posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2023 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <https://www.gnu.org/licenses/>.  */
  18
  19 #include <ctype.h>
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <fnmatch.h>
  23 #include <glob.h>
  24 #include <libintl.h>
  25 #include <paths.h>
  26 #include <pwd.h>
  27 #include <stdbool.h>
  28 #include <stdio.h>
  29 #include <string.h>
  30 #include <sys/param.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <wordexp.h>
  34 #include <spawn.h>
  35 #include <scratch_buffer.h>
  36 #include <_itoa.h>
  37 #include <assert.h>
  38
  39 /*
  40  * This is a recursive-descent-style word expansion routine.
  41  */
  42
  43 /* These variables are defined and initialized in the startup code.  */
  44 extern int __libc_argc attribute_hidden;
  45 extern char **__libc_argv attribute_hidden;
  46
  47 /* Some forward declarations */
  48 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  49                           const char *words, size_t *offset, int flags,
  50                           wordexp_t *pwordexp, const char *ifs,
  51                           const char *ifs_white, int quoted);
  52 static int parse_backtick (char **word, size_t *word_length,
  53                            size_t *max_length, const char *words,
  54                            size_t *offset, int flags, wordexp_t *pwordexp,
  55                            const char *ifs, const char *ifs_white);
  56 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  57                          const char *words, size_t *offset, int flags,
  58                          wordexp_t *pwordexp, const char *ifs,
  59                          const char *ifs_white);
  60 static int eval_expr (char *expr, long int *result);
  61
  62 /* The w_*() functions manipulate word lists. */
  63
  64 #define W_CHUNK (100)
  65
  66 /* Result of w_newword will be ignored if it's the last word. */
  67 static inline char *
  68 w_newword (size_t *actlen, size_t *maxlen)
  69 {
  70   *actlen = *maxlen = 0;
  71   return NULL;
  72 }
  73
  74 static char *
  75 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  76      /* (lengths exclude trailing zero) */
  77 {
  78   /* Add a character to the buffer, allocating room for it if needed.  */
  79
  80   if (*actlen == *maxlen)
  81     {
  82       char *old_buffer = buffer;
  83       assert (buffer == NULL || *maxlen != 0);
  84       *maxlen += W_CHUNK;
  85       buffer = (char *) realloc (buffer, 1 + *maxlen);
  86
  87       if (buffer == NULL)
  88         free (old_buffer);
  89     }
  90
  91   if (buffer != NULL)
  92     {
  93       buffer[*actlen] = ch;
  94       buffer[++(*actlen)] = '\0';
  95     }
  96
  97   return buffer;
  98 }
  99
 100 static char *
 101 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 102           size_t len)
 103 {
 104   /* Add a string to the buffer, allocating room for it if needed.
 105    */
 106   if (*actlen + len > *maxlen)
 107     {
 108       char *old_buffer = buffer;
 109       assert (buffer == NULL || *maxlen != 0);
 110       *maxlen += MAX (2 * len, W_CHUNK);
 111       buffer = realloc (old_buffer, 1 + *maxlen);
 112
 113       if (buffer == NULL)
 114         free (old_buffer);
 115     }
 116
 117   if (buffer != NULL)
 118     {
 119       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 120       *actlen += len;
 121     }
 122
 123   return buffer;
 124 }
 125
 126 static char *
 127 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 128      /* (lengths exclude trailing zero) */
 129 {
 130   /* Add a string to the buffer, allocating room for it if needed.
 131    */
 132   size_t len;
 133
 134   assert (str != NULL); /* w_addstr only called from this file */
 135   len = strlen (str);
 136
 137   return w_addmem (buffer, actlen, maxlen, str, len);
 138 }
 139
 140 static int
 141 w_addword (wordexp_t *pwordexp, char *word)
 142 {
 143   /* Add a word to the wordlist */
 144   size_t num_p;
 145   char **new_wordv;
 146   bool allocated = false;
 147
 148   /* Internally, NULL acts like "".  Convert NULLs to "" before
 149    * the caller sees them.
 150    */
 151   if (word == NULL)
 152     {
 153       word = __strdup ("");
 154       if (word == NULL)
 155         goto no_space;
 156       allocated = true;
 157     }
 158
 159   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 160   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 161   if (new_wordv != NULL)
 162     {
 163       pwordexp->we_wordv = new_wordv;
 164       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 165       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 166       return 0;
 167     }
 168
 169   if (allocated)
 170     free (word);
 171
 172 no_space:
 173   return WRDE_NOSPACE;
 174 }
 175
 176 /* The parse_*() functions should leave *offset being the offset in 'words'
 177  * to the last character processed.
 178  */
 179
 180 static int
 181 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 182                  const char *words, size_t *offset)
 183 {
 184   /* We are poised _at_ a backslash, not in quotes */
 185
 186   switch (words[1 + *offset])
 187     {
 188     case 0:
 189       /* Backslash is last character of input words */
 190       return WRDE_SYNTAX;
 191
 192     case '\n':
 193       ++(*offset);
 194       break;
 195
 196     default:
 197       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 198       if (*word == NULL)
 199         return WRDE_NOSPACE;
 200
 201       ++(*offset);
 202       break;
 203     }
 204
 205   return 0;
 206 }
 207
 208 static int
 209 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 210                      const char *words, size_t *offset)
 211 {
 212   /* We are poised _at_ a backslash, inside quotes */
 213
 214   switch (words[1 + *offset])
 215     {
 216     case 0:
 217       /* Backslash is last character of input words */
 218       return WRDE_SYNTAX;
 219
 220     case '\n':
 221       ++(*offset);
 222       break;
 223
 224     case '$':
 225     case '`':
 226     case '"':
 227     case '\\':
 228       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 229       if (*word == NULL)
 230         return WRDE_NOSPACE;
 231
 232       ++(*offset);
 233       break;
 234
 235     default:
 236       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 237       if (*word != NULL)
 238         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 239
 240       if (*word == NULL)
 241         return WRDE_NOSPACE;
 242
 243       ++(*offset);
 244       break;
 245     }
 246
 247   return 0;
 248 }
 249
 250 static int
 251 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 252              const char *words, size_t *offset, size_t wordc)
 253 {
 254   /* We are poised _at_ a tilde */
 255   size_t i;
 256
 257   if (*word_length != 0)
 258     {
 259       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 260         {
 261           if (!((*word)[*word_length - 1] == ':'
 262                 && strchr (*word, '=') && wordc == 0))
 263             {
 264               *word = w_addchar (*word, word_length, max_length, '~');
 265               return *word ? 0 : WRDE_NOSPACE;
 266             }
 267         }
 268     }
 269
 270   for (i = 1 + *offset; words[i]; i++)
 271     {
 272       if (words[i] == ':' || words[i] == '/' || words[i] == ' '
 273           || words[i] == '\t' || words[i] == 0 )
 274         break;
 275
 276       if (words[i] == '\\')
 277         {
 278           *word = w_addchar (*word, word_length, max_length, '~');
 279           return *word ? 0 : WRDE_NOSPACE;
 280         }
 281     }
 282
 283   if (i == 1 + *offset)
 284     {
 285       /* Tilde appears on its own */
 286       char* home;
 287
 288       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 289          results are unspecified.  We do a lookup on the uid if
 290          HOME is unset. */
 291
 292       home = getenv ("HOME");
 293       if (home != NULL)
 294         {
 295           *word = w_addstr (*word, word_length, max_length, home);
 296           if (*word == NULL)
 297             return WRDE_NOSPACE;
 298         }
 299       else
 300         {
 301           struct passwd pwd, *tpwd;
 302           uid_t uid = __getuid ();
 303           int result;
 304           struct scratch_buffer tmpbuf;
 305           scratch_buffer_init (&tmpbuf);
 306
 307           while ((result = __getpwuid_r (uid, &pwd,
 308                                          tmpbuf.data, tmpbuf.length,
 309                                          &tpwd)) != 0
 310                  && errno == ERANGE)
 311             if (!scratch_buffer_grow (&tmpbuf))
 312               return WRDE_NOSPACE;
 313
 314           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 315             {
 316               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 317               if (*word == NULL)
 318                 {
 319                   scratch_buffer_free (&tmpbuf);
 320                   return WRDE_NOSPACE;
 321                 }
 322             }
 323           else
 324             {
 325               *word = w_addchar (*word, word_length, max_length, '~');
 326               if (*word == NULL)
 327                 {
 328                   scratch_buffer_free (&tmpbuf);
 329                   return WRDE_NOSPACE;
 330                 }
 331             }
 332           scratch_buffer_free (&tmpbuf);
 333         }
 334     }
 335   else
 336     {
 337       /* Look up user name in database to get home directory */
 338       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 339       struct passwd pwd, *tpwd;
