posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997, 1998 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Library General Public License as
   8    published by the Free Software Foundation; either version 2 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Library General Public License for more details.
  15
  16    You should have received a copy of the GNU Library General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 #include <wordexp.h>
  22 #include <signal.h>
  23 #include <stdlib.h>
  24 #include <pwd.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <glob.h>
  28 #include <ctype.h>
  29 #include <sys/time.h>
  30 #include <sys/types.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <fcntl.h>
  34 #include <sys/stat.h>
  35 #include <paths.h>
  36 #include <errno.h>
  37 #include <sys/param.h>
  38 #include <stdio.h>
  39 #include <fnmatch.h>
  40
  41 #include <stdio-common/_itoa.h>
  42
  43 /* Undefine the following line for the production version.  */
  44 /* #define NDEBUG 1 */
  45 #include <assert.h>
  46
  47 /*
  48  * This is a recursive-descent-style word expansion routine.
  49  */
  50
  51 /* These variables are defined and initialized in the startup code.  */
  52 extern int __libc_argc;
  53 extern char **__libc_argv;
  54
  55 /* Some forward declarations */
  56 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  57                           const char *words, size_t *offset, int flags,
  58                           wordexp_t *pwordexp, const char *ifs,
  59                           const char *ifs_white, int quoted)
  60      internal_function;
  61 static int parse_backtick (char **word, size_t *word_length,
  62                            size_t *max_length, const char *words,
  63                            size_t *offset, int flags, wordexp_t *pwordexp,
  64                            const char *ifs, const char *ifs_white)
  65      internal_function;
  66 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  67                          const char *words, size_t *offset, int flags,
  68                          wordexp_t *pwordexp, const char *ifs,
  69                          const char *ifs_white)
  70      internal_function;
  71 static int eval_expr (char *expr, long int *result) internal_function;
  72
  73 /* The w_*() functions manipulate word lists. */
  74
  75 #define W_CHUNK (100)
  76
  77 /* Result of w_newword will be ignored if it the last word. */
  78 static inline char *
  79 w_newword (size_t *actlen, size_t *maxlen)
  80 {
  81   *actlen = *maxlen = 0;
  82   return NULL;
  83 }
  84
  85 static inline char *
  86 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  87      /* (lengths exclude trailing zero) */
  88 {
  89   /* Add a character to the buffer, allocating room for it if needed.
  90    */
  91
  92   if (*actlen == *maxlen)
  93     {
  94       char *old_buffer = buffer;
  95       assert (buffer == NULL || *maxlen != 0);
  96       *maxlen += W_CHUNK;
  97       buffer = realloc (buffer, 1 + *maxlen);
  98
  99       if (buffer == NULL)
 100         free (old_buffer);
 101     }
 102
 103   if (buffer != NULL)
 104     {
 105       buffer[*actlen] = ch;
 106       buffer[++(*actlen)] = '\0';
 107     }
 108
 109   return buffer;
 110 }
 111
 112 static char *
 113 internal_function
 114 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 115           size_t len)
 116 {
 117   /* Add a string to the buffer, allocating room for it if needed.
 118    */
 119   if (*actlen + len > *maxlen)
 120     {
 121       char *old_buffer = buffer;
 122       assert (buffer == NULL || *maxlen != 0);
 123       *maxlen += MAX (2 * len, W_CHUNK);
 124       buffer = realloc (old_buffer, 1 + *maxlen);
 125
 126       if (buffer == NULL)
 127         free (old_buffer);
 128     }
 129
 130   if (buffer != NULL)
 131     {
 132       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 133       *actlen += len;
 134     }
 135
 136   return buffer;
 137 }
 138
 139
 140 /* Result of w_emptyword will not be ignored even if it is the last. */
 141 static inline char *
 142 w_emptyword (size_t *actlen, size_t *maxlen)
 143 {
 144   char *word = malloc (1 + W_CHUNK);
 145   *maxlen = W_CHUNK;
 146   *actlen = 0;
 147
 148   if (word)
 149     *word = '\0';
 150
 151   return word;
 152 }
 153
 154 static char *
 155 internal_function
 156 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 157      /* (lengths exclude trailing zero) */
 158 {
 159   /* Add a string to the buffer, allocating room for it if needed.
 160    */
 161   size_t len;
 162
 163   assert (str != NULL); /* w_addstr only called from this file */
 164   len = strlen (str);
 165
 166   return w_addmem (buffer, actlen, maxlen, str, len);
 167 }
 168
 169 static int
 170 internal_function
 171 w_addword (wordexp_t *pwordexp, char *word)
 172 {
 173   /* Add a word to the wordlist */
 174   size_t num_p;
 175   char **new_wordv;
 176
 177   /* Internally, NULL acts like "".  Convert NULLs to "" before
 178    * the caller sees them.
 179    */
 180   if (word == NULL)
 181     {
 182       word = __strdup ("");
 183       if (word == NULL)
 184         goto no_space;
 185     }
 186
 187   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 188   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 189   if (new_wordv != NULL)
 190     {
 191       pwordexp->we_wordv = new_wordv;
 192       pwordexp->we_wordv[pwordexp->we_wordc++] = word;
 193       pwordexp->we_wordv[pwordexp->we_wordc] = NULL;
 194       return 0;
 195     }
 196
 197 no_space:
 198   return WRDE_NOSPACE;
 199 }
 200
 201 /* The parse_*() functions should leave *offset being the offset in 'words'
 202  * to the last character processed.
