posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997, 1998 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Library General Public License as
   8    published by the Free Software Foundation; either version 2 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Library General Public License for more details.
  15
  16    You should have received a copy of the GNU Library General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 #include <wordexp.h>
  22 #include <signal.h>
  23 #include <stdlib.h>
  24 #include <pwd.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <glob.h>
  28 #include <ctype.h>
  29 #include <sys/time.h>
  30 #include <sys/types.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <fcntl.h>
  34 #include <sys/stat.h>
  35 #include <paths.h>
  36 #include <errno.h>
  37 #include <sys/param.h>
  38 #include <stdio.h>
  39 #include <fnmatch.h>
  40
  41 #include <stdio-common/_itoa.h>
  42
  43 /* Undefine the following line for the production version.  */
  44 /* #define NDEBUG 1 */
  45 #include <assert.h>
  46
  47 /*
  48  * This is a recursive-descent-style word expansion routine.
  49  */
  50
  51 /* These variables are defined and initialized in the startup code.  */
  52 extern int __libc_argc;
  53 extern char **__libc_argv;
  54
  55 /* Some forward declarations */
  56 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  57                           const char *words, size_t *offset, int flags,
  58                           wordexp_t *pwordexp, const char *ifs,
  59                           const char *ifs_white, int quoted, int *fsplit)
  60      internal_function;
  61 static int parse_backtick (char **word, size_t *word_length,
  62                            size_t *max_length, const char *words,
  63                            size_t *offset, int flags, wordexp_t *pwordexp,
  64                            const char *ifs, const char *ifs_white)
  65      internal_function;
  66 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  67                          const char *words, size_t *offset, int flags,
  68                          wordexp_t *pwordexp, const char *ifs,
  69                          const char *ifs_white)
  70      internal_function;
  71 static int eval_expr (char *expr, long int *result) internal_function;
  72
  73 /* The w_*() functions manipulate word lists. */
  74
  75 #define W_CHUNK (100)
  76
  77 /* Result of w_newword will be ignored if it the last word. */
  78 static inline char *
  79 w_newword (size_t *actlen, size_t *maxlen)
  80 {
  81   *actlen = *maxlen = 0;
  82   return NULL;
  83 }
  84
  85 static inline char *
  86 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  87      /* (lengths exclude trailing zero) */
  88 {
  89   /* Add a character to the buffer, allocating room for it if needed.
  90    */
  91
  92   if (*actlen == *maxlen)
  93     {
  94       char *old_buffer = buffer;
  95       assert (buffer == NULL || *maxlen != 0);
  96       *maxlen += W_CHUNK;
  97       buffer = realloc (buffer, 1 + *maxlen);
  98
  99       if (buffer == NULL)
 100         free (old_buffer);
 101     }
 102
 103   if (buffer != NULL)
 104     {
 105       buffer[*actlen] = ch;
 106       buffer[++(*actlen)] = '\0';
 107     }
 108
 109   return buffer;
 110 }
 111
 112 static char *
 113 internal_function
 114 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 115           size_t len)
 116 {
 117   /* Add a string to the buffer, allocating room for it if needed.
 118    */
 119   if (*actlen + len > *maxlen)
 120     {
 121       char *old_buffer = buffer;
 122       assert (buffer == NULL || *maxlen != 0);
 123       *maxlen += MAX (2 * len, W_CHUNK);
 124       buffer = realloc (old_buffer, 1 + *maxlen);
 125
 126       if (buffer == NULL)
 127         free (old_buffer);
 128     }
 129
 130   if (buffer != NULL)
 131     {
 132       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 133       *actlen += len;
 134     }
 135
 136   return buffer;
 137 }
 138
 139 static char *
 140 internal_function
 141 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 142      /* (lengths exclude trailing zero) */
 143 {
 144   /* Add a string to the buffer, allocating room for it if needed.
