Add file access protection to file enumeration.filesec

The low level implementation of Postscript's filenameforall (*_enumerate_files)
needs to also honour file access protection.

This is has been complicated by requiring a gs_memory_t to be available where
it wasn't previously (in order to access the gs_lib_ctx and the file permissions
lists therein).

16 files changed, 166 insertions, 119 deletions

diff --git a/base/gp.h b/base/gp.h
index 0ae9d16ae..7c28007b5 100644
--- a/base/gp.h
+++ b/base/gp.h
@@ -572,8 +572,7 @@ typedef struct file_enum_s file_enum;
  * string of ?s should be interpreted as *.  Note that \ can appear in
  * the pattern also, as a quoting character.
  */
-file_enum *gp_enumerate_files_init(const char *pat, uint patlen,
-                                   gs_memory_t * memory);
+file_enum *gp_enumerate_files_init(gs_memory_t *memory, const char *pat, uint patlen);
 
 /*
  * Return the next file name in the enumeration.  The client passes in
@@ -582,7 +581,7 @@ file_enum *gp_enumerate_files_init(const char *pat, uint patlen,
  * returns max length +1.  If there are no more files, the procedure
  * returns -1.
  */
-uint gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen);
+uint gp_enumerate_files_next(gs_memory_t *memory, file_enum * pfen, char *ptr, uint maxlen);
 
 /*
  * Clean up a file enumeration.  This is only called to abandon
@@ -590,7 +589,7 @@ uint gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen);
  * no more files to enumerate.  This should deallocate the file_enum
  * structure and any subsidiary structures, strings, buffers, etc.
  */
-void gp_enumerate_files_close(file_enum * pfen);
+void gp_enumerate_files_close(gs_memory_t *memory, file_enum * pfen);
 
 /* ------ Font enumeration ------ */
 
@@ -660,6 +659,12 @@ int gp_can_share_fdesc(void);
 
 int gp_stat_impl(const gs_memory_t *mem, const char *path, struct stat *buf);
 
+file_enum *gp_enumerate_files_init_impl(gs_memory_t *memory, const char *pat, uint patlen);
+
+uint gp_enumerate_files_next_impl(gs_memory_t *memory, file_enum * pfen, char *ptr, uint maxlen);
+
+void gp_enumerate_files_close_impl(gs_memory_t *memory, file_enum * pfen);
+
 /* We don't define gp_fread_64, gp_fwrite_64,
    because (1) known platforms allow regular fread, fwrite
    to be applied to a file opened with O_LARGEFILE,
diff --git a/base/gp_dosfe.c b/base/gp_dosfe.c
index 75ef20bb3..48347c18b 100644
--- a/base/gp_dosfe.c
+++ b/base/gp_dosfe.c
@@ -42,7 +42,7 @@ gs_private_st_ptrs1(st_file_enum, struct file_enum_s, "file_enum",
 /* Initialize an enumeration.  Note that * and ? in a directory */
 /* don't work, and \ is taken literally unless a second \ follows. */
 file_enum *
-gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
+gp_enumerate_files_init_impl(gs_memory_t * mem, const char *pat, uint patlen)
 {
     file_enum *pfen = gs_alloc_struct(mem, file_enum, &st_file_enum, "gp_enumerate_files");
     int pat_size = 2 * patlen + 1;
@@ -107,7 +107,7 @@ static const string_match_params smp_file =
 {'*', '?', -1, true, true};
 
 uint
-gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
+gp_enumerate_files_next_impl(gs_memory_t * mem, file_enum * pfen, char *ptr, uint maxlen)
 {
     int code;
     char *p, *q;
@@ -120,7 +120,7 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
     } else
         code = dos_findnext(&pfen->ffblk);
     if (code != 0) {		/* All done, clean up. */
-        gp_enumerate_files_close(pfen);
+        gp_enumerate_files_close(mem, pfen);
         return ~(uint) 0;
     }
     if (maxlen < 13 + pfen->head_size)
@@ -138,11 +138,12 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
 
 /* Clean up the file enumeration. */
 void
-gp_enumerate_files_close(file_enum * pfen)
+gp_enumerate_files_close_impl(gs_memory_t * mem, file_enum * pfen)
 {
-    gs_memory_t *mem = pfen->memory;
+    gs_memory_t *mem2 = pfen->memory;
+    (void)mem;
 
-    gs_free_object(mem, pfen->pattern,
+    gs_free_object(mem2, pfen->pattern,
                    "gp_enumerate_files_close(pattern)");
-    gs_free_object(mem, pfen, "gp_enumerate_files_close");
+    gs_free_object(mem2, pfen, "gp_enumerate_files_close");
 }
diff --git a/base/gp_ntfs.c b/base/gp_ntfs.c
index 69a1de13b..aaf183be6 100644
--- a/base/gp_ntfs.c
+++ b/base/gp_ntfs.c
@@ -152,7 +152,7 @@ static int enumerate_directory_init(gs_memory_t *mem, directory_enum *pden, cons
 /* don't work with the OS call currently used. The '\' escape	*/
 /* character is removed for the 'Find...File' function.		*/
 file_enum *
-gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
+gp_enumerate_files_init_impl(gs_memory_t * mem, const char *pat, uint patlen)
 {
     directory_enum *pden;
     file_enum *pfen;
@@ -226,14 +226,15 @@ gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
 