 340       int result;
 341       struct scratch_buffer tmpbuf;
 342       scratch_buffer_init (&tmpbuf);
 343
 344       while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length,
 345                                      &tpwd)) != 0
 346              && errno == ERANGE)
 347         if (!scratch_buffer_grow (&tmpbuf))
 348           return WRDE_NOSPACE;
 349
 350       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 351         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 352       else
 353         {
 354           /* (invalid login name) */
 355           *word = w_addchar (*word, word_length, max_length, '~');
 356           if (*word != NULL)
 357             *word = w_addstr (*word, word_length, max_length, user);
 358         }
 359
 360       scratch_buffer_free (&tmpbuf);
 361
 362       *offset = i - 1;
 363     }
 364   return *word ? 0 : WRDE_NOSPACE;
 365 }
 366
 367
 368 static int
 369 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 370                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 371                const char *ifs_white)
 372 {
 373   int error;
 374   unsigned int match;
 375   glob_t globbuf;
 376
 377   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 378
 379   if (error != 0)
 380     {
 381       /* We can only run into memory problems.  */
 382       assert (error == GLOB_NOSPACE);
 383       return WRDE_NOSPACE;
 384     }
 385
 386   if (ifs && !*ifs)
 387     {
 388       /* No field splitting allowed. */
 389       assert (globbuf.gl_pathv[0] != NULL);
 390       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 391       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 392         {
 393           *word = w_addchar (*word, word_length, max_length, ' ');
 394           if (*word != NULL)
 395             *word = w_addstr (*word, word_length, max_length,
 396                               globbuf.gl_pathv[match]);
 397         }
 398
 399       globfree (&globbuf);
 400       return *word ? 0 : WRDE_NOSPACE;
 401     }
 402
 403   assert (ifs == NULL || *ifs != '\0');
 404   if (*word != NULL)
 405     {
 406       free (*word);
 407       *word = w_newword (word_length, max_length);
 408     }
 409
 410   for (match = 0; match < globbuf.gl_pathc; ++match)
 411     {
 412       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 413       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 414         {
 415           globfree (&globbuf);
 416           return WRDE_NOSPACE;
 417         }
 418     }
 419
 420   globfree (&globbuf);
 421   return 0;
 422 }
 423
 424 static int
 425 parse_glob (char **word, size_t *word_length, size_t *max_length,
 426             const char *words, size_t *offset, int flags,
 427             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 428 {
 429   /* We are poised just after a '*', a '[' or a '?'. */
 430   int error = WRDE_NOSPACE;
 431   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 432   size_t i;
 433   wordexp_t glob_list; /* List of words to glob */
 434
 435   glob_list.we_wordc = 0;
 436   glob_list.we_wordv = NULL;
 437   glob_list.we_offs = 0;
 438   for (; words[*offset] != '\0'; ++*offset)
 439     {
 440       if (strchr (ifs, words[*offset]) != NULL)
 441         /* Reached IFS */
 442         break;
 443
 444       /* Sort out quoting */
 445       if (words[*offset] == '\'')
 446         {
 447           if (quoted == 0)
 448             {
 449               quoted = 1;
 450               continue;
 451             }
 452           else if (quoted == 1)
 453             {
 454               quoted = 0;
 455               continue;
 456             }
 457         }
 458       else if (words[*offset] == '"')
 459         {
 460           if (quoted == 0)
 461             {
 462               quoted = 2;
 463               continue;
 464             }
 465           else if (quoted == 2)
 466             {
 467               quoted = 0;
 468               continue;
 469             }
 470         }
 471
 472       /* Sort out other special characters */
 473       if (quoted != 1 && words[*offset] == '$')
 474         {
 475           error = parse_dollars (word, word_length, max_length, words,
 476                                  offset, flags, &glob_list, ifs, ifs_white,
 477                                  quoted == 2);
 478           if (error)
 479             goto tidy_up;
 480
 481           continue;
 482         }
 483       else if (words[*offset] == '\\')
 484         {
 485           if (quoted)
 486             error = parse_qtd_backslash (word, word_length, max_length,
 487                                          words, offset);
 488           else
 489             error = parse_backslash (word, word_length, max_length,
 490                                      words, offset);
 491
 492           if (error)
 493             goto tidy_up;
 494
 495           continue;
 496         }
 497
 498       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 499       if (*word == NULL)
 500         goto tidy_up;
 501     }
 502
 503   /* Don't forget to re-parse the character we stopped at. */
 504   --*offset;
 505
 506   /* Glob the words */
 507   error = w_addword (&glob_list, *word);
 508   *word = w_newword (word_length, max_length);
 509   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 510     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 511                            max_length, pwordexp, ifs, ifs_white);
 512
 513   /* Now tidy up */
 514 tidy_up:
 515   wordfree (&glob_list);
 516   return error;
 517 }
 518
 519 static int
 520 parse_squote (char **word, size_t *word_length, size_t *max_length,
 521               const char *words, size_t *offset)
 522 {
 523   /* We are poised just after a single quote */
 524   for (; words[*offset]; ++(*offset))
 525     {
 526       if (words[*offset] != '\'')
 527         {
 528           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 529           if (*word == NULL)
 530             return WRDE_NOSPACE;
 531         }
 532       else return 0;
 533     }
 534
 535   /* Unterminated string */
 536   return WRDE_SYNTAX;
 537 }
 538
 539 /* Functions to evaluate an arithmetic expression */
 540 static int
 541 eval_expr_val (char **expr, long int *result)
 542 {
 543   char *digit;
 544
 545   /* Skip white space */
 546   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 547
 548   if (*digit == '(')
 549     {
 550       /* Scan for closing paren */
 551       for (++digit; **expr && **expr != ')'; ++(*expr));
 552
 553       /* Is there one? */
 554       if (!**expr)
 555         return WRDE_SYNTAX;
 556
 557       *(*expr)++ = 0;
 558
 559       if (eval_expr (digit, result))
 560         return WRDE_SYNTAX;
 561
 562       return 0;
 563     }
 564
 565   /* POSIX requires that decimal, octal, and hexadecimal constants are
 566      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 567   *result = strtol (digit, expr, 0);
 568   if (digit == *expr)
 569     return WRDE_SYNTAX;
 570
 571   return 0;
 572 }
 573
 574 static int
 575 eval_expr_multdiv (char **expr, long int *result)
 576 {
 577   long int arg;
 578
 579   /* Read a Value */
 580   if (eval_expr_val (expr, result) != 0)
 581     return WRDE_SYNTAX;
 582
 583   while (**expr)
 584     {
 585       /* Skip white space */
 586       for (; *expr && **expr && isspace (**expr); ++(*expr));
 587
 588       if (**expr == '*')
 589         {
 590           ++(*expr);
 591           if (eval_expr_val (expr, &arg) != 0)
 592             return WRDE_SYNTAX;
 593
 594           *result *= arg;
 595         }
 596       else if (**expr == '/')
 597         {
 598           ++(*expr);
 599           if (eval_expr_val (expr, &arg) != 0)
 600             return WRDE_SYNTAX;
 601
 602           /* Division by zero or integer overflow.  */
 603           if (arg == 0 || (arg == -1 && *result == LONG_MIN))
 604             return WRDE_SYNTAX;
 605
 606           *result /= arg;
 607         }
 608       else break;
 609     }
 610
 611   return 0;
 612 }
 613
 614 static int
 615 eval_expr (char *expr, long int *result)
 616 {
 617   long int arg;
 618
 619   /* Read a Multdiv */
 620   if (eval_expr_multdiv (&expr, result) != 0)
 621     return WRDE_SYNTAX;
 622
 623   while (*expr)
 624     {
 625       /* Skip white space */
 626       for (; expr && *expr && isspace (*expr); ++expr);
 627
 628       if (*expr == '+')
 629         {
 630           ++expr;
 631           if (eval_expr_multdiv (&expr, &arg) != 0)
 632             return WRDE_SYNTAX;
 633
 634           *result += arg;
 635         }
 636       else if (*expr == '-')
 637         {
 638           ++expr;
 639           if (eval_expr_multdiv (&expr, &arg) != 0)
 640             return WRDE_SYNTAX;
 641
 642           *result -= arg;
 643         }
 644       else break;
 645     }
 646
 647   return 0;
 648 }
 649
 650 static int
 651 parse_arith (char **word, size_t *word_length, size_t *max_length,
 652              const char *words, size_t *offset, int flags, int bracket)
 653 {
 654   /* We are poised just after "$((" or "$[" */
 655   int error;
 656   int paren_depth = 1;
 657   size_t expr_length;
 658   size_t expr_maxlen;
 659   char *expr;
 660
 661   expr = w_newword (&expr_length, &expr_maxlen);
 662   for (; words[*offset]; ++(*offset))
 663     {
 664       switch (words[*offset])
 665         {
 666         case '$':
 667           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 668                                  words, offset, flags, NULL, NULL, NULL, 1);
 669           /* The ``1'' here is to tell parse_dollars not to
 670            * split the fields.
