merge trunk

1 files changed, 1275 insertions, 828 deletions

diff --git a/generic/tclZipfs.c b/generic/tclZipfs.c
index eb94968..c36cf42 100644
--- a/generic/tclZipfs.c
+++ b/generic/tclZipfs.c
@@ -129,6 +129,14 @@
 	    Tcl_SetObjResult(interp, Tcl_NewStringObj(errstr, -1));	\
 	}								\
     } while (0)
+#define ZIPFS_MEM_ERROR(interp) \
+    do {								\
+	if (interp) {							\
+	    Tcl_SetObjResult(interp, Tcl_NewStringObj(			\
+		    "out of memory", -1));				\
+	    Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);		\
+	}								\
+    } while (0)
 #define ZIPFS_POSIX_ERROR(interp,errstr) \
     do {								\
 	if (interp) {							\
@@ -136,28 +144,11 @@
 		    "%s: %s", errstr, Tcl_PosixError(interp)));		\
 	}								\
     } while (0)
-
-/*
- * Macros to read and write little-endial 16 and 32 bit integers from/to ZIP
- * archives.
- */
-
-#define ZipReadInt(p) \
-    ((p)[0] | ((p)[1] << 8) | ((p)[2] << 16) | ((p)[3] << 24))
-#define ZipReadShort(p) \
-    ((p)[0] | ((p)[1] << 8))
-
-#define ZipWriteInt(p, v) \
-    do {			     \
-	(p)[0] = (v) & 0xff;	     \
-	(p)[1] = ((v) >> 8) & 0xff;  \
-	(p)[2] = ((v) >> 16) & 0xff; \
-	(p)[3] = ((v) >> 24) & 0xff; \
-    } while (0)
-#define ZipWriteShort(p, v) \
-    do {			    \
-	(p)[0] = (v) & 0xff;	    \
-	(p)[1] = ((v) >> 8) & 0xff; \
+#define ZIPFS_ERROR_CODE(interp,errcode) \
+    do {								\
+	if (interp) {							\
+	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", errcode, NULL);	\
+	}								\
     } while (0)
 
 /*
@@ -178,6 +169,12 @@ TCL_DECLARE_MUTEX(localtimeMutex)
 #endif /* !_WIN32 && !HAVE_LOCALTIME_R && TCL_THREADS */
 
 /*
+ * Forward declaration.
+ */
+
+struct ZipEntry;
+
+/*
  * In-core description of mounted ZIP archive file.
  */
 
@@ -206,6 +203,7 @@ typedef struct ZipFile {
 
 /*
  * In-core description of file contained in mounted ZIP archive.
+ * ZIP_ATTR_
  */
 
 typedef struct ZipEntry {
@@ -261,7 +259,9 @@ static struct {
     int initialized;		/* True when initialized */
     int lock;			/* RW lock, see below */
     int waiters;		/* RW lock, see below */
-    int wrmax;			/* Maximum write size of a file */
+    int wrmax;			/* Maximum write size of a file; only written
+				 * to from Tcl code in a trusted interpreter,
+				 * so NOT protected by mutex. */
     int idCount;		/* Counter for channel names */
     Tcl_HashTable fileHash;	/* File name to ZipEntry mapping */
     Tcl_HashTable zipHash;	/* Mount to ZipFile mapping */
@@ -287,15 +287,26 @@ static int		CopyImageFile(Tcl_Interp *interp, const char *imgName,
 			    Tcl_Channel out);
 static inline int	DescribeMounted(Tcl_Interp *interp,
 			    const char *mountPoint);
+static int		InitReadableChannel(Tcl_Interp *interp,
+			    ZipChannel *info, ZipEntry *z);
+static int		InitWritableChannel(Tcl_Interp *interp,
+			    ZipChannel *info, ZipEntry *z, int trunc);
 static inline int	ListMountPoints(Tcl_Interp *interp);
-static void		SerializeCentralDirectoryEntry(char *buf, ZipEntry *z,
-			    size_t nameLength, long long dataStartOffset);
-static void		SerializeCentralDirectorySuffix(char *buf,
+static void		SerializeCentralDirectoryEntry(
+			    const unsigned char *start,
+			    const unsigned char *end, unsigned char *buf,
+			    ZipEntry *z, size_t nameLength,
+			    long long dataStartOffset);
+static void		SerializeCentralDirectorySuffix(
+			    const unsigned char *start,
+			    const unsigned char *end, unsigned char *buf,
 			    int entryCount, long long dataStartOffset,
 			    long long directoryStartOffset,
 			    long long suffixStartOffset);
-static void		SerializeLocalEntryHeader(char *buf, ZipEntry *z,
-			    int nameLength, int align);
+static void		SerializeLocalEntryHeader(
+			    const unsigned char *start,
+			    const unsigned char *end, unsigned char *buf,
+			    ZipEntry *z, int nameLength, int align);
 #if !defined(STATIC_BUILD)
 static int		ZipfsAppHookFindTclInit(const char *archive);
 #endif
@@ -310,6 +321,9 @@ static Tcl_Channel	ZipFSOpenFileChannelProc(Tcl_Interp *interp,
 static int		ZipFSMatchInDirectoryProc(Tcl_Interp *interp,
 			    Tcl_Obj *result, Tcl_Obj *pathPtr,
 			    const char *pattern, Tcl_GlobTypeData *types);
+static void		ZipFSMatchMountPoints(Tcl_Obj *result,
+			    Tcl_Obj *normPathPtr, const char *pattern,
+			    Tcl_DString *prefix);
 static Tcl_Obj *	ZipFSListVolumesProc(void);
 static const char *const *ZipFSFileAttrStringsProc(Tcl_Obj *pathPtr,
 			    Tcl_Obj **objPtrRef);
@@ -329,6 +343,10 @@ static int		ZipChannelClose(void *instanceData,
 static Tcl_DriverGetHandleProc	ZipChannelGetFile;
 static int		ZipChannelRead(void *instanceData, char *buf,
 			    int toRead, int *errloc);
+#if !defined(TCL_NO_DEPRECATED) && (TCL_MAJOR_VERSION < 9)
+static int		ZipChannelSeek(void *instanceData, long offset,
+			    int mode, int *errloc);
+#endif
 static long long	ZipChannelWideSeek(void *instanceData,
 			    long long offset, int mode, int *errloc);
 static void		ZipChannelWatchChannel(void *instanceData,
@@ -379,23 +397,28 @@ static const Tcl_Filesystem zipfsFilesystem = {
  */
 
 static Tcl_ChannelType ZipChannelType = {
-    "zip",		    /* Type name. */
+    "zip",			/* Type name. */
     TCL_CHANNEL_VERSION_5,
-    TCL_CLOSE2PROC,	    /* Close channel, clean instance data */
-    ZipChannelRead,	    /* Handle read request */
-    ZipChannelWrite,	    /* Handle write request */
-	NULL,		    /* Move location of access point, NULL'able */
-    NULL,		    /* Set options, NULL'able */
-    NULL,		    /* Get options, NULL'able */
-    ZipChannelWatchChannel, /* Initialize notifier */
-    ZipChannelGetFile,	    /* Get OS handle from the channel */
-    ZipChannelClose,	    /* 2nd version of close channel, NULL'able */
-    NULL,		    /* Set blocking mode for raw channel, NULL'able */
-    NULL,		    /* Function to flush channel, NULL'able */
-    NULL,		    /* Function to handle event, NULL'able */
-    ZipChannelWideSeek,	/* Wide seek function, NULL'able */
-    NULL,		    /* Thread action function, NULL'able */
-    NULL,		    /* Truncate function, NULL'able */
+    TCL_CLOSE2PROC,		/* Close channel, clean instance data */
+    ZipChannelRead,		/* Handle read request */
+    ZipChannelWrite,		/* Handle write request */
+#if !defined(TCL_NO_DEPRECATED) && (TCL_MAJOR_VERSION < 9)
+    ZipChannelSeek,		/* Move location of access point, NULL'able */
+#else
+    NULL,			/* Move location of access point, NULL'able */
+#endif
+    NULL,			/* Set options, NULL'able */
+    NULL,			/* Get options, NULL'able */
+    ZipChannelWatchChannel,	/* Initialize notifier */
+    ZipChannelGetFile,		/* Get OS handle from the channel */
+    ZipChannelClose,		/* 2nd version of close channel, NULL'able */
+    NULL,			/* Set blocking mode for raw channel,
+				 * NULL'able */
+    NULL,			/* Function to flush channel, NULL'able */
+    NULL,			/* Function to handle event, NULL'able */
+    ZipChannelWideSeek,		/* Wide seek function, NULL'able */
+    NULL,			/* Thread action function, NULL'able */
+    NULL,			/* Truncate function, NULL'able */
 };
 
 /*
@@ -407,6 +430,79 @@ static Tcl_ChannelType ZipChannelType = {
 /*
  *-------------------------------------------------------------------------
  *
+ * ZipReadInt, ZipReadShort, ZipWriteInt, ZipWriteShort --
+ *
+ *	Inline functions to read and write little-endian 16 and 32 bit
+ *	integers from/to buffers representing parts of ZIP archives.
+ *
+ *	These take bufferStart and bufferEnd pointers, which are used to
+ *	maintain a guarantee that out-of-bounds accesses don't happen when
+ *	reading or writing critical directory structures.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static inline unsigned int
+ZipReadInt(
+    const unsigned char *bufferStart,
+    const unsigned char *bufferEnd,
+    const unsigned char *ptr)
+{
+    if (ptr < bufferStart || ptr + 4 > bufferEnd) {
+	Tcl_Panic("out of bounds read(4): start=%p, end=%p, ptr=%p",
+		bufferStart, bufferEnd, ptr);
+    }
+    return ptr[0] | (ptr[1] << 8) | (ptr[2] << 16) | (ptr[3] << 24);
+}
+
+static inline unsigned short
+ZipReadShort(
+    const unsigned char *bufferStart,
+    const unsigned char *bufferEnd,
+    const unsigned char *ptr)
+{
+    if (ptr < bufferStart || ptr + 2 > bufferEnd) {
+	Tcl_Panic("out of bounds read(2): start=%p, end=%p, ptr=%p",
+		bufferStart, bufferEnd, ptr);
+    }
+    return ptr[0] | (ptr[1] << 8);
+}
+
+static inline void
+ZipWriteInt(
+    const unsigned char *bufferStart,
+    const unsigned char *bufferEnd,
+    unsigned char *ptr,
+    unsigned int value)
+{
+    if (ptr < bufferStart || ptr + 4 > bufferEnd) {
+	Tcl_Panic("out of bounds write(4): start=%p, end=%p, ptr=%p",
+		bufferStart, bufferEnd, ptr);
+    }
+    ptr[0] = value & 0xff;
+    ptr[1] = (value >> 8) & 0xff;
+    ptr[2] = (value >> 16) & 0xff;
+    ptr[3] = (value >> 24) & 0xff;
+}
+
+static inline void
+ZipWriteShort(
+    const unsigned char *bufferStart,
+    const unsigned char *bufferEnd,
+    unsigned char *ptr,
+    unsigned short value)
+{
+    if (ptr < bufferStart || ptr + 2 > bufferEnd) {
+	Tcl_Panic("out of bounds write(2): start=%p, end=%p, ptr=%p",
+		bufferStart, bufferEnd, ptr);
+    }
+    ptr[0] = value & 0xff;
+    ptr[1] = (value >> 8) & 0xff;
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
  * ReadLock, WriteLock, Unlock --
  *
  *	POSIX like rwlock functions to support multiple readers and single
@@ -425,7 +521,7 @@ TCL_DECLARE_MUTEX(ZipFSMutex)
 
 static Tcl_Condition ZipFSCond;
 
-static void
+static inline void
 ReadLock(void)
 {
     Tcl_MutexLock(&ZipFSMutex);
@@ -438,7 +534,7 @@ ReadLock(void)
     Tcl_MutexUnlock(&ZipFSMutex);
 }
 
-static void
+static inline void
 WriteLock(void)
 {
     Tcl_MutexLock(&ZipFSMutex);
@@ -451,7 +547,7 @@ WriteLock(void)
     Tcl_MutexUnlock(&ZipFSMutex);
 }
 
-static void
+static inline void
 Unlock(void)
 {
     Tcl_MutexLock(&ZipFSMutex);
@@ -571,7 +667,7 @@ ToDosDate(
  *-------------------------------------------------------------------------
  */
 
-static int
+static inline int
 CountSlashes(
     const char *string)
 {
@@ -775,7 +871,7 @@ CanonicalPath(
  *-------------------------------------------------------------------------
  */
 
-static ZipEntry *
+static inline ZipEntry *
 ZipFSLookup(
     char *filename)
 {
@@ -792,13 +888,13 @@ ZipFSLookup(
 /*
  *-------------------------------------------------------------------------
  *
- * ZipFSLookupMount --
+ * ZipFSLookupZip --
  *
- *	This function returns an indication if the given file name corresponds
- *	to a mounted ZIP archive file.
+ *	This function gets the structure for a mounted ZIP archive.
  *
  * Results:
- *	Returns true, if the given file name is a mounted ZIP archive file.
+ *	Returns a pointer to the structure, or NULL if the file is ZIP file is
+ *	unknown/not mounted.
  *
  * Side effects:
  *	None.
@@ -806,45 +902,40 @@ ZipFSLookup(
  *-------------------------------------------------------------------------
  */
 
-#ifdef NEVER_USED
-static int
-ZipFSLookupMount(
-    char *filename)
+static inline ZipFile *
+ZipFSLookupZip(
+    const char *mountPoint)
 {
     Tcl_HashEntry *hPtr;
-    Tcl_HashSearch search;
-
-    for (hPtr = Tcl_FirstHashEntry(&ZipFS.zipHash, &search); hPtr;
-	   hPtr = Tcl_NextHashEntry(&search)) {
-	ZipFile *zf = Tcl_GetHashValue(hPtr);
+    ZipFile *zf = NULL;
 
-	if (strcmp(zf->mountPoint, filename) == 0) {
-	    return 1;
-	}
+    hPtr = Tcl_FindHashEntry(&ZipFS.zipHash, mountPoint);
+    if (hPtr) {
+	zf = (ZipFile *) Tcl_GetHashValue(hPtr);
     }
-    return 0;
+    return zf;
 }
-#endif /* NEVER_USED */
 
 /*
  *-------------------------------------------------------------------------
  *
- * AllocateZipFile --
+ * AllocateZipFile, AllocateZipEntry, AllocateZipChannel --
  *
- *	Allocates the memory for a ZipFile structure. Always ensures that it
- *	is zeroed out for safety.
+ *	Allocates the memory for a datastructure. Always ensures that it is
+ *	zeroed out for safety.
  *
  * Returns:
  *	The allocated structure, or NULL if allocate fails.
  *
  * Side effects:
- *	The interpreter result may be written to on error. Which might fail in
- *	a low-memory situation.
+ *	The interpreter result may be written to on error. Which might fail
+ *	(for ZipFile) in a low-memory situation. Always panics if ZipEntry
+ *	allocation fails.
  *
  *-------------------------------------------------------------------------
  */
 
-static ZipFile *
+static inline ZipFile *
 AllocateZipFile(
     Tcl_Interp *interp,
     size_t mountPointNameLength)
@@ -853,15 +944,34 @@ AllocateZipFile(
     ZipFile *zf = (ZipFile *) Tcl_AttemptAlloc(size);
 
     if (!zf) {
-	if (interp) {
-	    Tcl_AppendResult(interp, "out of memory", (char *) NULL);
-	    Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);
-	}
+	ZIPFS_MEM_ERROR(interp);
     } else {
 	memset(zf, 0, size);
     }
     return zf;
 }
+
+static inline ZipEntry *
+AllocateZipEntry(void)
+{
+    ZipEntry *z = (ZipEntry *) Tcl_Alloc(sizeof(ZipEntry));
+    memset(z, 0, sizeof(ZipEntry));
+    return z;
+}
+
+static inline ZipChannel *
+AllocateZipChannel(
+    Tcl_Interp *interp)
+{
+    ZipChannel *zc = (ZipChannel *) Tcl_AttemptAlloc(sizeof(ZipChannel));
+
+    if (!zc) {
+	ZIPFS_MEM_ERROR(interp);
+    } else {
+	memset(zc, 0, sizeof(ZipChannel));
+    }
+    return zc;
+}
 
