posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2002, 2003, 2005, 2006 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, write to the Free
  18    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  19    02111-1307 USA.  */
  20
  21 #include <alloca.h>
  22 #include <ctype.h>
  23 #include <errno.h>
  24 #include <fcntl.h>
  25 #include <fnmatch.h>
  26 #include <glob.h>
  27 #include <libintl.h>
  28 #include <paths.h>
  29 #include <pwd.h>
  30 #include <signal.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <sys/param.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/types.h>
  39 #include <sys/wait.h>
  40 #include <unistd.h>
  41 #ifdef USE_IN_LIBIO
  42 # include <wchar.h>
  43 #endif
  44 #include <wordexp.h>
  45
  46 #include <bits/libc-lock.h>
  47 #include <stdio-common/_itoa.h>
  48
  49 /* Undefine the following line for the production version.  */
  50 /* #define NDEBUG 1 */
  51 #include <assert.h>
  52
  53 /* Get some device information.  */
  54 #include <device-nrs.h>
  55
  56 /*
  57  * This is a recursive-descent-style word expansion routine.
  58  */
  59
  60 /* These variables are defined and initialized in the startup code.  */
  61 extern int __libc_argc attribute_hidden;
  62 extern char **__libc_argv attribute_hidden;
  63
  64 /* Some forward declarations */
  65 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  66                           const char *words, size_t *offset, int flags,
  67                           wordexp_t *pwordexp, const char *ifs,
  68                           const char *ifs_white, int quoted)
  69      internal_function;
  70 static int parse_backtick (char **word, size_t *word_length,
  71                            size_t *max_length, const char *words,
  72                            size_t *offset, int flags, wordexp_t *pwordexp,
  73                            const char *ifs, const char *ifs_white)
  74      internal_function;
  75 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  76                          const char *words, size_t *offset, int flags,
  77                          wordexp_t *pwordexp, const char *ifs,
  78                          const char *ifs_white)
  79      internal_function;
  80 static int eval_expr (char *expr, long int *result) internal_function;
  81
  82 /* The w_*() functions manipulate word lists. */
  83
  84 #define W_CHUNK (100)
  85
  86 /* Result of w_newword will be ignored if it's the last word. */
  87 static inline char *
  88 w_newword (size_t *actlen, size_t *maxlen)
  89 {
  90   *actlen = *maxlen = 0;
  91   return NULL;
  92 }
  93
  94 static char *
  95 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  96      /* (lengths exclude trailing zero) */
  97 {
  98   /* Add a character to the buffer, allocating room for it if needed.  */
  99
 100   if (*actlen == *maxlen)
 101     {
 102       char *old_buffer = buffer;
 103       assert (buffer == NULL || *maxlen != 0);
 104       *maxlen += W_CHUNK;
 105       buffer = (char *) realloc (buffer, 1 + *maxlen);
 106
 107       if (buffer == NULL)
 108         free (old_buffer);
 109     }
 110
 111   if (buffer != NULL)
 112     {
 113       buffer[*actlen] = ch;
 114       buffer[++(*actlen)] = '\0';
 115     }
 116
 117   return buffer;
 118 }
 119
 120 static char *
 121 internal_function
 122 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 123           size_t len)
 124 {
 125   /* Add a string to the buffer, allocating room for it if needed.
 126    */
 127   if (*actlen + len > *maxlen)
 128     {
 129       char *old_buffer = buffer;
 130       assert (buffer == NULL || *maxlen != 0);
 131       *maxlen += MAX (2 * len, W_CHUNK);
 132       buffer = realloc (old_buffer, 1 + *maxlen);
 133
 134       if (buffer == NULL)
 135         free (old_buffer);
 136     }
 137
 138   if (buffer != NULL)
 139     {
 140       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 141       *actlen += len;
 142     }
 143
 144   return buffer;
 145 }
 146
 147 static char *
 148 internal_function
 149 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 150      /* (lengths exclude trailing zero) */
 151 {
 152   /* Add a string to the buffer, allocating room for it if needed.
 153    */
 154   size_t len;
 155
 156   assert (str != NULL); /* w_addstr only called from this file */
 157   len = strlen (str);
 158
 159   return w_addmem (buffer, actlen, maxlen, str, len);
 160 }
 161
 162 static int
 163 internal_function
 164 w_addword (wordexp_t *pwordexp, char *word)
 165 {
 166   /* Add a word to the wordlist */
 167   size_t num_p;
 168   char **new_wordv;
 169   bool allocated = false;
 170
 171   /* Internally, NULL acts like "".  Convert NULLs to "" before
 172    * the caller sees them.
 173    */
 174   if (word == NULL)
 175     {
 176       word = __strdup ("");
 177       if (word == NULL)
 178         goto no_space;
 179       allocated = true;
 180     }
 181
 182   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 183   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 184   if (new_wordv != NULL)
 185     {
 186       pwordexp->we_wordv = new_wordv;
 187       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 188       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 189       return 0;
 190     }
 191
 192   if (allocated)
 193     free (word);
 194
 195 no_space:
 196   return WRDE_NOSPACE;
 197 }
 198
 199 /* The parse_*() functions should leave *offset being the offset in 'words'
 200  * to the last character processed.
 201  */
 202
 203 static int
 204 internal_function
 205 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 206                  const char *words, size_t *offset)
 207 {
 208   /* We are poised _at_ a backslash, not in quotes */
 209
 210   switch (words[1 + *offset])
 211     {
 212     case 0:
 213       /* Backslash is last character of input words */
 214       return WRDE_SYNTAX;
 215
 216     case '\n':
 217       ++(*offset);
 218       break;
 219
 220     default:
 221       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 222       if (*word == NULL)
 223         return WRDE_NOSPACE;
 224
 225       ++(*offset);
 226       break;
 227     }
 228
 229   return 0;
 230 }
 231
 232 static int
 233 internal_function
 234 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 235                      const char *words, size_t *offset)
 236 {
 237   /* We are poised _at_ a backslash, inside quotes */
 238
 239   switch (words[1 + *offset])
 240     {
 241     case 0:
 242       /* Backslash is last character of input words */
 243       return WRDE_SYNTAX;
 244
 245     case '\n':
 246       ++(*offset);
 247       break;
 248
 249     case '$':
 250     case '`':
 251     case '"':
 252     case '\\':
 253       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 254       if (*word == NULL)
 255         return WRDE_NOSPACE;
 256
 257       ++(*offset);
 258       break;
 259
 260     default:
 261       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 262       if (*word != NULL)
 263         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 264
 265       if (*word == NULL)
 266         return WRDE_NOSPACE;
 267
 268       ++(*offset);
 269       break;
 270     }
 271
 272   return 0;
 273 }
 274
 275 static int
 276 internal_function
 277 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 278              const char *words, size_t *offset, size_t wordc)
 279 {
 280   /* We are poised _at_ a tilde */
 281   size_t i;
 282
 283   if (*word_length != 0)
 284     {
 285       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 286         {
 287           if (!((*word)[*word_length - 1] == ':'
 288                 && strchr (*word, '=') && wordc == 0))
 289             {
 290               *word = w_addchar (*word, word_length, max_length, '~');
 291               return *word ? 0 : WRDE_NOSPACE;
 292             }
 293         }
 294     }
 295
 296   for (i = 1 + *offset; words[i]; i++)
 297     {
 298       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 299           words[i] == '\t' || words[i] == 0 )
 300         break;
 301
 302       if (words[i] == '\\')
 303         {
 304           *word = w_addchar (*word, word_length, max_length, '~');
 305           return *word ? 0 : WRDE_NOSPACE;
 306         }
 307     }
 308
 309   if (i == 1 + *offset)
 310     {
 311       /* Tilde appears on its own */
 312       uid_t uid;
 313       struct passwd pwd, *tpwd;
 314       int buflen = 1000;
 315       char* home;
 316       char* buffer;
 317       int result;
 318
 319       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 320          results are unspecified.  We do a lookup on the uid if
 321          HOME is unset. */
 322
 323       home = getenv ("HOME");
 324       if (home != NULL)
 325         {
 326           *word = w_addstr (*word, word_length, max_length, home);
 327           if (*word == NULL)
 328             return WRDE_NOSPACE;
 329         }
 330       else
 331         {
 332           uid = __getuid ();
 333           buffer = __alloca (buflen);
 334
 335           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 336                  && errno == ERANGE)
 337             buffer = extend_alloca (buffer, buflen, buflen + 1000);
 338
 339           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 340             {
 341               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 342               if (*word == NULL)
 343                 return WRDE_NOSPACE;
 344             }
 345           else
 346             {
 347               *word = w_addchar (*word, word_length, max_length, '~');
 348               if (*word == NULL)
 349                 return WRDE_NOSPACE;
 350             }
