posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2020 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, see
  18    <https://www.gnu.org/licenses/>.  */
  19
  20 #include <ctype.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <fnmatch.h>
  24 #include <glob.h>
  25 #include <libintl.h>
  26 #include <paths.h>
  27 #include <pwd.h>
  28 #include <stdbool.h>
  29 #include <stdio.h>
  30 #include <string.h>
  31 #include <sys/param.h>
  32 #include <sys/wait.h>
  33 #include <unistd.h>
  34 #include <wordexp.h>
  35 #include <spawn.h>
  36 #include <scratch_buffer.h>
  37 #include <_itoa.h>
  38 #include <assert.h>
  39
  40 /*
  41  * This is a recursive-descent-style word expansion routine.
  42  */
  43
  44 /* These variables are defined and initialized in the startup code.  */
  45 extern int __libc_argc attribute_hidden;
  46 extern char **__libc_argv attribute_hidden;
  47
  48 /* Some forward declarations */
  49 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  50                           const char *words, size_t *offset, int flags,
  51                           wordexp_t *pwordexp, const char *ifs,
  52                           const char *ifs_white, int quoted);
  53 static int parse_backtick (char **word, size_t *word_length,
  54                            size_t *max_length, const char *words,
  55                            size_t *offset, int flags, wordexp_t *pwordexp,
  56                            const char *ifs, const char *ifs_white);
  57 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  58                          const char *words, size_t *offset, int flags,
  59                          wordexp_t *pwordexp, const char *ifs,
  60                          const char *ifs_white);
  61 static int eval_expr (char *expr, long int *result);
  62
  63 /* The w_*() functions manipulate word lists. */
  64
  65 #define W_CHUNK (100)
  66
  67 /* Result of w_newword will be ignored if it's the last word. */
  68 static inline char *
  69 w_newword (size_t *actlen, size_t *maxlen)
  70 {
  71   *actlen = *maxlen = 0;
  72   return NULL;
  73 }
  74
  75 static char *
  76 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  77      /* (lengths exclude trailing zero) */
  78 {
  79   /* Add a character to the buffer, allocating room for it if needed.  */
  80
  81   if (*actlen == *maxlen)
  82     {
  83       char *old_buffer = buffer;
  84       assert (buffer == NULL || *maxlen != 0);
  85       *maxlen += W_CHUNK;
  86       buffer = (char *) realloc (buffer, 1 + *maxlen);
  87
  88       if (buffer == NULL)
  89         free (old_buffer);
  90     }
  91
  92   if (buffer != NULL)
  93     {
  94       buffer[*actlen] = ch;
  95       buffer[++(*actlen)] = '\0';
  96     }
  97
  98   return buffer;
  99 }
 100
 101 static char *
 102 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 103           size_t len)
 104 {
 105   /* Add a string to the buffer, allocating room for it if needed.
 106    */
 107   if (*actlen + len > *maxlen)
 108     {
 109       char *old_buffer = buffer;
 110       assert (buffer == NULL || *maxlen != 0);
 111       *maxlen += MAX (2 * len, W_CHUNK);
 112       buffer = realloc (old_buffer, 1 + *maxlen);
 113
 114       if (buffer == NULL)
 115         free (old_buffer);
 116     }
 117
 118   if (buffer != NULL)
 119     {
 120       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 121       *actlen += len;
 122     }
 123
 124   return buffer;
 125 }
 126
 127 static char *
 128 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 129      /* (lengths exclude trailing zero) */
 130 {
 131   /* Add a string to the buffer, allocating room for it if needed.
 132    */
 133   size_t len;
 134
 135   assert (str != NULL); /* w_addstr only called from this file */
 136   len = strlen (str);
 137
 138   return w_addmem (buffer, actlen, maxlen, str, len);
 139 }
 140
 141 static int
 142 w_addword (wordexp_t *pwordexp, char *word)
 143 {
 144   /* Add a word to the wordlist */
 145   size_t num_p;
 146   char **new_wordv;
 147   bool allocated = false;
 148
 149   /* Internally, NULL acts like "".  Convert NULLs to "" before
 150    * the caller sees them.
 151    */
 152   if (word == NULL)
 153     {
 154       word = __strdup ("");
 155       if (word == NULL)
 156         goto no_space;
 157       allocated = true;
 158     }
 159
 160   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 161   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 162   if (new_wordv != NULL)
 163     {
 164       pwordexp->we_wordv = new_wordv;
 165       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 166       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 167       return 0;
 168     }
 169
 170   if (allocated)
 171     free (word);
 172
 173 no_space:
 174   return WRDE_NOSPACE;
 175 }
 176
 177 /* The parse_*() functions should leave *offset being the offset in 'words'
 178  * to the last character processed.
 179  */
 180
 181 static int
 182 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 183                  const char *words, size_t *offset)
 184 {
 185   /* We are poised _at_ a backslash, not in quotes */
 186
 187   switch (words[1 + *offset])
 188     {
 189     case 0:
 190       /* Backslash is last character of input words */
 191       return WRDE_SYNTAX;
 192
 193     case '\n':
 194       ++(*offset);
 195       break;
 196
 197     default:
 198       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 199       if (*word == NULL)
 200         return WRDE_NOSPACE;
 201
 202       ++(*offset);
 203       break;
 204     }
 205
 206   return 0;
 207 }
 208
 209 static int
 210 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 211                      const char *words, size_t *offset)
 212 {
 213   /* We are poised _at_ a backslash, inside quotes */
 214
 215   switch (words[1 + *offset])
 216     {
 217     case 0:
 218       /* Backslash is last character of input words */
 219       return WRDE_SYNTAX;
 220
 221     case '\n':
 222       ++(*offset);
 223       break;
 224
 225     case '$':
 226     case '`':
 227     case '"':
 228     case '\\':
 229       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 230       if (*word == NULL)
 231         return WRDE_NOSPACE;
 232
 233       ++(*offset);
 234       break;
 235
 236     default:
 237       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 238       if (*word != NULL)
 239         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 240
 241       if (*word == NULL)
 242         return WRDE_NOSPACE;
 243
 244       ++(*offset);
 245       break;
 246     }
 247
 248   return 0;
 249 }
 250
 251 static int
 252 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 253              const char *words, size_t *offset, size_t wordc)
 254 {
 255   /* We are poised _at_ a tilde */
 256   size_t i;
 257
 258   if (*word_length != 0)
 259     {
 260       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 261         {
 262           if (!((*word)[*word_length - 1] == ':'
 263                 && strchr (*word, '=') && wordc == 0))
 264             {
 265               *word = w_addchar (*word, word_length, max_length, '~');
 266               return *word ? 0 : WRDE_NOSPACE;
 267             }
 268         }
 269     }
 270
 271   for (i = 1 + *offset; words[i]; i++)
 272     {
 273       if (words[i] == ':' || words[i] == '/' || words[i] == ' '
 274           || words[i] == '\t' || words[i] == 0 )
 275         break;
 276
 277       if (words[i] == '\\')
 278         {
 279           *word = w_addchar (*word, word_length, max_length, '~');
 280           return *word ? 0 : WRDE_NOSPACE;
 281         }
 282     }
 283
 284   if (i == 1 + *offset)
 285     {
 286       /* Tilde appears on its own */
 287       char* home;
 288
 289       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 290          results are unspecified.  We do a lookup on the uid if
 291          HOME is unset. */
 292
 293       home = getenv ("HOME");
 294       if (home != NULL)
 295         {
 296           *word = w_addstr (*word, word_length, max_length, home);
 297           if (*word == NULL)
 298             return WRDE_NOSPACE;
 299         }
 300       else
 301         {
 302           struct passwd pwd, *tpwd;
 303           uid_t uid = __getuid ();
 304           int result;
 305           struct scratch_buffer tmpbuf;
 306           scratch_buffer_init (&tmpbuf);
 307
 308           while ((result = __getpwuid_r (uid, &pwd,
 309                                          tmpbuf.data, tmpbuf.length,
 310                                          &tpwd)) != 0
 311                  && errno == ERANGE)
 312             if (!scratch_buffer_grow (&tmpbuf))
 313               return WRDE_NOSPACE;
 314
 315           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 316             {
 317               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 318               if (*word == NULL)
 319                 {
 320                   scratch_buffer_free (&tmpbuf);
 321                   return WRDE_NOSPACE;
 322                 }
 323             }
 324           else
 325             {
 326               *word = w_addchar (*word, word_length, max_length, '~');
 327               if (*word == NULL)
 328                 {
 329                   scratch_buffer_free (&tmpbuf);
 330                   return WRDE_NOSPACE;
 331                 }
 332             }
 333           scratch_buffer_free (&tmpbuf);
 334         }
 335     }
 336   else
 337     {
 338       /* Look up user name in database to get home directory */
 339       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 340       struct passwd pwd, *tpwd;