 /*
  *-------------------------------------------------------------------------
@@ -955,6 +1065,8 @@ ZipFSFindTOC(
 {
     size_t i;
     unsigned char *p, *q;
+    const unsigned char *start = zf->data;
+    const unsigned char *end = zf->data + zf->length;
 
     /*
      * Scan backwards from the end of the file for the signature. This is
@@ -963,9 +1075,9 @@ ZipFSFindTOC(
      */
 
     p = zf->data + zf->length - ZIP_CENTRAL_END_LEN;
-    while (p >= zf->data) {
+    while (p >= start) {
 	if (*p == (ZIP_CENTRAL_END_SIG & 0xFF)) {
-	    if (ZipReadInt(p) == ZIP_CENTRAL_END_SIG) {
+	    if (ZipReadInt(start, end, p) == ZIP_CENTRAL_END_SIG) {
 		break;
 	    }
 	    p -= ZIP_SIG_LEN;
@@ -984,9 +1096,7 @@ ZipFSFindTOC(
 	    return TCL_OK;
 	}
 	ZIPFS_ERROR(interp, "wrong end signature");
-	if (interp) {
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "END_SIG", NULL);
-	}
+	ZIPFS_ERROR_CODE(interp, "END_SIG");
 	goto error;
     }
 
@@ -994,16 +1104,14 @@ ZipFSFindTOC(
      * How many files in the archive? If that's bogus, we're done here.
      */
 
-    zf->numFiles = ZipReadShort(p + ZIP_CENTRAL_ENTS_OFFS);
+    zf->numFiles = ZipReadShort(start, end, p + ZIP_CENTRAL_ENTS_OFFS);
     if (zf->numFiles == 0) {
 	if (!needZip) {
 	    zf->baseOffset = zf->passOffset = zf->length;
 	    return TCL_OK;
 	}
 	ZIPFS_ERROR(interp, "empty archive");
-	if (interp) {
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "EMPTY", NULL);
-	}
+	ZIPFS_ERROR_CODE(interp, "EMPTY");
 	goto error;
     }
 
@@ -1011,8 +1119,8 @@ ZipFSFindTOC(
      * Where does the central directory start?
      */
 
-    q = zf->data + ZipReadInt(p + ZIP_CENTRAL_DIRSTART_OFFS);
-    p -= ZipReadInt(p + ZIP_CENTRAL_DIRSIZE_OFFS);
+    q = zf->data + ZipReadInt(start, end, p + ZIP_CENTRAL_DIRSTART_OFFS);
+    p -= ZipReadInt(start, end, p + ZIP_CENTRAL_DIRSIZE_OFFS);
     if ((p < zf->data) || (p > zf->data + zf->length)
 	    || (q < zf->data) || (q > zf->data + zf->length)) {
 	if (!needZip) {
@@ -1020,9 +1128,7 @@ ZipFSFindTOC(
 	    return TCL_OK;
 	}
 	ZIPFS_ERROR(interp, "archive directory not found");
-	if (interp) {
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "NO_DIR", NULL);
-	}
+	ZIPFS_ERROR_CODE(interp, "NO_DIR");
 	goto error;
     }
 
@@ -1036,23 +1142,19 @@ ZipFSFindTOC(
     for (i = 0; i < zf->numFiles; i++) {
 	int pathlen, comlen, extra;
 
-	if (q + ZIP_CENTRAL_HEADER_LEN > zf->data + zf->length) {
+	if (q + ZIP_CENTRAL_HEADER_LEN > end) {
 	    ZIPFS_ERROR(interp, "wrong header length");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "HDR_LEN", NULL);
-	    }
+	    ZIPFS_ERROR_CODE(interp, "HDR_LEN");
 	    goto error;
 	}
-	if (ZipReadInt(q) != ZIP_CENTRAL_HEADER_SIG) {
+	if (ZipReadInt(start, end, q) != ZIP_CENTRAL_HEADER_SIG) {
 	    ZIPFS_ERROR(interp, "wrong header signature");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "HDR_SIG", NULL);
-	    }
+	    ZIPFS_ERROR_CODE(interp, "HDR_SIG");
 	    goto error;
 	}
-	pathlen = ZipReadShort(q + ZIP_CENTRAL_PATHLEN_OFFS);
-	comlen = ZipReadShort(q + ZIP_CENTRAL_FCOMMENTLEN_OFFS);
-	extra = ZipReadShort(q + ZIP_CENTRAL_EXTRALEN_OFFS);
+	pathlen = ZipReadShort(start, end, q + ZIP_CENTRAL_PATHLEN_OFFS);
+	comlen = ZipReadShort(start, end, q + ZIP_CENTRAL_FCOMMENTLEN_OFFS);
+	extra = ZipReadShort(start, end, q + ZIP_CENTRAL_EXTRALEN_OFFS);
 	q += pathlen + comlen + extra + ZIP_CENTRAL_HEADER_LEN;
     }
 
@@ -1062,7 +1164,8 @@ ZipFSFindTOC(
      */
 
     q = zf->data + zf->baseOffset;
-    if ((zf->baseOffset >= 6) && (ZipReadInt(q - 4) == ZIP_PASSWORD_END_SIG)) {
+    if ((zf->baseOffset >= 6) &&
+	    (ZipReadInt(start, end, q - 4) == ZIP_PASSWORD_END_SIG)) {
 	i = q[-5];
 	if (q - 5 - i > zf->data) {
 	    zf->passBuf[0] = i;
@@ -1159,9 +1262,7 @@ ZipFSOpenArchive(
 	if ((zf->length - ZIP_CENTRAL_END_LEN)
 		> (64 * 1024 * 1024 - ZIP_CENTRAL_END_LEN)) {
 	    ZIPFS_ERROR(interp, "illegal file size");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "FILE_SIZE", NULL);
-	    }
+	    ZIPFS_ERROR_CODE(interp, "FILE_SIZE");
 	    goto error;
 	}
 	if (Tcl_Seek(zf->chan, 0, SEEK_SET) == -1) {
@@ -1170,10 +1271,7 @@ ZipFSOpenArchive(
 	}
 	zf->ptrToFree = zf->data = (unsigned char *) Tcl_AttemptAlloc(zf->length);
 	if (!zf->ptrToFree) {
-	    ZIPFS_ERROR(interp, "out of memory");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);
-	    }
+	    ZIPFS_MEM_ERROR(interp);
 	    goto error;
 	}
 	i = Tcl_Read(zf->chan, (char *) zf->data, zf->length);
@@ -1275,16 +1373,45 @@ ZipMapArchive(
 /*
  *-------------------------------------------------------------------------
  *
- * ZipFSRootNode --
+ * IsPasswordValid --
+ *
+ *	Basic test for whether a passowrd is valid. If the test fails, sets an
+ *	error message in the interpreter.
+ *
+ * Returns:
+ *	TCL_OK if the test passes, TCL_ERROR if it fails.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static inline int
+IsPasswordValid(
+    Tcl_Interp *interp,
+    const char *passwd,
+    int pwlen)
+{
+    if ((pwlen > 255) || strchr(passwd, 0xff)) {
+	ZIPFS_ERROR(interp, "illegal password");
+	ZIPFS_ERROR_CODE(interp, "BAD_PASS");
+	return TCL_ERROR;
+    }
+    return TCL_OK;
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
+ * ZipFSCatalogFilesystem --
  *
- *	This function generates the root node for a ZIPFS filesystem.
+ *	This function generates the root node for a ZIPFS filesystem by
+ *	reading the ZIP's central directory.
  *
  * Results:
  *	TCL_OK on success, TCL_ERROR otherwise with an error message placed
  *	into the given "interp" if it is not NULL.
  *
  * Side effects:
- *	...
+ *	Will acquire and release the write lock.
  *
  *-------------------------------------------------------------------------
  */
@@ -1313,12 +1440,7 @@ ZipFSCatalogFilesystem(
     pwlen = 0;
     if (passwd) {
 	pwlen = strlen(passwd);
-	if ((pwlen > 255) || strchr(passwd, 0xff)) {
-	    if (interp) {
-		Tcl_SetObjResult(interp,
-			Tcl_NewStringObj("illegal password", -1));
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "BAD_PASS", NULL);
-	    }
+	if (IsPasswordValid(interp, passwd, pwlen) != TCL_OK) {
 	    return TCL_ERROR;
 	}
     }
@@ -1327,13 +1449,11 @@ ZipFSCatalogFilesystem(
      * Validate the TOC data. If that's bad, things fall apart.
      */
 
-    if (zf0->baseOffset >= zf0->length ||
-	    zf0->passOffset >= zf0->length ||
-	    zf0->directoryOffset >= zf0->length) {
-	if (interp) {
-	    Tcl_SetObjResult(interp, Tcl_NewStringObj("bad zip data", -1));
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "BAD_ZIP", NULL);
-	}
+    if (zf0->baseOffset < 0 || zf0->baseOffset >= zf0->length ||
+	    zf0->passOffset < 0 || zf0->passOffset >= zf0->length ||
+	    zf0->directoryOffset < 0 || zf0->directoryOffset >= zf0->length) {
+	ZIPFS_ERROR(interp, "bad zip data");
+	ZIPFS_ERROR_CODE(interp, "BAD_ZIP");
 	return TCL_ERROR;
     }
 
@@ -1357,7 +1477,7 @@ ZipFSCatalogFilesystem(
 	    zf = (ZipFile *) Tcl_GetHashValue(hPtr);
 	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
 		    "%s is already mounted on %s", zf->name, mountPoint));
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "MOUNTED", NULL);
+	    ZIPFS_ERROR_CODE(interp, "MOUNTED");
 	}
 	Unlock();
 	ZipFSCloseArchive(interp, zf0);
@@ -1382,9 +1502,6 @@ ZipFSCatalogFilesystem(
     zf->nameLength = strlen(zipname);
     zf->name = (char *) Tcl_Alloc(zf->nameLength + 1);
     memcpy(zf->name, zipname, zf->nameLength + 1);
-    zf->entries = NULL;
-    zf->topEnts = NULL;
-    zf->numOpen = 0;
     Tcl_SetHashValue(hPtr, zf);
     if ((zf->passBuf[0] == 0) && pwlen) {
 	int k = 0;
@@ -1399,20 +1516,14 @@ ZipFSCatalogFilesystem(
     if (mountPoint[0] != '\0') {
 	hPtr = Tcl_CreateHashEntry(&ZipFS.fileHash, mountPoint, &isNew);
 	if (isNew) {
-	    z = (ZipEntry *) Tcl_Alloc(sizeof(ZipEntry));
+	    z = AllocateZipEntry();
 	    Tcl_SetHashValue(hPtr, z);
 
-	    z->tnext = NULL;
 	    z->depth = CountSlashes(mountPoint);
 	    z->zipFilePtr = zf;
 	    z->isDirectory = (zf->baseOffset == 0) ? 1 : -1; /* root marker */
-	    z->isEncrypted = 0;
 	    z->offset = zf->baseOffset;
-	    z->crc32 = 0;
-	    z->timestamp = 0;
-	    z->numBytes = z->numCompressedBytes = 0;
 	    z->compressMethod = ZIP_COMPMETH_STORED;
-	    z->data = NULL;
 	    z->name = (char *) Tcl_GetHashKey(&ZipFS.fileHash, hPtr);
 	    z->next = zf->entries;
 	    zf->entries = z;
@@ -1421,14 +1532,16 @@ ZipFSCatalogFilesystem(
     q = zf->data + zf->directoryOffset;
     Tcl_DStringInit(&fpBuf);
     for (i = 0; i < zf->numFiles; i++) {
+	const unsigned char *start = zf->data;
+	const unsigned char *end = zf->data + zf->length;
 	int extra, isdir = 0, dosTime, dosDate, nbcompr;
 	size_t offs, pathlen, comlen;
 	unsigned char *lq, *gq = NULL;
 	char *fullpath, *path;
 