 351         }
 352     }
 353   else
 354     {
 355       /* Look up user name in database to get home directory */
 356       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 357       struct passwd pwd, *tpwd;
 358       int buflen = 1000;
 359       char* buffer = __alloca (buflen);
 360       int result;
 361
 362       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 363              && errno == ERANGE)
 364         buffer = extend_alloca (buffer, buflen, buflen + 1000);
 365
 366       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 367         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 368       else
 369         {
 370           /* (invalid login name) */
 371           *word = w_addchar (*word, word_length, max_length, '~');
 372           if (*word != NULL)
 373             *word = w_addstr (*word, word_length, max_length, user);
 374         }
 375
 376       *offset = i - 1;
 377     }
 378   return *word ? 0 : WRDE_NOSPACE;
 379 }
 380
 381
 382 static int
 383 internal_function
 384 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 385                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 386                const char *ifs_white)
 387 {
 388   int error;
 389   unsigned int match;
 390   glob_t globbuf;
 391
 392   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 393
 394   if (error != 0)
 395     {
 396       /* We can only run into memory problems.  */
 397       assert (error == GLOB_NOSPACE);
 398       return WRDE_NOSPACE;
 399     }
 400
 401   if (ifs && !*ifs)
 402     {
 403       /* No field splitting allowed. */
 404       assert (globbuf.gl_pathv[0] != NULL);
 405       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 406       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 407         {
 408           *word = w_addchar (*word, word_length, max_length, ' ');
 409           if (*word != NULL)
 410             *word = w_addstr (*word, word_length, max_length,
 411                               globbuf.gl_pathv[match]);
 412         }
 413
 414       globfree (&globbuf);
 415       return *word ? 0 : WRDE_NOSPACE;
 416     }
 417
 418   assert (ifs == NULL || *ifs != '\0');
 419   if (*word != NULL)
 420     {
 421       free (*word);
 422       *word = w_newword (word_length, max_length);
 423     }
 424
 425   for (match = 0; match < globbuf.gl_pathc; ++match)
 426     {
 427       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 428       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 429         {
 430           globfree (&globbuf);
 431           return WRDE_NOSPACE;
 432         }
 433     }
 434
 435   globfree (&globbuf);
 436   return 0;
 437 }
 438
 439 static int
 440 internal_function
 441 parse_glob (char **word, size_t *word_length, size_t *max_length,
 442             const char *words, size_t *offset, int flags,
 443             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 444 {
 445   /* We are poised just after a '*', a '[' or a '?'. */
 446   int error = WRDE_NOSPACE;
 447   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 448   size_t i;
 449   wordexp_t glob_list; /* List of words to glob */
 450
 451   glob_list.we_wordc = 0;
 452   glob_list.we_wordv = NULL;
 453   glob_list.we_offs = 0;
 454   for (; words[*offset] != '\0'; ++*offset)
 455     {
 456       if (strchr (ifs, words[*offset]) != NULL)
 457         /* Reached IFS */
 458         break;
 459
 460       /* Sort out quoting */
 461       if (words[*offset] == '\'')
 462         {
 463           if (quoted == 0)
 464             {
 465               quoted = 1;
 466               continue;
 467             }
 468           else if (quoted == 1)
 469             {
 470               quoted = 0;
 471               continue;
 472             }
 473         }
 474       else if (words[*offset] == '"')
 475         {
 476           if (quoted == 0)
 477             {
 478               quoted = 2;
 479               continue;
 480             }
 481           else if (quoted == 2)
 482             {
 483               quoted = 0;
 484               continue;
 485             }
 486         }
 487
 488       /* Sort out other special characters */
 489       if (quoted != 1 && words[*offset] == '$')
 490         {
 491           error = parse_dollars (word, word_length, max_length, words,
 492                                  offset, flags, &glob_list, ifs, ifs_white,
 493                                  quoted == 2);
 494           if (error)
 495             goto tidy_up;
 496
 497           continue;
 498         }
 499       else if (words[*offset] == '\\')
 500         {
 501           if (quoted)
 502             error = parse_qtd_backslash (word, word_length, max_length,
 503                                          words, offset);
 504           else
 505             error = parse_backslash (word, word_length, max_length,
 506                                      words, offset);
 507
 508           if (error)
 509             goto tidy_up;
 510
 511           continue;
 512         }
 513
 514       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 515       if (*word == NULL)
 516         goto tidy_up;
 517     }
 518
 519   /* Don't forget to re-parse the character we stopped at. */
 520   --*offset;
 521
 522   /* Glob the words */
 523   error = w_addword (&glob_list, *word);
 524   *word = w_newword (word_length, max_length);
 525   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 526     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 527                            max_length, pwordexp, ifs, ifs_white);
 528
 529   /* Now tidy up */
 530 tidy_up:
 531   wordfree (&glob_list);
 532   return error;
 533 }
 534
 535 static int
 536 internal_function
 537 parse_squote (char **word, size_t *word_length, size_t *max_length,
 538               const char *words, size_t *offset)
 539 {
 540   /* We are poised just after a single quote */
 541   for (; words[*offset]; ++(*offset))
 542     {
 543       if (words[*offset] != '\'')
 544         {
 545           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 546           if (*word == NULL)
 547             return WRDE_NOSPACE;
 548         }
 549       else return 0;
 550     }
 551
 552   /* Unterminated string */
 553   return WRDE_SYNTAX;
 554 }
 555
 556 /* Functions to evaluate an arithmetic expression */
 557 static int
 558 internal_function
 559 eval_expr_val (char **expr, long int *result)
 560 {
 561   char *digit;
 562
 563   /* Skip white space */
 564   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 565
 566   if (*digit == '(')
 567     {
 568       /* Scan for closing paren */
 569       for (++digit; **expr && **expr != ')'; ++(*expr));
 570
 571       /* Is there one? */
 572       if (!**expr)
 573         return WRDE_SYNTAX;
 574
 575       *(*expr)++ = 0;
 576
 577       if (eval_expr (digit, result))
 578         return WRDE_SYNTAX;
 579
 580       return 0;
 581     }
 582
 583   /* POSIX requires that decimal, octal, and hexadecimal constants are
 584      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 585   *result = strtol (digit, expr, 0);
 586   if (digit == *expr)
 587     return WRDE_SYNTAX;
 588
 589   return 0;
 590 }
 591
 592 static int
 593 internal_function
 594 eval_expr_multdiv (char **expr, long int *result)
 595 {
 596   long int arg;
 597
 598   /* Read a Value */
 599   if (eval_expr_val (expr, result) != 0)
 600     return WRDE_SYNTAX;
 601
 602   while (**expr)
 603     {
 604       /* Skip white space */
 605       for (; *expr && **expr && isspace (**expr); ++(*expr));
 606
 607       if (**expr == '*')
 608         {
 609           ++(*expr);
 610           if (eval_expr_val (expr, &arg) != 0)
 611             return WRDE_SYNTAX;
 612
 613           *result *= arg;
 614         }
 615       else if (**expr == '/')
 616         {
 617           ++(*expr);
 618           if (eval_expr_val (expr, &arg) != 0)
 619             return WRDE_SYNTAX;
 620
 621           *result /= arg;
 622         }
 623       else break;
 624     }
 625
 626   return 0;
 627 }
 628
 629 static int
 630 internal_function
 631 eval_expr (char *expr, long int *result)
 632 {
 633   long int arg;
 634
 635   /* Read a Multdiv */
 636   if (eval_expr_multdiv (&expr, result) != 0)
 637     return WRDE_SYNTAX;
 638
 639   while (*expr)
 640     {
 641       /* Skip white space */
 642       for (; expr && *expr && isspace (*expr); ++expr);
 643
 644       if (*expr == '+')
 645         {
 646           ++expr;
 647           if (eval_expr_multdiv (&expr, &arg) != 0)
 648             return WRDE_SYNTAX;
 649
 650           *result += arg;
 651         }
 652       else if (*expr == '-')
 653         {
 654           ++expr;
 655           if (eval_expr_multdiv (&expr, &arg) != 0)
 656             return WRDE_SYNTAX;
 657
 658           *result -= arg;
 659         }
 660       else break;
 661     }
 662
 663   return 0;
 664 }
 665
 666 static int
 667 internal_function
 668 parse_arith (char **word, size_t *word_length, size_t *max_length,
 669              const char *words, size_t *offset, int flags, int bracket)
 670 {
 671   /* We are poised just after "$((" or "$[" */
 672   int error;
 673   int paren_depth = 1;
 674   size_t expr_length;
 675   size_t expr_maxlen;
 676   char *expr;
 677
 678   expr = w_newword (&expr_length, &expr_maxlen);
 679   for (; words[*offset]; ++(*offset))
 680     {
 681       switch (words[*offset])
 682         {
 683         case '$':
 684           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 685                                  words, offset, flags, NULL, NULL, NULL, 1);
 686           /* The ``1'' here is to tell parse_dollars not to
 687            * split the fields.
