posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2018 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, see
  18    <http://www.gnu.org/licenses/>.  */
  19
  20 #include <alloca.h>
  21 #include <ctype.h>
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <fnmatch.h>
  25 #include <glob.h>
  26 #include <libintl.h>
  27 #include <paths.h>
  28 #include <pwd.h>
  29 #include <signal.h>
  30 #include <stdbool.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <sys/param.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/types.h>
  39 #include <sys/wait.h>
  40 #include <unistd.h>
  41 #include <wchar.h>
  42 #include <wordexp.h>
  43 #include <kernel-features.h>
  44
  45 #include <libc-lock.h>
  46 #include <_itoa.h>
  47
  48 /* Undefine the following line for the production version.  */
  49 /* #define NDEBUG 1 */
  50 #include <assert.h>
  51
  52 /* Get some device information.  */
  53 #include <device-nrs.h>
  54
  55 /*
  56  * This is a recursive-descent-style word expansion routine.
  57  */
  58
  59 /* These variables are defined and initialized in the startup code.  */
  60 extern int __libc_argc attribute_hidden;
  61 extern char **__libc_argv attribute_hidden;
  62
  63 /* Some forward declarations */
  64 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  65                           const char *words, size_t *offset, int flags,
  66                           wordexp_t *pwordexp, const char *ifs,
  67                           const char *ifs_white, int quoted);
  68 static int parse_backtick (char **word, size_t *word_length,
  69                            size_t *max_length, const char *words,
  70                            size_t *offset, int flags, wordexp_t *pwordexp,
  71                            const char *ifs, const char *ifs_white);
  72 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  73                          const char *words, size_t *offset, int flags,
  74                          wordexp_t *pwordexp, const char *ifs,
  75                          const char *ifs_white);
  76 static int eval_expr (char *expr, long int *result);
  77
  78 /* The w_*() functions manipulate word lists. */
  79
  80 #define W_CHUNK (100)
  81
  82 /* Result of w_newword will be ignored if it's the last word. */
  83 static inline char *
  84 w_newword (size_t *actlen, size_t *maxlen)
  85 {
  86   *actlen = *maxlen = 0;
  87   return NULL;
  88 }
  89
  90 static char *
  91 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  92      /* (lengths exclude trailing zero) */
  93 {
  94   /* Add a character to the buffer, allocating room for it if needed.  */
  95
  96   if (*actlen == *maxlen)
  97     {
  98       char *old_buffer = buffer;
  99       assert (buffer == NULL || *maxlen != 0);
 100       *maxlen += W_CHUNK;
 101       buffer = (char *) realloc (buffer, 1 + *maxlen);
 102
 103       if (buffer == NULL)
 104         free (old_buffer);
 105     }
 106
 107   if (buffer != NULL)
 108     {
 109       buffer[*actlen] = ch;
 110       buffer[++(*actlen)] = '\0';
 111     }
 112
 113   return buffer;
 114 }
 115
 116 static char *
 117 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 118           size_t len)
 119 {
 120   /* Add a string to the buffer, allocating room for it if needed.
 121    */
 122   if (*actlen + len > *maxlen)
 123     {
 124       char *old_buffer = buffer;
 125       assert (buffer == NULL || *maxlen != 0);
 126       *maxlen += MAX (2 * len, W_CHUNK);
 127       buffer = realloc (old_buffer, 1 + *maxlen);
 128
 129       if (buffer == NULL)
 130         free (old_buffer);
 131     }
 132
 133   if (buffer != NULL)
 134     {
 135       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 136       *actlen += len;
 137     }
 138
 139   return buffer;
 140 }
 141
 142 static char *
 143 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 144      /* (lengths exclude trailing zero) */
 145 {
 146   /* Add a string to the buffer, allocating room for it if needed.
 147    */
 148   size_t len;
 149
 150   assert (str != NULL); /* w_addstr only called from this file */
 151   len = strlen (str);
 152
 153   return w_addmem (buffer, actlen, maxlen, str, len);
 154 }
 155
 156 static int
 157 w_addword (wordexp_t *pwordexp, char *word)
 158 {
 159   /* Add a word to the wordlist */
 160   size_t num_p;
 161   char **new_wordv;
 162   bool allocated = false;
 163
 164   /* Internally, NULL acts like "".  Convert NULLs to "" before
 165    * the caller sees them.
 166    */
 167   if (word == NULL)
 168     {
 169       word = __strdup ("");
 170       if (word == NULL)
 171         goto no_space;
 172       allocated = true;
 173     }
 174
 175   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 176   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 177   if (new_wordv != NULL)
 178     {
 179       pwordexp->we_wordv = new_wordv;
 180       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 181       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 182       return 0;
 183     }
 184
 185   if (allocated)
 186     free (word);
 187
 188 no_space:
 189   return WRDE_NOSPACE;
 190 }
 191
 192 /* The parse_*() functions should leave *offset being the offset in 'words'
 193  * to the last character processed.
 194  */
 195
 196 static int
 197 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 198                  const char *words, size_t *offset)
 199 {
 200   /* We are poised _at_ a backslash, not in quotes */
 201
 202   switch (words[1 + *offset])
 203     {
 204     case 0:
 205       /* Backslash is last character of input words */
 206       return WRDE_SYNTAX;
 207
 208     case '\n':
 209       ++(*offset);
 210       break;
 211
 212     default:
 213       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 214       if (*word == NULL)
 215         return WRDE_NOSPACE;
 216
 217       ++(*offset);
 218       break;
 219     }
 220
 221   return 0;
 222 }
 223
 224 static int
 225 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 226                      const char *words, size_t *offset)
 227 {
 228   /* We are poised _at_ a backslash, inside quotes */
 229
 230   switch (words[1 + *offset])
 231     {
 232     case 0:
 233       /* Backslash is last character of input words */
 234       return WRDE_SYNTAX;
 235
 236     case '\n':
 237       ++(*offset);
 238       break;
 239
 240     case '$':
 241     case '`':
 242     case '"':
 243     case '\\':
 244       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 245       if (*word == NULL)
 246         return WRDE_NOSPACE;
 247
 248       ++(*offset);
 249       break;
 250
 251     default:
 252       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 253       if (*word != NULL)
 254         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 255
 256       if (*word == NULL)
 257         return WRDE_NOSPACE;
 258
 259       ++(*offset);
 260       break;
 261     }
 262
 263   return 0;
 264 }
 265
 266 static int
 267 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 268              const char *words, size_t *offset, size_t wordc)
 269 {
 270   /* We are poised _at_ a tilde */
 271   size_t i;
 272
 273   if (*word_length != 0)
 274     {
 275       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 276         {
 277           if (!((*word)[*word_length - 1] == ':'
 278                 && strchr (*word, '=') && wordc == 0))
 279             {
 280               *word = w_addchar (*word, word_length, max_length, '~');
 281               return *word ? 0 : WRDE_NOSPACE;
 282             }
 283         }
 284     }
 285
 286   for (i = 1 + *offset; words[i]; i++)
 287     {
 288       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 289           words[i] == '\t' || words[i] == 0 )
 290         break;
 291
 292       if (words[i] == '\\')
 293         {
 294           *word = w_addchar (*word, word_length, max_length, '~');
 295           return *word ? 0 : WRDE_NOSPACE;
 296         }
 297     }
 298
 299   if (i == 1 + *offset)
 300     {
 301       /* Tilde appears on its own */
 302       uid_t uid;
 303       struct passwd pwd, *tpwd;
 304       int buflen = 1000;
 305       char* home;
 306       char* buffer;
 307       int result;
 308
 309       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 310          results are unspecified.  We do a lookup on the uid if
 311          HOME is unset. */
 312
 313       home = getenv ("HOME");
 314       if (home != NULL)
 315         {
 316           *word = w_addstr (*word, word_length, max_length, home);
 317           if (*word == NULL)
 318             return WRDE_NOSPACE;
 319         }
 320       else
 321         {
 322           uid = __getuid ();
 323           buffer = __alloca (buflen);
 324
 325           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 326                  && errno == ERANGE)
 327             buffer = extend_alloca (buffer, buflen, buflen + 1000);
 328
 329           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 330             {
 331               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 332               if (*word == NULL)
 333                 return WRDE_NOSPACE;
 334             }
 335           else
 336             {
 337               *word = w_addchar (*word, word_length, max_length, '~');
 338               if (*word == NULL)
 339                 return WRDE_NOSPACE;
 340             }
 341         }
 342     }
 343   else
 344     {
 345       /* Look up user name in database to get home directory */