-	pathlen = ZipReadShort(q + ZIP_CENTRAL_PATHLEN_OFFS);
-	comlen = ZipReadShort(q + ZIP_CENTRAL_FCOMMENTLEN_OFFS);
-	extra = ZipReadShort(q + ZIP_CENTRAL_EXTRALEN_OFFS);
+	pathlen = ZipReadShort(start, end, q + ZIP_CENTRAL_PATHLEN_OFFS);
+	comlen = ZipReadShort(start, end, q + ZIP_CENTRAL_FCOMMENTLEN_OFFS);
+	extra = ZipReadShort(start, end, q + ZIP_CENTRAL_EXTRALEN_OFFS);
 	Tcl_DStringSetLength(&ds, 0);
 	Tcl_DStringAppend(&ds, (char *) q + ZIP_CENTRAL_HEADER_LEN, pathlen);
 	path = Tcl_DStringValue(&ds);
@@ -1441,24 +1554,25 @@ ZipFSCatalogFilesystem(
 	    goto nextent;
 	}
 	lq = zf->data + zf->baseOffset
-		+ ZipReadInt(q + ZIP_CENTRAL_LOCALHDR_OFFS);
-	if ((lq < zf->data) || (lq > zf->data + zf->length)) {
+		+ ZipReadInt(start, end, q + ZIP_CENTRAL_LOCALHDR_OFFS);
+	if ((lq < start) || (lq + ZIP_LOCAL_HEADER_LEN > end)) {
 	    goto nextent;
 	}
-	nbcompr = ZipReadInt(lq + ZIP_LOCAL_COMPLEN_OFFS);
+	nbcompr = ZipReadInt(start, end, lq + ZIP_LOCAL_COMPLEN_OFFS);
 	if (!isdir && (nbcompr == 0)
-		&& (ZipReadInt(lq + ZIP_LOCAL_UNCOMPLEN_OFFS) == 0)
-		&& (ZipReadInt(lq + ZIP_LOCAL_CRC32_OFFS) == 0)) {
+		&& (ZipReadInt(start, end, lq + ZIP_LOCAL_UNCOMPLEN_OFFS) == 0)
+		&& (ZipReadInt(start, end, lq + ZIP_LOCAL_CRC32_OFFS) == 0)) {
 	    gq = q;
-	    nbcompr = ZipReadInt(gq + ZIP_CENTRAL_COMPLEN_OFFS);
+	    nbcompr = ZipReadInt(start, end, gq + ZIP_CENTRAL_COMPLEN_OFFS);
 	}
 	offs = (lq - zf->data)
 		+ ZIP_LOCAL_HEADER_LEN
-		+ ZipReadShort(lq + ZIP_LOCAL_PATHLEN_OFFS)
-		+ ZipReadShort(lq + ZIP_LOCAL_EXTRALEN_OFFS);
+		+ ZipReadShort(start, end, lq + ZIP_LOCAL_PATHLEN_OFFS)
+		+ ZipReadShort(start, end, lq + ZIP_LOCAL_EXTRALEN_OFFS);
 	if (offs + nbcompr > zf->length) {
 	    goto nextent;
 	}
+
 	if (!isdir && (mountPoint[0] == '\0') && !CountSlashes(path)) {
 #ifdef ANDROID
 	    /*
@@ -1474,8 +1588,7 @@ ZipFSCatalogFilesystem(
 	    Tcl_DStringInit(&ds2);
 	    Tcl_DStringAppend(&ds2, "assets/.root/", -1);
 	    Tcl_DStringAppend(&ds2, path, -1);
-	    hPtr = Tcl_FindHashEntry(&ZipFS.fileHash, Tcl_DStringValue(&ds2));
-	    if (hPtr) {
+	    if (ZipFSLookup(Tcl_DStringValue(&ds2))) {
 		/* should not happen but skip it anyway */
 		Tcl_DStringFree(&ds2);
 		goto nextent;
@@ -1492,83 +1605,91 @@ ZipFSCatalogFilesystem(
 	    goto nextent;
 #endif /* ANDROID */
 	}
+
 	Tcl_DStringSetLength(&fpBuf, 0);
 	fullpath = CanonicalPath(mountPoint, path, &fpBuf, 1);
-	z = (ZipEntry *) Tcl_Alloc(sizeof(ZipEntry));
-	z->name = NULL;
-	z->tnext = NULL;
+	z = AllocateZipEntry();
 	z->depth = CountSlashes(fullpath);
 	z->zipFilePtr = zf;
 	z->isDirectory = isdir;
-	z->isEncrypted = (ZipReadShort(lq + ZIP_LOCAL_FLAGS_OFFS) & 1)
+	z->isEncrypted =
+		(ZipReadShort(start, end, lq + ZIP_LOCAL_FLAGS_OFFS) & 1)
 		&& (nbcompr > 12);
 	z->offset = offs;
 	if (gq) {
-	    z->crc32 = ZipReadInt(gq + ZIP_CENTRAL_CRC32_OFFS);
-	    dosDate = ZipReadShort(gq + ZIP_CENTRAL_MDATE_OFFS);
-	    dosTime = ZipReadShort(gq + ZIP_CENTRAL_MTIME_OFFS);
+	    z->crc32 = ZipReadInt(start, end, gq + ZIP_CENTRAL_CRC32_OFFS);
+	    dosDate = ZipReadShort(start, end, gq + ZIP_CENTRAL_MDATE_OFFS);
+	    dosTime = ZipReadShort(start, end, gq + ZIP_CENTRAL_MTIME_OFFS);
 	    z->timestamp = DosTimeDate(dosDate, dosTime);
-	    z->numBytes = ZipReadInt(gq + ZIP_CENTRAL_UNCOMPLEN_OFFS);
-	    z->compressMethod = ZipReadShort(gq + ZIP_CENTRAL_COMPMETH_OFFS);
+	    z->numBytes = ZipReadInt(start, end,
+		    gq + ZIP_CENTRAL_UNCOMPLEN_OFFS);
+	    z->compressMethod = ZipReadShort(start, end,
+		    gq + ZIP_CENTRAL_COMPMETH_OFFS);
 	} else {
-	    z->crc32 = ZipReadInt(lq + ZIP_LOCAL_CRC32_OFFS);
-	    dosDate = ZipReadShort(lq + ZIP_LOCAL_MDATE_OFFS);
-	    dosTime = ZipReadShort(lq + ZIP_LOCAL_MTIME_OFFS);
+	    z->crc32 = ZipReadInt(start, end, lq + ZIP_LOCAL_CRC32_OFFS);
+	    dosDate = ZipReadShort(start, end, lq + ZIP_LOCAL_MDATE_OFFS);
+	    dosTime = ZipReadShort(start, end, lq + ZIP_LOCAL_MTIME_OFFS);
 	    z->timestamp = DosTimeDate(dosDate, dosTime);
-	    z->numBytes = ZipReadInt(lq + ZIP_LOCAL_UNCOMPLEN_OFFS);
-	    z->compressMethod = ZipReadShort(lq + ZIP_LOCAL_COMPMETH_OFFS);
+	    z->numBytes = ZipReadInt(start, end,
+		    lq + ZIP_LOCAL_UNCOMPLEN_OFFS);
+	    z->compressMethod = ZipReadShort(start, end,
+		    lq + ZIP_LOCAL_COMPMETH_OFFS);
 	}
 	z->numCompressedBytes = nbcompr;
-	z->data = NULL;
 	hPtr = Tcl_CreateHashEntry(&ZipFS.fileHash, fullpath, &isNew);
 	if (!isNew) {
 	    /* should not happen but skip it anyway */
 	    Tcl_Free(z);
-	} else {
-	    Tcl_SetHashValue(hPtr, z);
-	    z->name = (char *) Tcl_GetHashKey(&ZipFS.fileHash, hPtr);
-	    z->next = zf->entries;
-	    zf->entries = z;
-	    if (isdir && (mountPoint[0] == '\0') && (z->depth == 1)) {
-		z->tnext = zf->topEnts;
-		zf->topEnts = z;
-	    }
-	    if (!z->isDirectory && (z->depth > 1)) {
-		char *dir, *end;
-		ZipEntry *zd;
-
-		Tcl_DStringSetLength(&ds, strlen(z->name) + 8);
-		Tcl_DStringSetLength(&ds, 0);
-		Tcl_DStringAppend(&ds, z->name, -1);
-		dir = Tcl_DStringValue(&ds);
-		for (end = strrchr(dir, '/'); end && (end != dir);
-			end = strrchr(dir, '/')) {
-		    Tcl_DStringSetLength(&ds, end - dir);
-		    hPtr = Tcl_CreateHashEntry(&ZipFS.fileHash, dir, &isNew);
-		    if (!isNew) {
-			break;
-		    }
-		    zd = (ZipEntry *) Tcl_Alloc(sizeof(ZipEntry));
-		    zd->name = NULL;
-		    zd->tnext = NULL;
-		    zd->depth = CountSlashes(dir);
-		    zd->zipFilePtr = zf;
-		    zd->isDirectory = 1;
-		    zd->isEncrypted = 0;
-		    zd->offset = z->offset;
-		    zd->crc32 = 0;
-		    zd->timestamp = z->timestamp;
-		    zd->numBytes = zd->numCompressedBytes = 0;
-		    zd->compressMethod = ZIP_COMPMETH_STORED;
-		    zd->data = NULL;
-		    Tcl_SetHashValue(hPtr, zd);
-		    zd->name = (char *) Tcl_GetHashKey(&ZipFS.fileHash, hPtr);
-		    zd->next = zf->entries;
-		    zf->entries = zd;
-		    if ((mountPoint[0] == '\0') && (zd->depth == 1)) {
-			zd->tnext = zf->topEnts;
-			zf->topEnts = zd;
-		    }
+	    goto nextent;
+	}
+
+	Tcl_SetHashValue(hPtr, z);
+	z->name = (char *) Tcl_GetHashKey(&ZipFS.fileHash, hPtr);
+	z->next = zf->entries;
+	zf->entries = z;
+	if (isdir && (mountPoint[0] == '\0') && (z->depth == 1)) {
+	    z->tnext = zf->topEnts;
+	    zf->topEnts = z;
+	}
+
+	/*
+	 * Make any directory nodes we need. ZIPs are not consistent about
+	 * containing directory nodes.
+	 */
+
+	if (!z->isDirectory && (z->depth > 1)) {
+	    char *dir, *endPtr;
+	    ZipEntry *zd;
+
+	    Tcl_DStringSetLength(&ds, strlen(z->name) + 8);
+	    Tcl_DStringSetLength(&ds, 0);
+	    Tcl_DStringAppend(&ds, z->name, -1);
+	    dir = Tcl_DStringValue(&ds);
+	    for (endPtr = strrchr(dir, '/'); endPtr && (endPtr != dir);
+		    endPtr = strrchr(dir, '/')) {
+		Tcl_DStringSetLength(&ds, endPtr - dir);
+		hPtr = Tcl_CreateHashEntry(&ZipFS.fileHash, dir, &isNew);
+		if (!isNew) {
+		    /*
+		     * Already made. That's fine.
+		     */
+		    break;
+		}
+
+		zd = AllocateZipEntry();
+		zd->depth = CountSlashes(dir);
+		zd->zipFilePtr = zf;
+		zd->isDirectory = 1;
+		zd->offset = z->offset;
+		zd->timestamp = z->timestamp;
+		zd->compressMethod = ZIP_COMPMETH_STORED;
+		Tcl_SetHashValue(hPtr, zd);
+		zd->name = (char *) Tcl_GetHashKey(&ZipFS.fileHash, hPtr);
+		zd->next = zf->entries;
+		zf->entries = zd;
+		if ((mountPoint[0] == '\0') && (zd->depth == 1)) {
+		    zd->tnext = zf->topEnts;
+		    zf->topEnts = zd;
 		}
 	    }
 	}
@@ -1679,13 +1800,10 @@ DescribeMounted(
     Tcl_Interp *interp,
     const char *mountPoint)
 {
-    Tcl_HashEntry *hPtr;
-    ZipFile *zf;
-
     if (interp) {
-	hPtr = Tcl_FindHashEntry(&ZipFS.zipHash, mountPoint);
-	if (hPtr) {
-	    zf = (ZipFile *) Tcl_GetHashValue(hPtr);
+	ZipFile *zf = ZipFSLookupZip(mountPoint);
+
+	if (zf) {
 	    Tcl_SetObjResult(interp, Tcl_NewStringObj(zf->name, -1));
 	    return TCL_OK;
 	}
@@ -1753,15 +1871,8 @@ TclZipfs_Mount(
      * Have both a mount point and a file (name) to mount there.
      */
 
-    if (passwd) {
-	if ((strlen(passwd) > 255) || strchr(passwd, 0xff)) {
-	    if (interp) {
-		Tcl_SetObjResult(interp,
-			Tcl_NewStringObj("illegal password", -1));
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "BAD_PASS", NULL);
-	    }
-	    return TCL_ERROR;
-	}
+    if (passwd && IsPasswordValid(interp, passwd, strlen(passwd)) != TCL_OK) {
+	return TCL_ERROR;
     }
     zf = AllocateZipFile(interp, strlen(mountPoint));
     if (!zf) {
@@ -1849,10 +1960,7 @@ TclZipfs_MountBuffer(
     if (copy) {
 	zf->data = (unsigned char *) Tcl_AttemptAlloc(datalen);
 	if (!zf->data) {
-	    if (interp) {
-		Tcl_AppendResult(interp, "out of memory", (char *) NULL);
-		Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);
-	    }
+	    ZIPFS_MEM_ERROR(interp);
 	    return TCL_ERROR;
 	}
 	memcpy(zf->data, data, datalen);
@@ -1920,10 +2028,17 @@ TclZipfs_Unmount(
     zf = (ZipFile *) Tcl_GetHashValue(hPtr);
     if (zf->numOpen > 0) {
 	ZIPFS_ERROR(interp, "filesystem is busy");
+	ZIPFS_ERROR_CODE(interp, "BUSY");
 	ret = TCL_ERROR;
 	goto done;
     }
     Tcl_DeleteHashEntry(hPtr);
+
+    /*
+     * Now no longer mounted - the rest of the code won't find it - but we're
+     * still cleaning things up.
+     */
+
     for (z = zf->entries; z; z = znext) {
 	znext = z->next;
 	hPtr = Tcl_FindHashEntry(&ZipFS.fileHash, z->name);
@@ -1939,6 +2054,7 @@ TclZipfs_Unmount(
     Tcl_DeleteExitHandler(ZipfsExitHandler, zf);
     Tcl_Free(zf);
     unmounted = 1;
+
   done:
     Unlock();
     if (unmounted) {
@@ -2153,8 +2269,7 @@ ZipFSMkKeyObjCmd(
     if (len == 0) {
 	return TCL_OK;
     }
-    if ((len > 255) || strchr(pw, 0xff)) {
-	Tcl_SetObjResult(interp, Tcl_NewStringObj("illegal password", -1));
+    if (IsPasswordValid(interp, pw, len) != TCL_OK) {
 	return TCL_ERROR;
     }
     while (len > 0) {
@@ -2178,9 +2293,53 @@ ZipFSMkKeyObjCmd(
 /*
  *-------------------------------------------------------------------------
  *
+ * RandomChar --
+ *
+ *	Worker for ZipAddFile().  Picks a random character (range: 0..255)
+ *	using Tcl's standard PRNG.
+ *
+ * Returns:
+ *	Tcl result code. Updates chPtr with random character on success.
+ *
+ * Side effects:
+ *	Advances the PRNG state. May reenter the Tcl interpreter if the user
+ *	has replaced the PRNG.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static int
+RandomChar(
+    Tcl_Interp *interp,
+    int step,
+    int *chPtr)
+{
+    double r;
+    Tcl_Obj *ret;
+
+    if (Tcl_EvalEx(interp, "::tcl::mathfunc::rand", -1, 0) != TCL_OK) {
+	goto failed;
+    }
+    ret = Tcl_GetObjResult(interp);
+    if (Tcl_GetDoubleFromObj(interp, ret, &r) != TCL_OK) {
+	goto failed;
+    }
+    *chPtr = (int) (r * 256);
+    return TCL_OK;
+
+  failed:
+    Tcl_AppendObjToErrorInfo(interp, Tcl_ObjPrintf(
+	    "\n    (evaluating PRNG step %d for password encoding)",
+	    step));
+    return TCL_ERROR;
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
  * ZipAddFile --
  *
- *	This procedure is used by ZipFSMkZipOrImgCmd() to add a single file to
+ *	This procedure is used by ZipFSMkZipOrImg() to add a single file to
  *	the output ZIP archive file being written. A ZipEntry struct about the
  *	input file is added to the given fileHash table for later creation of
  *	the central ZIP directory.
@@ -2198,15 +2357,18 @@ ZipFSMkKeyObjCmd(
 static int
 ZipAddFile(
     Tcl_Interp *interp,		/* Current interpreter. */
-    const char *path,
-    const char *name,
-    Tcl_Channel out,
+    Tcl_Obj *pathObj,		/* Actual name of the file to add. */
+    const char *name,		/* Name to use in the ZIP archive. */
+    Tcl_Channel out,		/* The open ZIP archive being built. */
     const char *passwd,		/* Password for encoding the file, or NULL if
 				 * the file is to be unprotected. */
-    char *buf,
-    int bufsize,
-    Tcl_HashTable *fileHash)
+    char *buf,			/* Working buffer. */
+    int bufsize,		/* Size of buf */
+    Tcl_HashTable *fileHash)	/* Where to record ZIP entry metdata so we can
+				 * built the central directory. */
 {
+    const unsigned char *start = (unsigned char *) buf;
+    const unsigned char *end = (unsigned char *) buf + bufsize;
     Tcl_Channel in;
     Tcl_HashEntry *hPtr;
     ZipEntry *z;
@@ -2235,11 +2397,11 @@ ZipAddFile(
     zpathlen = strlen(zpath);
     if (zpathlen + ZIP_CENTRAL_HEADER_LEN > bufsize) {
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		"path too long for \"%s\"", path));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "PATH_LEN", NULL);
+		"path too long for \"%s\"", TclGetString(pathObj)));
+	ZIPFS_ERROR_CODE(interp, "PATH_LEN");
 	return TCL_ERROR;
     }
-    in = Tcl_OpenFileChannel(interp, path, "rb", 0);
+    in = Tcl_FSOpenFileChannel(interp, pathObj, "rb", 0);
     if (!in) {
 #ifdef _WIN32
 	/* hopefully a directory */
@@ -2251,16 +2413,18 @@ ZipAddFile(
 	Tcl_Close(interp, in);
 	return TCL_ERROR;
     } else {
-	Tcl_Obj *pathObj = Tcl_NewStringObj(path, -1);
 	Tcl_StatBuf statBuf;
 