 /* Enumerate the next file. */
 uint
-gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
+gp_enumerate_files_next_impl(gs_memory_t * mem, file_enum * pfen, char *ptr, uint maxlen)
 {
     directory_enum *new_denum = NULL, *pden = pfen->current;
     int code = 0;
     uint len;
     char outfname[(sizeof(pden->find_data.cFileName)*3+1)/2];
+
     if (pfen->illegal) {
-        gp_enumerate_files_close(pfen);
+        gp_enumerate_files_close(mem, pfen);
         return ~(uint) 0;
     }
 
@@ -256,9 +257,9 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
                 if (pden->previous) {
                     FindClose(pden->find_handle);
                     gs_free_object(pden->memory, pden->pattern,
-                       "gp_enumerate_files_close(pattern)");
+                       "gp_enumerate_files_next(pattern)");
                     new_denum = pden->previous;
-                    gs_free_object(pden->memory, pden, "gp_enumerate_files_close");
+                    gs_free_object(pden->memory, pden, "gp_enumerate_files_next");
                     pden = new_denum;
                     pfen->current = pden;
                     continue;
@@ -273,7 +274,7 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
                 if (pden->previous) {
                     FindClose(pden->find_handle);
                     gs_free_object(pden->memory, pden->pattern,
-                       "gp_enumerate_files_close(pattern)");
+                       "gp_enumerate_files_next(pattern)");
                     new_denum = pden->previous;
                     gs_free_object(pden->memory, pden, "gp_enumerate_files_close");
                     pden = new_denum;
@@ -314,7 +315,7 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
     }
 
     if (code != 0) {		/* All done, clean up. */
-        gp_enumerate_files_close(pfen);
+        gp_enumerate_files_close(mem, pfen);
         return ~(uint) 0;
     }
     wchar_to_utf8(outfname, pden->find_data.cFileName);
@@ -331,23 +332,24 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
 
 /* Clean up the file enumeration. */
 void
-gp_enumerate_files_close(file_enum * pfen)
+gp_enumerate_files_close_impl(gs_memory_t * mem, file_enum * pfen)
 {
     directory_enum *ptenum, *pden = pfen->current;
-    gs_memory_t *mem = pden->memory;
+    gs_memory_t *mem2 = pden->memory;
+    (void)mem;
 
     while (pden) {
         if (pden->find_handle != INVALID_HANDLE_VALUE)
             FindClose(pden->find_handle);
-        gs_free_object(mem, pden->pattern,
+        gs_free_object(mem2, pden->pattern,
                    "gp_enumerate_files_close(pattern)");
         ptenum = pden->previous;
-        gs_free_object(mem, pden, "gp_enumerate_files_close");
+        gs_free_object(mem2, pden, "gp_enumerate_files_close");
         pden = ptenum;
     };
-    gs_free_object(mem, pfen->pattern,
+    gs_free_object(mem2, pfen->pattern,
          "gp_enumerate_files_close(pattern)");
-    gs_free_object(mem, pfen, "gp_enumerate_files_close");
+    gs_free_object(mem2, pfen, "gp_enumerate_files_close");
 }
 
 /* -------------- Helpers for gp_file_name_combine_generic ------------- */
diff --git a/base/gp_os2fs.c b/base/gp_os2fs.c
index 232151e3a..f365f772a 100644
--- a/base/gp_os2fs.c
+++ b/base/gp_os2fs.c
@@ -88,7 +88,7 @@ gs_private_st_ptrs1(st_file_enum, struct file_enum_s, "file_enum",
 
 /* Initialize an enumeration.  may NEED WORK ON HANDLING * ? \. */
 file_enum *
-gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
+gp_enumerate_files_init_impl(gs_memory_t * mem, const char *pat, uint patlen)
 {
     file_enum *pfen = gs_alloc_struct(mem, file_enum, &st_file_enum, "gp_enumerate_files");
     int pat_size = 2 * patlen + 1;
@@ -132,10 +132,11 @@ gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
 
 /* Enumerate the next file. */
 uint
-gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
+gp_enumerate_files_next_impl(gs_memory_t * mem, file_enum * pfen, char *ptr, uint maxlen)
 {
     APIRET rc;
     ULONG cFilenames = 1;
+    (void)mem;
 
     if (!isos2) {
         /* CAN'T DO IT SO JUST RETURN THE PATTERN. */
@@ -180,15 +181,16 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
 