 346       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 347       struct passwd pwd, *tpwd;
 348       int buflen = 1000;
 349       char* buffer = __alloca (buflen);
 350       int result;
 351
 352       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 353              && errno == ERANGE)
 354         buffer = extend_alloca (buffer, buflen, buflen + 1000);
 355
 356       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 357         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 358       else
 359         {
 360           /* (invalid login name) */
 361           *word = w_addchar (*word, word_length, max_length, '~');
 362           if (*word != NULL)
 363             *word = w_addstr (*word, word_length, max_length, user);
 364         }
 365
 366       *offset = i - 1;
 367     }
 368   return *word ? 0 : WRDE_NOSPACE;
 369 }
 370
 371
 372 static int
 373 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 374                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 375                const char *ifs_white)
 376 {
 377   int error;
 378   unsigned int match;
 379   glob_t globbuf;
 380
 381   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 382
 383   if (error != 0)
 384     {
 385       /* We can only run into memory problems.  */
 386       assert (error == GLOB_NOSPACE);
 387       return WRDE_NOSPACE;
 388     }
 389
 390   if (ifs && !*ifs)
 391     {
 392       /* No field splitting allowed. */
 393       assert (globbuf.gl_pathv[0] != NULL);
 394       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 395       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 396         {
 397           *word = w_addchar (*word, word_length, max_length, ' ');
 398           if (*word != NULL)
 399             *word = w_addstr (*word, word_length, max_length,
 400                               globbuf.gl_pathv[match]);
 401         }
 402
 403       globfree (&globbuf);
 404       return *word ? 0 : WRDE_NOSPACE;
 405     }
 406
 407   assert (ifs == NULL || *ifs != '\0');
 408   if (*word != NULL)
 409     {
 410       free (*word);
 411       *word = w_newword (word_length, max_length);
 412     }
 413
 414   for (match = 0; match < globbuf.gl_pathc; ++match)
 415     {
 416       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 417       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 418         {
 419           globfree (&globbuf);
 420           return WRDE_NOSPACE;
 421         }
 422     }
 423
 424   globfree (&globbuf);
 425   return 0;
 426 }
 427
 428 static int
 429 parse_glob (char **word, size_t *word_length, size_t *max_length,
 430             const char *words, size_t *offset, int flags,
 431             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 432 {
 433   /* We are poised just after a '*', a '[' or a '?'. */
 434   int error = WRDE_NOSPACE;
 435   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 436   size_t i;
 437   wordexp_t glob_list; /* List of words to glob */
 438
 439   glob_list.we_wordc = 0;
 440   glob_list.we_wordv = NULL;
 441   glob_list.we_offs = 0;
 442   for (; words[*offset] != '\0'; ++*offset)
 443     {
 444       if (strchr (ifs, words[*offset]) != NULL)
 445         /* Reached IFS */
 446         break;
 447
 448       /* Sort out quoting */
 449       if (words[*offset] == '\'')
 450         {
 451           if (quoted == 0)
 452             {
 453               quoted = 1;
 454               continue;
 455             }
 456           else if (quoted == 1)
 457             {
 458               quoted = 0;
 459               continue;
 460             }
 461         }
 462       else if (words[*offset] == '"')
 463         {
 464           if (quoted == 0)
 465             {
 466               quoted = 2;
 467               continue;
 468             }
 469           else if (quoted == 2)
 470             {
 471               quoted = 0;
 472               continue;
 473             }
 474         }
 475
 476       /* Sort out other special characters */
 477       if (quoted != 1 && words[*offset] == '$')
 478         {
 479           error = parse_dollars (word, word_length, max_length, words,
 480                                  offset, flags, &glob_list, ifs, ifs_white,
 481                                  quoted == 2);
 482           if (error)
 483             goto tidy_up;
 484
 485           continue;
 486         }
 487       else if (words[*offset] == '\\')
 488         {
 489           if (quoted)
 490             error = parse_qtd_backslash (word, word_length, max_length,
 491                                          words, offset);
 492           else
 493             error = parse_backslash (word, word_length, max_length,
 494                                      words, offset);
 495
 496           if (error)
 497             goto tidy_up;
 498
 499           continue;
 500         }
 501
 502       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 503       if (*word == NULL)
 504         goto tidy_up;
 505     }
 506
 507   /* Don't forget to re-parse the character we stopped at. */
 508   --*offset;
 509
 510   /* Glob the words */
 511   error = w_addword (&glob_list, *word);
 512   *word = w_newword (word_length, max_length);
 513   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 514     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 515                            max_length, pwordexp, ifs, ifs_white);
 516
 517   /* Now tidy up */
 518 tidy_up:
 519   wordfree (&glob_list);
 520   return error;
 521 }
 522
 523 static int
 524 parse_squote (char **word, size_t *word_length, size_t *max_length,
 525               const char *words, size_t *offset)
 526 {
 527   /* We are poised just after a single quote */
 528   for (; words[*offset]; ++(*offset))
 529     {
 530       if (words[*offset] != '\'')
 531         {
 532           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 533           if (*word == NULL)
 534             return WRDE_NOSPACE;
 535         }
 536       else return 0;
 537     }
 538
 539   /* Unterminated string */
 540   return WRDE_SYNTAX;
 541 }
 542
 543 /* Functions to evaluate an arithmetic expression */
 544 static int
 545 eval_expr_val (char **expr, long int *result)
 546 {
 547   char *digit;
 548
 549   /* Skip white space */
 550   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 551
 552   if (*digit == '(')
 553     {
 554       /* Scan for closing paren */
 555       for (++digit; **expr && **expr != ')'; ++(*expr));
 556
 557       /* Is there one? */
 558       if (!**expr)
 559         return WRDE_SYNTAX;
 560
 561       *(*expr)++ = 0;
 562
 563       if (eval_expr (digit, result))
 564         return WRDE_SYNTAX;
 565
 566       return 0;
 567     }
 568
 569   /* POSIX requires that decimal, octal, and hexadecimal constants are
 570      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 571   *result = strtol (digit, expr, 0);
 572   if (digit == *expr)
 573     return WRDE_SYNTAX;
 574
 575   return 0;
 576 }
 577
 578 static int
 579 eval_expr_multdiv (char **expr, long int *result)
 580 {
 581   long int arg;
 582
 583   /* Read a Value */
 584   if (eval_expr_val (expr, result) != 0)
 585     return WRDE_SYNTAX;
 586
 587   while (**expr)
 588     {
 589       /* Skip white space */
 590       for (; *expr && **expr && isspace (**expr); ++(*expr));
 591
 592       if (**expr == '*')
 593         {
 594           ++(*expr);
 595           if (eval_expr_val (expr, &arg) != 0)
 596             return WRDE_SYNTAX;
 597
 598           *result *= arg;
 599         }
 600       else if (**expr == '/')
 601         {
 602           ++(*expr);
 603           if (eval_expr_val (expr, &arg) != 0)
 604             return WRDE_SYNTAX;
 605
 606           /* Division by zero or integer overflow.  */
 607           if (arg == 0 || (arg == -1 && *result == LONG_MIN))
 608             return WRDE_SYNTAX;
 609
 610           *result /= arg;
 611         }
 612       else break;
 613     }
 614
 615   return 0;
 616 }
 617
 618 static int
 619 eval_expr (char *expr, long int *result)
 620 {
 621   long int arg;
 622
 623   /* Read a Multdiv */
 624   if (eval_expr_multdiv (&expr, result) != 0)
 625     return WRDE_SYNTAX;
 626
 627   while (*expr)
 628     {
 629       /* Skip white space */
 630       for (; expr && *expr && isspace (*expr); ++expr);
 631
 632       if (*expr == '+')
 633         {
 634           ++expr;
 635           if (eval_expr_multdiv (&expr, &arg) != 0)
 636             return WRDE_SYNTAX;
 637
 638           *result += arg;
 639         }
 640       else if (*expr == '-')
 641         {
 642           ++expr;
 643           if (eval_expr_multdiv (&expr, &arg) != 0)
 644             return WRDE_SYNTAX;
 645
 646           *result -= arg;
 647         }
 648       else break;
 649     }
 650
 651   return 0;
 652 }
 653
 654 static int
 655 parse_arith (char **word, size_t *word_length, size_t *max_length,
 656              const char *words, size_t *offset, int flags, int bracket)
 657 {
 658   /* We are poised just after "$((" or "$[" */
 659   int error;
 660   int paren_depth = 1;
 661   size_t expr_length;
 662   size_t expr_maxlen;
 663   char *expr;
 664
 665   expr = w_newword (&expr_length, &expr_maxlen);
 666   for (; words[*offset]; ++(*offset))
 667     {
 668       switch (words[*offset])
 669         {
 670         case '$':
 671           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 672                                  words, offset, flags, NULL, NULL, NULL, 1);
 673           /* The ``1'' here is to tell parse_dollars not to
 674            * split the fields.
