posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997, 1998, 1999 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Library General Public License as
   8    published by the Free Software Foundation; either version 2 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Library General Public License for more details.
  15
  16    You should have received a copy of the GNU Library General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 #include <wordexp.h>
  22 #include <signal.h>
  23 #include <stdlib.h>
  24 #include <pwd.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <glob.h>
  28 #include <ctype.h>
  29 #include <sys/time.h>
  30 #include <sys/types.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <fcntl.h>
  34 #include <sys/stat.h>
  35 #include <paths.h>
  36 #include <errno.h>
  37 #include <sys/param.h>
  38 #include <stdio.h>
  39 #include <fnmatch.h>
  40
  41 #include <stdio-common/_itoa.h>
  42
  43 /* Undefine the following line for the production version.  */
  44 /* #define NDEBUG 1 */
  45 #include <assert.h>
  46
  47 /*
  48  * This is a recursive-descent-style word expansion routine.
  49  */
  50
  51 /* These variables are defined and initialized in the startup code.  */
  52 extern int __libc_argc;
  53 extern char **__libc_argv;
  54
  55 /* Some forward declarations */
  56 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  57                           const char *words, size_t *offset, int flags,
  58                           wordexp_t *pwordexp, const char *ifs,
  59                           const char *ifs_white, int quoted)
  60      internal_function;
  61 static int parse_backtick (char **word, size_t *word_length,
  62                            size_t *max_length, const char *words,
  63                            size_t *offset, int flags, wordexp_t *pwordexp,
  64                            const char *ifs, const char *ifs_white)
  65      internal_function;
  66 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  67                          const char *words, size_t *offset, int flags,
  68                          wordexp_t *pwordexp, const char *ifs,
  69                          const char *ifs_white)
  70      internal_function;
  71 static int eval_expr (char *expr, long int *result) internal_function;
  72
  73 /* The w_*() functions manipulate word lists. */
  74
  75 #define W_CHUNK (100)
  76
  77 /* Result of w_newword will be ignored if it's the last word. */
  78 static inline char *
  79 w_newword (size_t *actlen, size_t *maxlen)
  80 {
  81   *actlen = *maxlen = 0;
  82   return NULL;
  83 }
  84
  85 static inline char *
  86 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  87      /* (lengths exclude trailing zero) */
  88 {
  89   /* Add a character to the buffer, allocating room for it if needed.
  90    */
  91
  92   if (*actlen == *maxlen)
  93     {
  94       char *old_buffer = buffer;
  95       assert (buffer == NULL || *maxlen != 0);
  96       *maxlen += W_CHUNK;
  97       buffer = realloc (buffer, 1 + *maxlen);
  98
  99       if (buffer == NULL)
 100         free (old_buffer);
 101     }
 102
 103   if (buffer != NULL)
 104     {
 105       buffer[*actlen] = ch;
 106       buffer[++(*actlen)] = '\0';
 107     }
 108
 109   return buffer;
 110 }
 111
 112 static char *
 113 internal_function
 114 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 115           size_t len)
 116 {
 117   /* Add a string to the buffer, allocating room for it if needed.
 118    */
 119   if (*actlen + len > *maxlen)
 120     {
 121       char *old_buffer = buffer;
 122       assert (buffer == NULL || *maxlen != 0);
 123       *maxlen += MAX (2 * len, W_CHUNK);
 124       buffer = realloc (old_buffer, 1 + *maxlen);
 125
 126       if (buffer == NULL)
 127         free (old_buffer);
 128     }
 129
 130   if (buffer != NULL)
 131     {
 132       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 133       *actlen += len;
 134     }
 135
 136   return buffer;
 137 }
 138
 139 static char *
 140 internal_function
 141 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 142      /* (lengths exclude trailing zero) */
 143 {
 144   /* Add a string to the buffer, allocating room for it if needed.
 145    */
 146   size_t len;
 147
 148   assert (str != NULL); /* w_addstr only called from this file */
 149   len = strlen (str);
 150
 151   return w_addmem (buffer, actlen, maxlen, str, len);
 152 }
 153
 154 static int
 155 internal_function
 156 w_addword (wordexp_t *pwordexp, char *word)
 157 {
 158   /* Add a word to the wordlist */
 159   size_t num_p;
 160   char **new_wordv;
 161
 162   /* Internally, NULL acts like "".  Convert NULLs to "" before
 163    * the caller sees them.
 164    */
 165   if (word == NULL)
 166     {
 167       word = __strdup ("");
 168       if (word == NULL)
 169         goto no_space;
 170     }
 171
 172   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 173   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 174   if (new_wordv != NULL)
 175     {
 176       pwordexp->we_wordv = new_wordv;
 177       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 178       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 179       return 0;
 180     }
 181
 182 no_space:
 183   return WRDE_NOSPACE;
 184 }
 185
 186 /* The parse_*() functions should leave *offset being the offset in 'words'
 187  * to the last character processed.
 188  */
 189
 190 static int
 191 internal_function
 192 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 193                  const char *words, size_t *offset)
 194 {
 195   /* We are poised _at_ a backslash, not in quotes */
 196
 197   switch (words[1 + *offset])
 198     {
 199     case 0:
 200       /* Backslash is last character of input words */
 201       return WRDE_SYNTAX;
 202
 203     case '\n':
 204       ++(*offset);
 205       break;
 206
 207     default:
 208       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 209       if (*word == NULL)
 210         return WRDE_NOSPACE;
 211
 212       ++(*offset);
 213       break;
 214     }
 215
 216   return 0;
 217 }
 218
 219 static int
 220 internal_function
 221 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 222                      const char *words, size_t *offset)
 223 {
 224   /* We are poised _at_ a backslash, inside quotes */
 225
 226   switch (words[1 + *offset])
 227     {
 228     case 0:
 229       /* Backslash is last character of input words */
 230       return WRDE_SYNTAX;
 231
 232     case '\n':
 233       ++(*offset);
 234       break;
 235
 236     case '$':
 237     case '`':
 238     case '"':
 239     case '\\':
 240       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 241       if (*word == NULL)
 242         return WRDE_NOSPACE;
 243
 244       ++(*offset);
 245       break;
 246
 247     default:
 248       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 249       if (*word != NULL)
 250         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 251
 252       if (*word == NULL)
 253         return WRDE_NOSPACE;
 254
 255       ++(*offset);
 256       break;
 257     }
 258
 259   return 0;
 260 }
 261
 262 static int
 263 internal_function
 264 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 265              const char *words, size_t *offset, size_t wordc)
 266 {
 267   /* We are poised _at_ a tilde */
 268   size_t i;
 269
 270   if (*word_length != 0)
 271     {
 272       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 273         {
 274           if (!((*word)[*word_length - 1] == ':'
 275                 && strchr (*word, '=') && wordc == 0))
 276             {
 277               *word = w_addchar (*word, word_length, max_length, '~');
 278               return *word ? 0 : WRDE_NOSPACE;
 279             }
 280         }
 281     }
 282
 283   for (i = 1 + *offset; words[i]; i++)
 284     {
 285       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 286           words[i] == '\t' || words[i] == 0 )
 287         break;
 288
 289       if (words[i] == '\\')
 290         {
 291           *word = w_addchar (*word, word_length, max_length, '~');
 292           return *word ? 0 : WRDE_NOSPACE;
 293         }
 294     }
 295
 296   if (i == 1 + *offset)
 297     {
 298       /* Tilde appears on its own */
 299       uid_t uid;
 300       struct passwd pwd, *tpwd;
 301       int buflen = 1000;
 302       char* home;
 303       char* buffer;
 304       int result;
 305
 306       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 307          results are unspecified.  We do a lookup on the uid if
 308          HOME is unset. */
 309
 310       home = getenv ("HOME");
 311       if (home != NULL)
 312         {
 313           *word = w_addstr (*word, word_length, max_length, home);
 314           if (*word == NULL)
 315             return WRDE_NOSPACE;
 316         }
 317       else
 318         {
 319           uid = __getuid ();
 320           buffer = __alloca (buflen);
 321
 322           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 323                  && errno == ERANGE)
 324             {
 325               buflen += 1000;
 326               buffer = __alloca (buflen);
 327             }
 328
 329           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 330             {
 331               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 332               if (*word == NULL)
 333                 return WRDE_NOSPACE;
 334             }
 335           else
 336             {
 337               *word = w_addchar (*word, word_length, max_length, '~');
 338               if (*word == NULL)
 339                 return WRDE_NOSPACE;
 340             }
 341         }
 342     }
 343   else
 344     {
 345       /* Look up user name in database to get home directory */
 346       char *user = __strndup (&words[1 + *offset], i - (1 + *offset));