 688            */
 689           if (error)
 690             {
 691               free (expr);
 692               return error;
 693             }
 694           break;
 695
 696         case '`':
 697           (*offset)++;
 698           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 699                                   words, offset, flags, NULL, NULL, NULL);
 700           /* The first NULL here is to tell parse_backtick not to
 701            * split the fields.
 702            */
 703           if (error)
 704             {
 705               free (expr);
 706               return error;
 707             }
 708           break;
 709
 710         case '\\':
 711           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 712                                        words, offset);
 713           if (error)
 714             {
 715               free (expr);
 716               return error;
 717             }
 718           /* I think that a backslash within an
 719            * arithmetic expansion is bound to
 720            * cause an error sooner or later anyway though.
 721            */
 722           break;
 723
 724         case ')':
 725           if (--paren_depth == 0)
 726             {
 727               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 728               long int numresult = 0;
 729               long long int convertme;
 730
 731               if (bracket || words[1 + *offset] != ')')
 732                 {
 733                   free (expr);
 734                   return WRDE_SYNTAX;
 735                 }
 736
 737               ++(*offset);
 738
 739               /* Go - evaluate. */
 740               if (*expr && eval_expr (expr, &numresult) != 0)
 741                 {
 742                   free (expr);
 743                   return WRDE_SYNTAX;
 744                 }
 745
 746               if (numresult < 0)
 747                 {
 748                   convertme = -numresult;
 749                   *word = w_addchar (*word, word_length, max_length, '-');
 750                   if (!*word)
 751                     {
 752                       free (expr);
 753                       return WRDE_NOSPACE;
 754                     }
 755                 }
 756               else
 757                 convertme = numresult;
 758
 759               result[20] = '\0';
 760               *word = w_addstr (*word, word_length, max_length,
 761                                 _itoa (convertme, &result[20], 10, 0));
 762               free (expr);
 763               return *word ? 0 : WRDE_NOSPACE;
 764             }
 765           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 766           if (expr == NULL)
 767             return WRDE_NOSPACE;
 768
 769           break;
 770
 771         case ']':
 772           if (bracket && paren_depth == 1)
 773             {
 774               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 775               long int numresult = 0;
 776
 777               /* Go - evaluate. */
 778               if (*expr && eval_expr (expr, &numresult) != 0)
 779                 {
 780                   free (expr);
 781                   return WRDE_SYNTAX;
 782                 }
 783
 784               result[20] = '\0';
 785               *word = w_addstr (*word, word_length, max_length,
 786                                 _itoa_word (numresult, &result[20], 10, 0));
 787               free (expr);
 788               return *word ? 0 : WRDE_NOSPACE;
 789             }
 790
 791           free (expr);
 792           return WRDE_SYNTAX;
 793
 794         case '\n':
 795         case ';':
 796         case '{':
 797         case '}':
 798           free (expr);
 799           return WRDE_BADCHAR;
 800
 801         case '(':
 802           ++paren_depth;
 803         default:
 804           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 805           if (expr == NULL)
 806             return WRDE_NOSPACE;
 807         }
 808     }
 809
 810   /* Premature end */
 811   free (expr);
 812   return WRDE_SYNTAX;
 813 }
 814
 815 /* Function called by child process in exec_comm() */
 816 static inline void
 817 internal_function __attribute__ ((always_inline))
 818 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 819 {
 820   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 821
 822   /* Execute the command, or just check syntax? */
 823   if (noexec)
 824     args[1] = "-nc";
 825
 826   /* Redirect output.  */
 827   __dup2 (fildes[1], STDOUT_FILENO);
 828   __close (fildes[1]);
 829
 830   /* Redirect stderr to /dev/null if we have to.  */
 831   if (showerr == 0)
 832     {
 833       struct stat64 st;
 834       int fd;
 835       __close (2);
 836       fd = __open (_PATH_DEVNULL, O_WRONLY);
 837       if (fd >= 0 && fd != 2)
 838         {
 839           __dup2 (fd, STDERR_FILENO);
 840           __close (fd);
 841         }
 842       /* Be paranoid.  Check that we actually opened the /dev/null
 843          device.  */
 844       if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
 845           || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
 846 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 847           || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 848 #endif
 849           )
 850         /* It's not the /dev/null device.  Stop right here.  The
 851            problem is: how do we stop?  We use _exit() with an
 852            hopefully unusual exit code.  */
 853         _exit (90);
 854     }
 855
 856   /* Make sure the subshell doesn't field-split on our behalf. */
 857   __unsetenv ("IFS");
 858
 859   __close (fildes[0]);
 860   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 861
 862   /* Bad.  What now?  */
 863   abort ();
 864 }
 865
 866 /* Function to execute a command and retrieve the results */
 867 /* pwordexp contains NULL if field-splitting is forbidden */
 868 static int
 869 internal_function
 870 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 871            int flags, wordexp_t *pwordexp, const char *ifs,
 872            const char *ifs_white)
 873 {
 874   int fildes[2];
 875 #define bufsize 128
 876   int buflen;
 877   int i;
 878   int status = 0;
 879   size_t maxnewlines = 0;
 880   char buffer[bufsize];
 881   pid_t pid;
 882   int noexec = 0;
 883
 884   /* Don't fork() unless necessary */
 885   if (!comm || !*comm)
 886     return 0;
 887
 888   if (__pipe (fildes))
 889     /* Bad */
 890     return WRDE_NOSPACE;
 891
 892  again:
 893   if ((pid = __fork ()) < 0)
 894     {
 895       /* Bad */
 896       if (fildes[0] != -1)
 897         __close (fildes[0]);
 898       if (fildes[1] != -1)
 899         __close (fildes[1]);
 900       return WRDE_NOSPACE;
 901     }
 902
 903   if (pid == 0)
 904     exec_comm_child (comm, fildes, noexec ? 0 : flags & WRDE_SHOWERR, noexec);
 905
 906   /* Parent */
 907
 908   /* If we are just testing the syntax, only wait.  */
 909   if (noexec)
 910     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 911             && status != 0) ? WRDE_SYNTAX : 0;
 912
 913   __close (fildes[1]);
 914   fildes[1] = -1;
 915
 916   if (!pwordexp)
 917     /* Quoted - no field splitting */
 918     {
 919       while (1)
 920         {
 921           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 922                                                     bufsize))) < 1)
 923             {
 924               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, WNOHANG)) == 0)
 925                 continue;
 926               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 927                                                         bufsize))) < 1)
 928                 break;
 929             }
 930
 931           maxnewlines += buflen;
 932
 933           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 934           if (*word == NULL)
 935             goto no_space;
 936         }
 937     }
 938   else
 939     /* Not quoted - split fields */
 940     {
 941       int copying = 0;
 942       /* 'copying' is:
 943        *  0 when searching for first character in a field not IFS white space
 944        *  1 when copying the text of a field
 945        *  2 when searching for possible non-whitespace IFS
 946        *  3 when searching for non-newline after copying field
 947        */
 948
 949       while (1)
 950         {
 951           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 952                                                     bufsize))) < 1)
 953             {
 954               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, WNOHANG)) == 0)
 955                 continue;
 956               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 957                                                         bufsize))) < 1)
 958                 break;
 959             }
 960
 961           for (i = 0; i < buflen; ++i)
 962             {
 963               if (strchr (ifs, buffer[i]) != NULL)
 964                 {
 965                   /* Current character is IFS */
 966                   if (strchr (ifs_white, buffer[i]) == NULL)
 967                     {
 968                       /* Current character is IFS but not whitespace */
 969                       if (copying == 2)
 970                         {
 971                           /*            current character
 972                            *                   |
 973                            *                   V
 974                            * eg: text<space><comma><space>moretext
 975                            *
 976                            * So, strip whitespace IFS (like at the start)
 977                            */
 978                           copying = 0;
 979                           continue;
 980                         }
 981
 982                       copying = 0;
 983                       /* fall through and delimit field.. */
 984                     }
 985                   else
 986                     {
 987                       if (buffer[i] == '\n')
 988                         {
 989                           /* Current character is (IFS) newline */
 990
 991                           /* If copying a field, this is the end of it,
 992                              but maybe all that's left is trailing newlines.