-	Tcl_IncrRefCount(pathObj);
 	if (Tcl_FSStat(pathObj, &statBuf) != -1) {
 	    mtime = statBuf.st_mtime;
 	}
-	Tcl_DecrRefCount(pathObj);
     }
     Tcl_ResetResult(interp);
+
+    /*
+     * Compute the CRC.
+     */
+
     crc = 0;
     nbyte = nbytecompr = 0;
     while (1) {
@@ -2270,8 +2434,9 @@ ZipAddFile(
 		Tcl_Close(interp, in);
 		return TCL_OK;
 	    }
+	readErrorWithChannelOpen:
 	    Tcl_SetObjResult(interp, Tcl_ObjPrintf("read error on \"%s\": %s",
-		    path, Tcl_PosixError(interp)));
+		    TclGetString(pathObj), Tcl_PosixError(interp)));
 	    Tcl_Close(interp, in);
 	    return TCL_ERROR;
 	}
@@ -2283,66 +2448,68 @@ ZipAddFile(
     }
     if (Tcl_Seek(in, 0, SEEK_SET) == -1) {
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf("seek error on \"%s\": %s",
-		path, Tcl_PosixError(interp)));
+		TclGetString(pathObj), Tcl_PosixError(interp)));
 	Tcl_Close(interp, in);
 	return TCL_ERROR;
     }
+
+    /*
+     * Remember where we've got to so far so we can write the header (after
+     * writing the file).
+     */
+
     headerStartOffset = Tcl_Tell(out);
+
+    /*
+     * Reserve space for the per-file header. Includes writing the file name
+     * as we already know that.
+     */
+
     memset(buf, '\0', ZIP_LOCAL_HEADER_LEN);
     memcpy(buf + ZIP_LOCAL_HEADER_LEN, zpath, zpathlen);
     len = zpathlen + ZIP_LOCAL_HEADER_LEN;
     if ((size_t) Tcl_Write(out, buf, len) != len) {
-    wrerr:
+    writeErrorWithChannelOpen:
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		"write error on %s: %s", path, Tcl_PosixError(interp)));
+		"write error on \"%s\": %s",
+		TclGetString(pathObj), Tcl_PosixError(interp)));
 	Tcl_Close(interp, in);
 	return TCL_ERROR;
     }
+
+    /*
+     * Align payload to next 4-byte boundary (if necessary) using a dummy
+     * extra entry similar to the zipalign tool from Android's SDK.
+     */
+
     if ((len + headerStartOffset) & 3) {
 	unsigned char abuf[8];
-
-	/*
-	 * Align payload to next 4-byte boundary using a dummy extra entry
-	 * similar to the zipalign tool from Android's SDK.
-	 */
+	const unsigned char *astart = abuf;
+	const unsigned char *aend = abuf + 8;
 
 	align = 4 + ((len + headerStartOffset) & 3);
-	ZipWriteShort(abuf, 0xffff);
-	ZipWriteShort(abuf + 2, align - 4);
-	ZipWriteInt(abuf + 4, 0x03020100);
+	ZipWriteShort(astart, aend, abuf, 0xffff);
+	ZipWriteShort(astart, aend, abuf + 2, align - 4);
+	ZipWriteInt(astart, aend, abuf + 4, 0x03020100);
 	if ((size_t) Tcl_Write(out, (const char *) abuf, align) != align) {
-	    goto wrerr;
+	    goto writeErrorWithChannelOpen;
 	}
     }
+
+    /*
+     * Set up encryption if we were asked to.
+     */
+
     if (passwd) {
 	int i, ch, tmp;
 	unsigned char kvbuf[24];
-	Tcl_Obj *ret;
 
 	init_keys(passwd, keys, crc32tab);
 	for (i = 0; i < 12 - 2; i++) {
-	    double r;
-
-	    if (Tcl_EvalEx(interp, "::tcl::mathfunc::rand", -1, 0) != TCL_OK) {
-		Tcl_Obj *eiPtr = Tcl_ObjPrintf(
-			"\n    (evaluating PRNG step %d for password encoding)",
-			i);
-
-		Tcl_AppendObjToErrorInfo(interp, eiPtr);
-		Tcl_Close(interp, in);
-		return TCL_ERROR;
-	    }
-	    ret = Tcl_GetObjResult(interp);
-	    if (Tcl_GetDoubleFromObj(interp, ret, &r) != TCL_OK) {
-		Tcl_Obj *eiPtr = Tcl_ObjPrintf(
-			"\n    (evaluating PRNG step %d for password encoding)",
-			i);
-
-		Tcl_AppendObjToErrorInfo(interp, eiPtr);
+	    if (RandomChar(interp, i, &ch) != TCL_OK) {
 		Tcl_Close(interp, in);
 		return TCL_ERROR;
 	    }
-	    ch = (int) (r * 256);
 	    kvbuf[i + 12] = UCHAR(zencode(keys, crc32tab, ch, tmp));
 	}
 	Tcl_ResetResult(interp);
@@ -2355,16 +2522,23 @@ ZipAddFile(
 	len = Tcl_Write(out, (char *) kvbuf, 12);
 	memset(kvbuf, 0, 24);
 	if (len != 12) {
-	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		    "write error on %s: %s", path, Tcl_PosixError(interp)));
-	    Tcl_Close(interp, in);
-	    return TCL_ERROR;
+	    goto writeErrorWithChannelOpen;
 	}
 	memcpy(keys0, keys, sizeof(keys0));
 	nbytecompr += 12;
     }
+
+    /*
+     * Save where we've got to in case we need to just store this file.
+     */
+
     Tcl_Flush(out);
     dataStartOffset = Tcl_Tell(out);
+
+    /*
+     * Compress the stream.
+     */
+
     compMeth = ZIP_COMPMETH_DEFLATED;
     memset(&stream, 0, sizeof(z_stream));
     stream.zalloc = Z_NULL;
@@ -2373,19 +2547,17 @@ ZipAddFile(
     if (deflateInit2(&stream, 9, Z_DEFLATED, -15, 8,
 	    Z_DEFAULT_STRATEGY) != Z_OK) {
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		"compression init error on \"%s\"", path));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "DEFLATE_INIT", NULL);
+		"compression init error on \"%s\"", TclGetString(pathObj)));
+	ZIPFS_ERROR_CODE(interp, "DEFLATE_INIT");
 	Tcl_Close(interp, in);
 	return TCL_ERROR;
     }
+
     do {
 	len = Tcl_Read(in, buf, bufsize);
 	if (len == ERROR_LENGTH) {
-	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		    "read error on %s: %s", path, Tcl_PosixError(interp)));
 	    deflateEnd(&stream);
-	    Tcl_Close(interp, in);
-	    return TCL_ERROR;
+	    goto readErrorWithChannelOpen;
 	}
 	stream.avail_in = len;
 	stream.next_in = (unsigned char *) buf;
@@ -2396,8 +2568,8 @@ ZipAddFile(
 	    len = deflate(&stream, flush);
 	    if (len == (size_t) Z_STREAM_ERROR) {
 		Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-			"deflate error on %s", path));
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "DEFLATE", NULL);
+			"deflate error on \"%s\"", TclGetString(pathObj)));
+		ZIPFS_ERROR_CODE(interp, "DEFLATE");
 		deflateEnd(&stream);
 		Tcl_Close(interp, in);
 		return TCL_ERROR;
@@ -2412,18 +2584,21 @@ ZipAddFile(
 		}
 	    }
 	    if (olen && ((size_t) Tcl_Write(out, obuf, olen) != olen)) {
-		Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-			"write error: %s", Tcl_PosixError(interp)));
 		deflateEnd(&stream);
-		Tcl_Close(interp, in);
-		return TCL_ERROR;
+		goto writeErrorWithChannelOpen;
 	    }
 	    nbytecompr += olen;
 	} while (stream.avail_out == 0);
     } while (flush != Z_FINISH);
     deflateEnd(&stream);
+
+    /*
+     * Work out where we've got to.
+     */
+
     Tcl_Flush(out);
     dataEndOffset = Tcl_Tell(out);
+
     if (nbyte - nbytecompr <= 0) {
 	/*
 	 * Compressed file larger than input, write it again uncompressed.
@@ -2434,20 +2609,16 @@ ZipAddFile(
 	}
 	if (Tcl_Seek(out, dataStartOffset, SEEK_SET) != dataStartOffset) {
 	seekErr:
-	    Tcl_Close(interp, in);
 	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
 		    "seek error: %s", Tcl_PosixError(interp)));
+	    Tcl_Close(interp, in);
 	    return TCL_ERROR;
 	}
 	nbytecompr = (passwd ? 12 : 0);
 	while (1) {
 	    len = Tcl_Read(in, buf, bufsize);
 	    if (len == ERROR_LENGTH) {
-		Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-			"read error on \"%s\": %s",
-			path, Tcl_PosixError(interp)));
-		Tcl_Close(interp, in);
-		return TCL_ERROR;
+		goto readErrorWithChannelOpen;
 	    } else if (len == 0) {
 		break;
 	    }
@@ -2460,14 +2631,17 @@ ZipAddFile(
 		}
 	    }
 	    if ((size_t) Tcl_Write(out, buf, len) != len) {
-		Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-			"write error: %s", Tcl_PosixError(interp)));
-		Tcl_Close(interp, in);
-		return TCL_ERROR;
+		goto writeErrorWithChannelOpen;
 	    }
 	    nbytecompr += len;
 	}
 	compMeth = ZIP_COMPMETH_STORED;
+
+	/*
+	 * Chop off everything after this; it's the over-large compressed data
+	 * and we don't know if it is going to get overwritten otherwise.
+	 */
+
 	Tcl_Flush(out);
 	dataEndOffset = Tcl_Tell(out);
 	Tcl_TruncateChannel(out, dataEndOffset);
@@ -2477,18 +2651,19 @@ ZipAddFile(
     hPtr = Tcl_CreateHashEntry(fileHash, zpath, &isNew);
     if (!isNew) {
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		"non-unique path name \"%s\"", path));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "DUPLICATE_PATH", NULL);
+		"non-unique path name \"%s\"", TclGetString(pathObj)));
+	ZIPFS_ERROR_CODE(interp, "DUPLICATE_PATH");
 	return TCL_ERROR;
     }
 
-    z = (ZipEntry *) Tcl_Alloc(sizeof(ZipEntry));
+    /*
+     * Remember that we've written the file (for central directory generation)
+     * and generate the local (per-file) header in the space that we reserved
+     * earlier.
+     */
+
+    z = AllocateZipEntry();
     Tcl_SetHashValue(hPtr, z);
-    z->name = NULL;
-    z->tnext = NULL;
-    z->depth = 0;
-    z->zipFilePtr = NULL;
-    z->isDirectory = 0;
     z->isEncrypted = (passwd ? 1 : 0);
     z->offset = headerStartOffset;
     z->crc32 = crc;
@@ -2496,15 +2671,14 @@ ZipAddFile(
     z->numBytes = nbyte;
     z->numCompressedBytes = nbytecompr;
     z->compressMethod = compMeth;
-    z->data = NULL;
     z->name = (char *) Tcl_GetHashKey(fileHash, hPtr);
-    z->next = NULL;
 
     /*
      * Write final local header information.
      */
 
-    SerializeLocalEntryHeader(buf, z, zpathlen, align);
+    SerializeLocalEntryHeader(start, end, (unsigned char *) buf, z,
+	    zpathlen, align);
     if (Tcl_Seek(out, headerStartOffset, SEEK_SET) != headerStartOffset) {
 	Tcl_DeleteHashEntry(hPtr);
 	Tcl_Free(z);
@@ -2533,12 +2707,96 @@ ZipAddFile(
 /*
  *-------------------------------------------------------------------------
  *
- * ZipFSMkZipOrImgObjCmd --
+ * ZipFSFind --
+ *
+ *	Worker for ZipFSMkZipOrImg() that discovers the list of files to add.
+ *	Simple wrapper around [zipfs find].
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static Tcl_Obj *
+ZipFSFind(
+    Tcl_Interp *interp,
+    Tcl_Obj *dirRoot)
+{
+    Tcl_Obj *cmd[2];
+    int result;
+
+    cmd[0] = Tcl_NewStringObj("::tcl::zipfs::find", -1);
+    cmd[1] = dirRoot;
+    Tcl_IncrRefCount(cmd[0]);
+    result = Tcl_EvalObjv(interp, 2, cmd, 0);
+    Tcl_DecrRefCount(cmd[0]);
+    if (result != TCL_OK) {
+	return NULL;
+    }
+    return Tcl_GetObjResult(interp);
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
+ * ComputeNameInArchive --
+ *
+ *	Helper for ZipFSMkZipOrImg() that computes what the actual name of a
+ *	file in the ZIP archive should be, stripping a prefix (if appropriate)
+ *	and any leading slashes. If the result is an empty string, the entry
+ *	should be skipped.
+ *
+ * Returns:
+ *	Pointer to the name, which will be in memory owned by one of the
+ *	argument objects.
+ *
+ * Side effects:
+ *	None (if Tcl_Objs have string representations)
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static inline const char *
+ComputeNameInArchive(
+    Tcl_Obj *pathObj,		/* The path to the origin file */
+    Tcl_Obj *directNameObj,	/* User-specified name for use in the ZIP
+				 * archive */
+    const char *strip,		/* A prefix to strip */
+    int slen)			/* The length of the prefix */
+{
+    const char *name;
+    int len;
+
+    if (directNameObj) {
+	name = TclGetString(directNameObj);
+    } else {
+	name = TclGetStringFromObj(pathObj, &len);
+	if (slen > 0) {
+	    if ((len <= slen) || (strncmp(strip, name, slen) != 0)) {
+		/*
+		 * Guaranteed to be a NUL at the end, which will make this
+		 * entry be skipped.
+		 */
+
+		return name + len;
+	    }
+	    name += slen;
+	}
+    }
+    while (name[0] == '/') {
+	++name;
+    }
+    return name;
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
+ * ZipFSMkZipOrImg --
  *
  *	This procedure is creates a new ZIP archive file or image file given
  *	output filename, input directory of files to be archived, optional
  *	password, and optional image to be prepended to the output ZIP archive
- *	file.
+ *	file. It's the core of the implementation of [zipfs mkzip], [zipfs
+ *	mkimg], [zipfs lmkzip] and [zipfs lmkimg].
  *
  * Results:
  *	A standard Tcl result.
@@ -2550,15 +2808,24 @@ ZipAddFile(
  */
 
 static int
-ZipFSMkZipOrImgObjCmd(
+ZipFSMkZipOrImg(
     Tcl_Interp *interp,		/* Current interpreter. */
-    int isImg,
-    Tcl_Obj *targetFile,
-    Tcl_Obj *dirRoot,
-    Tcl_Obj *mappingList,
-    Tcl_Obj *originFile,
-    Tcl_Obj *stripPrefix,
-    Tcl_Obj *passwordObj)
+    int isImg,			/* Are we making an image? */
+    Tcl_Obj *targetFile,	/* What file are we making? */
+    Tcl_Obj *dirRoot,		/* What directory do we take files from? Do
+				 * not specify at the same time as
+				 * mappingList (one must be NULL). */
+    Tcl_Obj *mappingList,	/* What files are we putting in, and with what
+				 * names? Do not specify at the same time as
+				 * dirRoot (one must be NULL). */
+    Tcl_Obj *originFile,	/* If we're making an image, what file does
+				 * the non-ZIP part of the image come from? */
+    Tcl_Obj *stripPrefix,	/* Are we going to strip a prefix from
+				 * filenames found beneath dirRoot? If NULL,
+				 * do not strip anything (except for dirRoot
+				 * itself). */
+    Tcl_Obj *passwordObj)	/* The password for encoding things. NULL if
+				 * there's no password protection. */
 {
     Tcl_Channel out;
     int pwlen = 0, slen = 0, count, ret = TCL_ERROR, lobjc;
@@ -2577,6 +2844,8 @@ ZipFSMkZipOrImgObjCmd(
     Tcl_HashSearch search;
     Tcl_HashTable fileHash;
     char *strip = NULL, *pw = NULL, passBuf[264], buf[4096];
+    unsigned char *start = (unsigned char *) buf;
+    unsigned char *end = start + sizeof(buf);
 
     /*
      * Caller has verified that the number of arguments is correct.
@@ -2584,31 +2853,20 @@ ZipFSMkZipOrImgObjCmd(
 
     passBuf[0] = 0;
     if (passwordObj != NULL) {
-	pw = Tcl_GetStringFromObj(passwordObj, &pwlen);
-	if ((pwlen > 255) || strchr(pw, 0xff)) {
-	    Tcl_SetObjResult(interp,
-		    Tcl_NewStringObj("illegal password", -1));
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "BAD_PASS", NULL);
+	pw = TclGetStringFromObj(passwordObj, &pwlen);
+	if (IsPasswordValid(interp, pw, pwlen) != TCL_OK) {
 	    return TCL_ERROR;
 	}
+	if (pwlen <= 0) {
+	    pw = NULL;
+	    pwlen = 0;
+	}
     }
     if (dirRoot != NULL) {
-	Tcl_Obj *cmd[2];
-	int result;
-
-	/*
-	 * Discover the list of files to add.
-	 */
-
-	cmd[0] = Tcl_NewStringObj("::tcl::zipfs::find", -1);
-	cmd[1] = dirRoot;
-	Tcl_IncrRefCount(cmd[0]);
-	result = Tcl_EvalObjv(interp, 2, cmd, 0);
-	Tcl_DecrRefCount(cmd[0]);
-	if (result != TCL_OK) {
+	list = ZipFSFind(interp, dirRoot);
+	if (!list) {
 	    return TCL_ERROR;
 	}
-	list = Tcl_GetObjResult(interp);
     }
     Tcl_IncrRefCount(list);
     if (Tcl_ListObjGetElements(interp, list, &lobjc, &lobjv) != TCL_OK) {
@@ -2617,26 +2875,21 @@ ZipFSMkZipOrImgObjCmd(
     }
     if (mappingList && (lobjc % 2)) {
 	Tcl_DecrRefCount(list);
-	Tcl_SetObjResult(interp,
-		Tcl_NewStringObj("need even number of elements", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "LIST_LENGTH", NULL);
+	ZIPFS_ERROR(interp, "need even number of elements");
+	ZIPFS_ERROR_CODE(interp, "LIST_LENGTH");
 	return TCL_ERROR;
     }
     if (lobjc == 0) {
 	Tcl_DecrRefCount(list);
-	Tcl_SetObjResult(interp, Tcl_NewStringObj("empty archive", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "EMPTY", NULL);
+	ZIPFS_ERROR(interp, "empty archive");
+	ZIPFS_ERROR_CODE(interp, "EMPTY");
 	return TCL_ERROR;
     }
-    out = Tcl_OpenFileChannel(interp, TclGetString(targetFile), "wb", 0755);
+    out = Tcl_FSOpenFileChannel(interp, targetFile, "wb", 0755);
     if (out == NULL) {
 	Tcl_DecrRefCount(list);
 	return TCL_ERROR;
     }
-    if (pwlen <= 0) {
-	pw = NULL;
-	pwlen = 0;
-    }
 
