posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2015 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, see
  18    <http://www.gnu.org/licenses/>.  */
  19
  20 #include <alloca.h>
  21 #include <ctype.h>
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <fnmatch.h>
  25 #include <glob.h>
  26 #include <libintl.h>
  27 #include <paths.h>
  28 #include <pwd.h>
  29 #include <signal.h>
  30 #include <stdbool.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <sys/param.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/types.h>
  39 #include <sys/wait.h>
  40 #include <unistd.h>
  41 #include <wchar.h>
  42 #include <wordexp.h>
  43 #include <kernel-features.h>
  44
  45 #include <bits/libc-lock.h>
  46 #include <_itoa.h>
  47
  48 /* Undefine the following line for the production version.  */
  49 /* #define NDEBUG 1 */
  50 #include <assert.h>
  51
  52 /* Get some device information.  */
  53 #include <device-nrs.h>
  54
  55 /*
  56  * This is a recursive-descent-style word expansion routine.
  57  */
  58
  59 /* These variables are defined and initialized in the startup code.  */
  60 extern int __libc_argc attribute_hidden;
  61 extern char **__libc_argv attribute_hidden;
  62
  63 /* Some forward declarations */
  64 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  65                           const char *words, size_t *offset, int flags,
  66                           wordexp_t *pwordexp, const char *ifs,
  67                           const char *ifs_white, int quoted)
  68      internal_function;
  69 static int parse_backtick (char **word, size_t *word_length,
  70                            size_t *max_length, const char *words,
  71                            size_t *offset, int flags, wordexp_t *pwordexp,
  72                            const char *ifs, const char *ifs_white)
  73      internal_function;
  74 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  75                          const char *words, size_t *offset, int flags,
  76                          wordexp_t *pwordexp, const char *ifs,
  77                          const char *ifs_white)
  78      internal_function;
  79 static int eval_expr (char *expr, long int *result) internal_function;
  80
  81 /* The w_*() functions manipulate word lists. */
  82
  83 #define W_CHUNK (100)
  84
  85 /* Result of w_newword will be ignored if it's the last word. */
  86 static inline char *
  87 w_newword (size_t *actlen, size_t *maxlen)
  88 {
  89   *actlen = *maxlen = 0;
  90   return NULL;
  91 }
  92
  93 static char *
  94 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  95      /* (lengths exclude trailing zero) */
  96 {
  97   /* Add a character to the buffer, allocating room for it if needed.  */
  98
  99   if (*actlen == *maxlen)
 100     {
 101       char *old_buffer = buffer;
 102       assert (buffer == NULL || *maxlen != 0);
 103       *maxlen += W_CHUNK;
 104       buffer = (char *) realloc (buffer, 1 + *maxlen);
 105
 106       if (buffer == NULL)
 107         free (old_buffer);
 108     }
 109
 110   if (buffer != NULL)
 111     {
 112       buffer[*actlen] = ch;
 113       buffer[++(*actlen)] = '\0';
 114     }
 115
 116   return buffer;
 117 }
 118
 119 static char *
 120 internal_function
 121 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 122           size_t len)
 123 {
 124   /* Add a string to the buffer, allocating room for it if needed.
 125    */
 126   if (*actlen + len > *maxlen)
 127     {
 128       char *old_buffer = buffer;
 129       assert (buffer == NULL || *maxlen != 0);
 130       *maxlen += MAX (2 * len, W_CHUNK);
 131       buffer = realloc (old_buffer, 1 + *maxlen);
 132
 133       if (buffer == NULL)
 134         free (old_buffer);
 135     }
 136
 137   if (buffer != NULL)
 138     {
 139       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 140       *actlen += len;
 141     }
 142
 143   return buffer;
 144 }
 145
 146 static char *
 147 internal_function
 148 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 149      /* (lengths exclude trailing zero) */
 150 {
 151   /* Add a string to the buffer, allocating room for it if needed.
 152    */
 153   size_t len;
 154
 155   assert (str != NULL); /* w_addstr only called from this file */
 156   len = strlen (str);
 157
 158   return w_addmem (buffer, actlen, maxlen, str, len);
 159 }
 160
 161 static int
 162 internal_function
 163 w_addword (wordexp_t *pwordexp, char *word)
 164 {
 165   /* Add a word to the wordlist */
 166   size_t num_p;
 167   char **new_wordv;
 168   bool allocated = false;
 169
 170   /* Internally, NULL acts like "".  Convert NULLs to "" before
 171    * the caller sees them.
 172    */
 173   if (word == NULL)
 174     {
 175       word = __strdup ("");
 176       if (word == NULL)
 177         goto no_space;
 178       allocated = true;
 179     }
 180
 181   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 182   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 183   if (new_wordv != NULL)
 184     {
 185       pwordexp->we_wordv = new_wordv;
 186       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 187       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 188       return 0;
 189     }
 190
 191   if (allocated)
 192     free (word);
 193
 194 no_space:
 195   return WRDE_NOSPACE;
 196 }
 197
 198 /* The parse_*() functions should leave *offset being the offset in 'words'
 199  * to the last character processed.
 200  */
 201
 202 static int
 203 internal_function
 204 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 205                  const char *words, size_t *offset)
 206 {
 207   /* We are poised _at_ a backslash, not in quotes */
 208
 209   switch (words[1 + *offset])
 210     {
 211     case 0:
 212       /* Backslash is last character of input words */
 213       return WRDE_SYNTAX;
 214
 215     case '\n':
 216       ++(*offset);
 217       break;
 218
 219     default:
 220       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 221       if (*word == NULL)
 222         return WRDE_NOSPACE;
 223
 224       ++(*offset);
 225       break;
 226     }
 227
 228   return 0;
 229 }
 230
 231 static int
 232 internal_function
 233 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 234                      const char *words, size_t *offset)
 235 {
 236   /* We are poised _at_ a backslash, inside quotes */
 237
 238   switch (words[1 + *offset])
 239     {
 240     case 0:
 241       /* Backslash is last character of input words */
 242       return WRDE_SYNTAX;
 243
 244     case '\n':
 245       ++(*offset);
 246       break;
 247
 248     case '$':
 249     case '`':
 250     case '"':
 251     case '\\':
 252       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 253       if (*word == NULL)
 254         return WRDE_NOSPACE;
 255
 256       ++(*offset);
 257       break;
 258
 259     default:
 260       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 261       if (*word != NULL)
 262         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 263
 264       if (*word == NULL)
 265         return WRDE_NOSPACE;
 266
 267       ++(*offset);
 268       break;
 269     }
 270
 271   return 0;
 272 }
 273
 274 static int
 275 internal_function
 276 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 277              const char *words, size_t *offset, size_t wordc)
 278 {
 279   /* We are poised _at_ a tilde */
 280   size_t i;
 281
 282   if (*word_length != 0)
 283     {
 284       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 285         {
 286           if (!((*word)[*word_length - 1] == ':'
 287                 && strchr (*word, '=') && wordc == 0))
 288             {
 289               *word = w_addchar (*word, word_length, max_length, '~');
 290               return *word ? 0 : WRDE_NOSPACE;
 291             }
 292         }
 293     }
 294
 295   for (i = 1 + *offset; words[i]; i++)
 296     {
 297       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 298           words[i] == '\t' || words[i] == 0 )
 299         break;
 300
 301       if (words[i] == '\\')
 302         {
 303           *word = w_addchar (*word, word_length, max_length, '~');
 304           return *word ? 0 : WRDE_NOSPACE;
 305         }
 306     }
 307
 308   if (i == 1 + *offset)
 309     {
 310       /* Tilde appears on its own */
 311       uid_t uid;
 312       struct passwd pwd, *tpwd;
 313       int buflen = 1000;
 314       char* home;
 315       char* buffer;
 316       int result;
 317
 318       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 319          results are unspecified.  We do a lookup on the uid if
 320          HOME is unset. */
 321
 322       home = getenv ("HOME");
 323       if (home != NULL)
 324         {
 325           *word = w_addstr (*word, word_length, max_length, home);
 326           if (*word == NULL)
 327             return WRDE_NOSPACE;
 328         }
 329       else
 330         {
 331           uid = __getuid ();
 332           buffer = __alloca (buflen);
 333
 334           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 335                  && errno == ERANGE)
 336             buffer = extend_alloca (buffer, buflen, buflen + 1000);
 337
 338           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 339             {
 340               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 341               if (*word == NULL)
 342                 return WRDE_NOSPACE;
 343             }
 344           else
 345             {
 346               *word = w_addchar (*word, word_length, max_length, '~');
 347               if (*word == NULL)
 348                 return WRDE_NOSPACE;
 349             }
 350         }
 351     }
 352   else