 203  */
 204
 205 static int
 206 internal_function
 207 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 208                  const char *words, size_t *offset)
 209 {
 210   /* We are poised _at_ a backslash, not in quotes */
 211
 212   switch (words[1 + *offset])
 213     {
 214     case 0:
 215       /* Backslash is last character of input words */
 216       return WRDE_SYNTAX;
 217
 218     case '\n':
 219       ++(*offset);
 220       break;
 221
 222     default:
 223       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 224       if (*word == NULL)
 225         return WRDE_NOSPACE;
 226
 227       ++(*offset);
 228       break;
 229     }
 230
 231   return 0;
 232 }
 233
 234 static int
 235 internal_function
 236 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 237                      const char *words, size_t *offset)
 238 {
 239   /* We are poised _at_ a backslash, inside quotes */
 240
 241   switch (words[1 + *offset])
 242     {
 243     case 0:
 244       /* Backslash is last character of input words */
 245       return WRDE_SYNTAX;
 246
 247     case '\n':
 248       ++(*offset);
 249       break;
 250
 251     case '$':
 252     case '`':
 253     case '"':
 254     case '\\':
 255       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 256       if (*word == NULL)
 257         return WRDE_NOSPACE;
 258
 259       ++(*offset);
 260       break;
 261
 262     default:
 263       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 264       if (*word != NULL)
 265         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 266
 267       if (*word == NULL)
 268         return WRDE_NOSPACE;
 269
 270       ++(*offset);
 271       break;
 272     }
 273
 274   return 0;
 275 }
 276
 277 static int
 278 internal_function
 279 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 280              const char *words, size_t *offset, size_t wordc)
 281 {
 282   /* We are poised _at_ a tilde */
 283   size_t i;
 284
 285   if (*word_length != 0)
 286     {
 287       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 288         {
 289           if (!((*word)[*word_length - 1] == ':'
 290                 && strchr (*word, '=') && wordc == 0))
 291             {
 292               *word = w_addchar (*word, word_length, max_length, '~');
 293               return *word ? 0 : WRDE_NOSPACE;
 294             }
 295         }
 296     }
 297
 298   for (i = 1 + *offset; words[i]; i++)
 299     {
 300       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 301           words[i] == '\t' || words[i] == 0 )
 302         break;
 303
 304       if (words[i] == '\\')
 305         {
 306           *word = w_addchar (*word, word_length, max_length, '~');
 307           return *word ? 0 : WRDE_NOSPACE;
 308         }
 309     }
 310
 311   if (i == 1 + *offset)
 312     {
 313       /* Tilde appears on its own */
 314       uid_t uid;
 315       struct passwd pwd, *tpwd;
 316       int buflen = 1000;
 317       char* buffer = __alloca (buflen);
 318       int result;
 319
 320       uid = __getuid ();
 321
 322       while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 323              && errno == ERANGE)
 324         {
 325           buflen += 1000;
 326           buffer = __alloca (buflen);
 327         }
 328
 329       if (result == 0 && pwd.pw_dir != NULL)
 330         {
 331           *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 332           if (*word == NULL)
 333             return WRDE_NOSPACE;
 334         }
 335       else
 336         {
 337           *word = w_addchar (*word, word_length, max_length, '~');
 338           if (*word == NULL)
 339             return WRDE_NOSPACE;
 340         }
 341     }
 342   else
 343     {
 344       /* Look up user name in database to get home directory */
 345       char *user = __strndup (&words[1 + *offset], i - *offset);
 346       struct passwd pwd, *tpwd;
 347       int buflen = 1000;
 348       char* buffer = __alloca (buflen);
 349       int result;
 350
 351       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 352              && errno == ERANGE)
 353         {
 354           buflen += 1000;
 355           buffer = __alloca (buflen);
 356         }
 357
 358       if (result == 0 && pwd.pw_dir)
 359         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 360       else
 361         {
 362           /* (invalid login name) */
 363           *word = w_addchar (*word, word_length, max_length, '~');
 364           if (*word != NULL)
 365             *word = w_addstr (*word, word_length, max_length, user);
 366         }
 367
 368       *offset = i - 1;
 369     }
 370   return *word ? 0 : WRDE_NOSPACE;
 371 }
 372
 373
 374 static int
 375 internal_function
 376 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 377                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 378                const char *ifs_white)
 379 {
 380   int error;
 381   int match;
 382   glob_t globbuf;
 383
 384   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 385
 386   if (error != 0)
 387     {
 388       /* We can only run into memory problems.  */
 389       assert (error == GLOB_NOSPACE);
 390       return WRDE_NOSPACE;
 391     }
 392
 393   if (ifs && !*ifs)
 394     {
 395       /* No field splitting allowed. */
 396       assert (globbuf.gl_pathv[0] != NULL);
 397       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 398       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 399         {
 400           *word = w_addchar (*word, word_length, max_length, ' ');
 401           if (*word != NULL)
 402             *word = w_addstr (*word, word_length, max_length,
 403                               globbuf.gl_pathv[match]);
 404         }
 405
 406       globfree (&globbuf);
 407       return *word ? 0 : WRDE_NOSPACE;
 408     }
 409
 410   assert (ifs == NULL || *ifs != '\0');
 411   if (*word != NULL)
 412     {
 413       free (*word);
 414       *word = w_newword (word_length, max_length);
 415     }
 416
 417   for (match = 0; match < globbuf.gl_pathc; ++match)
 418     {
 419       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 420       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 421         {
 422           globfree (&globbuf);
 423           return WRDE_NOSPACE;
 424         }
 425     }
 426
 427   globfree (&globbuf);
 428   return 0;
 429 }
 430
 431 static int
 432 internal_function
 433 parse_glob (char **word, size_t *word_length, size_t *max_length,
 434             const char *words, size_t *offset, int flags,
 435             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 436 {
 437   /* We are poised just after a '*', a '[' or a '?'. */
 438   int error = WRDE_NOSPACE;
 439   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 440   int i;
 441   wordexp_t glob_list; /* List of words to glob */
 442
 443   glob_list.we_wordc = 0;
 444   glob_list.we_wordv = NULL;
 445   glob_list.we_offs = 0;
 446   for (; words[*offset] != '\0'; ++*offset)
 447     {
 448       if ((ifs && strchr (ifs, words[*offset])) ||
 449           (!ifs && strchr (" \t\n", words[*offset])))
 450         /* Reached IFS */
 451         break;
 452
 453       /* Sort out quoting */
 454       if (words[*offset] == '\'')
 455         {
 456           if (quoted == 0)
 457             {
 458               quoted = 1;
 459               continue;
 460             }
 461           else if (quoted == 1)
 462             {
 463               quoted = 0;
 464               continue;
 465             }
 466         }
 467       else if (words[*offset] == '"')
 468         {
 469           if (quoted == 0)
 470             {
 471               quoted = 2;
 472               continue;
 473             }
 474           else if (quoted == 2)
 475             {
 476               quoted = 0;
 477               continue;
 478             }
 479         }
 480
 481       /* Sort out other special characters */
 482       if (quoted != 1 && words[*offset] == '$')
 483         {
 484           error = parse_dollars (word, word_length, max_length, words,
 485                                  offset, flags, &glob_list, ifs, ifs_white,
 486                                  quoted == 2);
 487           if (error)
 488             goto tidy_up;
 489
 490           continue;
 491         }
 492       else if (words[*offset] == '\\')
 493         {
 494           if (quoted)
 495             error = parse_qtd_backslash (word, word_length, max_length,
 496                                          words, offset);
 497           else
 498             error = parse_backslash (word, word_length, max_length,
 499                                      words, offset);
 500
 501           if (error)
 502             goto tidy_up;
 503
 504           continue;
 505         }
 506
 507       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 508       if (*word == NULL)
 509         goto tidy_up;
 510     }
 511
 512   /* Don't forget to re-parse the character we stopped at. */
 513   --*offset;
 514
 515   /* Glob the words */
 516   error = w_addword (&glob_list, *word);
 517   *word = w_newword (word_length, max_length);
 518   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 519     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 520                            max_length, pwordexp, ifs, ifs_white);
 521
 522   /* Now tidy up */
 523 tidy_up:
 524   wordfree (&glob_list);
 525   return error;
 526 }
 527
 528 static int
 529 internal_function
 530 parse_squote (char **word, size_t *word_length, size_t *max_length,
 531               const char *words, size_t *offset)
 532 {
 533   /* We are poised just after a single quote */
 534   for (; words[*offset]; ++(*offset))
 535     {
 536       if (words[*offset] != '\'')
 537         {
 538           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 539           if (*word == NULL)
 540             return WRDE_NOSPACE;
 541         }
 542       else return 0;
 543     }
 544
 545   /* Unterminated string */
 546   return WRDE_SYNTAX;
 547 }
 548
 549 /* Functions to evaluate an arithmetic expression */
 550 static int
 551 internal_function
 552 eval_expr_val (char **expr, long int *result)
 553 {
 554   int sgn = +1;
 555   char *digit;
 556
 557   /* Skip white space */
 558   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 559
 560   switch (*digit)
 561     {
 562     case '(':
 563
 564       /* Scan for closing paren */
 565       for (++digit; **expr && **expr != ')'; ++(*expr));
 566
 567       /* Is there one? */
