sysdeps/generic/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2002, 2003 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, write to the Free
  18    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  19    02111-1307 USA.  */
  20
  21 #include <alloca.h>
  22 #include <ctype.h>
  23 #include <errno.h>
  24 #include <fcntl.h>
  25 #include <fnmatch.h>
  26 #include <glob.h>
  27 #include <libintl.h>
  28 #include <paths.h>
  29 #include <pwd.h>
  30 #include <signal.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <sys/param.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/types.h>
  39 #include <sys/wait.h>
  40 #include <unistd.h>
  41 #ifdef USE_IN_LIBIO
  42 # include <wchar.h>
  43 #endif
  44 #include <wordexp.h>
  45
  46 #include <bits/libc-lock.h>
  47 #include <stdio-common/_itoa.h>
  48
  49 /* Undefine the following line for the production version.  */
  50 /* #define NDEBUG 1 */
  51 #include <assert.h>
  52
  53 /* Get some device information.  */
  54 #include <device-nrs.h>
  55
  56 /*
  57  * This is a recursive-descent-style word expansion routine.
  58  */
  59
  60 /* These variables are defined and initialized in the startup code.  */
  61 extern int __libc_argc attribute_hidden;
  62 extern char **__libc_argv attribute_hidden;
  63
  64 /* Some forward declarations */
  65 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  66                           const char *words, size_t *offset, int flags,
  67                           wordexp_t *pwordexp, const char *ifs,
  68                           const char *ifs_white, int quoted)
  69      internal_function;
  70 static int parse_backtick (char **word, size_t *word_length,
  71                            size_t *max_length, const char *words,
  72                            size_t *offset, int flags, wordexp_t *pwordexp,
  73                            const char *ifs, const char *ifs_white)
  74      internal_function;
  75 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  76                          const char *words, size_t *offset, int flags,
  77                          wordexp_t *pwordexp, const char *ifs,
  78                          const char *ifs_white)
  79      internal_function;
  80 static int eval_expr (char *expr, long int *result) internal_function;
  81
  82 /* The w_*() functions manipulate word lists. */
  83
  84 #define W_CHUNK (100)
  85
  86 /* Result of w_newword will be ignored if it's the last word. */
  87 static inline char *
  88 w_newword (size_t *actlen, size_t *maxlen)
  89 {
  90   *actlen = *maxlen = 0;
  91   return NULL;
  92 }
  93
  94 static char *
  95 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  96      /* (lengths exclude trailing zero) */
  97 {
  98   /* Add a character to the buffer, allocating room for it if needed.  */
  99
 100   if (*actlen == *maxlen)
 101     {
 102       char *old_buffer = buffer;
 103       assert (buffer == NULL || *maxlen != 0);
 104       *maxlen += W_CHUNK;
 105       buffer = (char *) realloc (buffer, 1 + *maxlen);
 106
 107       if (buffer == NULL)
 108         free (old_buffer);
 109     }
 110
 111   if (buffer != NULL)
 112     {
 113       buffer[*actlen] = ch;
 114       buffer[++(*actlen)] = '\0';
 115     }
 116
 117   return buffer;
 118 }
 119
 120 static char *
 121 internal_function
 122 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 123           size_t len)
 124 {
 125   /* Add a string to the buffer, allocating room for it if needed.
 126    */
 127   if (*actlen + len > *maxlen)
 128     {
 129       char *old_buffer = buffer;
 130       assert (buffer == NULL || *maxlen != 0);
 131       *maxlen += MAX (2 * len, W_CHUNK);
 132       buffer = realloc (old_buffer, 1 + *maxlen);
 133
 134       if (buffer == NULL)
 135         free (old_buffer);
 136     }
 137
 138   if (buffer != NULL)
 139     {
 140       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 141       *actlen += len;
 142     }
 143
 144   return buffer;
 145 }
 146
 147 static char *
 148 internal_function
 149 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 150      /* (lengths exclude trailing zero) */
 151 {
 152   /* Add a string to the buffer, allocating room for it if needed.
 153    */
 154   size_t len;
 155
 156   assert (str != NULL); /* w_addstr only called from this file */
 157   len = strlen (str);
 158
 159   return w_addmem (buffer, actlen, maxlen, str, len);
 160 }
 161
 162 static int
 163 internal_function
 164 w_addword (wordexp_t *pwordexp, char *word)
 165 {
 166   /* Add a word to the wordlist */
 167   size_t num_p;
 168   char **new_wordv;
 169
 170   /* Internally, NULL acts like "".  Convert NULLs to "" before
 171    * the caller sees them.
 172    */
 173   if (word == NULL)
 174     {
 175       word = __strdup ("");
 176       if (word == NULL)
 177         goto no_space;
 178     }
 179
 180   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 181   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 182   if (new_wordv != NULL)
 183     {
 184       pwordexp->we_wordv = new_wordv;
 185       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 186       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 187       return 0;
 188     }
 189
 190 no_space:
 191   return WRDE_NOSPACE;
 192 }
 193
 194 /* The parse_*() functions should leave *offset being the offset in 'words'
 195  * to the last character processed.
 196  */
 197
 198 static int
 199 internal_function
 200 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 201                  const char *words, size_t *offset)
 202 {
 203   /* We are poised _at_ a backslash, not in quotes */
 204
 205   switch (words[1 + *offset])
 206     {
 207     case 0:
 208       /* Backslash is last character of input words */
 209       return WRDE_SYNTAX;
 210
 211     case '\n':
 212       ++(*offset);
 213       break;
 214
 215     default:
 216       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 217       if (*word == NULL)
 218         return WRDE_NOSPACE;
 219
 220       ++(*offset);
 221       break;
 222     }
 223
 224   return 0;
 225 }
 226
 227 static int
 228 internal_function
 229 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 230                      const char *words, size_t *offset)
 231 {
 232   /* We are poised _at_ a backslash, inside quotes */
 233
 234   switch (words[1 + *offset])
 235     {
 236     case 0:
 237       /* Backslash is last character of input words */
 238       return WRDE_SYNTAX;
 239
 240     case '\n':
 241       ++(*offset);
 242       break;
 243
 244     case '$':
 245     case '`':
 246     case '"':
 247     case '\\':
 248       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 249       if (*word == NULL)
 250         return WRDE_NOSPACE;
 251
 252       ++(*offset);
 253       break;
 254
 255     default:
 256       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 257       if (*word != NULL)
 258         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 259
 260       if (*word == NULL)
 261         return WRDE_NOSPACE;
 262
 263       ++(*offset);
 264       break;
 265     }
 266
 267   return 0;
 268 }
 269
 270 static int
 271 internal_function
 272 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 273              const char *words, size_t *offset, size_t wordc)
 274 {
 275   /* We are poised _at_ a tilde */
 276   size_t i;
 277
 278   if (*word_length != 0)
 279     {
 280       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 281         {
 282           if (!((*word)[*word_length - 1] == ':'
 283                 && strchr (*word, '=') && wordc == 0))
 284             {
 285               *word = w_addchar (*word, word_length, max_length, '~');
 286               return *word ? 0 : WRDE_NOSPACE;
 287             }
 288         }
 289     }
 290
 291   for (i = 1 + *offset; words[i]; i++)
 292     {
 293       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 294           words[i] == '\t' || words[i] == 0 )
 295         break;
 296
 297       if (words[i] == '\\')
 298         {
 299           *word = w_addchar (*word, word_length, max_length, '~');
 300           return *word ? 0 : WRDE_NOSPACE;
 301         }
 302     }
 303
 304   if (i == 1 + *offset)
 305     {
 306       /* Tilde appears on its own */
 307       uid_t uid;
 308       struct passwd pwd, *tpwd;
 309       int buflen = 1000;
 310       char* home;
 311       char* buffer;
 312       int result;
 313
 314       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 315          results are unspecified.  We do a lookup on the uid if
 316          HOME is unset. */
 317
 318       home = getenv ("HOME");
 319       if (home != NULL)
 320         {
 321           *word = w_addstr (*word, word_length, max_length, home);
 322           if (*word == NULL)
 323             return WRDE_NOSPACE;
 324         }
 325       else
 326         {
 327           uid = __getuid ();
 328           buffer = __alloca (buflen);
 329
 330           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 331                  && errno == ERANGE)
 332             buffer = extend_alloca (buffer, buflen, buflen + 1000);
 333
 334           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 335             {
 336               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 337               if (*word == NULL)
 338                 return WRDE_NOSPACE;
 339             }
 340           else
 341             {
 342               *word = w_addchar (*word, word_length, max_length, '~');
 343               if (*word == NULL)
 344                 return WRDE_NOSPACE;
 345             }
 346         }
 347     }
 348   else
 349     {
 350       /* Look up user name in database to get home directory */