 353     {
 354       /* Look up user name in database to get home directory */
 355       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 356       struct passwd pwd, *tpwd;
 357       int buflen = 1000;
 358       char* buffer = __alloca (buflen);
 359       int result;
 360
 361       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 362              && errno == ERANGE)
 363         buffer = extend_alloca (buffer, buflen, buflen + 1000);
 364
 365       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 366         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 367       else
 368         {
 369           /* (invalid login name) */
 370           *word = w_addchar (*word, word_length, max_length, '~');
 371           if (*word != NULL)
 372             *word = w_addstr (*word, word_length, max_length, user);
 373         }
 374
 375       *offset = i - 1;
 376     }
 377   return *word ? 0 : WRDE_NOSPACE;
 378 }
 379
 380
 381 static int
 382 internal_function
 383 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 384                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 385                const char *ifs_white)
 386 {
 387   int error;
 388   unsigned int match;
 389   glob_t globbuf;
 390
 391   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 392
 393   if (error != 0)
 394     {
 395       /* We can only run into memory problems.  */
 396       assert (error == GLOB_NOSPACE);
 397       return WRDE_NOSPACE;
 398     }
 399
 400   if (ifs && !*ifs)
 401     {
 402       /* No field splitting allowed. */
 403       assert (globbuf.gl_pathv[0] != NULL);
 404       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 405       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 406         {
 407           *word = w_addchar (*word, word_length, max_length, ' ');
 408           if (*word != NULL)
 409             *word = w_addstr (*word, word_length, max_length,
 410                               globbuf.gl_pathv[match]);
 411         }
 412
 413       globfree (&globbuf);
 414       return *word ? 0 : WRDE_NOSPACE;
 415     }
 416
 417   assert (ifs == NULL || *ifs != '\0');
 418   if (*word != NULL)
 419     {
 420       free (*word);
 421       *word = w_newword (word_length, max_length);
 422     }
 423
 424   for (match = 0; match < globbuf.gl_pathc; ++match)
 425     {
 426       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 427       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 428         {
 429           globfree (&globbuf);
 430           return WRDE_NOSPACE;
 431         }
 432     }
 433
 434   globfree (&globbuf);
 435   return 0;
 436 }
 437
 438 static int
 439 internal_function
 440 parse_glob (char **word, size_t *word_length, size_t *max_length,
 441             const char *words, size_t *offset, int flags,
 442             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 443 {
 444   /* We are poised just after a '*', a '[' or a '?'. */
 445   int error = WRDE_NOSPACE;
 446   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 447   size_t i;
 448   wordexp_t glob_list; /* List of words to glob */
 449
 450   glob_list.we_wordc = 0;
 451   glob_list.we_wordv = NULL;
 452   glob_list.we_offs = 0;
 453   for (; words[*offset] != '\0'; ++*offset)
 454     {
 455       if (strchr (ifs, words[*offset]) != NULL)
 456         /* Reached IFS */
 457         break;
 458
 459       /* Sort out quoting */
 460       if (words[*offset] == '\'')
 461         {
 462           if (quoted == 0)
 463             {
 464               quoted = 1;
 465               continue;
 466             }
 467           else if (quoted == 1)
 468             {
 469               quoted = 0;
 470               continue;
 471             }
 472         }
 473       else if (words[*offset] == '"')
 474         {
 475           if (quoted == 0)
 476             {
 477               quoted = 2;
 478               continue;
 479             }
 480           else if (quoted == 2)
 481             {
 482               quoted = 0;
 483               continue;
 484             }
 485         }
 486
 487       /* Sort out other special characters */
 488       if (quoted != 1 && words[*offset] == '$')
 489         {
 490           error = parse_dollars (word, word_length, max_length, words,
 491                                  offset, flags, &glob_list, ifs, ifs_white,
 492                                  quoted == 2);
 493           if (error)
 494             goto tidy_up;
 495
 496           continue;
 497         }
 498       else if (words[*offset] == '\\')
 499         {
 500           if (quoted)
 501             error = parse_qtd_backslash (word, word_length, max_length,
 502                                          words, offset);
 503           else
 504             error = parse_backslash (word, word_length, max_length,
 505                                      words, offset);
 506
 507           if (error)
 508             goto tidy_up;
 509
 510           continue;
 511         }
 512
 513       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 514       if (*word == NULL)
 515         goto tidy_up;
 516     }
 517
 518   /* Don't forget to re-parse the character we stopped at. */
 519   --*offset;
 520
 521   /* Glob the words */
 522   error = w_addword (&glob_list, *word);
 523   *word = w_newword (word_length, max_length);
 524   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 525     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 526                            max_length, pwordexp, ifs, ifs_white);
 527
 528   /* Now tidy up */
 529 tidy_up:
 530   wordfree (&glob_list);
 531   return error;
 532 }
 533
 534 static int
 535 internal_function
 536 parse_squote (char **word, size_t *word_length, size_t *max_length,
 537               const char *words, size_t *offset)
 538 {
 539   /* We are poised just after a single quote */
 540   for (; words[*offset]; ++(*offset))
 541     {
 542       if (words[*offset] != '\'')
 543         {
 544           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 545           if (*word == NULL)
 546             return WRDE_NOSPACE;
 547         }
 548       else return 0;
 549     }
 550
 551   /* Unterminated string */
 552   return WRDE_SYNTAX;
 553 }
 554
 555 /* Functions to evaluate an arithmetic expression */
 556 static int
 557 internal_function
 558 eval_expr_val (char **expr, long int *result)
 559 {
 560   char *digit;
 561
 562   /* Skip white space */
 563   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 564
 565   if (*digit == '(')
 566     {
 567       /* Scan for closing paren */
 568       for (++digit; **expr && **expr != ')'; ++(*expr));
 569
 570       /* Is there one? */
 571       if (!**expr)
 572         return WRDE_SYNTAX;
 573
 574       *(*expr)++ = 0;
 575
 576       if (eval_expr (digit, result))
 577         return WRDE_SYNTAX;
 578
 579       return 0;
 580     }
 581
 582   /* POSIX requires that decimal, octal, and hexadecimal constants are
 583      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 584   *result = strtol (digit, expr, 0);
 585   if (digit == *expr)
 586     return WRDE_SYNTAX;
 587
 588   return 0;
 589 }
 590
 591 static int
 592 internal_function
 593 eval_expr_multdiv (char **expr, long int *result)
 594 {
 595   long int arg;
 596
 597   /* Read a Value */
 598   if (eval_expr_val (expr, result) != 0)
 599     return WRDE_SYNTAX;
 600
 601   while (**expr)
 602     {
 603       /* Skip white space */
 604       for (; *expr && **expr && isspace (**expr); ++(*expr));
 605
 606       if (**expr == '*')
 607         {
 608           ++(*expr);
 609           if (eval_expr_val (expr, &arg) != 0)
 610             return WRDE_SYNTAX;
 611
 612           *result *= arg;
 613         }
 614       else if (**expr == '/')
 615         {
 616           ++(*expr);
 617           if (eval_expr_val (expr, &arg) != 0)
 618             return WRDE_SYNTAX;
 619
 620           *result /= arg;
 621         }
 622       else break;
 623     }
 624
 625   return 0;
 626 }
 627
 628 static int
 629 internal_function
 630 eval_expr (char *expr, long int *result)
 631 {
 632   long int arg;
 633
 634   /* Read a Multdiv */
 635   if (eval_expr_multdiv (&expr, result) != 0)
 636     return WRDE_SYNTAX;
 637
 638   while (*expr)
 639     {
 640       /* Skip white space */
 641       for (; expr && *expr && isspace (*expr); ++expr);
 642
 643       if (*expr == '+')
 644         {
 645           ++expr;
 646           if (eval_expr_multdiv (&expr, &arg) != 0)
 647             return WRDE_SYNTAX;
 648
 649           *result += arg;
 650         }
 651       else if (*expr == '-')
 652         {
 653           ++expr;
 654           if (eval_expr_multdiv (&expr, &arg) != 0)
 655             return WRDE_SYNTAX;
 656
 657           *result -= arg;
 658         }
 659       else break;
 660     }
 661
 662   return 0;
 663 }
 664
 665 static int
 666 internal_function
 667 parse_arith (char **word, size_t *word_length, size_t *max_length,
 668              const char *words, size_t *offset, int flags, int bracket)
 669 {
 670   /* We are poised just after "$((" or "$[" */
 671   int error;
 672   int paren_depth = 1;
 673   size_t expr_length;
 674   size_t expr_maxlen;
 675   char *expr;
 676
 677   expr = w_newword (&expr_length, &expr_maxlen);
 678   for (; words[*offset]; ++(*offset))
 679     {
 680       switch (words[*offset])
 681         {
 682         case '$':
 683           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 684                                  words, offset, flags, NULL, NULL, NULL, 1);
 685           /* The ``1'' here is to tell parse_dollars not to
 686            * split the fields.