 568       if (!**expr)
 569         return WRDE_SYNTAX;
 570
 571       *(*expr)++ = 0;
 572
 573       if (eval_expr (digit, result))
 574         return WRDE_SYNTAX;
 575
 576       return 0;
 577
 578     case '+':   /* Positive value */
 579       ++digit;
 580       break;
 581
 582     case '-':   /* Negative value */
 583       ++digit;
 584       sgn = -1;
 585       break;
 586
 587     default:
 588       if (!isdigit (*digit))
 589         return WRDE_SYNTAX;
 590     }
 591
 592   *result = 0;
 593   for (; *digit && isdigit (*digit); ++digit)
 594     *result = (*result * 10) + (*digit - '0');
 595
 596   *expr = digit;
 597   *result *= sgn;
 598   return 0;
 599 }
 600
 601 static int
 602 internal_function
 603 eval_expr_multdiv (char **expr, long int *result)
 604 {
 605   long int arg;
 606
 607   /* Read a Value */
 608   if (eval_expr_val (expr, result) != 0)
 609     return WRDE_SYNTAX;
 610
 611   while (**expr)
 612     {
 613       /* Skip white space */
 614       for (; *expr && **expr && isspace (**expr); ++(*expr));
 615
 616       if (**expr == '*')
 617         {
 618           ++(*expr);
 619           if (eval_expr_val (expr, &arg) != 0)
 620             return WRDE_SYNTAX;
 621
 622           *result *= arg;
 623         }
 624       else if (**expr == '/')
 625         {
 626           ++(*expr);
 627           if (eval_expr_val (expr, &arg) != 0)
 628             return WRDE_SYNTAX;
 629
 630           *result /= arg;
 631         }
 632       else break;
 633     }
 634
 635   return 0;
 636 }
 637
 638 static int
 639 internal_function
 640 eval_expr (char *expr, long int *result)
 641 {
 642   long int arg;
 643
 644   /* Read a Multdiv */
 645   if (eval_expr_multdiv (&expr, result) != 0)
 646     return WRDE_SYNTAX;
 647
 648   while (*expr)
 649     {
 650       /* Skip white space */
 651       for (; expr && *expr && isspace (*expr); ++expr);
 652
 653       if (*expr == '+')
 654         {
 655           ++expr;
 656           if (eval_expr_multdiv (&expr, &arg) != 0)
 657             return WRDE_SYNTAX;
 658
 659           *result += arg;
 660         }
 661       else if (*expr == '-')
 662         {
 663           ++expr;
 664           if (eval_expr_multdiv (&expr, &arg) != 0)
 665             return WRDE_SYNTAX;
 666
 667           *result -= arg;
 668         }
 669       else break;
 670     }
 671
 672   return 0;
 673 }
 674
 675 static int
 676 internal_function
 677 parse_arith (char **word, size_t *word_length, size_t *max_length,
 678              const char *words, size_t *offset, int flags, int bracket)
 679 {
 680   /* We are poised just after "$((" or "$[" */
 681   int error;
 682   int paren_depth = 1;
 683   size_t expr_length;
 684   size_t expr_maxlen;
 685   char *expr;
 686
 687   expr = w_newword (&expr_length, &expr_maxlen);
 688   for (; words[*offset]; ++(*offset))
 689     {
 690       switch (words[*offset])
 691         {
 692         case '$':
 693           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 694                                  words, offset, flags, NULL, NULL, NULL, 1);
 695           /* The ``1'' here is to tell parse_dollars not to
 696            * split the fields.
 697            */
 698           if (error)
 699             {
 700               free (expr);
 701               return error;
 702             }
 703           break;
 704
 705         case '`':
 706           (*offset)++;
 707           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 708                                   words, offset, flags, NULL, NULL, NULL);
 709           /* The first NULL here is to tell parse_backtick not to
 710            * split the fields.
 711            */
 712           if (error)
 713             {
 714               free (expr);
 715               return error;
 716             }
 717           break;
 718
 719         case '\\':
 720           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 721                                        words, offset);
 722           if (error)
 723             {
 724               free (expr);
 725               return error;
 726             }
 727           /* I think that a backslash within an
 728            * arithmetic expansion is bound to
 729            * cause an error sooner or later anyway though.
 730            */
 731           break;
 732
 733         case ')':
 734           if (--paren_depth == 0)
 735             {
 736               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 737               long int numresult = 0;
 738               long long int convertme;
 739
 740               if (bracket || words[1 + *offset] != ')')
 741                 return WRDE_SYNTAX;
 742
 743               ++(*offset);
 744
 745               /* Go - evaluate. */
 746               if (*expr && eval_expr (expr, &numresult) != 0)
 747                 return WRDE_SYNTAX;
 748
 749               if (numresult < 0)
 750                 {
 751                   convertme = -numresult;
 752                   *word = w_addchar (*word, word_length, max_length, '-');
 753                   if (!*word)
 754                     {
 755                       free (expr);
 756                       return WRDE_NOSPACE;
 757                     }
 758                 }
 759               else
 760                 convertme = numresult;
 761
 762               result[20] = '\0';
 763               *word = w_addstr (*word, word_length, max_length,
 764                                 _itoa (convertme, &result[20], 10, 0));
 765               free (expr);
 766               return *word ? 0 : WRDE_NOSPACE;
 767             }
 768           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 769           if (expr == NULL)
 770             return WRDE_NOSPACE;
 771
 772           break;
 773
 774         case ']':
 775           if (bracket && paren_depth == 1)
 776             {
 777               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 778               long int numresult = 0;
 779
 780               /* Go - evaluate. */
 781               if (*expr && eval_expr (expr, &numresult) != 0)
 782                 return WRDE_SYNTAX;
 783
 784               result[20] = '\0';
 785               *word = w_addstr (*word, word_length, max_length,
 786                                 _itoa_word (numresult, &result[20], 10, 0));
 787               free (expr);
 788               return *word ? 0 : WRDE_NOSPACE;
 789             }
 790
 791           free (expr);
 792           return WRDE_SYNTAX;
 793
 794         case '\n':
 795         case ';':
 796         case '{':
 797         case '}':
 798           free (expr);
 799           return WRDE_BADCHAR;
 800
 801         case '(':
 802           ++paren_depth;
 803         default:
 804           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 805           if (expr == NULL)
 806             return WRDE_NOSPACE;
 807         }
 808     }
 809
 810   /* Premature end */
 811   free (expr);
 812   return WRDE_SYNTAX;
 813 }
 814
 815 /* Function to execute a command and retrieve the results */
 816 /* pwordexp contains NULL if field-splitting is forbidden */
 817 static int
 818 internal_function
 819 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 820            int flags, wordexp_t *pwordexp, const char *ifs,
 821            const char *ifs_white)
 822 {
 823   int fildes[2];
 824   int bufsize = 128;
 825   int buflen;
 826   int i;
 827   char *buffer;
 828   pid_t pid;
 829   int keep_empty_word = 0;
 830
 831   /* Don't fork() unless necessary */
 832   if (!comm || !*comm)
 833     return 0;
 834
 835   if (__pipe (fildes))
 836     /* Bad */
 837     return WRDE_NOSPACE;
 838
 839   if ((pid = __fork ()) < 0)
 840     {
 841       /* Bad */
 842       return WRDE_NOSPACE;
 843     }
 844
 845   if (pid == 0)
 846     {
 847       /* Child */
 848       const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 849
 850       /* Redirect output.  */
 851       __dup2 (fildes[1], 1);
 852       __close (fildes[1]);
 853
 854       /* Redirect stderr to /dev/null if we have to.  */
 855       if ((flags & WRDE_SHOWERR) == 0)
 856         {
 857           int fd;
 858           __close (2);
 859           fd = __open (_PATH_DEVNULL, O_WRONLY);
 860           if (fd >= 0 && fd != 2)
 861             {
 862               __dup2 (fd, 2);
 863               __close (fd);
 864             }
 865         }
 866
 867       __close (fildes[0]);
 868       __execve (_PATH_BSHELL, (char *const *) args, __environ);
 869
 870       /* Bad.  What now?  */
 871       abort ();
 872     }
 873
 874   /* Parent */
 875
 876   __close (fildes[1]);
 877   buffer = __alloca (bufsize);
 878
 879   if (!pwordexp)
 880     { /* Quoted - no field splitting */
 881
 882       while (1)
 883         {
 884           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 885             {
 886               if (__waitpid (pid, NULL, WNOHANG) == 0)
 887                 continue;
 888               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 889                 break;
 890             }
 891
 892           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 893           if (*word == NULL)
 894             {
 895               __kill (pid, SIGKILL);
 896               __waitpid (pid, NULL, 0);
 897               __close (fildes[0]);
 898               return WRDE_NOSPACE;
 899             }
 900         }
 901     }
 902   else
 903     /* Not quoted - split fields */
 904     {
 905       int copying = 0;
 906       /* 'copying' is:
 907        *  0 when searching for first character in a field not IFS white space
 908        *  1 when copying the text of a field
 909        *  2 when searching for possible non-whitespace IFS
 910        */
 911
 912       while (1)
 913         {
 914           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 915             {
 916               if (__waitpid (pid, NULL, WNOHANG) == 0)
 917                 continue;
 918               if ((__read (fildes[0], buffer, bufsize)) < 1)
 919                 break;
 920             }
 921
 922           for (i = 0; i < buflen; ++i)
 923             {
 924               if (strchr (ifs, buffer[i]) != NULL)
 925                 {
 926                   /* Current character is IFS */
 927                   if (strchr (ifs_white, buffer[i]) == NULL)
 928                     {
 929                       /* Current character is IFS but not whitespace */
 930
 931                       /* After this delimiter, another field must result.