 675            */
 676           if (error)
 677             {
 678               free (expr);
 679               return error;
 680             }
 681           break;
 682
 683         case '`':
 684           (*offset)++;
 685           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 686                                   words, offset, flags, NULL, NULL, NULL);
 687           /* The first NULL here is to tell parse_backtick not to
 688            * split the fields.
 689            */
 690           if (error)
 691             {
 692               free (expr);
 693               return error;
 694             }
 695           break;
 696
 697         case '\\':
 698           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 699                                        words, offset);
 700           if (error)
 701             {
 702               free (expr);
 703               return error;
 704             }
 705           /* I think that a backslash within an
 706            * arithmetic expansion is bound to
 707            * cause an error sooner or later anyway though.
 708            */
 709           break;
 710
 711         case ')':
 712           if (--paren_depth == 0)
 713             {
 714               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 715               long int numresult = 0;
 716               long long int convertme;
 717
 718               if (bracket || words[1 + *offset] != ')')
 719                 {
 720                   free (expr);
 721                   return WRDE_SYNTAX;
 722                 }
 723
 724               ++(*offset);
 725
 726               /* Go - evaluate. */
 727               if (*expr && eval_expr (expr, &numresult) != 0)
 728                 {
 729                   free (expr);
 730                   return WRDE_SYNTAX;
 731                 }
 732
 733               if (numresult < 0)
 734                 {
 735                   convertme = -numresult;
 736                   *word = w_addchar (*word, word_length, max_length, '-');
 737                   if (!*word)
 738                     {
 739                       free (expr);
 740                       return WRDE_NOSPACE;
 741                     }
 742                 }
 743               else
 744                 convertme = numresult;
 745
 746               result[20] = '\0';
 747               *word = w_addstr (*word, word_length, max_length,
 748                                 _itoa (convertme, &result[20], 10, 0));
 749               free (expr);
 750               return *word ? 0 : WRDE_NOSPACE;
 751             }
 752           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 753           if (expr == NULL)
 754             return WRDE_NOSPACE;
 755
 756           break;
 757
 758         case ']':
 759           if (bracket && paren_depth == 1)
 760             {
 761               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 762               long int numresult = 0;
 763
 764               /* Go - evaluate. */
 765               if (*expr && eval_expr (expr, &numresult) != 0)
 766                 {
 767                   free (expr);
 768                   return WRDE_SYNTAX;
 769                 }
 770
 771               result[20] = '\0';
 772               *word = w_addstr (*word, word_length, max_length,
 773                                 _itoa_word (numresult, &result[20], 10, 0));
 774               free (expr);
 775               return *word ? 0 : WRDE_NOSPACE;
 776             }
 777
 778           free (expr);
 779           return WRDE_SYNTAX;
 780
 781         case '\n':
 782         case ';':
 783         case '{':
 784         case '}':
 785           free (expr);
 786           return WRDE_BADCHAR;
 787
 788         case '(':
 789           ++paren_depth;
 790         default:
 791           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 792           if (expr == NULL)
 793             return WRDE_NOSPACE;
 794         }
 795     }
 796
 797   /* Premature end */
 798   free (expr);
 799   return WRDE_SYNTAX;
 800 }
 801
 802 /* Function called by child process in exec_comm() */
 803 static inline void
 804 __attribute__ ((always_inline))
 805 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 806 {
 807   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 808
 809   /* Execute the command, or just check syntax? */
 810   if (noexec)
 811     args[1] = "-nc";
 812
 813   /* Redirect output.  */
 814   if (__glibc_likely (fildes[1] != STDOUT_FILENO))
 815     {
 816       __dup2 (fildes[1], STDOUT_FILENO);
 817       __close (fildes[1]);
 818     }
 819   else
 820     /* Reset the close-on-exec flag (if necessary).  */
 821     __fcntl (fildes[1], F_SETFD, 0);
 822
 823   /* Redirect stderr to /dev/null if we have to.  */
 824   if (showerr == 0)
 825     {
 826       struct stat64 st;
 827       int fd;
 828       __close (STDERR_FILENO);
 829       fd = __open (_PATH_DEVNULL, O_WRONLY);
 830       if (fd >= 0 && fd != STDERR_FILENO)
 831         {
 832           __dup2 (fd, STDERR_FILENO);
 833           __close (fd);
 834         }
 835       /* Be paranoid.  Check that we actually opened the /dev/null
 836          device.  */
 837       if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
 838           || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
 839 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 840           || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 841 #endif
 842           )
 843         /* It's not the /dev/null device.  Stop right here.  The
 844            problem is: how do we stop?  We use _exit() with an
 845            hopefully unusual exit code.  */
 846         _exit (90);
 847     }
 848
 849   /* Make sure the subshell doesn't field-split on our behalf. */
 850   __unsetenv ("IFS");
 851
 852   __close (fildes[0]);
 853   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 854
 855   /* Bad.  What now?  */
 856   abort ();
 857 }
 858
 859 /* Function to execute a command and retrieve the results */
 860 /* pwordexp contains NULL if field-splitting is forbidden */
 861 static int
 862 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 863            int flags, wordexp_t *pwordexp, const char *ifs,
 864            const char *ifs_white)
 865 {
 866   int fildes[2];
 867 #define bufsize 128
 868   int buflen;
 869   int i;
 870   int status = 0;
 871   size_t maxnewlines = 0;
 872   char buffer[bufsize];
 873   pid_t pid;
 874   int noexec = 0;
 875
 876   /* Do nothing if command substitution should not succeed.  */
 877   if (flags & WRDE_NOCMD)
 878     return WRDE_CMDSUB;
 879
 880   /* Don't fork() unless necessary */
 881   if (!comm || !*comm)
 882     return 0;
 883
 884   if (__pipe2 (fildes, O_CLOEXEC) < 0)
 885     return WRDE_NOSPACE;
 886
 887  again:
 888   if ((pid = __fork ()) < 0)
 889     {
 890       /* Bad */
 891       __close (fildes[0]);
 892       __close (fildes[1]);
 893       return WRDE_NOSPACE;
 894     }
 895
 896   if (pid == 0)
 897     exec_comm_child (comm, fildes, noexec ? 0 : flags & WRDE_SHOWERR, noexec);
 898
 899   /* Parent */
 900
 901   /* If we are just testing the syntax, only wait.  */
 902   if (noexec)
 903     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 904             && status != 0) ? WRDE_SYNTAX : 0;
 905
 906   __close (fildes[1]);
 907   fildes[1] = -1;
 908
 909   if (!pwordexp)
 910     /* Quoted - no field splitting */
 911     {
 912       while (1)
 913         {
 914           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 915                                                     bufsize))) < 1)
 916             {
 917               /* If read returned 0 then the process has closed its
 918                  stdout.  Don't use WNOHANG in that case to avoid busy
 919                  looping until the process eventually exits.  */
 920               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 921                                                  buflen == 0 ? 0 : WNOHANG))
 922                   == 0)
 923                 continue;
 924               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 925                                                         bufsize))) < 1)
 926                 break;
 927             }
 928
 929           maxnewlines += buflen;
 930
 931           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 932           if (*word == NULL)
 933             goto no_space;
 934         }
 935     }
 936   else
 937     /* Not quoted - split fields */
 938     {
 939       int copying = 0;
 940       /* 'copying' is:
 941        *  0 when searching for first character in a field not IFS white space
 942        *  1 when copying the text of a field
 943        *  2 when searching for possible non-whitespace IFS
 944        *  3 when searching for non-newline after copying field
 945        */
 946
 947       while (1)
 948         {
 949           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 950                                                     bufsize))) < 1)
 951             {
 952               /* If read returned 0 then the process has closed its
 953                  stdout.  Don't use WNOHANG in that case to avoid busy
 954                  looping until the process eventually exits.  */
 955               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 956                                                  buflen == 0 ? 0 : WNOHANG))
 957                   == 0)
 958                 continue;
 959               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 960                                                         bufsize))) < 1)
 961                 break;
 962             }
 963
 964           for (i = 0; i < buflen; ++i)
 965             {
 966               if (strchr (ifs, buffer[i]) != NULL)
 967                 {
 968                   /* Current character is IFS */
 969                   if (strchr (ifs_white, buffer[i]) == NULL)
 970                     {
 971                       /* Current character is IFS but not whitespace */
 972                       if (copying == 2)
 973                         {
 974                           /*            current character
 975                            *                   |
 976                            *                   V
 977                            * eg: text<space><comma><space>moretext
 978                            *
 979                            * So, strip whitespace IFS (like at the start)
 980                            */
 981                           copying = 0;
 982                           continue;
 983                         }
 984
 985                       copying = 0;
 986                       /* fall through and delimit field.. */
 987                     }
 988                   else
 989                     {
 990                       if (buffer[i] == '\n')
 991                         {
 992                           /* Current character is (IFS) newline */
 993
 994                           /* If copying a field, this is the end of it,
 995                              but maybe all that's left is trailing newlines.