 351       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 352       struct passwd pwd, *tpwd;
 353       int buflen = 1000;
 354       char* buffer = __alloca (buflen);
 355       int result;
 356
 357       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 358              && errno == ERANGE)
 359         buffer = extend_alloca (buffer, buflen, buflen + 1000);
 360
 361       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 362         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 363       else
 364         {
 365           /* (invalid login name) */
 366           *word = w_addchar (*word, word_length, max_length, '~');
 367           if (*word != NULL)
 368             *word = w_addstr (*word, word_length, max_length, user);
 369         }
 370
 371       *offset = i - 1;
 372     }
 373   return *word ? 0 : WRDE_NOSPACE;
 374 }
 375
 376
 377 static int
 378 internal_function
 379 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 380                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 381                const char *ifs_white)
 382 {
 383   int error;
 384   unsigned int match;
 385   glob_t globbuf;
 386
 387   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 388
 389   if (error != 0)
 390     {
 391       /* We can only run into memory problems.  */
 392       assert (error == GLOB_NOSPACE);
 393       return WRDE_NOSPACE;
 394     }
 395
 396   if (ifs && !*ifs)
 397     {
 398       /* No field splitting allowed. */
 399       assert (globbuf.gl_pathv[0] != NULL);
 400       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 401       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 402         {
 403           *word = w_addchar (*word, word_length, max_length, ' ');
 404           if (*word != NULL)
 405             *word = w_addstr (*word, word_length, max_length,
 406                               globbuf.gl_pathv[match]);
 407         }
 408
 409       globfree (&globbuf);
 410       return *word ? 0 : WRDE_NOSPACE;
 411     }
 412
 413   assert (ifs == NULL || *ifs != '\0');
 414   if (*word != NULL)
 415     {
 416       free (*word);
 417       *word = w_newword (word_length, max_length);
 418     }
 419
 420   for (match = 0; match < globbuf.gl_pathc; ++match)
 421     {
 422       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 423       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 424         {
 425           globfree (&globbuf);
 426           return WRDE_NOSPACE;
 427         }
 428     }
 429
 430   globfree (&globbuf);
 431   return 0;
 432 }
 433
 434 static int
 435 internal_function
 436 parse_glob (char **word, size_t *word_length, size_t *max_length,
 437             const char *words, size_t *offset, int flags,
 438             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 439 {
 440   /* We are poised just after a '*', a '[' or a '?'. */
 441   int error = WRDE_NOSPACE;
 442   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 443   size_t i;
 444   wordexp_t glob_list; /* List of words to glob */
 445
 446   glob_list.we_wordc = 0;
 447   glob_list.we_wordv = NULL;
 448   glob_list.we_offs = 0;
 449   for (; words[*offset] != '\0'; ++*offset)
 450     {
 451       if ((ifs && strchr (ifs, words[*offset])) ||
 452           (!ifs && strchr (" \t\n", words[*offset])))
 453         /* Reached IFS */
 454         break;
 455
 456       /* Sort out quoting */
 457       if (words[*offset] == '\'')
 458         {
 459           if (quoted == 0)
 460             {
 461               quoted = 1;
 462               continue;
 463             }
 464           else if (quoted == 1)
 465             {
 466               quoted = 0;
 467               continue;
 468             }
 469         }
 470       else if (words[*offset] == '"')
 471         {
 472           if (quoted == 0)
 473             {
 474               quoted = 2;
 475               continue;
 476             }
 477           else if (quoted == 2)
 478             {
 479               quoted = 0;
 480               continue;
 481             }
 482         }
 483
 484       /* Sort out other special characters */
 485       if (quoted != 1 && words[*offset] == '$')
 486         {
 487           error = parse_dollars (word, word_length, max_length, words,
 488                                  offset, flags, &glob_list, ifs, ifs_white,
 489                                  quoted == 2);
 490           if (error)
 491             goto tidy_up;
 492
 493           continue;
 494         }
 495       else if (words[*offset] == '\\')
 496         {
 497           if (quoted)
 498             error = parse_qtd_backslash (word, word_length, max_length,
 499                                          words, offset);
 500           else
 501             error = parse_backslash (word, word_length, max_length,
 502                                      words, offset);
 503
 504           if (error)
 505             goto tidy_up;
 506
 507           continue;
 508         }
 509
 510       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 511       if (*word == NULL)
 512         goto tidy_up;
 513     }
 514
 515   /* Don't forget to re-parse the character we stopped at. */
 516   --*offset;
 517
 518   /* Glob the words */
 519   error = w_addword (&glob_list, *word);
 520   *word = w_newword (word_length, max_length);
 521   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 522     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 523                            max_length, pwordexp, ifs, ifs_white);
 524
 525   /* Now tidy up */
 526 tidy_up:
 527   wordfree (&glob_list);
 528   return error;
 529 }
 530
 531 static int
 532 internal_function
 533 parse_squote (char **word, size_t *word_length, size_t *max_length,
 534               const char *words, size_t *offset)
 535 {
 536   /* We are poised just after a single quote */
 537   for (; words[*offset]; ++(*offset))
 538     {
 539       if (words[*offset] != '\'')
 540         {
 541           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 542           if (*word == NULL)
 543             return WRDE_NOSPACE;
 544         }
 545       else return 0;
 546     }
 547
 548   /* Unterminated string */
 549   return WRDE_SYNTAX;
 550 }
 551
 552 /* Functions to evaluate an arithmetic expression */
 553 static int
 554 internal_function
 555 eval_expr_val (char **expr, long int *result)
 556 {
 557   char *digit;
 558
 559   /* Skip white space */
 560   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 561
 562   if (*digit == '(')
 563     {
 564       /* Scan for closing paren */
 565       for (++digit; **expr && **expr != ')'; ++(*expr));
 566
 567       /* Is there one? */
 568       if (!**expr)
 569         return WRDE_SYNTAX;
 570
 571       *(*expr)++ = 0;
 572
 573       if (eval_expr (digit, result))
 574         return WRDE_SYNTAX;
 575
 576       return 0;
 577     }
 578
 579   /* POSIX requires that decimal, octal, and hexadecimal constants are
 580      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 581   *result = strtol (digit, expr, 0);
 582   if (digit == *expr)
 583     return WRDE_SYNTAX;
 584
 585   return 0;
 586 }
 587
 588 static int
 589 internal_function
 590 eval_expr_multdiv (char **expr, long int *result)
 591 {
 592   long int arg;
 593
 594   /* Read a Value */
 595   if (eval_expr_val (expr, result) != 0)
 596     return WRDE_SYNTAX;
 597
 598   while (**expr)
 599     {
 600       /* Skip white space */
 601       for (; *expr && **expr && isspace (**expr); ++(*expr));
 602
 603       if (**expr == '*')
 604         {
 605           ++(*expr);
 606           if (eval_expr_val (expr, &arg) != 0)
 607             return WRDE_SYNTAX;
 608
 609           *result *= arg;
 610         }
 611       else if (**expr == '/')
 612         {
 613           ++(*expr);
 614           if (eval_expr_val (expr, &arg) != 0)
 615             return WRDE_SYNTAX;
 616
 617           *result /= arg;
 618         }
 619       else break;
 620     }
 621
 622   return 0;
 623 }
 624
 625 static int
 626 internal_function
 627 eval_expr (char *expr, long int *result)
 628 {
 629   long int arg;
 630
 631   /* Read a Multdiv */
 632   if (eval_expr_multdiv (&expr, result) != 0)
 633     return WRDE_SYNTAX;
 634
 635   while (*expr)
 636     {
 637       /* Skip white space */
 638       for (; expr && *expr && isspace (*expr); ++expr);
 639
 640       if (*expr == '+')
 641         {
 642           ++expr;
 643           if (eval_expr_multdiv (&expr, &arg) != 0)
 644             return WRDE_SYNTAX;
 645
 646           *result += arg;
 647         }
 648       else if (*expr == '-')
 649         {
 650           ++expr;
 651           if (eval_expr_multdiv (&expr, &arg) != 0)
 652             return WRDE_SYNTAX;
 653
 654           *result -= arg;
 655         }
 656       else break;
 657     }
 658
 659   return 0;
 660 }
 661
 662 static int
 663 internal_function
 664 parse_arith (char **word, size_t *word_length, size_t *max_length,
 665              const char *words, size_t *offset, int flags, int bracket)
 666 {
 667   /* We are poised just after "$((" or "$[" */
 668   int error;
 669   int paren_depth = 1;
 670   size_t expr_length;
 671   size_t expr_maxlen;
 672   char *expr;
 673
 674   expr = w_newword (&expr_length, &expr_maxlen);
 675   for (; words[*offset]; ++(*offset))
 676     {
 677       switch (words[*offset])
 678         {
 679         case '$':
 680           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 681                                  words, offset, flags, NULL, NULL, NULL, 1);
 682           /* The ``1'' here is to tell parse_dollars not to
 683            * split the fields.