 /* Clean up the file enumeration. */
 void
-gp_enumerate_files_close(file_enum * pfen)
+gp_enumerate_files_close_impl(gs_memory_t * mem, file_enum * pfen)
 {
-    gs_memory_t *mem = pfen->memory;
+    gs_memory_t *mem2 = pfen->memory;
+    (void)mem;
 
     if (isos2)
         DosFindClose(pfen->hdir);
-    gs_free_object(mem, pfen->pattern,
+    gs_free_object(mem2, pfen->pattern,
                    "gp_enumerate_files_close(pattern)");
-    gs_free_object(mem, pfen, "gp_enumerate_files_close");
+    gs_free_object(mem2, pfen, "gp_enumerate_files_close");
 }
 
 /* ------ File naming and accessing ------ */
diff --git a/base/gp_unifs.c b/base/gp_unifs.c
index c3c37b120..c900326d4 100644
--- a/base/gp_unifs.c
+++ b/base/gp_unifs.c
@@ -329,7 +329,7 @@ popdir(file_enum * pfen)
 
 /* Initialize an enumeration. */
 file_enum *
-gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
+gp_enumerate_files_init_impl(gs_memory_t * mem, const char *pat, uint patlen)
 {
 #ifdef GS_NO_FILESYSTEM
     return &dummy_enum;
@@ -423,7 +423,7 @@ fail1:
 
 /* Enumerate the next file. */
 uint
-gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
+gp_enumerate_files_next_impl(gs_memory_t * mem, file_enum * pfen, char *ptr, uint maxlen)
 {
 #ifdef GS_NO_FILESYSTEM
     return ~(uint)0;
@@ -441,7 +441,7 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
         if_debug1m('e', pfen->memory, "[e]file_enum:First-Open '%s'\n", work);
         pfen->first_time = false;
         if (pfen->dirp == 0) {  /* first opendir failed */
-            gp_enumerate_files_close(pfen);
+            gp_enumerate_files_close(mem, pfen);
             return ~(uint) 0;
         }
     }
@@ -473,7 +473,7 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
             goto top;
         } else {
             if_debug0m('e', pfen->memory, "[e]file_enum:Dirstack empty\n");
-            gp_enumerate_files_close(pfen);
+            gp_enumerate_files_close(mem, pfen);
             return ~(uint) 0;
         }
     }
@@ -588,21 +588,22 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
 
 /* Clean up the file enumeration. */
 void
-gp_enumerate_files_close(file_enum * pfen)
+gp_enumerate_files_close_impl(gs_memory_t * mem, file_enum * pfen)
 {
 #ifdef GS_NO_FILESYSTEM
     /* No cleanup necessary */
 #else
-    gs_memory_t *mem = pfen->memory;
+    gs_memory_t *mem2 = pfen->memory;
+    (void)mem;
 
-    if_debug0m('e', mem, "[e]file_enum:Cleanup\n");
+    if_debug0m('e', mem2, "[e]file_enum:Cleanup\n");
     while (popdir(pfen))        /* clear directory stack */
         DO_NOTHING;
-    gs_free_object(mem, (byte *) pfen->work,
+    gs_free_object(mem2, (byte *) pfen->work,
                    "gp_enumerate_close(work)");
-    gs_free_object(mem, (byte *) pfen->pattern,
+    gs_free_object(mem2, (byte *) pfen->pattern,
                    "gp_enumerate_files_close(pattern)");
-    gs_free_object(mem, pfen, "gp_enumerate_files_close");
+    gs_free_object(mem2, pfen, "gp_enumerate_files_close");
 #endif
 }
 
diff --git a/base/gp_vms.c b/base/gp_vms.c
index a40189cc0..469447284 100644
--- a/base/gp_vms.c
+++ b/base/gp_vms.c
@@ -323,7 +323,7 @@ gp_free_enumeration(file_enum * pfen)
 /* Begin an enumeration.  See gp.h for details. */
 
 file_enum *
-gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
+gp_enumerate_files_init_impl(gs_memory_t * mem, const char *pat, uint patlen)
 {
     file_enum *pfen;
     uint i, len;
@@ -398,12 +398,13 @@ gp_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
 /* returns -1. */
 
 uint
-gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
+gp_enumerate_files_next_impl(gs_memory_t * mem, file_enum * pfen, char *ptr, uint maxlen)
 {
     char *c, filnam[NAM$C_MAXRSS];
     descrip result =
     {NAM$C_MAXRSS, DSC$K_DTYPE_T, DSC$K_CLASS_S, 0};
     uint i, len;
+    (void)mem;
 
     result.dsc$a_pointer = filnam;
 