 996                              So start searching for a non-newline. */
 997                           if (copying == 1)
 998                             copying = 3;
 999
1000                           continue;
1001                         }
1002                       else
1003                         {
1004                           /* Current character is IFS white space, but
1005                              not a newline */
1006
1007                           /* If not either copying a field or searching
1008                              for non-newline after a field, ignore it */
1009                           if (copying != 1 && copying != 3)
1010                             continue;
1011
1012                           /* End of field (search for non-ws IFS afterwards) */
1013                           copying = 2;
1014                         }
1015                     }
1016
1017                   /* First IFS white space (non-newline), or IFS non-whitespace.
1018                    * Delimit the field.  Nulls are converted by w_addword. */
1019                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1020                     goto no_space;
1021
1022                   *word = w_newword (word_length, max_length);
1023
1024                   maxnewlines = 0;
1025                   /* fall back round the loop.. */
1026                 }
1027               else
1028                 {
1029                   /* Not IFS character */
1030
1031                   if (copying == 3)
1032                     {
1033                       /* Nothing but (IFS) newlines since the last field,
1034                          so delimit it here before starting new word */
1035                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1036                         goto no_space;
1037
1038                       *word = w_newword (word_length, max_length);
1039                     }
1040
1041                   copying = 1;
1042
1043                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1044                     maxnewlines++;
1045                   else
1046                     maxnewlines = 0;
1047
1048                   *word = w_addchar (*word, word_length, max_length,
1049                                      buffer[i]);
1050                   if (*word == NULL)
1051                     goto no_space;
1052                 }
1053             }
1054         }
1055     }
1056
1057   /* Chop off trailing newlines (required by POSIX.2)  */
1058   /* Ensure we don't go back further than the beginning of the
1059      substitution (i.e. remove maxnewlines bytes at most) */
1060   while (maxnewlines-- != 0 &&
1061          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1062     {
1063       (*word)[--*word_length] = '\0';
1064
1065       /* If the last word was entirely newlines, turn it into a new word
1066        * which can be ignored if there's nothing following it. */
1067       if (*word_length == 0)
1068         {
1069           free (*word);
1070           *word = w_newword (word_length, max_length);
1071           break;
1072         }
1073     }
1074
1075   __close (fildes[0]);
1076   fildes[0] = -1;
1077
1078   /* Check for syntax error (re-execute but with "-n" flag) */
1079   if (buflen < 1 && status != 0)
1080     {
1081       noexec = 1;
1082       goto again;
1083     }
1084
1085   return 0;
1086
1087 no_space:
1088   __kill (pid, SIGKILL);
1089   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1090   __close (fildes[0]);
1091   return WRDE_NOSPACE;
1092 }
1093
1094 static int
1095 parse_comm (char **word, size_t *word_length, size_t *max_length,
1096             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1097             const char *ifs, const char *ifs_white)
1098 {
1099   /* We are poised just after "$(" */
1100   int paren_depth = 1;
1101   int error = 0;
1102   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1103   size_t comm_length;
1104   size_t comm_maxlen;
1105   char *comm = w_newword (&comm_length, &comm_maxlen);
1106
1107   for (; words[*offset]; ++(*offset))
1108     {
1109       switch (words[*offset])
1110         {
1111         case '\'':
1112           if (quoted == 0)
1113             quoted = 1;
1114           else if (quoted == 1)
1115             quoted = 0;
1116
1117           break;
1118
1119         case '"':
1120           if (quoted == 0)
1121             quoted = 2;
1122           else if (quoted == 2)
1123             quoted = 0;
1124
1125           break;
1126
1127         case ')':
1128           if (!quoted && --paren_depth == 0)
1129             {
1130               /* Go -- give script to the shell */
1131               if (comm)
1132                 {
1133 #ifdef __libc_ptf_call
1134                   /* We do not want the exec_comm call to be cut short
1135                      by a thread cancellation since cleanup is very
1136                      ugly.  Therefore disable cancellation for
1137                      now.  */
1138                   // XXX Ideally we do want the thread being cancelable.
1139                   // XXX If demand is there we'll change it.