 671            */
 672           if (error)
 673             {
 674               free (expr);
 675               return error;
 676             }
 677           break;
 678
 679         case '`':
 680           (*offset)++;
 681           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 682                                   words, offset, flags, NULL, NULL, NULL);
 683           /* The first NULL here is to tell parse_backtick not to
 684            * split the fields.
 685            */
 686           if (error)
 687             {
 688               free (expr);
 689               return error;
 690             }
 691           break;
 692
 693         case '\\':
 694           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 695                                        words, offset);
 696           if (error)
 697             {
 698               free (expr);
 699               return error;
 700             }
 701           /* I think that a backslash within an
 702            * arithmetic expansion is bound to
 703            * cause an error sooner or later anyway though.
 704            */
 705           break;
 706
 707         case ')':
 708           if (--paren_depth == 0)
 709             {
 710               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 711               long int numresult = 0;
 712               long long int convertme;
 713
 714               if (bracket || words[1 + *offset] != ')')
 715                 {
 716                   free (expr);
 717                   return WRDE_SYNTAX;
 718                 }
 719
 720               ++(*offset);
 721
 722               /* Go - evaluate. */
 723               if (expr && eval_expr (expr, &numresult) != 0)
 724                 {
 725                   free (expr);
 726                   return WRDE_SYNTAX;
 727                 }
 728
 729               if (numresult < 0)
 730                 {
 731                   convertme = -numresult;
 732                   *word = w_addchar (*word, word_length, max_length, '-');
 733                   if (!*word)
 734                     {
 735                       free (expr);
 736                       return WRDE_NOSPACE;
 737                     }
 738                 }
 739               else
 740                 convertme = numresult;
 741
 742               result[20] = '\0';
 743               *word = w_addstr (*word, word_length, max_length,
 744                                 _itoa (convertme, &result[20], 10, 0));
 745               free (expr);
 746               return *word ? 0 : WRDE_NOSPACE;
 747             }
 748           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 749           if (expr == NULL)
 750             return WRDE_NOSPACE;
 751
 752           break;
 753
 754         case ']':
 755           if (bracket && paren_depth == 1)
 756             {
 757               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 758               long int numresult = 0;
 759
 760               /* Go - evaluate. */
 761               if (expr && eval_expr (expr, &numresult) != 0)
 762                 {
 763                   free (expr);
 764                   return WRDE_SYNTAX;
 765                 }
 766
 767               result[20] = '\0';
 768               *word = w_addstr (*word, word_length, max_length,
 769                                 _itoa_word (numresult, &result[20], 10, 0));
 770               free (expr);
 771               return *word ? 0 : WRDE_NOSPACE;
 772             }
 773
 774           free (expr);
 775           return WRDE_SYNTAX;
 776
 777         case '\n':
 778         case ';':
 779         case '{':
 780         case '}':
 781           free (expr);
 782           return WRDE_BADCHAR;
 783
 784         case '(':
 785           ++paren_depth;
 786           /* Fall through.  */
 787         default:
 788           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 789           if (expr == NULL)
 790             return WRDE_NOSPACE;
 791         }
 792     }
 793
 794   /* Premature end */
 795   free (expr);
 796   return WRDE_SYNTAX;
 797 }
 798
 799 #define DYNARRAY_STRUCT        strlist
 800 #define DYNARRAY_ELEMENT       char *
 801 #define DYNARRAY_PREFIX        strlist_
 802 /* Allocates about 512/1024 (32/64 bit) on stack.  */
 803 #define DYNARRAY_INITIAL_SIZE  128
 804 #include <malloc/dynarray-skeleton.c>
 805
 806 /* Function called by child process in exec_comm() */
 807 static pid_t
 808 exec_comm_child (char *comm, int *fildes, bool showerr, bool noexec)
 809 {
 810   pid_t pid = -1;
 811
 812   /* Execute the command, or just check syntax?  */
 813   const char *args[] = { _PATH_BSHELL, noexec ? "-nc" : "-c", comm, NULL };
 814
 815   posix_spawn_file_actions_t fa;
 816   /* posix_spawn_file_actions_init does not fail.  */
 817   __posix_spawn_file_actions_init (&fa);
 818
 819   /* Redirect output.  For check syntax only (noexec being true), exec_comm
 820      explicits sets fildes[1] to -1, so check its value to avoid a failure in
 821      __posix_spawn_file_actions_adddup2.  */
 822   if (fildes[1] != -1)
 823     {
 824       if (__glibc_likely (fildes[1] != STDOUT_FILENO))
 825         {
 826           if (__posix_spawn_file_actions_adddup2 (&fa, fildes[1],
 827                                                   STDOUT_FILENO) != 0
 828               || __posix_spawn_file_actions_addclose (&fa, fildes[1]) != 0)
 829             goto out;
 830         }
 831       else
 832         /* Reset the close-on-exec flag (if necessary).  */
 833         if (__posix_spawn_file_actions_adddup2 (&fa, fildes[1], fildes[1])
 834             != 0)
 835           goto out;
 836     }
 837
 838   /* Redirect stderr to /dev/null if we have to.  */
 839   if (!showerr)
 840     if (__posix_spawn_file_actions_addopen (&fa, STDERR_FILENO, _PATH_DEVNULL,
 841                                             O_WRONLY, 0) != 0)
 842       goto out;
 843
 844   struct strlist newenv;
 845   strlist_init (&newenv);
 846
 847   bool recreate_env = getenv ("IFS") != NULL;
 848   if (recreate_env)
 849     {
 850       for (char **ep = __environ; *ep != NULL; ep++)
 851         if (strncmp (*ep, "IFS=", strlen ("IFS=")) != 0)
 852           strlist_add (&newenv, *ep);
 853       strlist_add (&newenv, NULL);
 854       if (strlist_has_failed (&newenv))
 855         goto out;
 856     }
 857
 858   /* pid is not set if posix_spawn fails, so it keep the original value
 859      of -1.  */
 860   __posix_spawn (&pid, _PATH_BSHELL, &fa, NULL, (char *const *) args,
 861                  recreate_env ? strlist_begin (&newenv) : __environ);
 862
 863   strlist_free (&newenv);
 864
 865 out:
 866   __posix_spawn_file_actions_destroy (&fa);
 867
 868   return pid;
 869 }
 870
 871 /* Function to execute a command and retrieve the results */
 872 /* pwordexp contains NULL if field-splitting is forbidden */
 873 static int
 874 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 875            int flags, wordexp_t *pwordexp, const char *ifs,
 876            const char *ifs_white)
 877 {
 878   int fildes[2];
 879 #define bufsize 128
 880   int buflen;
 881   int i;
 882   int status = 0;
 883   size_t maxnewlines = 0;
 884   char buffer[bufsize];
 885   pid_t pid;
 886   bool noexec = false;
 887
 888   /* Do nothing if command substitution should not succeed.  */
 889   if (flags & WRDE_NOCMD)
 890     return WRDE_CMDSUB;
 891
 892   /* Don't posix_spawn unless necessary */
 893   if (!comm || !*comm)
 894     return 0;
 895
 896   if (__pipe2 (fildes, O_CLOEXEC) < 0)
 897     return WRDE_NOSPACE;
 898
 899  again:
 900   pid = exec_comm_child (comm, fildes, noexec ? false : flags & WRDE_SHOWERR,
 901                          noexec);
 902   if (pid < 0)
 903     {
 904       __close (fildes[0]);
 905       __close (fildes[1]);
 906       return WRDE_NOSPACE;
 907     }
 908
 909   /* If we are just testing the syntax, only wait.  */
 910   if (noexec)
 911     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 912             && status != 0) ? WRDE_SYNTAX : 0;
 913
 914   __close (fildes[1]);
 915   fildes[1] = -1;
 916
 917   if (!pwordexp)
 918     /* Quoted - no field splitting */
 919     {
 920       while (1)
 921         {
 922           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 923                                                     bufsize))) < 1)
 924             {
 925               /* If read returned 0 then the process has closed its
 926                  stdout.  Don't use WNOHANG in that case to avoid busy
 927                  looping until the process eventually exits.  */
 928               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 929                                                  buflen == 0 ? 0 : WNOHANG))
 930                   == 0)
 931                 continue;
 932               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 933                                                         bufsize))) < 1)
 934                 break;
 935             }
 936
 937           maxnewlines += buflen;
 938
 939           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 940           if (*word == NULL)
 941             goto no_space;
 942         }
 943     }
 944   else
 945     /* Not quoted - split fields */
 946     {
 947       int copying = 0;
 948       /* 'copying' is:
 949        *  0 when searching for first character in a field not IFS white space
 950        *  1 when copying the text of a field
 951        *  2 when searching for possible non-whitespace IFS
