(posix-file-name-to-mac "~emacs/asd")
(posix-file-name-to-mac "/tmp/")

will crash a 22 branch Carbon Emacs.

A fix is below - it disables ~emacs and /tmp expansion when getpwnam  
or get_temp_dir_name return NULL, which they seem to do.
(OS X has /tmp, so I'm not sure if the code isn't leftover from MacOS  
and stopped working at some point.)

- D





Index: mac.c
===================================================================
RCS file: /sources/emacs/emacs/src/Attic/mac.c,v
retrieving revision 1.77.2.10
diff -c -r1.77.2.10 mac.c
*** mac.c	29 Aug 2008 08:18:07 -0000	1.77.2.10
--- mac.c	20 Sep 2008 12:29:24 -0000
***************
*** 214,237 ****
     if (strncmp (p, "~emacs/", 7) == 0)
       {
         struct passwd *pw = getpwnam ("emacs");
!       p += 7;
!       if (strlen (pw->pw_dir) + strlen (p) > MAXPATHLEN)
! 	return 0;
!       strcpy (expanded_pathname, pw->pw_dir);
!       strcat (expanded_pathname, p);
!       p = expanded_pathname;
!         /* now p points to the pathname with emacs dir prefix */
       }
     else if (strncmp (p, "/tmp/", 5) == 0)
       {
         char *t = get_temp_dir_name ();
!       p += 5;
!       if (strlen (t) + strlen (p) > MAXPATHLEN)
! 	return 0;
!       strcpy (expanded_pathname, t);
!       strcat (expanded_pathname, p);
!       p = expanded_pathname;
!         /* now p points to the pathname with emacs dir prefix */
       }
     else if (*p != '/')  /* relative pathname */
       strcat (mfn, ":");
--- 215,244 ----
     if (strncmp (p, "~emacs/", 7) == 0)
       {
         struct passwd *pw = getpwnam ("emacs");
!       if (pw != NULL)
! 	{
! 	  p += 7;
! 	  if (strlen (pw->pw_dir) + strlen (p) > MAXPATHLEN)
! 	    return 0;
! 	  strcpy (expanded_pathname, pw->pw_dir);
! 	  strcat (expanded_pathname, p);
! 	  p = expanded_pathname;
! 	  /* now p points to the pathname with emacs dir prefix */
! 	}
       }
     else if (strncmp (p, "/tmp/", 5) == 0)
       {
         char *t = get_temp_dir_name ();
!       if (t != NULL)
! 	{
! 	  p += 5;
! 	  if (strlen (t) + strlen (p) > MAXPATHLEN)
! 	    return 0;
! 	  strcpy (expanded_pathname, t);
! 	  strcat (expanded_pathname, p);
! 	  p = expanded_pathname;
! 	  /* now p points to the pathname with emacs dir prefix */
! 	}
       }
     else if (*p != '/')  /* relative pathname */
       strcat (mfn, ":");