@@ -432,8 +433,9 @@ gp_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
 /* structure and any subsidiary structures, strings, buffers, etc. */
 
 void
-gp_enumerate_files_close(file_enum * pfen)
+gp_enumerate_files_close_impl(gs_memory_t * mem, file_enum * pfen)
 {
+    (void)mem;
     gp_free_enumeration(pfen);
 }
 
diff --git a/base/gpmisc.c b/base/gpmisc.c
index 28550045f..dc1231c96 100644
--- a/base/gpmisc.c
+++ b/base/gpmisc.c
@@ -833,17 +833,31 @@ gp_stat(const gs_memory_t *mem, const char *path, struct stat *buf)
     return gp_stat_impl(mem, path, buf);
 }
 
-static int
-ends_in(const char *first, const char *last, const char *ds, size_t len)
+file_enum *
+gp_enumerate_files_init(gs_memory_t *mem, const char *pat, uint patlen)
 {
-    while (len) {
-        if (last < first)
-            return 0; /* No match */
-        if (*last != ds[--len])
-            return 0; /* No match */
-        last--;
+    return gp_enumerate_files_init_impl(mem, pat, patlen);
+}
+
+uint
+gp_enumerate_files_next(gs_memory_t *mem, file_enum * pfen, char *ptr, uint maxlen)
+{
+    uint code = 0;
+
+    while (code == 0) {
+        code = gp_enumerate_files_next_impl(mem, pfen, ptr, maxlen);
+        if (code == ~0) break;
+        if (code > 0) {
+            if (gp_validate_path(mem, ptr, "r") != 0)
+                code = 0;
+        }
     }
-    return 1;
+    return code;
+}
+void
+gp_enumerate_files_close(gs_memory_t *mem, file_enum * pfen)
+{
+    gp_enumerate_files_close_impl(mem, pfen);
 }
 
 /* Path validation: (FIXME: Move this somewhere better)
@@ -881,6 +895,19 @@ ends_in(const char *first, const char *last, const char *ds, size_t len)
  */
 
 static int
+ends_in(const char *first, const char *last, const char *ds, size_t len)
+{
+    while (len) {
+        if (last < first)
+            return 0; /* No match */
+        if (*last != ds[--len])
+            return 0; /* No match */
+        last--;
+    }
+    return 1;
+}
+
+static int
 validate(const gs_memory_t *mem,
          const char        *path,
          gs_path_control_t  type)
@@ -962,7 +989,9 @@ gp_validate_path(const gs_memory_t *mem,
     uint rlen;
     int code = 0;
 
-    if (mem->gs_lib_ctx->core->path_control_active == 0)
+    /* mem->gs_lib_ctx can be NULL when we're called from mkromfs */
+    if (mem->gs_lib_ctx == NULL ||
+        mem->gs_lib_ctx->core->path_control_active == 0)
         return 0;
 
     len = strlen(path);
diff --git a/base/gsiodev.c b/base/gsiodev.c
index b3369353c..1619f46aa 100644
--- a/base/gsiodev.c
+++ b/base/gsiodev.c
@@ -260,8 +260,8 @@ iodev_no_file_status(gx_io_device * iodev, const char *fname, struct stat *pstat
 }
 
 file_enum *
-iodev_no_enumerate_files(gx_io_device * iodev, const char *pat, uint patlen,
-                         gs_memory_t * memory)
+iodev_no_enumerate_files(gs_memory_t *mem, gx_io_device * iodev, const char *pat,
+                         uint patlen)
 {
     return NULL;
 }
@@ -322,10 +322,10 @@ os_status(gx_io_device * iodev, const char *fname, struct stat *pstat)
 }
 
 static file_enum *
-os_enumerate(gx_io_device * iodev, const char *pat, uint patlen,
-             gs_memory_t * mem)
+os_enumerate(gs_memory_t * mem, gx_io_device * iodev, const char *pat,
+             uint patlen)
 {
-    return gp_enumerate_files_init(pat, patlen, mem);
+    return gp_enumerate_files_init(mem, pat, patlen);
 }
 
 static int
@@ -476,7 +476,7 @@ gs_private_st_ptrs1(st_gs_file_enum, gs_file_enum, "gs_file_enum",
                     gs_file_enum_enum_ptrs, gs_file_enum_reloc_ptrs, pfile_enum);
 
 file_enum *
-gs_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
+gs_enumerate_files_init(gs_memory_t * mem, const char *pat, uint patlen)
 {
     file_enum *pfen;
     gs_file_enum *pgs_file_enum;
@@ -494,15 +494,15 @@ gs_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
     if (pfn.len == 0 || iodev->procs.enumerate_files == iodev_no_enumerate_files) {
         return NULL;	/* no pattern, or device not found -- just return */
     }
-    pfen = iodev->procs.enumerate_files(iodev, (const char *)pfn.fname,
-                pfn.len, mem);
+    pfen = iodev->procs.enumerate_files(mem, iodev, (const char *)pfn.fname,
+                pfn.len);
     if (pfen == 0)
         return NULL;
     pgs_file_enum = gs_alloc_struct(mem, gs_file_enum, &st_gs_file_enum,
                            "gs_enumerate_files_init");
     if (pgs_file_enum == 0)
     {
-        iodev->procs.enumerate_close(pfen);
+        iodev->procs.enumerate_close(mem, pfen);
         return NULL;
     }
     pgs_file_enum->memory = mem;
@@ -513,7 +513,8 @@ gs_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem)
 }
 
