAX;
-			}
-			if ((j = mbtowc(&wc, (char *)s, b_len)) <=  0) {
-				wc = (unsigned char)*s;
-				j = 1;
-			}
-			*t++ = wc;
-			nchread++;
-			s += j;
-		}
+	/*
+	 * We may have (MB_CUR_MAX - 1) unread data in the buffer.
+	 * Here, the last converted data was an illegal character which was
+	 * treated as one byte character. We don't know at this point
+	 * whether or not the remaining data is in legal sequence.
+	 * We first attempt to convert the remaining data.
+	 */
+	do {
+		if ((j = mbtowc(&wc, (char *)s, delta)) <= 0)
+			break;
+		*t++ = wc;
+		nchread++;
+		s += j;
+		delta -= j;
+	} while (delta > 0);
+
+	if (delta == 0)
 		return (nchread);
-	}
 
-	for (; delta < (int)MB_CUR_MAX; delta++, q++) {
+	/*
+	 * There seem to be ugly sequence in the buffer. Fill up till
+	 * mb_cur_max and see if we can get a right sequence.
+	 */
+	while (delta < mb_cur_max) {
 		assert((q + 1) < (chbuf + sizeof (chbuf)));
-		if (read(d, q, 1) != 1) {
+		if (read(d, q, 1) != 1)
 			break;
-		}
-		if (*q == '\n') {
-			break;
-		}
+		delta++;
+		q++;
 		if (mbtowc(&wc, (char *)s, delta) > 0) {
 			*t = wc;
 			return (nchread + 1);
 		}
 	}
 
+	/*
+	 * no luck. we have filled MB_CUR_MAX bytes in the buffer.
+	 * Ideally we should return with leaving such data off and
+	 * put them into a local buffer for next read, but we don't
+	 * have such.
+	 * So, stop reading further, and treat them as all single
+	 * byte characters.
+	 */
 	while (s < q) {
-		if ((b_len = q - s) > (int)MB_CUR_MAX) {
-			b_len = MB_CUR_MAX;
-		}
+		b_len = q - s;
 		if ((j = mbtowc(&wc, (char *)s, b_len)) <=  0) {
 			wc = (unsigned char)*s;
 			j = 1;
@@ -610,6 +621,7 @@ retry:
 		s += j;
 	}
 	return (nchread);
+
 #else /* !MBCHAR */
 	/* One byte always represents one tchar.  Easy! */
 	int		i;