 687            */
 688           if (error)
 689             {
 690               free (expr);
 691               return error;
 692             }
 693           break;
 694
 695         case '`':
 696           (*offset)++;
 697           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 698                                   words, offset, flags, NULL, NULL, NULL);
 699           /* The first NULL here is to tell parse_backtick not to
 700            * split the fields.
 701            */
 702           if (error)
 703             {
 704               free (expr);
 705               return error;
 706             }
 707           break;
 708
 709         case '\\':
 710           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 711                                        words, offset);
 712           if (error)
 713             {
 714               free (expr);
 715               return error;
 716             }
 717           /* I think that a backslash within an
 718            * arithmetic expansion is bound to
 719            * cause an error sooner or later anyway though.
 720            */
 721           break;
 722
 723         case ')':
 724           if (--paren_depth == 0)
 725             {
 726               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 727               long int numresult = 0;
 728               long long int convertme;
 729
 730               if (bracket || words[1 + *offset] != ')')
 731                 {
 732                   free (expr);
 733                   return WRDE_SYNTAX;
 734                 }
 735
 736               ++(*offset);
 737
 738               /* Go - evaluate. */
 739               if (*expr && eval_expr (expr, &numresult) != 0)
 740                 {
 741                   free (expr);
 742                   return WRDE_SYNTAX;
 743                 }
 744
 745               if (numresult < 0)
 746                 {
 747                   convertme = -numresult;
 748                   *word = w_addchar (*word, word_length, max_length, '-');
 749                   if (!*word)
 750                     {
 751                       free (expr);
 752                       return WRDE_NOSPACE;
 753                     }
 754                 }
 755               else
 756                 convertme = numresult;
 757
 758               result[20] = '\0';
 759               *word = w_addstr (*word, word_length, max_length,
 760                                 _itoa (convertme, &result[20], 10, 0));
 761               free (expr);
 762               return *word ? 0 : WRDE_NOSPACE;
 763             }
 764           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 765           if (expr == NULL)
 766             return WRDE_NOSPACE;
 767
 768           break;
 769
 770         case ']':
 771           if (bracket && paren_depth == 1)
 772             {
 773               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 774               long int numresult = 0;
 775
 776               /* Go - evaluate. */
 777               if (*expr && eval_expr (expr, &numresult) != 0)
 778                 {
 779                   free (expr);
 780                   return WRDE_SYNTAX;
 781                 }
 782
 783               result[20] = '\0';
 784               *word = w_addstr (*word, word_length, max_length,
 785                                 _itoa_word (numresult, &result[20], 10, 0));
 786               free (expr);
 787               return *word ? 0 : WRDE_NOSPACE;
 788             }
 789
 790           free (expr);
 791           return WRDE_SYNTAX;
 792
 793         case '\n':
 794         case ';':
 795         case '{':
 796         case '}':
 797           free (expr);
 798           return WRDE_BADCHAR;
 799
 800         case '(':
 801           ++paren_depth;
 802         default:
 803           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 804           if (expr == NULL)
 805             return WRDE_NOSPACE;
 806         }
 807     }
 808
 809   /* Premature end */
 810   free (expr);
 811   return WRDE_SYNTAX;
 812 }
 813
 814 /* Function called by child process in exec_comm() */
 815 static inline void
 816 internal_function __attribute__ ((always_inline))
 817 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 818 {
 819   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 820
 821   /* Execute the command, or just check syntax? */
 822   if (noexec)
 823     args[1] = "-nc";
 824
 825   /* Redirect output.  */
 826   if (__glibc_likely (fildes[1] != STDOUT_FILENO))
 827     {
 828       __dup2 (fildes[1], STDOUT_FILENO);
 829       __close (fildes[1]);
 830     }
 831   else
 832     {
 833 #ifdef O_CLOEXEC
 834       /* Reset the close-on-exec flag (if necessary).  */
 835 # ifndef __ASSUME_PIPE2
 836       if (__have_pipe2 > 0)
 837 # endif
 838         __fcntl (fildes[1], F_SETFD, 0);
 839 #endif
 840     }
 841
 842   /* Redirect stderr to /dev/null if we have to.  */
 843   if (showerr == 0)
 844     {
 845       struct stat64 st;
 846       int fd;
 847       __close (STDERR_FILENO);
 848       fd = __open (_PATH_DEVNULL, O_WRONLY);
 849       if (fd >= 0 && fd != STDERR_FILENO)
 850         {
 851           __dup2 (fd, STDERR_FILENO);
 852           __close (fd);
 853         }
 854       /* Be paranoid.  Check that we actually opened the /dev/null
 855          device.  */
 856       if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
 857           || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
 858 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 859           || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 860 #endif
 861           )
 862         /* It's not the /dev/null device.  Stop right here.  The
 863            problem is: how do we stop?  We use _exit() with an
 864            hopefully unusual exit code.  */
 865         _exit (90);
 866     }
 867
 868   /* Make sure the subshell doesn't field-split on our behalf. */
 869   __unsetenv ("IFS");
 870
 871   __close (fildes[0]);
 872   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 873
 874   /* Bad.  What now?  */
 875   abort ();
 876 }
 877
 878 /* Function to execute a command and retrieve the results */
 879 /* pwordexp contains NULL if field-splitting is forbidden */
 880 static int
 881 internal_function
 882 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 883            int flags, wordexp_t *pwordexp, const char *ifs,
 884            const char *ifs_white)
 885 {
 886   int fildes[2];
 887 #define bufsize 128
 888   int buflen;
 889   int i;
 890   int status = 0;
 891   size_t maxnewlines = 0;
 892   char buffer[bufsize];
 893   pid_t pid;
 894   int noexec = 0;
 895
 896   /* Do nothing if command substitution should not succeed.  */
 897   if (flags & WRDE_NOCMD)
 898     return WRDE_CMDSUB;
 899
 900   /* Don't fork() unless necessary */
 901   if (!comm || !*comm)
 902     return 0;
 903
 904 #ifdef O_CLOEXEC
 905 # ifndef __ASSUME_PIPE2
 906   if (__have_pipe2 >= 0)
 907 # endif
 908     {
 909       int r = __pipe2 (fildes, O_CLOEXEC);
 910 # ifndef __ASSUME_PIPE2
 911       if (__have_pipe2 == 0)
 912         __have_pipe2 = r != -1 || errno != ENOSYS ? 1 : -1;
 913
 914       if (__have_pipe2 > 0)
 915 # endif
 916         if (r < 0)
 917           /* Bad */
 918           return WRDE_NOSPACE;
 919     }
 920 #endif
 921 #ifndef __ASSUME_PIPE2
 922 # ifdef O_CLOEXEC
 923   if (__have_pipe2 < 0)
 924 # endif
 925     if (__pipe (fildes) < 0)
 926       /* Bad */
 927       return WRDE_NOSPACE;
 928 #endif
 929
 930  again:
 931   if ((pid = __fork ()) < 0)
 932     {
 933       /* Bad */
 934       __close (fildes[0]);
 935       __close (fildes[1]);
 936       return WRDE_NOSPACE;
 937     }
 938
 939   if (pid == 0)
 940     exec_comm_child (comm, fildes, noexec ? 0 : flags & WRDE_SHOWERR, noexec);
 941
 942   /* Parent */
 943
 944   /* If we are just testing the syntax, only wait.  */
 945   if (noexec)
 946     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 947             && status != 0) ? WRDE_SYNTAX : 0;
 948
 949   __close (fildes[1]);
 950   fildes[1] = -1;
 951
 952   if (!pwordexp)
 953     /* Quoted - no field splitting */
 954     {
 955       while (1)
 956         {
 957           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 958                                                     bufsize))) < 1)
 959             {
 960               /* If read returned 0 then the process has closed its
 961                  stdout.  Don't use WNOHANG in that case to avoid busy