 341       int result;
 342       struct scratch_buffer tmpbuf;
 343       scratch_buffer_init (&tmpbuf);
 344
 345       while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length,
 346                                      &tpwd)) != 0
 347              && errno == ERANGE)
 348         if (!scratch_buffer_grow (&tmpbuf))
 349           return WRDE_NOSPACE;
 350
 351       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 352         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 353       else
 354         {
 355           /* (invalid login name) */
 356           *word = w_addchar (*word, word_length, max_length, '~');
 357           if (*word != NULL)
 358             *word = w_addstr (*word, word_length, max_length, user);
 359         }
 360
 361       scratch_buffer_free (&tmpbuf);
 362
 363       *offset = i - 1;
 364     }
 365   return *word ? 0 : WRDE_NOSPACE;
 366 }
 367
 368
 369 static int
 370 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 371                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 372                const char *ifs_white)
 373 {
 374   int error;
 375   unsigned int match;
 376   glob_t globbuf;
 377
 378   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 379
 380   if (error != 0)
 381     {
 382       /* We can only run into memory problems.  */
 383       assert (error == GLOB_NOSPACE);
 384       return WRDE_NOSPACE;
 385     }
 386
 387   if (ifs && !*ifs)
 388     {
 389       /* No field splitting allowed. */
 390       assert (globbuf.gl_pathv[0] != NULL);
 391       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 392       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 393         {
 394           *word = w_addchar (*word, word_length, max_length, ' ');
 395           if (*word != NULL)
 396             *word = w_addstr (*word, word_length, max_length,
 397                               globbuf.gl_pathv[match]);
 398         }
 399
 400       globfree (&globbuf);
 401       return *word ? 0 : WRDE_NOSPACE;
 402     }
 403
 404   assert (ifs == NULL || *ifs != '\0');
 405   if (*word != NULL)
 406     {
 407       free (*word);
 408       *word = w_newword (word_length, max_length);
 409     }
 410
 411   for (match = 0; match < globbuf.gl_pathc; ++match)
 412     {
 413       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 414       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 415         {
 416           globfree (&globbuf);
 417           return WRDE_NOSPACE;
 418         }
 419     }
 420
 421   globfree (&globbuf);
 422   return 0;
 423 }
 424
 425 static int
 426 parse_glob (char **word, size_t *word_length, size_t *max_length,
 427             const char *words, size_t *offset, int flags,
 428             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 429 {
 430   /* We are poised just after a '*', a '[' or a '?'. */
 431   int error = WRDE_NOSPACE;
 432   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 433   size_t i;
 434   wordexp_t glob_list; /* List of words to glob */
 435
 436   glob_list.we_wordc = 0;
 437   glob_list.we_wordv = NULL;
 438   glob_list.we_offs = 0;
 439   for (; words[*offset] != '\0'; ++*offset)
 440     {
 441       if (strchr (ifs, words[*offset]) != NULL)
 442         /* Reached IFS */
 443         break;
 444
 445       /* Sort out quoting */
 446       if (words[*offset] == '\'')
 447         {
 448           if (quoted == 0)
 449             {
 450               quoted = 1;
 451               continue;
 452             }
 453           else if (quoted == 1)
 454             {
 455               quoted = 0;
 456               continue;
 457             }
 458         }
 459       else if (words[*offset] == '"')
 460         {
 461           if (quoted == 0)
 462             {
 463               quoted = 2;
 464               continue;
 465             }
 466           else if (quoted == 2)
 467             {
 468               quoted = 0;
 469               continue;
 470             }
 471         }
 472
 473       /* Sort out other special characters */
 474       if (quoted != 1 && words[*offset] == '$')
 475         {
 476           error = parse_dollars (word, word_length, max_length, words,
 477                                  offset, flags, &glob_list, ifs, ifs_white,
 478                                  quoted == 2);
 479           if (error)
 480             goto tidy_up;
 481
 482           continue;
 483         }
 484       else if (words[*offset] == '\\')
 485         {
 486           if (quoted)
 487             error = parse_qtd_backslash (word, word_length, max_length,
 488                                          words, offset);
 489           else
 490             error = parse_backslash (word, word_length, max_length,
 491                                      words, offset);
 492
 493           if (error)
 494             goto tidy_up;
 495
 496           continue;
 497         }
 498
 499       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 500       if (*word == NULL)
 501         goto tidy_up;
 502     }
 503
 504   /* Don't forget to re-parse the character we stopped at. */
 505   --*offset;
 506
 507   /* Glob the words */
 508   error = w_addword (&glob_list, *word);
 509   *word = w_newword (word_length, max_length);
 510   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 511     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 512                            max_length, pwordexp, ifs, ifs_white);
 513
 514   /* Now tidy up */
 515 tidy_up:
 516   wordfree (&glob_list);
 517   return error;
 518 }
 519
 520 static int
 521 parse_squote (char **word, size_t *word_length, size_t *max_length,
 522               const char *words, size_t *offset)
 523 {
 524   /* We are poised just after a single quote */
 525   for (; words[*offset]; ++(*offset))
 526     {
 527       if (words[*offset] != '\'')
 528         {
 529           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 530           if (*word == NULL)
 531             return WRDE_NOSPACE;
 532         }
 533       else return 0;
 534     }
 535
 536   /* Unterminated string */
 537   return WRDE_SYNTAX;
 538 }
 539
 540 /* Functions to evaluate an arithmetic expression */
 541 static int
 542 eval_expr_val (char **expr, long int *result)
 543 {
 544   char *digit;
 545
 546   /* Skip white space */
 547   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 548
 549   if (*digit == '(')
 550     {
 551       /* Scan for closing paren */
 552       for (++digit; **expr && **expr != ')'; ++(*expr));
 553
 554       /* Is there one? */
 555       if (!**expr)
 556         return WRDE_SYNTAX;
 557
 558       *(*expr)++ = 0;
 559
 560       if (eval_expr (digit, result))
 561         return WRDE_SYNTAX;
 562
 563       return 0;
 564     }
 565
 566   /* POSIX requires that decimal, octal, and hexadecimal constants are
 567      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 568   *result = strtol (digit, expr, 0);
 569   if (digit == *expr)
 570     return WRDE_SYNTAX;
 571
 572   return 0;
 573 }
 574
 575 static int
 576 eval_expr_multdiv (char **expr, long int *result)
 577 {
 578   long int arg;
 579
 580   /* Read a Value */
 581   if (eval_expr_val (expr, result) != 0)
 582     return WRDE_SYNTAX;
 583
 584   while (**expr)
 585     {
 586       /* Skip white space */
 587       for (; *expr && **expr && isspace (**expr); ++(*expr));
 588
 589       if (**expr == '*')
 590         {
 591           ++(*expr);
 592           if (eval_expr_val (expr, &arg) != 0)
 593             return WRDE_SYNTAX;
 594
 595           *result *= arg;
 596         }
 597       else if (**expr == '/')
 598         {
 599           ++(*expr);
 600           if (eval_expr_val (expr, &arg) != 0)
 601             return WRDE_SYNTAX;
 602
 603           /* Division by zero or integer overflow.  */
 604           if (arg == 0 || (arg == -1 && *result == LONG_MIN))
 605             return WRDE_SYNTAX;
 606
 607           *result /= arg;
 608         }
 609       else break;
 610     }
 611
 612   return 0;
 613 }
 614
 615 static int
 616 eval_expr (char *expr, long int *result)
 617 {
 618   long int arg;
 619
 620   /* Read a Multdiv */
 621   if (eval_expr_multdiv (&expr, result) != 0)
 622     return WRDE_SYNTAX;
 623
 624   while (*expr)
 625     {
 626       /* Skip white space */
 627       for (; expr && *expr && isspace (*expr); ++expr);
 628
 629       if (*expr == '+')
 630         {
 631           ++expr;
 632           if (eval_expr_multdiv (&expr, &arg) != 0)
 633             return WRDE_SYNTAX;
 634
 635           *result += arg;
 636         }
 637       else if (*expr == '-')
 638         {
 639           ++expr;
 640           if (eval_expr_multdiv (&expr, &arg) != 0)
 641             return WRDE_SYNTAX;
 642
 643           *result -= arg;
 644         }
 645       else break;
 646     }
 647
 648   return 0;
 649 }
 650
 651 static int
 652 parse_arith (char **word, size_t *word_length, size_t *max_length,
 653              const char *words, size_t *offset, int flags, int bracket)
 654 {
 655   /* We are poised just after "$((" or "$[" */
 656   int error;
 657   int paren_depth = 1;
 658   size_t expr_length;
 659   size_t expr_maxlen;
 660   char *expr;
 661
 662   expr = w_newword (&expr_length, &expr_maxlen);
 663   for (; words[*offset]; ++(*offset))
 664     {
 665       switch (words[*offset])
 666         {
 667         case '$':
 668           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 669                                  words, offset, flags, NULL, NULL, NULL, 1);
 670           /* The ``1'' here is to tell parse_dollars not to
 671            * split the fields.