     /*
      * Copy the existing contents from the image if it is an executable image.
@@ -2756,32 +3009,17 @@ ZipFSMkZipOrImgObjCmd(
     Tcl_InitHashTable(&fileHash, TCL_STRING_KEYS);
     dataStartOffset = Tcl_Tell(out);
     if (mappingList == NULL && stripPrefix != NULL) {
-	strip = Tcl_GetStringFromObj(stripPrefix, &slen);
+	strip = TclGetStringFromObj(stripPrefix, &slen);
     }
     for (i = 0; i < (size_t) lobjc; i += (mappingList ? 2 : 1)) {
-	const char *path, *name;
+	Tcl_Obj *pathObj = lobjv[i];
+	const char *name = ComputeNameInArchive(pathObj,
+		(mappingList ? lobjv[i + 1] : NULL), strip, slen);
 
-	path = TclGetString(lobjv[i]);
-	if (mappingList) {
-	    name = TclGetString(lobjv[i + 1]);
-	} else {
-	    name = path;
-	    if (slen > 0) {
-		len = strlen(name);
-		if ((len <= (size_t) slen) ||
-			(strncmp(strip, name, slen) != 0)) {
-		    continue;
-		}
-		name += slen;
-	    }
-	}
-	while (name[0] == '/') {
-	    ++name;
-	}
 	if (name[0] == '\0') {
 	    continue;
 	}
-	if (ZipAddFile(interp, path, name, out, pw, buf, sizeof(buf),
+	if (ZipAddFile(interp, pathObj, name, out, pw, buf, sizeof(buf),
 		&fileHash) != TCL_OK) {
 	    goto done;
 	}
@@ -2794,25 +3032,9 @@ ZipFSMkZipOrImgObjCmd(
     directoryStartOffset = Tcl_Tell(out);
     count = 0;
     for (i = 0; i < (size_t) lobjc; i += (mappingList ? 2 : 1)) {
-	const char *path, *name;
+	const char *name = ComputeNameInArchive(lobjv[i],
+		(mappingList ? lobjv[i + 1] : NULL), strip, slen);
 
-	path = TclGetString(lobjv[i]);
-	if (mappingList) {
-	    name = TclGetString(lobjv[i + 1]);
-	} else {
-	    name = path;
-	    if (slen > 0) {
-		len = strlen(name);
-		if ((len <= (size_t) slen) ||
-			(strncmp(strip, name, slen) != 0)) {
-		    continue;
-		}
-		name += slen;
-	    }
-	}
-	while (name[0] == '/') {
-	    ++name;
-	}
 	if (name[0] == '\0') {
 	    continue;
 	}
@@ -2822,7 +3044,8 @@ ZipFSMkZipOrImgObjCmd(
 	}
 	z = (ZipEntry *) Tcl_GetHashValue(hPtr);
 	len = strlen(z->name);
-	SerializeCentralDirectoryEntry(buf, z, len, dataStartOffset);
+	SerializeCentralDirectoryEntry(start, end, (unsigned char *) buf,
+		z, len, dataStartOffset);
 	if ((Tcl_Write(out, buf, ZIP_CENTRAL_HEADER_LEN)
 		!= ZIP_CENTRAL_HEADER_LEN)
 		|| ((size_t) Tcl_Write(out, z->name, len) != len)) {
@@ -2839,8 +3062,8 @@ ZipFSMkZipOrImgObjCmd(
 
     Tcl_Flush(out);
     suffixStartOffset = Tcl_Tell(out);
-    SerializeCentralDirectorySuffix(buf, count, dataStartOffset,
-	    directoryStartOffset, suffixStartOffset);
+    SerializeCentralDirectorySuffix(start, end, (unsigned char *) buf,
+	    count, dataStartOffset, directoryStartOffset, suffixStartOffset);
     if (Tcl_Write(out, buf, ZIP_CENTRAL_END_LEN) != ZIP_CENTRAL_END_LEN) {
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
 		"write error: %s", Tcl_PosixError(interp)));
@@ -2871,8 +3094,8 @@ ZipFSMkZipOrImgObjCmd(
  *
  * CopyImageFile --
  *
- *	A simple file copy function that is used (by ZipFSMkZipOrImgObjCmd)
- *	for anything that is not an image with a ZIP appended.
+ *	A simple file copy function that is used (by ZipFSMkZipOrImg) for
+ *	anything that is not an image with a ZIP appended.
  *
  * Returns:
  *	A Tcl result code.
@@ -2967,54 +3190,71 @@ CopyImageFile(
 
 static void
 SerializeLocalEntryHeader(
-    char *buf,			/* Where to serialize to */
+    const unsigned char *start,	/* The start of writable memory. */
+    const unsigned char *end,	/* The end of writable memory. */
+    unsigned char *buf,		/* Where to serialize to */
     ZipEntry *z,		/* The description of what to serialize. */
     int nameLength,		/* The length of the name. */
     int align)			/* The number of alignment bytes. */
 {
-    ZipWriteInt(buf + ZIP_LOCAL_SIG_OFFS, ZIP_LOCAL_HEADER_SIG);
-    ZipWriteShort(buf + ZIP_LOCAL_VERSION_OFFS, ZIP_MIN_VERSION);
-    ZipWriteShort(buf + ZIP_LOCAL_FLAGS_OFFS, z->isEncrypted);
-    ZipWriteShort(buf + ZIP_LOCAL_COMPMETH_OFFS, z->compressMethod);
-    ZipWriteShort(buf + ZIP_LOCAL_MTIME_OFFS, ToDosTime(z->timestamp));
-    ZipWriteShort(buf + ZIP_LOCAL_MDATE_OFFS, ToDosDate(z->timestamp));
-    ZipWriteInt(buf + ZIP_LOCAL_CRC32_OFFS, z->crc32);
-    ZipWriteInt(buf + ZIP_LOCAL_COMPLEN_OFFS, z->numCompressedBytes);
-    ZipWriteInt(buf + ZIP_LOCAL_UNCOMPLEN_OFFS, z->numBytes);
-    ZipWriteShort(buf + ZIP_LOCAL_PATHLEN_OFFS, nameLength);
-    ZipWriteShort(buf + ZIP_LOCAL_EXTRALEN_OFFS, align);
+    ZipWriteInt(start, end, buf + ZIP_LOCAL_SIG_OFFS, ZIP_LOCAL_HEADER_SIG);
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_VERSION_OFFS, ZIP_MIN_VERSION);
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_FLAGS_OFFS, z->isEncrypted);
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_COMPMETH_OFFS,
+	    z->compressMethod);
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_MTIME_OFFS,
+	    ToDosTime(z->timestamp));
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_MDATE_OFFS,
+	    ToDosDate(z->timestamp));
+    ZipWriteInt(start, end, buf + ZIP_LOCAL_CRC32_OFFS, z->crc32);
+    ZipWriteInt(start, end, buf + ZIP_LOCAL_COMPLEN_OFFS,
+	    z->numCompressedBytes);
+    ZipWriteInt(start, end, buf + ZIP_LOCAL_UNCOMPLEN_OFFS, z->numBytes);
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_PATHLEN_OFFS, nameLength);
+    ZipWriteShort(start, end, buf + ZIP_LOCAL_EXTRALEN_OFFS, align);
 }
 
 static void
 SerializeCentralDirectoryEntry(
-    char *buf,			/* Where to serialize to */
+    const unsigned char *start,	/* The start of writable memory. */
+    const unsigned char *end,	/* The end of writable memory. */
+    unsigned char *buf,		/* Where to serialize to */
     ZipEntry *z,		/* The description of what to serialize. */
     size_t nameLength,		/* The length of the name. */
     long long dataStartOffset)	/* The overall file offset of the start of the
 				 * data section of the file. */
 {
-    ZipWriteInt(buf + ZIP_CENTRAL_SIG_OFFS, ZIP_CENTRAL_HEADER_SIG);
-    ZipWriteShort(buf + ZIP_CENTRAL_VERSIONMADE_OFFS, ZIP_MIN_VERSION);
-    ZipWriteShort(buf + ZIP_CENTRAL_VERSION_OFFS, ZIP_MIN_VERSION);
-    ZipWriteShort(buf + ZIP_CENTRAL_FLAGS_OFFS, z->isEncrypted);
-    ZipWriteShort(buf + ZIP_CENTRAL_COMPMETH_OFFS, z->compressMethod);
-    ZipWriteShort(buf + ZIP_CENTRAL_MTIME_OFFS, ToDosTime(z->timestamp));
-    ZipWriteShort(buf + ZIP_CENTRAL_MDATE_OFFS, ToDosDate(z->timestamp));
-    ZipWriteInt(buf + ZIP_CENTRAL_CRC32_OFFS, z->crc32);
-    ZipWriteInt(buf + ZIP_CENTRAL_COMPLEN_OFFS, z->numCompressedBytes);
-    ZipWriteInt(buf + ZIP_CENTRAL_UNCOMPLEN_OFFS, z->numBytes);
-    ZipWriteShort(buf + ZIP_CENTRAL_PATHLEN_OFFS, nameLength);
-    ZipWriteShort(buf + ZIP_CENTRAL_EXTRALEN_OFFS, 0);
-    ZipWriteShort(buf + ZIP_CENTRAL_FCOMMENTLEN_OFFS, 0);
-    ZipWriteShort(buf + ZIP_CENTRAL_DISKFILE_OFFS, 0);
-    ZipWriteShort(buf + ZIP_CENTRAL_IATTR_OFFS, 0);
-    ZipWriteInt(buf + ZIP_CENTRAL_EATTR_OFFS, 0);
-    ZipWriteInt(buf + ZIP_CENTRAL_LOCALHDR_OFFS, z->offset - dataStartOffset);
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_SIG_OFFS,
+	    ZIP_CENTRAL_HEADER_SIG);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_VERSIONMADE_OFFS,
+	    ZIP_MIN_VERSION);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_VERSION_OFFS, ZIP_MIN_VERSION);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_FLAGS_OFFS, z->isEncrypted);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_COMPMETH_OFFS,
+	    z->compressMethod);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_MTIME_OFFS,
+	    ToDosTime(z->timestamp));
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_MDATE_OFFS,
+	    ToDosDate(z->timestamp));
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_CRC32_OFFS, z->crc32);
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_COMPLEN_OFFS,
+	    z->numCompressedBytes);
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_UNCOMPLEN_OFFS, z->numBytes);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_PATHLEN_OFFS, nameLength);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_EXTRALEN_OFFS, 0);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_FCOMMENTLEN_OFFS, 0);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_DISKFILE_OFFS, 0);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_IATTR_OFFS, 0);
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_EATTR_OFFS, 0);
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_LOCALHDR_OFFS,
+	    z->offset - dataStartOffset);
 }
 
 static void
 SerializeCentralDirectorySuffix(
-    char *buf,			/* Where to serialize to */
+    const unsigned char *start,	/* The start of writable memory. */
+    const unsigned char *end,	/* The end of writable memory. */
+    unsigned char *buf,		/* Where to serialize to */
     int entryCount,		/* The number of entries in the directory */
     long long dataStartOffset,	/* The overall file offset of the start of the
 				 * data section of the file. */
@@ -3025,16 +3265,17 @@ SerializeCentralDirectorySuffix(
 				 * suffix of the central directory (i.e.,
 				 * where this data will be written). */
 {
-    ZipWriteInt(buf + ZIP_CENTRAL_END_SIG_OFFS, ZIP_CENTRAL_END_SIG);
-    ZipWriteShort(buf + ZIP_CENTRAL_DISKNO_OFFS, 0);
-    ZipWriteShort(buf + ZIP_CENTRAL_DISKDIR_OFFS, 0);
-    ZipWriteShort(buf + ZIP_CENTRAL_ENTS_OFFS, entryCount);
-    ZipWriteShort(buf + ZIP_CENTRAL_TOTALENTS_OFFS, entryCount);
-    ZipWriteInt(buf + ZIP_CENTRAL_DIRSIZE_OFFS,
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_END_SIG_OFFS,
+	    ZIP_CENTRAL_END_SIG);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_DISKNO_OFFS, 0);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_DISKDIR_OFFS, 0);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_ENTS_OFFS, entryCount);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_TOTALENTS_OFFS, entryCount);
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_DIRSIZE_OFFS,
 	    suffixStartOffset - directoryStartOffset);
-    ZipWriteInt(buf + ZIP_CENTRAL_DIRSTART_OFFS,
+    ZipWriteInt(start, end, buf + ZIP_CENTRAL_DIRSTART_OFFS,
 	    directoryStartOffset - dataStartOffset);
-    ZipWriteShort(buf + ZIP_CENTRAL_COMMENTLEN_OFFS, 0);
+    ZipWriteShort(start, end, buf + ZIP_CENTRAL_COMMENTLEN_OFFS, 0);
 }
 
 /*
@@ -3043,13 +3284,13 @@ SerializeCentralDirectorySuffix(
  * ZipFSMkZipObjCmd, ZipFSLMkZipObjCmd --
  *
  *	These procedures are invoked to process the [zipfs mkzip] and [zipfs
- *	lmkzip] commands.  See description of ZipFSMkZipOrImgCmd().
+ *	lmkzip] commands.  See description of ZipFSMkZipOrImg().
  *
  * Results:
  *	A standard Tcl result.
  *
  * Side effects:
- *	See description of ZipFSMkZipOrImgCmd().
+ *	See description of ZipFSMkZipOrImg().
  *
  *-------------------------------------------------------------------------
  */
@@ -3068,15 +3309,14 @@ ZipFSMkZipObjCmd(
 	return TCL_ERROR;
     }
     if (Tcl_IsSafe(interp)) {
-	Tcl_SetObjResult(interp, Tcl_NewStringObj(
-		"operation not permitted in a safe interpreter", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "SAFE_INTERP", NULL);
+	ZIPFS_ERROR(interp, "operation not permitted in a safe interpreter");
+	ZIPFS_ERROR_CODE(interp, "SAFE_INTERP");
 	return TCL_ERROR;
     }
 
     stripPrefix = (objc > 3 ? objv[3] : NULL);
     password = (objc > 4 ? objv[4] : NULL);
-    return ZipFSMkZipOrImgObjCmd(interp, 0, objv[1], objv[2], NULL, NULL,
+    return ZipFSMkZipOrImg(interp, 0, objv[1], objv[2], NULL, NULL,
 	    stripPrefix, password);
 }
 
@@ -3094,14 +3334,13 @@ ZipFSLMkZipObjCmd(
 	return TCL_ERROR;
     }
     if (Tcl_IsSafe(interp)) {
-	Tcl_SetObjResult(interp, Tcl_NewStringObj(
-		"operation not permitted in a safe interpreter", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "SAFE_INTERP", NULL);
+	ZIPFS_ERROR(interp, "operation not permitted in a safe interpreter");
+	ZIPFS_ERROR_CODE(interp, "SAFE_INTERP");
 	return TCL_ERROR;
     }
 
     password = (objc > 3 ? objv[3] : NULL);
-    return ZipFSMkZipOrImgObjCmd(interp, 0, objv[1], NULL, objv[2], NULL,
+    return ZipFSMkZipOrImg(interp, 0, objv[1], NULL, objv[2], NULL,
 	    NULL, password);
 }
 