 962                  looping until the process eventually exits.  */
 963               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 964                                                  buflen == 0 ? 0 : WNOHANG))
 965                   == 0)
 966                 continue;
 967               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 968                                                         bufsize))) < 1)
 969                 break;
 970             }
 971
 972           maxnewlines += buflen;
 973
 974           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 975           if (*word == NULL)
 976             goto no_space;
 977         }
 978     }
 979   else
 980     /* Not quoted - split fields */
 981     {
 982       int copying = 0;
 983       /* 'copying' is:
 984        *  0 when searching for first character in a field not IFS white space
 985        *  1 when copying the text of a field
 986        *  2 when searching for possible non-whitespace IFS
 987        *  3 when searching for non-newline after copying field
 988        */
 989
 990       while (1)
 991         {
 992           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 993                                                     bufsize))) < 1)
 994             {
 995               /* If read returned 0 then the process has closed its
 996                  stdout.  Don't use WNOHANG in that case to avoid busy
 997                  looping until the process eventually exits.  */
 998               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 999                                                  buflen == 0 ? 0 : WNOHANG))
1000                   == 0)
1001                 continue;
1002               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
1003                                                         bufsize))) < 1)
1004                 break;
1005             }
1006
1007           for (i = 0; i < buflen; ++i)
1008             {
1009               if (strchr (ifs, buffer[i]) != NULL)
1010                 {
1011                   /* Current character is IFS */
1012                   if (strchr (ifs_white, buffer[i]) == NULL)
1013                     {
1014                       /* Current character is IFS but not whitespace */
1015                       if (copying == 2)
1016                         {
1017                           /*            current character
1018                            *                   |
1019                            *                   V
1020                            * eg: text<space><comma><space>moretext
1021                            *
1022                            * So, strip whitespace IFS (like at the start)
1023                            */
1024                           copying = 0;
1025                           continue;
1026                         }
1027
1028                       copying = 0;
1029                       /* fall through and delimit field.. */
1030                     }
1031                   else
1032                     {
1033                       if (buffer[i] == '\n')
1034                         {
1035                           /* Current character is (IFS) newline */
1036
1037                           /* If copying a field, this is the end of it,
1038                              but maybe all that's left is trailing newlines.
1039                              So start searching for a non-newline. */
1040                           if (copying == 1)
1041                             copying = 3;
1042
1043                           continue;
1044                         }
1045                       else
1046                         {
1047                           /* Current character is IFS white space, but
1048                              not a newline */
1049
1050                           /* If not either copying a field or searching
1051                              for non-newline after a field, ignore it */
1052                           if (copying != 1 && copying != 3)
1053                             continue;
1054
1055                           /* End of field (search for non-ws IFS afterwards) */
1056                           copying = 2;
1057                         }
1058                     }
1059
1060                   /* First IFS white space (non-newline), or IFS non-whitespace.
1061                    * Delimit the field.  Nulls are converted by w_addword. */
1062                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1063                     goto no_space;
1064
1065                   *word = w_newword (word_length, max_length);
1066
1067                   maxnewlines = 0;
1068                   /* fall back round the loop.. */
1069                 }
1070               else
1071                 {
1072                   /* Not IFS character */
1073
1074                   if (copying == 3)
1075                     {
1076                       /* Nothing but (IFS) newlines since the last field,
1077                          so delimit it here before starting new word */
1078                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1079                         goto no_space;
1080
1081                       *word = w_newword (word_length, max_length);
1082                     }
1083
1084                   copying = 1;
1085
1086                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1087                     maxnewlines++;
1088                   else
1089                     maxnewlines = 0;
1090
1091                   *word = w_addchar (*word, word_length, max_length,
1092                                      buffer[i]);
1093                   if (*word == NULL)
1094                     goto no_space;
1095                 }
1096             }
1097         }
1098     }
1099
1100   /* Chop off trailing newlines (required by POSIX.2)  */
1101   /* Ensure we don't go back further than the beginning of the
1102      substitution (i.e. remove maxnewlines bytes at most) */
1103   while (maxnewlines-- != 0 &&
1104          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1105     {
1106       (*word)[--*word_length] = '\0';
1107
1108       /* If the last word was entirely newlines, turn it into a new word
1109        * which can be ignored if there's nothing following it. */
1110       if (*word_length == 0)
1111         {
1112           free (*word);
1113           *word = w_newword (word_length, max_length);
1114           break;
1115         }
1116     }
1117
1118   __close (fildes[0]);
1119   fildes[0] = -1;
1120
1121   /* Check for syntax error (re-execute but with "-n" flag) */
1122   if (buflen < 1 && status != 0)
1123     {
1124       noexec = 1;
1125       goto again;
1126     }
1127
1128   return 0;
1129
1130 no_space:
1131   __kill (pid, SIGKILL);
1132   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1133   __close (fildes[0]);
1134   return WRDE_NOSPACE;
1135 }
1136
1137 static int
1138 internal_function
1139 parse_comm (char **word, size_t *word_length, size_t *max_length,
1140             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1141             const char *ifs, const char *ifs_white)
1142 {
1143   /* We are poised just after "$(" */
1144   int paren_depth = 1;
1145   int error = 0;
1146   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1147   size_t comm_length;
1148   size_t comm_maxlen;
1149   char *comm = w_newword (&comm_length, &comm_maxlen);
1150
1151   for (; words[*offset]; ++(*offset))
1152     {
1153       switch (words[*offset])
1154         {
1155         case '\'':
1156           if (quoted == 0)
1157             quoted = 1;
1158           else if (quoted == 1)
1159             quoted = 0;
1160
1161           break;
1162
1163         case '"':
1164           if (quoted == 0)
1165             quoted = 2;
1166           else if (quoted == 2)
1167             quoted = 0;
1168
1169           break;
1170
1171         case ')':
1172           if (!quoted && --paren_depth == 0)
1173             {
1174               /* Go -- give script to the shell */
1175               if (comm)
1176                 {
1177 #ifdef __libc_ptf_call
1178                   /* We do not want the exec_comm call to be cut short
1179                      by a thread cancellation since cleanup is very
1180                      ugly.  Therefore disable cancellation for
1181                      now.  */
1182                   // XXX Ideally we do want the thread being cancelable.
1183                   // XXX If demand is there we'll change it.