 672            */
 673           if (error)
 674             {
 675               free (expr);
 676               return error;
 677             }
 678           break;
 679
 680         case '`':
 681           (*offset)++;
 682           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 683                                   words, offset, flags, NULL, NULL, NULL);
 684           /* The first NULL here is to tell parse_backtick not to
 685            * split the fields.
 686            */
 687           if (error)
 688             {
 689               free (expr);
 690               return error;
 691             }
 692           break;
 693
 694         case '\\':
 695           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 696                                        words, offset);
 697           if (error)
 698             {
 699               free (expr);
 700               return error;
 701             }
 702           /* I think that a backslash within an
 703            * arithmetic expansion is bound to
 704            * cause an error sooner or later anyway though.
 705            */
 706           break;
 707
 708         case ')':
 709           if (--paren_depth == 0)
 710             {
 711               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 712               long int numresult = 0;
 713               long long int convertme;
 714
 715               if (bracket || words[1 + *offset] != ')')
 716                 {
 717                   free (expr);
 718                   return WRDE_SYNTAX;
 719                 }
 720
 721               ++(*offset);
 722
 723               /* Go - evaluate. */
 724               if (*expr && eval_expr (expr, &numresult) != 0)
 725                 {
 726                   free (expr);
 727                   return WRDE_SYNTAX;
 728                 }
 729
 730               if (numresult < 0)
 731                 {
 732                   convertme = -numresult;
 733                   *word = w_addchar (*word, word_length, max_length, '-');
 734                   if (!*word)
 735                     {
 736                       free (expr);
 737                       return WRDE_NOSPACE;
 738                     }
 739                 }
 740               else
 741                 convertme = numresult;
 742
 743               result[20] = '\0';
 744               *word = w_addstr (*word, word_length, max_length,
 745                                 _itoa (convertme, &result[20], 10, 0));
 746               free (expr);
 747               return *word ? 0 : WRDE_NOSPACE;
 748             }
 749           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 750           if (expr == NULL)
 751             return WRDE_NOSPACE;
 752
 753           break;
 754
 755         case ']':
 756           if (bracket && paren_depth == 1)
 757             {
 758               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 759               long int numresult = 0;
 760
 761               /* Go - evaluate. */
 762               if (*expr && eval_expr (expr, &numresult) != 0)
 763                 {
 764                   free (expr);
 765                   return WRDE_SYNTAX;
 766                 }
 767
 768               result[20] = '\0';
 769               *word = w_addstr (*word, word_length, max_length,
 770                                 _itoa_word (numresult, &result[20], 10, 0));
 771               free (expr);
 772               return *word ? 0 : WRDE_NOSPACE;
 773             }
 774
 775           free (expr);
 776           return WRDE_SYNTAX;
 777
 778         case '\n':
 779         case ';':
 780         case '{':
 781         case '}':
 782           free (expr);
 783           return WRDE_BADCHAR;
 784
 785         case '(':
 786           ++paren_depth;
 787           /* Fall through.  */
 788         default:
 789           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 790           if (expr == NULL)
 791             return WRDE_NOSPACE;
 792         }
 793     }
 794
 795   /* Premature end */
 796   free (expr);
 797   return WRDE_SYNTAX;
 798 }
 799
 800 #define DYNARRAY_STRUCT        strlist
 801 #define DYNARRAY_ELEMENT       char *
 802 #define DYNARRAY_PREFIX        strlist_
 803 /* Allocates about 512/1024 (32/64 bit) on stack.  */
 804 #define DYNARRAY_INITIAL_SIZE  128
 805 #include <malloc/dynarray-skeleton.c>
 806
 807 /* Function called by child process in exec_comm() */
 808 static pid_t
 809 exec_comm_child (char *comm, int *fildes, bool showerr, bool noexec)
 810 {
 811   pid_t pid = -1;
 812
 813   /* Execute the command, or just check syntax?  */
 814   const char *args[] = { _PATH_BSHELL, noexec ? "-nc" : "-c", comm, NULL };
 815
 816   posix_spawn_file_actions_t fa;
 817   /* posix_spawn_file_actions_init does not fail.  */
 818   __posix_spawn_file_actions_init (&fa);
 819
 820   /* Redirect output.  For check syntax only (noexec being true), exec_comm
 821      explicits sets fildes[1] to -1, so check its value to avoid a failure in
 822      __posix_spawn_file_actions_adddup2.  */
 823   if (fildes[1] != -1)
 824     {
 825       if (__glibc_likely (fildes[1] != STDOUT_FILENO))
 826         {
 827           if (__posix_spawn_file_actions_adddup2 (&fa, fildes[1],
 828                                                   STDOUT_FILENO) != 0
 829               || __posix_spawn_file_actions_addclose (&fa, fildes[1]) != 0)
 830             goto out;
 831         }
 832       else
 833         /* Reset the close-on-exec flag (if necessary).  */
 834         if (__posix_spawn_file_actions_adddup2 (&fa, fildes[1], fildes[1])
 835             != 0)
 836           goto out;
 837     }
 838
 839   /* Redirect stderr to /dev/null if we have to.  */
 840   if (!showerr)
 841     if (__posix_spawn_file_actions_addopen (&fa, STDERR_FILENO, _PATH_DEVNULL,
 842                                             O_WRONLY, 0) != 0)
 843       goto out;
 844
 845   struct strlist newenv;
 846   strlist_init (&newenv);
 847
 848   bool recreate_env = getenv ("IFS") != NULL;
 849   if (recreate_env)
 850     {
 851       for (char **ep = __environ; *ep != NULL; ep++)
 852         if (strncmp (*ep, "IFS=", strlen ("IFS=")) != 0)
 853           strlist_add (&newenv, *ep);
 854       strlist_add (&newenv, NULL);
 855       if (strlist_has_failed (&newenv))
 856         goto out;
 857     }
 858
 859   /* pid is not set if posix_spawn fails, so it keep the original value
 860      of -1.  */
 861   __posix_spawn (&pid, _PATH_BSHELL, &fa, NULL, (char *const *) args,
 862                  recreate_env ? strlist_begin (&newenv) : __environ);
 863
 864   strlist_free (&newenv);
 865
 866 out:
 867   __posix_spawn_file_actions_destroy (&fa);
 868
 869   return pid;
 870 }
 871
 872 /* Function to execute a command and retrieve the results */
 873 /* pwordexp contains NULL if field-splitting is forbidden */
 874 static int
 875 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 876            int flags, wordexp_t *pwordexp, const char *ifs,
 877            const char *ifs_white)
 878 {
 879   int fildes[2];
 880 #define bufsize 128
 881   int buflen;
 882   int i;
 883   int status = 0;
 884   size_t maxnewlines = 0;
 885   char buffer[bufsize];
 886   pid_t pid;
 887   bool noexec = false;
 888
 889   /* Do nothing if command substitution should not succeed.  */
 890   if (flags & WRDE_NOCMD)
 891     return WRDE_CMDSUB;
 892
 893   /* Don't posix_spawn unless necessary */
 894   if (!comm || !*comm)
 895     return 0;
 896
 897   if (__pipe2 (fildes, O_CLOEXEC) < 0)
 898     return WRDE_NOSPACE;
 899
 900  again:
 901   pid = exec_comm_child (comm, fildes, noexec ? false : flags & WRDE_SHOWERR,
 902                          noexec);
 903   if (pid < 0)
 904     {
 905       __close (fildes[0]);
 906       __close (fildes[1]);
 907       return WRDE_NOSPACE;
 908     }
 909
 910   /* If we are just testing the syntax, only wait.  */
 911   if (noexec)
 912     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 913             && status != 0) ? WRDE_SYNTAX : 0;
 914
 915   __close (fildes[1]);
 916   fildes[1] = -1;
 917
 918   if (!pwordexp)
 919     /* Quoted - no field splitting */
 920     {
 921       while (1)
 922         {
 923           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 924                                                     bufsize))) < 1)
 925             {
 926               /* If read returned 0 then the process has closed its
 927                  stdout.  Don't use WNOHANG in that case to avoid busy
 928                  looping until the process eventually exits.  */
 929               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 930                                                  buflen == 0 ? 0 : WNOHANG))
 931                   == 0)
 932                 continue;
 933               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 934                                                         bufsize))) < 1)
 935                 break;
 936             }
 937
 938           maxnewlines += buflen;
 939
 940           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 941           if (*word == NULL)
 942             goto no_space;
 943         }
 944     }
 945   else
 946     /* Not quoted - split fields */
 947     {
 948       int copying = 0;
 949       /* 'copying' is:
 950        *  0 when searching for first character in a field not IFS white space
 951        *  1 when copying the text of a field
 952        *  2 when searching for possible non-whitespace IFS