@@ -3111,13 +3350,13 @@ ZipFSLMkZipObjCmd(
  * ZipFSMkImgObjCmd, ZipFSLMkImgObjCmd --
  *
  *	These procedures are invoked to process the [zipfs mkimg] and [zipfs
- *	lmkimg] commands.  See description of ZipFSMkZipOrImgCmd().
+ *	lmkimg] commands.  See description of ZipFSMkZipOrImg().
  *
  * Results:
  *	A standard Tcl result.
  *
  * Side effects:
- *	See description of ZipFSMkZipOrImgCmd().
+ *	See description of ZipFSMkZipOrImg().
  *
  *-------------------------------------------------------------------------
  */
@@ -3137,16 +3376,15 @@ ZipFSMkImgObjCmd(
 	return TCL_ERROR;
     }
     if (Tcl_IsSafe(interp)) {
-	Tcl_SetObjResult(interp, Tcl_NewStringObj(
-		"operation not permitted in a safe interpreter", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "SAFE_INTERP", NULL);
+	ZIPFS_ERROR(interp, "operation not permitted in a safe interpreter");
+	ZIPFS_ERROR_CODE(interp, "SAFE_INTERP");
 	return TCL_ERROR;
     }
 
     originFile = (objc > 5 ? objv[5] : NULL);
     stripPrefix = (objc > 3 ? objv[3] : NULL);
     password = (objc > 4 ? objv[4] : NULL);
-    return ZipFSMkZipOrImgObjCmd(interp, 1, objv[1], objv[2], NULL,
+    return ZipFSMkZipOrImg(interp, 1, objv[1], objv[2], NULL,
 	    originFile, stripPrefix, password);
 }
 
@@ -3164,15 +3402,14 @@ ZipFSLMkImgObjCmd(
 	return TCL_ERROR;
     }
     if (Tcl_IsSafe(interp)) {
-	Tcl_SetObjResult(interp, Tcl_NewStringObj(
-		"operation not permitted in a safe interpreter", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "SAFE_INTERP", NULL);
+	ZIPFS_ERROR(interp, "operation not permitted in a safe interpreter");
+	ZIPFS_ERROR_CODE(interp, "SAFE_INTERP");
 	return TCL_ERROR;
     }
 
     originFile = (objc > 4 ? objv[4] : NULL);
     password = (objc > 3 ? objv[3] : NULL);
-    return ZipFSMkZipOrImgObjCmd(interp, 1, objv[1], NULL, objv[2],
+    return ZipFSMkZipOrImg(interp, 1, objv[1], NULL, objv[2],
 	    originFile, NULL, password);
 }
 
@@ -3288,7 +3525,7 @@ ZipFSExistsObjCmd(
  *
  * ZipFSInfoObjCmd --
  *
- *	This procedure is invoked to process the [zipfs info] command.	 On
+ *	This procedure is invoked to process the [zipfs info] command.  On
  *	success, it returns a Tcl list made up of name of ZIP archive file,
  *	size uncompressed, size compressed, and archive offset of a file in
  *	the ZIP filesystem.
@@ -3364,31 +3601,43 @@ ZipFSListObjCmd(
     Tcl_HashEntry *hPtr;
     Tcl_HashSearch search;
     Tcl_Obj *result = Tcl_GetObjResult(interp);
+    const char *options[] = {"-glob", "-regexp", NULL};
+    enum list_options { OPT_GLOB, OPT_REGEXP };
+
+    /*
+     * Parse arguments.
+     */
 
     if (objc > 3) {
 	Tcl_WrongNumArgs(interp, 1, objv, "?(-glob|-regexp)? ?pattern?");
 	return TCL_ERROR;
     }
     if (objc == 3) {
-	int n;
-	char *what = Tcl_GetStringFromObj(objv[1], &n);
+	int idx;
 
-	if ((n >= 2) && (strncmp(what, "-glob", n) == 0)) {
+	if (Tcl_GetIndexFromObj(interp, objv[1], options, "option",
+		0, &idx) != TCL_OK) {
+	    return TCL_ERROR;
+	}
+	switch (idx) {
+	case OPT_GLOB:
 	    pattern = TclGetString(objv[2]);
-	} else if ((n >= 2) && (strncmp(what, "-regexp", n) == 0)) {
+	    break;
+	case OPT_REGEXP:
 	    regexp = Tcl_RegExpCompile(interp, TclGetString(objv[2]));
 	    if (!regexp) {
 		return TCL_ERROR;
 	    }
-	} else {
-	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
-		    "unknown option \"%s\"", what));
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "BAD_OPT", NULL);
-	    return TCL_ERROR;
+	    break;
 	}
     } else if (objc == 2) {
 	pattern = TclGetString(objv[1]);
     }
+
+    /*
+     * Scan for matching entries.
+     */
+
     ReadLock();
     if (pattern) {
 	for (hPtr = Tcl_FirstHashEntry(&ZipFS.fileHash, &search);
@@ -3484,7 +3733,7 @@ TclZipfs_TclLibrary(void)
 
 #if !defined(STATIC_BUILD)
 #if defined(_WIN32) || defined(__CYGWIN__)
-    hModule = (HMODULE)TclWinGetTclInstance();
+    hModule = TclWinGetTclInstance();
     GetModuleFileNameW(hModule, wName, MAX_PATH);
 #ifdef __CYGWIN__
     cygwin_conv_path(3, wName, dllName, sizeof(dllName));
@@ -3805,6 +4054,18 @@ ZipChannelWideSeek(
     info->numRead = (size_t) offset;
     return info->numRead;
 }
+
+#if !defined(TCL_NO_DEPRECATED) && (TCL_MAJOR_VERSION < 9)
+static int
+ZipChannelSeek(
+    void *instanceData,
+    long offset,
+    int mode,
+    int *errloc)
+{
+    return ZipChannelWideSeek(instanceData, offset, mode, errloc);
+}
+#endif
 
 /*
  *-------------------------------------------------------------------------
@@ -3863,7 +4124,7 @@ ZipChannelGetFile(
  * ZipChannelOpen --
  *
  *	This function opens a Tcl_Channel on a file from a mounted ZIP archive
- *	according to given open mode.
+ *	according to given open mode (already parsed by caller).
  *
  * Results:
  *	Tcl_Channel on success, or NULL on error.
@@ -3877,24 +4138,19 @@ ZipChannelGetFile(
 static Tcl_Channel
 ZipChannelOpen(
     Tcl_Interp *interp,		/* Current interpreter. */
-    char *filename,
-    int mode,
-    TCL_UNUSED(int) /*permissions*/)
+    char *filename,		/* What are we opening. */
+    int wr,			/* True if we're opening in write mode. */
+    int trunc)			/* True if we're opening in truncate mode. */
 {
     ZipEntry *z;
     ZipChannel *info;
-    int i, ch, trunc, wr, flags = 0;
+    int flags = 0;
     char cname[128];
 
-    if ((mode & O_APPEND)
-	    || ((ZipFS.wrmax <= 0) && (mode & (O_WRONLY | O_RDWR)))) {
-	if (interp) {
-	    Tcl_SetObjResult(interp,
-		    Tcl_NewStringObj("unsupported open mode", -1));
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "BAD_MODE", NULL);
-	}
-	return NULL;
-    }
+    /*
+     * Is the file there?
+     */
+
     WriteLock();
     z = ZipFSLookup(filename);
     if (!z) {
@@ -3906,188 +4162,161 @@ ZipChannelOpen(
 	}
 	goto error;
     }
-    trunc = (mode & O_TRUNC) != 0;
-    wr = (mode & (O_WRONLY | O_RDWR)) != 0;
-    if ((z->compressMethod != ZIP_COMPMETH_STORED)
-	    && (z->compressMethod != ZIP_COMPMETH_DEFLATED)) {
-	ZIPFS_ERROR(interp, "unsupported compression method");
+
+    /*
+     * Do we support opening the file that way?
+     */
+
+    if (wr && z->isDirectory) {
+	Tcl_SetErrno(EISDIR);
 	if (interp) {
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "COMP_METHOD", NULL);
+	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+		    "unsupported file type: %s",
+		    Tcl_PosixError(interp)));
 	}
 	goto error;
     }
-    if (wr && z->isDirectory) {
-	ZIPFS_ERROR(interp, "unsupported file type");
-	if (interp) {
-	    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "FILE_TYPE", NULL);
-	}
+    if ((z->compressMethod != ZIP_COMPMETH_STORED)
+	    && (z->compressMethod != ZIP_COMPMETH_DEFLATED)) {
+	ZIPFS_ERROR(interp, "unsupported compression method");
+	ZIPFS_ERROR_CODE(interp, "COMP_METHOD");
 	goto error;
     }
     if (!trunc) {
 	flags |= TCL_READABLE;
 	if (z->isEncrypted && (z->zipFilePtr->passBuf[0] == 0)) {
 	    ZIPFS_ERROR(interp, "decryption failed");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "DECRYPT", NULL);
-	    }
+	    ZIPFS_ERROR_CODE(interp, "DECRYPT");
 	    goto error;
 	} else if (wr && !z->data && (z->numBytes > ZipFS.wrmax)) {
 	    ZIPFS_ERROR(interp, "file too large");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "FILE_SIZE", NULL);
-	    }
+	    ZIPFS_ERROR_CODE(interp, "FILE_SIZE");
 	    goto error;
 	}
     } else {
 	flags = TCL_WRITABLE;
     }
-    info = (ZipChannel *) Tcl_AttemptAlloc(sizeof(ZipChannel));
+
+    info = AllocateZipChannel(interp);
     if (!info) {
-	ZIPFS_ERROR(interp, "out of memory");
-	if (interp) {
-	    Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);
-	}
 	goto error;
     }
     info->zipFilePtr = z->zipFilePtr;
     info->zipEntryPtr = z;
-    info->numRead = 0;
     if (wr) {
+	/*
+	 * Set up a writable channel.
+	 */
+
 	flags |= TCL_WRITABLE;
-	info->isWriting = 1;
-	info->isDirectory = 0;
-	info->maxWrite = ZipFS.wrmax;
-	info->iscompr = 0;
-	info->isEncrypted = 0;
-	info->ubuf = (unsigned char *) Tcl_AttemptAlloc(info->maxWrite);
-	if (!info->ubuf) {
-	merror0:
-	    if (info->ubuf) {
-		Tcl_Free(info->ubuf);
-	    }
+	if (InitWritableChannel(interp, info, z, trunc) == TCL_ERROR) {
 	    Tcl_Free(info);
-	    ZIPFS_ERROR(interp, "out of memory");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);
-	    }
 	    goto error;
 	}
-	memset(info->ubuf, 0, info->maxWrite);
-	if (trunc) {
-	    info->numBytes = 0;
-	} else if (z->data) {
-	    unsigned int j = z->numBytes;
-
-	    if (j > info->maxWrite) {
-		j = info->maxWrite;
-	    }
-	    memcpy(info->ubuf, z->data, j);
-	    info->numBytes = j;
-	} else {
-	    unsigned char *zbuf = z->zipFilePtr->data + z->offset;
-
-	    if (z->isEncrypted) {
-		int len = z->zipFilePtr->passBuf[0] & 0xFF;
-		char passBuf[260];
-
-		for (i = 0; i < len; i++) {
-		    ch = z->zipFilePtr->passBuf[len - i];
-		    passBuf[i] = (ch & 0x0f) | pwrot[(ch >> 4) & 0x0f];
-		}
-		passBuf[i] = '\0';
-		init_keys(passBuf, info->keys, crc32tab);
-		memset(passBuf, 0, sizeof(passBuf));
-		for (i = 0; i < 12; i++) {
-		    ch = info->ubuf[i];
-		    zdecode(info->keys, crc32tab, ch);
-		}
-		zbuf += i;
-	    }
-	    if (z->compressMethod == ZIP_COMPMETH_DEFLATED) {
-		z_stream stream;
-		int err;
-		unsigned char *cbuf = NULL;
-
-		memset(&stream, 0, sizeof(z_stream));
-		stream.zalloc = Z_NULL;
-		stream.zfree = Z_NULL;
-		stream.opaque = Z_NULL;
-		stream.avail_in = z->numCompressedBytes;
-		if (z->isEncrypted) {
-		    unsigned int j;
-
-		    stream.avail_in -= 12;
-		    cbuf = (unsigned char *) Tcl_AttemptAlloc(stream.avail_in);
-		    if (!cbuf) {
-			goto merror0;
-		    }
-		    for (j = 0; j < stream.avail_in; j++) {
-			ch = info->ubuf[j];
-			cbuf[j] = zdecode(info->keys, crc32tab, ch);
-		    }
-		    stream.next_in = cbuf;
-		} else {
-		    stream.next_in = zbuf;
-		}
-		stream.next_out = info->ubuf;
-		stream.avail_out = info->maxWrite;
-		if (inflateInit2(&stream, -15) != Z_OK) {
-		    goto cerror0;
-		}
-		err = inflate(&stream, Z_SYNC_FLUSH);
-		inflateEnd(&stream);
-		if ((err == Z_STREAM_END)
-			|| ((err == Z_OK) && (stream.avail_in == 0))) {
-		    if (cbuf) {
-			memset(info->keys, 0, sizeof(info->keys));
-			Tcl_Free(cbuf);
-		    }
-		    goto wrapchan;
-		}
-	    cerror0:
-		if (cbuf) {
-		    memset(info->keys, 0, sizeof(info->keys));
-		    Tcl_Free(cbuf);
-		}
-		if (info->ubuf) {
-		    Tcl_Free(info->ubuf);
-		}
-		Tcl_Free(info);
-		ZIPFS_ERROR(interp, "decompression error");
-		if (interp) {
-		    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "CORRUPT", NULL);
-		}
-		goto error;
-	    } else if (z->isEncrypted) {
-		for (i = 0; i < z->numBytes - 12; i++) {
-		    ch = zbuf[i];
-		    info->ubuf[i] = zdecode(info->keys, crc32tab, ch);
-		}
-	    } else {
-		memcpy(info->ubuf, zbuf, z->numBytes);
-	    }
-	    memset(info->keys, 0, sizeof(info->keys));
-	    goto wrapchan;
-	}
     } else if (z->data) {
+	/*
+	 * Set up a readable channel for direct data.
+	 */
+
 	flags |= TCL_READABLE;
-	info->isWriting = 0;
-	info->iscompr = 0;
-	info->isDirectory = 0;
-	info->isEncrypted = 0;
 	info->numBytes = z->numBytes;
-	info->maxWrite = 0;
 	info->ubuf = z->data;
     } else {
+	/*
+	 * Set up a readable channel.
+	 */
+
 	flags |= TCL_READABLE;
-	info->isWriting = 0;
-	info->iscompr = (z->compressMethod == ZIP_COMPMETH_DEFLATED);
-	info->ubuf = z->zipFilePtr->data + z->offset;
-	info->isDirectory = z->isDirectory;
-	info->isEncrypted = z->isEncrypted;
-	info->numBytes = z->numBytes;
-	info->maxWrite = 0;
-	if (info->isEncrypted) {
+	if (InitReadableChannel(interp, info, z) == TCL_ERROR) {
+	    Tcl_Free(info);
+	    goto error;
+	}
+    }
+
+    /*
+     * Wrap the ZipChannel into a Tcl_Channel.
+     */
+
+    sprintf(cname, "zipfs_%" TCL_LL_MODIFIER "x_%d", z->offset,
+	    ZipFS.idCount++);
+    z->zipFilePtr->numOpen++;
+    Unlock();
+    return Tcl_CreateChannel(&ZipChannelType, cname, info, flags);
+
+  error:
+    Unlock();
+    return NULL;
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
+ * InitWritableChannel --
+ *
+ *	Assistant for ZipChannelOpen() that sets up a writable channel. It's
+ *	up to the caller to actually register the channel.
+ *
+ * Returns:
+ *	Tcl result code.
+ *
+ * Side effects:
+ *	Allocates memory for the implementation of the channel. Writes to the
+ *	interpreter's result on error.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static int
+InitWritableChannel(
+    Tcl_Interp *interp,		/* Current interpreter, or NULL (when errors
+				 * will be silent). */
+    ZipChannel *info,		/* The channel to set up. */
+    ZipEntry *z,		/* The zipped file that the channel will write
+				 * to. */
+    int trunc)			/* Whether to truncate the data. */
+{
+    int i, ch;
+    unsigned char *cbuf = NULL;
+
+    /*
+     * Set up a writable channel.
+     */
+
+    info->isWriting = 1;
+    info->maxWrite = ZipFS.wrmax;
+
+    info->ubuf = (unsigned char *) Tcl_AttemptAlloc(info->maxWrite);
+    if (!info->ubuf) {
+	goto memoryError;
+    }
+    memset(info->ubuf, 0, info->maxWrite);
+
+    if (trunc) {
+	/*
+	 * Truncate; nothing there.
+	 */
+
+	info->numBytes = 0;
+    } else if (z->data) {
+	/*
+	 * Already got uncompressed data.
+	 */
+
+	unsigned int j = z->numBytes;
+
+	if (j > info->maxWrite) {
+	    j = info->maxWrite;
+	}
+	memcpy(info->ubuf, z->data, j);
+	info->numBytes = j;
+    } else {
+	/*
+	 * Need to uncompress the existing data.
+	 */
+
+	unsigned char *zbuf = z->zipFilePtr->data + z->offset;
+
+	if (z->isEncrypted) {
 	    int len = z->zipFilePtr->passBuf[0] & 0xFF;
 	    char passBuf[260];
 