1184                   int state = PTHREAD_CANCEL_ENABLE;
1185                   __libc_ptf_call (pthread_setcancelstate,
1186                                    (PTHREAD_CANCEL_DISABLE, &state), 0);
1187 #endif
1188
1189                   error = exec_comm (comm, word, word_length, max_length,
1190                                      flags, pwordexp, ifs, ifs_white);
1191
1192 #ifdef __libc_ptf_call
1193                   __libc_ptf_call (pthread_setcancelstate, (state, NULL), 0);
1194 #endif
1195
1196                   free (comm);
1197                 }
1198
1199               return error;
1200             }
1201
1202           /* This is just part of the script */
1203           break;
1204
1205         case '(':
1206           if (!quoted)
1207             ++paren_depth;
1208         }
1209
1210       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1211       if (comm == NULL)
1212         return WRDE_NOSPACE;
1213     }
1214
1215   /* Premature end.  */
1216   free (comm);
1217
1218   return WRDE_SYNTAX;
1219 }
1220
1221 static int
1222 internal_function
1223 parse_param (char **word, size_t *word_length, size_t *max_length,
1224              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1225              const char *ifs, const char *ifs_white, int quoted)
1226 {
1227   /* We are poised just after "$" */
1228   enum action
1229   {
1230     ACT_NONE,
1231     ACT_RP_SHORT_LEFT = '#',
1232     ACT_RP_LONG_LEFT = 'L',
1233     ACT_RP_SHORT_RIGHT = '%',
1234     ACT_RP_LONG_RIGHT = 'R',
1235     ACT_NULL_ERROR = '?',
1236     ACT_NULL_SUBST = '-',
1237     ACT_NONNULL_SUBST = '+',
1238     ACT_NULL_ASSIGN = '='
1239   };
1240   size_t env_length;
1241   size_t env_maxlen;
1242   size_t pat_length;
1243   size_t pat_maxlen;
1244   size_t start = *offset;
1245   char *env;
1246   char *pattern;
1247   char *value = NULL;
1248   enum action action = ACT_NONE;
1249   int depth = 0;
1250   int colon_seen = 0;
1251   int seen_hash = 0;
1252   int free_value = 0;
1253   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1254   int error;
1255   int special = 0;
1256   char buffer[21];
1257   int brace = words[*offset] == '{';
1258
1259   env = w_newword (&env_length, &env_maxlen);
1260   pattern = w_newword (&pat_length, &pat_maxlen);
1261
1262   if (brace)
1263     ++*offset;
1264
1265   /* First collect the parameter name. */
1266
1267   if (words[*offset] == '#')
1268     {
1269       seen_hash = 1;
1270       if (!brace)
1271         goto envsubst;
1272       ++*offset;
1273     }
1274
1275   if (isalpha (words[*offset]) || words[*offset] == '_')
1276     {
1277       /* Normal parameter name. */
1278       do
1279         {
1280           env = w_addchar (env, &env_length, &env_maxlen,
1281                            words[*offset]);
1282           if (env == NULL)
1283             goto no_space;
1284         }
1285       while (isalnum (words[++*offset]) || words[*offset] == '_');
1286     }
1287   else if (isdigit (words[*offset]))
1288     {
1289       /* Numeric parameter name. */
1290       special = 1;
1291       do
1292         {
1293           env = w_addchar (env, &env_length, &env_maxlen,
1294                            words[*offset]);
1295           if (env == NULL)
1296             goto no_space;
1297           if (!brace)
1298             goto envsubst;
1299         }
1300       while (isdigit(words[++*offset]));
1301     }
1302   else if (strchr ("*@$", words[*offset]) != NULL)
1303     {
1304       /* Special parameter. */
1305       special = 1;
1306       env = w_addchar (env, &env_length, &env_maxlen,
1307                        words[*offset]);
1308       if (env == NULL)
1309         goto no_space;
1310       ++*offset;
1311     }
1312   else
1313     {
1314       if (brace)
1315         goto syntax;
1316     }
1317
1318   if (brace)
1319     {
1320       /* Check for special action to be applied to the value. */
1321       switch (words[*offset])
1322         {
1323         case '}':
1324           /* Evaluate. */
1325           goto envsubst;
1326
1327         case '#':
1328           action = ACT_RP_SHORT_LEFT;
1329           if (words[1 + *offset] == '#')
1330             {
1331               ++*offset;
1332               action = ACT_RP_LONG_LEFT;
1333             }
1334           break;
1335
1336         case '%':
1337           action = ACT_RP_SHORT_RIGHT;
1338           if (words[1 + *offset] == '%')
1339             {
1340               ++*offset;
1341               action = ACT_RP_LONG_RIGHT;
1342             }
1343           break;
1344
1345         case ':':
1346           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1347             goto syntax;
1348
1349           colon_seen = 1;
1350           action = words[++*offset];
1351           break;
1352
1353         case '-':
1354         case '=':
1355         case '?':
1356         case '+':
1357           action = words[*offset];
1358           break;
1359
1360         default:
1361           goto syntax;
1362         }
1363
1364       /* Now collect the pattern, but don't expand it yet. */
1365       ++*offset;
1366       for (; words[*offset]; ++(*offset))
1367         {
1368           switch (words[*offset])
1369             {
1370             case '{':
1371               if (!pattern_is_quoted)
1372                 ++depth;
1373               break;
1374
1375             case '}':
1376               if (!pattern_is_quoted)
1377                 {
1378                   if (depth == 0)
1379                     goto envsubst;
1380                   --depth;
1381                 }
1382               break;
1383
1384             case '\\':
1385               if (pattern_is_quoted)
1386                 /* Quoted; treat as normal character. */
1387                 break;
1388
1389               /* Otherwise, it's an escape: next character is literal. */
1390               if (words[++*offset] == '\0')
1391                 goto syntax;
1392
1393               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1394               if (pattern == NULL)
1395                 goto no_space;
1396
1397               break;
1398
1399             case '\'':
1400               if (pattern_is_quoted == 0)
1401                 pattern_is_quoted = 1;
1402               else if (pattern_is_quoted == 1)
1403                 pattern_is_quoted = 0;
1404
1405               break;
1406
1407             case '"':
1408               if (pattern_is_quoted == 0)
1409                 pattern_is_quoted = 2;
1410               else if (pattern_is_quoted == 2)
1411                 pattern_is_quoted = 0;
1412
1413               break;
1414             }
1415
1416           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1417                                words[*offset]);
1418           if (pattern == NULL)
1419             goto no_space;
1420         }
1421     }
1422
1423   /* End of input string -- remember to reparse the character that we
1424    * stopped at.  */
1425   --(*offset);
1426
1427 envsubst:
1428   if (words[start] == '{' && words[*offset] != '}')
1429     goto syntax;
1430
1431   if (env == NULL)
1432     {
1433       if (seen_hash)
1434         {
1435           /* $# expands to the number of positional parameters */
1436           buffer[20] = '\0';
1437           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1438           seen_hash = 0;
1439         }
1440       else
1441         {
1442           /* Just $ on its own */
1443           *offset = start - 1;
1444           *word = w_addchar (*word, word_length, max_length, '$');
1445           return *word ? 0 : WRDE_NOSPACE;
1446         }
1447     }
1448   /* Is it a numeric parameter? */
1449   else if (isdigit (env[0]))
1450     {
1451       int n = atoi (env);
1452
1453       if (n >= __libc_argc)
1454         /* Substitute NULL. */
1455         value = NULL;
1456       else
1457         /* Replace with appropriate positional parameter. */
1458         value = __libc_argv[n];
1459     }
1460   /* Is it a special parameter? */
1461   else if (special)
1462     {
1463       /* Is it `$$'? */
1464       if (*env == '$')
1465         {
1466           buffer[20] = '\0';
1467           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1468         }
1469       /* Is it `${#*}' or `${#@}'? */
1470       else if ((*env == '*' || *env == '@') && seen_hash)
1471         {
1472           buffer[20] = '\0';
1473           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1474                               &buffer[20], 10, 0);
1475           *word = w_addstr (*word, word_length, max_length, value);
1476           free (env);
1477           free (pattern);
1478           return *word ? 0 : WRDE_NOSPACE;
1479         }
1480       /* Is it `$*' or `$@' (unquoted) ? */
1481       else if (*env == '*' || (*env == '@' && !quoted))
1482         {
1483           size_t plist_len = 0;
1484           int p;
1485           char *end;
1486
1487           /* Build up value parameter by parameter (copy them) */
1488           for (p = 1; __libc_argv[p]; ++p)
1489             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1490           value = malloc (plist_len);
1491           if (value == NULL)
1492             goto no_space;
1493           end = value;
1494           *end = 0;
1495           for (p = 1; __libc_argv[p]; ++p)
1496             {
1497               if (p > 1)
1498                 *end++ = ' ';
1499               end = __stpcpy (end, __libc_argv[p]);
1500             }
1501
1502           free_value = 1;
1503         }
1504       else
1505         {
1506           /* Must be a quoted `$@' */
1507           assert (*env == '@' && quoted);
1508
1509           /* Each parameter is a separate word ("$@") */
1510           if (__libc_argc == 2)
1511             value = __libc_argv[1];
1512           else if (__libc_argc > 2)
1513             {
1514               int p;
1515
1516               /* Append first parameter to current word. */
1517               value = w_addstr (*word, word_length, max_length,
1518                                 __libc_argv[1]);
1519               if (value == NULL || w_addword (pwordexp, value))
1520                 goto no_space;
1521
1522               for (p = 2; __libc_argv[p + 1]; p++)
1523                 {
1524                   char *newword = __strdup (__libc_argv[p]);
1525                   if (newword == NULL || w_addword (pwordexp, newword))
1526                     goto no_space;
1527                 }