 953        *  3 when searching for non-newline after copying field
 954        */
 955
 956       while (1)
 957         {
 958           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 959                                                     bufsize))) < 1)
 960             {
 961               /* If read returned 0 then the process has closed its
 962                  stdout.  Don't use WNOHANG in that case to avoid busy
 963                  looping until the process eventually exits.  */
 964               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 965                                                  buflen == 0 ? 0 : WNOHANG))
 966                   == 0)
 967                 continue;
 968               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 969                                                         bufsize))) < 1)
 970                 break;
 971             }
 972
 973           for (i = 0; i < buflen; ++i)
 974             {
 975               if (strchr (ifs, buffer[i]) != NULL)
 976                 {
 977                   /* Current character is IFS */
 978                   if (strchr (ifs_white, buffer[i]) == NULL)
 979                     {
 980                       /* Current character is IFS but not whitespace */
 981                       if (copying == 2)
 982                         {
 983                           /*            current character
 984                            *                   |
 985                            *                   V
 986                            * eg: text<space><comma><space>moretext
 987                            *
 988                            * So, strip whitespace IFS (like at the start)
 989                            */
 990                           copying = 0;
 991                           continue;
 992                         }
 993
 994                       copying = 0;
 995                       /* fall through and delimit field.. */
 996                     }
 997                   else
 998                     {
 999                       if (buffer[i] == '\n')
1000                         {
1001                           /* Current character is (IFS) newline */
1002
1003                           /* If copying a field, this is the end of it,
1004                              but maybe all that's left is trailing newlines.
1005                              So start searching for a non-newline. */
1006                           if (copying == 1)
1007                             copying = 3;
1008
1009                           continue;
1010                         }
1011                       else
1012                         {
1013                           /* Current character is IFS white space, but
1014                              not a newline */
1015
1016                           /* If not either copying a field or searching
1017                              for non-newline after a field, ignore it */
1018                           if (copying != 1 && copying != 3)
1019                             continue;
1020
1021                           /* End of field (search for non-ws IFS afterwards) */
1022                           copying = 2;
1023                         }
1024                     }
1025
1026                   /* First IFS white space (non-newline), or IFS non-whitespace.
1027                    * Delimit the field.  Nulls are converted by w_addword. */
1028                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1029                     goto no_space;
1030
1031                   *word = w_newword (word_length, max_length);
1032
1033                   maxnewlines = 0;
1034                   /* fall back round the loop.. */
1035                 }
1036               else
1037                 {
1038                   /* Not IFS character */
1039
1040                   if (copying == 3)
1041                     {
1042                       /* Nothing but (IFS) newlines since the last field,
1043                          so delimit it here before starting new word */
1044                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1045                         goto no_space;
1046
1047                       *word = w_newword (word_length, max_length);
1048                     }
1049
1050                   copying = 1;
1051
1052                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1053                     maxnewlines++;
1054                   else
1055                     maxnewlines = 0;
1056
1057                   *word = w_addchar (*word, word_length, max_length,
1058                                      buffer[i]);
1059                   if (*word == NULL)
1060                     goto no_space;
1061                 }
1062             }
1063         }
1064     }
1065
1066   /* Chop off trailing newlines (required by POSIX.2)  */
1067   /* Ensure we don't go back further than the beginning of the
1068      substitution (i.e. remove maxnewlines bytes at most) */
1069   while (maxnewlines-- != 0
1070          && *word_length > 0 && (*word)[*word_length - 1] == '\n')
1071     {
1072       (*word)[--*word_length] = '\0';
1073
1074       /* If the last word was entirely newlines, turn it into a new word
1075        * which can be ignored if there's nothing following it. */
1076       if (*word_length == 0)
1077         {
1078           free (*word);
1079           *word = w_newword (word_length, max_length);
1080           break;
1081         }
1082     }
1083
1084   __close (fildes[0]);
1085   fildes[0] = -1;
1086
1087   /* Check for syntax error (re-execute but with "-n" flag) */
1088   if (buflen < 1 && status != 0)
1089     {
1090       noexec = true;
1091       goto again;
1092     }
1093
1094   return 0;
1095
1096 no_space:
1097   __kill (pid, SIGKILL);
1098   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1099   __close (fildes[0]);
1100   return WRDE_NOSPACE;
1101 }
1102
1103 static int
1104 parse_comm (char **word, size_t *word_length, size_t *max_length,
1105             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1106             const char *ifs, const char *ifs_white)
1107 {
1108   /* We are poised just after "$(" */
1109   int paren_depth = 1;
1110   int error = 0;
1111   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1112   size_t comm_length;
1113   size_t comm_maxlen;
1114   char *comm = w_newword (&comm_length, &comm_maxlen);
1115
1116   for (; words[*offset]; ++(*offset))
1117     {
1118       switch (words[*offset])
1119         {
1120         case '\'':
1121           if (quoted == 0)
1122             quoted = 1;
1123           else if (quoted == 1)
1124             quoted = 0;
1125
1126           break;
1127
1128         case '"':
1129           if (quoted == 0)
1130             quoted = 2;
1131           else if (quoted == 2)
1132             quoted = 0;
1133
1134           break;
1135
1136         case ')':
1137           if (!quoted && --paren_depth == 0)
1138             {
1139               /* Go -- give script to the shell */
1140               if (comm)
1141                 {
1142                   /* posix_spawn already handles thread cancellation.  */
1143                   error = exec_comm (comm, word, word_length, max_length,
1144                                      flags, pwordexp, ifs, ifs_white);
1145                   free (comm);
1146                 }
1147
1148               return error;
1149             }
1150
1151           /* This is just part of the script */
1152           break;
1153
1154         case '(':
1155           if (!quoted)
1156             ++paren_depth;
1157         }
1158
1159       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1160       if (comm == NULL)
1161         return WRDE_NOSPACE;
1162     }
1163
1164   /* Premature end.  */
1165   free (comm);
1166
1167   return WRDE_SYNTAX;
1168 }
1169
1170 #define CHAR_IN_SET(ch, char_set) \
1171   (memchr (char_set "", ch, sizeof (char_set) - 1) != NULL)
1172
1173 static int
1174 parse_param (char **word, size_t *word_length, size_t *max_length,
1175              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1176              const char *ifs, const char *ifs_white, int quoted)
1177 {
1178   /* We are poised just after "$" */
1179   enum action
1180   {
1181     ACT_NONE,
1182     ACT_RP_SHORT_LEFT = '#',
1183     ACT_RP_LONG_LEFT = 'L',
1184     ACT_RP_SHORT_RIGHT = '%',
1185     ACT_RP_LONG_RIGHT = 'R',
1186     ACT_NULL_ERROR = '?',
1187     ACT_NULL_SUBST = '-',
1188     ACT_NONNULL_SUBST = '+',
1189     ACT_NULL_ASSIGN = '='
1190   };
1191   size_t env_length;
1192   size_t env_maxlen;
1193   size_t pat_length;
1194   size_t pat_maxlen;
1195   size_t start = *offset;
1196   char *env;
1197   char *pattern;
1198   char *value = NULL;
1199   enum action action = ACT_NONE;
1200   int depth = 0;
1201   int colon_seen = 0;
1202   int seen_hash = 0;
1203   int free_value = 0;
1204   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1205   int error;
1206   int special = 0;
1207   char buffer[21];
1208   int brace = words[*offset] == '{';
1209
1210   env = w_newword (&env_length, &env_maxlen);
1211   pattern = w_newword (&pat_length, &pat_maxlen);
1212
1213   if (brace)
1214     ++*offset;
1215
1216   /* First collect the parameter name. */
1217
1218   if (words[*offset] == '#')
1219     {
1220       seen_hash = 1;
1221       if (!brace)
1222         goto envsubst;
1223       ++*offset;
1224     }
1225
1226   if (isalpha (words[*offset]) || words[*offset] == '_')
1227     {
1228       /* Normal parameter name. */
1229       do