 993                              So start searching for a non-newline. */
 994                           if (copying == 1)
 995                             copying = 3;
 996
 997                           continue;
 998                         }
 999                       else
1000                         {
1001                           /* Current character is IFS white space, but
1002                              not a newline */
1003
1004                           /* If not either copying a field or searching
1005                              for non-newline after a field, ignore it */
1006                           if (copying != 1 && copying != 3)
1007                             continue;
1008
1009                           /* End of field (search for non-ws IFS afterwards) */
1010                           copying = 2;
1011                         }
1012                     }
1013
1014                   /* First IFS white space (non-newline), or IFS non-whitespace.
1015                    * Delimit the field.  Nulls are converted by w_addword. */
1016                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1017                     goto no_space;
1018
1019                   *word = w_newword (word_length, max_length);
1020
1021                   maxnewlines = 0;
1022                   /* fall back round the loop.. */
1023                 }
1024               else
1025                 {
1026                   /* Not IFS character */
1027
1028                   if (copying == 3)
1029                     {
1030                       /* Nothing but (IFS) newlines since the last field,
1031                          so delimit it here before starting new word */
1032                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1033                         goto no_space;
1034
1035                       *word = w_newword (word_length, max_length);
1036                     }
1037
1038                   copying = 1;
1039
1040                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1041                     maxnewlines++;
1042                   else
1043                     maxnewlines = 0;
1044
1045                   *word = w_addchar (*word, word_length, max_length,
1046                                      buffer[i]);
1047                   if (*word == NULL)
1048                     goto no_space;
1049                 }
1050             }
1051         }
1052     }
1053
1054   /* Chop off trailing newlines (required by POSIX.2)  */
1055   /* Ensure we don't go back further than the beginning of the
1056      substitution (i.e. remove maxnewlines bytes at most) */
1057   while (maxnewlines-- != 0 &&
1058          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1059     {
1060       (*word)[--*word_length] = '\0';
1061
1062       /* If the last word was entirely newlines, turn it into a new word
1063        * which can be ignored if there's nothing following it. */
1064       if (*word_length == 0)
1065         {
1066           free (*word);
1067           *word = w_newword (word_length, max_length);
1068           break;
1069         }
1070     }
1071
1072   __close (fildes[0]);
1073   fildes[0] = -1;
1074
1075   /* Check for syntax error (re-execute but with "-n" flag) */
1076   if (buflen < 1 && status != 0)
1077     {
1078       noexec = 1;
1079       goto again;
1080     }
1081
1082   return 0;
1083
1084 no_space:
1085   __kill (pid, SIGKILL);
1086   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1087   __close (fildes[0]);
1088   return WRDE_NOSPACE;
1089 }
1090
1091 static int
1092 internal_function
1093 parse_comm (char **word, size_t *word_length, size_t *max_length,
1094             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1095             const char *ifs, const char *ifs_white)
1096 {
1097   /* We are poised just after "$(" */
1098   int paren_depth = 1;
1099   int error = 0;
1100   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1101   size_t comm_length;
1102   size_t comm_maxlen;
1103   char *comm = w_newword (&comm_length, &comm_maxlen);
1104
1105   for (; words[*offset]; ++(*offset))
1106     {
1107       switch (words[*offset])
1108         {
1109         case '\'':
1110           if (quoted == 0)
1111             quoted = 1;
1112           else if (quoted == 1)
1113             quoted = 0;
1114
1115           break;
1116
1117         case '"':
1118           if (quoted == 0)
1119             quoted = 2;
1120           else if (quoted == 2)
1121             quoted = 0;
1122
1123           break;
1124
1125         case ')':
1126           if (!quoted && --paren_depth == 0)
1127             {
1128               /* Go -- give script to the shell */
1129               if (comm)
1130                 {
1131 #ifdef __libc_ptf_call
1132                   /* We do not want the exec_comm call to be cut short
1133                      by a thread cancellation since cleanup is very
1134                      ugly.  Therefore disable cancellation for
1135                      now.  */
1136                   // XXX Ideally we do want the thread being cancelable.
1137                   // XXX If demand is there we'll change it.