 932                        * Make a note. */
 933                       keep_empty_word = 1;
 934
 935                       if (copying == 2)
 936                         {
 937                           /*            current character
 938                            *                   |
 939                            *                   V
 940                            * eg: text<space><comma><space>moretext
 941                            *
 942                            * So, strip whitespace IFS (like at the start)
 943                            */
 944                           copying = 0;
 945                           continue;
 946                         }
 947
 948                       copying = 0;
 949                       /* fall through and delimit field.. */
 950                     }
 951                   else
 952                     {
 953                       /* Current character is IFS white space */
 954
 955                       /* If not copying a field, ignore it */
 956                       if (copying != 1)
 957                         continue;
 958
 959                       /* End of field (search for non-ws IFS afterwards) */
 960                       copying = 2;
 961                     }
 962
 963                   /* First IFS white space, or IFS non-whitespace.
 964                    * Delimit the field.  Nulls are converted by w_addword. */
 965                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
 966                     {
 967                       __kill (pid, SIGKILL);
 968                       __waitpid (pid, NULL, 0);
 969                       __close (fildes[0]);
 970                       return WRDE_NOSPACE;
 971                     }
 972
 973                   if (keep_empty_word)
 974                     *word = w_emptyword (word_length, max_length);
 975                   else
 976                     *word = w_newword (word_length, max_length);
 977                   /* fall back round the loop.. */
 978                 }
 979               else
 980                 {
 981                   /* Not IFS character */
 982                   copying = 1;
 983
 984                   if (buffer[i] != '\n')
 985                     keep_empty_word = 0;
 986
 987                   *word = w_addchar (*word, word_length, max_length,
 988                                      buffer[i]);
 989                   if (*word == NULL)
 990                     {
 991                       __kill (pid, SIGKILL);
 992                       __waitpid (pid, NULL, 0);
 993                       __close (fildes[0]);
 994                       return WRDE_NOSPACE;
 995                     }
 996                 }
 997             }
 998         }
 999     }
1000
1001   /* Bash chops off trailing newlines, which seems sensible.  */
1002   while (*word_length > 0 && (*word)[*word_length - 1] == '\n')
1003     {
1004       (*word)[--*word_length] = '\0';
1005
1006       /* If the last word was entirely newlines, and the previous word
1007        * wasn't delimited with IFS non-whitespace, turn it into a new word
1008        * which can be ignored if there's nothing following it. */
1009       if (!keep_empty_word && *word_length == 0)
1010         {
1011           free (*word);
1012           *word = w_newword (word_length, max_length);
1013         }
1014     }
1015
1016   __close (fildes[0]);
1017   return 0;
1018 }
1019
1020 static int
1021 internal_function
1022 parse_comm (char **word, size_t *word_length, size_t *max_length,
1023             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1024             const char *ifs, const char *ifs_white)
1025 {
1026   /* We are poised just after "$(" */
1027   int paren_depth = 1;
1028   int error = 0;
1029   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1030   size_t comm_length;
1031   size_t comm_maxlen;
1032   char *comm = w_newword (&comm_length, &comm_maxlen);
1033
1034   for (; words[*offset]; ++(*offset))
1035     {
1036       switch (words[*offset])
1037         {
1038         case '\'':
1039           if (quoted == 0)
1040             quoted = 1;
1041           else if (quoted == 1)
1042             quoted = 0;
1043
1044           break;
1045
1046         case '"':
1047           if (quoted == 0)
1048             quoted = 2;
1049           else if (quoted == 2)
1050             quoted = 0;
1051
1052           break;
1053
1054         case ')':
1055           if (!quoted && --paren_depth == 0)
1056             {
1057               /* Go -- give script to the shell */
1058               if (comm)
1059                 {
1060                   error = exec_comm (comm, word, word_length, max_length,
1061                                      flags, pwordexp, ifs, ifs_white);
1062                   free (comm);
1063                 }
1064
1065               return error;
1066             }
1067
1068           /* This is just part of the script */
1069           break;
1070
1071         case '(':
1072           if (!quoted)
1073             ++paren_depth;
1074         }
1075
1076       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1077       if (comm == NULL)
1078         return WRDE_NOSPACE;
1079     }
1080
1081   /* Premature end */
1082   if (comm)
1083     free (comm);
1084
1085   return WRDE_SYNTAX;
1086 }
1087
1088 static int
1089 internal_function
1090 parse_param (char **word, size_t *word_length, size_t *max_length,
1091              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1092              const char *ifs, const char *ifs_white, int quoted)
1093 {
1094   /* We are poised just after "$" */
1095   enum action
1096   {
1097     ACT_NONE,
1098     ACT_RP_SHORT_LEFT = '#',
1099     ACT_RP_LONG_LEFT = 'L',
1100     ACT_RP_SHORT_RIGHT = '%',
1101     ACT_RP_LONG_RIGHT = 'R',
1102     ACT_NULL_ERROR = '?',
1103     ACT_NULL_SUBST = '-',
1104     ACT_NONNULL_SUBST = '+',
1105     ACT_NULL_ASSIGN = '='
1106   };
1107   size_t env_length;
1108   size_t env_maxlen;
1109   size_t pat_length;
1110   size_t pat_maxlen;
1111   size_t start = *offset;
1112   char *env;
1113   char *pattern;
1114   char *value = NULL;
1115   enum action action = ACT_NONE;
1116   int depth = 0;
1117   int colon_seen = 0;
1118   int seen_hash = 0;
1119   int free_value = 0;
1120   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1121   int error;
1122   int special = 0;
1123   char buffer[21];
1124   int brace = words[*offset] == '{';
1125
1126   env = w_newword (&env_length, &env_maxlen);
1127   pattern = w_newword (&pat_length, &pat_maxlen);
1128
1129   if (brace)
1130     ++*offset;
1131
1132   /* First collect the parameter name. */
1133
1134   if (words[*offset] == '#')
1135     {
1136       seen_hash = 1;
1137       if (!brace)
1138         goto envsubst;
1139       ++*offset;
1140     }
1141
1142   if (isalpha (words[*offset]) || words[*offset] == '_')
1143     {
1144       /* Normal parameter name. */
1145       do
1146         {
1147           env = w_addchar (env, &env_length, &env_maxlen,
1148                            words[*offset]);
1149           if (env == NULL)
1150             goto no_space;
1151         }
1152       while (isalnum (words[++*offset]) || words[*offset] == '_');
1153     }
1154   else if (isdigit (words[*offset]))
1155     {
1156       /* Numeric parameter name. */
1157       special = 1;
1158       do
1159         {
1160           env = w_addchar (env, &env_length, &env_maxlen,
1161                            words[*offset]);
1162           if (env == NULL)
1163             goto no_space;
1164           if (!brace)
1165             goto envsubst;
1166         }
1167       while (isdigit(words[++*offset]));
1168     }
1169   else if (strchr ("*@$", words[*offset]) != NULL)
1170     {
1171       /* Special parameter. */
1172       special = 1;
1173       env = w_addchar (env, &env_length, &env_maxlen,
1174                        words[*offset]);
1175       if (env == NULL)
1176         goto no_space;
1177       ++*offset;
1178     }
1179   else
1180     {
1181       if (brace)
1182         goto syntax;
1183     }
1184
1185   if (brace)
1186     {
1187       /* Check for special action to be applied to the value. */
1188       switch (words[*offset])
1189         {
1190         case '}':
1191           /* Evaluate. */
1192           goto envsubst;
1193
1194         case '#':
1195           action = ACT_RP_SHORT_LEFT;