 952        *  3 when searching for non-newline after copying field
 953        */
 954
 955       while (1)
 956         {
 957           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 958                                                     bufsize))) < 1)
 959             {
 960               /* If read returned 0 then the process has closed its
 961                  stdout.  Don't use WNOHANG in that case to avoid busy
 962                  looping until the process eventually exits.  */
 963               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 964                                                  buflen == 0 ? 0 : WNOHANG))
 965                   == 0)
 966                 continue;
 967               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 968                                                         bufsize))) < 1)
 969                 break;
 970             }
 971
 972           for (i = 0; i < buflen; ++i)
 973             {
 974               if (strchr (ifs, buffer[i]) != NULL)
 975                 {
 976                   /* Current character is IFS */
 977                   if (strchr (ifs_white, buffer[i]) == NULL)
 978                     {
 979                       /* Current character is IFS but not whitespace */
 980                       if (copying == 2)
 981                         {
 982                           /*            current character
 983                            *                   |
 984                            *                   V
 985                            * eg: text<space><comma><space>moretext
 986                            *
 987                            * So, strip whitespace IFS (like at the start)
 988                            */
 989                           copying = 0;
 990                           continue;
 991                         }
 992
 993                       copying = 0;
 994                       /* fall through and delimit field.. */
 995                     }
 996                   else
 997                     {
 998                       if (buffer[i] == '\n')
 999                         {
1000                           /* Current character is (IFS) newline */
1001
1002                           /* If copying a field, this is the end of it,
1003                              but maybe all that's left is trailing newlines.
1004                              So start searching for a non-newline. */
1005                           if (copying == 1)
1006                             copying = 3;
1007
1008                           continue;
1009                         }
1010                       else
1011                         {
1012                           /* Current character is IFS white space, but
1013                              not a newline */
1014
1015                           /* If not either copying a field or searching
1016                              for non-newline after a field, ignore it */
1017                           if (copying != 1 && copying != 3)
1018                             continue;
1019
1020                           /* End of field (search for non-ws IFS afterwards) */
1021                           copying = 2;
1022                         }
1023                     }
1024
1025                   /* First IFS white space (non-newline), or IFS non-whitespace.
1026                    * Delimit the field.  Nulls are converted by w_addword. */
1027                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1028                     goto no_space;
1029
1030                   *word = w_newword (word_length, max_length);
1031
1032                   maxnewlines = 0;
1033                   /* fall back round the loop.. */
1034                 }
1035               else
1036                 {
1037                   /* Not IFS character */
1038
1039                   if (copying == 3)
1040                     {
1041                       /* Nothing but (IFS) newlines since the last field,
1042                          so delimit it here before starting new word */
1043                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1044                         goto no_space;
1045
1046                       *word = w_newword (word_length, max_length);
1047                     }
1048
1049                   copying = 1;
1050
1051                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1052                     maxnewlines++;
1053                   else
1054                     maxnewlines = 0;
1055
1056                   *word = w_addchar (*word, word_length, max_length,
1057                                      buffer[i]);
1058                   if (*word == NULL)
1059                     goto no_space;
1060                 }
1061             }
1062         }
1063     }
1064
1065   /* Chop off trailing newlines (required by POSIX.2)  */
1066   /* Ensure we don't go back further than the beginning of the
1067      substitution (i.e. remove maxnewlines bytes at most) */
1068   while (maxnewlines-- != 0
1069          && *word_length > 0 && (*word)[*word_length - 1] == '\n')
1070     {
1071       (*word)[--*word_length] = '\0';
1072
1073       /* If the last word was entirely newlines, turn it into a new word
1074        * which can be ignored if there's nothing following it. */
1075       if (*word_length == 0)
1076         {
1077           free (*word);
1078           *word = w_newword (word_length, max_length);
1079           break;
1080         }
1081     }
1082
1083   __close (fildes[0]);
1084   fildes[0] = -1;
1085
1086   /* Check for syntax error (re-execute but with "-n" flag) */
1087   if (buflen < 1 && status != 0)
1088     {
1089       noexec = true;
1090       goto again;
1091     }
1092
1093   return 0;
1094
1095 no_space:
1096   __kill (pid, SIGKILL);
1097   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1098   __close (fildes[0]);
1099   return WRDE_NOSPACE;
1100 }
1101
1102 static int
1103 parse_comm (char **word, size_t *word_length, size_t *max_length,
1104             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1105             const char *ifs, const char *ifs_white)
1106 {
1107   /* We are poised just after "$(" */
1108   int paren_depth = 1;
1109   int error = 0;
1110   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1111   size_t comm_length;
1112   size_t comm_maxlen;
1113   char *comm = w_newword (&comm_length, &comm_maxlen);
1114
1115   for (; words[*offset]; ++(*offset))
1116     {
1117       switch (words[*offset])
1118         {
1119         case '\'':
1120           if (quoted == 0)
1121             quoted = 1;
1122           else if (quoted == 1)
1123             quoted = 0;
1124
1125           break;
1126
1127         case '"':
1128           if (quoted == 0)
1129             quoted = 2;
1130           else if (quoted == 2)
1131             quoted = 0;
1132
1133           break;
1134
1135         case ')':
1136           if (!quoted && --paren_depth == 0)
1137             {
1138               /* Go -- give script to the shell */
1139               if (comm)
1140                 {
1141                   /* posix_spawn already handles thread cancellation.  */
1142                   error = exec_comm (comm, word, word_length, max_length,
1143                                      flags, pwordexp, ifs, ifs_white);
1144                   free (comm);
1145                 }
1146
1147               return error;
1148             }
1149
1150           /* This is just part of the script */
1151           break;
1152
1153         case '(':
1154           if (!quoted)
1155             ++paren_depth;
1156         }
1157
1158       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1159       if (comm == NULL)
1160         return WRDE_NOSPACE;
1161     }
1162
1163   /* Premature end.  */
1164   free (comm);
1165
1166   return WRDE_SYNTAX;
1167 }
1168
1169 #define CHAR_IN_SET(ch, char_set) \
1170   (memchr (char_set "", ch, sizeof (char_set) - 1) != NULL)
1171
1172 static int
1173 parse_param (char **word, size_t *word_length, size_t *max_length,
1174              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1175              const char *ifs, const char *ifs_white, int quoted)
1176 {
1177   /* We are poised just after "$" */
1178   enum action
1179   {
1180     ACT_NONE,
1181     ACT_RP_SHORT_LEFT = '#',
1182     ACT_RP_LONG_LEFT = 'L',
1183     ACT_RP_SHORT_RIGHT = '%',
1184     ACT_RP_LONG_RIGHT = 'R',
1185     ACT_NULL_ERROR = '?',
1186     ACT_NULL_SUBST = '-',
1187     ACT_NONNULL_SUBST = '+',
1188     ACT_NULL_ASSIGN = '='
1189   };
1190   size_t env_length;
1191   size_t env_maxlen;
1192   size_t pat_length;
1193   size_t pat_maxlen;
1194   size_t start = *offset;
1195   char *env;
1196   char *pattern;
1197   char *value = NULL;
1198   enum action action = ACT_NONE;
1199   int depth = 0;
1200   int colon_seen = 0;
1201   int seen_hash = 0;
1202   int free_value = 0;
1203   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1204   int error;
1205   int special = 0;
1206   char buffer[21];
1207   int brace = words[*offset] == '{';
1208
1209   env = w_newword (&env_length, &env_maxlen);
1210   pattern = w_newword (&pat_length, &pat_maxlen);
1211
1212   if (brace)
1213     ++*offset;
1214
1215   /* First collect the parameter name. */
1216
1217   if (words[*offset] == '#')
1218     {
1219       seen_hash = 1;
1220       if (!brace)
1221         goto envsubst;
1222       ++*offset;
1223     }
1224
1225   if (isalpha (words[*offset]) || words[*offset] == '_')
1226     {
1227       /* Normal parameter name. */