 145    */
 146   size_t len;
 147
 148   assert (str != NULL); /* w_addstr only called from this file */
 149   len = strlen (str);
 150
 151   return w_addmem (buffer, actlen, maxlen, str, len);
 152 }
 153
 154 static int
 155 internal_function
 156 w_addword (wordexp_t *pwordexp, char *word)
 157 {
 158   /* Add a word to the wordlist */
 159   size_t num_p;
 160   char **new_wordv;
 161
 162   /* Internally, NULL acts like "".  Convert NULLs to "" before
 163    * the caller sees them.
 164    */
 165   if (word == NULL)
 166     {
 167       word = __strdup ("");
 168       if (word == NULL)
 169         goto no_space;
 170     }
 171
 172   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 173   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 174   if (new_wordv != NULL)
 175     {
 176       pwordexp->we_wordv = new_wordv;
 177       pwordexp->we_wordv[pwordexp->we_wordc++] = word;
 178       pwordexp->we_wordv[pwordexp->we_wordc] = NULL;
 179       return 0;
 180     }
 181
 182 no_space:
 183   return WRDE_NOSPACE;
 184 }
 185
 186 static int
 187 internal_function
 188 field_split_word (char *word, wordexp_t *pwordexp, const char *ifs,
 189                   const char *ifs_white)
 190 {
 191   size_t field_length;
 192   size_t field_maxlen;
 193   char *field = w_newword (&field_length, &field_maxlen);
 194   char *field_begin = word;
 195   int seen_nonws_ifs = 0;
 196
 197   if (!word)
 198     return 0;
 199
 200   do
 201     {
 202       char *field_end = field_begin;
 203       char *next_field;
 204
 205       /* If this isn't the first field, start a new word */
 206       if (field_begin != word)
 207         {
 208           if (w_addword (pwordexp, field) == WRDE_NOSPACE)
 209             goto no_space;
 210
 211           field = w_newword (&field_length, &field_maxlen);
 212         }
 213
 214       /* Skip IFS whitespace before the field */
 215       field_begin += strspn (field_begin, ifs_white);
 216
 217       if (!seen_nonws_ifs && *field_begin == 0)
 218         /* Nothing but whitespace */
 219         break;
 220
 221       /* Search for the end of the field */
 222       field_end = field_begin + strcspn (field_begin, ifs);
 223
 224       /* Set up pointer to the character after end of field and
 225          skip whitespace IFS after it. */
 226       next_field = field_end + strspn (field_end, ifs_white);
 227
 228       /* Skip at most one non-whitespace IFS character after the field */
 229       seen_nonws_ifs = 0;
 230       if (*next_field && strchr (ifs, *next_field))
 231         {
 232           seen_nonws_ifs = 1;
 233           next_field++;
 234         }
 235
 236       /* Null-terminate it */
 237       *field_end = 0;
 238
 239       /* Tag a copy onto the current word */
 240       field = w_addstr (field, &field_length, &field_maxlen, field_begin);
 241
 242       if (field == NULL && *field_begin != '\0')
 243         goto no_space;
 244
 245       field_begin = next_field;
 246     }
 247   while (seen_nonws_ifs || *field_begin);
 248
 249   if (field && w_addword (pwordexp, field))
 250     goto no_space;
 251
 252   return 0;
 253
 254 no_space:
 255   return WRDE_NOSPACE;
 256 }
 257
 258 /* The parse_*() functions should leave *offset being the offset in 'words'
 259  * to the last character processed.