1230         {
1231           env = w_addchar (env, &env_length, &env_maxlen,
1232                            words[*offset]);
1233           if (env == NULL)
1234             goto no_space;
1235         }
1236       while (isalnum (words[++*offset]) || words[*offset] == '_');
1237     }
1238   else if (isdigit (words[*offset]))
1239     {
1240       /* Numeric parameter name. */
1241       special = 1;
1242       do
1243         {
1244           env = w_addchar (env, &env_length, &env_maxlen,
1245                            words[*offset]);
1246           if (env == NULL)
1247             goto no_space;
1248           if (!brace)
1249             goto envsubst;
1250         }
1251       while (isdigit(words[++*offset]));
1252     }
1253   else if (CHAR_IN_SET (words[*offset], "*@$"))
1254     {
1255       /* Special parameter. */
1256       special = 1;
1257       env = w_addchar (env, &env_length, &env_maxlen,
1258                        words[*offset]);
1259       if (env == NULL)
1260         goto no_space;
1261       ++*offset;
1262     }
1263   else
1264     {
1265       if (brace)
1266         goto syntax;
1267     }
1268
1269   if (brace)
1270     {
1271       /* Check for special action to be applied to the value. */
1272       switch (words[*offset])
1273         {
1274         case '}':
1275           /* Evaluate. */
1276           goto envsubst;
1277
1278         case '#':
1279           action = ACT_RP_SHORT_LEFT;
1280           if (words[1 + *offset] == '#')
1281             {
1282               ++*offset;
1283               action = ACT_RP_LONG_LEFT;
1284             }
1285           break;
1286
1287         case '%':
1288           action = ACT_RP_SHORT_RIGHT;
1289           if (words[1 + *offset] == '%')
1290             {
1291               ++*offset;
1292               action = ACT_RP_LONG_RIGHT;
1293             }
1294           break;
1295
1296         case ':':
1297           if (!CHAR_IN_SET (words[1 + *offset], "-=?+"))
1298             goto syntax;
1299
1300           colon_seen = 1;
1301           action = words[++*offset];
1302           break;
1303
1304         case '-':
1305         case '=':
1306         case '?':
1307         case '+':
1308           action = words[*offset];
1309           break;
1310
1311         default:
1312           goto syntax;
1313         }
1314
1315       /* Now collect the pattern, but don't expand it yet. */
1316       ++*offset;
1317       for (; words[*offset]; ++(*offset))
1318         {
1319           switch (words[*offset])
1320             {
1321             case '{':
1322               if (!pattern_is_quoted)
1323                 ++depth;
1324               break;
1325
1326             case '}':
1327               if (!pattern_is_quoted)
1328                 {
1329                   if (depth == 0)
1330                     goto envsubst;
1331                   --depth;
1332                 }
1333               break;
1334
1335             case '\\':
1336               if (pattern_is_quoted)
1337                 /* Quoted; treat as normal character. */
1338                 break;
1339
1340               /* Otherwise, it's an escape: next character is literal. */
1341               if (words[++*offset] == '\0')
1342                 goto syntax;
1343
1344               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1345               if (pattern == NULL)
1346                 goto no_space;
1347
1348               break;
1349
1350             case '\'':
1351               if (pattern_is_quoted == 0)
1352                 pattern_is_quoted = 1;
1353               else if (pattern_is_quoted == 1)
1354                 pattern_is_quoted = 0;
1355
1356               break;
1357
1358             case '"':
1359               if (pattern_is_quoted == 0)
1360                 pattern_is_quoted = 2;
1361               else if (pattern_is_quoted == 2)
1362                 pattern_is_quoted = 0;
1363
1364               break;
1365             }
1366
1367           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1368                                words[*offset]);
1369           if (pattern == NULL)
1370             goto no_space;
1371         }
1372     }
1373
1374   /* End of input string -- remember to reparse the character that we
1375    * stopped at.  */
1376   --(*offset);
1377
1378 envsubst:
1379   if (words[start] == '{' && words[*offset] != '}')
1380     goto syntax;
1381
1382   if (env == NULL)
1383     {
1384       if (seen_hash)
1385         {
1386           /* $# expands to the number of positional parameters */
1387           buffer[20] = '\0';
1388           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1389           seen_hash = 0;
1390         }
1391       else
1392         {
1393           /* Just $ on its own */
1394           *offset = start - 1;
1395           *word = w_addchar (*word, word_length, max_length, '$');
1396           return *word ? 0 : WRDE_NOSPACE;
1397         }
1398     }
1399   /* Is it a numeric parameter? */
1400   else if (isdigit (env[0]))
1401     {
1402       int n = atoi (env);
1403
1404       if (n >= __libc_argc)
1405         /* Substitute NULL. */
1406         value = NULL;
1407       else
1408         /* Replace with appropriate positional parameter. */
1409         value = __libc_argv[n];
1410     }
1411   /* Is it a special parameter? */
1412   else if (special)
1413     {
1414       /* Is it `$$'? */
1415       if (*env == '$')
1416         {
1417           buffer[20] = '\0';
1418           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1419         }
1420       /* Is it `${#*}' or `${#@}'? */
1421       else if ((*env == '*' || *env == '@') && seen_hash)
1422         {
1423           buffer[20] = '\0';
1424           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1425                               &buffer[20], 10, 0);
1426           *word = w_addstr (*word, word_length, max_length, value);
1427           free (env);
1428           free (pattern);
1429           return *word ? 0 : WRDE_NOSPACE;
1430         }
1431       /* Is it `$*' or `$@' (unquoted) ? */
1432       else if (*env == '*' || (*env == '@' && !quoted))
1433         {
1434           size_t plist_len = 0;
1435           int p;
1436           char *end;
1437
1438           /* Build up value parameter by parameter (copy them) */
1439           for (p = 1; __libc_argv[p]; ++p)
1440             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1441           value = malloc (plist_len);
1442           if (value == NULL)
1443             goto no_space;
1444           end = value;
1445           *end = 0;
1446           for (p = 1; __libc_argv[p]; ++p)
1447             {
1448               if (p > 1)
1449                 *end++ = ' ';
1450               end = __stpcpy (end, __libc_argv[p]);
1451             }
1452
1453           free_value = 1;
1454         }
1455       else
1456         {
1457           /* Must be a quoted `$@' */
1458           assert (*env == '@' && quoted);
1459
1460           /* Each parameter is a separate word ("$@") */
1461           if (__libc_argc == 2)
1462             value = __libc_argv[1];
1463           else if (__libc_argc > 2)
1464             {
1465               int p;
1466
1467               /* Append first parameter to current word. */
1468               value = w_addstr (*word, word_length, max_length,
1469                                 __libc_argv[1]);
1470               if (value == NULL || w_addword (pwordexp, value))
1471                 goto no_space;
1472
1473               for (p = 2; __libc_argv[p + 1]; p++)
1474                 {
1475                   char *newword = __strdup (__libc_argv[p]);
1476                   if (newword == NULL || w_addword (pwordexp, newword))
1477                     goto no_space;
1478                 }
1479
1480               /* Start a new word with the last parameter. */
1481               *word = w_newword (word_length, max_length);
1482               value = __libc_argv[p];
1483             }
1484           else
1485             {
1486               free (env);
1487               free (pattern);
1488               return 0;
1489             }
1490         }
1491     }
1492   else
1493     value = getenv (env);
1494
1495   if (value == NULL && (flags & WRDE_UNDEF))
1496     {
1497       /* Variable not defined. */
1498       error = WRDE_BADVAL;
1499       goto do_error;
1500     }
1501
1502   if (action != ACT_NONE)
1503     {
1504       int expand_pattern = 0;
1505
1506       /* First, find out if we need to expand pattern (i.e. if we will
1507        * use it). */
1508       switch (action)
1509         {
1510         case ACT_RP_SHORT_LEFT:
1511         case ACT_RP_LONG_LEFT:
1512         case ACT_RP_SHORT_RIGHT:
1513         case ACT_RP_LONG_RIGHT:
1514           /* Always expand for these. */
1515           expand_pattern = 1;
1516           break;
1517
1518         case ACT_NULL_ERROR:
1519         case ACT_NULL_SUBST:
1520         case ACT_NULL_ASSIGN:
1521           if (!value || (!*value && colon_seen))
1522             /* If param is unset, or set but null and a colon has been seen,
1523                the expansion of the pattern will be needed. */
1524             expand_pattern = 1;
1525
1526           break;
1527
1528         case ACT_NONNULL_SUBST:
1529           /* Expansion of word will be needed if parameter is set and not null,
1530              or set null but no colon has been seen. */
1531           if (value && (*value || !colon_seen))
1532             expand_pattern = 1;
1533
1534           break;
1535