1228       do
1229         {
1230           env = w_addchar (env, &env_length, &env_maxlen,
1231                            words[*offset]);
1232           if (env == NULL)
1233             goto no_space;
1234         }
1235       while (isalnum (words[++*offset]) || words[*offset] == '_');
1236     }
1237   else if (isdigit (words[*offset]))
1238     {
1239       /* Numeric parameter name. */
1240       special = 1;
1241       do
1242         {
1243           env = w_addchar (env, &env_length, &env_maxlen,
1244                            words[*offset]);
1245           if (env == NULL)
1246             goto no_space;
1247           if (!brace)
1248             goto envsubst;
1249         }
1250       while (isdigit(words[++*offset]));
1251     }
1252   else if (CHAR_IN_SET (words[*offset], "*@$"))
1253     {
1254       /* Special parameter. */
1255       special = 1;
1256       env = w_addchar (env, &env_length, &env_maxlen,
1257                        words[*offset]);
1258       if (env == NULL)
1259         goto no_space;
1260       ++*offset;
1261     }
1262   else
1263     {
1264       if (brace)
1265         goto syntax;
1266     }
1267
1268   if (brace)
1269     {
1270       /* Check for special action to be applied to the value. */
1271       switch (words[*offset])
1272         {
1273         case '}':
1274           /* Evaluate. */
1275           goto envsubst;
1276
1277         case '#':
1278           action = ACT_RP_SHORT_LEFT;
1279           if (words[1 + *offset] == '#')
1280             {
1281               ++*offset;
1282               action = ACT_RP_LONG_LEFT;
1283             }
1284           break;
1285
1286         case '%':
1287           action = ACT_RP_SHORT_RIGHT;
1288           if (words[1 + *offset] == '%')
1289             {
1290               ++*offset;
1291               action = ACT_RP_LONG_RIGHT;
1292             }
1293           break;
1294
1295         case ':':
1296           if (!CHAR_IN_SET (words[1 + *offset], "-=?+"))
1297             goto syntax;
1298
1299           colon_seen = 1;
1300           action = words[++*offset];
1301           break;
1302
1303         case '-':
1304         case '=':
1305         case '?':
1306         case '+':
1307           action = words[*offset];
1308           break;
1309
1310         default:
1311           goto syntax;
1312         }
1313
1314       /* Now collect the pattern, but don't expand it yet. */
1315       ++*offset;
1316       for (; words[*offset]; ++(*offset))
1317         {
1318           switch (words[*offset])
1319             {
1320             case '{':
1321               if (!pattern_is_quoted)
1322                 ++depth;
1323               break;
1324
1325             case '}':
1326               if (!pattern_is_quoted)
1327                 {
1328                   if (depth == 0)
1329                     goto envsubst;
1330                   --depth;
1331                 }
1332               break;
1333
1334             case '\\':
1335               if (pattern_is_quoted)
1336                 /* Quoted; treat as normal character. */
1337                 break;
1338
1339               /* Otherwise, it's an escape: next character is literal. */
1340               if (words[++*offset] == '\0')
1341                 goto syntax;
1342
1343               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1344               if (pattern == NULL)
1345                 goto no_space;
1346
1347               break;
1348
1349             case '\'':
1350               if (pattern_is_quoted == 0)
1351                 pattern_is_quoted = 1;
1352               else if (pattern_is_quoted == 1)
1353                 pattern_is_quoted = 0;
1354
1355               break;
1356
1357             case '"':
1358               if (pattern_is_quoted == 0)
1359                 pattern_is_quoted = 2;
1360               else if (pattern_is_quoted == 2)
1361                 pattern_is_quoted = 0;
1362
1363               break;
1364             }
1365
1366           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1367                                words[*offset]);
1368           if (pattern == NULL)
1369             goto no_space;
1370         }
1371     }
1372
1373   /* End of input string -- remember to reparse the character that we
1374    * stopped at.  */
1375   --(*offset);
1376
1377 envsubst:
1378   if (words[start] == '{' && words[*offset] != '}')
1379     goto syntax;
1380
1381   if (env == NULL)
1382     {
1383       if (seen_hash)
1384         {
1385           /* $# expands to the number of positional parameters */
1386           buffer[20] = '\0';
1387           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1388           seen_hash = 0;
1389         }
1390       else
1391         {
1392           /* Just $ on its own */
1393           *offset = start - 1;
1394           *word = w_addchar (*word, word_length, max_length, '$');
1395           return *word ? 0 : WRDE_NOSPACE;
1396         }
1397     }
1398   /* Is it a numeric parameter? */
1399   else if (isdigit (env[0]))
1400     {
1401       unsigned long n = strtoul (env, NULL, 10);
1402
1403       if (n >= __libc_argc)
1404         /* Substitute NULL. */
1405         value = NULL;
1406       else
1407         /* Replace with appropriate positional parameter. */
1408         value = __libc_argv[n];
1409     }
1410   /* Is it a special parameter? */
1411   else if (special)
1412     {
1413       /* Is it `$$'? */
1414       if (*env == '$')
1415         {
1416           buffer[20] = '\0';
1417           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1418         }
1419       /* Is it `${#*}' or `${#@}'? */
1420       else if ((*env == '*' || *env == '@') && seen_hash)
1421         {
1422           buffer[20] = '\0';
1423           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1424                               &buffer[20], 10, 0);
1425           *word = w_addstr (*word, word_length, max_length, value);
1426           free (env);
1427           free (pattern);
1428           return *word ? 0 : WRDE_NOSPACE;
1429         }
1430       /* Is it `$*' or `$@' (unquoted) ? */
1431       else if (*env == '*' || (*env == '@' && !quoted))
1432         {
1433           size_t plist_len = 0;
1434           int p;
1435           char *end;
1436
1437           /* Build up value parameter by parameter (copy them) */
1438           for (p = 1; __libc_argv[p]; ++p)
1439             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1440           value = malloc (plist_len);
1441           if (value == NULL)
1442             goto no_space;
1443           end = value;
1444           *end = 0;
1445           for (p = 1; __libc_argv[p]; ++p)
1446             {
1447               if (p > 1)
1448                 *end++ = ' ';
1449               end = __stpcpy (end, __libc_argv[p]);
1450             }
1451
1452           free_value = 1;
1453         }
1454       else
1455         {
1456           /* Must be a quoted `$@' */
1457           assert (*env == '@' && quoted);
1458
1459           /* Each parameter is a separate word ("$@") */
1460           if (__libc_argc == 2)
1461             value = __libc_argv[1];
1462           else if (__libc_argc > 2)
1463             {
1464               int p;
1465
1466               /* Append first parameter to current word. */
1467               value = w_addstr (*word, word_length, max_length,
1468                                 __libc_argv[1]);
1469               if (value == NULL || w_addword (pwordexp, value))
1470                 goto no_space;
1471
1472               for (p = 2; __libc_argv[p + 1]; p++)
1473                 {
1474                   char *newword = __strdup (__libc_argv[p]);
1475                   if (newword == NULL || w_addword (pwordexp, newword))
1476                     goto no_space;
1477                 }
1478
1479               /* Start a new word with the last parameter. */
1480               *word = w_newword (word_length, max_length);
1481               value = __libc_argv[p];
1482             }
1483           else
1484             {
1485               free (env);
1486               free (pattern);
1487               return 0;
1488             }
1489         }
1490     }
1491   else
1492     value = getenv (env);
1493
1494   if (value == NULL && (flags & WRDE_UNDEF))
1495     {
1496       /* Variable not defined. */
1497       error = WRDE_BADVAL;
1498       goto do_error;
1499     }
1500
1501   if (action != ACT_NONE)
1502     {
1503       int expand_pattern = 0;
1504
1505       /* First, find out if we need to expand pattern (i.e. if we will
1506        * use it). */
1507       switch (action)
1508         {
1509         case ACT_RP_SHORT_LEFT:
1510         case ACT_RP_LONG_LEFT:
1511         case ACT_RP_SHORT_RIGHT:
1512         case ACT_RP_LONG_RIGHT:
1513           /* Always expand for these. */
1514           expand_pattern = 1;
1515           break;
1516
1517         case ACT_NULL_ERROR:
1518         case ACT_NULL_SUBST:
1519         case ACT_NULL_ASSIGN:
1520           if (!value || (!*value && colon_seen))
1521             /* If param is unset, or set but null and a colon has been seen,
1522                the expansion of the pattern will be needed. */
1523             expand_pattern = 1;
1524
1525           break;
1526
1527         case ACT_NONNULL_SUBST:
1528           /* Expansion of word will be needed if parameter is set and not null,
1529              or set null but no colon has been seen. */
1530           if (value && (*value || !colon_seen))
1531             expand_pattern = 1;