 260  */
 261
 262 static int
 263 internal_function
 264 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 265                  const char *words, size_t *offset)
 266 {
 267   /* We are poised _at_ a backslash, not in quotes */
 268
 269   switch (words[1 + *offset])
 270     {
 271     case 0:
 272       /* Backslash is last character of input words */
 273       return WRDE_SYNTAX;
 274
 275     case '\n':
 276       ++(*offset);
 277       break;
 278
 279     default:
 280       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 281       if (*word == NULL)
 282         return WRDE_NOSPACE;
 283
 284       ++(*offset);
 285       break;
 286     }
 287
 288   return 0;
 289 }
 290
 291 static int
 292 internal_function
 293 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 294                      const char *words, size_t *offset)
 295 {
 296   /* We are poised _at_ a backslash, inside quotes */
 297
 298   switch (words[1 + *offset])
 299     {
 300     case 0:
 301       /* Backslash is last character of input words */
 302       return WRDE_SYNTAX;
 303
 304     case '\n':
 305       ++(*offset);
 306       break;
 307
 308     case '$':
 309     case '`':
 310     case '"':
 311     case '\\':
 312       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 313       if (*word == NULL)
 314         return WRDE_NOSPACE;
 315
 316       ++(*offset);
 317       break;
 318
 319     default:
 320       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 321       if (*word != NULL)
 322         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 323
 324       if (*word == NULL)
 325         return WRDE_NOSPACE;
 326
 327       ++(*offset);
 328       break;
 329     }
 330
 331   return 0;
 332 }
 333
 334 static int
 335 internal_function
 336 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 337              const char *words, size_t *offset, size_t wordc)
 338 {
 339   /* We are poised _at_ a tilde */
 340   size_t i;
 341
 342   if (*word_length != 0)
 343     {
 344       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 345         {
 346           if (!((*word)[*word_length - 1] == ':'
 347                 && strchr (*word, '=') && wordc == 0))
 348             {
 349               *word = w_addchar (*word, word_length, max_length, '~');
 350               return *word ? 0 : WRDE_NOSPACE;
 351             }
 352         }
 353     }
 354
 355   for (i = 1 + *offset; words[i]; i++)
 356     {
 357       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 358           words[i] == '\t' || words[i] == 0 )
 359         break;
 360
 361       if (words[i] == '\\')
 362         {
 363           *word = w_addchar (*word, word_length, max_length, '~');
 364           return *word ? 0 : WRDE_NOSPACE;
 365         }
 366     }
 367
 368   if (i == 1 + *offset)
 369     {
 370       /* Tilde appears on its own */
 371       uid_t uid;
 372       struct passwd pwd, *tpwd;
 373       int buflen = 1000;
 374       char* buffer = __alloca (buflen);
 375       int result;
 376
 377       uid = __getuid ();
 378
 379       while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 380              && errno == ERANGE)
 381         {
 382           buflen += 1000;
 383           buffer = __alloca (buflen);
 384         }
 385
 386       if (result == 0 && pwd.pw_dir != NULL)
 387         {
 388           *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 389           if (*word == NULL)
 390             return WRDE_NOSPACE;
 391         }
 392       else
 393         {
 394           *word = w_addchar (*word, word_length, max_length, '~');
 395           if (*word == NULL)
 396             return WRDE_NOSPACE;
 397         }
 398     }
 399   else
 400     {
 401       /* Look up user name in database to get home directory */
 402       char *user = __strndup (&words[1 + *offset], i - *offset);
 403       struct passwd pwd, *tpwd;
 404       int buflen = 1000;
 405       char* buffer = __alloca (buflen);
 406       int result;
 407
 408       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 409              && errno == ERANGE)
 410         {
 411           buflen += 1000;
 412           buffer = __alloca (buflen);
 413         }
 414
 415       if (result == 0 && pwd.pw_dir)
 416         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 417       else
 418         {
 419           /* (invalid login name) */
 420           *word = w_addchar (*word, word_length, max_length, '~');
 421           if (*word != NULL)
 422             *word = w_addstr (*word, word_length, max_length, user);
 423         }
 424
 425       *offset = i - 1;
 426     }