 uint
-gs_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
+gs_enumerate_files_next(gs_memory_t * mem, file_enum * pfen, char *ptr,
+                        uint maxlen)
 {
     gs_file_enum *pgs_file_enum = (gs_file_enum *)pfen;
     int iodev_name_len;
@@ -529,23 +530,23 @@ gs_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen)
         return maxlen + 1;	/* signal overflow error */
     if (iodev_name_len > 0)
         memcpy(ptr, pgs_file_enum->piodev->dname, iodev_name_len);
-    return_len = pgs_file_enum->piodev->procs.enumerate_next(pgs_file_enum->pfile_enum,
+    return_len = pgs_file_enum->piodev->procs.enumerate_next(mem, pgs_file_enum->pfile_enum,
                                 ptr + iodev_name_len, maxlen - iodev_name_len);
     if (return_len == ~0) {
-        gs_memory_t *mem = pgs_file_enum->memory;
+        gs_memory_t *mem2 = pgs_file_enum->memory;
 
-        gs_free_object(mem, pgs_file_enum, "gs_enumerate_files_close");
+        gs_free_object(mem2, pgs_file_enum, "gs_enumerate_files_close");
         return ~0;
     }
     return return_len+iodev_name_len;
 }
 
 void
-gs_enumerate_files_close(file_enum * pfen)
+gs_enumerate_files_close(gs_memory_t * mem, file_enum * pfen)
 {
     gs_file_enum *pgs_file_enum = (gs_file_enum *)pfen;
-    gs_memory_t *mem = pgs_file_enum->memory;
+    gs_memory_t *mem2 = pgs_file_enum->memory;
 
-    pgs_file_enum->piodev->procs.enumerate_close(pgs_file_enum->pfile_enum);
-    gs_free_object(mem, pgs_file_enum, "gs_enumerate_files_close");
+    pgs_file_enum->piodev->procs.enumerate_close(mem, pgs_file_enum->pfile_enum);
+    gs_free_object(mem2, pgs_file_enum, "gs_enumerate_files_close");
 }
diff --git a/base/gsiodisk.c b/base/gsiodisk.c
index ccb260e48..24f534265 100644
--- a/base/gsiodisk.c
+++ b/base/gsiodisk.c
@@ -355,8 +355,8 @@ done:
 }
 
 static file_enum *
-diskn_enumerate_files(gx_io_device * iodev, const char *pat, uint patlen,
-             gs_memory_t * mem)
+diskn_enumerate_files(gs_memory_t * mem, gx_io_device * iodev, const char *pat,
+                      uint patlen)
 {
     diskn_state * pstate = (diskn_state *)iodev->state;
     
@@ -364,14 +364,16 @@ diskn_enumerate_files(gx_io_device * iodev, const char *pat, uint patlen,
 }
 
 static void
-diskn_enumerate_close(file_enum *pfen)
+diskn_enumerate_close(gs_memory_t * mem, file_enum *pfen)
 {
+    (void)mem;
     map_file_enum_close((void *)pfen);
 }
 
 static uint
-diskn_enumerate_next(file_enum *pfen, char *ptr, uint maxlen)
+diskn_enumerate_next(gs_memory_t * mem, file_enum *pfen, char *ptr, uint maxlen)
 {
+    (void)mem;
     if (map_file_enum_next((void *)pfen, ptr))
         return strlen(ptr);
     /* If we did not find a file then clean up */
diff --git a/base/gsioram.c b/base/gsioram.c
index 04f2e14ff..c0199b75b 100644
--- a/base/gsioram.c
+++ b/base/gsioram.c
@@ -487,8 +487,8 @@ ram_status(gx_io_device * iodev, const char *fname, struct stat *pstat)
 }
 
 static file_enum *
-ram_enumerate_init(gx_io_device *iodev, const char *pat, uint patlen,
-    gs_memory_t *mem)
+ram_enumerate_init(gs_memory_t * mem, gx_io_device *iodev, const char *pat,
+                   uint patlen)
 {
     gsram_enum * penum = gs_alloc_struct(
     mem, gsram_enum, &st_gsram_enum,
@@ -497,6 +497,7 @@ ram_enumerate_init(gx_io_device *iodev, const char *pat, uint patlen,
     char *pattern = (char *)gs_alloc_bytes(
     mem, patlen+1, "ram_enumerate_file_init(pattern)"
     );
+
     ramfs_enum * e = ramfs_enum_new(GETRAMFS(iodev->state));
     if(penum && pattern && e) {
     memcpy(pattern, pat, patlen);
@@ -515,18 +516,19 @@ ram_enumerate_init(gx_io_device *iodev, const char *pat, uint patlen,
 }
 