1532
1533           break;
1534
1535         default:
1536           assert (! "Unrecognised action!");
1537         }
1538
1539       if (expand_pattern)
1540         {
1541           /* We need to perform tilde expansion, parameter expansion,
1542              command substitution, and arithmetic expansion.  We also
1543              have to be a bit careful with wildcard characters, as
1544              pattern might be given to fnmatch soon.  To do this, we
1545              convert quotes to escapes. */
1546
1547           char *expanded;
1548           size_t exp_len;
1549           size_t exp_maxl;
1550           char *p;
1551           int quoted = 0; /* 1: single quotes; 2: double */
1552
1553           expanded = w_newword (&exp_len, &exp_maxl);
1554           for (p = pattern; p && *p; p++)
1555             {
1556               size_t offset;
1557
1558               switch (*p)
1559                 {
1560                 case '"':
1561                   if (quoted == 2)
1562                     quoted = 0;
1563                   else if (quoted == 0)
1564                     quoted = 2;
1565                   else break;
1566
1567                   continue;
1568
1569                 case '\'':
1570                   if (quoted == 1)
1571                     quoted = 0;
1572                   else if (quoted == 0)
1573                     quoted = 1;
1574                   else break;
1575
1576                   continue;
1577
1578                 case '*':
1579                 case '?':
1580                   if (quoted)
1581                     {
1582                       /* Convert quoted wildchar to escaped wildchar. */
1583                       expanded = w_addchar (expanded, &exp_len,
1584                                             &exp_maxl, '\\');
1585
1586                       if (expanded == NULL)
1587                         goto no_space;
1588                     }
1589                   break;
1590
1591                 case '$':
1592                   offset = 0;
1593                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1594                                          &offset, flags, NULL, NULL, NULL, 1);
1595                   if (error)
1596                     {
1597                       if (free_value)
1598                         free (value);
1599
1600                       free (expanded);
1601
1602                       goto do_error;
1603                     }
1604
1605                   p += offset;
1606                   continue;
1607
1608                 case '~':
1609                   if (quoted || exp_len)
1610                     break;
1611
1612                   offset = 0;
1613                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1614                                        &offset, 0);
1615                   if (error)
1616                     {
1617                       if (free_value)
1618                         free (value);
1619
1620                       free (expanded);
1621
1622                       goto do_error;
1623                     }
1624
1625                   p += offset;
1626                   continue;
1627
1628                 case '\\':
1629                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1630                   ++p;
1631                   assert (*p); /* checked when extracted initially */
1632                   if (expanded == NULL)
1633                     goto no_space;
1634                 }
1635
1636               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1637
1638               if (expanded == NULL)
1639                 goto no_space;
1640             }
1641
1642           free (pattern);
1643
1644           pattern = expanded;
1645         }
1646
1647       switch (action)
1648         {
1649         case ACT_RP_SHORT_LEFT:
1650         case ACT_RP_LONG_LEFT:
1651         case ACT_RP_SHORT_RIGHT:
1652         case ACT_RP_LONG_RIGHT:
1653           {
1654             char *p;
1655             char c;
1656             char *end;
1657
1658             if (value == NULL || pattern == NULL || *pattern == '\0')
1659               break;
1660
1661             end = value + strlen (value);
1662
1663             switch (action)
1664               {
1665               case ACT_RP_SHORT_LEFT:
1666                 for (p = value; p <= end; ++p)
1667                   {
1668                     c = *p;
1669                     *p = '\0';
1670                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1671                       {
1672                         *p = c;
1673                         if (free_value)
1674                           {
1675                             char *newval = __strdup (p);
1676                             if (newval == NULL)
1677                               {
1678                                 free (value);
1679                                 goto no_space;
1680                               }
1681                             free (value);
1682                             value = newval;
1683                           }
1684                         else
1685                           value = p;
1686                         break;
1687                       }
1688                     *p = c;
1689                   }
1690
1691                 break;
1692
1693               case ACT_RP_LONG_LEFT:
1694                 for (p = end; p >= value; --p)
1695                   {
1696                     c = *p;
1697                     *p = '\0';
1698                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1699                       {
1700                         *p = c;
1701                         if (free_value)
1702                           {
1703                             char *newval = __strdup (p);
1704                             if (newval == NULL)
1705                               {
1706                                 free (value);
1707                                 goto no_space;
1708                               }
1709                             free (value);
1710                             value = newval;
1711                           }
1712                         else
1713                           value = p;
1714                         break;
1715                       }
1716                     *p = c;
1717                   }
1718
1719                 break;
1720
1721               case ACT_RP_SHORT_RIGHT:
1722                 for (p = end; p >= value; --p)
1723                   {
1724                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1725                       {
1726                         char *newval;
1727                         newval = malloc (p - value + 1);
1728
1729                         if (newval == NULL)
1730                           {
1731                             if (free_value)
1732                               free (value);
1733                             goto no_space;
1734                           }
1735
1736                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1737                         if (free_value)
1738                           free (value);
1739                         value = newval;
1740                         free_value = 1;
1741                         break;
1742                       }
1743                   }
1744
1745                 break;
1746
1747               case ACT_RP_LONG_RIGHT:
1748                 for (p = value; p <= end; ++p)
1749                   {
1750                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1751                       {
1752                         char *newval;
1753                         newval = malloc (p - value + 1);
1754
1755                         if (newval == NULL)
1756                           {
1757                             if (free_value)
1758                               free (value);
1759                             goto no_space;
1760                           }
1761
1762                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1763                         if (free_value)
1764                           free (value);
1765                         value = newval;
1766                         free_value = 1;
1767                         break;
1768                       }
1769                   }
1770
1771                 break;
1772
1773               default:
1774                 break;
1775               }
1776
1777             break;
1778           }
1779
1780         case ACT_NULL_ERROR:
1781           if (value && *value)
1782             /* Substitute parameter */
1783             break;
1784
1785           error = 0;
1786           if (!colon_seen && value)
1787             /* Substitute NULL */
1788             ;
1789           else
1790             {
1791               const char *str = pattern;
1792
1793               if (!str || str[0] == '\0')
1794                 str = _("parameter null or not set");
1795
1796               __fxprintf (NULL, "%s: %s\n", env, str);
1797             }
1798
1799           if (free_value)
1800             free (value);
1801           goto do_error;
1802
1803         case ACT_NULL_SUBST:
1804           if (value && *value)
1805             /* Substitute parameter */
1806             break;
1807
1808           if (free_value)
1809             free (value);
1810
1811           if (!colon_seen && value)
1812             /* Substitute NULL */
1813             goto success;
1814
1815           value = pattern ? __strdup (pattern) : pattern;
1816           free_value = 1;
1817
1818           if (pattern && !value)