1536         default:
1537           assert (! "Unrecognised action!");
1538         }
1539
1540       if (expand_pattern)
1541         {
1542           /* We need to perform tilde expansion, parameter expansion,
1543              command substitution, and arithmetic expansion.  We also
1544              have to be a bit careful with wildcard characters, as
1545              pattern might be given to fnmatch soon.  To do this, we
1546              convert quotes to escapes. */
1547
1548           char *expanded;
1549           size_t exp_len;
1550           size_t exp_maxl;
1551           char *p;
1552           int quoted = 0; /* 1: single quotes; 2: double */
1553
1554           expanded = w_newword (&exp_len, &exp_maxl);
1555           for (p = pattern; p && *p; p++)
1556             {
1557               size_t offset;
1558
1559               switch (*p)
1560                 {
1561                 case '"':
1562                   if (quoted == 2)
1563                     quoted = 0;
1564                   else if (quoted == 0)
1565                     quoted = 2;
1566                   else break;
1567
1568                   continue;
1569
1570                 case '\'':
1571                   if (quoted == 1)
1572                     quoted = 0;
1573                   else if (quoted == 0)
1574                     quoted = 1;
1575                   else break;
1576
1577                   continue;
1578
1579                 case '*':
1580                 case '?':
1581                   if (quoted)
1582                     {
1583                       /* Convert quoted wildchar to escaped wildchar. */
1584                       expanded = w_addchar (expanded, &exp_len,
1585                                             &exp_maxl, '\\');
1586
1587                       if (expanded == NULL)
1588                         goto no_space;
1589                     }
1590                   break;
1591
1592                 case '$':
1593                   offset = 0;
1594                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1595                                          &offset, flags, NULL, NULL, NULL, 1);
1596                   if (error)
1597                     {
1598                       if (free_value)
1599                         free (value);
1600
1601                       free (expanded);
1602
1603                       goto do_error;
1604                     }
1605
1606                   p += offset;
1607                   continue;
1608
1609                 case '~':
1610                   if (quoted || exp_len)
1611                     break;
1612
1613                   offset = 0;
1614                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1615                                        &offset, 0);
1616                   if (error)
1617                     {
1618                       if (free_value)
1619                         free (value);
1620
1621                       free (expanded);
1622
1623                       goto do_error;
1624                     }
1625
1626                   p += offset;
1627                   continue;
1628
1629                 case '\\':
1630                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1631                   ++p;
1632                   assert (*p); /* checked when extracted initially */
1633                   if (expanded == NULL)
1634                     goto no_space;
1635                 }
1636
1637               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1638
1639               if (expanded == NULL)
1640                 goto no_space;
1641             }
1642
1643           free (pattern);
1644
1645           pattern = expanded;
1646         }
1647
1648       switch (action)
1649         {
1650         case ACT_RP_SHORT_LEFT:
1651         case ACT_RP_LONG_LEFT:
1652         case ACT_RP_SHORT_RIGHT:
1653         case ACT_RP_LONG_RIGHT:
1654           {
1655             char *p;
1656             char c;
1657             char *end;
1658
1659             if (value == NULL || pattern == NULL || *pattern == '\0')
1660               break;
1661
1662             end = value + strlen (value);
1663
1664             switch (action)
1665               {
1666               case ACT_RP_SHORT_LEFT:
1667                 for (p = value; p <= end; ++p)
1668                   {
1669                     c = *p;
1670                     *p = '\0';
1671                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1672                       {
1673                         *p = c;
1674                         if (free_value)
1675                           {
1676                             char *newval = __strdup (p);
1677                             if (newval == NULL)
1678                               {
1679                                 free (value);
1680                                 goto no_space;
1681                               }
1682                             free (value);
1683                             value = newval;
1684                           }
1685                         else
1686                           value = p;
1687                         break;
1688                       }
1689                     *p = c;
1690                   }
1691
1692                 break;
1693
1694               case ACT_RP_LONG_LEFT:
1695                 for (p = end; p >= value; --p)
1696                   {
1697                     c = *p;
1698                     *p = '\0';
1699                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1700                       {
1701                         *p = c;
1702                         if (free_value)
1703                           {
1704                             char *newval = __strdup (p);
1705                             if (newval == NULL)
1706                               {
1707                                 free (value);
1708                                 goto no_space;
1709                               }
1710                             free (value);
1711                             value = newval;
1712                           }
1713                         else
1714                           value = p;
1715                         break;
1716                       }
1717                     *p = c;
1718                   }
1719
1720                 break;
1721
1722               case ACT_RP_SHORT_RIGHT:
1723                 for (p = end; p >= value; --p)
1724                   {
1725                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1726                       {
1727                         char *newval;
1728                         newval = malloc (p - value + 1);
1729
1730                         if (newval == NULL)
1731                           {
1732                             if (free_value)
1733                               free (value);
1734                             goto no_space;
1735                           }
1736
1737                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1738                         if (free_value)
1739                           free (value);
1740                         value = newval;
1741                         free_value = 1;
1742                         break;
1743                       }
1744                   }
1745
1746                 break;
1747
1748               case ACT_RP_LONG_RIGHT:
1749                 for (p = value; p <= end; ++p)
1750                   {
1751                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1752                       {
1753                         char *newval;
1754                         newval = malloc (p - value + 1);
1755
1756                         if (newval == NULL)
1757                           {
1758                             if (free_value)
1759                               free (value);
1760                             goto no_space;
1761                           }
1762
1763                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1764                         if (free_value)
1765                           free (value);
1766                         value = newval;
1767                         free_value = 1;
1768                         break;
1769                       }
1770                   }
1771
1772                 break;
1773
1774               default:
1775                 break;
1776               }
1777
1778             break;
1779           }
1780
1781         case ACT_NULL_ERROR:
1782           if (value && *value)
1783             /* Substitute parameter */
1784             break;
1785
1786           error = 0;
1787           if (!colon_seen && value)
1788             /* Substitute NULL */
1789             ;
1790           else
1791             {
1792               const char *str = pattern;
1793
1794               if (str[0] == '\0')
1795                 str = _("parameter null or not set");
1796
1797               __fxprintf (NULL, "%s: %s\n", env, str);
1798             }
1799
1800           if (free_value)
1801             free (value);
1802           goto do_error;
1803
1804         case ACT_NULL_SUBST:
1805           if (value && *value)
1806             /* Substitute parameter */
1807             break;
1808
1809           if (free_value)
1810             free (value);
1811
1812           if (!colon_seen && value)
1813             /* Substitute NULL */
1814             goto success;
1815
1816           value = pattern ? __strdup (pattern) : pattern;
1817           free_value = 1;
1818
1819           if (pattern && !value)
1820             goto no_space;
1821
1822           break;