 427   return *word ? 0 : WRDE_NOSPACE;
 428 }
 429
 430
 431 static int
 432 internal_function
 433 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 434                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 435                const char *ifs_white)
 436 {
 437   int error;
 438   int match;
 439   glob_t globbuf;
 440
 441   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 442
 443   if (error != 0)
 444     {
 445       /* We can only run into memory problems.  */
 446       assert (error == GLOB_NOSPACE);
 447       return WRDE_NOSPACE;
 448     }
 449
 450   if (ifs && !*ifs)
 451     {
 452       /* No field splitting allowed. */
 453       assert (globbuf.gl_pathv[0] != NULL);
 454       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 455       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 456         {
 457           *word = w_addchar (*word, word_length, max_length, ' ');
 458           if (*word != NULL)
 459             *word = w_addstr (*word, word_length, max_length,
 460                               globbuf.gl_pathv[match]);
 461         }
 462
 463       globfree (&globbuf);
 464       return *word ? 0 : WRDE_NOSPACE;
 465     }
 466
 467   assert (ifs == NULL || *ifs != '\0');
 468   if (*word != NULL)
 469     {
 470       free (*word);
 471       *word = w_newword (word_length, max_length);
 472     }
 473
 474   for (match = 0; match < globbuf.gl_pathc; ++match)
 475     {
 476       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 477       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 478         {
 479           globfree (&globbuf);
 480           return WRDE_NOSPACE;
 481         }
 482     }
 483
 484   globfree (&globbuf);
 485   return 0;
 486 }
 487
 488 static int
 489 internal_function
 490 parse_glob (char **word, size_t *word_length, size_t *max_length,
 491             const char *words, size_t *offset, int flags,
 492             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 493 {
 494   /* We are poised just after a '*', a '[' or a '?'. */
 495   int error = WRDE_NOSPACE;
 496   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 497   int i;
 498   wordexp_t glob_list; /* List of words to glob */
 499   int fieldsplit = 0;
 500
 501   glob_list.we_wordc = 0;
 502   glob_list.we_wordv = NULL;
 503   glob_list.we_offs = 0;
 504   for (; words[*offset] != '\0'; ++*offset)
 505     {
 506       if (strchr (" \t\n", words[*offset]))
 507         /* Reached end of word */
 508         break;
 509
 510       /* Sort out quoting */
 511       if (words[*offset] == '\'')
 512         {
 513           if (quoted == 0)
 514             {
 515               quoted = 1;
 516               continue;
 517             }
 518           else if (quoted == 1)
 519             {
 520               quoted = 0;
 521               continue;
 522             }
 523         }
 524       else if (words[*offset] == '"')
 525         {
 526           if (quoted == 0)
 527             {
 528               quoted = 2;
 529               continue;
 530             }
 531           else if (quoted == 2)
 532             {
 533               quoted = 0;
 534               continue;
 535             }
 536         }
 537
 538       /* Sort out other special characters */
 539       if (quoted != 1 && words[*offset] == '$')
 540         {
 541           error = parse_dollars (word, word_length, max_length, words,
 542                                  offset, flags, &glob_list, ifs, ifs_white,
 543                                  quoted == 2, &fieldsplit);
 544           if (error)
 545             goto tidy_up;
 546
 547           continue;
 548         }
 549       else if (words[*offset] == '\\')
 550         {
 551           if (quoted)
 552             error = parse_qtd_backslash (word, word_length, max_length,
 553                                          words, offset);
 554           else
 555             error = parse_backslash (word, word_length, max_length,
 556                                      words, offset);
 557
 558           if (error)
 559             goto tidy_up;
 560
 561           continue;
 562         }
 563
 564       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 565       if (*word == NULL)
 566         goto tidy_up;
 567     }
 568
 569   /* Don't forget to re-parse the character we stopped at. */
 570   --*offset;
 571
 572   if (fieldsplit)
 573     {
 574       error = field_split_word (*word, &glob_list, ifs, ifs_white);
 575       if (*word)
 576         free (*word);
 577     }
 578   else
 579     error = w_addword (&glob_list, *word);
 580
 581   /* Glob the words */
 582   *word = w_newword (word_length, max_length);