1196           if (words[1 + *offset] == '#')
1197             {
1198               ++*offset;
1199               action = ACT_RP_LONG_LEFT;
1200             }
1201           break;
1202
1203         case '%':
1204           action = ACT_RP_SHORT_RIGHT;
1205           if (words[1 + *offset] == '%')
1206             {
1207               ++*offset;
1208               action = ACT_RP_LONG_RIGHT;
1209             }
1210           break;
1211
1212         case ':':
1213           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1214             goto syntax;
1215
1216           colon_seen = 1;
1217           action = words[++*offset];
1218           break;
1219
1220         case '-':
1221         case '=':
1222         case '?':
1223         case '+':
1224           action = words[*offset];
1225           break;
1226
1227         default:
1228           goto syntax;
1229         }
1230
1231       /* Now collect the pattern. */
1232       ++*offset;
1233       for (; words[*offset]; ++(*offset))
1234         {
1235           switch (words[*offset])
1236             {
1237             case '{':
1238               if (!pattern_is_quoted)
1239                 ++depth;
1240               break;
1241
1242             case '}':
1243               if (!pattern_is_quoted)
1244                 {
1245                   if (depth == 0)
1246                     goto envsubst;
1247                   --depth;
1248                 }
1249               break;
1250
1251             case '\\':
1252               if (!pattern_is_quoted && words[++*offset] == '\0')
1253                 goto syntax;
1254               break;
1255
1256             case '\'':
1257               if (pattern_is_quoted == 0)
1258                 pattern_is_quoted = 1;
1259               else if (pattern_is_quoted == 1)
1260                 pattern_is_quoted = 0;
1261
1262               break;
1263
1264             case '"':
1265               if (pattern_is_quoted == 0)
1266                 pattern_is_quoted = 2;
1267               else if (pattern_is_quoted == 2)
1268                 pattern_is_quoted = 0;
1269
1270               break;
1271             }
1272
1273           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1274                                words[*offset]);
1275           if (pattern == NULL)
1276             goto no_space;
1277         }
1278     }
1279
1280   /* End of input string -- remember to reparse the character that we
1281    * stopped at.  */
1282   --(*offset);
1283
1284 envsubst:
1285   if (words[start] == '{' && words[*offset] != '}')
1286     goto syntax;
1287
1288   if (env == NULL)
1289     {
1290       if (seen_hash)
1291         {
1292           /* $# expands to the number of positional parameters */
1293           buffer[20] = '\0';
1294           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1295           seen_hash = 0;
1296         }
1297       else
1298         {
1299           /* Just $ on its own */
1300           *offset = start - 1;
1301           *word = w_addchar (*word, word_length, max_length, '$');
1302           return *word ? 0 : WRDE_NOSPACE;
1303         }
1304     }
1305   /* Is it a numeric parameter? */
1306   else if (isdigit (env[0]))
1307     {
1308       int n = atoi (env);
1309
1310       if (n >= __libc_argc)
1311         /* Substitute NULL. */
1312         value = NULL;
1313       else
1314         /* Replace with appropriate positional parameter. */
1315         value = __libc_argv[n];
1316     }
1317   /* Is it a special parameter? */
1318   else if (special)
1319     {
1320       /* Is it `$$'? */
1321       if (*env == '$')
1322         {
1323           buffer[20] = '\0';
1324           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1325         }
1326       /* Is it `${#*}' or `${#@}'? */
1327       else if ((*env == '*' || *env == '@') && seen_hash)
1328         {
1329           buffer[20] = '\0';
1330           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1331                               &buffer[20], 10, 0);
1332           *word = w_addstr (*word, word_length, max_length, value);
1333           free (env);
1334           return *word ? 0 : WRDE_NOSPACE;
1335         }
1336       /* Is it `$*' or `$@' (unquoted) ? */
1337       else if (*env == '*' || (*env == '@' && !quoted))
1338         {
1339           size_t plist_len = 0;
1340           int p;
1341           char *end;
1342
1343           /* Build up value parameter by parameter (copy them) */
1344           for (p = 1; __libc_argv[p]; ++p)
1345             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1346           value = malloc (plist_len);
1347           if (value == NULL)
1348             goto no_space;
1349           end = value;
1350           *end = 0;
1351           for (p = 1; __libc_argv[p]; ++p)
1352             {
1353               if (p > 1)
1354                 *end++ = ' ';
1355               end = __stpcpy (end, __libc_argv[p]);
1356             }
1357
1358           free_value = 1;
1359         }
1360       else
1361         {
1362           /* Must be a quoted `$@' */
1363           assert (*env == '@' && quoted);
1364
1365           /* Each parameter is a separate word ("$@") */
1366           if (__libc_argc == 2)
1367             value = __libc_argv[1];
1368           else if (__libc_argc > 2)
1369             {
1370               int p;
1371
1372               /* Append first parameter to current word. */
1373               value = w_addstr (*word, word_length, max_length,
1374                                 __libc_argv[1]);
1375               if (value == NULL || w_addword (pwordexp, value))
1376                 goto no_space;
1377
1378               for (p = 2; __libc_argv[p + 1]; p++)
1379                 {
1380                   char *newword = __strdup (__libc_argv[p]);
1381                   if (newword == NULL || w_addword (pwordexp, newword))
1382                     goto no_space;
1383                 }
1384
1385               /* Start a new word with the last parameter. */
1386               *word = w_newword (word_length, max_length);
1387               value = __libc_argv[p];
1388             }
1389           else
1390             {
1391               free (env);
1392               free (pattern);
1393               return 0;
1394             }
1395         }
1396     }
1397   else
1398     value = getenv (env);
1399
1400   if (value == NULL && (flags & WRDE_UNDEF))
1401     {
1402       /* Variable not defined. */
1403       if (pattern)
1404         free (pattern);
1405       if (env)
1406         free (env);
1407       return WRDE_BADVAL;
1408     }
1409
1410   if (action != ACT_NONE)
1411     {
1412       switch (action)
1413         {
1414         case ACT_RP_SHORT_LEFT:
1415         case ACT_RP_LONG_LEFT:
1416         case ACT_RP_SHORT_RIGHT:
1417         case ACT_RP_LONG_RIGHT:
1418           {
1419             char *p;
1420             char c;
1421             char *end;
1422
1423             if (value == NULL || pattern == NULL || *pattern == '\0')
1424               break;
1425
1426             end = value + strlen (value);
1427
1428             switch (action)
1429               {
1430               case ACT_RP_SHORT_LEFT:
1431                 for (p = value; p <= end; ++p)
1432                   {
1433                     c = *p;
1434                     *p = '\0';
1435                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1436                       {
1437                         *p = c;
1438                         if (free_value)
1439                           {
1440                             char *newval = __strdup (p);
1441                             if (newval == NULL)
1442                               {
1443                                 free (value);
1444                                 goto no_space;
1445                               }
1446                             free (value);
1447                             value = newval;
1448                           }
1449                         else
1450                           value = p;
1451                         break;
1452                       }
1453                     *p = c;
1454                   }
1455
1456                 break;
1457
1458               case ACT_RP_LONG_LEFT:
1459                 for (p = end; p >= value; --p)
1460                   {
1461                     c = *p;
1462                     *p = '\0';