1140                   int state = PTHREAD_CANCEL_ENABLE;
1141                   __libc_ptf_call (__pthread_setcancelstate,
1142                                    (PTHREAD_CANCEL_DISABLE, &state), 0);
1143 #endif
1144
1145                   error = exec_comm (comm, word, word_length, max_length,
1146                                      flags, pwordexp, ifs, ifs_white);
1147
1148 #ifdef __libc_ptf_call
1149                   __libc_ptf_call (__pthread_setcancelstate,
1150                                    (state, NULL), 0);
1151 #endif
1152
1153                   free (comm);
1154                 }
1155
1156               return error;
1157             }
1158
1159           /* This is just part of the script */
1160           break;
1161
1162         case '(':
1163           if (!quoted)
1164             ++paren_depth;
1165         }
1166
1167       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1168       if (comm == NULL)
1169         return WRDE_NOSPACE;
1170     }
1171
1172   /* Premature end.  */
1173   free (comm);
1174
1175   return WRDE_SYNTAX;
1176 }
1177
1178 #define CHAR_IN_SET(ch, char_set) \
1179   (memchr (char_set "", ch, sizeof (char_set) - 1) != NULL)
1180
1181 static int
1182 parse_param (char **word, size_t *word_length, size_t *max_length,
1183              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1184              const char *ifs, const char *ifs_white, int quoted)
1185 {
1186   /* We are poised just after "$" */
1187   enum action
1188   {
1189     ACT_NONE,
1190     ACT_RP_SHORT_LEFT = '#',
1191     ACT_RP_LONG_LEFT = 'L',
1192     ACT_RP_SHORT_RIGHT = '%',
1193     ACT_RP_LONG_RIGHT = 'R',
1194     ACT_NULL_ERROR = '?',
1195     ACT_NULL_SUBST = '-',
1196     ACT_NONNULL_SUBST = '+',
1197     ACT_NULL_ASSIGN = '='
1198   };
1199   size_t env_length;
1200   size_t env_maxlen;
1201   size_t pat_length;
1202   size_t pat_maxlen;
1203   size_t start = *offset;
1204   char *env;
1205   char *pattern;
1206   char *value = NULL;
1207   enum action action = ACT_NONE;
1208   int depth = 0;
1209   int colon_seen = 0;
1210   int seen_hash = 0;
1211   int free_value = 0;
1212   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1213   int error;
1214   int special = 0;
1215   char buffer[21];
1216   int brace = words[*offset] == '{';
1217
1218   env = w_newword (&env_length, &env_maxlen);
1219   pattern = w_newword (&pat_length, &pat_maxlen);
1220
1221   if (brace)
1222     ++*offset;
1223
1224   /* First collect the parameter name. */
1225
1226   if (words[*offset] == '#')
1227     {
1228       seen_hash = 1;
1229       if (!brace)
1230         goto envsubst;
1231       ++*offset;
1232     }
1233
1234   if (isalpha (words[*offset]) || words[*offset] == '_')
1235     {
1236       /* Normal parameter name. */
1237       do
1238         {
1239           env = w_addchar (env, &env_length, &env_maxlen,
1240                            words[*offset]);
1241           if (env == NULL)
1242             goto no_space;
1243         }
1244       while (isalnum (words[++*offset]) || words[*offset] == '_');
1245     }
1246   else if (isdigit (words[*offset]))
1247     {
1248       /* Numeric parameter name. */
1249       special = 1;
1250       do
1251         {
1252           env = w_addchar (env, &env_length, &env_maxlen,
1253                            words[*offset]);
1254           if (env == NULL)
1255             goto no_space;
1256           if (!brace)
1257             goto envsubst;
1258         }
1259       while (isdigit(words[++*offset]));
1260     }
1261   else if (CHAR_IN_SET (words[*offset], "*@$"))
1262     {
1263       /* Special parameter. */
1264       special = 1;
1265       env = w_addchar (env, &env_length, &env_maxlen,
1266                        words[*offset]);
1267       if (env == NULL)
1268         goto no_space;
1269       ++*offset;
1270     }
1271   else
1272     {
1273       if (brace)
1274         goto syntax;
1275     }
1276
1277   if (brace)
1278     {
1279       /* Check for special action to be applied to the value. */
1280       switch (words[*offset])
1281         {
1282         case '}':
1283           /* Evaluate. */
1284           goto envsubst;
1285
1286         case '#':
1287           action = ACT_RP_SHORT_LEFT;
1288           if (words[1 + *offset] == '#')
1289             {
1290               ++*offset;
1291               action = ACT_RP_LONG_LEFT;
1292             }
1293           break;
1294
1295         case '%':
1296           action = ACT_RP_SHORT_RIGHT;
1297           if (words[1 + *offset] == '%')
1298             {
1299               ++*offset;
1300               action = ACT_RP_LONG_RIGHT;
1301             }
1302           break;
1303
1304         case ':':
1305           if (!CHAR_IN_SET (words[1 + *offset], "-=?+"))
1306             goto syntax;
1307
1308           colon_seen = 1;
1309           action = words[++*offset];
1310           break;
1311
1312         case '-':
1313         case '=':
1314         case '?':
1315         case '+':
1316           action = words[*offset];
1317           break;
1318
1319         default:
1320           goto syntax;
1321         }
1322
1323       /* Now collect the pattern, but don't expand it yet. */
1324       ++*offset;
1325       for (; words[*offset]; ++(*offset))
1326         {
1327           switch (words[*offset])
1328             {
1329             case '{':
1330               if (!pattern_is_quoted)
1331                 ++depth;
1332               break;
1333
1334             case '}':
1335               if (!pattern_is_quoted)
1336                 {
1337                   if (depth == 0)
1338                     goto envsubst;
1339                   --depth;
1340                 }
1341               break;
1342
1343             case '\\':
1344               if (pattern_is_quoted)
1345                 /* Quoted; treat as normal character. */
1346                 break;
1347
1348               /* Otherwise, it's an escape: next character is literal. */
1349               if (words[++*offset] == '\0')
1350                 goto syntax;
1351
1352               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1353               if (pattern == NULL)
1354                 goto no_space;
1355
1356               break;
1357
1358             case '\'':
1359               if (pattern_is_quoted == 0)
1360                 pattern_is_quoted = 1;
1361               else if (pattern_is_quoted == 1)
1362                 pattern_is_quoted = 0;
1363
1364               break;
1365
1366             case '"':
1367               if (pattern_is_quoted == 0)
1368                 pattern_is_quoted = 2;
1369               else if (pattern_is_quoted == 2)
1370                 pattern_is_quoted = 0;
1371
1372               break;
1373             }
1374
1375           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1376                                words[*offset]);
1377           if (pattern == NULL)
1378             goto no_space;
1379         }
1380     }
1381
1382   /* End of input string -- remember to reparse the character that we
1383    * stopped at.  */
1384   --(*offset);
1385
1386 envsubst:
1387   if (words[start] == '{' && words[*offset] != '}')
1388     goto syntax;
1389
1390   if (env == NULL)
1391     {
1392       if (seen_hash)
1393         {
1394           /* $# expands to the number of positional parameters */
1395           buffer[20] = '\0';
1396           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1397           seen_hash = 0;
1398         }
1399       else
1400         {
1401           /* Just $ on its own */
1402           *offset = start - 1;
1403           *word = w_addchar (*word, word_length, max_length, '$');
1404           return *word ? 0 : WRDE_NOSPACE;
1405         }
1406     }
1407   /* Is it a numeric parameter? */
1408   else if (isdigit (env[0]))
1409     {
1410       int n = atoi (env);
1411
1412       if (n >= __libc_argc)
1413         /* Substitute NULL. */
1414         value = NULL;
1415       else
1416         /* Replace with appropriate positional parameter. */
1417         value = __libc_argv[n];
1418     }
1419   /* Is it a special parameter? */
1420   else if (special)
1421     {
1422       /* Is it `$$'? */
1423       if (*env == '$')
1424         {
1425           buffer[20] = '\0';
1426           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1427         }
1428       /* Is it `${#*}' or `${#@}'? */
1429       else if ((*env == '*' || *env == '@') && seen_hash)
1430         {
1431           buffer[20] = '\0';
1432           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1433                               &buffer[20], 10, 0);
1434           *word = w_addstr (*word, word_length, max_length, value);
1435           free (env);
1436           free (pattern);
1437           return *word ? 0 : WRDE_NOSPACE;
1438         }
1439       /* Is it `$*' or `$@' (unquoted) ? */
1440       else if (*env == '*' || (*env == '@' && !quoted))
1441         {
1442           size_t plist_len = 0;
1443           int p;
1444           char *end;
1445
1446           /* Build up value parameter by parameter (copy them) */
1447           for (p = 1; __libc_argv[p]; ++p)
1448             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1449           value = malloc (plist_len);
1450           if (value == NULL)
1451             goto no_space;
1452           end = value;
1453           *end = 0;
1454           for (p = 1; __libc_argv[p]; ++p)
1455             {
1456               if (p > 1)
1457                 *end++ = ' ';
1458               end = __stpcpy (end, __libc_argv[p]);
1459             }
1460
1461           free_value = 1;
1462         }
1463       else
1464         {
1465           /* Must be a quoted `$@' */
1466           assert (*env == '@' && quoted);
1467
1468           /* Each parameter is a separate word ("$@") */
1469           if (__libc_argc == 2)
1470             value = __libc_argv[1];
1471           else if (__libc_argc > 2)
1472             {
1473               int p;
1474
1475               /* Append first parameter to current word. */
1476               value = w_addstr (*word, word_length, max_length,
1477                                 __libc_argv[1]);
1478               if (value == NULL || w_addword (pwordexp, value))
1479                 goto no_space;
1480
1481               for (p = 2; __libc_argv[p + 1]; p++)
1482                 {
1483                   char *newword = __strdup (__libc_argv[p]);