1528
1529               /* Start a new word with the last parameter. */
1530               *word = w_newword (word_length, max_length);
1531               value = __libc_argv[p];
1532             }
1533           else
1534             {
1535               free (env);
1536               free (pattern);
1537               return 0;
1538             }
1539         }
1540     }
1541   else
1542     value = getenv (env);
1543
1544   if (value == NULL && (flags & WRDE_UNDEF))
1545     {
1546       /* Variable not defined. */
1547       error = WRDE_BADVAL;
1548       goto do_error;
1549     }
1550
1551   if (action != ACT_NONE)
1552     {
1553       int expand_pattern = 0;
1554
1555       /* First, find out if we need to expand pattern (i.e. if we will
1556        * use it). */
1557       switch (action)
1558         {
1559         case ACT_RP_SHORT_LEFT:
1560         case ACT_RP_LONG_LEFT:
1561         case ACT_RP_SHORT_RIGHT:
1562         case ACT_RP_LONG_RIGHT:
1563           /* Always expand for these. */
1564           expand_pattern = 1;
1565           break;
1566
1567         case ACT_NULL_ERROR:
1568         case ACT_NULL_SUBST:
1569         case ACT_NULL_ASSIGN:
1570           if (!value || (!*value && colon_seen))
1571             /* If param is unset, or set but null and a colon has been seen,
1572                the expansion of the pattern will be needed. */
1573             expand_pattern = 1;
1574
1575           break;
1576
1577         case ACT_NONNULL_SUBST:
1578           /* Expansion of word will be needed if parameter is set and not null,
1579              or set null but no colon has been seen. */
1580           if (value && (*value || !colon_seen))
1581             expand_pattern = 1;
1582
1583           break;
1584
1585         default:
1586           assert (! "Unrecognised action!");
1587         }
1588
1589       if (expand_pattern)
1590         {
1591           /* We need to perform tilde expansion, parameter expansion,
1592              command substitution, and arithmetic expansion.  We also
1593              have to be a bit careful with wildcard characters, as
1594              pattern might be given to fnmatch soon.  To do this, we
1595              convert quotes to escapes. */
1596
1597           char *expanded;
1598           size_t exp_len;
1599           size_t exp_maxl;
1600           char *p;
1601           int quoted = 0; /* 1: single quotes; 2: double */
1602
1603           expanded = w_newword (&exp_len, &exp_maxl);
1604           for (p = pattern; p && *p; p++)
1605             {
1606               size_t offset;
1607
1608               switch (*p)
1609                 {
1610                 case '"':
1611                   if (quoted == 2)
1612                     quoted = 0;
1613                   else if (quoted == 0)
1614                     quoted = 2;
1615                   else break;
1616
1617                   continue;
1618
1619                 case '\'':
1620                   if (quoted == 1)
1621                     quoted = 0;
1622                   else if (quoted == 0)
1623                     quoted = 1;
1624                   else break;
1625
1626                   continue;
1627
1628                 case '*':
1629                 case '?':
1630                   if (quoted)
1631                     {
1632                       /* Convert quoted wildchar to escaped wildchar. */
1633                       expanded = w_addchar (expanded, &exp_len,
1634                                             &exp_maxl, '\\');
1635
1636                       if (expanded == NULL)
1637                         goto no_space;
1638                     }
1639                   break;
1640
1641                 case '$':
1642                   offset = 0;
1643                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1644                                          &offset, flags, NULL, NULL, NULL, 1);
1645                   if (error)
1646                     {
1647                       if (free_value)
1648                         free (value);
1649
1650                       free (expanded);
1651
1652                       goto do_error;
1653                     }
1654
1655                   p += offset;
1656                   continue;
1657
1658                 case '~':
1659                   if (quoted || exp_len)
1660                     break;
1661
1662                   offset = 0;
1663                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1664                                        &offset, 0);
1665                   if (error)
1666                     {
1667                       if (free_value)
1668                         free (value);
1669
1670                       free (expanded);
1671
1672                       goto do_error;
1673                     }
1674
1675                   p += offset;
1676                   continue;
1677
1678                 case '\\':
1679                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1680                   ++p;
1681                   assert (*p); /* checked when extracted initially */
1682                   if (expanded == NULL)
1683                     goto no_space;
1684                 }
1685
1686               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1687
1688               if (expanded == NULL)
1689                 goto no_space;
1690             }
1691
1692           free (pattern);
1693
1694           pattern = expanded;
1695         }
1696
1697       switch (action)
1698         {
1699         case ACT_RP_SHORT_LEFT:
1700         case ACT_RP_LONG_LEFT:
1701         case ACT_RP_SHORT_RIGHT:
1702         case ACT_RP_LONG_RIGHT:
1703           {
1704             char *p;
1705             char c;
1706             char *end;
1707
1708             if (value == NULL || pattern == NULL || *pattern == '\0')
1709               break;
1710
1711             end = value + strlen (value);
1712
1713             switch (action)
1714               {
1715               case ACT_RP_SHORT_LEFT:
1716                 for (p = value; p <= end; ++p)
1717                   {
1718                     c = *p;
1719                     *p = '\0';
1720                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1721                       {
1722                         *p = c;
1723                         if (free_value)
1724                           {
1725                             char *newval = __strdup (p);
1726                             if (newval == NULL)
1727                               {
1728                                 free (value);
1729                                 goto no_space;
1730                               }
1731                             free (value);
1732                             value = newval;
1733                           }
1734                         else
1735                           value = p;
1736                         break;
1737                       }
1738                     *p = c;
1739                   }
1740
1741                 break;
1742
1743               case ACT_RP_LONG_LEFT:
1744                 for (p = end; p >= value; --p)
1745                   {
1746                     c = *p;
1747                     *p = '\0';
1748                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1749                       {
1750                         *p = c;
1751                         if (free_value)
1752                           {
1753                             char *newval = __strdup (p);
1754                             if (newval == NULL)
1755                               {
1756                                 free (value);
1757                                 goto no_space;
1758                               }
1759                             free (value);
1760                             value = newval;
1761                           }
1762                         else
1763                           value = p;
1764                         break;
1765                       }
1766                     *p = c;
1767                   }
1768
1769                 break;
1770
1771               case ACT_RP_SHORT_RIGHT:
1772                 for (p = end; p >= value; --p)
1773                   {
1774                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1775                       {
1776                         char *newval;
1777                         newval = malloc (p - value + 1);
1778
1779                         if (newval == NULL)
1780                           {
1781                             if (free_value)
1782                               free (value);
1783                             goto no_space;
1784                           }
1785
1786                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1787                         if (free_value)
1788                           free (value);
1789                         value = newval;
1790                         free_value = 1;
1791                         break;
1792                       }
1793                   }
1794
1795                 break;
1796
1797               case ACT_RP_LONG_RIGHT:
1798                 for (p = value; p <= end; ++p)
1799                   {
1800                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1801                       {
1802                         char *newval;
1803                         newval = malloc (p - value + 1);
1804
1805                         if (newval == NULL)
1806                           {
1807                             if (free_value)
1808                               free (value);
1809                             goto no_space;
1810                           }
1811
1812                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1813                         if (free_value)
1814                           free (value);
1815                         value = newval;
1816                         free_value = 1;
1817                         break;
1818                       }
1819                   }
1820
1821                 break;
1822
1823               default:
1824                 break;
1825               }
1826
1827             break;
1828           }
1829
1830         case ACT_NULL_ERROR:
1831           if (value && *value)
1832             /* Substitute parameter */
1833             break;
1834
1835           error = 0;
1836           if (!colon_seen && value)
1837             /* Substitute NULL */
1838             ;
1839           else