 347       struct passwd pwd, *tpwd;
 348       int buflen = 1000;
 349       char* buffer = __alloca (buflen);
 350       int result;
 351
 352       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 353              && errno == ERANGE)
 354         {
 355           buflen += 1000;
 356           buffer = __alloca (buflen);
 357         }
 358
 359       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 360         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 361       else
 362         {
 363           /* (invalid login name) */
 364           *word = w_addchar (*word, word_length, max_length, '~');
 365           if (*word != NULL)
 366             *word = w_addstr (*word, word_length, max_length, user);
 367         }
 368
 369       *offset = i - 1;
 370     }
 371   return *word ? 0 : WRDE_NOSPACE;
 372 }
 373
 374
 375 static int
 376 internal_function
 377 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 378                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 379                const char *ifs_white)
 380 {
 381   int error;
 382   int match;
 383   glob_t globbuf;
 384
 385   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 386
 387   if (error != 0)
 388     {
 389       /* We can only run into memory problems.  */
 390       assert (error == GLOB_NOSPACE);
 391       return WRDE_NOSPACE;
 392     }
 393
 394   if (ifs && !*ifs)
 395     {
 396       /* No field splitting allowed. */
 397       assert (globbuf.gl_pathv[0] != NULL);
 398       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 399       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 400         {
 401           *word = w_addchar (*word, word_length, max_length, ' ');
 402           if (*word != NULL)
 403             *word = w_addstr (*word, word_length, max_length,
 404                               globbuf.gl_pathv[match]);
 405         }
 406
 407       globfree (&globbuf);
 408       return *word ? 0 : WRDE_NOSPACE;
 409     }
 410
 411   assert (ifs == NULL || *ifs != '\0');
 412   if (*word != NULL)
 413     {
 414       free (*word);
 415       *word = w_newword (word_length, max_length);
 416     }
 417
 418   for (match = 0; match < globbuf.gl_pathc; ++match)
 419     {
 420       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 421       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 422         {
 423           globfree (&globbuf);
 424           return WRDE_NOSPACE;
 425         }
 426     }
 427
 428   globfree (&globbuf);
 429   return 0;
 430 }
 431
 432 static int
 433 internal_function
 434 parse_glob (char **word, size_t *word_length, size_t *max_length,
 435             const char *words, size_t *offset, int flags,
 436             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 437 {
 438   /* We are poised just after a '*', a '[' or a '?'. */
 439   int error = WRDE_NOSPACE;
 440   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 441   int i;
 442   wordexp_t glob_list; /* List of words to glob */
 443
 444   glob_list.we_wordc = 0;
 445   glob_list.we_wordv = NULL;
 446   glob_list.we_offs = 0;
 447   for (; words[*offset] != '\0'; ++*offset)
 448     {
 449       if ((ifs && strchr (ifs, words[*offset])) ||
 450           (!ifs && strchr (" \t\n", words[*offset])))
 451         /* Reached IFS */
 452         break;
 453
 454       /* Sort out quoting */
 455       if (words[*offset] == '\'')
 456         {
 457           if (quoted == 0)
 458             {
 459               quoted = 1;
 460               continue;
 461             }
 462           else if (quoted == 1)
 463             {
 464               quoted = 0;
 465               continue;
 466             }
 467         }
 468       else if (words[*offset] == '"')
 469         {
 470           if (quoted == 0)
 471             {
 472               quoted = 2;
 473               continue;
 474             }
 475           else if (quoted == 2)
 476             {
 477               quoted = 0;
 478               continue;
 479             }
 480         }
 481
 482       /* Sort out other special characters */
 483       if (quoted != 1 && words[*offset] == '$')
 484         {
 485           error = parse_dollars (word, word_length, max_length, words,
 486                                  offset, flags, &glob_list, ifs, ifs_white,
 487                                  quoted == 2);
 488           if (error)
 489             goto tidy_up;
 490
 491           continue;
 492         }
 493       else if (words[*offset] == '\\')
 494         {
 495           if (quoted)
 496             error = parse_qtd_backslash (word, word_length, max_length,
 497                                          words, offset);
 498           else
 499             error = parse_backslash (word, word_length, max_length,
 500                                      words, offset);
 501
 502           if (error)
 503             goto tidy_up;
 504
 505           continue;
 506         }
 507
 508       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 509       if (*word == NULL)
 510         goto tidy_up;
 511     }
 512
 513   /* Don't forget to re-parse the character we stopped at. */
 514   --*offset;
 515
 516   /* Glob the words */
 517   error = w_addword (&glob_list, *word);
 518   *word = w_newword (word_length, max_length);
 519   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 520     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 521                            max_length, pwordexp, ifs, ifs_white);
 522
 523   /* Now tidy up */
 524 tidy_up:
 525   wordfree (&glob_list);
 526   return error;
 527 }
 528
 529 static int
 530 internal_function
 531 parse_squote (char **word, size_t *word_length, size_t *max_length,
 532               const char *words, size_t *offset)
 533 {
 534   /* We are poised just after a single quote */
 535   for (; words[*offset]; ++(*offset))
 536     {
 537       if (words[*offset] != '\'')
 538         {
 539           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 540           if (*word == NULL)
 541             return WRDE_NOSPACE;
 542         }
 543       else return 0;
 544     }
 545
 546   /* Unterminated string */
 547   return WRDE_SYNTAX;
 548 }
 549
 550 /* Functions to evaluate an arithmetic expression */
 551 static int
 552 internal_function
 553 eval_expr_val (char **expr, long int *result)
 554 {
 555   int sgn = +1;
 556   char *digit;
 557
 558   /* Skip white space */
 559   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 560
 561   switch (*digit)
 562     {
 563     case '(':
 564
 565       /* Scan for closing paren */
 566       for (++digit; **expr && **expr != ')'; ++(*expr));
 567
 568       /* Is there one? */
 569       if (!**expr)
 570         return WRDE_SYNTAX;
 571
 572       *(*expr)++ = 0;
 573
 574       if (eval_expr (digit, result))
 575         return WRDE_SYNTAX;
 576
 577       return 0;
 578
 579     case '+':   /* Positive value */
 580       ++digit;
 581       break;
 582
 583     case '-':   /* Negative value */
 584       ++digit;
 585       sgn = -1;
 586       break;
 587
 588     default:
 589       if (!isdigit (*digit))
 590         return WRDE_SYNTAX;
 591     }
 592
 593   *result = 0;
 594   for (; *digit && isdigit (*digit); ++digit)
 595     *result = (*result * 10) + (*digit - '0');
 596
 597   *expr = digit;
 598   *result *= sgn;
 599   return 0;
 600 }
 601
 602 static int
 603 internal_function
 604 eval_expr_multdiv (char **expr, long int *result)
 605 {
 606   long int arg;
 607
 608   /* Read a Value */
 609   if (eval_expr_val (expr, result) != 0)
 610     return WRDE_SYNTAX;
 611
 612   while (**expr)
 613     {
 614       /* Skip white space */
 615       for (; *expr && **expr && isspace (**expr); ++(*expr));
 616
 617       if (**expr == '*')
 618         {
 619           ++(*expr);
 620           if (eval_expr_val (expr, &arg) != 0)
 621             return WRDE_SYNTAX;
 622
 623           *result *= arg;
 624         }
 625       else if (**expr == '/')
 626         {
 627           ++(*expr);
 628           if (eval_expr_val (expr, &arg) != 0)
 629             return WRDE_SYNTAX;
 630
 631           *result /= arg;
 632         }
 633       else break;
 634     }
 635
 636   return 0;
 637 }
 638
 639 static int
 640 internal_function
 641 eval_expr (char *expr, long int *result)
 642 {
 643   long int arg;
 644
 645   /* Read a Multdiv */
 646   if (eval_expr_multdiv (&expr, result) != 0)
 647     return WRDE_SYNTAX;
 648
 649   while (*expr)
 650     {
 651       /* Skip white space */
 652       for (; expr && *expr && isspace (*expr); ++expr);
 653
 654       if (*expr == '+')
 655         {
 656           ++expr;
 657           if (eval_expr_multdiv (&expr, &arg) != 0)
 658             return WRDE_SYNTAX;
 659
 660           *result += arg;
 661         }
 662       else if (*expr == '-')
 663         {
 664           ++expr;
 665           if (eval_expr_multdiv (&expr, &arg) != 0)
 666             return WRDE_SYNTAX;
 667
 668           *result -= arg;
 669         }
 670       else break;
 671     }
 672
 673   return 0;
 674 }
 675
 676 static int
 677 internal_function
 678 parse_arith (char **word, size_t *word_length, size_t *max_length,
 679              const char *words, size_t *offset, int flags, int bracket)
 680 {
 681   /* We are poised just after "$((" or "$[" */
 682   int error;
 683   int paren_depth = 1;
 684   size_t expr_length;
 685   size_t expr_maxlen;
 686   char *expr;
 687
 688   expr = w_newword (&expr_length, &expr_maxlen);
 689   for (; words[*offset]; ++(*offset))
 690     {
 691       switch (words[*offset])
 692         {
 693         case '$':
 694           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 695                                  words, offset, flags, NULL, NULL, NULL, 1);
 696           /* The ``1'' here is to tell parse_dollars not to
 697            * split the fields.