 583   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 584     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 585                            max_length, pwordexp, ifs, ifs_white);
 586
 587   /* Now tidy up */
 588 tidy_up:
 589   wordfree (&glob_list);
 590   return error;
 591 }
 592
 593 static int
 594 internal_function
 595 parse_squote (char **word, size_t *word_length, size_t *max_length,
 596               const char *words, size_t *offset)
 597 {
 598   /* We are poised just after a single quote */
 599   for (; words[*offset]; ++(*offset))
 600     {
 601       if (words[*offset] != '\'')
 602         {
 603           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 604           if (*word == NULL)
 605             return WRDE_NOSPACE;
 606         }
 607       else return 0;
 608     }
 609
 610   /* Unterminated string */
 611   return WRDE_SYNTAX;
 612 }
 613
 614 /* Functions to evaluate an arithmetic expression */
 615 static int
 616 internal_function
 617 eval_expr_val (char **expr, long int *result)
 618 {
 619   int sgn = +1;
 620   char *digit;
 621
 622   /* Skip white space */
 623   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 624
 625   switch (*digit)
 626     {
 627     case '(':
 628
 629       /* Scan for closing paren */
 630       for (++digit; **expr && **expr != ')'; ++(*expr));
 631
 632       /* Is there one? */
 633       if (!**expr)
 634         return WRDE_SYNTAX;
 635
 636       *(*expr)++ = 0;
 637
 638       if (eval_expr (digit, result))
 639         return WRDE_SYNTAX;
 640
 641       return 0;
 642
 643     case '+':   /* Positive value */
 644       ++digit;
 645       break;
 646
 647     case '-':   /* Negative value */
 648       ++digit;
 649       sgn = -1;
 650       break;
 651
 652     default:
 653       if (!isdigit (*digit))
 654         return WRDE_SYNTAX;
 655     }
 656
 657   *result = 0;
 658   for (; *digit && isdigit (*digit); ++digit)
 659     *result = (*result * 10) + (*digit - '0');
 660
 661   *expr = digit;
 662   *result *= sgn;
 663   return 0;
 664 }
 665
 666 static int
 667 internal_function
 668 eval_expr_multdiv (char **expr, long int *result)
 669 {
 670   long int arg;
 671
 672   /* Read a Value */
 673   if (eval_expr_val (expr, result) != 0)
 674     return WRDE_SYNTAX;
 675
 676   while (**expr)
 677     {
 678       /* Skip white space */
 679       for (; *expr && **expr && isspace (**expr); ++(*expr));
 680
 681       if (**expr == '*')
 682         {
 683           ++(*expr);
 684           if (eval_expr_val (expr, &arg) != 0)
 685             return WRDE_SYNTAX;
 686
 687           *result *= arg;
 688         }
 689       else if (**expr == '/')
 690         {
 691           ++(*expr);
 692           if (eval_expr_val (expr, &arg) != 0)
 693             return WRDE_SYNTAX;
 694
 695           *result /= arg;
 696         }
 697       else break;
 698     }
 699
 700   return 0;
 701 }
 702
 703 static int
 704 internal_function
 705 eval_expr (char *expr, long int *result)
 706 {
 707   long int arg;
 708
 709   /* Read a Multdiv */
 710   if (eval_expr_multdiv (&expr, result) != 0)
 711     return WRDE_SYNTAX;
 712
 713   while (*expr)
 714     {
 715       /* Skip white space */
 716       for (; expr && *expr && isspace (*expr); ++expr);
 717
 718       if (*expr == '+')
 719         {
 720           ++expr;
 721           if (eval_expr_multdiv (&expr, &arg) != 0)
 722             return WRDE_SYNTAX;
 723
 724           *result += arg;
 725         }
 726       else if (*expr == '-')
 727         {
 728           ++expr;
 729           if (eval_expr_multdiv (&expr, &arg) != 0)
 730             return WRDE_SYNTAX;
 731
 732           *result -= arg;
 733         }
 734       else break;
 735     }
 736
 737   return 0;
 738 }
 739
 740 static int
 741 internal_function
 742 parse_arith (char **word, size_t *word_length, size_t *max_length,
 743              const char *words, size_t *offset, int flags, int bracket)
 744 {
 745   /* We are poised just after "$((" or "$[" */
 746   int error;
 747   int paren_depth = 1;
 748   size_t expr_length;
 749   size_t expr_maxlen;
 750   char *expr;
 751
 752   expr = w_newword (&expr_length, &expr_maxlen);
 753   for (; words[*offset]; ++(*offset))
 754     {
 755       switch (words[*offset])
 756         {
 757         case '$':
 758           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 759                                  words, offset, flags, NULL, NULL, NULL, 1,
 760                                  NULL);
 761           /* The ``1'' here is to tell parse_dollars not to
 762            * split the fields.