@@ -4102,119 +4331,244 @@ ZipChannelOpen(
 		ch = info->ubuf[i];
 		zdecode(info->keys, crc32tab, ch);
 	    }
-	    info->ubuf += i;
+	    zbuf += i;
 	}
-	if (info->iscompr) {
+
+	if (z->compressMethod == ZIP_COMPMETH_DEFLATED) {
 	    z_stream stream;
 	    int err;
-	    unsigned char *ubuf = NULL;
-	    unsigned int j;
 
 	    memset(&stream, 0, sizeof(z_stream));
 	    stream.zalloc = Z_NULL;
 	    stream.zfree = Z_NULL;
 	    stream.opaque = Z_NULL;
 	    stream.avail_in = z->numCompressedBytes;
-	    if (info->isEncrypted) {
+	    if (z->isEncrypted) {
+		unsigned int j;
+
 		stream.avail_in -= 12;
-		ubuf = (unsigned char *) Tcl_AttemptAlloc(stream.avail_in);
-		if (!ubuf) {
-		    info->ubuf = NULL;
-		    goto merror;
+		cbuf = (unsigned char *) Tcl_AttemptAlloc(stream.avail_in);
+		if (!cbuf) {
+		    goto memoryError;
 		}
 		for (j = 0; j < stream.avail_in; j++) {
 		    ch = info->ubuf[j];
-		    ubuf[j] = zdecode(info->keys, crc32tab, ch);
+		    cbuf[j] = zdecode(info->keys, crc32tab, ch);
 		}
-		stream.next_in = ubuf;
+		stream.next_in = cbuf;
 	    } else {
-		stream.next_in = info->ubuf;
+		stream.next_in = zbuf;
 	    }
-	    stream.next_out = info->ubuf = (unsigned char *)
-		    Tcl_AttemptAlloc(info->numBytes);
-	    if (!info->ubuf) {
-	    merror:
-		if (ubuf) {
-		    info->isEncrypted = 0;
-		    memset(info->keys, 0, sizeof(info->keys));
-		    Tcl_Free(ubuf);
-		}
-		Tcl_Free(info);
-		if (interp) {
-		    Tcl_SetObjResult(interp,
-			    Tcl_NewStringObj("out of memory", -1));
-		    Tcl_SetErrorCode(interp, "TCL", "MALLOC", NULL);
-		}
-		goto error;
-	    }
-	    stream.avail_out = info->numBytes;
+	    stream.next_out = info->ubuf;
+	    stream.avail_out = info->maxWrite;
 	    if (inflateInit2(&stream, -15) != Z_OK) {
-		goto cerror;
+		goto corruptionError;
 	    }
 	    err = inflate(&stream, Z_SYNC_FLUSH);
 	    inflateEnd(&stream);
 	    if ((err == Z_STREAM_END)
 		    || ((err == Z_OK) && (stream.avail_in == 0))) {
-		if (ubuf) {
-		    info->isEncrypted = 0;
+		if (cbuf) {
 		    memset(info->keys, 0, sizeof(info->keys));
-		    Tcl_Free(ubuf);
+		    Tcl_Free(cbuf);
 		}
-		goto wrapchan;
-	    }
-	cerror:
-	    if (ubuf) {
-		info->isEncrypted = 0;
-		memset(info->keys, 0, sizeof(info->keys));
-		Tcl_Free(ubuf);
-	    }
-	    if (info->ubuf) {
-		Tcl_Free(info->ubuf);
-	    }
-	    Tcl_Free(info);
-	    ZIPFS_ERROR(interp, "decompression error");
-	    if (interp) {
-		Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "CORRUPT", NULL);
+		return TCL_OK;
 	    }
-	    goto error;
-	} else if (info->isEncrypted) {
-	    unsigned char *ubuf = NULL;
-	    unsigned int j, len;
+	    goto corruptionError;
+	} else if (z->isEncrypted) {
+	    /*
+	     * Need to decrypt some otherwise-simple stored data.
+	     */
 
+	    for (i = 0; i < z->numBytes - 12; i++) {
+		ch = zbuf[i];
+		info->ubuf[i] = zdecode(info->keys, crc32tab, ch);
+	    }
+	} else {
 	    /*
-	     * Decode encrypted but uncompressed file, since we support
-	     * Tcl_Seek() on it, and it can be randomly accessed later.
+	     * Simple stored data. Copy into our working buffer.
 	     */
 
-	    len = z->numCompressedBytes - 12;
-	    ubuf = (unsigned char *) Tcl_AttemptAlloc(len);
-	    if (ubuf == NULL) {
-		Tcl_Free((char *) info);
-		if (interp != NULL) {
-		    Tcl_SetObjResult(interp,
-			Tcl_NewStringObj("out of memory", -1));
-		}
-		goto error;
+	    memcpy(info->ubuf, zbuf, z->numBytes);
+	}
+	memset(info->keys, 0, sizeof(info->keys));
+    }
+    return TCL_OK;
+
+  memoryError:
+    if (info->ubuf) {
+	Tcl_Free(info->ubuf);
+    }
+    ZIPFS_MEM_ERROR(interp);
+    return TCL_ERROR;
+
+  corruptionError:
+    if (cbuf) {
+	memset(info->keys, 0, sizeof(info->keys));
+	Tcl_Free(cbuf);
+    }
+    if (info->ubuf) {
+	Tcl_Free(info->ubuf);
+    }
+    ZIPFS_ERROR(interp, "decompression error");
+    ZIPFS_ERROR_CODE(interp, "CORRUPT");
+    return TCL_ERROR;
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
+ * InitReadableChannel --
+ *
+ *	Assistant for ZipChannelOpen() that sets up a readable channel. It's
+ *	up to the caller to actually register the channel.
+ *
+ * Returns:
+ *	Tcl result code.
+ *
+ * Side effects:
+ *	Allocates memory for the implementation of the channel. Writes to the
+ *	interpreter's result on error.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static int
+InitReadableChannel(
+    Tcl_Interp *interp,		/* Current interpreter, or NULL (when errors
+				 * will be silent). */
+    ZipChannel *info,		/* The channel to set up. */
+    ZipEntry *z)		/* The zipped file that the channel will read
+				 * from. */
+{
+    unsigned char *ubuf = NULL;
+    int i, ch;
+
+    info->iscompr = (z->compressMethod == ZIP_COMPMETH_DEFLATED);
+    info->ubuf = z->zipFilePtr->data + z->offset;
+    info->isDirectory = z->isDirectory;
+    info->isEncrypted = z->isEncrypted;
+    info->numBytes = z->numBytes;
+
+    if (info->isEncrypted) {
+	int len = z->zipFilePtr->passBuf[0] & 0xFF;
+	char passBuf[260];
+
+	for (i = 0; i < len; i++) {
+	    ch = z->zipFilePtr->passBuf[len - i];
+	    passBuf[i] = (ch & 0x0f) | pwrot[(ch >> 4) & 0x0f];
+	}
+	passBuf[i] = '\0';
+	init_keys(passBuf, info->keys, crc32tab);
+	memset(passBuf, 0, sizeof(passBuf));
+	for (i = 0; i < 12; i++) {
+	    ch = info->ubuf[i];
+	    zdecode(info->keys, crc32tab, ch);
+	}
+	info->ubuf += i;
+    }
+
+    if (info->iscompr) {
+	z_stream stream;
+	int err;
+	unsigned int j;
+
+	/*
+	 * Data to decode is compressed, and possibly encrpyted too.
+	 */
+
+	memset(&stream, 0, sizeof(z_stream));
+	stream.zalloc = Z_NULL;
+	stream.zfree = Z_NULL;
+	stream.opaque = Z_NULL;
+	stream.avail_in = z->numCompressedBytes;
+	if (info->isEncrypted) {
+	    stream.avail_in -= 12;
+	    ubuf = (unsigned char *) Tcl_AttemptAlloc(stream.avail_in);
+	    if (!ubuf) {
+		info->ubuf = NULL;
+		goto memoryError;
 	    }
-	    for (j = 0; j < len; j++) {
+
+	    for (j = 0; j < stream.avail_in; j++) {
 		ch = info->ubuf[j];
 		ubuf[j] = zdecode(info->keys, crc32tab, ch);
 	    }
-	    info->ubuf = ubuf;
+	    stream.next_in = ubuf;
+	} else {
+	    stream.next_in = info->ubuf;
+	}
+	stream.next_out = info->ubuf = (unsigned char *)
+		Tcl_AttemptAlloc(info->numBytes);
+	if (!info->ubuf) {
+	    goto memoryError;
+	}
+	stream.avail_out = info->numBytes;
+	if (inflateInit2(&stream, -15) != Z_OK) {
+	    goto corruptionError;
+	}
+	err = inflate(&stream, Z_SYNC_FLUSH);
+	inflateEnd(&stream);
+
+	/*
+	 * Decompression was successful if we're either in the END state, or
+	 * in the OK state with no buffered bytes.
+	 */
+
+	if ((err != Z_STREAM_END)
+		&& ((err != Z_OK) || (stream.avail_in != 0))) {
+	    goto corruptionError;
+	}
+
+	if (ubuf) {
 	    info->isEncrypted = 0;
+	    memset(info->keys, 0, sizeof(info->keys));
+	    Tcl_Free(ubuf);
 	}
+	return TCL_OK;
+    } else if (info->isEncrypted) {
+	unsigned int j, len;
+
+	/*
+	 * Decode encrypted but uncompressed file, since we support Tcl_Seek()
+	 * on it, and it can be randomly accessed later.
+	 */
+
+	len = z->numCompressedBytes - 12;
+	ubuf = (unsigned char *) Tcl_AttemptAlloc(len);
+	if (ubuf == NULL) {
+	    goto memoryError;
+	}
+	for (j = 0; j < len; j++) {
+	    ch = info->ubuf[j];
+	    ubuf[j] = zdecode(info->keys, crc32tab, ch);
+	}
+	info->ubuf = ubuf;
+	info->isEncrypted = 0;
     }
+    return TCL_OK;
 
-  wrapchan:
-    sprintf(cname, "zipfs_%" TCL_LL_MODIFIER "x_%d", z->offset,
-	    ZipFS.idCount++);
-    z->zipFilePtr->numOpen++;
-    Unlock();
-    return Tcl_CreateChannel(&ZipChannelType, cname, info, flags);
+  corruptionError:
+    if (ubuf) {
+	info->isEncrypted = 0;
+	memset(info->keys, 0, sizeof(info->keys));
+	Tcl_Free(ubuf);
+    }
+    if (info->ubuf) {
+	Tcl_Free(info->ubuf);
+    }
+    ZIPFS_ERROR(interp, "decompression error");
+    ZIPFS_ERROR_CODE(interp, "CORRUPT");
+    return TCL_ERROR;
 
-  error:
-    Unlock();
-    return NULL;
+  memoryError:
+    if (ubuf) {
+	info->isEncrypted = 0;
+	memset(info->keys, 0, sizeof(info->keys));
+	Tcl_Free(ubuf);
+    }
+    ZIPFS_MEM_ERROR(interp);
+    return TCL_ERROR;
 }
 
 /*
@@ -4299,9 +4653,14 @@ ZipEntryAccess(
  *
  * ZipFSOpenFileChannelProc --
  *
+ *	Open a channel to a file in a mounted ZIP archive. Delegates to
+ *	ZipChannelOpen().
+ *
  * Results:
+ *	Tcl_Channel on success, or NULL on error.
  *
  * Side effects:
+ *	Allocates memory.
  *
  *-------------------------------------------------------------------------
  */
@@ -4311,16 +4670,33 @@ ZipFSOpenFileChannelProc(
     Tcl_Interp *interp,		/* Current interpreter. */
     Tcl_Obj *pathPtr,
     int mode,
-    int permissions)
+    TCL_UNUSED(int) /* permissions */)
 {
+    int trunc = (mode & O_TRUNC) != 0;
+    int wr = (mode & (O_WRONLY | O_RDWR)) != 0;
     int len;
 
     pathPtr = Tcl_FSGetNormalizedPath(NULL, pathPtr);
     if (!pathPtr) {
 	return NULL;
     }
-    return ZipChannelOpen(interp, Tcl_GetStringFromObj(pathPtr, &len), mode,
-	    permissions);
+
+    /*
+     * Check for unsupported modes.
+     */
+
+    if ((mode & O_APPEND) || ((ZipFS.wrmax <= 0) && wr)) {
+	Tcl_SetErrno(EACCES);
+	if (interp) {
+	    Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+		    "write access not supported: %s",
+		    Tcl_PosixError(interp)));
+	}
+	return NULL;
+    }
+
+    return ZipChannelOpen(interp, TclGetStringFromObj(pathPtr, &len), wr,
+	    trunc);
 }
 
 /*
@@ -4351,7 +4727,7 @@ ZipFSStatProc(
     if (!pathPtr) {
 	return -1;
     }
-    return ZipEntryStat(Tcl_GetStringFromObj(pathPtr, &len), buf);
+    return ZipEntryStat(TclGetStringFromObj(pathPtr, &len), buf);
 }
 
 /*
@@ -4382,7 +4758,7 @@ ZipFSAccessProc(
     if (!pathPtr) {
 	return -1;
     }
-    return ZipEntryAccess(Tcl_GetStringFromObj(pathPtr, &len), mode);
+    return ZipEntryAccess(TclGetStringFromObj(pathPtr, &len), mode);
 }
 
 /*
@@ -4414,6 +4790,38 @@ ZipFSFilesystemSeparatorProc(
 /*
  *-------------------------------------------------------------------------
  *
+ * AppendWithPrefix --
+ *
+ *	Worker for ZipFSMatchInDirectoryProc() that is a wrapper around
+ *	Tcl_ListObjAppendElement() which knows about handling prefixes.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static inline void
+AppendWithPrefix(
+    Tcl_Obj *result,		/* Where to append a list element to. */
+    Tcl_DString *prefix,	/* The prefix to add to the element, or NULL
+				 * for don't do that. */
+    const char *name,		/* The name to append. */
+    int nameLen)		/* The length of the name. May be -1 for
+				 * append-up-to-NUL-byte. */
+{
+    if (prefix) {
+	int prefixLength = Tcl_DStringLength(prefix);
+
+	Tcl_DStringAppend(prefix, name, nameLen);
+	Tcl_ListObjAppendElement(NULL, result, Tcl_NewStringObj(
+		Tcl_DStringValue(prefix), Tcl_DStringLength(prefix)));
+	Tcl_DStringSetLength(prefix, prefixLength);
+    } else {
+	Tcl_ListObjAppendElement(NULL, result, Tcl_NewStringObj(name, nameLen));
+    }
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
  * ZipFSMatchInDirectoryProc --
  *
  *	This routine is used by the globbing code to search a directory for
@@ -4433,31 +4841,32 @@ ZipFSFilesystemSeparatorProc(
 static int
 ZipFSMatchInDirectoryProc(
     TCL_UNUSED(Tcl_Interp *),
-    Tcl_Obj *result,
-    Tcl_Obj *pathPtr,
-    const char *pattern,
-    Tcl_GlobTypeData *types)
+    Tcl_Obj *result,		/* Where to append matched items to. */
+    Tcl_Obj *pathPtr,		/* Where we are looking. */
+    const char *pattern,	/* What names we are looking for. */
+    Tcl_GlobTypeData *types)	/* What types we are looking for. */
 {
     Tcl_HashEntry *hPtr;
     Tcl_HashSearch search;
     Tcl_Obj *normPathPtr = Tcl_FSGetNormalizedPath(NULL, pathPtr);
-    int scnt, l, dirOnly = -1, prefixLen, strip = 0;
+    int scnt, l, dirOnly = -1, prefixLen, strip = 0, mounts = 0;
     size_t len;
     char *pat, *prefix, *path;
-    Tcl_DString dsPref;
+    Tcl_DString dsPref, *prefixBuf = NULL;
 
     if (!normPathPtr) {
 	return -1;
     }
     if (types) {
 	dirOnly = (types->type & TCL_GLOB_TYPE_DIR) == TCL_GLOB_TYPE_DIR;
+	mounts = (types->type == TCL_GLOB_TYPE_MOUNT);
     }
 