 698            */
 699           if (error)
 700             {
 701               free (expr);
 702               return error;
 703             }
 704           break;
 705
 706         case '`':
 707           (*offset)++;
 708           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 709                                   words, offset, flags, NULL, NULL, NULL);
 710           /* The first NULL here is to tell parse_backtick not to
 711            * split the fields.
 712            */
 713           if (error)
 714             {
 715               free (expr);
 716               return error;
 717             }
 718           break;
 719
 720         case '\\':
 721           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 722                                        words, offset);
 723           if (error)
 724             {
 725               free (expr);
 726               return error;
 727             }
 728           /* I think that a backslash within an
 729            * arithmetic expansion is bound to
 730            * cause an error sooner or later anyway though.
 731            */
 732           break;
 733
 734         case ')':
 735           if (--paren_depth == 0)
 736             {
 737               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 738               long int numresult = 0;
 739               long long int convertme;
 740
 741               if (bracket || words[1 + *offset] != ')')
 742                 {
 743                   free (expr);
 744                   return WRDE_SYNTAX;
 745                 }
 746
 747               ++(*offset);
 748
 749               /* Go - evaluate. */
 750               if (*expr && eval_expr (expr, &numresult) != 0)
 751                 {
 752                   free (expr);
 753                   return WRDE_SYNTAX;
 754                 }
 755
 756               if (numresult < 0)
 757                 {
 758                   convertme = -numresult;
 759                   *word = w_addchar (*word, word_length, max_length, '-');
 760                   if (!*word)
 761                     {
 762                       free (expr);
 763                       return WRDE_NOSPACE;
 764                     }
 765                 }
 766               else
 767                 convertme = numresult;
 768
 769               result[20] = '\0';
 770               *word = w_addstr (*word, word_length, max_length,
 771                                 _itoa (convertme, &result[20], 10, 0));
 772               free (expr);
 773               return *word ? 0 : WRDE_NOSPACE;
 774             }
 775           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 776           if (expr == NULL)
 777             return WRDE_NOSPACE;
 778
 779           break;
 780
 781         case ']':
 782           if (bracket && paren_depth == 1)
 783             {
 784               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 785               long int numresult = 0;
 786
 787               /* Go - evaluate. */
 788               if (*expr && eval_expr (expr, &numresult) != 0)
 789                 {
 790                   free (expr);
 791                   return WRDE_SYNTAX;
 792                 }
 793
 794               result[20] = '\0';
 795               *word = w_addstr (*word, word_length, max_length,
 796                                 _itoa_word (numresult, &result[20], 10, 0));
 797               free (expr);
 798               return *word ? 0 : WRDE_NOSPACE;
 799             }
 800
 801           free (expr);
 802           return WRDE_SYNTAX;
 803
 804         case '\n':
 805         case ';':
 806         case '{':
 807         case '}':
 808           free (expr);
 809           return WRDE_BADCHAR;
 810
 811         case '(':
 812           ++paren_depth;
 813         default:
 814           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 815           if (expr == NULL)
 816             return WRDE_NOSPACE;
 817         }
 818     }
 819
 820   /* Premature end */
 821   free (expr);
 822   return WRDE_SYNTAX;
 823 }
 824
 825 /* Function called by child process in exec_comm() */
 826 static void
 827 internal_function
 828 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 829 {
 830   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 831
 832   /* Execute the command, or just check syntax? */
 833   if (noexec)
 834     args[1] = "-nc";
 835
 836   /* Redirect output.  */
 837   __dup2 (fildes[1], 1);
 838   __close (fildes[1]);
 839
 840   /* Redirect stderr to /dev/null if we have to.  */
 841   if (showerr == 0)
 842     {
 843       int fd;
 844       __close (2);
 845       fd = __open (_PATH_DEVNULL, O_WRONLY);
 846       if (fd >= 0 && fd != 2)
 847         {
 848           __dup2 (fd, 2);
 849           __close (fd);
 850         }
 851     }
 852
 853   /* Make sure the subshell doesn't field-split on our behalf. */
 854   unsetenv ("IFS");
 855
 856   __close (fildes[0]);
 857   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 858
 859   /* Bad.  What now?  */
 860   abort ();
 861 }
 862
 863 /* Function to execute a command and retrieve the results */
 864 /* pwordexp contains NULL if field-splitting is forbidden */
 865 static int
 866 internal_function
 867 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 868            int flags, wordexp_t *pwordexp, const char *ifs,
 869            const char *ifs_white)
 870 {
 871   int fildes[2];
 872   int bufsize = 128;
 873   int buflen;
 874   int i;
 875   int status = 0;
 876   size_t maxnewlines = 0;
 877   char *buffer;
 878   pid_t pid;
 879
 880   /* Don't fork() unless necessary */
 881   if (!comm || !*comm)
 882     return 0;
 883
 884   if (__pipe (fildes))
 885     /* Bad */
 886     return WRDE_NOSPACE;
 887
 888   if ((pid = __fork ()) < 0)
 889     {
 890       /* Bad */
 891       __close (fildes[0]);
 892       __close (fildes[1]);
 893       return WRDE_NOSPACE;
 894     }
 895
 896   if (pid == 0)
 897     exec_comm_child(comm, fildes, (flags & WRDE_SHOWERR), 0);
 898
 899   /* Parent */
 900
 901   __close (fildes[1]);
 902   buffer = __alloca (bufsize);
 903
 904   if (!pwordexp)
 905     /* Quoted - no field splitting */
 906     {
 907       while (1)
 908         {
 909           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 910             {
 911               if (__waitpid (pid, &status, WNOHANG) == 0)
 912                 continue;
 913               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 914                 break;
 915             }
 916
 917           maxnewlines += buflen;
 918
 919           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 920           if (*word == NULL)
 921             goto no_space;
 922         }
 923     }
 924   else
 925     /* Not quoted - split fields */
 926     {
 927       int copying = 0;
 928       /* 'copying' is:
 929        *  0 when searching for first character in a field not IFS white space
 930        *  1 when copying the text of a field
 931        *  2 when searching for possible non-whitespace IFS
 932        *  3 when searching for non-newline after copying field
 933        */
 934
 935       while (1)
 936         {
 937           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 938             {
 939               if (__waitpid (pid, &status, WNOHANG) == 0)
 940                 continue;
 941               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 942                 break;
 943             }
 944
 945           for (i = 0; i < buflen; ++i)
 946             {
 947               if (strchr (ifs, buffer[i]) != NULL)
 948                 {
 949                   /* Current character is IFS */
 950                   if (strchr (ifs_white, buffer[i]) == NULL)
 951                     {
 952                       /* Current character is IFS but not whitespace */
 953                       if (copying == 2)
 954                         {
 955                           /*            current character
 956                            *                   |
 957                            *                   V
 958                            * eg: text<space><comma><space>moretext
 959                            *
 960                            * So, strip whitespace IFS (like at the start)
 961                            */
 962                           copying = 0;
 963                           continue;
 964                         }
 965
 966                       copying = 0;
 967                       /* fall through and delimit field.. */
 968                     }
 969                   else
 970                     {
 971                       if (buffer[i] == '\n')
 972                         {
 973                           /* Current character is (IFS) newline */
 974
 975                           /* If copying a field, this is the end of it,
 976                              but maybe all that's left is trailing newlines.