 684            */
 685           if (error)
 686             {
 687               free (expr);
 688               return error;
 689             }
 690           break;
 691
 692         case '`':
 693           (*offset)++;
 694           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 695                                   words, offset, flags, NULL, NULL, NULL);
 696           /* The first NULL here is to tell parse_backtick not to
 697            * split the fields.
 698            */
 699           if (error)
 700             {
 701               free (expr);
 702               return error;
 703             }
 704           break;
 705
 706         case '\\':
 707           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 708                                        words, offset);
 709           if (error)
 710             {
 711               free (expr);
 712               return error;
 713             }
 714           /* I think that a backslash within an
 715            * arithmetic expansion is bound to
 716            * cause an error sooner or later anyway though.
 717            */
 718           break;
 719
 720         case ')':
 721           if (--paren_depth == 0)
 722             {
 723               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 724               long int numresult = 0;
 725               long long int convertme;
 726
 727               if (bracket || words[1 + *offset] != ')')
 728                 {
 729                   free (expr);
 730                   return WRDE_SYNTAX;
 731                 }
 732
 733               ++(*offset);
 734
 735               /* Go - evaluate. */
 736               if (*expr && eval_expr (expr, &numresult) != 0)
 737                 {
 738                   free (expr);
 739                   return WRDE_SYNTAX;
 740                 }
 741
 742               if (numresult < 0)
 743                 {
 744                   convertme = -numresult;
 745                   *word = w_addchar (*word, word_length, max_length, '-');
 746                   if (!*word)
 747                     {
 748                       free (expr);
 749                       return WRDE_NOSPACE;
 750                     }
 751                 }
 752               else
 753                 convertme = numresult;
 754
 755               result[20] = '\0';
 756               *word = w_addstr (*word, word_length, max_length,
 757                                 _itoa (convertme, &result[20], 10, 0));
 758               free (expr);
 759               return *word ? 0 : WRDE_NOSPACE;
 760             }
 761           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 762           if (expr == NULL)
 763             return WRDE_NOSPACE;
 764
 765           break;
 766
 767         case ']':
 768           if (bracket && paren_depth == 1)
 769             {
 770               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 771               long int numresult = 0;
 772
 773               /* Go - evaluate. */
 774               if (*expr && eval_expr (expr, &numresult) != 0)
 775                 {
 776                   free (expr);
 777                   return WRDE_SYNTAX;
 778                 }
 779
 780               result[20] = '\0';
 781               *word = w_addstr (*word, word_length, max_length,
 782                                 _itoa_word (numresult, &result[20], 10, 0));
 783               free (expr);
 784               return *word ? 0 : WRDE_NOSPACE;
 785             }
 786
 787           free (expr);
 788           return WRDE_SYNTAX;
 789
 790         case '\n':
 791         case ';':
 792         case '{':
 793         case '}':
 794           free (expr);
 795           return WRDE_BADCHAR;
 796
 797         case '(':
 798           ++paren_depth;
 799         default:
 800           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 801           if (expr == NULL)
 802             return WRDE_NOSPACE;
 803         }
 804     }
 805
 806   /* Premature end */
 807   free (expr);
 808   return WRDE_SYNTAX;
 809 }
 810
 811 /* Function called by child process in exec_comm() */
 812 static void
 813 internal_function
 814 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 815 {
 816   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 817
 818   /* Execute the command, or just check syntax? */
 819   if (noexec)
 820     args[1] = "-nc";
 821
 822   /* Redirect output.  */
 823   __dup2 (fildes[1], STDOUT_FILENO);
 824   __close (fildes[1]);
 825
 826   /* Redirect stderr to /dev/null if we have to.  */
 827   if (showerr == 0)
 828     {
 829       struct stat64 st;
 830       int fd;
 831       __close (2);
 832       fd = __open (_PATH_DEVNULL, O_WRONLY);
 833       if (fd >= 0 && fd != 2)
 834         {
 835           __dup2 (fd, STDERR_FILENO);
 836           __close (fd);
 837         }
 838       /* Be paranoid.  Check that we actually opened the /dev/null
 839          device.  */
 840       if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
 841           || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
 842 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 843           || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 844 #endif
 845           )
 846         /* It's not the /dev/null device.  Stop right here.  The
 847            problem is: how do we stop?  We use _exit() with an
 848            hopefully unusual exit code.  */
 849         _exit (90);
 850     }
 851
 852   /* Make sure the subshell doesn't field-split on our behalf. */
 853   __unsetenv ("IFS");
 854
 855   __close (fildes[0]);
 856   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 857
 858   /* Bad.  What now?  */
 859   abort ();
 860 }
 861
 862 /* Function to execute a command and retrieve the results */
 863 /* pwordexp contains NULL if field-splitting is forbidden */
 864 static int
 865 internal_function
 866 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 867            int flags, wordexp_t *pwordexp, const char *ifs,
 868            const char *ifs_white)
 869 {
 870   int fildes[2];
 871   int bufsize = 128;
 872   int buflen;
 873   int i;
 874   int status = 0;
 875   size_t maxnewlines = 0;
 876   char *buffer;
 877   pid_t pid;
 878
 879   /* Don't fork() unless necessary */
 880   if (!comm || !*comm)
 881     return 0;
 882
 883   if (__pipe (fildes))
 884     /* Bad */
 885     return WRDE_NOSPACE;
 886
 887   if ((pid = __fork ()) < 0)
 888     {
 889       /* Bad */
 890       __close (fildes[0]);
 891       __close (fildes[1]);
 892       return WRDE_NOSPACE;
 893     }
 894
 895   if (pid == 0)
 896     exec_comm_child (comm, fildes, flags & WRDE_SHOWERR, 0);
 897
 898   /* Parent */
 899
 900   __close (fildes[1]);
 901   buffer = __alloca (bufsize);
 902
 903   if (!pwordexp)
 904     /* Quoted - no field splitting */
 905     {
 906       while (1)
 907         {
 908           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 909             {
 910               if (__waitpid (pid, &status, WNOHANG) == 0)
 911                 continue;
 912               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 913                 break;
 914             }
 915
 916           maxnewlines += buflen;
 917
 918           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 919           if (*word == NULL)
 920             goto no_space;
 921         }
 922     }
 923   else
 924     /* Not quoted - split fields */
 925     {
 926       int copying = 0;
 927       /* 'copying' is:
 928        *  0 when searching for first character in a field not IFS white space
 929        *  1 when copying the text of a field
 930        *  2 when searching for possible non-whitespace IFS
 931        *  3 when searching for non-newline after copying field
 932        */
 933
 934       while (1)
 935         {
 936           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 937             {
 938               if (__waitpid (pid, &status, WNOHANG) == 0)
 939                 continue;
 940               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 941                 break;
 942             }
 943
 944           for (i = 0; i < buflen; ++i)
 945             {
 946               if (strchr (ifs, buffer[i]) != NULL)
 947                 {
 948                   /* Current character is IFS */
 949                   if (strchr (ifs_white, buffer[i]) == NULL)
 950                     {
 951                       /* Current character is IFS but not whitespace */
 952                       if (copying == 2)
 953                         {
 954                           /*            current character
 955                            *                   |
 956                            *                   V
 957                            * eg: text<space><comma><space>moretext
 958                            *
 959                            * So, strip whitespace IFS (like at the start)
 960                            */
 961                           copying = 0;
 962                           continue;
 963                         }
 964
 965                       copying = 0;
 966                       /* fall through and delimit field.. */
 967                     }
 968                   else
 969                     {
 970                       if (buffer[i] == '\n')
 971                         {
 972                           /* Current character is (IFS) newline */
 973
 974                           /* If copying a field, this is the end of it,
 975                              but maybe all that's left is trailing newlines.
 976                              So start searching for a non-newline. */
 977                           if (copying == 1)
 978                             copying = 3;
 979
 980                           continue;
 981                         }
 982                       else
 983                         {
 984                           /* Current character is IFS white space, but
 985                              not a newline */
 986
 987                           /* If not either copying a field or searching
 988                              for non-newline after a field, ignore it */
 989                           if (copying != 1 && copying != 3)
 990                             continue;
 991
 992                           /* End of field (search for non-ws IFS afterwards) */
 993                           copying = 2;
 994                         }
 995                     }
 996
 997                   /* First IFS white space (non-newline), or IFS non-whitespace.
 998                    * Delimit the field.  Nulls are converted by w_addword. */
 999                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1000                     goto no_space;
1001
1002                   *word = w_newword (word_length, max_length);
1003
1004                   maxnewlines = 0;
1005                   /* fall back round the loop.. */
1006                 }
1007               else
1008                 {
1009                   /* Not IFS character */
1010
1011                   if (copying == 3)
1012                     {
1013                       /* Nothing but (IFS) newlines since the last field,
1014                          so delimit it here before starting new word */
1015                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1016                         goto no_space;
1017
1018                       *word = w_newword (word_length, max_length);
1019                     }
1020
1021                   copying = 1;
1022
1023                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1024                     maxnewlines++;
1025                   else
1026                     maxnewlines = 0;
1027
1028                   *word = w_addchar (*word, word_length, max_length,
1029                                      buffer[i]);
1030                   if (*word == NULL)
1031                     goto no_space;
1032                 }
1033             }
1034         }
1035     }
1036
1037   /* Chop off trailing newlines (required by POSIX.2)  */
1038   /* Ensure we don't go back further than the beginning of the
1039      substitution (i.e. remove maxnewlines bytes at most) */
1040   while (maxnewlines-- != 0 &&
1041          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1042     {
1043       (*word)[--*word_length] = '\0';
1044
1045       /* If the last word was entirely newlines, turn it into a new word
1046        * which can be ignored if there's nothing following it. */
1047       if (*word_length == 0)
1048         {
1049           free (*word);
1050           *word = w_newword (word_length, max_length);
1051           break;
1052         }
1053     }
1054
1055   __close (fildes[0]);
1056
1057   /* Check for syntax error (re-execute but with "-n" flag) */
1058   if (buflen < 1 && status != 0)
1059     {
1060       if ((pid = __fork ()) < 0)
1061         {
1062           /* Bad */
1063           return WRDE_NOSPACE;
1064         }
1065
1066       if (pid == 0)
1067         {
1068           fildes[0] = fildes[1] = -1;
1069           exec_comm_child (comm, fildes, 0, 1);
1070         }
1071
1072       if (__waitpid (pid, &status, 0) == pid && status != 0)
1073         return WRDE_SYNTAX;
1074     }
1075
1076   return 0;
1077
1078 no_space:
1079   __kill (pid, SIGKILL);
1080   __waitpid (pid, NULL, 0);
1081   __close (fildes[0]);
1082   return WRDE_NOSPACE;
1083 }
1084
1085 static int
1086 internal_function
1087 parse_comm (char **word, size_t *word_length, size_t *max_length,
1088             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1089             const char *ifs, const char *ifs_white)
1090 {
1091   /* We are poised just after "$(" */
1092   int paren_depth = 1;
1093   int error = 0;
1094   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1095   size_t comm_length;
1096   size_t comm_maxlen;
1097   char *comm = w_newword (&comm_length, &comm_maxlen);
1098
1099   for (; words[*offset]; ++(*offset))
1100     {
1101       switch (words[*offset])
1102         {
1103         case '\'':
1104           if (quoted == 0)
1105             quoted = 1;
1106           else if (quoted == 1)
1107             quoted = 0;
1108
1109           break;
1110
1111         case '"':
1112           if (quoted == 0)
1113             quoted = 2;
1114           else if (quoted == 2)
1115             quoted = 0;
1116
1117           break;
1118
1119         case ')':
1120           if (!quoted && --paren_depth == 0)
1121             {
1122               /* Go -- give script to the shell */
1123               if (comm)
1124                 {
1125 #ifdef __libc_ptf_call
1126                   /* We do not want the exec_comm call to be cut short
1127                      by a thread cancellation since cleanup is very
1128                      ugly.  Therefore disable cancellation for
1129                      now.  */
1130                   // XXX Ideally we do want the thread being cancelable.
1131                   // XXX If demand is there we'll change it.
1132                   int state = PTHREAD_CANCEL_ENABLE;
1133                   __libc_ptf_call (pthread_setcancelstate,
1134                                    (PTHREAD_CANCEL_DISABLE, &state), 0);
1135 #endif
1136
1137                   error = exec_comm (comm, word, word_length, max_length,
1138                                      flags, pwordexp, ifs, ifs_white);
1139
1140 #ifdef __libc_ptf_call
1141                   __libc_ptf_call (pthread_setcancelstate, (state, NULL), 0);
1142 #endif
1143
1144                   free (comm);
1145                 }
1146
1147               return error;
1148             }
1149
1150           /* This is just part of the script */
1151           break;
1152
1153         case '(':
1154           if (!quoted)
1155             ++paren_depth;
1156         }
1157
1158       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1159       if (comm == NULL)
1160         return WRDE_NOSPACE;
1161     }
1162
1163   /* Premature end */
1164   if (comm)
1165     free (comm);
1166
1167   return WRDE_SYNTAX;
1168 }
1169
1170 static int
1171 internal_function
1172 parse_param (char **word, size_t *word_length, size_t *max_length,
1173              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1174              const char *ifs, const char *ifs_white, int quoted)
1175 {
1176   /* We are poised just after "$" */
1177   enum action
1178   {
1179     ACT_NONE,
1180     ACT_RP_SHORT_LEFT = '#',
1181     ACT_RP_LONG_LEFT = 'L',
1182     ACT_RP_SHORT_RIGHT = '%',
1183     ACT_RP_LONG_RIGHT = 'R',
1184     ACT_NULL_ERROR = '?',
1185     ACT_NULL_SUBST = '-',
1186     ACT_NONNULL_SUBST = '+',
1187     ACT_NULL_ASSIGN = '='
1188   };
1189   size_t env_length;
1190   size_t env_maxlen;
1191   size_t pat_length;
1192   size_t pat_maxlen;
1193   size_t start = *offset;
1194   char *env;
1195   char *pattern;
1196   char *value = NULL;
1197   enum action action = ACT_NONE;
1198   int depth = 0;
1199   int colon_seen = 0;
1200   int seen_hash = 0;
1201   int free_value = 0;
1202   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1203   int error;
1204   int special = 0;
1205   char buffer[21];
1206   int brace = words[*offset] == '{';
1207
1208   env = w_newword (&env_length, &env_maxlen);
1209   pattern = w_newword (&pat_length, &pat_maxlen);
1210
1211   if (brace)
1212     ++*offset;
1213
1214   /* First collect the parameter name. */
1215
1216   if (words[*offset] == '#')
1217     {
1218       seen_hash = 1;
1219       if (!brace)
1220         goto envsubst;
1221       ++*offset;
1222     }
1223
1224   if (isalpha (words[*offset]) || words[*offset] == '_')
1225     {
1226       /* Normal parameter name. */
1227       do
1228         {
1229           env = w_addchar (env, &env_length, &env_maxlen,
1230                            words[*offset]);
1231           if (env == NULL)
1232             goto no_space;
1233         }
1234       while (isalnum (words[++*offset]) || words[*offset] == '_');
1235     }
1236   else if (isdigit (words[*offset]))
1237     {
1238       /* Numeric parameter name. */
1239       special = 1;
1240       do
1241         {
1242           env = w_addchar (env, &env_length, &env_maxlen,
1243                            words[*offset]);
1244           if (env == NULL)
1245             goto no_space;
1246           if (!brace)
1247             goto envsubst;
1248         }
1249       while (isdigit(words[++*offset]));
1250     }
1251   else if (strchr ("*@$", words[*offset]) != NULL)
1252     {
1253       /* Special parameter. */
1254       special = 1;
1255       env = w_addchar (env, &env_length, &env_maxlen,
1256                        words[*offset]);
1257       if (env == NULL)
1258         goto no_space;
1259       ++*offset;
1260     }
1261   else
1262     {
1263       if (brace)
1264         goto syntax;
1265     }
1266
1267   if (brace)
1268     {
1269       /* Check for special action to be applied to the value. */
1270       switch (words[*offset])
1271         {
1272         case '}':
1273           /* Evaluate. */
1274           goto envsubst;
1275
1276         case '#':
1277           action = ACT_RP_SHORT_LEFT;
1278           if (words[1 + *offset] == '#')
1279             {
1280               ++*offset;
1281               action = ACT_RP_LONG_LEFT;
1282             }
1283           break;
1284
1285         case '%':
1286           action = ACT_RP_SHORT_RIGHT;
1287           if (words[1 + *offset] == '%')
1288             {
1289               ++*offset;
1290               action = ACT_RP_LONG_RIGHT;
1291             }
1292           break;
1293
1294         case ':':
1295           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1296             goto syntax;
1297
1298           colon_seen = 1;
1299           action = words[++*offset];
1300           break;
1301
1302         case '-':
1303         case '=':
1304         case '?':
1305         case '+':
1306           action = words[*offset];
1307           break;
1308
1309         default:
1310           goto syntax;
1311         }
1312
1313       /* Now collect the pattern, but don't expand it yet. */
1314       ++*offset;
1315       for (; words[*offset]; ++(*offset))
1316         {
1317           switch (words[*offset])
1318             {
1319             case '{':
1320               if (!pattern_is_quoted)
1321                 ++depth;
1322               break;
1323
1324             case '}':
1325               if (!pattern_is_quoted)
1326                 {
1327                   if (depth == 0)
1328                     goto envsubst;
1329                   --depth;
1330                 }
1331               break;
1332
1333             case '\\':
1334               if (pattern_is_quoted)
1335                 /* Quoted; treat as normal character. */
1336                 break;
1337
1338               /* Otherwise, it's an escape: next character is literal. */
1339               if (words[++*offset] == '\0')
1340                 goto syntax;
1341
1342               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1343               if (pattern == NULL)
1344                 goto no_space;
1345
1346               break;
1347
1348             case '\'':
1349               if (pattern_is_quoted == 0)
1350                 pattern_is_quoted = 1;
1351               else if (pattern_is_quoted == 1)
1352                 pattern_is_quoted = 0;
1353
1354               break;
1355
1356             case '"':
1357               if (pattern_is_quoted == 0)
1358                 pattern_is_quoted = 2;
1359               else if (pattern_is_quoted == 2)
1360                 pattern_is_quoted = 0;
1361
1362               break;
1363             }
1364
1365           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1366                                words[*offset]);
1367           if (pattern == NULL)
1368             goto no_space;
1369         }
1370     }
1371
1372   /* End of input string -- remember to reparse the character that we
1373    * stopped at.  */
1374   --(*offset);
1375
1376 envsubst:
1377   if (words[start] == '{' && words[*offset] != '}')
1378     goto syntax;
1379
1380   if (env == NULL)
1381     {
1382       if (seen_hash)
1383         {
1384           /* $# expands to the number of positional parameters */
1385           buffer[20] = '\0';
1386           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1387           seen_hash = 0;
1388         }
1389       else
1390         {
1391           /* Just $ on its own */
1392           *offset = start - 1;
1393           *word = w_addchar (*word, word_length, max_length, '$');
1394           return *word ? 0 : WRDE_NOSPACE;
1395         }
1396     }
1397   /* Is it a numeric parameter? */
1398   else if (isdigit (env[0]))
1399     {
1400       int n = atoi (env);
1401
1402       if (n >= __libc_argc)
1403         /* Substitute NULL. */
1404         value = NULL;
1405       else
1406         /* Replace with appropriate positional parameter. */
1407         value = __libc_argv[n];
1408     }
1409   /* Is it a special parameter? */
1410   else if (special)
1411     {
1412       /* Is it `$$'? */
1413       if (*env == '$')
1414         {
1415           buffer[20] = '\0';
1416           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1417         }
1418       /* Is it `${#*}' or `${#@}'? */
1419       else if ((*env == '*' || *env == '@') && seen_hash)
1420         {
1421           buffer[20] = '\0';
1422           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1423                               &buffer[20], 10, 0);
1424           *word = w_addstr (*word, word_length, max_length, value);
1425           free (env);
1426           if (pattern)
1427             free (pattern);
1428           return *word ? 0 : WRDE_NOSPACE;
1429         }
1430       /* Is it `$*' or `$@' (unquoted) ? */
1431       else if (*env == '*' || (*env == '@' && !quoted))
1432         {
1433           size_t plist_len = 0;
1434           int p;
1435           char *end;
1436
1437           /* Build up value parameter by parameter (copy them) */
1438           for (p = 1; __libc_argv[p]; ++p)
1439             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1440           value = malloc (plist_len);
1441           if (value == NULL)
1442             goto no_space;
1443           end = value;
1444           *end = 0;
1445           for (p = 1; __libc_argv[p]; ++p)
1446             {
1447               if (p > 1)
1448                 *end++ = ' ';
1449               end = __stpcpy (end, __libc_argv[p]);
1450             }
1451
1452           free_value = 1;
1453         }
1454       else
1455         {
1456           /* Must be a quoted `$@' */
1457           assert (*env == '@' && quoted);
1458
1459           /* Each parameter is a separate word ("$@") */
1460           if (__libc_argc == 2)
1461             value = __libc_argv[1];
1462           else if (__libc_argc > 2)
1463             {
1464               int p;
1465
1466               /* Append first parameter to current word. */
1467               value = w_addstr (*word, word_length, max_length,
1468                                 __libc_argv[1]);
1469               if (value == NULL || w_addword (pwordexp, value))
1470                 goto no_space;
1471
1472               for (p = 2; __libc_argv[p + 1]; p++)
1473                 {
1474                   char *newword = __strdup (__libc_argv[p]);
1475                   if (newword == NULL || w_addword (pwordexp, newword))
1476                     goto no_space;
1477                 }
1478
1479               /* Start a new word with the last parameter. */
1480               *word = w_newword (word_length, max_length);
1481               value = __libc_argv[p];
1482             }
1483           else
1484             {
1485               free (env);
1486               free (pattern);
1487               return 0;
1488             }
1489         }
1490     }
1491   else
1492     value = getenv (env);
1493
1494   if (value == NULL && (flags & WRDE_UNDEF))
1495     {
1496       /* Variable not defined. */
1497       error = WRDE_BADVAL;
1498       goto do_error;
1499     }
1500
1501   if (action != ACT_NONE)
1502     {
1503       int expand_pattern = 0;
1504
1505       /* First, find out if we need to expand pattern (i.e. if we will
1506        * use it). */
1507       switch (action)
1508         {
1509         case ACT_RP_SHORT_LEFT:
1510         case ACT_RP_LONG_LEFT:
1511         case ACT_RP_SHORT_RIGHT:
1512         case ACT_RP_LONG_RIGHT:
1513           /* Always expand for these. */
1514           expand_pattern = 1;
1515           break;
1516
1517         case ACT_NULL_ERROR:
1518         case ACT_NULL_SUBST:
1519         case ACT_NULL_ASSIGN:
1520           if (!value || (!*value && colon_seen))
1521             /* If param is unset, or set but null and a colon has been seen,
1522                the expansion of the pattern will be needed. */
1523             expand_pattern = 1;
1524
1525           break;
1526
1527         case ACT_NONNULL_SUBST:
1528           /* Expansion of word will be needed if parameter is set and not null,
1529              or set null but no colon has been seen. */
1530           if (value && (*value || !colon_seen))
1531             expand_pattern = 1;
1532
1533           break;
1534
1535         default:
1536           assert (! "Unrecognised action!");
1537         }
1538
1539       if (expand_pattern)
1540         {
1541           /* We need to perform tilde expansion, parameter expansion,
1542              command substitution, and arithmetic expansion.  We also
1543              have to be a bit careful with wildcard characters, as
1544              pattern might be given to fnmatch soon.  To do this, we
1545              convert quotes to escapes. */
1546
1547           char *expanded;
1548           size_t exp_len;
1549           size_t exp_maxl;
1550           char *p;
1551           int quoted = 0; /* 1: single quotes; 2: double */
1552
1553           expanded = w_newword (&exp_len, &exp_maxl);
1554           for (p = pattern; p && *p; p++)
1555             {
1556               size_t offset;
1557
1558               switch (*p)
1559                 {
1560                 case '"':
1561                   if (quoted == 2)
1562                     quoted = 0;
1563                   else if (quoted == 0)
1564                     quoted = 2;
1565                   else break;
1566
1567                   continue;
1568
1569                 case '\'':
1570                   if (quoted == 1)
1571                     quoted = 0;
1572                   else if (quoted == 0)
1573                     quoted = 1;
1574                   else break;
1575
1576                   continue;
1577
1578                 case '*':
1579                 case '?':
1580                   if (quoted)
1581                     {
1582                       /* Convert quoted wildchar to escaped wildchar. */
1583                       expanded = w_addchar (expanded, &exp_len,
1584                                             &exp_maxl, '\\');
1585
1586                       if (expanded == NULL)
1587                         goto no_space;
1588                     }
1589                   break;
1590
1591                 case '$':
1592                   offset = 0;
1593                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1594                                          &offset, flags, NULL, NULL, NULL, 1);
1595                   if (error)
1596                     {
1597                       if (free_value)
1598                         free (value);
1599
1600                       if (expanded)
1601                         free (expanded);
1602
1603                       goto do_error;
1604                     }
1605
1606                   p += offset;
1607                   continue;
1608
1609                 case '~':
1610                   if (quoted || exp_len)
1611                     break;
1612
1613                   offset = 0;
1614                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1615                                        &offset, 0);
1616                   if (error)
1617                     {
1618                       if (free_value)
1619                         free (value);
1620
1621                       if (expanded)
1622                         free (expanded);
1623
1624                       goto do_error;
1625                     }
1626
1627                   p += offset;
1628                   continue;
1629
1630                 case '\\':
1631                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1632                   ++p;
1633                   assert (*p); /* checked when extracted initially */
1634                   if (expanded == NULL)
1635                     goto no_space;
1636                 }
1637
1638               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1639
1640               if (expanded == NULL)
1641                 goto no_space;
1642             }
1643
1644           if (pattern)
1645                   free (pattern);
1646
1647           pattern = expanded;
1648         }
1649
1650       switch (action)
1651         {
1652         case ACT_RP_SHORT_LEFT:
1653         case ACT_RP_LONG_LEFT:
1654         case ACT_RP_SHORT_RIGHT:
1655         case ACT_RP_LONG_RIGHT:
1656           {
1657             char *p;
1658             char c;
1659             char *end;
1660
1661             if (value == NULL || pattern == NULL || *pattern == '\0')
1662               break;
1663
1664             end = value + strlen (value);
1665
1666             switch (action)
1667               {
1668               case ACT_RP_SHORT_LEFT:
1669                 for (p = value; p <= end; ++p)
1670                   {
1671                     c = *p;
1672                     *p = '\0';
1673                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1674                       {
1675                         *p = c;
1676                         if (free_value)
1677                           {
1678                             char *newval = __strdup (p);
1679                             if (newval == NULL)
1680                               {
1681                                 free (value);
1682                                 goto no_space;
1683                               }
1684                             free (value);
1685                             value = newval;
1686                           }
1687                         else
1688                           value = p;
1689                         break;
1690                       }
1691                     *p = c;
1692                   }
1693
1694                 break;
1695
1696               case ACT_RP_LONG_LEFT:
1697                 for (p = end; p >= value; --p)
1698                   {
1699                     c = *p;
1700                     *p = '\0';
1701                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1702                       {
1703                         *p = c;
1704                         if (free_value)
1705                           {
1706                             char *newval = __strdup (p);
1707                             if (newval == NULL)
1708                               {
1709                                 free (value);
1710                                 goto no_space;
1711                               }
1712                             free (value);
1713                             value = newval;
1714                           }
1715                         else
1716                           value = p;
1717                         break;
1718                       }
1719                     *p = c;
1720                   }
1721
1722                 break;
1723
1724               case ACT_RP_SHORT_RIGHT:
1725                 for (p = end; p >= value; --p)
1726                   {
1727                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1728                       {
1729                         char *newval;
1730                         newval = malloc (p - value + 1);
1731
1732                         if (newval == NULL)
1733                           {
1734                             if (free_value)
1735                               free (value);
1736                             goto no_space;
1737                           }
1738
1739                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1740                         if (free_value)
1741                           free (value);
1742                         value = newval;
1743                         free_value = 1;
1744                         break;
1745                       }
1746                   }
1747
1748                 break;
1749
1750               case ACT_RP_LONG_RIGHT:
1751                 for (p = value; p <= end; ++p)
1752                   {
1753                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1754                       {
1755                         char *newval;
1756                         newval = malloc (p - value + 1);
1757
1758                         if (newval == NULL)
1759                           {
1760                             if (free_value)
1761                               free (value);
1762                             goto no_space;
1763                           }
1764
1765                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1766                         if (free_value)
1767                           free (value);
1768                         value = newval;
1769                         free_value = 1;
1770                         break;
1771                       }
1772                   }
1773
1774                 break;
1775
1776               default:
1777                 break;
1778               }
1779
1780             break;
1781           }
1782
1783         case ACT_NULL_ERROR:
1784           if (value && *value)
1785             /* Substitute parameter */
1786             break;
1787
1788           error = 0;
1789           if (!colon_seen && value)
1790             /* Substitute NULL */
1791             ;
1792           else
1793             {
1794               const char *str = pattern;
1795
1796               if (str[0] == '\0')
1797                 str = _("parameter null or not set");
1798
1799 #ifdef USE_IN_LIBIO
1800               if (_IO_fwide (stderr, 0) > 0)
1801                 __fwprintf (stderr, L"%s: %s\n", env, str);
1802               else
1803 #endif
1804                 fprintf (stderr, "%s: %s\n", env, str);
1805             }
1806
1807           if (free_value)
1808             free (value);
1809           goto do_error;
1810
1811         case ACT_NULL_SUBST:
1812           if (value && *value)
1813             /* Substitute parameter */
1814             break;
1815
1816           if (free_value && value)
1817             free (value);
1818
1819           if (!colon_seen && value)
1820             /* Substitute NULL */
1821             goto success;
1822
1823           value = pattern ? __strdup (pattern) : pattern;
1824           free_value = 1;
1825
1826           if (pattern && !value)
1827             goto no_space;
1828
1829           break;
1830
1831         case ACT_NONNULL_SUBST:
1832           if (value && (*value || !colon_seen))
1833             {
1834               if (free_value && value)
1835                 free (value);
1836
1837               value = pattern ? __strdup (pattern) : pattern;
1838               free_value = 1;
1839
1840               if (pattern && !value)
1841                 goto no_space;
1842
1843               break;
1844             }
1845
1846           /* Substitute NULL */
1847           if (free_value)
1848             free (value);
1849           goto success;
1850
1851         case ACT_NULL_ASSIGN:
1852           if (value && *value)
1853             /* Substitute parameter */
1854             break;
1855
1856           if (!colon_seen && value)
1857             {
1858               /* Substitute NULL */
1859               if (free_value)
1860                 free (value);
1861               goto success;
1862             }
1863
1864           if (free_value && value)
1865             free (value);
1866
1867           value = pattern ? __strdup (pattern) : pattern;
1868           free_value = 1;
1869
1870           if (pattern && !value)
1871             goto no_space;
1872
1873           __setenv (env, value, 1);
1874           break;
1875
1876         default:
1877           assert (! "Unrecognised action!");
1878         }
1879     }
1880
1881   free (env); env = NULL;
1882   free (pattern); pattern = NULL;
1883
1884   if (seen_hash)
1885     {
1886       char param_length[21];
1887       param_length[20] = '\0';
1888       *word = w_addstr (*word, word_length, max_length,
1889                         _itoa_word (value ? strlen (value) : 0,
1890                                     &param_length[20], 10, 0));
1891       if (free_value)
1892         {
1893           assert (value != NULL);
1894           free (value);
1895         }
1896
1897       return *word ? 0 : WRDE_NOSPACE;
1898     }
1899
1900   if (value == NULL)
1901     return 0;
1902
1903   if (quoted || !pwordexp)
1904     {
1905       /* Quoted - no field split */
1906       *word = w_addstr (*word, word_length, max_length, value);
1907       if (free_value)
1908         free (value);
1909
1910       return *word ? 0 : WRDE_NOSPACE;
1911     }
1912   else
1913     {
1914       /* Need to field-split */
1915       char *value_copy = __strdup (value); /* Don't modify value */
1916       char *field_begin = value_copy;
1917       int seen_nonws_ifs = 0;
1918
1919       if (free_value)
1920         free (value);
1921
1922       if (value_copy == NULL)
1923         goto no_space;
1924
1925       do
1926         {
1927           char *field_end = field_begin;
1928           char *next_field;
1929
1930           /* If this isn't the first field, start a new word */
1931           if (field_begin != value_copy)
1932             {
1933               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1934                 {
1935                   free (value_copy);
1936                   goto no_space;
1937                 }
1938
1939               *word = w_newword (word_length, max_length);
1940             }
1941
1942           /* Skip IFS whitespace before the field */
1943           field_begin += strspn (field_begin, ifs_white);
1944
1945           if (!seen_nonws_ifs && *field_begin == 0)
1946             /* Nothing but whitespace */
1947             break;
1948
1949           /* Search for the end of the field */
1950           field_end = field_begin + strcspn (field_begin, ifs);
1951
1952           /* Set up pointer to the character after end of field and
1953              skip whitespace IFS after it. */
1954           next_field = field_end + strspn (field_end, ifs_white);
1955
1956           /* Skip at most one non-whitespace IFS character after the field */
1957           seen_nonws_ifs = 0;
1958           if (*next_field && strchr (ifs, *next_field))
1959             {
1960               seen_nonws_ifs = 1;
1961               next_field++;
1962             }
1963
1964           /* Null-terminate it */
1965           *field_end = 0;
1966
1967           /* Tag a copy onto the current word */
1968           *word = w_addstr (*word, word_length, max_length, field_begin);
1969
1970           if (*word == NULL && *field_begin != '\0')
1971             {
1972               free (value_copy);
1973               goto no_space;
1974             }
1975
1976           field_begin = next_field;
1977         }
1978       while (seen_nonws_ifs || *field_begin);
1979
1980       free (value_copy);
1981     }
1982
1983   return 0;
1984
1985 success:
1986   error = 0;
1987   goto do_error;
1988
1989 no_space:
1990   error = WRDE_NOSPACE;
1991   goto do_error;
1992
1993 syntax:
1994   error = WRDE_SYNTAX;
1995
1996 do_error:
1997   if (env)
1998     free (env);
1999
2000   if (pattern)
2001     free (pattern);
2002
2003   return error;
2004 }
2005
2006 static int
2007 internal_function
2008 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2009                const char *words, size_t *offset, int flags,
2010                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2011                int quoted)
2012 {
2013   /* We are poised _at_ "$" */
2014   switch (words[1 + *offset])
2015     {
2016     case '"':
2017     case '\'':
2018     case 0:
2019       *word = w_addchar (*word, word_length, max_length, '$');
2020       return *word ? 0 : WRDE_NOSPACE;
2021
2022     case '(':
2023       if (words[2 + *offset] == '(')
2024         {
2025           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2026           int i = 3 + *offset;
2027           int depth = 0;
2028           while (words[i] && !(depth == 0 && words[i] == ')'))
2029             {
2030               if (words[i] == '(')
2031                 ++depth;
2032               else if (words[i] == ')')
2033                 --depth;
2034
2035               ++i;
2036             }
2037
2038           if (words[i] == ')' && words[i + 1] == ')')
2039             {
2040               (*offset) += 3;
2041               /* Call parse_arith -- 0 is for "no brackets" */
2042               return parse_arith (word, word_length, max_length, words, offset,
2043                                   flags, 0);
2044             }
2045         }
2046
2047       if (flags & WRDE_NOCMD)
2048         return WRDE_CMDSUB;
2049
2050       (*offset) += 2;
2051       return parse_comm (word, word_length, max_length, words, offset, flags,
2052                          quoted? NULL : pwordexp, ifs, ifs_white);
2053
2054     case '[':
2055       (*offset) += 2;
2056       /* Call parse_arith -- 1 is for "brackets" */
2057       return parse_arith (word, word_length, max_length, words, offset, flags,
2058                           1);
2059
2060     case '{':
2061     default:
2062       ++(*offset);      /* parse_param needs to know if "{" is there */
2063       return parse_param (word, word_length, max_length, words, offset, flags,
2064                            pwordexp, ifs, ifs_white, quoted);
2065     }
2066 }
2067
2068 static int
2069 internal_function
2070 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2071                 const char *words, size_t *offset, int flags,
2072                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2073 {
2074   /* We are poised just after "`" */
2075   int error;
2076   int squoting = 0;
2077   size_t comm_length;
2078   size_t comm_maxlen;
2079   char *comm = w_newword (&comm_length, &comm_maxlen);
2080
2081   for (; words[*offset]; ++(*offset))
2082     {
2083       switch (words[*offset])
2084         {
2085         case '`':
2086           /* Go -- give the script to the shell */
2087           error = exec_comm (comm, word, word_length, max_length, flags,
2088                              pwordexp, ifs, ifs_white);
2089           free (comm);
2090           return error;
2091
2092         case '\\':
2093           if (squoting)
2094             {
2095               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2096                                            words, offset);
2097
2098               if (error)
2099                 {
2100                   free (comm);
2101                   return error;
2102                 }
2103
2104               break;
2105             }
2106
2107           ++(*offset);
2108           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2109                                    offset);
2110
2111           if (error)
2112             {
2113               free (comm);
2114               return error;
2115             }
2116
2117           break;
2118
2119         case '\'':
2120           squoting = 1 - squoting;
2121         default:
2122           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2123           if (comm == NULL)
2124             return WRDE_NOSPACE;
2125         }
2126     }
2127
2128   /* Premature end */
2129   free (comm);
2130   return WRDE_SYNTAX;
2131 }
2132
2133 static int
2134 internal_function
2135 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2136               const char *words, size_t *offset, int flags,
2137               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2138 {
2139   /* We are poised just after a double-quote */
2140   int error;
2141
2142   for (; words[*offset]; ++(*offset))
2143     {
2144       switch (words[*offset])
2145         {
2146         case '"':
2147           return 0;
2148
2149         case '$':
2150           error = parse_dollars (word, word_length, max_length, words, offset,
2151                                  flags, pwordexp, ifs, ifs_white, 1);
2152           /* The ``1'' here is to tell parse_dollars not to
2153            * split the fields.  It may need to, however ("$@").
2154            */
2155           if (error)
2156             return error;
2157
2158           break;
2159
2160         case '`':
2161           if (flags & WRDE_NOCMD)
2162             return WRDE_CMDSUB;
2163
2164           ++(*offset);
2165           error = parse_backtick (word, word_length, max_length, words,
2166                                   offset, flags, NULL, NULL, NULL);
2167           /* The first NULL here is to tell parse_backtick not to
2168            * split the fields.
2169            */
2170           if (error)
2171             return error;
2172
2173           break;
2174
2175         case '\\':
2176           error = parse_qtd_backslash (word, word_length, max_length, words,
2177                                        offset);
2178
2179           if (error)
2180             return error;
2181
2182           break;
2183
2184         default:
2185           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2186           if (*word == NULL)
2187             return WRDE_NOSPACE;
2188         }
2189     }
2190
2191   /* Unterminated string */
2192   return WRDE_SYNTAX;
2193 }
2194
2195 /*
2196  * wordfree() is to be called after pwordexp is finished with.
2197  */
2198
2199 void
2200 wordfree (wordexp_t *pwordexp)
2201 {
2202
2203   /* wordexp can set pwordexp to NULL */
2204   if (pwordexp && pwordexp->we_wordv)
2205     {
2206       char **wordv = pwordexp->we_wordv;
2207
2208       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2209         free (*wordv);
2210
2211       free (pwordexp->we_wordv);
2212       pwordexp->we_wordv = NULL;
2213     }
2214 }
2215 libc_hidden_def (wordfree)
2216
2217 /*
2218  * wordexp()
2219  */
2220
2221 int
2222 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2223 {
2224   size_t words_offset;
2225   size_t word_length;
2226   size_t max_length;
2227   char *word = w_newword (&word_length, &max_length);
2228   int error;
2229   char *ifs;
2230   char ifs_white[4];
2231   wordexp_t old_word = *pwordexp;
2232
2233   if (flags & WRDE_REUSE)
2234     {
2235       /* Minimal implementation of WRDE_REUSE for now */
2236       wordfree (pwordexp);
2237       old_word.we_wordv = NULL;
2238     }
2239
2240   if ((flags & WRDE_APPEND) == 0)
2241     {
2242       pwordexp->we_wordc = 0;
2243
2244       if (flags & WRDE_DOOFFS)
2245         {
2246           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2247           if (pwordexp->we_wordv == NULL)
2248             {
2249               error = WRDE_NOSPACE;
2250               goto do_error;
2251             }
2252         }
2253       else
2254         {
2255           pwordexp->we_wordv = calloc (1, sizeof (char *));
2256           if (pwordexp->we_wordv == NULL)
2257             {
2258               error = WRDE_NOSPACE;
2259               goto do_error;
2260             }
2261
2262           pwordexp->we_offs = 0;
2263         }
2264     }
2265
2266   /* Find out what the field separators are.
2267    * There are two types: whitespace and non-whitespace.
2268    */
2269   ifs = getenv ("IFS");
2270
2271   if (!ifs)
2272     /* IFS unset - use <space><tab><newline>. */
2273     ifs = strcpy (ifs_white, " \t\n");
2274   else
2275     {
2276       char *ifsch = ifs;
2277       char *whch = ifs_white;
2278
2279       /* Start off with no whitespace IFS characters */
2280       ifs_white[0] = '\0';
2281
2282       while (*ifsch != '\0')
2283         {
2284           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2285             {
2286               /* Whitespace IFS.  See first whether it is already in our
2287                  collection.  */
2288               char *runp = ifs_white;
2289
2290               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2291                 ++runp;
2292
2293               if (runp == whch)
2294                 *whch++ = *ifsch;
2295             }
2296
2297           ++ifsch;
2298         }
2299       *whch = '\0';
2300     }
2301
2302   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2303     switch (words[words_offset])
2304       {
2305       case '\\':
2306         error = parse_backslash (&word, &word_length, &max_length, words,
2307                                  &words_offset);
2308
2309         if (error)
2310           goto do_error;
2311
2312         break;
2313
2314       case '$':
2315         error = parse_dollars (&word, &word_length, &max_length, words,
2316                                &words_offset, flags, pwordexp, ifs, ifs_white,
2317                                0);
2318
2319         if (error)
2320           goto do_error;
2321
2322         break;
2323
2324       case '`':
2325         if (flags & WRDE_NOCMD)
2326           {
2327             error = WRDE_CMDSUB;
2328             goto do_error;
2329           }
2330
2331         ++words_offset;
2332         error = parse_backtick (&word, &word_length, &max_length, words,
2333                                 &words_offset, flags, pwordexp, ifs,
2334                                 ifs_white);
2335
2336         if (error)
2337           goto do_error;
2338
2339         break;
2340
2341       case '"':
2342         ++words_offset;
2343         error = parse_dquote (&word, &word_length, &max_length, words,
2344                               &words_offset, flags, pwordexp, ifs, ifs_white);
2345
2346         if (error)
2347           goto do_error;
2348
2349         if (!word_length)
2350           {
2351             error = w_addword (pwordexp, NULL);
2352
2353             if (error)
2354               return error;
2355           }
2356
2357         break;
2358
2359       case '\'':
2360         ++words_offset;
2361         error = parse_squote (&word, &word_length, &max_length, words,
2362                               &words_offset);
2363
2364         if (error)
2365           goto do_error;
2366
2367         if (!word_length)
2368           {
2369             error = w_addword (pwordexp, NULL);
2370
2371             if (error)
2372               return error;
2373           }
2374
2375         break;
2376
2377       case '~':
2378         error = parse_tilde (&word, &word_length, &max_length, words,
2379                              &words_offset, pwordexp->we_wordc);
2380
2381         if (error)
2382           goto do_error;
2383
2384         break;
2385
2386       case '*':
2387       case '[':
2388       case '?':
2389         error = parse_glob (&word, &word_length, &max_length, words,
2390                             &words_offset, flags, pwordexp, ifs, ifs_white);
2391
2392         if (error)
2393           goto do_error;
2394
2395         break;
2396
2397       default:
2398         /* Is it a word separator? */
2399         if (strchr (" \t", words[words_offset]) == NULL)
2400           {
2401             char ch = words[words_offset];
2402
2403             /* Not a word separator -- but is it a valid word char? */
2404             if (strchr ("\n|&;<>(){}", ch))
2405               {
2406                 /* Fail */
2407                 error = WRDE_BADCHAR;
2408                 goto do_error;
2409               }
2410
2411             /* "Ordinary" character -- add it to word */
2412             word = w_addchar (word, &word_length, &max_length,
2413                               ch);
2414             if (word == NULL)
2415               {
2416                 error = WRDE_NOSPACE;
2417                 goto do_error;
2418               }
2419
2420             break;
2421           }
2422
2423         /* If a word has been delimited, add it to the list. */
2424         if (word != NULL)
2425           {
2426             error = w_addword (pwordexp, word);
2427             if (error)
2428               goto do_error;
2429           }
2430
2431         word = w_newword (&word_length, &max_length);
2432       }
2433
2434   /* End of string */
2435
2436   /* There was a word separator at the end */
2437   if (word == NULL) /* i.e. w_newword */
2438     return 0;
2439
2440   /* There was no field separator at the end */
2441   return w_addword (pwordexp, word);
2442
2443 do_error:
2444   /* Error:
2445    *    free memory used (unless error is WRDE_NOSPACE), and
2446    *    set pwordexp members back to what they were.
2447    */
2448
2449   if (word != NULL)
2450     free (word);
2451
2452   if (error == WRDE_NOSPACE)
2453     return WRDE_NOSPACE;
2454
2455   if ((flags & WRDE_APPEND) == 0)
2456     wordfree (pwordexp);
2457
2458   *pwordexp = old_word;
2459   return error;
2460 }