1819             goto no_space;
1820
1821           break;
1822
1823         case ACT_NONNULL_SUBST:
1824           if (value && (*value || !colon_seen))
1825             {
1826               if (free_value)
1827                 free (value);
1828
1829               value = pattern ? __strdup (pattern) : pattern;
1830               free_value = 1;
1831
1832               if (pattern && !value)
1833                 goto no_space;
1834
1835               break;
1836             }
1837
1838           /* Substitute NULL */
1839           if (free_value)
1840             free (value);
1841           goto success;
1842
1843         case ACT_NULL_ASSIGN:
1844           if (value && *value)
1845             /* Substitute parameter */
1846             break;
1847
1848           if (!colon_seen && value)
1849             {
1850               /* Substitute NULL */
1851               if (free_value)
1852                 free (value);
1853               goto success;
1854             }
1855
1856           if (free_value)
1857             free (value);
1858
1859           value = pattern ? __strdup (pattern) : pattern;
1860           free_value = 1;
1861
1862           if (pattern && !value)
1863             goto no_space;
1864
1865           __setenv (env, value ?: "", 1);
1866           break;
1867
1868         default:
1869           assert (! "Unrecognised action!");
1870         }
1871     }
1872
1873   free (env);
1874   env = NULL;
1875   free (pattern);
1876   pattern = NULL;
1877
1878   if (seen_hash)
1879     {
1880       char param_length[21];
1881       param_length[20] = '\0';
1882       *word = w_addstr (*word, word_length, max_length,
1883                         _itoa_word (value ? strlen (value) : 0,
1884                                     &param_length[20], 10, 0));
1885       if (free_value)
1886         free (value);
1887
1888       return *word ? 0 : WRDE_NOSPACE;
1889     }
1890
1891   if (value == NULL)
1892     return 0;
1893
1894   if (quoted || !pwordexp)
1895     {
1896       /* Quoted - no field split */
1897       *word = w_addstr (*word, word_length, max_length, value);
1898       if (free_value)
1899         free (value);
1900
1901       return *word ? 0 : WRDE_NOSPACE;
1902     }
1903   else
1904     {
1905       /* Need to field-split */
1906       char *value_copy = __strdup (value); /* Don't modify value */
1907       char *field_begin = value_copy;
1908       int seen_nonws_ifs = 0;
1909
1910       if (free_value)
1911         free (value);
1912
1913       if (value_copy == NULL)
1914         goto no_space;
1915
1916       do
1917         {
1918           char *field_end = field_begin;
1919           char *next_field;
1920
1921           /* If this isn't the first field, start a new word */
1922           if (field_begin != value_copy)
1923             {
1924               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1925                 {
1926                   free (value_copy);
1927                   goto no_space;
1928                 }
1929
1930               *word = w_newword (word_length, max_length);
1931             }
1932
1933           /* Skip IFS whitespace before the field */
1934           field_begin += strspn (field_begin, ifs_white);
1935
1936           if (!seen_nonws_ifs && *field_begin == 0)
1937             /* Nothing but whitespace */
1938             break;
1939
1940           /* Search for the end of the field */
1941           field_end = field_begin + strcspn (field_begin, ifs);
1942
1943           /* Set up pointer to the character after end of field and
1944              skip whitespace IFS after it. */
1945           next_field = field_end + strspn (field_end, ifs_white);
1946
1947           /* Skip at most one non-whitespace IFS character after the field */
1948           seen_nonws_ifs = 0;
1949           if (*next_field && strchr (ifs, *next_field))
1950             {
1951               seen_nonws_ifs = 1;
1952               next_field++;
1953             }
1954
1955           /* Null-terminate it */
1956           *field_end = 0;
1957
1958           /* Tag a copy onto the current word */
1959           *word = w_addstr (*word, word_length, max_length, field_begin);
1960
1961           if (*word == NULL && *field_begin != '\0')
1962             {
1963               free (value_copy);
1964               goto no_space;
1965             }
1966
1967           field_begin = next_field;
1968         }
1969       while (seen_nonws_ifs || *field_begin);
1970
1971       free (value_copy);
1972     }
1973
1974   return 0;
1975
1976 success:
1977   error = 0;
1978   goto do_error;
1979
1980 no_space:
1981   error = WRDE_NOSPACE;
1982   goto do_error;
1983
1984 syntax:
1985   error = WRDE_SYNTAX;
1986
1987 do_error:
1988   free (env);
1989
1990   free (pattern);
1991
1992   return error;
1993 }
1994
1995 #undef CHAR_IN_SET
1996
1997 static int
1998 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1999                const char *words, size_t *offset, int flags,
2000                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2001                int quoted)
2002 {
2003   /* We are poised _at_ "$" */
2004   switch (words[1 + *offset])
2005     {
2006     case '"':
2007     case '\'':
2008     case 0:
2009       *word = w_addchar (*word, word_length, max_length, '$');
2010       return *word ? 0 : WRDE_NOSPACE;
2011
2012     case '(':
2013       if (words[2 + *offset] == '(')
2014         {
2015           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2016           int i = 3 + *offset;
2017           int depth = 0;
2018           while (words[i] && !(depth == 0 && words[i] == ')'))
2019             {
2020               if (words[i] == '(')
2021                 ++depth;
2022               else if (words[i] == ')')
2023                 --depth;
2024
2025               ++i;
2026             }
2027
2028           if (words[i] == ')' && words[i + 1] == ')')
2029             {
2030               (*offset) += 3;
2031               /* Call parse_arith -- 0 is for "no brackets" */
2032               return parse_arith (word, word_length, max_length, words, offset,
2033                                   flags, 0);
2034             }
2035         }
2036
2037       (*offset) += 2;
2038       return parse_comm (word, word_length, max_length, words, offset, flags,
2039                          quoted? NULL : pwordexp, ifs, ifs_white);
2040
2041     case '[':
2042       (*offset) += 2;
2043       /* Call parse_arith -- 1 is for "brackets" */
2044       return parse_arith (word, word_length, max_length, words, offset, flags,
2045                           1);
2046
2047     case '{':
2048     default:
2049       ++(*offset);      /* parse_param needs to know if "{" is there */
2050       return parse_param (word, word_length, max_length, words, offset, flags,
2051                            pwordexp, ifs, ifs_white, quoted);
2052     }
2053 }
2054
2055 static int
2056 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2057                 const char *words, size_t *offset, int flags,
2058                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2059 {
2060   /* We are poised just after "`" */
2061   int error;
2062   int squoting = 0;
2063   size_t comm_length;
2064   size_t comm_maxlen;
2065   char *comm = w_newword (&comm_length, &comm_maxlen);
2066
2067   for (; words[*offset]; ++(*offset))
2068     {
2069       switch (words[*offset])
2070         {
2071         case '`':
2072           /* Go -- give the script to the shell */
2073           error = exec_comm (comm, word, word_length, max_length, flags,
2074                              pwordexp, ifs, ifs_white);
2075           free (comm);
2076           return error;
2077
2078         case '\\':
2079           if (squoting)
2080             {
2081               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2082                                            words, offset);
2083
2084               if (error)
2085                 {
2086                   free (comm);
2087                   return error;
2088                 }
2089
2090               break;
2091             }
2092
2093           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2094                                    offset);
2095
2096           if (error)
2097             {
2098               free (comm);
2099               return error;
2100             }
2101
2102           break;
2103
2104         case '\'':
2105           squoting = 1 - squoting;
2106           /* Fall through.  */
2107         default:
2108           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2109           if (comm == NULL)
2110             return WRDE_NOSPACE;
2111         }
2112     }
2113
2114   /* Premature end */
2115   free (comm);
2116   return WRDE_SYNTAX;
2117 }
2118
2119 static int
2120 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2121               const char *words, size_t *offset, int flags,
2122               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2123 {
2124   /* We are poised just after a double-quote */
2125   int error;
2126
2127   for (; words[*offset]; ++(*offset))
2128     {
2129       switch (words[*offset])
2130         {
2131         case '"':
2132           return 0;
2133
2134         case '$':
2135           error = parse_dollars (word, word_length, max_length, words, offset,
2136                                  flags, pwordexp, ifs, ifs_white, 1);
2137           /* The ``1'' here is to tell parse_dollars not to
2138            * split the fields.  It may need to, however ("$@").