1463                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1464                       {
1465                         *p = c;
1466                         if (free_value)
1467                           {
1468                             char *newval = __strdup (p);
1469                             if (newval == NULL)
1470                               {
1471                                 free (value);
1472                                 goto no_space;
1473                               }
1474                             free (value);
1475                             value = newval;
1476                           }
1477                         else
1478                           value = p;
1479                         break;
1480                       }
1481                     *p = c;
1482                   }
1483
1484                 break;
1485
1486               case ACT_RP_SHORT_RIGHT:
1487                 for (p = end; p >= value; --p)
1488                   {
1489                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1490                       {
1491                         char *newval;
1492                         newval = malloc (p - value + 1);
1493                         if (newval == NULL)
1494                           goto no_space;
1495                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1496                         if (free_value)
1497                           free (value);
1498                         value = newval;
1499                         free_value = 1;
1500                         break;
1501                       }
1502                   }
1503
1504                 break;
1505
1506               case ACT_RP_LONG_RIGHT:
1507                 for (p = value; p <= end; ++p)
1508                   {
1509                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1510                       {
1511                         char *newval;
1512                         newval = malloc (p - value + 1);
1513                         if (newval == NULL)
1514                           goto no_space;
1515                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1516                         if (free_value)
1517                           free (value);
1518                         value = newval;
1519                         free_value = 1;
1520                         break;
1521                       }
1522                   }
1523
1524                 break;
1525
1526               default:
1527                 break;
1528               }
1529
1530             break;
1531           }
1532
1533         case ACT_NULL_ERROR:
1534           if (value && *value)
1535             /* Substitute parameter */
1536             break;
1537
1538           if (!colon_seen && value)
1539             /* Substitute NULL */
1540             error = 0;
1541           else if (*pattern)
1542             {
1543               /* Expand 'pattern' and write it to stderr */
1544               wordexp_t we;
1545
1546               error = wordexp (pattern, &we, flags);
1547
1548               if (error == 0)
1549                 {
1550                   int i;
1551
1552                   fprintf (stderr, "%s:", env);
1553
1554                   for (i = 0; i < we.we_wordc; ++i)
1555                     {
1556                       fprintf (stderr, " %s", we.we_wordv[i]);
1557                     }
1558
1559                   fprintf (stderr, "\n");
1560                   error = WRDE_BADVAL;
1561                 }
1562
1563               wordfree (&we);
1564             }
1565           else
1566             {
1567               fprintf (stderr, "%s: parameter null or not set\n", env);
1568               error = WRDE_BADVAL;
1569             }
1570
1571           free (env);
1572           free (pattern);
1573           if (free_value)
1574             free (value);
1575           return error;
1576
1577         case ACT_NULL_SUBST:
1578           if (value && *value)
1579             /* Substitute parameter */
1580             break;
1581
1582           if (!colon_seen && value)
1583             {
1584               /* Substitute NULL */
1585               free (env);
1586               free (pattern);
1587               if (free_value)
1588                 free (value);
1589               return 0;
1590             }
1591
1592         subst_word:
1593           {
1594             /* Substitute word */
1595             wordexp_t we;
1596             int i;
1597
1598             if (free_value)
1599               free (value);
1600
1601             if (quoted)
1602               {
1603                 /* No field-splitting is allowed, so imagine
1604                    quotes around the word.  */
1605                 char *qtd_pattern = malloc (3 + strlen (pattern));
1606                 if (qtd_pattern)
1607                   sprintf (qtd_pattern, "\"%s\"", pattern);
1608                 free (pattern);
1609                 pattern = qtd_pattern;
1610               }
1611
1612             if (pattern == NULL && (pattern = __strdup ("")) == NULL)
1613               goto no_space;
1614
1615             error = wordexp (pattern, &we, flags);
1616             if (error)
1617               {
1618                 free (env);
1619                 free (pattern);
1620                 return error;
1621               }
1622
1623             /* Fingers crossed that the quotes worked.. */
1624             assert (!quoted || we.we_wordc == 1);
1625
1626             /* Substitute */
1627             for (i = 0; i < we.we_wordc; ++i)
1628               if (w_addword (pwordexp, __strdup (we.we_wordv[i]))
1629                   == WRDE_NOSPACE)
1630                 break;
1631
1632             if (i < we.we_wordc)
1633               {
1634                 /* Ran out of space */
1635                 wordfree (&we);
1636                 goto no_space;
1637               }
1638
1639             if (action == ACT_NULL_ASSIGN)
1640               {
1641                 char *words;
1642                 char *cp;
1643                 size_t words_size = 0;
1644
1645                 if (special)
1646                   /* Cannot assign special parameters. */
1647                   goto syntax;
1648
1649                 for (i = 0; i < we.we_wordc; i++)
1650                   words_size += strlen (we.we_wordv[i]) + 1; /* for <space> */
1651                 words_size++;
1652
1653                 cp = words = __alloca (words_size);
1654                 *words = 0;
1655                 for (i = 0; i < we.we_wordc - 1; i++)
1656                   {
1657                     cp = __stpcpy (cp, we.we_wordv[i]);
1658                     *cp++ = ' ';
1659                   }
1660
1661                 strcpy (cp, we.we_wordv[i]);
1662
1663                 /* Also assign */
1664                 setenv (env, words, 1);
1665               }
1666
1667             wordfree (&we);
1668             free (env);
1669             free (pattern);
1670             return 0;
1671           }
1672
1673         case ACT_NONNULL_SUBST:
1674           if (value && *value)
1675             goto subst_word;
1676
1677           if (!colon_seen && value)
1678             goto subst_word;
1679
1680           /* Substitute NULL */
1681           free (env);
1682           free (pattern);
1683           if (free_value)
1684             free (value);
1685           return 0;
1686
1687         case ACT_NULL_ASSIGN:
1688           if (value && *value)
1689             /* Substitute parameter */
1690             break;
1691
1692           if (!colon_seen && value)
1693             {
1694               /* Substitute NULL */
1695               free (env);
1696               free (pattern);
1697               if (free_value)
1698                 free (value);
1699               return 0;
1700             }
1701
1702           /* This checks for '=' so it knows to assign */
1703           goto subst_word;
1704
1705         default:
1706           assert (! "Unrecognised action!");
1707         }
1708     }
1709
1710   free (env);
1711   free (pattern);
1712
1713   if (seen_hash)
1714     {
1715       char param_length[21];
1716       param_length[20] = '\0';
1717       *word = w_addstr (*word, word_length, max_length,
1718                         _itoa_word (value ? strlen (value) : 0,
1719                                     &param_length[20], 10, 0));
1720       if (free_value)
1721         {