 977                              So start searching for a non-newline. */
 978                           if (copying == 1)
 979                             copying = 3;
 980
 981                           continue;
 982                         }
 983                       else
 984                         {
 985                           /* Current character is IFS white space, but
 986                              not a newline */
 987
 988                           /* If not either copying a field or searching
 989                              for non-newline after a field, ignore it */
 990                           if (copying != 1 && copying != 3)
 991                             continue;
 992
 993                           /* End of field (search for non-ws IFS afterwards) */
 994                           copying = 2;
 995                         }
 996                     }
 997
 998                   /* First IFS white space (non-newline), or IFS non-whitespace.
 999                    * Delimit the field.  Nulls are converted by w_addword. */
1000                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1001                     goto no_space;
1002
1003                   *word = w_newword (word_length, max_length);
1004
1005                   maxnewlines = 0;
1006                   /* fall back round the loop.. */
1007                 }
1008               else
1009                 {
1010                   /* Not IFS character */
1011
1012                   if (copying == 3)
1013                     {
1014                       /* Nothing but (IFS) newlines since the last field,
1015                          so delimit it here before starting new word */
1016                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1017                         goto no_space;
1018
1019                       *word = w_newword (word_length, max_length);
1020                     }
1021
1022                   copying = 1;
1023
1024                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1025                     maxnewlines++;
1026                   else
1027                     maxnewlines = 0;
1028
1029                   *word = w_addchar (*word, word_length, max_length,
1030                                      buffer[i]);
1031                   if (*word == NULL)
1032                     goto no_space;
1033                 }
1034             }
1035         }
1036     }
1037
1038   /* Chop off trailing newlines (required by POSIX.2)  */
1039   /* Ensure we don't go back further than the beginning of the
1040      substitution (i.e. remove maxnewlines bytes at most) */
1041   while (maxnewlines-- != 0 &&
1042          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1043     {
1044       (*word)[--*word_length] = '\0';
1045
1046       /* If the last word was entirely newlines, turn it into a new word
1047        * which can be ignored if there's nothing following it. */
1048       if (*word_length == 0)
1049         {
1050           free (*word);
1051           *word = w_newword (word_length, max_length);
1052           break;
1053         }
1054     }
1055
1056   __close (fildes[0]);
1057
1058   /* Check for syntax error (re-execute but with "-n" flag) */
1059   if (buflen < 1 && status != 0)
1060     {
1061       if ((pid = __fork ()) < 0)
1062         {
1063           /* Bad */
1064           return WRDE_NOSPACE;
1065         }
1066
1067       if (pid == 0)
1068         {
1069           fildes[0] = fildes[1] = -1;
1070           exec_comm_child(comm, fildes, 0, 1);
1071         }
1072
1073       if (__waitpid (pid, &status, 0) == pid && status != 0)
1074         return WRDE_SYNTAX;
1075     }
1076
1077   return 0;
1078
1079 no_space:
1080   __kill (pid, SIGKILL);
1081   __waitpid (pid, NULL, 0);
1082   __close (fildes[0]);
1083   return WRDE_NOSPACE;
1084 }
1085
1086 static int
1087 internal_function
1088 parse_comm (char **word, size_t *word_length, size_t *max_length,
1089             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1090             const char *ifs, const char *ifs_white)
1091 {
1092   /* We are poised just after "$(" */
1093   int paren_depth = 1;
1094   int error = 0;
1095   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1096   size_t comm_length;
1097   size_t comm_maxlen;
1098   char *comm = w_newword (&comm_length, &comm_maxlen);
1099
1100   for (; words[*offset]; ++(*offset))
1101     {
1102       switch (words[*offset])
1103         {
1104         case '\'':
1105           if (quoted == 0)
1106             quoted = 1;
1107           else if (quoted == 1)
1108             quoted = 0;
1109
1110           break;
1111
1112         case '"':
1113           if (quoted == 0)
1114             quoted = 2;
1115           else if (quoted == 2)
1116             quoted = 0;
1117
1118           break;
1119
1120         case ')':
1121           if (!quoted && --paren_depth == 0)
1122             {
1123               /* Go -- give script to the shell */
1124               if (comm)
1125                 {
1126                   error = exec_comm (comm, word, word_length, max_length,
1127                                      flags, pwordexp, ifs, ifs_white);
1128                   free (comm);
1129                 }
1130
1131               return error;
1132             }
1133
1134           /* This is just part of the script */
1135           break;
1136
1137         case '(':
1138           if (!quoted)
1139             ++paren_depth;
1140         }
1141
1142       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1143       if (comm == NULL)
1144         return WRDE_NOSPACE;
1145     }
1146
1147   /* Premature end */
1148   if (comm)
1149     free (comm);
1150
1151   return WRDE_SYNTAX;
1152 }
1153
1154 static int
1155 internal_function
1156 parse_param (char **word, size_t *word_length, size_t *max_length,
1157              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1158              const char *ifs, const char *ifs_white, int quoted)
1159 {
1160   /* We are poised just after "$" */
1161   enum action
1162   {
1163     ACT_NONE,
1164     ACT_RP_SHORT_LEFT = '#',
1165     ACT_RP_LONG_LEFT = 'L',
1166     ACT_RP_SHORT_RIGHT = '%',
1167     ACT_RP_LONG_RIGHT = 'R',
1168     ACT_NULL_ERROR = '?',
1169     ACT_NULL_SUBST = '-',
1170     ACT_NONNULL_SUBST = '+',
1171     ACT_NULL_ASSIGN = '='
1172   };
1173   size_t env_length;
1174   size_t env_maxlen;
1175   size_t pat_length;
1176   size_t pat_maxlen;
1177   size_t start = *offset;
1178   char *env;
1179   char *pattern;
1180   char *value = NULL;
1181   enum action action = ACT_NONE;
1182   int depth = 0;
1183   int colon_seen = 0;
1184   int seen_hash = 0;
1185   int free_value = 0;
1186   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1187   int error;
1188   int special = 0;
1189   char buffer[21];
1190   int brace = words[*offset] == '{';
1191
1192   env = w_newword (&env_length, &env_maxlen);
1193   pattern = w_newword (&pat_length, &pat_maxlen);
1194
1195   if (brace)
1196     ++*offset;
1197
1198   /* First collect the parameter name. */
1199
1200   if (words[*offset] == '#')
1201     {
1202       seen_hash = 1;
1203       if (!brace)
1204         goto envsubst;
1205       ++*offset;
1206     }
1207
1208   if (isalpha (words[*offset]) || words[*offset] == '_')
1209     {
1210       /* Normal parameter name. */
1211       do
1212         {
1213           env = w_addchar (env, &env_length, &env_maxlen,
1214                            words[*offset]);
1215           if (env == NULL)
1216             goto no_space;
1217         }
1218       while (isalnum (words[++*offset]) || words[*offset] == '_');
1219     }
1220   else if (isdigit (words[*offset]))
1221     {
1222       /* Numeric parameter name. */
1223       special = 1;
1224       do
1225         {
1226           env = w_addchar (env, &env_length, &env_maxlen,
1227                            words[*offset]);
1228           if (env == NULL)
1229             goto no_space;
1230           if (!brace)
1231             goto envsubst;
1232         }
1233       while (isdigit(words[++*offset]));
1234     }
1235   else if (strchr ("*@$", words[*offset]) != NULL)
1236     {
1237       /* Special parameter. */
1238       special = 1;
1239       env = w_addchar (env, &env_length, &env_maxlen,
1240                        words[*offset]);
1241       if (env == NULL)
1242         goto no_space;
1243       ++*offset;
1244     }
1245   else
1246     {
1247       if (brace)
1248         goto syntax;
1249     }
1250
1251   if (brace)
1252     {
1253       /* Check for special action to be applied to the value. */
1254       switch (words[*offset])
1255         {
1256         case '}':
1257           /* Evaluate. */
1258           goto envsubst;
1259
1260         case '#':
1261           action = ACT_RP_SHORT_LEFT;
1262           if (words[1 + *offset] == '#')
1263             {
1264               ++*offset;
1265               action = ACT_RP_LONG_LEFT;
1266             }
1267           break;
1268
1269         case '%':
1270           action = ACT_RP_SHORT_RIGHT;