1823
1824         case ACT_NONNULL_SUBST:
1825           if (value && (*value || !colon_seen))
1826             {
1827               if (free_value)
1828                 free (value);
1829
1830               value = pattern ? __strdup (pattern) : pattern;
1831               free_value = 1;
1832
1833               if (pattern && !value)
1834                 goto no_space;
1835
1836               break;
1837             }
1838
1839           /* Substitute NULL */
1840           if (free_value)
1841             free (value);
1842           goto success;
1843
1844         case ACT_NULL_ASSIGN:
1845           if (value && *value)
1846             /* Substitute parameter */
1847             break;
1848
1849           if (!colon_seen && value)
1850             {
1851               /* Substitute NULL */
1852               if (free_value)
1853                 free (value);
1854               goto success;
1855             }
1856
1857           if (free_value)
1858             free (value);
1859
1860           value = pattern ? __strdup (pattern) : pattern;
1861           free_value = 1;
1862
1863           if (pattern && !value)
1864             goto no_space;
1865
1866           __setenv (env, value ?: "", 1);
1867           break;
1868
1869         default:
1870           assert (! "Unrecognised action!");
1871         }
1872     }
1873
1874   free (env);
1875   env = NULL;
1876   free (pattern);
1877   pattern = NULL;
1878
1879   if (seen_hash)
1880     {
1881       char param_length[21];
1882       param_length[20] = '\0';
1883       *word = w_addstr (*word, word_length, max_length,
1884                         _itoa_word (value ? strlen (value) : 0,
1885                                     &param_length[20], 10, 0));
1886       if (free_value)
1887         {
1888           assert (value != NULL);
1889           free (value);
1890         }
1891
1892       return *word ? 0 : WRDE_NOSPACE;
1893     }
1894
1895   if (value == NULL)
1896     return 0;
1897
1898   if (quoted || !pwordexp)
1899     {
1900       /* Quoted - no field split */
1901       *word = w_addstr (*word, word_length, max_length, value);
1902       if (free_value)
1903         free (value);
1904
1905       return *word ? 0 : WRDE_NOSPACE;
1906     }
1907   else
1908     {
1909       /* Need to field-split */
1910       char *value_copy = __strdup (value); /* Don't modify value */
1911       char *field_begin = value_copy;
1912       int seen_nonws_ifs = 0;
1913
1914       if (free_value)
1915         free (value);
1916
1917       if (value_copy == NULL)
1918         goto no_space;
1919
1920       do
1921         {
1922           char *field_end = field_begin;
1923           char *next_field;
1924
1925           /* If this isn't the first field, start a new word */
1926           if (field_begin != value_copy)
1927             {
1928               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1929                 {
1930                   free (value_copy);
1931                   goto no_space;
1932                 }
1933
1934               *word = w_newword (word_length, max_length);
1935             }
1936
1937           /* Skip IFS whitespace before the field */
1938           field_begin += strspn (field_begin, ifs_white);
1939
1940           if (!seen_nonws_ifs && *field_begin == 0)
1941             /* Nothing but whitespace */
1942             break;
1943
1944           /* Search for the end of the field */
1945           field_end = field_begin + strcspn (field_begin, ifs);
1946
1947           /* Set up pointer to the character after end of field and
1948              skip whitespace IFS after it. */
1949           next_field = field_end + strspn (field_end, ifs_white);
1950
1951           /* Skip at most one non-whitespace IFS character after the field */
1952           seen_nonws_ifs = 0;
1953           if (*next_field && strchr (ifs, *next_field))
1954             {
1955               seen_nonws_ifs = 1;
1956               next_field++;
1957             }
1958
1959           /* Null-terminate it */
1960           *field_end = 0;
1961
1962           /* Tag a copy onto the current word */
1963           *word = w_addstr (*word, word_length, max_length, field_begin);
1964
1965           if (*word == NULL && *field_begin != '\0')
1966             {
1967               free (value_copy);
1968               goto no_space;
1969             }
1970
1971           field_begin = next_field;
1972         }
1973       while (seen_nonws_ifs || *field_begin);
1974
1975       free (value_copy);
1976     }
1977
1978   return 0;
1979
1980 success:
1981   error = 0;
1982   goto do_error;
1983
1984 no_space:
1985   error = WRDE_NOSPACE;
1986   goto do_error;
1987
1988 syntax:
1989   error = WRDE_SYNTAX;
1990
1991 do_error:
1992   free (env);
1993
1994   free (pattern);
1995
1996   return error;
1997 }
1998
1999 #undef CHAR_IN_SET
2000
2001 static int
2002 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2003                const char *words, size_t *offset, int flags,
2004                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2005                int quoted)
2006 {
2007   /* We are poised _at_ "$" */
2008   switch (words[1 + *offset])
2009     {
2010     case '"':
2011     case '\'':
2012     case 0:
2013       *word = w_addchar (*word, word_length, max_length, '$');
2014       return *word ? 0 : WRDE_NOSPACE;
2015
2016     case '(':
2017       if (words[2 + *offset] == '(')
2018         {
2019           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2020           int i = 3 + *offset;
2021           int depth = 0;
2022           while (words[i] && !(depth == 0 && words[i] == ')'))
2023             {
2024               if (words[i] == '(')
2025                 ++depth;
2026               else if (words[i] == ')')
2027                 --depth;
2028
2029               ++i;
2030             }
2031
2032           if (words[i] == ')' && words[i + 1] == ')')
2033             {
2034               (*offset) += 3;
2035               /* Call parse_arith -- 0 is for "no brackets" */
2036               return parse_arith (word, word_length, max_length, words, offset,
2037                                   flags, 0);
2038             }
2039         }
2040
2041       (*offset) += 2;
2042       return parse_comm (word, word_length, max_length, words, offset, flags,
2043                          quoted? NULL : pwordexp, ifs, ifs_white);
2044
2045     case '[':
2046       (*offset) += 2;
2047       /* Call parse_arith -- 1 is for "brackets" */
2048       return parse_arith (word, word_length, max_length, words, offset, flags,
2049                           1);
2050
2051     case '{':
2052     default:
2053       ++(*offset);      /* parse_param needs to know if "{" is there */
2054       return parse_param (word, word_length, max_length, words, offset, flags,
2055                            pwordexp, ifs, ifs_white, quoted);
2056     }
2057 }
2058
2059 static int
2060 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2061                 const char *words, size_t *offset, int flags,
2062                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2063 {
2064   /* We are poised just after "`" */
2065   int error;
2066   int squoting = 0;
2067   size_t comm_length;
2068   size_t comm_maxlen;
2069   char *comm = w_newword (&comm_length, &comm_maxlen);
2070
2071   for (; words[*offset]; ++(*offset))
2072     {
2073       switch (words[*offset])
2074         {
2075         case '`':
2076           /* Go -- give the script to the shell */
2077           error = exec_comm (comm, word, word_length, max_length, flags,
2078                              pwordexp, ifs, ifs_white);
2079           free (comm);
2080           return error;
2081
2082         case '\\':
2083           if (squoting)
2084             {
2085               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2086                                            words, offset);
2087
2088               if (error)
2089                 {
2090                   free (comm);
2091                   return error;
2092                 }
2093
2094               break;
2095             }
2096
2097           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2098                                    offset);
2099
2100           if (error)
2101             {
2102               free (comm);
2103               return error;
2104             }
2105
2106           break;
2107
2108         case '\'':
2109           squoting = 1 - squoting;
2110           /* Fall through.  */
2111         default:
2112           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2113           if (comm == NULL)
2114             return WRDE_NOSPACE;
2115         }
2116     }
2117
2118   /* Premature end */
2119   free (comm);
2120   return WRDE_SYNTAX;
2121 }
2122
2123 static int
2124 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2125               const char *words, size_t *offset, int flags,
2126               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2127 {
2128   /* We are poised just after a double-quote */
2129   int error;
2130
2131   for (; words[*offset]; ++(*offset))
2132     {
2133       switch (words[*offset])
2134         {
2135         case '"':
2136           return 0;
2137
2138         case '$':
2139           error = parse_dollars (word, word_length, max_length, words, offset,
2140                                  flags, pwordexp, ifs, ifs_white, 1);
2141           /* The ``1'' here is to tell parse_dollars not to
2142            * split the fields.  It may need to, however ("$@").