1722           assert (value != NULL);
1723           free (value);
1724         }
1725
1726       return *word ? 0 : WRDE_NOSPACE;
1727     }
1728
1729   if (value == NULL)
1730     return 0;
1731
1732   if (quoted || !pwordexp)
1733     {
1734       /* Quoted - no field split */
1735       *word = w_addstr (*word, word_length, max_length, value);
1736       if (free_value)
1737         free (value);
1738
1739       return *word ? 0 : WRDE_NOSPACE;
1740     }
1741   else
1742     {
1743       /* Need to field-split */
1744       char *value_copy = __strdup (value); /* Don't modify value */
1745       char *field_begin = value_copy;
1746       int seen_nonws_ifs = 0;
1747
1748       if (free_value)
1749         free (value);
1750
1751       if (value_copy == NULL)
1752         goto no_space;
1753
1754       do
1755         {
1756           char *field_end = field_begin;
1757           char *next_field;
1758
1759           /* If this isn't the first field, start a new word */
1760           if (field_begin != value_copy)
1761             {
1762               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1763                 {
1764                   free (value_copy);
1765                   goto no_space;
1766                 }
1767
1768               *word = w_emptyword (word_length, max_length);
1769             }
1770
1771           /* Skip IFS whitespace before the field */
1772           field_begin += strspn (field_begin, ifs_white);
1773
1774           if (!seen_nonws_ifs && *field_begin == 0)
1775             /* Nothing but whitespace */
1776             break;
1777
1778           /* Search for the end of the field */
1779           field_end = field_begin + strcspn (field_begin, ifs);
1780
1781           /* Set up pointer to the character after end of field and
1782              skip whitespace IFS after it. */
1783           next_field = field_end + strspn (field_end, ifs_white);
1784
1785           /* Skip at most one non-whitespace IFS character after the field */
1786           seen_nonws_ifs = 0;
1787           if (*next_field && strchr (ifs, *next_field))
1788             {
1789               seen_nonws_ifs = 1;
1790               next_field++;
1791             }
1792
1793           /* Null-terminate it */
1794           *field_end = 0;
1795
1796           /* Tag a copy onto the current word */
1797           *word = w_addstr (*word, word_length, max_length, field_begin);
1798
1799           if (*word == NULL && *field_begin != '\0')
1800             {
1801               free (value_copy);
1802               goto no_space;
1803             }
1804
1805           field_begin = next_field;
1806         }
1807       while (seen_nonws_ifs || *field_begin);
1808
1809       free (value_copy);
1810     }
1811
1812   return 0;
1813
1814 no_space:
1815   if (env)
1816     free (env);
1817
1818   if (pattern)
1819     free (pattern);
1820
1821   return WRDE_NOSPACE;
1822
1823 syntax:
1824   if (env)
1825     free (env);
1826
1827   if (pattern)
1828     free (pattern);
1829
1830   return WRDE_SYNTAX;
1831 }
1832
1833 static int
1834 internal_function
1835 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1836                const char *words, size_t *offset, int flags,
1837                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
1838                int quoted)
1839 {
1840   /* We are poised _at_ "$" */
1841   switch (words[1 + *offset])
1842     {
1843     case '"':
1844     case '\'':
1845     case 0:
1846       *word = w_addchar (*word, word_length, max_length, '$');
1847       return *word ? 0 : WRDE_NOSPACE;
1848
1849     case '(':
1850       if (words[2 + *offset] == '(')
1851         {
1852           /* Differentiate between $((1+3)) and $((echo);(ls)) */
1853           int i = 3 + *offset;
1854           int depth = 0;
1855           while (words[i] && !(depth == 0 && words[i] == ')'))
1856             {
1857               if (words[i] == '(')
1858                 ++depth;
1859               else if (words[i] == ')')
1860                 --depth;
1861
1862               ++i;
1863             }
1864
1865           if (words[i] == ')' && words[i + 1] == ')')
1866             {
1867               (*offset) += 3;
1868               /* Call parse_arith -- 0 is for "no brackets" */
1869               return parse_arith (word, word_length, max_length, words, offset,
1870                                   flags, 0);
1871             }
1872         }
1873
1874       if (flags & WRDE_NOCMD)
1875         return WRDE_CMDSUB;
1876
1877       (*offset) += 2;
1878       return parse_comm (word, word_length, max_length, words, offset, flags,
1879                          quoted? NULL : pwordexp, ifs, ifs_white);
1880
1881     case '[':
1882       (*offset) += 2;
1883       /* Call parse_arith -- 1 is for "brackets" */
1884       return parse_arith (word, word_length, max_length, words, offset, flags,
1885                           1);
1886
1887     case '{':
1888     default:
1889       ++(*offset);      /* parse_param needs to know if "{" is there */
1890       return parse_param (word, word_length, max_length, words, offset, flags,
1891                            pwordexp, ifs, ifs_white, quoted);
1892     }
1893 }
1894
1895 static int
1896 parse_backtick (char **word, size_t *word_length, size_t *max_length,
1897                 const char *words, size_t *offset, int flags,
1898                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
1899 {
1900   /* We are poised just after "`" */
1901   int error;
1902   int squoting = 0;
1903   size_t comm_length;
1904   size_t comm_maxlen;
1905   char *comm = w_newword (&comm_length, &comm_maxlen);
1906
1907   for (; words[*offset]; ++(*offset))
1908     {
1909       switch (words[*offset])
1910         {
1911         case '`':
1912           /* Go -- give the script to the shell */
1913           error = exec_comm (comm, word, word_length, max_length, flags,
1914                              pwordexp, ifs, ifs_white);
1915           free (comm);
1916           return error;
1917
1918         case '\\':
1919           if (squoting)
1920             {
1921               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
1922                                            words, offset);
1923
1924               if (error)
1925                 {
1926                   free (comm);
1927                   return error;
1928                 }
1929
1930               break;
1931             }
1932
1933           ++(*offset);
1934           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
1935                                    offset);
1936
1937           if (error)
1938             {
1939               free (comm);
1940               return error;
1941             }
1942
1943           break;
1944
1945         case '\'':
1946           squoting = 1 - squoting;
1947         default:
1948           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1949           if (comm == NULL)
1950             return WRDE_NOSPACE;
1951         }
1952     }
1953
1954   /* Premature end */
1955   free (comm);
1956   return WRDE_SYNTAX;
1957 }
1958
1959 static int
1960 internal_function
1961 parse_dquote (char **word, size_t *word_length, size_t *max_length,
1962               const char *words, size_t *offset, int flags,
1963               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
1964 {
1965   /* We are poised just after a double-quote */
1966   int error;
1967
1968   for (; words[*offset]; ++(*offset))
1969     {
1970       switch (words[*offset])
1971         {
1972         case '"':
1973           return 0;
1974
1975         case '$':
1976           error = parse_dollars (word, word_length, max_length, words, offset,
1977                                  flags, pwordexp, ifs, ifs_white, 1);
1978           /* The ``1'' here is to tell parse_dollars not to
1979            * split the fields.  It may need to, however ("$@").
1980            */
1981           if (error)
1982             return error;
1983
1984           break;
1985
1986         case '`':
1987           if (flags & WRDE_NOCMD)
1988             return WRDE_CMDSUB;
1989
1990           ++(*offset);
1991           error = parse_backtick (word, word_length, max_length, words,
1992                                   offset, flags, NULL, NULL, NULL);
1993           /* The first NULL here is to tell parse_backtick not to
1994            * split the fields.