     /*
      * The prefix that gets prepended to results.
      */
 
-    prefix = Tcl_GetStringFromObj(pathPtr, &prefixLen);
+    prefix = TclGetStringFromObj(pathPtr, &prefixLen);
 
     /*
      * The (normalized) path we're searching.
@@ -4467,101 +4876,53 @@ ZipFSMatchInDirectoryProc(
     len = normPathPtr->length;
 
     Tcl_DStringInit(&dsPref);
-    Tcl_DStringAppend(&dsPref, prefix, prefixLen);
-
     if (strcmp(prefix, path) == 0) {
-	prefix = NULL;
+	prefixBuf = NULL;
     } else {
+	/*
+	 * We need to strip the normalized prefix of the filenames and replace
+	 * it with the official prefix that we were expecting to get.
+	 */
+
 	strip = len + 1;
-    }
-    if (prefix) {
+	Tcl_DStringAppend(&dsPref, prefix, prefixLen);
 	Tcl_DStringAppend(&dsPref, "/", 1);
-	prefixLen++;
 	prefix = Tcl_DStringValue(&dsPref);
+	prefixBuf = &dsPref;
     }
+
     ReadLock();
-    if (types && (types->type == TCL_GLOB_TYPE_MOUNT)) {
-	l = CountSlashes(path);
-	if (path[len - 1] == '/') {
-	    len--;
-	} else {
-	    l++;
-	}
-	if (!pattern || (pattern[0] == '\0')) {
-	    pattern = "*";
-	}
-	for (hPtr = Tcl_FirstHashEntry(&ZipFS.zipHash, &search); hPtr;
-		hPtr = Tcl_NextHashEntry(&search)) {
-	    ZipFile *zf = (ZipFile *) Tcl_GetHashValue(hPtr);
-
-	    if (zf->mountPointLen == 0) {
-		ZipEntry *z;
-
-		for (z = zf->topEnts; z; z = z->tnext) {
-		    size_t lenz = strlen(z->name);
-
-		    if ((lenz > len + 1) && (strncmp(z->name, path, len) == 0)
-			    && (z->name[len] == '/')
-			    && (CountSlashes(z->name) == l)
-			    && Tcl_StringCaseMatch(z->name + len + 1, pattern,
-				    0)) {
-			if (prefix) {
-			    Tcl_DStringAppend(&dsPref, z->name, lenz);
-			    Tcl_ListObjAppendElement(NULL, result,
-				    Tcl_NewStringObj(Tcl_DStringValue(&dsPref),
-					    Tcl_DStringLength(&dsPref)));
-			    Tcl_DStringSetLength(&dsPref, prefixLen);
-			} else {
-			    Tcl_ListObjAppendElement(NULL, result,
-				    Tcl_NewStringObj(z->name, lenz));
-			}
-		    }
-		}
-	    } else if ((zf->mountPointLen > len + 1)
-		    && (strncmp(zf->mountPoint, path, len) == 0)
-		    && (zf->mountPoint[len] == '/')
-		    && (CountSlashes(zf->mountPoint) == l)
-		    && Tcl_StringCaseMatch(zf->mountPoint + len + 1,
-			    pattern, 0)) {
-		if (prefix) {
-		    Tcl_DStringAppend(&dsPref, zf->mountPoint,
-			    zf->mountPointLen);
-		    Tcl_ListObjAppendElement(NULL, result,
-			    Tcl_NewStringObj(Tcl_DStringValue(&dsPref),
-				    Tcl_DStringLength(&dsPref)));
-		    Tcl_DStringSetLength(&dsPref, prefixLen);
-		} else {
-		    Tcl_ListObjAppendElement(NULL, result,
-			    Tcl_NewStringObj(zf->mountPoint,
-				    zf->mountPointLen));
-		}
-	    }
-	}
+
+    /*
+     * Are we globbing the mount points?
+     */
+
+    if (mounts) {
+	ZipFSMatchMountPoints(result, normPathPtr, pattern, prefixBuf);
 	goto end;
     }
 
+    /*
+     * Can we skip the complexity of actual globbing? Without a pattern, yes;
+     * it's a directory existence test.
+     */
+
     if (!pattern || (pattern[0] == '\0')) {
-	hPtr = Tcl_FindHashEntry(&ZipFS.fileHash, path);
-	if (hPtr) {
-	    ZipEntry *z = (ZipEntry *) Tcl_GetHashValue(hPtr);
+	ZipEntry *z = ZipFSLookup(path);
 
-	    if ((dirOnly < 0) || (!dirOnly && !z->isDirectory)
-		    || (dirOnly && z->isDirectory)) {
-		if (prefix) {
-		    Tcl_DStringAppend(&dsPref, z->name, -1);
-		    Tcl_ListObjAppendElement(NULL, result,
-			    Tcl_NewStringObj(Tcl_DStringValue(&dsPref),
-				    Tcl_DStringLength(&dsPref)));
-		    Tcl_DStringSetLength(&dsPref, prefixLen);
-		} else {
-		    Tcl_ListObjAppendElement(NULL, result,
-			    Tcl_NewStringObj(z->name, -1));
-		}
-	    }
+	if (z && ((dirOnly < 0) || (!dirOnly && !z->isDirectory)
+		|| (dirOnly && z->isDirectory))) {
+	    AppendWithPrefix(result, prefixBuf, z->name, -1);
 	}
 	goto end;
     }
 
+    /*
+     * We've got to work for our supper and do the actual globbing. And all
+     * we've got really is an undifferentiated pile of all the filenames we've
+     * got from all our ZIP mounts.
+     */
+
     l = strlen(pattern);
     pat = (char *) Tcl_Alloc(len + l + 2);
     memcpy(pat, path, len);
@@ -4574,6 +4935,7 @@ ZipFSMatchInDirectoryProc(
     }
     memcpy(pat + len, pattern, l + 1);
     scnt = CountSlashes(pat);
+
     for (hPtr = Tcl_FirstHashEntry(&ZipFS.fileHash, &search);
 	    hPtr; hPtr = Tcl_NextHashEntry(&search)) {
 	ZipEntry *z = (ZipEntry *) Tcl_GetHashValue(hPtr);
@@ -4583,16 +4945,7 @@ ZipFSMatchInDirectoryProc(
 	    continue;
 	}
 	if ((z->depth == scnt) && Tcl_StringCaseMatch(z->name, pat, 0)) {
-	    if (prefix) {
-		Tcl_DStringAppend(&dsPref, z->name + strip, -1);
-		Tcl_ListObjAppendElement(NULL, result,
-			Tcl_NewStringObj(Tcl_DStringValue(&dsPref),
-				Tcl_DStringLength(&dsPref)));
-		Tcl_DStringSetLength(&dsPref, prefixLen);
-	    } else {
-		Tcl_ListObjAppendElement(NULL, result,
-			Tcl_NewStringObj(z->name + strip, -1));
-	    }
+	    AppendWithPrefix(result, prefixBuf, z->name + strip, -1);
 	}
     }
     Tcl_Free(pat);
@@ -4606,6 +4959,87 @@ ZipFSMatchInDirectoryProc(
 /*
  *-------------------------------------------------------------------------
  *
+ * ZipFSMatchMountPoints --
+ *
+ *	This routine is a worker for ZipFSMatchInDirectoryProc, used by the
+ *	globbing code to search for all mount points files which match a given
+ *	pattern.
+ *
+ * Results:
+ *	None.
+ *
+ * Side effects:
+ *	Adds the matching mounts to the list in result, uses prefix as working
+ *	space if it is non-NULL.
+ *
+ *-------------------------------------------------------------------------
+ */
+
+static void
+ZipFSMatchMountPoints(
+    Tcl_Obj *result,		/* The list of matches being built. */
+    Tcl_Obj *normPathPtr,	/* Where we're looking from. */
+    const char *pattern,	/* What we're looking for. NULL for a full
+				 * list. */
+    Tcl_DString *prefix)	/* Workspace filled with a prefix for all the
+				 * filenames, or NULL if no prefix is to be
+				 * used. */
+{
+    Tcl_HashEntry *hPtr;
+    Tcl_HashSearch search;
+    int l, normLength;
+    const char *path = TclGetStringFromObj(normPathPtr, &normLength);
+    size_t len = (size_t) normLength;
+
+    l = CountSlashes(path);
+    if (path[len - 1] == '/') {
+	len--;
+    } else {
+	l++;
+    }
+    if (!pattern || (pattern[0] == '\0')) {
+	pattern = "*";
+    }
+
+    for (hPtr = Tcl_FirstHashEntry(&ZipFS.zipHash, &search); hPtr;
+	    hPtr = Tcl_NextHashEntry(&search)) {
+	ZipFile *zf = (ZipFile *) Tcl_GetHashValue(hPtr);
+
+	if (zf->mountPointLen == 0) {
+	    ZipEntry *z;
+
+	    /*
+	     * Enumerate the contents of the ZIP; it's mounted on the root.
+	     */
+
+	    for (z = zf->topEnts; z; z = z->tnext) {
+		size_t lenz = strlen(z->name);
+
+		if ((lenz > len + 1) && (strncmp(z->name, path, len) == 0)
+			&& (z->name[len] == '/')
+			&& (CountSlashes(z->name) == l)
+			&& Tcl_StringCaseMatch(z->name + len + 1, pattern, 0)) {
+		    AppendWithPrefix(result, prefix, z->name, lenz);
+		}
+	    }
+	} else if ((zf->mountPointLen > len + 1)
+		&& (strncmp(zf->mountPoint, path, len) == 0)
+		&& (zf->mountPoint[len] == '/')
+		&& (CountSlashes(zf->mountPoint) == l)
+		&& Tcl_StringCaseMatch(zf->mountPoint + len + 1,
+			pattern, 0)) {
+	    /*
+	     * Standard mount; append if it matches.
+	     */
+
+	    AppendWithPrefix(result, prefix, zf->mountPoint, zf->mountPointLen);
+	}
+    }
+}
+
+/*
+ *-------------------------------------------------------------------------
+ *
  * ZipFSPathInFilesystemProc --
  *
  *	This function determines if the given path object is in the ZIP
@@ -4717,11 +5151,25 @@ ZipFSListVolumesProc(void)
  *-------------------------------------------------------------------------
  */
 
+enum ZipFileAttrs {
+    ZIP_ATTR_UNCOMPSIZE,
+    ZIP_ATTR_COMPSIZE,
+    ZIP_ATTR_OFFSET,
+    ZIP_ATTR_MOUNT,
+    ZIP_ATTR_ARCHIVE,
+    ZIP_ATTR_PERMISSIONS,
+    ZIP_ATTR_CRC
+};
+
 static const char *const *
 ZipFSFileAttrStringsProc(
     TCL_UNUSED(Tcl_Obj *) /*pathPtr*/,
     TCL_UNUSED(Tcl_Obj **) /*objPtrRef*/)
 {
+    /*
+     * Must match up with ZipFileAttrs enum above.
+     */
+
     static const char *const attrs[] = {
 	"-uncompsize",
 	"-compsize",
@@ -4729,6 +5177,7 @@ ZipFSFileAttrStringsProc(
 	"-mount",
 	"-archive",
 	"-permissions",
+	"-crc",
 	NULL,
     };
 
@@ -4770,7 +5219,7 @@ ZipFSFileAttrsGetProc(
     if (!pathPtr) {
 	return -1;
     }
-    path = Tcl_GetStringFromObj(pathPtr, &len);
+    path = TclGetStringFromObj(pathPtr, &len);
     ReadLock();
     z = ZipFSLookup(path);
     if (!z) {
@@ -4780,27 +5229,31 @@ ZipFSFileAttrsGetProc(
 	goto done;
     }
     switch (index) {
-    case 0:
+    case ZIP_ATTR_UNCOMPSIZE:
 	TclNewIntObj(*objPtrRef, z->numBytes);
 	break;
-    case 1:
+    case ZIP_ATTR_COMPSIZE:
 	TclNewIntObj(*objPtrRef, z->numCompressedBytes);
 	break;
-    case 2:
+    case ZIP_ATTR_OFFSET:
 	TclNewIntObj(*objPtrRef, z->offset);
 	break;
-    case 3:
+    case ZIP_ATTR_MOUNT:
 	*objPtrRef = Tcl_NewStringObj(z->zipFilePtr->mountPoint,
 		z->zipFilePtr->mountPointLen);
 	break;
-    case 4:
+    case ZIP_ATTR_ARCHIVE:
 	*objPtrRef = Tcl_NewStringObj(z->zipFilePtr->name, -1);
 	break;
-    case 5:
+    case ZIP_ATTR_PERMISSIONS:
 	*objPtrRef = Tcl_NewStringObj("0o555", -1);
 	break;
+    case ZIP_ATTR_CRC:
+	TclNewIntObj(*objPtrRef, z->crc32);
+	break;
     default:
 	ZIPFS_ERROR(interp, "unknown attribute");
+	ZIPFS_ERROR_CODE(interp, "FILE_ATTR");
 	ret = TCL_ERROR;
     }
 
@@ -4833,10 +5286,8 @@ ZipFSFileAttrsSetProc(
     TCL_UNUSED(Tcl_Obj *) /*pathPtr*/,
     TCL_UNUSED(Tcl_Obj *) /*objPtr*/)
 {
-    if (interp) {
-	Tcl_SetObjResult(interp, Tcl_NewStringObj("unsupported operation", -1));
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "UNSUPPORTED_OP", NULL);
-    }
+    ZIPFS_ERROR(interp, "unsupported operation");
+    ZIPFS_ERROR_CODE(interp, "UNSUPPORTED_OP");
     return TCL_ERROR;
 }
 
@@ -4938,7 +5389,7 @@ ZipFSLoadFile(
 	if (execName) {
 	    const char *p = strrchr(execName, '/');
 
-	    if (p > execName + 1) {
+	    if (p && p > execName + 1) {
 		--p;
 		objs[0] = Tcl_NewStringObj(execName, p - execName);
 	    }
@@ -5054,8 +5505,10 @@ TclZipfs_Init(
 	Tcl_Obj *mapObj;
 
 	Tcl_EvalEx(interp, findproc, -1, TCL_EVAL_GLOBAL);
-	Tcl_LinkVar(interp, "::tcl::zipfs::wrmax", (char *) &ZipFS.wrmax,
-		TCL_LINK_INT);
+	if (!Tcl_IsSafe(interp)) {
+	    Tcl_LinkVar(interp, "::tcl::zipfs::wrmax", (char *) &ZipFS.wrmax,
+		    TCL_LINK_INT);
+	}
 	ensemble = TclMakeEnsemble(interp, "zipfs",
 		Tcl_IsSafe(interp) ? (initMap + 4) : initMap);
 
@@ -5073,7 +5526,7 @@ TclZipfs_Init(
     return TCL_OK;
 #else /* !HAVE_ZLIB */
     ZIPFS_ERROR(interp, "no zlib available");
-    Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "NO_ZLIB", NULL);
+    ZIPFS_ERROR_CODE(interp, "NO_ZLIB");
     return TCL_ERROR;
 #endif /* HAVE_ZLIB */
 }
@@ -5283,9 +5736,7 @@ TclZipfs_Mount(
 				 * the ZIP is unprotected. */
 {
     ZIPFS_ERROR(interp, "no zlib available");
-    if (interp) {
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "NO_ZLIB", NULL);
-    }
+    ZIPFS_ERROR_CODE(interp, "NO_ZLIB");
     return TCL_ERROR;
 }
 
@@ -5298,9 +5749,7 @@ TclZipfs_MountBuffer(
     int copy)
 {
     ZIPFS_ERROR(interp, "no zlib available");
-    if (interp) {
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "NO_ZLIB", NULL);
-    }
+    ZIPFS_ERROR_CODE(interp, "NO_ZLIB");
     return TCL_ERROR;
 }
 
@@ -5310,9 +5759,7 @@ TclZipfs_Unmount(
     const char *mountPoint)	/* Mount point path. */
 {
     ZIPFS_ERROR(interp, "no zlib available");
-    if (interp) {
-	Tcl_SetErrorCode(interp, "TCL", "ZIPFS", "NO_ZLIB", NULL);
-    }
+    ZIPFS_ERROR_CODE(interp, "NO_ZLIB");
     return TCL_ERROR;
 }
 #endif /* !HAVE_ZLIB */