 static void
-ram_enumerate_close(file_enum *pfen)
+ram_enumerate_close(gs_memory_t * mem, file_enum *pfen)
 {
     gsram_enum *penum = (gsram_enum *)pfen;
-    gs_memory_t *mem = penum->memory;
+    gs_memory_t *mem2 = penum->memory;
+    (void)mem;
 
     ramfs_enum_end(penum->e);
-    gs_free_object(mem, penum->pattern, "ramfs_enum_init(pattern)");
-    gs_free_object(mem, penum, "ramfs_enum_init(ramfs_enum)");
+    gs_free_object(mem2, penum->pattern, "ramfs_enum_init(pattern)");
+    gs_free_object(mem2, penum, "ramfs_enum_init(ramfs_enum)");
 }
 
 static uint
-ram_enumerate_next(file_enum *pfen, char *ptr, uint maxlen)
+ram_enumerate_next(gs_memory_t * mem, file_enum *pfen, char *ptr, uint maxlen)
 {
     gsram_enum *penum = (gsram_enum *)pfen;
 
@@ -541,7 +543,7 @@ ram_enumerate_next(file_enum *pfen, char *ptr, uint maxlen)
     }
     }
     /* ran off end of list, close the enum */
-    ram_enumerate_close(pfen);
+    ram_enumerate_close(mem, pfen);
     return ~(uint)0;
 }
 
diff --git a/base/gsiorom.c b/base/gsiorom.c
index 9e6c27173..6f76427cf 100644
--- a/base/gsiorom.c
+++ b/base/gsiorom.c
@@ -351,8 +351,8 @@ romfs_file_status(gx_io_device * iodev, const char *fname, struct stat *pstat)
 }
 
 static file_enum *
-romfs_enumerate_files_init(gx_io_device *iodev, const char *pat, uint patlen,
-             gs_memory_t *mem)
+romfs_enumerate_files_init(gs_memory_t * mem, gx_io_device *iodev, const char *pat,
+                           uint patlen)
 {
     romfs_file_enum *penum = gs_alloc_struct(mem, romfs_file_enum, &st_romfs_file_enum,
                                                         "romfs_enumerate_files_init(file_enum)");
@@ -363,7 +363,7 @@ romfs_enumerate_files_init(gx_io_device *iodev, const char *pat, uint patlen,
     penum->list_index = 0;		/* start at first node */
     penum->memory = mem;
     if (penum->pattern == NULL) {
-        romfs_enumerate_close((file_enum *) penum);
+        romfs_enumerate_close(mem, (file_enum *) penum);
         return NULL;
     }
     memcpy(penum->pattern, pat, patlen);	/* Copy string to buffer */
@@ -373,21 +373,23 @@ romfs_enumerate_files_init(gx_io_device *iodev, const char *pat, uint patlen,
 }
 
 static void
-romfs_enumerate_close(file_enum *pfen)
+romfs_enumerate_close(gs_memory_t * mem, file_enum *pfen)
 {
     romfs_file_enum *penum = (romfs_file_enum *)pfen;
-    gs_memory_t *mem = penum->memory;
+    gs_memory_t *mem2 = penum->memory;
+    (void)mem;
 
     if (penum->pattern)
-        gs_free_object(mem, penum->pattern, "romfs_enum_init(pattern)");
-    gs_free_object(mem, penum, "romfs_enum_init(romfs_enum)");
+        gs_free_object(mem2, penum->pattern, "romfs_enum_init(pattern)");
+    gs_free_object(mem2, penum, "romfs_enum_init(romfs_enum)");
 }
 
 static uint
-romfs_enumerate_next(file_enum *pfen, char *ptr, uint maxlen)
+romfs_enumerate_next(gs_memory_t * mem, file_enum *pfen, char *ptr, uint maxlen)
 {
     extern const uint32_t *gs_romfs[];
     romfs_file_enum *penum = (romfs_file_enum *)pfen;
+    (void)mem;
 
     while (gs_romfs[penum->list_index] != 0) {
         const uint32_t *node = gs_romfs[penum->list_index];
@@ -405,6 +407,6 @@ romfs_enumerate_next(file_enum *pfen, char *ptr, uint maxlen)
         }
     }
     /* ran off end of list, close the enum */
-    romfs_enumerate_close(pfen);
+    romfs_enumerate_close(mem, pfen);
     return ~(uint)0;
 }
diff --git a/base/gxiodev.h b/base/gxiodev.h
index 3363749d8..fa9065f67 100644
--- a/base/gxiodev.h
+++ b/base/gxiodev.h
@@ -110,16 +110,16 @@ struct gx_io_device_procs_s {
     iodev_proc_file_status((*file_status));
 