1138                   int state = PTHREAD_CANCEL_ENABLE;
1139                   __libc_ptf_call (pthread_setcancelstate,
1140                                    (PTHREAD_CANCEL_DISABLE, &state), 0);
1141 #endif
1142
1143                   error = exec_comm (comm, word, word_length, max_length,
1144                                      flags, pwordexp, ifs, ifs_white);
1145
1146 #ifdef __libc_ptf_call
1147                   __libc_ptf_call (pthread_setcancelstate, (state, NULL), 0);
1148 #endif
1149
1150                   free (comm);
1151                 }
1152
1153               return error;
1154             }
1155
1156           /* This is just part of the script */
1157           break;
1158
1159         case '(':
1160           if (!quoted)
1161             ++paren_depth;
1162         }
1163
1164       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1165       if (comm == NULL)
1166         return WRDE_NOSPACE;
1167     }
1168
1169   /* Premature end.  */
1170   free (comm);
1171
1172   return WRDE_SYNTAX;
1173 }
1174
1175 static int
1176 internal_function
1177 parse_param (char **word, size_t *word_length, size_t *max_length,
1178              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1179              const char *ifs, const char *ifs_white, int quoted)
1180 {
1181   /* We are poised just after "$" */
1182   enum action
1183   {
1184     ACT_NONE,
1185     ACT_RP_SHORT_LEFT = '#',
1186     ACT_RP_LONG_LEFT = 'L',
1187     ACT_RP_SHORT_RIGHT = '%',
1188     ACT_RP_LONG_RIGHT = 'R',
1189     ACT_NULL_ERROR = '?',
1190     ACT_NULL_SUBST = '-',
1191     ACT_NONNULL_SUBST = '+',
1192     ACT_NULL_ASSIGN = '='
1193   };
1194   size_t env_length;
1195   size_t env_maxlen;
1196   size_t pat_length;
1197   size_t pat_maxlen;
1198   size_t start = *offset;
1199   char *env;
1200   char *pattern;
1201   char *value = NULL;
1202   enum action action = ACT_NONE;
1203   int depth = 0;
1204   int colon_seen = 0;
1205   int seen_hash = 0;
1206   int free_value = 0;
1207   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1208   int error;
1209   int special = 0;
1210   char buffer[21];
1211   int brace = words[*offset] == '{';
1212
1213   env = w_newword (&env_length, &env_maxlen);
1214   pattern = w_newword (&pat_length, &pat_maxlen);
1215
1216   if (brace)
1217     ++*offset;
1218
1219   /* First collect the parameter name. */
1220
1221   if (words[*offset] == '#')
1222     {
1223       seen_hash = 1;
1224       if (!brace)
1225         goto envsubst;
1226       ++*offset;
1227     }
1228
1229   if (isalpha (words[*offset]) || words[*offset] == '_')
1230     {
1231       /* Normal parameter name. */
1232       do
1233         {
1234           env = w_addchar (env, &env_length, &env_maxlen,
1235                            words[*offset]);
1236           if (env == NULL)
1237             goto no_space;
1238         }
1239       while (isalnum (words[++*offset]) || words[*offset] == '_');
1240     }
1241   else if (isdigit (words[*offset]))
1242     {
1243       /* Numeric parameter name. */
1244       special = 1;
1245       do
1246         {
1247           env = w_addchar (env, &env_length, &env_maxlen,
1248                            words[*offset]);
1249           if (env == NULL)
1250             goto no_space;
1251           if (!brace)
1252             goto envsubst;
1253         }
1254       while (isdigit(words[++*offset]));
1255     }
1256   else if (strchr ("*@$", words[*offset]) != NULL)
1257     {
1258       /* Special parameter. */
1259       special = 1;
1260       env = w_addchar (env, &env_length, &env_maxlen,
1261                        words[*offset]);
1262       if (env == NULL)
1263         goto no_space;
1264       ++*offset;
1265     }
1266   else
1267     {
1268       if (brace)
1269         goto syntax;
1270     }
1271
1272   if (brace)
1273     {
1274       /* Check for special action to be applied to the value. */
1275       switch (words[*offset])
1276         {
1277         case '}':
1278           /* Evaluate. */
1279           goto envsubst;
1280
1281         case '#':
1282           action = ACT_RP_SHORT_LEFT;
1283           if (words[1 + *offset] == '#')
1284             {
1285               ++*offset;
1286               action = ACT_RP_LONG_LEFT;
1287             }
1288           break;
1289
1290         case '%':
1291           action = ACT_RP_SHORT_RIGHT;
1292           if (words[1 + *offset] == '%')
1293             {
1294               ++*offset;
1295               action = ACT_RP_LONG_RIGHT;
1296             }
1297           break;
1298
1299         case ':':
1300           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1301             goto syntax;
1302
1303           colon_seen = 1;
1304           action = words[++*offset];
1305           break;
1306
1307         case '-':
1308         case '=':
1309         case '?':
1310         case '+':
1311           action = words[*offset];
1312           break;
1313
1314         default:
1315           goto syntax;
1316         }
1317
1318       /* Now collect the pattern, but don't expand it yet. */
1319       ++*offset;
1320       for (; words[*offset]; ++(*offset))
1321         {
1322           switch (words[*offset])
1323             {
1324             case '{':
1325               if (!pattern_is_quoted)
1326                 ++depth;
1327               break;
1328
1329             case '}':
1330               if (!pattern_is_quoted)
1331                 {
1332                   if (depth == 0)
1333                     goto envsubst;
1334                   --depth;
1335                 }
1336               break;
1337
1338             case '\\':
1339               if (pattern_is_quoted)
1340                 /* Quoted; treat as normal character. */
1341                 break;
1342
1343               /* Otherwise, it's an escape: next character is literal. */
1344               if (words[++*offset] == '\0')
1345                 goto syntax;
1346
1347               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1348               if (pattern == NULL)
1349                 goto no_space;
1350
1351               break;
1352
1353             case '\'':
1354               if (pattern_is_quoted == 0)
1355                 pattern_is_quoted = 1;
1356               else if (pattern_is_quoted == 1)
1357                 pattern_is_quoted = 0;
1358
1359               break;
1360
1361             case '"':
1362               if (pattern_is_quoted == 0)
1363                 pattern_is_quoted = 2;
1364               else if (pattern_is_quoted == 2)
1365                 pattern_is_quoted = 0;
1366
1367               break;
1368             }
1369
1370           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1371                                words[*offset]);
1372           if (pattern == NULL)
1373             goto no_space;
1374         }
1375     }
1376
1377   /* End of input string -- remember to reparse the character that we
1378    * stopped at.  */
1379   --(*offset);
1380
1381 envsubst:
1382   if (words[start] == '{' && words[*offset] != '}')
1383     goto syntax;
1384
1385   if (env == NULL)
1386     {
1387       if (seen_hash)
1388         {
1389           /* $# expands to the number of positional parameters */
1390           buffer[20] = '\0';
1391           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1392           seen_hash = 0;
1393         }
1394       else
1395         {
1396           /* Just $ on its own */
1397           *offset = start - 1;
1398           *word = w_addchar (*word, word_length, max_length, '$');
1399           return *word ? 0 : WRDE_NOSPACE;
1400         }
1401     }
1402   /* Is it a numeric parameter? */
1403   else if (isdigit (env[0]))
1404     {
1405       int n = atoi (env);
1406
1407       if (n >= __libc_argc)
1408         /* Substitute NULL. */
1409         value = NULL;
1410       else
1411         /* Replace with appropriate positional parameter. */
1412         value = __libc_argv[n];
1413     }
1414   /* Is it a special parameter? */
1415   else if (special)
1416     {
1417       /* Is it `$$'? */
1418       if (*env == '$')
1419         {
1420           buffer[20] = '\0';
1421           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1422         }
1423       /* Is it `${#*}' or `${#@}'? */
1424       else if ((*env == '*' || *env == '@') && seen_hash)
1425         {
1426           buffer[20] = '\0';
1427           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1428                               &buffer[20], 10, 0);
1429           *word = w_addstr (*word, word_length, max_length, value);
1430           free (env);
1431           free (pattern);
1432           return *word ? 0 : WRDE_NOSPACE;
1433         }
1434       /* Is it `$*' or `$@' (unquoted) ? */
1435       else if (*env == '*' || (*env == '@' && !quoted))
1436         {
1437           size_t plist_len = 0;
1438           int p;
1439           char *end;
1440
1441           /* Build up value parameter by parameter (copy them) */
1442           for (p = 1; __libc_argv[p]; ++p)
1443             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1444           value = malloc (plist_len);
1445           if (value == NULL)
1446             goto no_space;
1447           end = value;
1448           *end = 0;
1449           for (p = 1; __libc_argv[p]; ++p)
1450             {
1451               if (p > 1)
1452                 *end++ = ' ';
1453               end = __stpcpy (end, __libc_argv[p]);
1454             }
1455
1456           free_value = 1;
1457         }
1458       else
1459         {
1460           /* Must be a quoted `$@' */
1461           assert (*env == '@' && quoted);
1462
1463           /* Each parameter is a separate word ("$@") */
1464           if (__libc_argc == 2)
1465             value = __libc_argv[1];
1466           else if (__libc_argc > 2)
1467             {
1468               int p;
1469
1470               /* Append first parameter to current word. */
1471               value = w_addstr (*word, word_length, max_length,
1472                                 __libc_argv[1]);
1473               if (value == NULL || w_addword (pwordexp, value))
1474                 goto no_space;
1475
1476               for (p = 2; __libc_argv[p + 1]; p++)
1477                 {
1478                   char *newword = __strdup (__libc_argv[p]);
1479                   if (newword == NULL || w_addword (pwordexp, newword))
1480                     goto no_space;
1481                 }
1482