1995            */
1996           if (error)
1997             return error;
1998
1999           break;
2000
2001         case '\\':
2002           error = parse_qtd_backslash (word, word_length, max_length, words,
2003                                        offset);
2004
2005           if (error)
2006             return error;
2007
2008           break;
2009
2010         default:
2011           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2012           if (*word == NULL)
2013             return WRDE_NOSPACE;
2014         }
2015     }
2016
2017   /* Unterminated string */
2018   return WRDE_SYNTAX;
2019 }
2020
2021 /*
2022  * wordfree() is to be called after pwordexp is finished with.
2023  */
2024
2025 void
2026 wordfree (wordexp_t *pwordexp)
2027 {
2028
2029   /* wordexp can set pwordexp to NULL */
2030   if (pwordexp && pwordexp->we_wordv)
2031     {
2032       char **wordv = pwordexp->we_wordv;
2033
2034       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2035         free (*wordv);
2036
2037       free (pwordexp->we_wordv);
2038       pwordexp->we_wordv = NULL;
2039     }
2040 }
2041
2042 /*
2043  * wordexp()
2044  */
2045
2046 int
2047 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2048 {
2049   size_t wordv_offset;
2050   size_t words_offset;
2051   size_t word_length;
2052   size_t max_length;
2053   char *word = w_newword (&word_length, &max_length);
2054   int error;
2055   char *ifs;
2056   char ifs_white[4];
2057   char **old_wordv = pwordexp->we_wordv;
2058   size_t old_wordc = (flags & WRDE_REUSE) ? pwordexp->we_wordc : 0;
2059
2060   if (flags & WRDE_REUSE)
2061     {
2062       /* Minimal implementation of WRDE_REUSE for now */
2063       wordfree (pwordexp);
2064       old_wordv = NULL;
2065     }
2066
2067   if (flags & WRDE_DOOFFS)
2068     {
2069       pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2070       if (pwordexp->we_wordv == NULL)
2071         return WRDE_NOSPACE;
2072     }
2073   else
2074     {
2075       pwordexp->we_wordv = calloc (1, sizeof (char *));
2076       if (pwordexp->we_wordv == NULL)
2077         return WRDE_NOSPACE;
2078
2079       pwordexp->we_offs = 0;
2080     }
2081
2082   if ((flags & WRDE_APPEND) == 0)
2083     pwordexp->we_wordc = 0;
2084
2085   wordv_offset = pwordexp->we_offs + pwordexp->we_wordc;
2086
2087   /* Find out what the field separators are.
2088    * There are two types: whitespace and non-whitespace.
2089    */
2090   ifs = getenv ("IFS");
2091
2092   if (!ifs)
2093     /* IFS unset - use <space><tab><newline>. */
2094     ifs = strcpy (ifs_white, " \t\n");
2095   else
2096     {
2097       char *ifsch = ifs;
2098       char *whch = ifs_white;
2099
2100       /* Start off with no whitespace IFS characters */
2101       ifs_white[0] = '\0';
2102
2103       while (*ifsch != '\0')
2104         {
2105           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2106             {
2107               /* Whitespace IFS.  See first whether it is already in our
2108                  collection.  */
2109               char *runp = ifs_white;
2110
2111               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2112                 ++runp;
2113
2114               if (runp == whch)
2115                 *whch++ = *ifsch;
2116             }
2117
2118           ++ifsch;
2119         }
2120       *whch = '\0';
2121     }
2122
2123   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2124     switch (words[words_offset])
2125       {
2126       case '\\':
2127         error = parse_backslash (&word, &word_length, &max_length, words,
2128                                  &words_offset);
2129
2130         if (error)
2131           goto do_error;
2132
2133         break;
2134
2135       case '$':
2136         error = parse_dollars (&word, &word_length, &max_length, words,
2137                                &words_offset, flags, pwordexp, ifs, ifs_white,
2138                                0);
2139
2140         if (error)
2141           goto do_error;
2142
2143         break;
2144
2145       case '`':
2146         if (flags & WRDE_NOCMD)
2147           return WRDE_CMDSUB;
2148
2149         ++words_offset;
2150         error = parse_backtick (&word, &word_length, &max_length, words,
2151                                 &words_offset, flags, pwordexp, ifs,
2152                                 ifs_white);
2153
2154         if (error)
2155           goto do_error;
2156
2157         break;
2158
2159       case '"':
2160         ++words_offset;
2161         error = parse_dquote (&word, &word_length, &max_length, words,
2162                               &words_offset, flags, pwordexp, ifs, ifs_white);
2163
2164         if (error)
2165           goto do_error;
2166
2167         break;
2168
2169       case '\'':
2170         ++words_offset;
2171         error = parse_squote (&word, &word_length, &max_length, words,
2172                               &words_offset);
2173
2174         if (error)
2175           goto do_error;
2176
2177         break;
2178
2179       case '~':
2180         error = parse_tilde (&word, &word_length, &max_length, words,
2181                              &words_offset, pwordexp->we_wordc);
2182
2183         if (error)
2184           goto do_error;
2185
2186         break;
2187
2188       case '*':
2189       case '[':
2190       case '?':
2191         error = parse_glob (&word, &word_length, &max_length, words,
2192                             &words_offset, flags, pwordexp, ifs, ifs_white);
2193
2194         if (error)
2195           goto do_error;
2196
2197         break;
2198
2199       default:
2200         /* Is it a word separator? */
2201         if (strchr (" \t", words[words_offset]) == NULL)
2202           {
2203             char ch = words[words_offset];
2204
2205             /* Not a word separator -- but is it a valid word char? */
2206             if (strchr ("\n|&;<>(){}", ch))
2207               {
2208                 /* Fail */
2209                 wordfree (pwordexp);
2210                 pwordexp->we_wordc = 0;
2211                 pwordexp->we_wordv = old_wordv;
2212                 return WRDE_BADCHAR;
2213               }
2214
2215             /* "Ordinary" character -- add it to word */
2216
2217             /* Convert IFS chars to blanks -- bash does this */
2218             if (strchr (ifs, ch))
2219               ch = ' ';
2220
2221             word = w_addchar (word, &word_length, &max_length,
2222                               ch);
2223             if (word == NULL)
2224               {
2225                 error = WRDE_NOSPACE;
2226                 goto do_error;
2227               }
2228
2229             break;
2230           }
2231
2232         /* If a word has been delimited, add it to the list. */
2233         if (word != NULL)
2234           {
2235             error = w_addword (pwordexp, word);
2236             if (error)
2237               goto do_error;
2238           }
2239
2240         word = w_newword (&word_length, &max_length);
2241       }
2242
2243   /* End of string */
2244
2245   /* There was a word separator at the end */
2246   if (word == NULL) /* i.e. w_newword */
2247     return 0;
2248
2249   /* There was no field separator at the end */
2250   return w_addword (pwordexp, word);
2251
2252 do_error:
2253   /* Error:
2254    *    free memory used (unless error is WRDE_NOSPACE), and
2255    *    set we_wordc and wd_wordv back to what they were.
2256    */
2257
2258   if (word != NULL)
2259     free (word);
2260
2261   if (error == WRDE_NOSPACE)
2262     return WRDE_NOSPACE;
2263
2264   wordfree (pwordexp);
2265   pwordexp->we_wordv = old_wordv;
2266   pwordexp->we_wordc = old_wordc;
2267   return error;
2268 }