1484                   if (newword == NULL || w_addword (pwordexp, newword))
1485                     goto no_space;
1486                 }
1487
1488               /* Start a new word with the last parameter. */
1489               *word = w_newword (word_length, max_length);
1490               value = __libc_argv[p];
1491             }
1492           else
1493             {
1494               free (env);
1495               free (pattern);
1496               return 0;
1497             }
1498         }
1499     }
1500   else
1501     value = getenv (env);
1502
1503   if (value == NULL && (flags & WRDE_UNDEF))
1504     {
1505       /* Variable not defined. */
1506       error = WRDE_BADVAL;
1507       goto do_error;
1508     }
1509
1510   if (action != ACT_NONE)
1511     {
1512       int expand_pattern = 0;
1513
1514       /* First, find out if we need to expand pattern (i.e. if we will
1515        * use it). */
1516       switch (action)
1517         {
1518         case ACT_RP_SHORT_LEFT:
1519         case ACT_RP_LONG_LEFT:
1520         case ACT_RP_SHORT_RIGHT:
1521         case ACT_RP_LONG_RIGHT:
1522           /* Always expand for these. */
1523           expand_pattern = 1;
1524           break;
1525
1526         case ACT_NULL_ERROR:
1527         case ACT_NULL_SUBST:
1528         case ACT_NULL_ASSIGN:
1529           if (!value || (!*value && colon_seen))
1530             /* If param is unset, or set but null and a colon has been seen,
1531                the expansion of the pattern will be needed. */
1532             expand_pattern = 1;
1533
1534           break;
1535
1536         case ACT_NONNULL_SUBST:
1537           /* Expansion of word will be needed if parameter is set and not null,
1538              or set null but no colon has been seen. */
1539           if (value && (*value || !colon_seen))
1540             expand_pattern = 1;
1541
1542           break;
1543
1544         default:
1545           assert (! "Unrecognised action!");
1546         }
1547
1548       if (expand_pattern)
1549         {
1550           /* We need to perform tilde expansion, parameter expansion,
1551              command substitution, and arithmetic expansion.  We also
1552              have to be a bit careful with wildcard characters, as
1553              pattern might be given to fnmatch soon.  To do this, we
1554              convert quotes to escapes. */
1555
1556           char *expanded;
1557           size_t exp_len;
1558           size_t exp_maxl;
1559           char *p;
1560           int quoted = 0; /* 1: single quotes; 2: double */
1561
1562           expanded = w_newword (&exp_len, &exp_maxl);
1563           for (p = pattern; p && *p; p++)
1564             {
1565               size_t offset;
1566
1567               switch (*p)
1568                 {
1569                 case '"':
1570                   if (quoted == 2)
1571                     quoted = 0;
1572                   else if (quoted == 0)
1573                     quoted = 2;
1574                   else break;
1575
1576                   continue;
1577
1578                 case '\'':
1579                   if (quoted == 1)
1580                     quoted = 0;
1581                   else if (quoted == 0)
1582                     quoted = 1;
1583                   else break;
1584
1585                   continue;
1586
1587                 case '*':
1588                 case '?':
1589                   if (quoted)
1590                     {
1591                       /* Convert quoted wildchar to escaped wildchar. */
1592                       expanded = w_addchar (expanded, &exp_len,
1593                                             &exp_maxl, '\\');
1594
1595                       if (expanded == NULL)
1596                         goto no_space;
1597                     }
1598                   break;
1599
1600                 case '$':
1601                   offset = 0;
1602                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1603                                          &offset, flags, NULL, NULL, NULL, 1);
1604                   if (error)
1605                     {
1606                       if (free_value)
1607                         free (value);
1608
1609                       free (expanded);
1610
1611                       goto do_error;
1612                     }
1613
1614                   p += offset;
1615                   continue;
1616
1617                 case '~':
1618                   if (quoted || exp_len)
1619                     break;
1620
1621                   offset = 0;
1622                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1623                                        &offset, 0);
1624                   if (error)
1625                     {
1626                       if (free_value)
1627                         free (value);
1628
1629                       free (expanded);
1630
1631                       goto do_error;
1632                     }
1633
1634                   p += offset;
1635                   continue;
1636
1637                 case '\\':
1638                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1639                   ++p;
1640                   assert (*p); /* checked when extracted initially */
1641                   if (expanded == NULL)
1642                     goto no_space;
1643                 }
1644
1645               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1646
1647               if (expanded == NULL)
1648                 goto no_space;
1649             }
1650
1651           free (pattern);
1652
1653           pattern = expanded;
1654         }
1655
1656       switch (action)
1657         {
1658         case ACT_RP_SHORT_LEFT:
1659         case ACT_RP_LONG_LEFT:
1660         case ACT_RP_SHORT_RIGHT:
1661         case ACT_RP_LONG_RIGHT:
1662           {
1663             char *p;
1664             char c;
1665             char *end;
1666
1667             if (value == NULL || pattern == NULL || *pattern == '\0')
1668               break;
1669
1670             end = value + strlen (value);
1671
1672             switch (action)
1673               {
1674               case ACT_RP_SHORT_LEFT:
1675                 for (p = value; p <= end; ++p)
1676                   {
1677                     c = *p;
1678                     *p = '\0';
1679                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1680                       {
1681                         *p = c;
1682                         if (free_value)
1683                           {
1684                             char *newval = __strdup (p);
1685                             if (newval == NULL)
1686                               {
1687                                 free (value);
1688                                 goto no_space;
1689                               }
1690                             free (value);
1691                             value = newval;
1692                           }
1693                         else
1694                           value = p;
1695                         break;
1696                       }
1697                     *p = c;
1698                   }
1699
1700                 break;
1701
1702               case ACT_RP_LONG_LEFT:
1703                 for (p = end; p >= value; --p)
1704                   {
1705                     c = *p;
1706                     *p = '\0';
1707                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1708                       {
1709                         *p = c;
1710                         if (free_value)
1711                           {
1712                             char *newval = __strdup (p);
1713                             if (newval == NULL)
1714                               {
1715                                 free (value);
1716                                 goto no_space;
1717                               }
1718                             free (value);
1719                             value = newval;
1720                           }
1721                         else
1722                           value = p;
1723                         break;
1724                       }
1725                     *p = c;
1726                   }
1727
1728                 break;
1729
1730               case ACT_RP_SHORT_RIGHT:
1731                 for (p = end; p >= value; --p)
1732                   {
1733                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1734                       {
1735                         char *newval;
1736                         newval = malloc (p - value + 1);
1737
1738                         if (newval == NULL)
1739                           {
1740                             if (free_value)
1741                               free (value);
1742                             goto no_space;
1743                           }
1744
1745                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1746                         if (free_value)
1747                           free (value);
1748                         value = newval;
1749                         free_value = 1;
1750                         break;
1751                       }
1752                   }
1753
1754                 break;
1755
1756               case ACT_RP_LONG_RIGHT:
1757                 for (p = value; p <= end; ++p)
1758                   {
1759                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1760                       {
1761                         char *newval;
1762                         newval = malloc (p - value + 1);
1763
1764                         if (newval == NULL)
1765                           {
1766                             if (free_value)
1767                               free (value);
1768                             goto no_space;
1769                           }
1770
1771                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1772                         if (free_value)
1773                           free (value);
1774                         value = newval;
1775                         free_value = 1;
1776                         break;
1777                       }
1778                   }
1779
1780                 break;
1781
1782               default:
1783                 break;
1784               }
1785
1786             break;
1787           }
1788
1789         case ACT_NULL_ERROR:
1790           if (value && *value)
1791             /* Substitute parameter */
1792             break;
1793
1794           error = 0;
1795           if (!colon_seen && value)