1483               /* Start a new word with the last parameter. */
1484               *word = w_newword (word_length, max_length);
1485               value = __libc_argv[p];
1486             }
1487           else
1488             {
1489               free (env);
1490               free (pattern);
1491               return 0;
1492             }
1493         }
1494     }
1495   else
1496     value = getenv (env);
1497
1498   if (value == NULL && (flags & WRDE_UNDEF))
1499     {
1500       /* Variable not defined. */
1501       error = WRDE_BADVAL;
1502       goto do_error;
1503     }
1504
1505   if (action != ACT_NONE)
1506     {
1507       int expand_pattern = 0;
1508
1509       /* First, find out if we need to expand pattern (i.e. if we will
1510        * use it). */
1511       switch (action)
1512         {
1513         case ACT_RP_SHORT_LEFT:
1514         case ACT_RP_LONG_LEFT:
1515         case ACT_RP_SHORT_RIGHT:
1516         case ACT_RP_LONG_RIGHT:
1517           /* Always expand for these. */
1518           expand_pattern = 1;
1519           break;
1520
1521         case ACT_NULL_ERROR:
1522         case ACT_NULL_SUBST:
1523         case ACT_NULL_ASSIGN:
1524           if (!value || (!*value && colon_seen))
1525             /* If param is unset, or set but null and a colon has been seen,
1526                the expansion of the pattern will be needed. */
1527             expand_pattern = 1;
1528
1529           break;
1530
1531         case ACT_NONNULL_SUBST:
1532           /* Expansion of word will be needed if parameter is set and not null,
1533              or set null but no colon has been seen. */
1534           if (value && (*value || !colon_seen))
1535             expand_pattern = 1;
1536
1537           break;
1538
1539         default:
1540           assert (! "Unrecognised action!");
1541         }
1542
1543       if (expand_pattern)
1544         {
1545           /* We need to perform tilde expansion, parameter expansion,
1546              command substitution, and arithmetic expansion.  We also
1547              have to be a bit careful with wildcard characters, as
1548              pattern might be given to fnmatch soon.  To do this, we
1549              convert quotes to escapes. */
1550
1551           char *expanded;
1552           size_t exp_len;
1553           size_t exp_maxl;
1554           char *p;
1555           int quoted = 0; /* 1: single quotes; 2: double */
1556
1557           expanded = w_newword (&exp_len, &exp_maxl);
1558           for (p = pattern; p && *p; p++)
1559             {
1560               size_t offset;
1561
1562               switch (*p)
1563                 {
1564                 case '"':
1565                   if (quoted == 2)
1566                     quoted = 0;
1567                   else if (quoted == 0)
1568                     quoted = 2;
1569                   else break;
1570
1571                   continue;
1572
1573                 case '\'':
1574                   if (quoted == 1)
1575                     quoted = 0;
1576                   else if (quoted == 0)
1577                     quoted = 1;
1578                   else break;
1579
1580                   continue;
1581
1582                 case '*':
1583                 case '?':
1584                   if (quoted)
1585                     {
1586                       /* Convert quoted wildchar to escaped wildchar. */
1587                       expanded = w_addchar (expanded, &exp_len,
1588                                             &exp_maxl, '\\');
1589
1590                       if (expanded == NULL)
1591                         goto no_space;
1592                     }
1593                   break;
1594
1595                 case '$':
1596                   offset = 0;
1597                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1598                                          &offset, flags, NULL, NULL, NULL, 1);
1599                   if (error)
1600                     {
1601                       if (free_value)
1602                         free (value);
1603
1604                       free (expanded);
1605
1606                       goto do_error;
1607                     }
1608
1609                   p += offset;
1610                   continue;
1611
1612                 case '~':
1613                   if (quoted || exp_len)
1614                     break;
1615
1616                   offset = 0;
1617                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1618                                        &offset, 0);
1619                   if (error)
1620                     {
1621                       if (free_value)
1622                         free (value);
1623
1624                       free (expanded);
1625
1626                       goto do_error;
1627                     }
1628
1629                   p += offset;
1630                   continue;
1631
1632                 case '\\':
1633                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1634                   ++p;
1635                   assert (*p); /* checked when extracted initially */
1636                   if (expanded == NULL)
1637                     goto no_space;
1638                 }
1639
1640               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1641
1642               if (expanded == NULL)
1643                 goto no_space;
1644             }
1645
1646           free (pattern);
1647
1648           pattern = expanded;
1649         }
1650
1651       switch (action)
1652         {
1653         case ACT_RP_SHORT_LEFT:
1654         case ACT_RP_LONG_LEFT:
1655         case ACT_RP_SHORT_RIGHT:
1656         case ACT_RP_LONG_RIGHT:
1657           {
1658             char *p;
1659             char c;
1660             char *end;
1661
1662             if (value == NULL || pattern == NULL || *pattern == '\0')
1663               break;
1664
1665             end = value + strlen (value);
1666
1667             switch (action)
1668               {
1669               case ACT_RP_SHORT_LEFT:
1670                 for (p = value; p <= end; ++p)
1671                   {
1672                     c = *p;
1673                     *p = '\0';
1674                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1675                       {
1676                         *p = c;
1677                         if (free_value)
1678                           {
1679                             char *newval = __strdup (p);
1680                             if (newval == NULL)
1681                               {
1682                                 free (value);
1683                                 goto no_space;
1684                               }
1685                             free (value);
1686                             value = newval;
1687                           }
1688                         else
1689                           value = p;
1690                         break;
1691                       }
1692                     *p = c;
1693                   }
1694
1695                 break;
1696
1697               case ACT_RP_LONG_LEFT:
1698                 for (p = end; p >= value; --p)
1699                   {
1700                     c = *p;
1701                     *p = '\0';
1702                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1703                       {
1704                         *p = c;
1705                         if (free_value)
1706                           {
1707                             char *newval = __strdup (p);
1708                             if (newval == NULL)
1709                               {
1710                                 free (value);
1711                                 goto no_space;
1712                               }
1713                             free (value);
1714                             value = newval;
1715                           }
1716                         else
1717                           value = p;
1718                         break;
1719                       }
1720                     *p = c;
1721                   }
1722
1723                 break;
1724
1725               case ACT_RP_SHORT_RIGHT:
1726                 for (p = end; p >= value; --p)
1727                   {
1728                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1729                       {
1730                         char *newval;
1731                         newval = malloc (p - value + 1);
1732
1733                         if (newval == NULL)
1734                           {
1735                             if (free_value)
1736                               free (value);
1737                             goto no_space;
1738                           }
1739
1740                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1741                         if (free_value)
1742                           free (value);
1743                         value = newval;
1744                         free_value = 1;
1745                         break;
1746                       }
1747                   }
1748
1749                 break;
1750
1751               case ACT_RP_LONG_RIGHT:
1752                 for (p = value; p <= end; ++p)
1753                   {
1754                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1755                       {
1756                         char *newval;
1757                         newval = malloc (p - value + 1);
1758
1759                         if (newval == NULL)
1760                           {
1761                             if (free_value)
1762                               free (value);
1763                             goto no_space;
1764                           }
1765
1766                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1767                         if (free_value)
1768                           free (value);
1769                         value = newval;
1770                         free_value = 1;
1771                         break;
1772                       }
1773                   }
1774
1775                 break;
1776
1777               default:
1778                 break;
1779               }
1780
1781             break;
1782           }
1783
1784         case ACT_NULL_ERROR:
1785           if (value && *value)
1786             /* Substitute parameter */
1787             break;
1788
1789           error = 0;
1790           if (!colon_seen && value)
1791             /* Substitute NULL */
1792             ;
1793           else
1794             {
1795               const char *str = pattern;