 #define iodev_proc_enumerate_files(proc)\
-  file_enum *proc(gx_io_device *iodev, const char *pat, uint patlen,\
-                  gs_memory_t *mem)
+  file_enum *proc(gs_memory_t *memory, gx_io_device *iodev, \
+                  const char *pat, uint patlen)
     iodev_proc_enumerate_files((*enumerate_files));
 
 #define iodev_proc_enumerate_next(proc)\
-  uint proc(file_enum *pfen, char *ptr, uint maxlen)
+  uint proc(gs_memory_t *memory, file_enum *pfen, char *ptr, uint maxlen)
     iodev_proc_enumerate_next((*enumerate_next));
 
 #define iodev_proc_enumerate_close(proc)\
-  void proc(file_enum *pfen)
+  void proc(gs_memory_t *memory, file_enum *pfen)
     iodev_proc_enumerate_close((*enumerate_close));
 
     /* Added in release 2.9 */
@@ -174,9 +174,9 @@ int gs_fopen_errno_to_code(int);
 
 /* Interface functions for clients that want iodev independent access to */
 /* the gp_enumerate functions */
-file_enum *gs_enumerate_files_init(const char *pat, uint patlen, gs_memory_t * mem);
-uint gs_enumerate_files_next(file_enum * pfen, char *ptr, uint maxlen);
-void gs_enumerate_files_close(file_enum * pfen);
+file_enum *gs_enumerate_files_init(gs_memory_t * mem, const char *pat, uint patlen);
+uint gs_enumerate_files_next(gs_memory_t * mem, file_enum * pfen, char *ptr, uint maxlen);
+void gs_enumerate_files_close(gs_memory_t * mem, file_enum * pfen);
 
 /* Test whether a string is equal to a character. */
 /* (This is used for access testing in file_open procedures.) */
diff --git a/base/mkromfs.c b/base/mkromfs.c
index e9b8df634..33ec1f154 100644
--- a/base/mkromfs.c
+++ b/base/mkromfs.c
@@ -1685,13 +1685,13 @@ void process_path(char *path, const char *os_prefix, const char *rom_prefix,
     strcpy(rom_filename, rom_prefix);
 
     /* check for the file on the Xlist */
-    pfenum = gp_enumerate_files_init(prefixed_path, strlen(prefixed_path),
-                        (gs_memory_t *)&minimal_memory);
+    pfenum = gp_enumerate_files_init((gs_memory_t *)&minimal_memory, prefixed_path,
+                         strlen(prefixed_path));
     if (pfenum == NULL) {
         printf("gp_enumerate_files_init failed.\n");
         exit(1);
     }
-    while ((namelen=gp_enumerate_files_next(pfenum, found_path, 1024)) >= 0) {
+    while ((namelen=gp_enumerate_files_next((gs_memory_t *)&minimal_memory, pfenum, found_path, 1024)) >= 0) {
         excluded = 0;
         found_path[namelen] = 0;		/* terminate the string */
         /* check to see if the tail of the path we found matches one on the exclusion list */
diff --git a/pcl/pl/pjparse.c b/pcl/pl/pjparse.c
index 284b4e923..007dd461e 100644
--- a/pcl/pl/pjparse.c
+++ b/pcl/pl/pjparse.c
@@ -466,11 +466,11 @@ pjl_check_font_path(char *path_list, gs_memory_t * mem)
         if (gs_strlcat(path_and_pattern, pattern, sizeof(path_and_pattern)) >= sizeof(path_and_pattern))
             continue;
 