1840             {
1841               const char *str = pattern;
1842
1843               if (str[0] == '\0')
1844                 str = _("parameter null or not set");
1845
1846               __fxprintf (NULL, "%s: %s\n", env, str);
1847             }
1848
1849           if (free_value)
1850             free (value);
1851           goto do_error;
1852
1853         case ACT_NULL_SUBST:
1854           if (value && *value)
1855             /* Substitute parameter */
1856             break;
1857
1858           if (free_value)
1859             free (value);
1860
1861           if (!colon_seen && value)
1862             /* Substitute NULL */
1863             goto success;
1864
1865           value = pattern ? __strdup (pattern) : pattern;
1866           free_value = 1;
1867
1868           if (pattern && !value)
1869             goto no_space;
1870
1871           break;
1872
1873         case ACT_NONNULL_SUBST:
1874           if (value && (*value || !colon_seen))
1875             {
1876               if (free_value)
1877                 free (value);
1878
1879               value = pattern ? __strdup (pattern) : pattern;
1880               free_value = 1;
1881
1882               if (pattern && !value)
1883                 goto no_space;
1884
1885               break;
1886             }
1887
1888           /* Substitute NULL */
1889           if (free_value)
1890             free (value);
1891           goto success;
1892
1893         case ACT_NULL_ASSIGN:
1894           if (value && *value)
1895             /* Substitute parameter */
1896             break;
1897
1898           if (!colon_seen && value)
1899             {
1900               /* Substitute NULL */
1901               if (free_value)
1902                 free (value);
1903               goto success;
1904             }
1905
1906           if (free_value)
1907             free (value);
1908
1909           value = pattern ? __strdup (pattern) : pattern;
1910           free_value = 1;
1911
1912           if (pattern && !value)
1913             goto no_space;
1914
1915           __setenv (env, value, 1);
1916           break;
1917
1918         default:
1919           assert (! "Unrecognised action!");
1920         }
1921     }
1922
1923   free (env);
1924   env = NULL;
1925   free (pattern);
1926   pattern = NULL;
1927
1928   if (seen_hash)
1929     {
1930       char param_length[21];
1931       param_length[20] = '\0';
1932       *word = w_addstr (*word, word_length, max_length,
1933                         _itoa_word (value ? strlen (value) : 0,
1934                                     &param_length[20], 10, 0));
1935       if (free_value)
1936         {
1937           assert (value != NULL);
1938           free (value);
1939         }
1940
1941       return *word ? 0 : WRDE_NOSPACE;
1942     }
1943
1944   if (value == NULL)
1945     return 0;
1946
1947   if (quoted || !pwordexp)
1948     {
1949       /* Quoted - no field split */
1950       *word = w_addstr (*word, word_length, max_length, value);
1951       if (free_value)
1952         free (value);
1953
1954       return *word ? 0 : WRDE_NOSPACE;
1955     }
1956   else
1957     {
1958       /* Need to field-split */
1959       char *value_copy = __strdup (value); /* Don't modify value */
1960       char *field_begin = value_copy;
1961       int seen_nonws_ifs = 0;
1962
1963       if (free_value)
1964         free (value);
1965
1966       if (value_copy == NULL)
1967         goto no_space;
1968
1969       do
1970         {
1971           char *field_end = field_begin;
1972           char *next_field;
1973
1974           /* If this isn't the first field, start a new word */
1975           if (field_begin != value_copy)
1976             {
1977               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1978                 {
1979                   free (value_copy);
1980                   goto no_space;
1981                 }
1982
1983               *word = w_newword (word_length, max_length);
1984             }
1985
1986           /* Skip IFS whitespace before the field */
1987           field_begin += strspn (field_begin, ifs_white);
1988
1989           if (!seen_nonws_ifs && *field_begin == 0)
1990             /* Nothing but whitespace */
1991             break;
1992
1993           /* Search for the end of the field */
1994           field_end = field_begin + strcspn (field_begin, ifs);
1995
1996           /* Set up pointer to the character after end of field and
1997              skip whitespace IFS after it. */
1998           next_field = field_end + strspn (field_end, ifs_white);
1999
2000           /* Skip at most one non-whitespace IFS character after the field */
2001           seen_nonws_ifs = 0;
2002           if (*next_field && strchr (ifs, *next_field))
2003             {
2004               seen_nonws_ifs = 1;
2005               next_field++;
2006             }
2007
2008           /* Null-terminate it */
2009           *field_end = 0;
2010
2011           /* Tag a copy onto the current word */
2012           *word = w_addstr (*word, word_length, max_length, field_begin);
2013
2014           if (*word == NULL && *field_begin != '\0')
2015             {
2016               free (value_copy);
2017               goto no_space;
2018             }
2019
2020           field_begin = next_field;
2021         }
2022       while (seen_nonws_ifs || *field_begin);
2023
2024       free (value_copy);
2025     }
2026
2027   return 0;
2028
2029 success:
2030   error = 0;
2031   goto do_error;
2032
2033 no_space:
2034   error = WRDE_NOSPACE;
2035   goto do_error;
2036
2037 syntax:
2038   error = WRDE_SYNTAX;
2039
2040 do_error:
2041   free (env);
2042
2043   free (pattern);
2044
2045   return error;
2046 }
2047
2048 static int
2049 internal_function
2050 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2051                const char *words, size_t *offset, int flags,
2052                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2053                int quoted)
2054 {
2055   /* We are poised _at_ "$" */
2056   switch (words[1 + *offset])
2057     {
2058     case '"':
2059     case '\'':
2060     case 0:
2061       *word = w_addchar (*word, word_length, max_length, '$');
2062       return *word ? 0 : WRDE_NOSPACE;
2063
2064     case '(':
2065       if (words[2 + *offset] == '(')
2066         {
2067           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2068           int i = 3 + *offset;
2069           int depth = 0;
2070           while (words[i] && !(depth == 0 && words[i] == ')'))
2071             {
2072               if (words[i] == '(')
2073                 ++depth;
2074               else if (words[i] == ')')
2075                 --depth;
2076
2077               ++i;
2078             }
2079
2080           if (words[i] == ')' && words[i + 1] == ')')
2081             {
2082               (*offset) += 3;
2083               /* Call parse_arith -- 0 is for "no brackets" */
2084               return parse_arith (word, word_length, max_length, words, offset,
2085                                   flags, 0);
2086             }
2087         }
2088
2089       (*offset) += 2;
2090       return parse_comm (word, word_length, max_length, words, offset, flags,
2091                          quoted? NULL : pwordexp, ifs, ifs_white);
2092
2093     case '[':
2094       (*offset) += 2;
2095       /* Call parse_arith -- 1 is for "brackets" */
2096       return parse_arith (word, word_length, max_length, words, offset, flags,
2097                           1);
2098
2099     case '{':
2100     default:
2101       ++(*offset);      /* parse_param needs to know if "{" is there */
2102       return parse_param (word, word_length, max_length, words, offset, flags,
2103                            pwordexp, ifs, ifs_white, quoted);
2104     }
2105 }
2106
2107 static int
2108 internal_function
2109 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2110                 const char *words, size_t *offset, int flags,
2111                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2112 {
2113   /* We are poised just after "`" */
2114   int error;
2115   int squoting = 0;
2116   size_t comm_length;
2117   size_t comm_maxlen;
2118   char *comm = w_newword (&comm_length, &comm_maxlen);
2119
2120   for (; words[*offset]; ++(*offset))
2121     {
2122       switch (words[*offset])
2123         {
2124         case '`':
2125           /* Go -- give the script to the shell */
2126           error = exec_comm (comm, word, word_length, max_length, flags,
2127                              pwordexp, ifs, ifs_white);
2128           free (comm);
2129           return error;
2130
2131         case '\\':
2132           if (squoting)
2133             {
2134               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2135                                            words, offset);
2136
2137               if (error)
2138                 {
2139                   free (comm);
2140                   return error;
2141                 }
2142
2143               break;
2144             }
2145
2146           ++(*offset);
2147           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2148                                    offset);
2149
2150           if (error)
2151             {
2152               free (comm);
2153               return error;
2154             }
2155
2156           break;
2157
2158         case '\'':
2159           squoting = 1 - squoting;
2160         default:
2161           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2162           if (comm == NULL)
2163             return WRDE_NOSPACE;
2164         }
2165     }
2166
2167   /* Premature end */
2168   free (comm);
2169   return WRDE_SYNTAX;
2170 }
2171
2172 static int
2173 internal_function
2174 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2175               const char *words, size_t *offset, int flags,
2176               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2177 {
2178   /* We are poised just after a double-quote */
2179   int error;
2180
2181   for (; words[*offset]; ++(*offset))
2182     {
2183       switch (words[*offset])
2184         {
2185         case '"':
2186           return 0;
2187
2188         case '$':
2189           error = parse_dollars (word, word_length, max_length, words, offset,
2190                                  flags, pwordexp, ifs, ifs_white, 1);
2191           /* The ``1'' here is to tell parse_dollars not to
2192            * split the fields.  It may need to, however ("$@").