1271           if (words[1 + *offset] == '%')
1272             {
1273               ++*offset;
1274               action = ACT_RP_LONG_RIGHT;
1275             }
1276           break;
1277
1278         case ':':
1279           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1280             goto syntax;
1281
1282           colon_seen = 1;
1283           action = words[++*offset];
1284           break;
1285
1286         case '-':
1287         case '=':
1288         case '?':
1289         case '+':
1290           action = words[*offset];
1291           break;
1292
1293         default:
1294           goto syntax;
1295         }
1296
1297       /* Now collect the pattern, but don't expand it yet. */
1298       ++*offset;
1299       for (; words[*offset]; ++(*offset))
1300         {
1301           switch (words[*offset])
1302             {
1303             case '{':
1304               if (!pattern_is_quoted)
1305                 ++depth;
1306               break;
1307
1308             case '}':
1309               if (!pattern_is_quoted)
1310                 {
1311                   if (depth == 0)
1312                     goto envsubst;
1313                   --depth;
1314                 }
1315               break;
1316
1317             case '\\':
1318               if (pattern_is_quoted)
1319                 /* Quoted; treat as normal character. */
1320                 break;
1321
1322               /* Otherwise, it's an escape: next character is literal. */
1323               if (words[++*offset] == '\0')
1324                 goto syntax;
1325
1326               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1327               if (pattern == NULL)
1328                 goto no_space;
1329
1330               break;
1331
1332             case '\'':
1333               if (pattern_is_quoted == 0)
1334                 pattern_is_quoted = 1;
1335               else if (pattern_is_quoted == 1)
1336                 pattern_is_quoted = 0;
1337
1338               break;
1339
1340             case '"':
1341               if (pattern_is_quoted == 0)
1342                 pattern_is_quoted = 2;
1343               else if (pattern_is_quoted == 2)
1344                 pattern_is_quoted = 0;
1345
1346               break;
1347             }
1348
1349           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1350                                words[*offset]);
1351           if (pattern == NULL)
1352             goto no_space;
1353         }
1354     }
1355
1356   /* End of input string -- remember to reparse the character that we
1357    * stopped at.  */
1358   --(*offset);
1359
1360 envsubst:
1361   if (words[start] == '{' && words[*offset] != '}')
1362     goto syntax;
1363
1364   if (env == NULL)
1365     {
1366       if (seen_hash)
1367         {
1368           /* $# expands to the number of positional parameters */
1369           buffer[20] = '\0';
1370           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1371           seen_hash = 0;
1372         }
1373       else
1374         {
1375           /* Just $ on its own */
1376           *offset = start - 1;
1377           *word = w_addchar (*word, word_length, max_length, '$');
1378           return *word ? 0 : WRDE_NOSPACE;
1379         }
1380     }
1381   /* Is it a numeric parameter? */
1382   else if (isdigit (env[0]))
1383     {
1384       int n = atoi (env);
1385
1386       if (n >= __libc_argc)
1387         /* Substitute NULL. */
1388         value = NULL;
1389       else
1390         /* Replace with appropriate positional parameter. */
1391         value = __libc_argv[n];
1392     }
1393   /* Is it a special parameter? */
1394   else if (special)
1395     {
1396       /* Is it `$$'? */
1397       if (*env == '$')
1398         {
1399           buffer[20] = '\0';
1400           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1401         }
1402       /* Is it `${#*}' or `${#@}'? */
1403       else if ((*env == '*' || *env == '@') && seen_hash)
1404         {
1405           buffer[20] = '\0';
1406           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1407                               &buffer[20], 10, 0);
1408           *word = w_addstr (*word, word_length, max_length, value);
1409           free (env);
1410           if (pattern)
1411             free (pattern);
1412           return *word ? 0 : WRDE_NOSPACE;
1413         }
1414       /* Is it `$*' or `$@' (unquoted) ? */
1415       else if (*env == '*' || (*env == '@' && !quoted))
1416         {
1417           size_t plist_len = 0;
1418           int p;
1419           char *end;
1420
1421           /* Build up value parameter by parameter (copy them) */
1422           for (p = 1; __libc_argv[p]; ++p)
1423             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1424           value = malloc (plist_len);
1425           if (value == NULL)
1426             goto no_space;
1427           end = value;
1428           *end = 0;
1429           for (p = 1; __libc_argv[p]; ++p)
1430             {
1431               if (p > 1)
1432                 *end++ = ' ';
1433               end = __stpcpy (end, __libc_argv[p]);
1434             }
1435
1436           free_value = 1;
1437         }
1438       else
1439         {
1440           /* Must be a quoted `$@' */
1441           assert (*env == '@' && quoted);
1442
1443           /* Each parameter is a separate word ("$@") */
1444           if (__libc_argc == 2)
1445             value = __libc_argv[1];
1446           else if (__libc_argc > 2)
1447             {
1448               int p;
1449
1450               /* Append first parameter to current word. */
1451               value = w_addstr (*word, word_length, max_length,
1452                                 __libc_argv[1]);
1453               if (value == NULL || w_addword (pwordexp, value))
1454                 goto no_space;
1455
1456               for (p = 2; __libc_argv[p + 1]; p++)
1457                 {
1458                   char *newword = __strdup (__libc_argv[p]);
1459                   if (newword == NULL || w_addword (pwordexp, newword))
1460                     goto no_space;
1461                 }
1462
1463               /* Start a new word with the last parameter. */
1464               *word = w_newword (word_length, max_length);
1465               value = __libc_argv[p];
1466             }
1467           else
1468             {
1469               free (env);
1470               free (pattern);
1471               return 0;
1472             }
1473         }
1474     }
1475   else
1476     value = getenv (env);
1477
1478   if (value == NULL && (flags & WRDE_UNDEF))
1479     {
1480       /* Variable not defined. */
1481       error = WRDE_BADVAL;
1482       goto do_error;
1483     }
1484
1485   if (action != ACT_NONE)
1486     {
1487       int expand_pattern = 0;
1488
1489       /* First, find out if we need to expand pattern (i.e. if we will
1490        * use it). */
1491       switch (action)
1492         {
1493         case ACT_RP_SHORT_LEFT:
1494         case ACT_RP_LONG_LEFT:
1495         case ACT_RP_SHORT_RIGHT:
1496         case ACT_RP_LONG_RIGHT:
1497           /* Always expand for these. */
1498           expand_pattern = 1;
1499           break;
1500
1501         case ACT_NULL_ERROR:
1502         case ACT_NULL_SUBST:
1503         case ACT_NULL_ASSIGN:
1504           if (!value || (!*value && colon_seen))
1505             /* If param is unset, or set but null and a colon has been seen,
1506                the expansion of the pattern will be needed. */
1507             expand_pattern = 1;
1508
1509           break;
1510
1511         case ACT_NONNULL_SUBST:
1512           /* Expansion of word will be needed if parameter is set and not null,
1513              or set null but no colon has been seen. */
1514           if (value && (*value || !colon_seen))
1515             expand_pattern = 1;
1516
1517           break;
1518
1519         default:
1520           assert (! "Unrecognised action!");
1521         }
1522
1523       if (expand_pattern)
1524         {
1525           /* We need to perform tilde expansion, parameter expansion,
1526              command substitution, and arithmetic expansion.  We also
1527              have to be a bit careful with wildcard characters, as
1528              pattern might be given to fnmatch soon.  To do this, we
1529              convert quotes to escapes. */
1530
1531           char *expanded;
1532           size_t exp_len;
1533           size_t exp_maxl;
1534           char *p;
1535           int quoted = 0; /* 1: single quotes; 2: double */
1536
1537           expanded = w_newword (&exp_len, &exp_maxl);
1538           for (p = pattern; p && *p; p++)
1539             {
1540               size_t offset;
1541
1542               switch (*p)
1543                 {
1544                 case '"':
1545                   if (quoted == 2)
1546                     quoted = 0;
1547                   else if (quoted == 0)
1548                     quoted = 2;
1549                   else break;
1550
1551                   continue;
1552
1553                 case '\'':
1554                   if (quoted == 1)