1796             /* Substitute NULL */
1797             ;
1798           else
1799             {
1800               const char *str = pattern;
1801
1802               if (str[0] == '\0')
1803                 str = _("parameter null or not set");
1804
1805               __fxprintf (NULL, "%s: %s\n", env, str);
1806             }
1807
1808           if (free_value)
1809             free (value);
1810           goto do_error;
1811
1812         case ACT_NULL_SUBST:
1813           if (value && *value)
1814             /* Substitute parameter */
1815             break;
1816
1817           if (free_value)
1818             free (value);
1819
1820           if (!colon_seen && value)
1821             /* Substitute NULL */
1822             goto success;
1823
1824           value = pattern ? __strdup (pattern) : pattern;
1825           free_value = 1;
1826
1827           if (pattern && !value)
1828             goto no_space;
1829
1830           break;
1831
1832         case ACT_NONNULL_SUBST:
1833           if (value && (*value || !colon_seen))
1834             {
1835               if (free_value)
1836                 free (value);
1837
1838               value = pattern ? __strdup (pattern) : pattern;
1839               free_value = 1;
1840
1841               if (pattern && !value)
1842                 goto no_space;
1843
1844               break;
1845             }
1846
1847           /* Substitute NULL */
1848           if (free_value)
1849             free (value);
1850           goto success;
1851
1852         case ACT_NULL_ASSIGN:
1853           if (value && *value)
1854             /* Substitute parameter */
1855             break;
1856
1857           if (!colon_seen && value)
1858             {
1859               /* Substitute NULL */
1860               if (free_value)
1861                 free (value);
1862               goto success;
1863             }
1864
1865           if (free_value)
1866             free (value);
1867
1868           value = pattern ? __strdup (pattern) : pattern;
1869           free_value = 1;
1870
1871           if (pattern && !value)
1872             goto no_space;
1873
1874           __setenv (env, value ?: "", 1);
1875           break;
1876
1877         default:
1878           assert (! "Unrecognised action!");
1879         }
1880     }
1881
1882   free (env);
1883   env = NULL;
1884   free (pattern);
1885   pattern = NULL;
1886
1887   if (seen_hash)
1888     {
1889       char param_length[21];
1890       param_length[20] = '\0';
1891       *word = w_addstr (*word, word_length, max_length,
1892                         _itoa_word (value ? strlen (value) : 0,
1893                                     &param_length[20], 10, 0));
1894       if (free_value)
1895         {
1896           assert (value != NULL);
1897           free (value);
1898         }
1899
1900       return *word ? 0 : WRDE_NOSPACE;
1901     }
1902
1903   if (value == NULL)
1904     return 0;
1905
1906   if (quoted || !pwordexp)
1907     {
1908       /* Quoted - no field split */
1909       *word = w_addstr (*word, word_length, max_length, value);
1910       if (free_value)
1911         free (value);
1912
1913       return *word ? 0 : WRDE_NOSPACE;
1914     }
1915   else
1916     {
1917       /* Need to field-split */
1918       char *value_copy = __strdup (value); /* Don't modify value */
1919       char *field_begin = value_copy;
1920       int seen_nonws_ifs = 0;
1921
1922       if (free_value)
1923         free (value);
1924
1925       if (value_copy == NULL)
1926         goto no_space;
1927
1928       do
1929         {
1930           char *field_end = field_begin;
1931           char *next_field;
1932
1933           /* If this isn't the first field, start a new word */
1934           if (field_begin != value_copy)
1935             {
1936               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1937                 {
1938                   free (value_copy);
1939                   goto no_space;
1940                 }
1941
1942               *word = w_newword (word_length, max_length);
1943             }
1944
1945           /* Skip IFS whitespace before the field */
1946           field_begin += strspn (field_begin, ifs_white);
1947
1948           if (!seen_nonws_ifs && *field_begin == 0)
1949             /* Nothing but whitespace */
1950             break;
1951
1952           /* Search for the end of the field */
1953           field_end = field_begin + strcspn (field_begin, ifs);
1954
1955           /* Set up pointer to the character after end of field and
1956              skip whitespace IFS after it. */
1957           next_field = field_end + strspn (field_end, ifs_white);
1958
1959           /* Skip at most one non-whitespace IFS character after the field */
1960           seen_nonws_ifs = 0;
1961           if (*next_field && strchr (ifs, *next_field))
1962             {
1963               seen_nonws_ifs = 1;
1964               next_field++;
1965             }
1966
1967           /* Null-terminate it */
1968           *field_end = 0;
1969
1970           /* Tag a copy onto the current word */
1971           *word = w_addstr (*word, word_length, max_length, field_begin);
1972
1973           if (*word == NULL && *field_begin != '\0')
1974             {
1975               free (value_copy);
1976               goto no_space;
1977             }
1978
1979           field_begin = next_field;
1980         }
1981       while (seen_nonws_ifs || *field_begin);
1982
1983       free (value_copy);
1984     }
1985
1986   return 0;
1987
1988 success:
1989   error = 0;
1990   goto do_error;
1991
1992 no_space:
1993   error = WRDE_NOSPACE;
1994   goto do_error;
1995
1996 syntax:
1997   error = WRDE_SYNTAX;
1998
1999 do_error:
2000   free (env);
2001
2002   free (pattern);
2003
2004   return error;
2005 }
2006
2007 #undef CHAR_IN_SET
2008
2009 static int
2010 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2011                const char *words, size_t *offset, int flags,
2012                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2013                int quoted)
2014 {
2015   /* We are poised _at_ "$" */
2016   switch (words[1 + *offset])
2017     {
2018     case '"':
2019     case '\'':
2020     case 0:
2021       *word = w_addchar (*word, word_length, max_length, '$');
2022       return *word ? 0 : WRDE_NOSPACE;
2023
2024     case '(':
2025       if (words[2 + *offset] == '(')
2026         {
2027           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2028           int i = 3 + *offset;
2029           int depth = 0;
2030           while (words[i] && !(depth == 0 && words[i] == ')'))
2031             {
2032               if (words[i] == '(')
2033                 ++depth;
2034               else if (words[i] == ')')
2035                 --depth;
2036
2037               ++i;
2038             }
2039
2040           if (words[i] == ')' && words[i + 1] == ')')
2041             {
2042               (*offset) += 3;
2043               /* Call parse_arith -- 0 is for "no brackets" */
2044               return parse_arith (word, word_length, max_length, words, offset,
2045                                   flags, 0);
2046             }
2047         }
2048
2049       (*offset) += 2;
2050       return parse_comm (word, word_length, max_length, words, offset, flags,
2051                          quoted? NULL : pwordexp, ifs, ifs_white);
2052
2053     case '[':
2054       (*offset) += 2;
2055       /* Call parse_arith -- 1 is for "brackets" */
2056       return parse_arith (word, word_length, max_length, words, offset, flags,
2057                           1);
2058
2059     case '{':
2060     default:
2061       ++(*offset);      /* parse_param needs to know if "{" is there */
2062       return parse_param (word, word_length, max_length, words, offset, flags,
2063                            pwordexp, ifs, ifs_white, quoted);
2064     }
2065 }
2066
2067 static int
2068 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2069                 const char *words, size_t *offset, int flags,
2070                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2071 {
2072   /* We are poised just after "`" */
2073   int error;
2074   int squoting = 0;
2075   size_t comm_length;
2076   size_t comm_maxlen;
2077   char *comm = w_newword (&comm_length, &comm_maxlen);
2078
2079   for (; words[*offset]; ++(*offset))
2080     {
2081       switch (words[*offset])
2082         {
2083         case '`':
2084           /* Go -- give the script to the shell */
2085           error = exec_comm (comm, word, word_length, max_length, flags,
2086                              pwordexp, ifs, ifs_white);
2087           free (comm);
2088           return error;
2089
2090         case '\\':
2091           if (squoting)
2092             {
2093               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2094                                            words, offset);
2095
2096               if (error)
2097                 {
2098                   free (comm);
2099                   return error;
2100                 }
2101
2102               break;
2103             }
2104
2105           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2106                                    offset);
2107
2108           if (error)
2109             {
2110               free (comm);
2111               return error;
2112             }
2113
2114           break;
2115
2116         case '\'':
2117           squoting = 1 - squoting;
2118         default:
2119           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2120           if (comm == NULL)
2121             return WRDE_NOSPACE;
2122         }
2123     }
2124
2125   /* Premature end */
2126   free (comm);
2127   return WRDE_SYNTAX;
2128 }
2129
2130 static int
2131 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2132               const char *words, size_t *offset, int flags,
2133               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2134 {
2135   /* We are poised just after a double-quote */
2136   int error;
2137
2138   for (; words[*offset]; ++(*offset))
2139     {
2140       switch (words[*offset])
2141         {
2142         case '"':
2143           return 0;
2144
2145         case '$':
2146           error = parse_dollars (word, word_length, max_length, words, offset,
2147                                  flags, pwordexp, ifs, ifs_white, 1);
2148           /* The ``1'' here is to tell parse_dollars not to
2149            * split the fields.  It may need to, however ("$@").