2143            */
2144           if (error)
2145             return error;
2146
2147           break;
2148
2149         case '`':
2150           ++(*offset);
2151           error = parse_backtick (word, word_length, max_length, words,
2152                                   offset, flags, NULL, NULL, NULL);
2153           /* The first NULL here is to tell parse_backtick not to
2154            * split the fields.
2155            */
2156           if (error)
2157             return error;
2158
2159           break;
2160
2161         case '\\':
2162           error = parse_qtd_backslash (word, word_length, max_length, words,
2163                                        offset);
2164
2165           if (error)
2166             return error;
2167
2168           break;
2169
2170         default:
2171           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2172           if (*word == NULL)
2173             return WRDE_NOSPACE;
2174         }
2175     }
2176
2177   /* Unterminated string */
2178   return WRDE_SYNTAX;
2179 }
2180
2181 /*
2182  * wordfree() is to be called after pwordexp is finished with.
2183  */
2184
2185 void
2186 wordfree (wordexp_t *pwordexp)
2187 {
2188
2189   /* wordexp can set pwordexp to NULL */
2190   if (pwordexp && pwordexp->we_wordv)
2191     {
2192       char **wordv = pwordexp->we_wordv;
2193
2194       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2195         free (*wordv);
2196
2197       free (pwordexp->we_wordv);
2198       pwordexp->we_wordv = NULL;
2199     }
2200 }
2201 libc_hidden_def (wordfree)
2202
2203 /*
2204  * wordexp()
2205  */
2206
2207 int
2208 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2209 {
2210   size_t words_offset;
2211   size_t word_length;
2212   size_t max_length;
2213   char *word = w_newword (&word_length, &max_length);
2214   int error;
2215   char *ifs;
2216   char ifs_white[4];
2217   wordexp_t old_word = *pwordexp;
2218
2219   if (flags & WRDE_REUSE)
2220     {
2221       /* Minimal implementation of WRDE_REUSE for now */
2222       wordfree (pwordexp);
2223       old_word.we_wordv = NULL;
2224     }
2225
2226   if ((flags & WRDE_APPEND) == 0)
2227     {
2228       pwordexp->we_wordc = 0;
2229
2230       if (flags & WRDE_DOOFFS)
2231         {
2232           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2233           if (pwordexp->we_wordv == NULL)
2234             {
2235               error = WRDE_NOSPACE;
2236               goto do_error;
2237             }
2238         }
2239       else
2240         {
2241           pwordexp->we_wordv = calloc (1, sizeof (char *));
2242           if (pwordexp->we_wordv == NULL)
2243             {
2244               error = WRDE_NOSPACE;
2245               goto do_error;
2246             }
2247
2248           pwordexp->we_offs = 0;
2249         }
2250     }
2251
2252   /* Find out what the field separators are.
2253    * There are two types: whitespace and non-whitespace.
2254    */
2255   ifs = getenv ("IFS");
2256
2257   if (ifs == NULL)
2258     /* IFS unset - use <space><tab><newline>. */
2259     ifs = strcpy (ifs_white, " \t\n");
2260   else
2261     {
2262       char *ifsch = ifs;
2263       char *whch = ifs_white;
2264
2265       while (*ifsch != '\0')
2266         {
2267           if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2268             {
2269               /* Whitespace IFS.  See first whether it is already in our
2270                  collection.  */
2271               char *runp = ifs_white;
2272
2273               while (runp < whch && *runp != *ifsch)
2274                 ++runp;
2275
2276               if (runp == whch)
2277                 *whch++ = *ifsch;
2278             }
2279
2280           ++ifsch;
2281         }
2282       *whch = '\0';
2283     }
2284
2285   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2286     switch (words[words_offset])
2287       {
2288       case '\\':
2289         error = parse_backslash (&word, &word_length, &max_length, words,
2290                                  &words_offset);
2291
2292         if (error)
2293           goto do_error;
2294
2295         break;
2296
2297       case '$':
2298         error = parse_dollars (&word, &word_length, &max_length, words,
2299                                &words_offset, flags, pwordexp, ifs, ifs_white,
2300                                0);
2301
2302         if (error)
2303           goto do_error;
2304
2305         break;
2306
2307       case '`':
2308         ++words_offset;
2309         error = parse_backtick (&word, &word_length, &max_length, words,
2310                                 &words_offset, flags, pwordexp, ifs,
2311                                 ifs_white);
2312
2313         if (error)
2314           goto do_error;
2315
2316         break;
2317
2318       case '"':
2319         ++words_offset;
2320         error = parse_dquote (&word, &word_length, &max_length, words,
2321                               &words_offset, flags, pwordexp, ifs, ifs_white);
2322
2323         if (error)
2324           goto do_error;
2325
2326         if (!word_length)
2327           {
2328             error = w_addword (pwordexp, NULL);
2329
2330             if (error)
2331               return error;
2332           }
2333
2334         break;
2335
2336       case '\'':
2337         ++words_offset;
2338         error = parse_squote (&word, &word_length, &max_length, words,
2339                               &words_offset);
2340
2341         if (error)
2342           goto do_error;
2343
2344         if (!word_length)
2345           {
2346             error = w_addword (pwordexp, NULL);
2347
2348             if (error)
2349               return error;
2350           }
2351
2352         break;
2353
2354       case '~':
2355         error = parse_tilde (&word, &word_length, &max_length, words,
2356                              &words_offset, pwordexp->we_wordc);
2357
2358         if (error)
2359           goto do_error;
2360
2361         break;
2362
2363       case '*':
2364       case '[':
2365       case '?':
2366         error = parse_glob (&word, &word_length, &max_length, words,
2367                             &words_offset, flags, pwordexp, ifs, ifs_white);
2368
2369         if (error)
2370           goto do_error;
2371
2372         break;
2373
2374       default:
2375         /* Is it a word separator? */
2376         if (strchr (" \t", words[words_offset]) == NULL)
2377           {
2378             char ch = words[words_offset];
2379
2380             /* Not a word separator -- but is it a valid word char? */
2381             if (strchr ("\n|&;<>(){}", ch))
2382               {
2383                 /* Fail */
2384                 error = WRDE_BADCHAR;
2385                 goto do_error;
2386               }
2387
2388             /* "Ordinary" character -- add it to word */
2389             word = w_addchar (word, &word_length, &max_length,
2390                               ch);
2391             if (word == NULL)
2392               {
2393                 error = WRDE_NOSPACE;
2394                 goto do_error;
2395               }
2396
2397             break;
2398           }
2399
2400         /* If a word has been delimited, add it to the list. */
2401         if (word != NULL)
2402           {
2403             error = w_addword (pwordexp, word);
2404             if (error)
2405               goto do_error;
2406           }
2407
2408         word = w_newword (&word_length, &max_length);
2409       }
2410
2411   /* End of string */
2412
2413   /* There was a word separator at the end */
2414   if (word == NULL) /* i.e. w_newword */
2415     return 0;
2416
2417   /* There was no field separator at the end */
2418   return w_addword (pwordexp, word);
2419
2420 do_error:
2421   /* Error:
2422    *    free memory used (unless error is WRDE_NOSPACE), and
2423    *    set pwordexp members back to what they were.
2424    */
2425
2426   free (word);
2427
2428   if (error == WRDE_NOSPACE)
2429     return WRDE_NOSPACE;
2430
2431   if ((flags & WRDE_APPEND) == 0)
2432     wordfree (pwordexp);
2433
2434   *pwordexp = old_word;
2435   return error;
2436 }