1555                     quoted = 0;
1556                   else if (quoted == 0)
1557                     quoted = 1;
1558                   else break;
1559
1560                   continue;
1561
1562                 case '*':
1563                 case '?':
1564                   if (quoted)
1565                     {
1566                       /* Convert quoted wildchar to escaped wildchar. */
1567                       expanded = w_addchar (expanded, &exp_len,
1568                                             &exp_maxl, '\\');
1569
1570                       if (expanded == NULL)
1571                         goto no_space;
1572                     }
1573                   break;
1574
1575                 case '$':
1576                   offset = 0;
1577                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1578                                          &offset, flags, NULL, NULL, NULL, 1);
1579                   if (error)
1580                     {
1581                       if (free_value)
1582                         free (value);
1583
1584                       if (expanded)
1585                         free (expanded);
1586
1587                       goto do_error;
1588                     }
1589
1590                   p += offset;
1591                   continue;
1592
1593                 case '~':
1594                   if (quoted || exp_len)
1595                     break;
1596
1597                   offset = 0;
1598                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1599                                        &offset, 0);
1600                   if (error)
1601                     {
1602                       if (free_value)
1603                         free (value);
1604
1605                       if (expanded)
1606                         free (expanded);
1607
1608                       goto do_error;
1609                     }
1610
1611                   p += offset;
1612                   continue;
1613
1614                 case '\\':
1615                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1616                   ++p;
1617                   assert (*p); /* checked when extracted initially */
1618                   if (expanded == NULL)
1619                     goto no_space;
1620                 }
1621
1622               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1623
1624               if (expanded == NULL)
1625                 goto no_space;
1626             }
1627
1628           if (pattern)
1629                   free (pattern);
1630
1631           pattern = expanded;
1632         }
1633
1634       switch (action)
1635         {
1636         case ACT_RP_SHORT_LEFT:
1637         case ACT_RP_LONG_LEFT:
1638         case ACT_RP_SHORT_RIGHT:
1639         case ACT_RP_LONG_RIGHT:
1640           {
1641             char *p;
1642             char c;
1643             char *end;
1644
1645             if (value == NULL || pattern == NULL || *pattern == '\0')
1646               break;
1647
1648             end = value + strlen (value);
1649
1650             switch (action)
1651               {
1652               case ACT_RP_SHORT_LEFT:
1653                 for (p = value; p <= end; ++p)
1654                   {
1655                     c = *p;
1656                     *p = '\0';
1657                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1658                       {
1659                         *p = c;
1660                         if (free_value)
1661                           {
1662                             char *newval = __strdup (p);
1663                             if (newval == NULL)
1664                               {
1665                                 free (value);
1666                                 goto no_space;
1667                               }
1668                             free (value);
1669                             value = newval;
1670                           }
1671                         else
1672                           value = p;
1673                         break;
1674                       }
1675                     *p = c;
1676                   }
1677
1678                 break;
1679
1680               case ACT_RP_LONG_LEFT:
1681                 for (p = end; p >= value; --p)
1682                   {
1683                     c = *p;
1684                     *p = '\0';
1685                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1686                       {
1687                         *p = c;
1688                         if (free_value)
1689                           {
1690                             char *newval = __strdup (p);
1691                             if (newval == NULL)
1692                               {
1693                                 free (value);
1694                                 goto no_space;
1695                               }
1696                             free (value);
1697                             value = newval;
1698                           }
1699                         else
1700                           value = p;
1701                         break;
1702                       }
1703                     *p = c;
1704                   }
1705
1706                 break;
1707
1708               case ACT_RP_SHORT_RIGHT:
1709                 for (p = end; p >= value; --p)
1710                   {
1711                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1712                       {
1713                         char *newval;
1714                         newval = malloc (p - value + 1);
1715
1716                         if (newval == NULL)
1717                           {
1718                             if (free_value)
1719                               free (value);
1720                             goto no_space;
1721                           }
1722
1723                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1724                         if (free_value)
1725                           free (value);
1726                         value = newval;
1727                         free_value = 1;
1728                         break;
1729                       }
1730                   }
1731
1732                 break;
1733
1734               case ACT_RP_LONG_RIGHT:
1735                 for (p = value; p <= end; ++p)
1736                   {
1737                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1738                       {
1739                         char *newval;
1740                         newval = malloc (p - value + 1);
1741
1742                         if (newval == NULL)
1743                           {
1744                             if (free_value)
1745                               free (value);
1746                             goto no_space;
1747                           }
1748
1749                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1750                         if (free_value)
1751                           free (value);
1752                         value = newval;
1753                         free_value = 1;
1754                         break;
1755                       }
1756                   }
1757
1758                 break;
1759
1760               default:
1761                 break;
1762               }
1763
1764             break;
1765           }
1766
1767         case ACT_NULL_ERROR:
1768           if (value && *value)
1769             /* Substitute parameter */
1770             break;
1771
1772           error = 0;
1773           if (!colon_seen && value)
1774             /* Substitute NULL */
1775             ;
1776           else if (*pattern)
1777             fprintf (stderr, "%s: %s\n", env, pattern);
1778           else
1779             {
1780               fprintf (stderr, "%s: parameter null or not set\n", env);
1781               error = WRDE_BADVAL;
1782             }
1783
1784           if (free_value)
1785             free (value);
1786           goto do_error;
1787
1788         case ACT_NULL_SUBST:
1789           if (value && *value)
1790             /* Substitute parameter */
1791             break;
1792
1793           if (free_value && value)
1794             free (value);
1795
1796           if (!colon_seen && value)
1797             /* Substitute NULL */
1798             goto success;
1799
1800           value = pattern ? __strdup (pattern) : pattern;
1801           free_value = 1;
1802
1803           if (pattern && !value)
1804             goto no_space;
1805
1806           break;
1807
1808         case ACT_NONNULL_SUBST:
1809           if (value && (*value || !colon_seen))
1810             {
1811               if (free_value && value)
1812                 free (value);
1813
1814               value = pattern ? __strdup (pattern) : pattern;
1815               free_value = 1;
1816
1817               if (pattern && !value)
1818                 goto no_space;
1819
1820               break;
1821             }
1822
1823           /* Substitute NULL */
1824           if (free_value)
1825             free (value);
1826           goto success;
1827
1828         case ACT_NULL_ASSIGN:
1829           if (value && *value)
1830             /* Substitute parameter */
1831             break;
1832
1833           if (!colon_seen && value)
1834             {
1835               /* Substitute NULL */
1836               if (free_value)
1837                 free (value);
1838               goto success;
1839             }
1840
1841           if (free_value && value)
1842             free (value);
1843
1844           value = pattern ? __strdup (pattern) : pattern;
1845           free_value = 1;
1846
1847           if (pattern && !value)
1848             goto no_space;
1849
1850           setenv (env, value, 1);
1851           break;
1852
1853         default:
1854           assert (! "Unrecognised action!");
1855         }
1856     }
1857
1858   free (env); env = NULL;
1859   free (pattern); pattern = NULL;
1860
1861   if (seen_hash)
1862     {
1863       char param_length[21];
1864       param_length[20] = '\0';
1865       *word = w_addstr (*word, word_length, max_length,
1866                         _itoa_word (value ? strlen (value) : 0,
1867                                     &param_length[20], 10, 0));
1868       if (free_value)
1869         {
1870           assert (value != NULL);
1871           free (value);
1872         }
1873
1874       return *word ? 0 : WRDE_NOSPACE;
1875     }
1876
1877   if (value == NULL)
1878     return 0;
1879
1880   if (quoted || !pwordexp)
1881     {
1882       /* Quoted - no field split */
1883       *word = w_addstr (*word, word_length, max_length, value);
1884       if (free_value)
1885         free (value);
1886
1887       return *word ? 0 : WRDE_NOSPACE;
1888     }
1889   else
1890     {
1891       /* Need to field-split */
1892       char *value_copy = __strdup (value); /* Don't modify value */
1893       char *field_begin = value_copy;
1894       int seen_nonws_ifs = 0;
1895
1896       if (free_value)
1897         free (value);
1898
1899       if (value_copy == NULL)
1900         goto no_space;
1901
1902       do
1903         {
1904           char *field_end = field_begin;
1905           char *next_field;
1906
1907           /* If this isn't the first field, start a new word */
1908           if (field_begin != value_copy)
1909             {
1910               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1911                 {
1912                   free (value_copy);
1913                   goto no_space;
1914                 }
1915
1916               *word = w_newword (word_length, max_length);
1917             }
1918
1919           /* Skip IFS whitespace before the field */
1920           field_begin += strspn (field_begin, ifs_white);
1921
1922           if (!seen_nonws_ifs && *field_begin == 0)
1923             /* Nothing but whitespace */
1924             break;
1925
1926           /* Search for the end of the field */
1927           field_end = field_begin + strcspn (field_begin, ifs);
1928
1929           /* Set up pointer to the character after end of field and
1930              skip whitespace IFS after it. */
1931           next_field = field_end + strspn (field_end, ifs_white);
1932
1933           /* Skip at most one non-whitespace IFS character after the field */
1934           seen_nonws_ifs = 0;
1935           if (*next_field && strchr (ifs, *next_field))
1936             {
1937               seen_nonws_ifs = 1;
1938               next_field++;
1939             }
1940
1941           /* Null-terminate it */
1942           *field_end = 0;
1943
1944           /* Tag a copy onto the current word */
1945           *word = w_addstr (*word, word_length, max_length, field_begin);
1946
1947           if (*word == NULL && *field_begin != '\0')
1948             {
1949               free (value_copy);
1950               goto no_space;
1951             }
1952
1953           field_begin = next_field;
1954         }
1955       while (seen_nonws_ifs || *field_begin);
1956
1957       free (value_copy);
1958     }
1959
1960   return 0;
1961
1962 success:
1963   error = 0;
1964   goto do_error;
1965
1966 no_space:
1967   error = WRDE_NOSPACE;
1968   goto do_error;
1969
1970 syntax:
1971   error = WRDE_SYNTAX;
1972
1973 do_error:
1974   if (env)
1975     free (env);
1976
1977   if (pattern)
1978     free (pattern);
1979
1980   return error;
1981 }
1982
1983 static int
1984 internal_function
1985 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1986                const char *words, size_t *offset, int flags,
1987                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
1988                int quoted)
1989 {
1990   /* We are poised _at_ "$" */
1991   switch (words[1 + *offset])
1992     {
1993     case '"':
1994     case '\'':
1995     case 0:
1996       *word = w_addchar (*word, word_length, max_length, '$');
1997       return *word ? 0 : WRDE_NOSPACE;
1998
1999     case '(':
2000       if (words[2 + *offset] == '(')
2001         {
2002           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2003           int i = 3 + *offset;
2004           int depth = 0;
2005           while (words[i] && !(depth == 0 && words[i] == ')'))
2006             {
2007               if (words[i] == '(')
2008                 ++depth;
2009               else if (words[i] == ')')
2010                 --depth;
2011
2012               ++i;
2013             }
2014
2015           if (words[i] == ')' && words[i + 1] == ')')
2016             {
2017               (*offset) += 3;
2018               /* Call parse_arith -- 0 is for "no brackets" */
2019               return parse_arith (word, word_length, max_length, words, offset,
2020                                   flags, 0);
2021             }
2022         }
2023
2024       if (flags & WRDE_NOCMD)
2025         return WRDE_CMDSUB;
2026
2027       (*offset) += 2;
2028       return parse_comm (word, word_length, max_length, words, offset, flags,
2029                          quoted? NULL : pwordexp, ifs, ifs_white);
2030
2031     case '[':
2032       (*offset) += 2;
2033       /* Call parse_arith -- 1 is for "brackets" */
2034       return parse_arith (word, word_length, max_length, words, offset, flags,
2035                           1);
2036
2037     case '{':
2038     default:
2039       ++(*offset);      /* parse_param needs to know if "{" is there */
2040       return parse_param (word, word_length, max_length, words, offset, flags,
2041                            pwordexp, ifs, ifs_white, quoted);
2042     }
2043 }
2044
2045 static int
2046 internal_function
2047 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2048                 const char *words, size_t *offset, int flags,
2049                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2050 {
2051   /* We are poised just after "`" */
2052   int error;
2053   int squoting = 0;
2054   size_t comm_length;
2055   size_t comm_maxlen;
2056   char *comm = w_newword (&comm_length, &comm_maxlen);
2057
2058   for (; words[*offset]; ++(*offset))
2059     {
2060       switch (words[*offset])
2061         {
2062         case '`':
2063           /* Go -- give the script to the shell */
2064           error = exec_comm (comm, word, word_length, max_length, flags,
2065                              pwordexp, ifs, ifs_white);
2066           free (comm);
2067           return error;
2068
2069         case '\\':
2070           if (squoting)
2071             {
2072               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2073                                            words, offset);
2074
2075               if (error)
2076                 {
2077                   free (comm);
2078                   return error;
2079                 }
2080
2081               break;
2082             }
2083
2084           ++(*offset);
2085           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2086                                    offset);
2087
2088           if (error)
2089             {
2090               free (comm);
2091               return error;
2092             }
2093
2094           break;
2095
2096         case '\'':
2097           squoting = 1 - squoting;
2098         default:
2099           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2100           if (comm == NULL)
2101             return WRDE_NOSPACE;
2102         }
2103     }
2104
2105   /* Premature end */
2106   free (comm);
2107   return WRDE_SYNTAX;
2108 }
2109
2110 static int
2111 internal_function
2112 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2113               const char *words, size_t *offset, int flags,
2114               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2115 {
2116   /* We are poised just after a double-quote */
2117   int error;
2118
2119   for (; words[*offset]; ++(*offset))
2120     {
2121       switch (words[*offset])
2122         {
2123         case '"':
2124           return 0;
2125
2126         case '$':
2127           error = parse_dollars (word, word_length, max_length, words, offset,
2128                                  flags, pwordexp, ifs, ifs_white, 1);
2129           /* The ``1'' here is to tell parse_dollars not to
2130            * split the fields.  It may need to, however ("$@").