2150            */
2151           if (error)
2152             return error;
2153
2154           break;
2155
2156         case '`':
2157           ++(*offset);
2158           error = parse_backtick (word, word_length, max_length, words,
2159                                   offset, flags, NULL, NULL, NULL);
2160           /* The first NULL here is to tell parse_backtick not to
2161            * split the fields.
2162            */
2163           if (error)
2164             return error;
2165
2166           break;
2167
2168         case '\\':
2169           error = parse_qtd_backslash (word, word_length, max_length, words,
2170                                        offset);
2171
2172           if (error)
2173             return error;
2174
2175           break;
2176
2177         default:
2178           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2179           if (*word == NULL)
2180             return WRDE_NOSPACE;
2181         }
2182     }
2183
2184   /* Unterminated string */
2185   return WRDE_SYNTAX;
2186 }
2187
2188 /*
2189  * wordfree() is to be called after pwordexp is finished with.
2190  */
2191
2192 void
2193 wordfree (wordexp_t *pwordexp)
2194 {
2195
2196   /* wordexp can set pwordexp to NULL */
2197   if (pwordexp && pwordexp->we_wordv)
2198     {
2199       char **wordv = pwordexp->we_wordv;
2200
2201       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2202         free (*wordv);
2203
2204       free (pwordexp->we_wordv);
2205       pwordexp->we_wordv = NULL;
2206     }
2207 }
2208 libc_hidden_def (wordfree)
2209
2210 /*
2211  * wordexp()
2212  */
2213
2214 int
2215 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2216 {
2217   size_t words_offset;
2218   size_t word_length;
2219   size_t max_length;
2220   char *word = w_newword (&word_length, &max_length);
2221   int error;
2222   char *ifs;
2223   char ifs_white[4];
2224   wordexp_t old_word = *pwordexp;
2225
2226   if (flags & WRDE_REUSE)
2227     {
2228       /* Minimal implementation of WRDE_REUSE for now */
2229       wordfree (pwordexp);
2230       old_word.we_wordv = NULL;
2231     }
2232
2233   if ((flags & WRDE_APPEND) == 0)
2234     {
2235       pwordexp->we_wordc = 0;
2236
2237       if (flags & WRDE_DOOFFS)
2238         {
2239           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2240           if (pwordexp->we_wordv == NULL)
2241             {
2242               error = WRDE_NOSPACE;
2243               goto do_error;
2244             }
2245         }
2246       else
2247         {
2248           pwordexp->we_wordv = calloc (1, sizeof (char *));
2249           if (pwordexp->we_wordv == NULL)
2250             {
2251               error = WRDE_NOSPACE;
2252               goto do_error;
2253             }
2254
2255           pwordexp->we_offs = 0;
2256         }
2257     }
2258
2259   /* Find out what the field separators are.
2260    * There are two types: whitespace and non-whitespace.
2261    */
2262   ifs = getenv ("IFS");
2263
2264   if (ifs == NULL)
2265     /* IFS unset - use <space><tab><newline>. */
2266     ifs = strcpy (ifs_white, " \t\n");
2267   else
2268     {
2269       char *ifsch = ifs;
2270       char *whch = ifs_white;
2271
2272       while (*ifsch != '\0')
2273         {
2274           if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2275             {
2276               /* Whitespace IFS.  See first whether it is already in our
2277                  collection.  */
2278               char *runp = ifs_white;
2279
2280               while (runp < whch && *runp != *ifsch)
2281                 ++runp;
2282
2283               if (runp == whch)
2284                 *whch++ = *ifsch;
2285             }
2286
2287           ++ifsch;
2288         }
2289       *whch = '\0';
2290     }
2291
2292   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2293     switch (words[words_offset])
2294       {
2295       case '\\':
2296         error = parse_backslash (&word, &word_length, &max_length, words,
2297                                  &words_offset);
2298
2299         if (error)
2300           goto do_error;
2301
2302         break;
2303
2304       case '$':
2305         error = parse_dollars (&word, &word_length, &max_length, words,
2306                                &words_offset, flags, pwordexp, ifs, ifs_white,
2307                                0);
2308
2309         if (error)
2310           goto do_error;
2311
2312         break;
2313
2314       case '`':
2315         ++words_offset;
2316         error = parse_backtick (&word, &word_length, &max_length, words,
2317                                 &words_offset, flags, pwordexp, ifs,
2318                                 ifs_white);
2319
2320         if (error)
2321           goto do_error;
2322
2323         break;
2324
2325       case '"':
2326         ++words_offset;
2327         error = parse_dquote (&word, &word_length, &max_length, words,
2328                               &words_offset, flags, pwordexp, ifs, ifs_white);
2329
2330         if (error)
2331           goto do_error;
2332
2333         if (!word_length)
2334           {
2335             error = w_addword (pwordexp, NULL);
2336
2337             if (error)
2338               return error;
2339           }
2340
2341         break;
2342
2343       case '\'':
2344         ++words_offset;
2345         error = parse_squote (&word, &word_length, &max_length, words,
2346                               &words_offset);
2347
2348         if (error)
2349           goto do_error;
2350
2351         if (!word_length)
2352           {
2353             error = w_addword (pwordexp, NULL);
2354
2355             if (error)
2356               return error;
2357           }
2358
2359         break;
2360
2361       case '~':
2362         error = parse_tilde (&word, &word_length, &max_length, words,
2363                              &words_offset, pwordexp->we_wordc);
2364
2365         if (error)
2366           goto do_error;
2367
2368         break;
2369
2370       case '*':
2371       case '[':
2372       case '?':
2373         error = parse_glob (&word, &word_length, &max_length, words,
2374                             &words_offset, flags, pwordexp, ifs, ifs_white);
2375
2376         if (error)
2377           goto do_error;
2378
2379         break;
2380
2381       default:
2382         /* Is it a word separator? */
2383         if (strchr (" \t", words[words_offset]) == NULL)
2384           {
2385             char ch = words[words_offset];
2386
2387             /* Not a word separator -- but is it a valid word char? */
2388             if (strchr ("\n|&;<>(){}", ch))
2389               {
2390                 /* Fail */
2391                 error = WRDE_BADCHAR;
2392                 goto do_error;
2393               }
2394
2395             /* "Ordinary" character -- add it to word */
2396             word = w_addchar (word, &word_length, &max_length,
2397                               ch);
2398             if (word == NULL)
2399               {
2400                 error = WRDE_NOSPACE;
2401                 goto do_error;
2402               }
2403
2404             break;
2405           }
2406
2407         /* If a word has been delimited, add it to the list. */
2408         if (word != NULL)
2409           {
2410             error = w_addword (pwordexp, word);
2411             if (error)
2412               goto do_error;
2413           }
2414
2415         word = w_newword (&word_length, &max_length);
2416       }
2417
2418   /* End of string */
2419
2420   /* There was a word separator at the end */
2421   if (word == NULL) /* i.e. w_newword */
2422     return 0;
2423
2424   /* There was no field separator at the end */
2425   return w_addword (pwordexp, word);
2426
2427 do_error:
2428   /* Error:
2429    *    free memory used (unless error is WRDE_NOSPACE), and
2430    *    set pwordexp members back to what they were.
2431    */
2432
2433   free (word);
2434
2435   if (error == WRDE_NOSPACE)
2436     return WRDE_NOSPACE;
2437
2438   if ((flags & WRDE_APPEND) == 0)
2439     wordfree (pwordexp);
2440
2441   *pwordexp = old_word;
2442   return error;
2443 }