1796
1797               if (str[0] == '\0')
1798                 str = _("parameter null or not set");
1799
1800               __fxprintf (NULL, "%s: %s\n", env, str);
1801             }
1802
1803           if (free_value)
1804             free (value);
1805           goto do_error;
1806
1807         case ACT_NULL_SUBST:
1808           if (value && *value)
1809             /* Substitute parameter */
1810             break;
1811
1812           if (free_value && value)
1813             free (value);
1814
1815           if (!colon_seen && value)
1816             /* Substitute NULL */
1817             goto success;
1818
1819           value = pattern ? __strdup (pattern) : pattern;
1820           free_value = 1;
1821
1822           if (pattern && !value)
1823             goto no_space;
1824
1825           break;
1826
1827         case ACT_NONNULL_SUBST:
1828           if (value && (*value || !colon_seen))
1829             {
1830               if (free_value && value)
1831                 free (value);
1832
1833               value = pattern ? __strdup (pattern) : pattern;
1834               free_value = 1;
1835
1836               if (pattern && !value)
1837                 goto no_space;
1838
1839               break;
1840             }
1841
1842           /* Substitute NULL */
1843           if (free_value)
1844             free (value);
1845           goto success;
1846
1847         case ACT_NULL_ASSIGN:
1848           if (value && *value)
1849             /* Substitute parameter */
1850             break;
1851
1852           if (!colon_seen && value)
1853             {
1854               /* Substitute NULL */
1855               if (free_value)
1856                 free (value);
1857               goto success;
1858             }
1859
1860           if (free_value)
1861             free (value);
1862
1863           value = pattern ? __strdup (pattern) : pattern;
1864           free_value = 1;
1865
1866           if (pattern && !value)
1867             goto no_space;
1868
1869           __setenv (env, value, 1);
1870           break;
1871
1872         default:
1873           assert (! "Unrecognised action!");
1874         }
1875     }
1876
1877   free (env);
1878   env = NULL;
1879   free (pattern);
1880   pattern = NULL;
1881
1882   if (seen_hash)
1883     {
1884       char param_length[21];
1885       param_length[20] = '\0';
1886       *word = w_addstr (*word, word_length, max_length,
1887                         _itoa_word (value ? strlen (value) : 0,
1888                                     &param_length[20], 10, 0));
1889       if (free_value)
1890         {
1891           assert (value != NULL);
1892           free (value);
1893         }
1894
1895       return *word ? 0 : WRDE_NOSPACE;
1896     }
1897
1898   if (value == NULL)
1899     return 0;
1900
1901   if (quoted || !pwordexp)
1902     {
1903       /* Quoted - no field split */
1904       *word = w_addstr (*word, word_length, max_length, value);
1905       if (free_value)
1906         free (value);
1907
1908       return *word ? 0 : WRDE_NOSPACE;
1909     }
1910   else
1911     {
1912       /* Need to field-split */
1913       char *value_copy = __strdup (value); /* Don't modify value */
1914       char *field_begin = value_copy;
1915       int seen_nonws_ifs = 0;
1916
1917       if (free_value)
1918         free (value);
1919
1920       if (value_copy == NULL)
1921         goto no_space;
1922
1923       do
1924         {
1925           char *field_end = field_begin;
1926           char *next_field;
1927
1928           /* If this isn't the first field, start a new word */
1929           if (field_begin != value_copy)
1930             {
1931               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1932                 {
1933                   free (value_copy);
1934                   goto no_space;
1935                 }
1936
1937               *word = w_newword (word_length, max_length);
1938             }
1939
1940           /* Skip IFS whitespace before the field */
1941           field_begin += strspn (field_begin, ifs_white);
1942
1943           if (!seen_nonws_ifs && *field_begin == 0)
1944             /* Nothing but whitespace */
1945             break;
1946
1947           /* Search for the end of the field */
1948           field_end = field_begin + strcspn (field_begin, ifs);
1949
1950           /* Set up pointer to the character after end of field and
1951              skip whitespace IFS after it. */
1952           next_field = field_end + strspn (field_end, ifs_white);
1953
1954           /* Skip at most one non-whitespace IFS character after the field */
1955           seen_nonws_ifs = 0;
1956           if (*next_field && strchr (ifs, *next_field))
1957             {
1958               seen_nonws_ifs = 1;
1959               next_field++;
1960             }
1961
1962           /* Null-terminate it */
1963           *field_end = 0;
1964
1965           /* Tag a copy onto the current word */
1966           *word = w_addstr (*word, word_length, max_length, field_begin);
1967
1968           if (*word == NULL && *field_begin != '\0')
1969             {
1970               free (value_copy);
1971               goto no_space;
1972             }
1973
1974           field_begin = next_field;
1975         }
1976       while (seen_nonws_ifs || *field_begin);
1977
1978       free (value_copy);
1979     }
1980
1981   return 0;
1982
1983 success:
1984   error = 0;
1985   goto do_error;
1986
1987 no_space:
1988   error = WRDE_NOSPACE;
1989   goto do_error;
1990
1991 syntax:
1992   error = WRDE_SYNTAX;
1993
1994 do_error:
1995   free (env);
1996
1997   free (pattern);
1998
1999   return error;
2000 }
2001
2002 static int
2003 internal_function
2004 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2005                const char *words, size_t *offset, int flags,
2006                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2007                int quoted)
2008 {
2009   /* We are poised _at_ "$" */
2010   switch (words[1 + *offset])
2011     {
2012     case '"':
2013     case '\'':
2014     case 0:
2015       *word = w_addchar (*word, word_length, max_length, '$');
2016       return *word ? 0 : WRDE_NOSPACE;
2017
2018     case '(':
2019       if (words[2 + *offset] == '(')
2020         {
2021           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2022           int i = 3 + *offset;
2023           int depth = 0;
2024           while (words[i] && !(depth == 0 && words[i] == ')'))
2025             {
2026               if (words[i] == '(')
2027                 ++depth;
2028               else if (words[i] == ')')
2029                 --depth;
2030
2031               ++i;
2032             }
2033
2034           if (words[i] == ')' && words[i + 1] == ')')
2035             {
2036               (*offset) += 3;
2037               /* Call parse_arith -- 0 is for "no brackets" */
2038               return parse_arith (word, word_length, max_length, words, offset,
2039                                   flags, 0);
2040             }
2041         }
2042
2043       if (flags & WRDE_NOCMD)
2044         return WRDE_CMDSUB;
2045
2046       (*offset) += 2;
2047       return parse_comm (word, word_length, max_length, words, offset, flags,
2048                          quoted? NULL : pwordexp, ifs, ifs_white);
2049
2050     case '[':
2051       (*offset) += 2;
2052       /* Call parse_arith -- 1 is for "brackets" */
2053       return parse_arith (word, word_length, max_length, words, offset, flags,
2054                           1);
2055
2056     case '{':
2057     default:
2058       ++(*offset);      /* parse_param needs to know if "{" is there */
2059       return parse_param (word, word_length, max_length, words, offset, flags,
2060                            pwordexp, ifs, ifs_white, quoted);
2061     }
2062 }
2063
2064 static int
2065 internal_function
2066 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2067                 const char *words, size_t *offset, int flags,
2068                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2069 {
2070   /* We are poised just after "`" */
2071   int error;
2072   int squoting = 0;
2073   size_t comm_length;
2074   size_t comm_maxlen;
2075   char *comm = w_newword (&comm_length, &comm_maxlen);
2076
2077   for (; words[*offset]; ++(*offset))
2078     {
2079       switch (words[*offset])
2080         {
2081         case '`':
2082           /* Go -- give the script to the shell */
2083           error = exec_comm (comm, word, word_length, max_length, flags,
2084                              pwordexp, ifs, ifs_white);
2085           free (comm);
2086           return error;
2087
2088         case '\\':
2089           if (squoting)
2090             {
2091               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2092                                            words, offset);
2093
2094               if (error)
2095                 {
2096                   free (comm);
2097                   return error;
2098                 }
2099
2100               break;
2101             }
2102
2103           ++(*offset);
2104           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2105                                    offset);
2106
2107           if (error)
2108             {
2109               free (comm);
2110               return error;
2111             }
2112
2113           break;
2114
2115         case '\'':
2116           squoting = 1 - squoting;
2117         default:
2118           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2119           if (comm == NULL)
2120             return WRDE_NOSPACE;
2121         }
2122     }
2123
2124   /* Premature end */
2125   free (comm);
2126   return WRDE_SYNTAX;
2127 }
2128
2129 static int
2130 internal_function
2131 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2132               const char *words, size_t *offset, int flags,
2133               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2134 {
2135   /* We are poised just after a double-quote */
2136   int error;
2137
2138   for (; words[*offset]; ++(*offset))
2139     {
2140       switch (words[*offset])
2141         {
2142         case '"':
2143           return 0;
2144
2145         case '$':
2146           error = parse_dollars (word, word_length, max_length, words, offset,
2147                                  flags, pwordexp, ifs, ifs_white, 1);
2148           /* The ``1'' here is to tell parse_dollars not to
2149            * split the fields.  It may need to, however ("$@").