2139            */
2140           if (error)
2141             return error;
2142
2143           break;
2144
2145         case '`':
2146           ++(*offset);
2147           error = parse_backtick (word, word_length, max_length, words,
2148                                   offset, flags, NULL, NULL, NULL);
2149           /* The first NULL here is to tell parse_backtick not to
2150            * split the fields.
2151            */
2152           if (error)
2153             return error;
2154
2155           break;
2156
2157         case '\\':
2158           error = parse_qtd_backslash (word, word_length, max_length, words,
2159                                        offset);
2160
2161           if (error)
2162             return error;
2163
2164           break;
2165
2166         default:
2167           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2168           if (*word == NULL)
2169             return WRDE_NOSPACE;
2170         }
2171     }
2172
2173   /* Unterminated string */
2174   return WRDE_SYNTAX;
2175 }
2176
2177 /*
2178  * wordfree() is to be called after pwordexp is finished with.
2179  */
2180
2181 void
2182 wordfree (wordexp_t *pwordexp)
2183 {
2184
2185   /* wordexp can set pwordexp to NULL */
2186   if (pwordexp && pwordexp->we_wordv)
2187     {
2188       char **wordv = pwordexp->we_wordv;
2189
2190       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2191         free (*wordv);
2192
2193       free (pwordexp->we_wordv);
2194       pwordexp->we_wordv = NULL;
2195     }
2196 }
2197 libc_hidden_def (wordfree)
2198
2199 /*
2200  * wordexp()
2201  */
2202
2203 int
2204 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2205 {
2206   size_t words_offset;
2207   size_t word_length;
2208   size_t max_length;
2209   char *word = w_newword (&word_length, &max_length);
2210   int error;
2211   char *ifs;
2212   char ifs_white[4];
2213   wordexp_t old_word = *pwordexp;
2214
2215   if (flags & WRDE_REUSE)
2216     {
2217       /* Minimal implementation of WRDE_REUSE for now */
2218       wordfree (pwordexp);
2219       old_word.we_wordv = NULL;
2220     }
2221
2222   if ((flags & WRDE_APPEND) == 0)
2223     {
2224       pwordexp->we_wordc = 0;
2225
2226       if (flags & WRDE_DOOFFS)
2227         {
2228           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2229           if (pwordexp->we_wordv == NULL)
2230             {
2231               error = WRDE_NOSPACE;
2232               goto do_error;
2233             }
2234         }
2235       else
2236         {
2237           pwordexp->we_wordv = calloc (1, sizeof (char *));
2238           if (pwordexp->we_wordv == NULL)
2239             {
2240               error = WRDE_NOSPACE;
2241               goto do_error;
2242             }
2243
2244           pwordexp->we_offs = 0;
2245         }
2246     }
2247
2248   /* Find out what the field separators are.
2249    * There are two types: whitespace and non-whitespace.
2250    */
2251   ifs = getenv ("IFS");
2252
2253   if (ifs == NULL)
2254     /* IFS unset - use <space><tab><newline>. */
2255     ifs = strcpy (ifs_white, " \t\n");
2256   else
2257     {
2258       char *ifsch = ifs;
2259       char *whch = ifs_white;
2260
2261       while (*ifsch != '\0')
2262         {
2263           if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2264             {
2265               /* Whitespace IFS.  See first whether it is already in our
2266                  collection.  */
2267               char *runp = ifs_white;
2268
2269               while (runp < whch && *runp != *ifsch)
2270                 ++runp;
2271
2272               if (runp == whch)
2273                 *whch++ = *ifsch;
2274             }
2275
2276           ++ifsch;
2277         }
2278       *whch = '\0';
2279     }
2280
2281   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2282     switch (words[words_offset])
2283       {
2284       case '\\':
2285         error = parse_backslash (&word, &word_length, &max_length, words,
2286                                  &words_offset);
2287
2288         if (error)
2289           goto do_error;
2290
2291         break;
2292
2293       case '$':
2294         error = parse_dollars (&word, &word_length, &max_length, words,
2295                                &words_offset, flags, pwordexp, ifs, ifs_white,
2296                                0);
2297
2298         if (error)
2299           goto do_error;
2300
2301         break;
2302
2303       case '`':
2304         ++words_offset;
2305         error = parse_backtick (&word, &word_length, &max_length, words,
2306                                 &words_offset, flags, pwordexp, ifs,
2307                                 ifs_white);
2308
2309         if (error)
2310           goto do_error;
2311
2312         break;
2313
2314       case '"':
2315         ++words_offset;
2316         error = parse_dquote (&word, &word_length, &max_length, words,
2317                               &words_offset, flags, pwordexp, ifs, ifs_white);
2318
2319         if (error)
2320           goto do_error;
2321
2322         if (!word_length)
2323           {
2324             error = w_addword (pwordexp, NULL);
2325
2326             if (error)
2327               return error;
2328           }
2329
2330         break;
2331
2332       case '\'':
2333         ++words_offset;
2334         error = parse_squote (&word, &word_length, &max_length, words,
2335                               &words_offset);
2336
2337         if (error)
2338           goto do_error;
2339
2340         if (!word_length)
2341           {
2342             error = w_addword (pwordexp, NULL);
2343
2344             if (error)
2345               return error;
2346           }
2347
2348         break;
2349
2350       case '~':
2351         error = parse_tilde (&word, &word_length, &max_length, words,
2352                              &words_offset, pwordexp->we_wordc);
2353
2354         if (error)
2355           goto do_error;
2356
2357         break;
2358
2359       case '*':
2360       case '[':
2361       case '?':
2362         error = parse_glob (&word, &word_length, &max_length, words,
2363                             &words_offset, flags, pwordexp, ifs, ifs_white);
2364
2365         if (error)
2366           goto do_error;
2367
2368         break;
2369
2370       default:
2371         /* Is it a word separator? */
2372         if (strchr (" \t", words[words_offset]) == NULL)
2373           {
2374             char ch = words[words_offset];
2375
2376             /* Not a word separator -- but is it a valid word char? */
2377             if (strchr ("\n|&;<>(){}", ch))
2378               {
2379                 /* Fail */
2380                 error = WRDE_BADCHAR;
2381                 goto do_error;
2382               }
2383
2384             /* "Ordinary" character -- add it to word */
2385             word = w_addchar (word, &word_length, &max_length,
2386                               ch);
2387             if (word == NULL)
2388               {
2389                 error = WRDE_NOSPACE;
2390                 goto do_error;
2391               }
2392
2393             break;
2394           }
2395
2396         /* If a word has been delimited, add it to the list. */
2397         if (word != NULL)
2398           {
2399             error = w_addword (pwordexp, word);
2400             if (error)
2401               goto do_error;
2402           }
2403
2404         word = w_newword (&word_length, &max_length);
2405       }
2406
2407   /* End of string */
2408
2409   /* There was a word separator at the end */
2410   if (word == NULL) /* i.e. w_newword */
2411     return 0;
2412
2413   /* There was no field separator at the end */
2414   return w_addword (pwordexp, word);
2415
2416 do_error:
2417   /* Error:
2418    *    free memory used (unless error is WRDE_NOSPACE), and
2419    *    set pwordexp members back to what they were.
2420    */
2421
2422   free (word);
2423
2424   if (error == WRDE_NOSPACE)
2425     return WRDE_NOSPACE;
2426
2427   if ((flags & WRDE_APPEND) == 0)
2428     wordfree (pwordexp);
2429
2430   *pwordexp = old_word;
2431   return error;
2432 }