2131            */
2132           if (error)
2133             return error;
2134
2135           break;
2136
2137         case '`':
2138           if (flags & WRDE_NOCMD)
2139             return WRDE_CMDSUB;
2140
2141           ++(*offset);
2142           error = parse_backtick (word, word_length, max_length, words,
2143                                   offset, flags, NULL, NULL, NULL);
2144           /* The first NULL here is to tell parse_backtick not to
2145            * split the fields.
2146            */
2147           if (error)
2148             return error;
2149
2150           break;
2151
2152         case '\\':
2153           error = parse_qtd_backslash (word, word_length, max_length, words,
2154                                        offset);
2155
2156           if (error)
2157             return error;
2158
2159           break;
2160
2161         default:
2162           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2163           if (*word == NULL)
2164             return WRDE_NOSPACE;
2165         }
2166     }
2167
2168   /* Unterminated string */
2169   return WRDE_SYNTAX;
2170 }
2171
2172 /*
2173  * wordfree() is to be called after pwordexp is finished with.
2174  */
2175
2176 void
2177 wordfree (wordexp_t *pwordexp)
2178 {
2179
2180   /* wordexp can set pwordexp to NULL */
2181   if (pwordexp && pwordexp->we_wordv)
2182     {
2183       char **wordv = pwordexp->we_wordv;
2184
2185       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2186         free (*wordv);
2187
2188       free (pwordexp->we_wordv);
2189       pwordexp->we_wordv = NULL;
2190     }
2191 }
2192
2193 /*
2194  * wordexp()
2195  */
2196
2197 int
2198 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2199 {
2200   size_t words_offset;
2201   size_t word_length;
2202   size_t max_length;
2203   char *word = w_newword (&word_length, &max_length);
2204   int error;
2205   char *ifs;
2206   char ifs_white[4];
2207   wordexp_t old_word = *pwordexp;
2208
2209   if (flags & WRDE_REUSE)
2210     {
2211       /* Minimal implementation of WRDE_REUSE for now */
2212       wordfree (pwordexp);
2213       old_word.we_wordv = NULL;
2214     }
2215
2216   if ((flags & WRDE_APPEND) == 0)
2217     {
2218       pwordexp->we_wordc = 0;
2219
2220       if (flags & WRDE_DOOFFS)
2221         {
2222           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2223           if (pwordexp->we_wordv == NULL)
2224             {
2225               error = WRDE_NOSPACE;
2226               goto do_error;
2227             }
2228         }
2229       else
2230         {
2231           pwordexp->we_wordv = calloc (1, sizeof (char *));
2232           if (pwordexp->we_wordv == NULL)
2233             {
2234               error = WRDE_NOSPACE;
2235               goto do_error;
2236             }
2237
2238           pwordexp->we_offs = 0;
2239         }
2240     }
2241
2242   /* Find out what the field separators are.
2243    * There are two types: whitespace and non-whitespace.
2244    */
2245   ifs = getenv ("IFS");
2246
2247   if (!ifs)
2248     /* IFS unset - use <space><tab><newline>. */
2249     ifs = strcpy (ifs_white, " \t\n");
2250   else
2251     {
2252       char *ifsch = ifs;
2253       char *whch = ifs_white;
2254
2255       /* Start off with no whitespace IFS characters */
2256       ifs_white[0] = '\0';
2257
2258       while (*ifsch != '\0')
2259         {
2260           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2261             {
2262               /* Whitespace IFS.  See first whether it is already in our
2263                  collection.  */
2264               char *runp = ifs_white;
2265
2266               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2267                 ++runp;
2268
2269               if (runp == whch)
2270                 *whch++ = *ifsch;
2271             }
2272
2273           ++ifsch;
2274         }
2275       *whch = '\0';
2276     }
2277
2278   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2279     switch (words[words_offset])
2280       {
2281       case '\\':
2282         error = parse_backslash (&word, &word_length, &max_length, words,
2283                                  &words_offset);
2284
2285         if (error)
2286           goto do_error;
2287
2288         break;
2289
2290       case '$':
2291         error = parse_dollars (&word, &word_length, &max_length, words,
2292                                &words_offset, flags, pwordexp, ifs, ifs_white,
2293                                0);
2294
2295         if (error)
2296           goto do_error;
2297
2298         break;
2299
2300       case '`':
2301         if (flags & WRDE_NOCMD)
2302           {
2303             error = WRDE_CMDSUB;
2304             goto do_error;
2305           }
2306
2307         ++words_offset;
2308         error = parse_backtick (&word, &word_length, &max_length, words,
2309                                 &words_offset, flags, pwordexp, ifs,
2310                                 ifs_white);
2311
2312         if (error)
2313           goto do_error;
2314
2315         break;
2316
2317       case '"':
2318         ++words_offset;
2319         error = parse_dquote (&word, &word_length, &max_length, words,
2320                               &words_offset, flags, pwordexp, ifs, ifs_white);
2321
2322         if (error)
2323           goto do_error;
2324
2325         if (!word_length)
2326           {
2327             error = w_addword (pwordexp, NULL);
2328
2329             if (error)
2330               return error;
2331           }
2332
2333         break;
2334
2335       case '\'':
2336         ++words_offset;
2337         error = parse_squote (&word, &word_length, &max_length, words,
2338                               &words_offset);
2339
2340         if (error)
2341           goto do_error;
2342
2343         if (!word_length)
2344           {
2345             error = w_addword (pwordexp, NULL);
2346
2347             if (error)
2348               return error;
2349           }
2350
2351         break;
2352
2353       case '~':
2354         error = parse_tilde (&word, &word_length, &max_length, words,
2355                              &words_offset, pwordexp->we_wordc);
2356
2357         if (error)
2358           goto do_error;
2359
2360         break;
2361
2362       case '*':
2363       case '[':
2364       case '?':
2365         error = parse_glob (&word, &word_length, &max_length, words,
2366                             &words_offset, flags, pwordexp, ifs, ifs_white);
2367
2368         if (error)
2369           goto do_error;
2370
2371         break;
2372
2373       default:
2374         /* Is it a word separator? */
2375         if (strchr (" \t", words[words_offset]) == NULL)
2376           {
2377             char ch = words[words_offset];
2378
2379             /* Not a word separator -- but is it a valid word char? */
2380             if (strchr ("\n|&;<>(){}", ch))
2381               {
2382                 /* Fail */
2383                 error = WRDE_BADCHAR;
2384                 goto do_error;
2385               }
2386
2387             /* "Ordinary" character -- add it to word */
2388             word = w_addchar (word, &word_length, &max_length,
2389                               ch);
2390             if (word == NULL)
2391               {
2392                 error = WRDE_NOSPACE;
2393                 goto do_error;
2394               }
2395
2396             break;
2397           }
2398
2399         /* If a word has been delimited, add it to the list. */
2400         if (word != NULL)
2401           {
2402             error = w_addword (pwordexp, word);
2403             if (error)
2404               goto do_error;
2405           }
2406
2407         word = w_newword (&word_length, &max_length);
2408       }
2409
2410   /* End of string */
2411
2412   /* There was a word separator at the end */
2413   if (word == NULL) /* i.e. w_newword */
2414     return 0;
2415
2416   /* There was no field separator at the end */
2417   return w_addword (pwordexp, word);
2418
2419 do_error:
2420   /* Error:
2421    *    free memory used (unless error is WRDE_NOSPACE), and
2422    *    set pwordexp members back to what they were.
2423    */
2424
2425   if (word != NULL)
2426     free (word);
2427
2428   if (error == WRDE_NOSPACE)
2429     return WRDE_NOSPACE;
2430
2431   if ((flags & WRDE_APPEND) == 0)
2432     wordfree (pwordexp);
2433
2434   *pwordexp = old_word;
2435   return error;
2436 }