2150            */
2151           if (error)
2152             return error;
2153
2154           break;
2155
2156         case '`':
2157           if (flags & WRDE_NOCMD)
2158             return WRDE_CMDSUB;
2159
2160           ++(*offset);
2161           error = parse_backtick (word, word_length, max_length, words,
2162                                   offset, flags, NULL, NULL, NULL);
2163           /* The first NULL here is to tell parse_backtick not to
2164            * split the fields.
2165            */
2166           if (error)
2167             return error;
2168
2169           break;
2170
2171         case '\\':
2172           error = parse_qtd_backslash (word, word_length, max_length, words,
2173                                        offset);
2174
2175           if (error)
2176             return error;
2177
2178           break;
2179
2180         default:
2181           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2182           if (*word == NULL)
2183             return WRDE_NOSPACE;
2184         }
2185     }
2186
2187   /* Unterminated string */
2188   return WRDE_SYNTAX;
2189 }
2190
2191 /*
2192  * wordfree() is to be called after pwordexp is finished with.
2193  */
2194
2195 void
2196 wordfree (wordexp_t *pwordexp)
2197 {
2198
2199   /* wordexp can set pwordexp to NULL */
2200   if (pwordexp && pwordexp->we_wordv)
2201     {
2202       char **wordv = pwordexp->we_wordv;
2203
2204       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2205         free (*wordv);
2206
2207       free (pwordexp->we_wordv);
2208       pwordexp->we_wordv = NULL;
2209     }
2210 }
2211 libc_hidden_def (wordfree)
2212
2213 /*
2214  * wordexp()
2215  */
2216
2217 int
2218 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2219 {
2220   size_t words_offset;
2221   size_t word_length;
2222   size_t max_length;
2223   char *word = w_newword (&word_length, &max_length);
2224   int error;
2225   char *ifs;
2226   char ifs_white[4];
2227   wordexp_t old_word = *pwordexp;
2228
2229   if (flags & WRDE_REUSE)
2230     {
2231       /* Minimal implementation of WRDE_REUSE for now */
2232       wordfree (pwordexp);
2233       old_word.we_wordv = NULL;
2234     }
2235
2236   if ((flags & WRDE_APPEND) == 0)
2237     {
2238       pwordexp->we_wordc = 0;
2239
2240       if (flags & WRDE_DOOFFS)
2241         {
2242           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2243           if (pwordexp->we_wordv == NULL)
2244             {
2245               error = WRDE_NOSPACE;
2246               goto do_error;
2247             }
2248         }
2249       else
2250         {
2251           pwordexp->we_wordv = calloc (1, sizeof (char *));
2252           if (pwordexp->we_wordv == NULL)
2253             {
2254               error = WRDE_NOSPACE;
2255               goto do_error;
2256             }
2257
2258           pwordexp->we_offs = 0;
2259         }
2260     }
2261
2262   /* Find out what the field separators are.
2263    * There are two types: whitespace and non-whitespace.
2264    */
2265   ifs = getenv ("IFS");
2266
2267   if (ifs == NULL)
2268     /* IFS unset - use <space><tab><newline>. */
2269     ifs = strcpy (ifs_white, " \t\n");
2270   else
2271     {
2272       char *ifsch = ifs;
2273       char *whch = ifs_white;
2274
2275       while (*ifsch != '\0')
2276         {
2277           if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2278             {
2279               /* Whitespace IFS.  See first whether it is already in our
2280                  collection.  */
2281               char *runp = ifs_white;
2282
2283               while (runp < whch && *runp != *ifsch)
2284                 ++runp;
2285
2286               if (runp == whch)
2287                 *whch++ = *ifsch;
2288             }
2289
2290           ++ifsch;
2291         }
2292       *whch = '\0';
2293     }
2294
2295   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2296     switch (words[words_offset])
2297       {
2298       case '\\':
2299         error = parse_backslash (&word, &word_length, &max_length, words,
2300                                  &words_offset);
2301
2302         if (error)
2303           goto do_error;
2304
2305         break;
2306
2307       case '$':
2308         error = parse_dollars (&word, &word_length, &max_length, words,
2309                                &words_offset, flags, pwordexp, ifs, ifs_white,
2310                                0);
2311
2312         if (error)
2313           goto do_error;
2314
2315         break;
2316
2317       case '`':
2318         if (flags & WRDE_NOCMD)
2319           {
2320             error = WRDE_CMDSUB;
2321             goto do_error;
2322           }
2323
2324         ++words_offset;
2325         error = parse_backtick (&word, &word_length, &max_length, words,
2326                                 &words_offset, flags, pwordexp, ifs,
2327                                 ifs_white);
2328
2329         if (error)
2330           goto do_error;
2331
2332         break;
2333
2334       case '"':
2335         ++words_offset;
2336         error = parse_dquote (&word, &word_length, &max_length, words,
2337                               &words_offset, flags, pwordexp, ifs, ifs_white);
2338
2339         if (error)
2340           goto do_error;
2341
2342         if (!word_length)
2343           {
2344             error = w_addword (pwordexp, NULL);
2345
2346             if (error)
2347               return error;
2348           }
2349
2350         break;
2351
2352       case '\'':
2353         ++words_offset;
2354         error = parse_squote (&word, &word_length, &max_length, words,
2355                               &words_offset);
2356
2357         if (error)
2358           goto do_error;
2359
2360         if (!word_length)
2361           {
2362             error = w_addword (pwordexp, NULL);
2363
2364             if (error)
2365               return error;
2366           }
2367
2368         break;
2369
2370       case '~':
2371         error = parse_tilde (&word, &word_length, &max_length, words,
2372                              &words_offset, pwordexp->we_wordc);
2373
2374         if (error)
2375           goto do_error;
2376
2377         break;
2378
2379       case '*':
2380       case '[':
2381       case '?':
2382         error = parse_glob (&word, &word_length, &max_length, words,
2383                             &words_offset, flags, pwordexp, ifs, ifs_white);
2384
2385         if (error)
2386           goto do_error;
2387
2388         break;
2389
2390       default:
2391         /* Is it a word separator? */
2392         if (strchr (" \t", words[words_offset]) == NULL)
2393           {
2394             char ch = words[words_offset];
2395
2396             /* Not a word separator -- but is it a valid word char? */
2397             if (strchr ("\n|&;<>(){}", ch))
2398               {
2399                 /* Fail */
2400                 error = WRDE_BADCHAR;
2401                 goto do_error;
2402               }
2403
2404             /* "Ordinary" character -- add it to word */
2405             word = w_addchar (word, &word_length, &max_length,
2406                               ch);
2407             if (word == NULL)
2408               {
2409                 error = WRDE_NOSPACE;
2410                 goto do_error;
2411               }
2412
2413             break;
2414           }
2415
2416         /* If a word has been delimited, add it to the list. */
2417         if (word != NULL)
2418           {
2419             error = w_addword (pwordexp, word);
2420             if (error)
2421               goto do_error;
2422           }
2423
2424         word = w_newword (&word_length, &max_length);
2425       }
2426
2427   /* End of string */
2428
2429   /* There was a word separator at the end */
2430   if (word == NULL) /* i.e. w_newword */
2431     return 0;
2432
2433   /* There was no field separator at the end */
2434   return w_addword (pwordexp, word);
2435
2436 do_error:
2437   /* Error:
2438    *    free memory used (unless error is WRDE_NOSPACE), and
2439    *    set pwordexp members back to what they were.
2440    */
2441
2442   free (word);
2443
2444   if (error == WRDE_NOSPACE)
2445     return WRDE_NOSPACE;
2446
2447   if ((flags & WRDE_APPEND) == 0)
2448     wordfree (pwordexp);
2449
2450   *pwordexp = old_word;
2451   return error;
2452 }