Index: uspace/srv/vfs/vfs_lookup.c
===================================================================
--- uspace/srv/vfs/vfs_lookup.c	(revision 9bb85f3480d8697d332ae4f46dabcd45bc5ab0c5)
+++ uspace/srv/vfs/vfs_lookup.c	(revision d6084ef92b6611a19749ebcfb70d5730dc0cb07b)
@@ -50,5 +50,5 @@
 
 /* Forward static declarations. */
-static char *canonify(char *path);
+static char *canonify(char *path, size_t *lenp);
 
 atomic_t plb_futex = FUTEX_INITIALIZER;
@@ -58,6 +58,6 @@
 /** Perform a path lookup.
  *
- * @param path		Path to be resolved; it needn't be an ASCIIZ string.
- * @param len		Number of path characters pointed by path.
+ * @param path		Path to be resolved; it must be a NULL-terminated
+ *			string.
  * @param lflag		Flags to be used during lookup.
  * @param result	Empty structure where the lookup result will be stored.
@@ -68,11 +68,8 @@
  * @return		EOK on success or an error code from errno.h.
  */
-int vfs_lookup_internal(char *path, size_t len, int lflag,
-    vfs_lookup_res_t *result, vfs_pair_t *altroot)
+int vfs_lookup_internal(char *path, int lflag, vfs_lookup_res_t *result,
+    vfs_pair_t *altroot)
 {
 	vfs_pair_t *root;
-
-	if (!len)
-		return EINVAL;
 
 	if (altroot)
@@ -83,4 +80,9 @@
 	if (!root->fs_handle)
 		return ENOENT;
+	
+	size_t len;
+	path = canonify(path, &len);
+	if (!path)
+		return EINVAL;
 	
 	futex_down(&plb_futex);
@@ -274,5 +276,6 @@
 static void terminate_slash(token_t *t, token_t *tfsl, token_t *tlcomp)
 {
-	tfsl->stop[1] = '\0';
+	if (tfsl->stop[1])	/* avoid writing to a well-formatted path */
+		tfsl->stop[1] = '\0';
 }
 static void remove_trailing_slash(token_t *t, token_t *tfsl, token_t *tlcomp)
@@ -435,9 +438,11 @@
  * It works in-place and requires a NULL-terminated input string.
  *
- * @param		Path to be canonified.
+ * @param path		Path to be canonified.
+ * @param lenp		Pointer where the length of the final path will be
+ *			stored. Can be NULL.
  *
  * @return		Canonified path or NULL on failure.
  */
-char *canonify(char *path)
+char *canonify(char *path, size_t *lenp)
 {
 	state_t state;
@@ -451,4 +456,5 @@
 	state = S_INI;
 	t = tfsl;
+	tlcomp = tfsl;
 	while (state != S_ACCEPT && state != S_RESTART && state != S_REJECT) {
 		if (trans[state][t.kind].f)
@@ -464,4 +470,6 @@
 		return NULL;
 	case S_ACCEPT:
+		if (lenp)
+			*lenp = (size_t)((tlcomp.stop - tfsl.start) + 1);
 		return tfsl.start; 
 	default: