posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997, 1998 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Library General Public License as
   8    published by the Free Software Foundation; either version 2 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Library General Public License for more details.
  15
  16    You should have received a copy of the GNU Library General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 #include <wordexp.h>
  22 #include <signal.h>
  23 #include <stdlib.h>
  24 #include <pwd.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <glob.h>
  28 #include <ctype.h>
  29 #include <sys/time.h>
  30 #include <sys/types.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <fcntl.h>
  34 #include <sys/stat.h>
  35 #include <paths.h>
  36 #include <errno.h>
  37 #include <sys/param.h>
  38 #include <stdio.h>
  39 #include <fnmatch.h>
  40
  41 #include <stdio-common/_itoa.h>
  42
  43 /* Undefine the following line for the production version.  */
  44 /* #define NDEBUG 1 */
  45 #include <assert.h>
  46
  47 /*
  48  * This is a recursive-descent-style word expansion routine.
  49  */
  50
  51 /* These variables are defined and initialized in the startup code.  */
  52 extern int __libc_argc;
  53 extern char **__libc_argv;
  54
  55 /* Some forward declarations */
  56 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  57                           const char *words, size_t *offset, int flags,
  58                           wordexp_t *pwordexp, const char *ifs,
  59                           const char *ifs_white, int quoted)
  60      internal_function;
  61 static int parse_backtick (char **word, size_t *word_length,
  62                            size_t *max_length, const char *words,
  63                            size_t *offset, int flags, wordexp_t *pwordexp,
  64                            const char *ifs, const char *ifs_white)
  65      internal_function;
  66 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  67                          const char *words, size_t *offset, int flags,
  68                          wordexp_t *pwordexp, const char *ifs,
  69                          const char *ifs_white)
  70      internal_function;
  71 static int eval_expr (char *expr, long int *result) internal_function;
  72
  73 /* The w_*() functions manipulate word lists. */
  74
  75 #define W_CHUNK (100)
  76
  77 static inline char *
  78 w_newword (size_t *actlen, size_t *maxlen)
  79 {
  80   *actlen = *maxlen = 0;
  81   return NULL;
  82 }
  83
  84 static inline char *
  85 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  86      /* (lengths exclude trailing zero) */
  87 {
  88   /* Add a character to the buffer, allocating room for it if needed.
  89    */
  90
  91   if (*actlen == *maxlen)
  92     {
  93       char *old_buffer = buffer;
  94       assert (buffer == NULL || *maxlen != 0);
  95       *maxlen += W_CHUNK;
  96       buffer = realloc (buffer, 1 + *maxlen);
  97
  98       if (buffer == NULL)
  99         free (old_buffer);
 100     }
 101
 102   if (buffer != NULL)
 103     {
 104       buffer[*actlen] = ch;
 105       buffer[++(*actlen)] = '\0';
 106     }
 107
 108   return buffer;
 109 }
 110
 111 static char *
 112 internal_function
 113 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 114           size_t len)
 115 {
 116   /* Add a string to the buffer, allocating room for it if needed.
 117    */
 118   if (*actlen + len > *maxlen)
 119     {
 120       char *old_buffer = buffer;
 121       assert (buffer == NULL || *maxlen != 0);
 122       *maxlen += MAX (2 * len, W_CHUNK);
 123       buffer = realloc (old_buffer, 1 + *maxlen);
 124
 125       if (buffer == NULL)
 126         free (old_buffer);
 127     }
 128
 129   if (buffer != NULL)
 130     {
 131       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 132       *actlen += len;
 133     }
 134
 135   return buffer;
 136 }
 137
 138
 139 static char *
 140 internal_function
 141 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 142      /* (lengths exclude trailing zero) */
 143 {
 144   /* Add a string to the buffer, allocating room for it if needed.
 145    */
 146   size_t len;
 147
 148   assert (str != NULL); /* w_addstr only called from this file */
 149   len = strlen (str);
 150
 151   return w_addmem (buffer, actlen, maxlen, str, len);
 152 }
 153
 154 static int
 155 internal_function
 156 w_addword (wordexp_t *pwordexp, char *word)
 157 {
 158   /* Add a word to the wordlist */
 159   size_t num_p;
 160   char **new_wordv;
 161
 162   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 163   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 164   if (new_wordv != NULL)
 165     {
 166       pwordexp->we_wordv = new_wordv;
 167       pwordexp->we_wordv[pwordexp->we_wordc++] = word;
 168       pwordexp->we_wordv[pwordexp->we_wordc] = NULL;
 169       return 0;
 170     }
 171
 172   return WRDE_NOSPACE;
 173 }
 174
 175 /* The parse_*() functions should leave *offset being the offset in 'words'
 176  * to the last character processed.
 177  */
 178
 179 static int
 180 internal_function
 181 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 182                  const char *words, size_t *offset)
 183 {
 184   /* We are poised _at_ a backslash, not in quotes */
 185
 186   switch (words[1 + *offset])
 187     {
 188     case 0:
 189       /* Backslash is last character of input words */
 190       return WRDE_SYNTAX;
 191
 192     case '\n':
 193       ++(*offset);
 194       break;
 195
 196     default:
 197       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 198       if (*word == NULL)
 199         return WRDE_NOSPACE;
 200
 201       ++(*offset);
 202       break;
 203     }
 204
 205   return 0;
 206 }
 207
 208 static int
 209 internal_function
 210 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 211                      const char *words, size_t *offset)
 212 {
 213   /* We are poised _at_ a backslash, inside quotes */
 214
 215   switch (words[1 + *offset])
 216     {
 217     case 0:
 218       /* Backslash is last character of input words */
 219       return WRDE_SYNTAX;
 220
 221     case '\n':
 222       ++(*offset);
 223       break;
 224
 225     case '$':
 226     case '`':
 227     case '"':
 228     case '\\':
 229       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 230       if (*word == NULL)
 231         return WRDE_NOSPACE;
 232
 233       ++(*offset);
 234       break;
 235
 236     default:
 237       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 238       if (*word != NULL)
 239         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 240
 241       if (*word == NULL)
 242         return WRDE_NOSPACE;
 243
 244       ++(*offset);
 245       break;
 246     }
 247
 248   return 0;
 249 }
 250
 251 static int
 252 internal_function
 253 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 254              const char *words, size_t *offset, size_t wordc)
 255 {
 256   /* We are poised _at_ a tilde */
 257   size_t i;
 258
 259   if (*word_length != 0)
 260     {
 261       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 262         {
 263           if (!((*word)[*word_length - 1] == ':'
 264                 && strchr (*word, '=') && wordc == 0))
 265             {
 266               *word = w_addchar (*word, word_length, max_length, '~');
 267               return *word ? 0 : WRDE_NOSPACE;
 268             }
 269         }
 270     }
 271
 272   for (i = 1 + *offset; words[i]; i++)
 273     {
 274       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 275           words[i] == '\t' || words[i] == 0 )
 276         break;
 277
 278       if (words[i] == '\\')
 279         {
 280           *word = w_addchar (*word, word_length, max_length, '~');
 281           return *word ? 0 : WRDE_NOSPACE;
 282         }
 283     }
 284
 285   if (i == 1 + *offset)
 286     {
 287       /* Tilde appears on its own */
 288       uid_t uid;
 289       struct passwd pwd, *tpwd;
 290       int buflen = 1000;
 291       char* buffer = __alloca (buflen);
 292       int result;
 293
 294       uid = __getuid ();
 295
 296       while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 297              && errno == ERANGE)
 298         {
 299           buflen += 1000;
 300           buffer = __alloca (buflen);
 301         }
 302
 303       if (result == 0 && pwd.pw_dir != NULL)
 304         {
 305           *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 306           if (*word == NULL)
 307             return WRDE_NOSPACE;
 308         }
 309       else
 310         {
 311           *word = w_addchar (*word, word_length, max_length, '~');
 312           if (*word == NULL)
 313             return WRDE_NOSPACE;
 314         }
 315     }
 316   else
 317     {
 318       /* Look up user name in database to get home directory */
 319       char *user = __strndup (&words[1 + *offset], i - *offset);
 320       struct passwd pwd, *tpwd;
 321       int buflen = 1000;
 322       char* buffer = __alloca (buflen);
 323       int result;
 324
 325       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 326              && errno == ERANGE)
 327         {
 328           buflen += 1000;
 329           buffer = __alloca (buflen);
 330         }
 331
 332       if (result == 0 && pwd.pw_dir)
 333         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 334       else
 335         {
 336           /* (invalid login name) */
 337           *word = w_addchar (*word, word_length, max_length, '~');
 338           if (*word != NULL)
 339             *word = w_addstr (*word, word_length, max_length, user);
 340         }
 341
 342       *offset = i - 1;
 343     }
 344   return *word ? 0 : WRDE_NOSPACE;
 345 }
 346
 347
 348 static int
 349 internal_function
 350 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 351                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 352                const char *ifs_white)
 353 {
 354   int error;
 355   int match;
 356   glob_t globbuf;
 357
 358   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 359
 360   if (error != 0)
 361     {
 362       /* We can only run into memory problems.  */
 363       assert (error == GLOB_NOSPACE);
 364       return WRDE_NOSPACE;
 365     }
 366
 367   if (ifs && !*ifs)
 368     {
 369       /* No field splitting allowed. */
 370       assert (globbuf.gl_pathv[0] != NULL);
 371       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 372       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 373         {
 374           *word = w_addchar (*word, word_length, max_length, ' ');
 375           if (*word != NULL)
 376             *word = w_addstr (*word, word_length, max_length,
 377                               globbuf.gl_pathv[match]);
 378         }
 379
 380       globfree (&globbuf);
 381       return *word ? 0 : WRDE_NOSPACE;
 382     }
 383
 384   assert (ifs == NULL || *ifs != '\0');
 385   if (*word != NULL)
 386     {
 387       free (*word);
 388       *word = w_newword (word_length, max_length);
 389     }
 390
 391   for (match = 0; match < globbuf.gl_pathc; ++match)
 392     {
 393       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 394       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 395         {
 396           globfree (&globbuf);
 397           return WRDE_NOSPACE;
 398         }
 399     }
 400
 401   globfree (&globbuf);
 402   return 0;
 403 }
 404
 405 static int
 406 internal_function
 407 parse_glob (char **word, size_t *word_length, size_t *max_length,
 408             const char *words, size_t *offset, int flags,
 409             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 410 {
 411   /* We are poised just after a '*', a '[' or a '?'. */
 412   int error = WRDE_NOSPACE;
 413   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 414   int i;
 415   wordexp_t glob_list; /* List of words to glob */
 416
 417   glob_list.we_wordc = 0;
 418   glob_list.we_wordv = NULL;
 419   glob_list.we_offs = 0;
 420   for (; words[*offset] != '\0'; ++*offset)
 421     {
 422       if ((ifs && strchr (ifs, words[*offset])) ||
 423           (!ifs && strchr (" \t\n", words[*offset])))
 424         /* Reached IFS */
 425         break;
 426
 427       /* Sort out quoting */
 428       if (words[*offset] == '\'')
 429           if (quoted == 0)
 430             {
 431               quoted = 1;
 432               continue;
 433             }
 434           else if (quoted == 1)
 435             {
 436               quoted = 0;
 437               continue;
 438             }
 439       else if (words[*offset] == '"')
 440         if (quoted == 0)
 441           {
 442             quoted = 2;
 443             continue;
 444           }
 445         else if (quoted == 2)
 446           {
 447             quoted = 0;
 448             continue;
 449           }
 450
 451       /* Sort out other special characters */
 452       if (quoted != 1 && words[*offset] == '$')
 453         {
 454           error = parse_dollars (word, word_length, max_length, words,
 455                                  offset, flags, &glob_list, ifs, ifs_white,
 456                                  quoted == 2);
 457           if (error)
 458             goto tidy_up;
 459
 460           continue;
 461         }
 462       else if (words[*offset] == '\\')
 463         {
 464           if (quoted)
 465             error = parse_qtd_backslash (word, word_length, max_length,
 466                                          words, offset);
 467           else
 468             error = parse_backslash (word, word_length, max_length,
 469                                      words, offset);
 470
 471           if (error)
 472             goto tidy_up;
 473
 474           continue;
 475         }
 476
 477       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 478       if (*word == NULL)
 479         goto tidy_up;
 480     }
 481
 482   /* Don't forget to re-parse the character we stopped at. */
 483   --*offset;
 484
 485   /* Glob the words */
 486   error = w_addword (&glob_list, *word);
 487   *word = w_newword (word_length, max_length);
 488   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 489     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 490                            max_length, pwordexp, ifs, ifs_white);
 491
 492   /* Now tidy up */
 493 tidy_up:
 494   wordfree (&glob_list);
 495   return error;
 496 }
 497
 498 static int
 499 internal_function
 500 parse_squote (char **word, size_t *word_length, size_t *max_length,
 501               const char *words, size_t *offset)
 502 {
 503   /* We are poised just after a single quote */
 504   for (; words[*offset]; ++(*offset))
 505     {
 506       if (words[*offset] != '\'')
 507         {
 508           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 509           if (*word == NULL)
 510             return WRDE_NOSPACE;
 511         }
 512       else return 0;
 513     }
 514
 515   /* Unterminated string */
 516   return WRDE_SYNTAX;
 517 }
 518
 519 /* Functions to evaluate an arithmetic expression */
 520 static int
 521 internal_function
 522 eval_expr_val (char **expr, long int *result)
 523 {
 524   int sgn = +1;
 525   char *digit;
 526
 527   /* Skip white space */
 528   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 529
 530   switch (*digit)
 531     {
 532     case '(':
 533
 534       /* Scan for closing paren */
 535       for (++digit; **expr && **expr != ')'; ++(*expr));
 536
 537       /* Is there one? */
 538       if (!**expr)
 539         return WRDE_SYNTAX;
 540
 541       *(*expr)++ = 0;
 542
 543       if (eval_expr (digit, result))
 544         return WRDE_SYNTAX;
 545
 546       return 0;
 547
 548     case '+':   /* Positive value */
 549       ++digit;
 550       break;
 551
 552     case '-':   /* Negative value */
 553       ++digit;
 554       sgn = -1;
 555       break;
 556
 557     default:
 558       if (!isdigit (*digit))
 559         return WRDE_SYNTAX;
 560     }
 561
 562   *result = 0;
 563   for (; *digit && isdigit (*digit); ++digit)
 564     *result = (*result * 10) + (*digit - '0');
 565
 566   *expr = digit;
 567   *result *= sgn;
 568   return 0;
 569 }
 570
 571 static int
 572 internal_function
 573 eval_expr_multdiv (char **expr, long int *result)
 574 {
 575   long int arg;
 576
 577   /* Read a Value */
 578   if (eval_expr_val (expr, result) != 0)
 579     return WRDE_SYNTAX;
 580
 581   while (**expr)
 582     {
 583       /* Skip white space */
 584       for (; *expr && **expr && isspace (**expr); ++(*expr));
 585
 586       if (**expr == '*')
 587         {
 588           ++(*expr);
 589           if (eval_expr_val (expr, &arg) != 0)
 590             return WRDE_SYNTAX;
 591
 592           *result *= arg;
 593         }
 594       else if (**expr == '/')
 595         {
 596           ++(*expr);
 597           if (eval_expr_val (expr, &arg) != 0)
 598             return WRDE_SYNTAX;
 599
 600           *result /= arg;
 601         }
 602       else break;
 603     }
 604
 605   return 0;
 606 }
 607
 608 static int
 609 internal_function
 610 eval_expr (char *expr, long int *result)
 611 {
 612   long int arg;
 613
 614   /* Read a Multdiv */
 615   if (eval_expr_multdiv (&expr, result) != 0)
 616     return WRDE_SYNTAX;
 617
 618   while (*expr)
 619     {
 620       /* Skip white space */
 621       for (; expr && *expr && isspace (*expr); ++expr);
 622
 623       if (*expr == '+')
 624         {
 625           ++expr;
 626           if (eval_expr_multdiv (&expr, &arg) != 0)
 627             return WRDE_SYNTAX;
 628
 629           *result += arg;
 630         }
 631       else if (*expr == '-')
 632         {
 633           ++expr;
 634           if (eval_expr_multdiv (&expr, &arg) != 0)
 635             return WRDE_SYNTAX;
 636
 637           *result -= arg;
 638         }
 639       else break;
 640     }
 641
 642   return 0;
 643 }
 644
 645 static int
 646 internal_function
 647 parse_arith (char **word, size_t *word_length, size_t *max_length,
 648              const char *words, size_t *offset, int flags, int bracket)
 649 {
 650   /* We are poised just after "$((" or "$[" */
 651   int error;
 652   int paren_depth = 1;
 653   size_t expr_length;
 654   size_t expr_maxlen;
 655   char *expr;
 656
 657   expr = w_newword (&expr_length, &expr_maxlen);
 658   for (; words[*offset]; ++(*offset))
 659     {
 660       switch (words[*offset])
 661         {
 662         case '$':
 663           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 664                                  words, offset, flags, NULL, NULL, NULL, 1);
 665           /* The ``1'' here is to tell parse_dollars not to
 666            * split the fields.
 667            */
 668           if (error)
 669             {
 670               free (expr);
 671               return error;
 672             }
 673           break;
 674
 675         case '`':
 676           (*offset)++;
 677           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 678                                   words, offset, flags, NULL, NULL, NULL);
 679           /* The first NULL here is to tell parse_backtick not to
 680            * split the fields.
 681            */
 682           if (error)
 683             {
 684               free (expr);
 685               return error;
 686             }
 687           break;
 688
 689         case '\\':
 690           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 691                                        words, offset);
 692           if (error)
 693             {
 694               free (expr);
 695               return error;
 696             }
 697           /* I think that a backslash within an
 698            * arithmetic expansion is bound to
 699            * cause an error sooner or later anyway though.
 700            */
 701           break;
 702
 703         case ')':
 704           if (--paren_depth == 0)
 705             {
 706               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 707               long int numresult = 0;
 708               long long int convertme;
 709
 710               if (bracket || words[1 + *offset] != ')')
 711                 return WRDE_SYNTAX;
 712
 713               ++(*offset);
 714
 715               /* Go - evaluate. */
 716               if (*expr && eval_expr (expr, &numresult) != 0)
 717                 return WRDE_SYNTAX;
 718
 719               if (numresult < 0)
 720                 {
 721                   convertme = -numresult;
 722                   *word = w_addchar (*word, word_length, max_length, '-');
 723                   if (!*word)
 724                     {
 725                       free (expr);
 726                       return WRDE_NOSPACE;
 727                     }
 728                 }
 729               else
 730                 convertme = numresult;
 731
 732               result[20] = '\0';
 733               *word = w_addstr (*word, word_length, max_length,
 734                                 _itoa (convertme, &result[20], 10, 0));
 735               free (expr);
 736               return *word ? 0 : WRDE_NOSPACE;
 737             }
 738           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 739           if (expr == NULL)
 740             return WRDE_NOSPACE;
 741
 742           break;
 743
 744         case ']':
 745           if (bracket && paren_depth == 1)
 746             {
 747               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 748               long int numresult = 0;
 749
 750               /* Go - evaluate. */
 751               if (*expr && eval_expr (expr, &numresult) != 0)
 752                 return WRDE_SYNTAX;
 753
 754               result[20] = '\0';
 755               *word = w_addstr (*word, word_length, max_length,
 756                                 _itoa_word (numresult, &result[20], 10, 0));
 757               free (expr);
 758               return *word ? 0 : WRDE_NOSPACE;
 759             }
 760
 761           free (expr);
 762           return WRDE_SYNTAX;
 763
 764         case '\n':
 765         case ';':
 766         case '{':
 767         case '}':
 768           free (expr);
 769           return WRDE_BADCHAR;
 770
 771         case '(':
 772           ++paren_depth;
 773         default:
 774           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 775           if (expr == NULL)
 776             return WRDE_NOSPACE;
 777         }
 778     }
 779
 780   /* Premature end */
 781   free (expr);
 782   return WRDE_SYNTAX;
 783 }
 784
 785 /* Function to execute a command and retrieve the results */
 786 /* pwordexp contains NULL if field-splitting is forbidden */
 787 static int
 788 internal_function
 789 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 790            int flags, wordexp_t *pwordexp, const char *ifs,
 791            const char *ifs_white)
 792 {
 793   int fildes[2];
 794   int bufsize = 128;
 795   int buflen;
 796   int i;
 797   char *buffer;
 798   pid_t pid;
 799
 800   /* Don't fork() unless necessary */
 801   if (!comm || !*comm)
 802     return 0;
 803
 804   if (__pipe (fildes))
 805     /* Bad */
 806     return WRDE_NOSPACE;
 807
 808   if ((pid = __fork ()) < 0)
 809     {
 810       /* Bad */
 811       return WRDE_NOSPACE;
 812     }
 813
 814   if (pid == 0)
 815     {
 816       /* Child */
 817       const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 818
 819       /* Redirect output.  */
 820       __dup2 (fildes[1], 1);
 821       __close (fildes[1]);
 822
 823       /* Redirect stderr to /dev/null if we have to.  */
 824       if ((flags & WRDE_SHOWERR) == 0)
 825         {
 826           int fd;
 827           __close (2);
 828           fd = __open (_PATH_DEVNULL, O_WRONLY);
 829           if (fd >= 0 && fd != 2)
 830             {
 831               __dup2 (fd, 2);
 832               __close (fd);
 833             }
 834         }
 835
 836       __close (fildes[0]);
 837       __execve (_PATH_BSHELL, (char *const *) args, __environ);
 838
 839       /* Bad.  What now?  */
 840       abort ();
 841     }
 842
 843   /* Parent */
 844
 845   __close (fildes[1]);
 846   buffer = __alloca (bufsize);
 847
 848   if (!pwordexp)
 849     { /* Quoted - no field splitting */
 850
 851       while (1)
 852         {
 853           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 854             {
 855               if (__waitpid (pid, NULL, WNOHANG) == 0)
 856                 continue;
 857               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 858                 break;
 859             }
 860
 861           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 862           if (*word == NULL)
 863             {
 864               __kill (pid, SIGKILL);
 865               __waitpid (pid, NULL, 0);
 866               __close (fildes[0]);
 867               return WRDE_NOSPACE;
 868             }
 869         }
 870     }
 871   else
 872     /* Not quoted - split fields */
 873     {
 874       int copying = 0;
 875       /* 'copying' is:
 876        *  0 when searching for first character in a field not IFS white space
 877        *  1 when copying the text of a field
 878        *  2 when searching for possible non-whitespace IFS
 879        */
 880
 881       while (1)
 882         {
 883           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 884             {
 885               if (__waitpid (pid, NULL, WNOHANG) == 0)
 886                 continue;
 887               if ((__read (fildes[0], buffer, bufsize)) < 1)
 888                 break;
 889             }
 890
 891           for (i = 0; i < buflen; ++i)
 892             {
 893               if (strchr (ifs, buffer[i]) != NULL)
 894                 {
 895                   /* Current character is IFS */
 896                   if (strchr (ifs_white, buffer[i]) == NULL)
 897                     {
 898                       /* Current character is IFS but not whitespace */
 899                       if (copying == 2)
 900                         {
 901                           /*            current character
 902                            *                   |
 903                            *                   V
 904                            * eg: text<space><comma><space>moretext
 905                            *
 906                            * So, strip whitespace IFS (like at the start)
 907                            */
 908                           copying = 0;
 909                           continue;
 910                         }
 911
 912                       copying = 0;
 913                       /* fall through and delimit field.. */
 914                     }
 915                   else
 916                     {
 917                       /* Current character is IFS white space */
 918
 919                       /* If not copying a field, ignore it */
 920                       if (copying != 1)
 921                         continue;
 922
 923                       /* End of field (search for non-IFS afterwards) */
 924                       copying = 2;
 925                     }
 926
 927                   /* First IFS white space, or IFS non-whitespace.
 928                    * Delimit the field. */
 929                   if (!*word)
 930                     {
 931                       /* This field is null, so make it an empty string */
 932                       *word = w_addchar (*word, word_length, max_length, 0);
 933                       if (*word == NULL)
 934                         {
 935                           __kill (pid, SIGKILL);
 936                           __waitpid (pid, NULL, 0);
 937                           __close (fildes[0]);
 938                           return WRDE_NOSPACE;
 939                         }
 940                     }
 941
 942                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
 943                     {
 944                       __kill (pid, SIGKILL);
 945                       __waitpid (pid, NULL, 0);
 946                       __close (fildes[0]);
 947                       return WRDE_NOSPACE;
 948                     }
 949
 950                   *word = w_newword (word_length, max_length);
 951                   /* fall back round the loop.. */
 952                 }
 953               else
 954                 {
 955                   /* Not IFS character */
 956                   copying = 1;
 957                   *word = w_addchar (*word, word_length, max_length,
 958                                      buffer[i]);
 959                   if (*word == NULL)
 960                     {
 961                       __kill (pid, SIGKILL);
 962                       __waitpid (pid, NULL, 0);
 963                       __close (fildes[0]);
 964                       return WRDE_NOSPACE;
 965                     }
 966                 }
 967             }
 968         }
 969     }
 970
 971   /* Bash chops off trailing newlines, which seems sensible.  */
 972   while (*word_length > 0 && (*word)[*word_length - 1] == '\n')
 973     (*word)[--*word_length] = '\0';
 974
 975   __close (fildes[0]);
 976   return 0;
 977 }
 978
 979 static int
 980 internal_function
 981 parse_comm (char **word, size_t *word_length, size_t *max_length,
 982             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
 983             const char *ifs, const char *ifs_white)
 984 {
 985   /* We are poised just after "$(" */
 986   int paren_depth = 1;
 987   int error = 0;
 988   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
 989   size_t comm_length;
 990   size_t comm_maxlen;
 991   char *comm = w_newword (&comm_length, &comm_maxlen);
 992
 993   for (; words[*offset]; ++(*offset))
 994     {
 995       switch (words[*offset])
 996         {
 997         case '\'':
 998           if (quoted == 0)
 999             quoted = 1;
1000           else if (quoted == 1)
1001             quoted = 0;
1002
1003           break;
1004
1005         case '"':
1006           if (quoted == 0)
1007             quoted = 2;
1008           else if (quoted == 2)
1009             quoted = 0;
1010
1011           break;
1012
1013         case ')':
1014           if (!quoted && --paren_depth == 0)
1015             {
1016               /* Go -- give script to the shell */
1017               if (comm)
1018                 {
1019                   error = exec_comm (comm, word, word_length, max_length,
1020                                      flags, pwordexp, ifs, ifs_white);
1021                   free (comm);
1022                 }
1023
1024               return error;
1025             }
1026
1027           /* This is just part of the script */
1028           break;
1029
1030         case '(':
1031           if (!quoted)
1032             ++paren_depth;
1033         }
1034
1035       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1036       if (comm == NULL)
1037         return WRDE_NOSPACE;
1038     }
1039
1040   /* Premature end */
1041   if (comm)
1042     free (comm);
1043
1044   return WRDE_SYNTAX;
1045 }
1046
1047 static int
1048 internal_function
1049 parse_param (char **word, size_t *word_length, size_t *max_length,
1050              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1051              const char *ifs, const char *ifs_white, int quoted)
1052 {
1053   /* We are poised just after "$" */
1054   enum action
1055   {
1056     ACT_NONE,
1057     ACT_RP_SHORT_LEFT = '#',
1058     ACT_RP_LONG_LEFT = 'L',
1059     ACT_RP_SHORT_RIGHT = '%',
1060     ACT_RP_LONG_RIGHT = 'R',
1061     ACT_NULL_ERROR = '?',
1062     ACT_NULL_SUBST = '-',
1063     ACT_NONNULL_SUBST = '+',
1064     ACT_NULL_ASSIGN = '='
1065   };
1066   size_t env_length;
1067   size_t env_maxlen;
1068   size_t pat_length;
1069   size_t pat_maxlen;
1070   size_t start = *offset;
1071   char *env;
1072   char *pattern;
1073   char *value = NULL;
1074   enum action action = ACT_NONE;
1075   int depth = 0;
1076   int colon_seen = 0;
1077   int seen_hash = 0;
1078   int free_value = 0;
1079   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1080   int error;
1081   int special = 0;
1082   char buffer[21];
1083   int brace = words[*offset] == '{';
1084
1085   env = w_newword (&env_length, &env_maxlen);
1086   pattern = w_newword (&pat_length, &pat_maxlen);
1087
1088   if (brace)
1089     ++*offset;
1090
1091   /* First collect the parameter name. */
1092
1093   if (words[*offset] == '#')
1094     {
1095       seen_hash = 1;
1096       if (!brace)
1097         goto envsubst;
1098       ++*offset;
1099     }
1100
1101   if (isalpha (words[*offset]) || words[*offset] == '_')
1102     {
1103       /* Normal parameter name. */
1104       do
1105         {
1106           env = w_addchar (env, &env_length, &env_maxlen,
1107                            words[*offset]);
1108           if (env == NULL)
1109             goto no_space;
1110         }
1111       while (isalnum (words[++*offset]) || words[*offset] == '_');
1112     }
1113   else if (isdigit (words[*offset]))
1114     {
1115       /* Numeric parameter name. */
1116       special = 1;
1117       do
1118         {
1119           env = w_addchar (env, &env_length, &env_maxlen,
1120                            words[*offset]);
1121           if (env == NULL)
1122             goto no_space;
1123           if (!brace)
1124             goto envsubst;
1125         }
1126       while (isdigit(words[++*offset]));
1127     }
1128   else if (strchr ("*@$", words[*offset]) != NULL)
1129     {
1130       /* Special parameter. */
1131       special = 1;
1132       env = w_addchar (env, &env_length, &env_maxlen,
1133                        words[*offset]);
1134       if (env == NULL)
1135         goto no_space;
1136       ++*offset;
1137     }
1138   else
1139     {
1140       if (brace)
1141         goto syntax;
1142     }
1143
1144   if (brace)
1145     {
1146       /* Check for special action to be applied to the value. */
1147       switch (words[*offset])
1148         {
1149         case '}':
1150           /* Evaluate. */
1151           goto envsubst;
1152
1153         case '#':
1154           action = ACT_RP_SHORT_LEFT;
1155           if (words[1 + *offset] == '#')
1156             {
1157               ++*offset;
1158               action = ACT_RP_LONG_LEFT;
1159             }
1160           break;
1161
1162         case '%':
1163           action = ACT_RP_SHORT_RIGHT;
1164           if (words[1 + *offset] == '%')
1165             {
1166               ++*offset;
1167               action = ACT_RP_LONG_RIGHT;
1168             }
1169           break;
1170
1171         case ':':
1172           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1173             goto syntax;
1174
1175           colon_seen = 1;
1176           action = words[++*offset];
1177           break;
1178
1179         case '-':
1180         case '=':
1181         case '?':
1182         case '+':
1183           action = words[*offset];
1184           break;
1185
1186         default:
1187           goto syntax;
1188         }
1189
1190       /* Now collect the pattern. */
1191       ++*offset;
1192       for (; words[*offset]; ++(*offset))
1193         {
1194           switch (words[*offset])
1195             {
1196             case '{':
1197               if (!pattern_is_quoted)
1198                 ++depth;
1199               break;
1200
1201             case '}':
1202               if (!pattern_is_quoted)
1203                 {
1204                   if (depth == 0)
1205                     goto envsubst;
1206                   --depth;
1207                 }
1208               break;
1209
1210             case '\\':
1211               if (!pattern_is_quoted && words[++*offset] == '\0')
1212                 goto syntax;
1213               break;
1214
1215             case '\'':
1216               if (pattern_is_quoted == 0)
1217                 pattern_is_quoted = 1;
1218               else if (pattern_is_quoted == 1)
1219                 pattern_is_quoted = 0;
1220
1221               break;
1222
1223             case '"':
1224               if (pattern_is_quoted == 0)
1225                 pattern_is_quoted = 2;
1226               else if (pattern_is_quoted == 2)
1227                 pattern_is_quoted = 0;
1228
1229               break;
1230             }
1231
1232           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1233                                words[*offset]);
1234           if (pattern == NULL)
1235             goto no_space;
1236         }
1237     }
1238
1239   /* End of input string -- remember to reparse the character that we
1240    * stopped at.  */
1241   --(*offset);
1242
1243 envsubst:
1244   if (words[start] == '{' && words[*offset] != '}')
1245     goto syntax;
1246
1247   if (env == NULL)
1248     {
1249       if (seen_hash)
1250         {
1251           /* $# expands to the number of positional parameters */
1252           buffer[20] = '\0';
1253           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1254           seen_hash = 0;
1255         }
1256       else
1257         {
1258           /* Just $ on its own */
1259           *offset = start - 1;
1260           *word = w_addchar (*word, word_length, max_length, '$');
1261           return *word ? 0 : WRDE_NOSPACE;
1262         }
1263     }
1264   /* Is it a numeric parameter? */
1265   else if (isdigit (env[0]))
1266     {
1267       int n = atoi (env);
1268
1269       if (n >= __libc_argc)
1270         /* Substitute NULL. */
1271         value = NULL;
1272       else
1273         /* Replace with appropriate positional parameter. */
1274         value = __libc_argv[n];
1275     }
1276   /* Is it a special parameter? */
1277   else if (special)
1278     {
1279       /* Is it `$$'? */
1280       if (*env == '$')
1281         {
1282           buffer[20] = '\0';
1283           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1284         }
1285       /* Is it `${#*}' or `${#@}'? */
1286       else if ((*env == '*' || *env == '@') && seen_hash)
1287         {
1288           buffer[20] = '\0';
1289           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1290                               &buffer[20], 10, 0);
1291           *word = w_addstr (*word, word_length, max_length, value);
1292           free (env);
1293           return *word ? 0 : WRDE_NOSPACE;
1294         }
1295       /* Is it `$*' or `$@' (unquoted) ? */
1296       else if (*env == '*' || (*env == '@' && !quoted))
1297         {
1298           size_t plist_len = 0;
1299           int p;
1300           char *end;
1301
1302           /* Build up value parameter by parameter (copy them) */
1303           for (p = 1; __libc_argv[p]; ++p)
1304             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1305           value = malloc (plist_len);
1306           if (value == NULL)
1307             goto no_space;
1308           end = value;
1309           *end = 0;
1310           for (p = 1; __libc_argv[p]; ++p)
1311             {
1312               if (p > 1)
1313                 *end++ = ' ';
1314               end = __stpcpy (end, __libc_argv[p]);
1315             }
1316
1317           free_value = 1;
1318         }
1319       else
1320         {
1321           /* Must be a quoted `$@' */
1322           assert (*env == '@' && quoted);
1323
1324           /* Each parameter is a separate word ("$@") */
1325           if (__libc_argc == 2)
1326             value = __libc_argv[1];
1327           else if (__libc_argc > 2)
1328             {
1329               int p;
1330
1331               /* Append first parameter to current word. */
1332               value = w_addstr (*word, word_length, max_length,
1333                                 __libc_argv[1]);
1334               if (value == NULL || w_addword (pwordexp, value))
1335                 goto no_space;
1336
1337               for (p = 2; __libc_argv[p + 1]; p++)
1338                 {
1339                   char *newword = __strdup (__libc_argv[p]);
1340                   if (newword == NULL || w_addword (pwordexp, newword))
1341                     goto no_space;
1342                 }
1343
1344               /* Start a new word with the last parameter. */
1345               *word = w_newword (word_length, max_length);
1346               value = __libc_argv[p];
1347             }
1348           else
1349             {
1350               free (env);
1351               free (pattern);
1352               return 0;
1353             }
1354         }
1355     }
1356   else
1357     value = getenv (env);
1358
1359   if (value == NULL && (flags & WRDE_UNDEF))
1360     {
1361       /* Variable not defined. */
1362       if (pattern)
1363         free (pattern);
1364       if (env)
1365         free (env);
1366       return WRDE_BADVAL;
1367     }
1368
1369   if (action != ACT_NONE)
1370     {
1371       switch (action)
1372         {
1373         case ACT_RP_SHORT_LEFT:
1374         case ACT_RP_LONG_LEFT:
1375         case ACT_RP_SHORT_RIGHT:
1376         case ACT_RP_LONG_RIGHT:
1377           {
1378             char *p;
1379             char c;
1380             char *end;
1381
1382             if (value == NULL || pattern == NULL || *pattern == '\0')
1383               break;
1384
1385             end = value + strlen (value);
1386
1387             switch (action)
1388               {
1389               case ACT_RP_SHORT_LEFT:
1390                 for (p = value; p <= end; ++p)
1391                   {
1392                     c = *p;
1393                     *p = '\0';
1394                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1395                       {
1396                         *p = c;
1397                         if (free_value)
1398                           {
1399                             char *newval = __strdup (p);
1400                             if (newval == NULL)
1401                               {
1402                                 free (value);
1403                                 goto no_space;
1404                               }
1405                             free (value);
1406                             value = newval;
1407                           }
1408                         else
1409                           value = p;
1410                         break;
1411                       }
1412                     *p = c;
1413                   }
1414
1415                 break;
1416
1417               case ACT_RP_LONG_LEFT:
1418                 for (p = end; p >= value; --p)
1419                   {
1420                     c = *p;
1421                     *p = '\0';
1422                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1423                       {
1424                         *p = c;
1425                         if (free_value)
1426                           {
1427                             char *newval = __strdup (p);
1428                             if (newval == NULL)
1429                               {
1430                                 free (value);
1431                                 goto no_space;
1432                               }
1433                             free (value);
1434                             value = newval;
1435                           }
1436                         else
1437                           value = p;
1438                         break;
1439                       }
1440                     *p = c;
1441                   }
1442
1443                 break;
1444
1445               case ACT_RP_SHORT_RIGHT:
1446                 for (p = end; p >= value; --p)
1447                   {
1448                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1449                       {
1450                         char *newval;
1451                         newval = malloc (p - value + 1);
1452                         if (newval == NULL)
1453                           goto no_space;
1454                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1455                         if (free_value)
1456                           free (value);
1457                         value = newval;
1458                         free_value = 1;
1459                         break;
1460                       }
1461                   }
1462
1463                 break;
1464
1465               case ACT_RP_LONG_RIGHT:
1466                 for (p = value; p <= end; ++p)
1467                   {
1468                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1469                       {
1470                         char *newval;
1471                         newval = malloc (p - value + 1);
1472                         if (newval == NULL)
1473                           goto no_space;
1474                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1475                         if (free_value)
1476                           free (value);
1477                         value = newval;
1478                         free_value = 1;
1479                         break;
1480                       }
1481                   }
1482
1483                 break;
1484
1485               default:
1486                 break;
1487               }
1488
1489             break;
1490           }
1491
1492         case ACT_NULL_ERROR:
1493           if (value && *value)
1494             /* Substitute parameter */
1495             break;
1496
1497           if (!colon_seen && value)
1498             /* Substitute NULL */
1499             error = 0;
1500           else if (*pattern)
1501             {
1502               /* Expand 'pattern' and write it to stderr */
1503               wordexp_t we;
1504
1505               error = wordexp (pattern, &we, flags);
1506
1507               if (error == 0)
1508                 {
1509                   int i;
1510
1511                   fprintf (stderr, "%s:", env);
1512
1513                   for (i = 0; i < we.we_wordc; ++i)
1514                     {
1515                       fprintf (stderr, " %s", we.we_wordv[i]);
1516                     }
1517
1518                   fprintf (stderr, "\n");
1519                   error = WRDE_BADVAL;
1520                 }
1521
1522               wordfree (&we);
1523             }
1524           else
1525             {
1526               fprintf (stderr, "%s: parameter null or not set\n", env);
1527               error = WRDE_BADVAL;
1528             }
1529
1530           free (env);
1531           free (pattern);
1532           if (free_value)
1533             free (value);
1534           return error;
1535
1536         case ACT_NULL_SUBST:
1537           if (value && *value)
1538             /* Substitute parameter */
1539             break;
1540
1541           if (!colon_seen && value)
1542             {
1543               /* Substitute NULL */
1544               free (env);
1545               free (pattern);
1546               if (free_value)
1547                 free (value);
1548               return 0;
1549             }
1550
1551         subst_word:
1552           {
1553             /* Substitute word */
1554             wordexp_t we;
1555             int i;
1556
1557             if (free_value)
1558               free (value);
1559
1560             if (quoted)
1561               {
1562                 /* No field-splitting is allowed, so imagine
1563                    quotes around the word.  */
1564                 char *qtd_pattern = malloc (3 + strlen (pattern));
1565                 if (qtd_pattern)
1566                   sprintf (qtd_pattern, "\"%s\"", pattern);
1567                 free (pattern);
1568                 pattern = qtd_pattern;
1569               }
1570
1571             if (pattern == NULL && (pattern = __strdup ("")) == NULL)
1572               goto no_space;
1573
1574             error = wordexp (pattern, &we, flags);
1575             if (error)
1576               {
1577                 free (env);
1578                 free (pattern);
1579                 return error;
1580               }
1581
1582             /* Fingers crossed that the quotes worked.. */
1583             assert (!quoted || we.we_wordc == 1);
1584
1585             /* Substitute */
1586             for (i = 0; i < we.we_wordc; ++i)
1587               if (w_addword (pwordexp, __strdup (we.we_wordv[i]))
1588                   == WRDE_NOSPACE)
1589                 break;
1590
1591             if (i < we.we_wordc)
1592               {
1593                 /* Ran out of space */
1594                 wordfree (&we);
1595                 goto no_space;
1596               }
1597
1598             if (action == ACT_NULL_ASSIGN)
1599               {
1600                 char *words;
1601                 char *cp;
1602                 size_t words_size = 0;
1603
1604                 if (special)
1605                   /* Cannot assign special parameters. */
1606                   goto syntax;
1607
1608                 for (i = 0; i < we.we_wordc; i++)
1609                   words_size += strlen (we.we_wordv[i]) + 1; /* for <space> */
1610                 words_size++;
1611
1612                 cp = words = __alloca (words_size);
1613                 *words = 0;
1614                 for (i = 0; i < we.we_wordc - 1; i++)
1615                   {
1616                     cp = __stpcpy (cp, we.we_wordv[i]);
1617                     *cp++ = ' ';
1618                   }
1619
1620                 strcpy (cp, we.we_wordv[i]);
1621
1622                 /* Also assign */
1623                 setenv (env, words, 1);
1624               }
1625
1626             wordfree (&we);
1627             free (env);
1628             free (pattern);
1629             return 0;
1630           }
1631
1632         case ACT_NONNULL_SUBST:
1633           if (value && *value)
1634             goto subst_word;
1635
1636           if (!colon_seen && value)
1637             goto subst_word;
1638
1639           /* Substitute NULL */
1640           free (env);
1641           free (pattern);
1642           if (free_value)
1643             free (value);
1644           return 0;
1645
1646         case ACT_NULL_ASSIGN:
1647           if (value && *value)
1648             /* Substitute parameter */
1649             break;
1650
1651           if (!colon_seen && value)
1652             {
1653               /* Substitute NULL */
1654               free (env);
1655               free (pattern);
1656               if (free_value)
1657                 free (value);
1658               return 0;
1659             }
1660
1661           /* This checks for '=' so it knows to assign */
1662           goto subst_word;
1663
1664         default:
1665           assert (! "Unrecognised action!");
1666         }
1667     }
1668
1669   free (env);
1670   free (pattern);
1671
1672   if (seen_hash)
1673     {
1674       char param_length[21];
1675       param_length[20] = '\0';
1676       *word = w_addstr (*word, word_length, max_length,
1677                         _itoa_word (value ? strlen (value) : 0,
1678                                     &param_length[20], 10, 0));
1679       if (free_value)
1680         {
1681           assert (value != NULL);
1682           free (value);
1683         }
1684
1685       return *word ? 0 : WRDE_NOSPACE;
1686     }
1687
1688   if (value == NULL)
1689     return 0;
1690
1691   if (quoted || !pwordexp)
1692     {
1693       /* Quoted - no field split */
1694       *word = w_addstr (*word, word_length, max_length, value);
1695       if (free_value)
1696         free (value);
1697
1698       return *word ? 0 : WRDE_NOSPACE;
1699     }
1700   else
1701     {
1702       /* Need to field-split */
1703       char *value_copy = __strdup (value); /* Don't modify value */
1704       char *field_begin = value_copy;
1705       int seen_nonws_ifs = 0;
1706
1707       if (free_value)
1708         free (value);
1709
1710       if (value_copy == NULL)
1711         return WRDE_NOSPACE;
1712
1713       do
1714         {
1715           char *field_end = field_begin;
1716           char *next_field;
1717
1718           /* If this isn't the first field, start a new word */
1719           if (field_begin != value_copy)
1720             {
1721               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1722                 {
1723                   free (value_copy);
1724                   return WRDE_NOSPACE;
1725                 }
1726
1727               *word = w_newword (word_length, max_length);
1728             }
1729
1730           /* Skip IFS whitespace before the field */
1731           field_begin += strspn (field_begin, ifs_white);
1732
1733           if (!seen_nonws_ifs && *field_begin == 0)
1734             /* Nothing but whitespace */
1735             break;
1736
1737           /* Search for the end of the field */
1738           field_end = field_begin + strcspn (field_begin, ifs);
1739
1740           /* Set up pointer to the character after end of field and
1741              skip whitespace IFS after it. */
1742           next_field = field_end + strspn (field_end, ifs_white);
1743
1744           /* Skip at most one non-whitespace IFS character after the field */
1745           seen_nonws_ifs = 0;
1746           if (*next_field && strchr (ifs, *next_field))
1747             {
1748               seen_nonws_ifs = 1;
1749               next_field++;
1750             }
1751
1752           /* Null-terminate it */
1753           *field_end = 0;
1754
1755           /* Tag a copy onto the current word */
1756           *word = w_addstr (*word, word_length, max_length, field_begin);
1757
1758           if (*word == NULL)
1759             {
1760               free (value_copy);
1761               return WRDE_NOSPACE;
1762             }
1763
1764           field_begin = next_field;
1765         }
1766       while (seen_nonws_ifs || *field_begin);
1767
1768       free (value_copy);
1769     }
1770
1771   return 0;
1772
1773 no_space:
1774   if (env)
1775     free (env);
1776
1777   if (pattern)
1778     free (pattern);
1779
1780   return WRDE_NOSPACE;
1781
1782 syntax:
1783   if (env)
1784     free (env);
1785
1786   if (pattern)
1787     free (pattern);
1788
1789   return WRDE_SYNTAX;
1790 }
1791
1792 static int
1793 internal_function
1794 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1795                const char *words, size_t *offset, int flags,
1796                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
1797                int quoted)
1798 {
1799   /* We are poised _at_ "$" */
1800   switch (words[1 + *offset])
1801     {
1802     case '"':
1803     case '\'':
1804     case 0:
1805       *word = w_addchar (*word, word_length, max_length, '$');
1806       return *word ? 0 : WRDE_NOSPACE;
1807
1808     case '(':
1809       if (words[2 + *offset] == '(')
1810         {
1811           /* Differentiate between $((1+3)) and $((echo);(ls)) */
1812           int i = 3 + *offset;
1813           int depth = 0;
1814           while (words[i] && !(depth == 0 && words[i] == ')'))
1815             {
1816               if (words[i] == '(')
1817                 ++depth;
1818               else if (words[i] == ')')
1819                 --depth;
1820
1821               ++i;
1822             }
1823
1824           if (words[i] == ')' && words[i + 1] == ')')
1825             {
1826               (*offset) += 3;
1827               /* Call parse_arith -- 0 is for "no brackets" */
1828               return parse_arith (word, word_length, max_length, words, offset,
1829                                   flags, 0);
1830             }
1831         }
1832
1833       if (flags & WRDE_NOCMD)
1834         return WRDE_CMDSUB;
1835
1836       (*offset) += 2;
1837       return parse_comm (word, word_length, max_length, words, offset, flags,
1838                          quoted? NULL : pwordexp, ifs, ifs_white);
1839
1840     case '[':
1841       (*offset) += 2;
1842       /* Call parse_arith -- 1 is for "brackets" */
1843       return parse_arith (word, word_length, max_length, words, offset, flags,
1844                           1);
1845
1846     case '{':
1847     default:
1848       ++(*offset);      /* parse_param needs to know if "{" is there */
1849       return parse_param (word, word_length, max_length, words, offset, flags,
1850                            pwordexp, ifs, ifs_white, quoted);
1851     }
1852 }
1853
1854 static int
1855 parse_backtick (char **word, size_t *word_length, size_t *max_length,
1856                 const char *words, size_t *offset, int flags,
1857                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
1858 {
1859   /* We are poised just after "`" */
1860   int error;
1861   int squoting = 0;
1862   size_t comm_length;
1863   size_t comm_maxlen;
1864   char *comm = w_newword (&comm_length, &comm_maxlen);
1865
1866   for (; words[*offset]; ++(*offset))
1867     {
1868       switch (words[*offset])
1869         {
1870         case '`':
1871           /* Go -- give the script to the shell */
1872           error = exec_comm (comm, word, word_length, max_length, flags,
1873                              pwordexp, ifs, ifs_white);
1874           free (comm);
1875           return error;
1876
1877         case '\\':
1878           if (squoting)
1879             {
1880               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
1881                                            words, offset);
1882
1883               if (error)
1884                 {
1885                   free (comm);
1886                   return error;
1887                 }
1888
1889               break;
1890             }
1891
1892           ++(*offset);
1893           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
1894                                    offset);
1895
1896           if (error)
1897             {
1898               free (comm);
1899               return error;
1900             }
1901
1902           break;
1903
1904         case '\'':
1905           squoting = 1 - squoting;
1906         default:
1907           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1908           if (comm == NULL)
1909             return WRDE_NOSPACE;
1910         }
1911     }
1912
1913   /* Premature end */
1914   free (comm);
1915   return WRDE_SYNTAX;
1916 }
1917
1918 static int
1919 internal_function
1920 parse_dquote (char **word, size_t *word_length, size_t *max_length,
1921               const char *words, size_t *offset, int flags,
1922               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
1923 {
1924   /* We are poised just after a double-quote */
1925   int error;
1926
1927   for (; words[*offset]; ++(*offset))
1928     {
1929       switch (words[*offset])
1930         {
1931         case '"':
1932           return 0;
1933
1934         case '$':
1935           error = parse_dollars (word, word_length, max_length, words, offset,
1936                                  flags, pwordexp, ifs, ifs_white, 1);
1937           /* The ``1'' here is to tell parse_dollars not to
1938            * split the fields.  It may need to, however ("$@").
1939            */
1940           if (error)
1941             return error;
1942
1943           break;
1944
1945         case '`':
1946           if (flags & WRDE_NOCMD)
1947             return WRDE_CMDSUB;
1948
1949           ++(*offset);
1950           error = parse_backtick (word, word_length, max_length, words,
1951                                   offset, flags, NULL, NULL, NULL);
1952           /* The first NULL here is to tell parse_backtick not to
1953            * split the fields.
1954            */
1955           if (error)
1956             return error;
1957
1958           break;
1959
1960         case '\\':
1961           error = parse_qtd_backslash (word, word_length, max_length, words,
1962                                        offset);
1963
1964           if (error)
1965             return error;
1966
1967           break;
1968
1969         default:
1970           *word = w_addchar (*word, word_length, max_length, words[*offset]);
1971           if (*word == NULL)
1972             return WRDE_NOSPACE;
1973         }
1974     }
1975
1976   /* Unterminated string */
1977   return WRDE_SYNTAX;
1978 }
1979
1980 /*
1981  * wordfree() is to be called after pwordexp is finished with.
1982  */
1983
1984 void
1985 wordfree (wordexp_t *pwordexp)
1986 {
1987
1988   /* wordexp can set pwordexp to NULL */
1989   if (pwordexp && pwordexp->we_wordv)
1990     {
1991       char **wordv = pwordexp->we_wordv;
1992
1993       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
1994         free (*wordv);
1995
1996       free (pwordexp->we_wordv);
1997       pwordexp->we_wordv = NULL;
1998     }
1999 }
2000
2001 /*
2002  * wordexp()
2003  */
2004
2005 int
2006 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2007 {
2008   size_t wordv_offset;
2009   size_t words_offset;
2010   size_t word_length;
2011   size_t max_length;
2012   char *word = w_newword (&word_length, &max_length);
2013   int error;
2014   char *ifs;
2015   char ifs_white[4];
2016   char **old_wordv = pwordexp->we_wordv;
2017   size_t old_wordc = (flags & WRDE_REUSE) ? pwordexp->we_wordc : 0;
2018
2019   if (flags & WRDE_REUSE)
2020     {
2021       /* Minimal implementation of WRDE_REUSE for now */
2022       wordfree (pwordexp);
2023       old_wordv = NULL;
2024     }
2025
2026   if (flags & WRDE_DOOFFS)
2027     {
2028       pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2029       if (pwordexp->we_wordv == NULL)
2030         return WRDE_NOSPACE;
2031     }
2032   else
2033     {
2034       pwordexp->we_wordv = calloc (1, sizeof (char *));
2035       if (pwordexp->we_wordv == NULL)
2036         return WRDE_NOSPACE;
2037
2038       pwordexp->we_offs = 0;
2039     }
2040
2041   if ((flags & WRDE_APPEND) == 0)
2042     pwordexp->we_wordc = 0;
2043
2044   wordv_offset = pwordexp->we_offs + pwordexp->we_wordc;
2045
2046   /* Find out what the field separators are.
2047    * There are two types: whitespace and non-whitespace.
2048    */
2049   ifs = getenv ("IFS");
2050
2051   if (!ifs)
2052     /* NULL IFS means no field-splitting is to be performed */
2053     ifs = strcpy (ifs_white, "");
2054   else
2055     {
2056       char *ifsch = ifs;
2057       char *whch = ifs_white;
2058
2059       /* Start off with no whitespace IFS characters */
2060       ifs_white[0] = '\0';
2061
2062       while (*ifsch != '\0')
2063         {
2064           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2065             {
2066               /* Whitespace IFS.  See first whether it is already in our
2067                  collection.  */
2068               char *runp = ifs_white;
2069
2070               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2071                 ++runp;
2072
2073               if (runp == whch)
2074                 *whch++ = *ifsch;
2075             }
2076
2077           ++ifsch;
2078         }
2079       *whch = '\0';
2080     }
2081
2082   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2083     switch (words[words_offset])
2084       {
2085       case '\n':
2086       case '|':
2087       case '&':
2088       case ';':
2089       case '<':
2090       case '>':
2091       case '(':
2092       case ')':
2093         case '{':
2094       case '}':
2095         /* Fail */
2096         wordfree (pwordexp);
2097         pwordexp->we_wordc = 0;
2098         pwordexp->we_wordv = old_wordv;
2099         return WRDE_BADCHAR;
2100
2101       case '\\':
2102         error = parse_backslash (&word, &word_length, &max_length, words,
2103                                  &words_offset);
2104
2105         if (error)
2106           goto do_error;
2107
2108         break;
2109
2110       case '$':
2111         error = parse_dollars (&word, &word_length, &max_length, words,
2112                                &words_offset, flags, pwordexp, ifs, ifs_white,
2113                                0);
2114
2115         if (error)
2116           goto do_error;
2117
2118         break;
2119
2120       case '`':
2121         if (flags & WRDE_NOCMD)
2122           return WRDE_CMDSUB;
2123
2124         ++words_offset;
2125         error = parse_backtick (&word, &word_length, &max_length, words,
2126                                 &words_offset, flags, pwordexp, ifs,
2127                                 ifs_white);
2128
2129         if (error)
2130           goto do_error;
2131
2132         break;
2133
2134       case '"':
2135         ++words_offset;
2136         error = parse_dquote (&word, &word_length, &max_length, words,
2137                               &words_offset, flags, pwordexp, ifs, ifs_white);
2138
2139         if (error)
2140           goto do_error;
2141
2142         break;
2143
2144       case '\'':
2145         ++words_offset;
2146         error = parse_squote (&word, &word_length, &max_length, words,
2147                               &words_offset);
2148
2149         if (error)
2150           goto do_error;
2151
2152         break;
2153
2154       case '~':
2155         error = parse_tilde (&word, &word_length, &max_length, words,
2156                              &words_offset, pwordexp->we_wordc);
2157
2158         if (error)
2159           goto do_error;
2160
2161         break;
2162
2163       case '*':
2164       case '[':
2165       case '?':
2166         error = parse_glob (&word, &word_length, &max_length, words,
2167                             &words_offset, flags, pwordexp, ifs, ifs_white);
2168
2169         if (error)
2170           goto do_error;
2171
2172         break;
2173
2174       default:
2175         /* Is it a field separator? */
2176         if (strchr (ifs, words[words_offset]) == NULL)
2177           {
2178             /* "Ordinary" character -- add it to word */
2179
2180             word = w_addchar (word, &word_length, &max_length,
2181                               words[words_offset]);
2182             if (word == NULL)
2183               {
2184                 error = WRDE_NOSPACE;
2185                 goto do_error;
2186               }
2187
2188             break;
2189           }
2190
2191         /* Field separator */
2192         if (strchr (ifs_white, words[words_offset]))
2193           {
2194             /* It's a whitespace IFS char.  Ignore it at the beginning
2195                of a line and ignore multiple instances.  */
2196             if (!word || !*word)
2197               break;
2198
2199             if (w_addword (pwordexp, word) == WRDE_NOSPACE)
2200               {
2201                 error = WRDE_NOSPACE;
2202                 goto do_error;
2203               }
2204
2205             word = w_newword (&word_length, &max_length);
2206             break;
2207           }
2208
2209         /* It's a non-whitespace IFS char */
2210
2211         /* Multiple non-whitespace IFS chars are treated as one.  */
2212         if (word != NULL)
2213           {
2214             if (w_addword (pwordexp, word) == WRDE_NOSPACE)
2215               {
2216                 error = WRDE_NOSPACE;
2217                 goto do_error;
2218               }
2219           }
2220
2221         word = w_newword (&word_length, &max_length);
2222       }
2223
2224   /* End of string */
2225
2226   /* There was a field separator at the end */
2227   if (word == NULL)
2228     return 0;
2229
2230   /* There was no field separator at the end */
2231   return w_addword (pwordexp, word);
2232
2233 do_error:
2234   /* Error:
2235    *    free memory used (unless error is WRDE_NOSPACE), and
2236    *    set we_wordc and wd_wordv back to what they were.
2237    */
2238
2239   if (error == WRDE_NOSPACE)
2240     return WRDE_NOSPACE;
2241
2242   if (word != NULL)
2243     free (word);
2244
2245   wordfree (pwordexp);
2246   pwordexp->we_wordv = old_wordv;
2247   pwordexp->we_wordc = old_wordc;
2248   return error;
2249 }