2193            */
2194           if (error)
2195             return error;
2196
2197           break;
2198
2199         case '`':
2200           ++(*offset);
2201           error = parse_backtick (word, word_length, max_length, words,
2202                                   offset, flags, NULL, NULL, NULL);
2203           /* The first NULL here is to tell parse_backtick not to
2204            * split the fields.
2205            */
2206           if (error)
2207             return error;
2208
2209           break;
2210
2211         case '\\':
2212           error = parse_qtd_backslash (word, word_length, max_length, words,
2213                                        offset);
2214
2215           if (error)
2216             return error;
2217
2218           break;
2219
2220         default:
2221           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2222           if (*word == NULL)
2223             return WRDE_NOSPACE;
2224         }
2225     }
2226
2227   /* Unterminated string */
2228   return WRDE_SYNTAX;
2229 }
2230
2231 /*
2232  * wordfree() is to be called after pwordexp is finished with.
2233  */
2234
2235 void
2236 wordfree (wordexp_t *pwordexp)
2237 {
2238
2239   /* wordexp can set pwordexp to NULL */
2240   if (pwordexp && pwordexp->we_wordv)
2241     {
2242       char **wordv = pwordexp->we_wordv;
2243
2244       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2245         free (*wordv);
2246
2247       free (pwordexp->we_wordv);
2248       pwordexp->we_wordv = NULL;
2249     }
2250 }
2251 libc_hidden_def (wordfree)
2252
2253 /*
2254  * wordexp()
2255  */
2256
2257 int
2258 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2259 {
2260   size_t words_offset;
2261   size_t word_length;
2262   size_t max_length;
2263   char *word = w_newword (&word_length, &max_length);
2264   int error;
2265   char *ifs;
2266   char ifs_white[4];
2267   wordexp_t old_word = *pwordexp;
2268
2269   if (flags & WRDE_REUSE)
2270     {
2271       /* Minimal implementation of WRDE_REUSE for now */
2272       wordfree (pwordexp);
2273       old_word.we_wordv = NULL;
2274     }
2275
2276   if ((flags & WRDE_APPEND) == 0)
2277     {
2278       pwordexp->we_wordc = 0;
2279
2280       if (flags & WRDE_DOOFFS)
2281         {
2282           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2283           if (pwordexp->we_wordv == NULL)
2284             {
2285               error = WRDE_NOSPACE;
2286               goto do_error;
2287             }
2288         }
2289       else
2290         {
2291           pwordexp->we_wordv = calloc (1, sizeof (char *));
2292           if (pwordexp->we_wordv == NULL)
2293             {
2294               error = WRDE_NOSPACE;
2295               goto do_error;
2296             }
2297
2298           pwordexp->we_offs = 0;
2299         }
2300     }
2301
2302   /* Find out what the field separators are.
2303    * There are two types: whitespace and non-whitespace.
2304    */
2305   ifs = getenv ("IFS");
2306
2307   if (ifs == NULL)
2308     /* IFS unset - use <space><tab><newline>. */
2309     ifs = strcpy (ifs_white, " \t\n");
2310   else
2311     {
2312       char *ifsch = ifs;
2313       char *whch = ifs_white;
2314
2315       while (*ifsch != '\0')
2316         {
2317           if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2318             {
2319               /* Whitespace IFS.  See first whether it is already in our
2320                  collection.  */
2321               char *runp = ifs_white;
2322
2323               while (runp < whch && *runp != *ifsch)
2324                 ++runp;
2325
2326               if (runp == whch)
2327                 *whch++ = *ifsch;
2328             }
2329
2330           ++ifsch;
2331         }
2332       *whch = '\0';
2333     }
2334
2335   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2336     switch (words[words_offset])
2337       {
2338       case '\\':
2339         error = parse_backslash (&word, &word_length, &max_length, words,
2340                                  &words_offset);
2341
2342         if (error)
2343           goto do_error;
2344
2345         break;
2346
2347       case '$':
2348         error = parse_dollars (&word, &word_length, &max_length, words,
2349                                &words_offset, flags, pwordexp, ifs, ifs_white,
2350                                0);
2351
2352         if (error)
2353           goto do_error;
2354
2355         break;
2356
2357       case '`':
2358         ++words_offset;
2359         error = parse_backtick (&word, &word_length, &max_length, words,
2360                                 &words_offset, flags, pwordexp, ifs,
2361                                 ifs_white);
2362
2363         if (error)
2364           goto do_error;
2365
2366         break;
2367
2368       case '"':
2369         ++words_offset;
2370         error = parse_dquote (&word, &word_length, &max_length, words,
2371                               &words_offset, flags, pwordexp, ifs, ifs_white);
2372
2373         if (error)
2374           goto do_error;
2375
2376         if (!word_length)
2377           {
2378             error = w_addword (pwordexp, NULL);
2379
2380             if (error)
2381               return error;
2382           }
2383
2384         break;
2385
2386       case '\'':
2387         ++words_offset;
2388         error = parse_squote (&word, &word_length, &max_length, words,
2389                               &words_offset);
2390
2391         if (error)
2392           goto do_error;
2393
2394         if (!word_length)
2395           {
2396             error = w_addword (pwordexp, NULL);
2397
2398             if (error)
2399               return error;
2400           }
2401
2402         break;
2403
2404       case '~':
2405         error = parse_tilde (&word, &word_length, &max_length, words,
2406                              &words_offset, pwordexp->we_wordc);
2407
2408         if (error)
2409           goto do_error;
2410
2411         break;
2412
2413       case '*':
2414       case '[':
2415       case '?':
2416         error = parse_glob (&word, &word_length, &max_length, words,
2417                             &words_offset, flags, pwordexp, ifs, ifs_white);
2418
2419         if (error)
2420           goto do_error;
2421
2422         break;
2423
2424       default:
2425         /* Is it a word separator? */
2426         if (strchr (" \t", words[words_offset]) == NULL)
2427           {
2428             char ch = words[words_offset];
2429
2430             /* Not a word separator -- but is it a valid word char? */
2431             if (strchr ("\n|&;<>(){}", ch))
2432               {
2433                 /* Fail */
2434                 error = WRDE_BADCHAR;
2435                 goto do_error;
2436               }
2437
2438             /* "Ordinary" character -- add it to word */
2439             word = w_addchar (word, &word_length, &max_length,
2440                               ch);
2441             if (word == NULL)
2442               {
2443                 error = WRDE_NOSPACE;
2444                 goto do_error;
2445               }
2446
2447             break;
2448           }
2449
2450         /* If a word has been delimited, add it to the list. */
2451         if (word != NULL)
2452           {
2453             error = w_addword (pwordexp, word);
2454             if (error)
2455               goto do_error;
2456           }
2457
2458         word = w_newword (&word_length, &max_length);
2459       }
2460
2461   /* End of string */
2462
2463   /* There was a word separator at the end */
2464   if (word == NULL) /* i.e. w_newword */
2465     return 0;
2466
2467   /* There was no field separator at the end */
2468   return w_addword (pwordexp, word);
2469
2470 do_error:
2471   /* Error:
2472    *    free memory used (unless error is WRDE_NOSPACE), and
2473    *    set pwordexp members back to what they were.
2474    */
2475
2476   free (word);
2477
2478   if (error == WRDE_NOSPACE)
2479     return WRDE_NOSPACE;
2480
2481   if ((flags & WRDE_APPEND) == 0)
2482     wordfree (pwordexp);
2483
2484   *pwordexp = old_word;
2485   return error;
2486 }