-        fe = gs_enumerate_files_init(path_and_pattern,
-                                     strlen(path_and_pattern), mem);
+        fe = gs_enumerate_files_init(mem, path_and_pattern,
+                                     strlen(path_and_pattern));
         if (fe == NULL
             ||
-            (gs_enumerate_files_next(fe, fontfilename, PJL_PATH_NAME_LENGTH))
+            (gs_enumerate_files_next(mem, fe, fontfilename, PJL_PATH_NAME_LENGTH))
             == -1) {
             pathp = NULL;
         } else {
@@ -480,7 +480,7 @@ pjl_check_font_path(char *path_list, gs_memory_t * mem)
                directory */
             while (1) {
                 int fstatus =
-                    (int)gs_enumerate_files_next(fe, fontfilename,
+                    (int)gs_enumerate_files_next(mem, fe, fontfilename,
                                                  PJL_PATH_NAME_LENGTH);
                 /* we don't care if the file does not fit (return +1) */
                 if (fstatus == -1)
@@ -732,12 +732,11 @@ pjl_search_for_file(pjl_parser_state_t * pst, char *pathname, char *filename,
     /* should check length */
     strcpy(fontfilename, pathname);
     strcat(fontfilename, "/*");
-    fe = gs_enumerate_files_init(fontfilename, strlen(fontfilename),
-                                 pst->mem);
+    fe = gs_enumerate_files_init(pst->mem, fontfilename, strlen(fontfilename));
     if (fe) {
         do {
             uint fstatus =
-                gs_enumerate_files_next(fe, fontfilename,
+                gs_enumerate_files_next(pst->mem, fe, fontfilename,
                                         PJL_PATH_NAME_LENGTH);
             /* done */
             if (fstatus == ~(uint) 0)
@@ -767,12 +766,11 @@ pjl_fsdirlist(pjl_parser_state_t * pst, char *pathname, int entry, int count)
     pjl_parsed_filename_to_string(fontfilename, pathname);
     /* if this is a directory add * for the directory listing NB fix */
     strcat(fontfilename, "/*");
-    fe = gs_enumerate_files_init(fontfilename, strlen(fontfilename),
-                                 pst->mem);
+    fe = gs_enumerate_files_init(pst->mem, fontfilename, strlen(fontfilename));
     if (fe) {
         do {
             uint fstatus =
-                gs_enumerate_files_next(fe, fontfilename,
+                gs_enumerate_files_next(pst->mem, fe, fontfilename,
                                         PJL_PATH_NAME_LENGTH);
             /* done */
             if (fstatus == ~(uint) 0)
diff --git a/pcl/pl/pllfont.c b/pcl/pl/pllfont.c
index efc78e639..d6c22a17b 100644
--- a/pcl/pl/pllfont.c
+++ b/pcl/pl/pllfont.c
@@ -622,12 +622,12 @@ pl_load_built_in_fonts(const char *pathname, gs_memory_t * mem,
     if (gs_strlcat(path, "*", sizeof(path)) >= sizeof(path))
         return 0;
 
-    fe = gs_enumerate_files_init(path, strlen(path), mem);
+    fe = gs_enumerate_files_init(mem, path, strlen(path));
     if (fe == NULL)
         return 0;
 
     /* loop through the files */
-    while ((code = gs_enumerate_files_next(fe, path, sizeof(path) - 1)) >= 0) {
+    while ((code = gs_enumerate_files_next(mem, fe, path, sizeof(path) - 1)) >= 0) {
         char buffer[1024];
         pl_font_t *plfont;
         stream *in;
@@ -673,7 +673,7 @@ pl_load_built_in_fonts(const char *pathname, gs_memory_t * mem,
                                 gs_next_ids(mem, 1), &plfont,
                                 buffer) < 0) {
                 /* vm error */
-                gs_enumerate_files_close(fe);
+                gs_enumerate_files_close(mem, fe);
                 return gs_throw1(0,
                                  "An unrecoverable failure occurred while reading the resident font %s\n",
                                  path);
@@ -684,7 +684,7 @@ pl_load_built_in_fonts(const char *pathname, gs_memory_t * mem,
                 gs_free_object(mem, plfont->pfont, "pl_tt_load_font(gs_font_type42)");
                 pl_free_tt_fontfile_buffer(mem, plfont->header);
                 gs_free_object(mem, plfont, "pl_tt_load_font(pl_font_t)");
-                gs_enumerate_files_close(fe);
+                gs_enumerate_files_close(mem, fe);
                 return gs_throw1(0,
                                  "An unrecoverable failure occurred while reading the resident font %s\n",
                                  path);
diff --git a/psi/zfile.c b/psi/zfile.c
index b21bba6b0..9d87f4556 100644
--- a/psi/zfile.c
+++ b/psi/zfile.c
@@ -396,8 +396,8 @@ zfilenameforall(i_ctx_t *i_ctx_p)
         pop(3);
         return 0;       /* no pattern, or device not found -- just return */
     }
-    pfen = iodev->procs.enumerate_files(iodev, (const char *)pname.fname,
-                pname.len, imemory);
+    pfen = iodev->procs.enumerate_files(imemory, iodev, (const char *)pname.fname,
+                pname.len);
     if (pfen == 0)
         return_error(gs_error_VMerror);
     push_mark_estack(es_for, file_cleanup);
@@ -432,7 +432,7 @@ file_continue(i_ctx_t *i_ctx_p)
 
     do {
         memcpy((char *)pscratch->value.bytes, iodev->dname, devlen);
-        code = iodev->procs.enumerate_next(pfen, (char *)pscratch->value.bytes + devlen,
+        code = iodev->procs.enumerate_next(imemory, pfen, (char *)pscratch->value.bytes + devlen,
                     len - devlen);
         if (code == ~(uint) 0) {    /* all done */
             esp -= 5;               /* pop proc, pfen, devlen, iodev , mark */
@@ -457,7 +457,7 @@ file_cleanup(i_ctx_t *i_ctx_p)
 {
     gx_io_device *iodev = r_ptr(esp + 2, gx_io_device);
 
-    iodev->procs.enumerate_close(r_ptr(esp + 5, file_enum));
+    iodev->procs.enumerate_close(imemory, r_ptr(esp + 5, file_enum));
     return 0;
 }