 763            */
 764           if (error)
 765             {
 766               free (expr);
 767               return error;
 768             }
 769           break;
 770
 771         case '`':
 772           (*offset)++;
 773           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 774                                   words, offset, flags, NULL, NULL, NULL);
 775           /* The first NULL here is to tell parse_backtick not to
 776            * split the fields.
 777            */
 778           if (error)
 779             {
 780               free (expr);
 781               return error;
 782             }
 783           break;
 784
 785         case '\\':
 786           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 787                                        words, offset);
 788           if (error)
 789             {
 790               free (expr);
 791               return error;
 792             }
 793           /* I think that a backslash within an
 794            * arithmetic expansion is bound to
 795            * cause an error sooner or later anyway though.
 796            */
 797           break;
 798
 799         case ')':
 800           if (--paren_depth == 0)
 801             {
 802               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 803               long int numresult = 0;
 804               long long int convertme;
 805
 806               if (bracket || words[1 + *offset] != ')')
 807                 {
 808                   free (expr);
 809                   return WRDE_SYNTAX;
 810                 }
 811
 812               ++(*offset);
 813
 814               /* Go - evaluate. */
 815               if (*expr && eval_expr (expr, &numresult) != 0)
 816                 {
 817                   free (expr);
 818                   return WRDE_SYNTAX;
 819                 }
 820
 821               if (numresult < 0)
 822                 {
 823                   convertme = -numresult;
 824                   *word = w_addchar (*word, word_length, max_length, '-');
 825                   if (!*word)
 826                     {
 827                       free (expr);
 828                       return WRDE_NOSPACE;
 829                     }
 830                 }
 831               else
 832                 convertme = numresult;
 833
 834               result[20] = '\0';
 835               *word = w_addstr (*word, word_length, max_length,
 836                                 _itoa (convertme, &result[20], 10, 0));
 837               free (expr);
 838               return *word ? 0 : WRDE_NOSPACE;
 839             }
 840           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 841           if (expr == NULL)
 842             return WRDE_NOSPACE;
 843
 844           break;
 845
 846         case ']':
 847           if (bracket && paren_depth == 1)
 848             {
 849               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 850               long int numresult = 0;
 851
 852               /* Go - evaluate. */
 853               if (*expr && eval_expr (expr, &numresult) != 0)
 854                 {
 855                   free (expr);
 856                   return WRDE_SYNTAX;
 857                 }
 858
 859               result[20] = '\0';
 860               *word = w_addstr (*word, word_length, max_length,
 861                                 _itoa_word (numresult, &result[20], 10, 0));
 862               free (expr);
 863               return *word ? 0 : WRDE_NOSPACE;
 864             }
 865
 866           free (expr);
 867           return WRDE_SYNTAX;
 868
 869         case '\n':
 870         case ';':
 871         case '{':
 872         case '}':
 873           free (expr);
 874           return WRDE_BADCHAR;
 875
 876         case '(':
 877           ++paren_depth;
 878         default:
 879           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 880           if (expr == NULL)
 881             return WRDE_NOSPACE;
 882         }
 883     }
 884
 885   /* Premature end */
 886   free (expr);
 887   return WRDE_SYNTAX;
 888 }
 889
 890 /* Function to execute a command and retrieve the results */
 891 /* pwordexp contains NULL if field-splitting is forbidden */
 892 static int
 893 internal_function
 894 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 895            int flags, wordexp_t *pwordexp, const char *ifs,
 896            const char *ifs_white)
 897 {
 898   int fildes[2];
 899   int bufsize = 128;
 900   int buflen;
 901   int i;
 902   char *buffer;
 903   pid_t pid;
 904
 905   /* Don't fork() unless necessary */
 906   if (!comm || !*comm)
 907     return 0;
 908
 909   if (__pipe (fildes))
 910     /* Bad */
 911     return WRDE_NOSPACE;
 912
 913   if ((pid = __fork ()) < 0)
 914     {
 915       /* Bad */
 916       __close (fildes[0]);
 917       __close (fildes[1]);
 918       return WRDE_NOSPACE;
 919     }
 920
 921   if (pid == 0)
 922     {
 923       /* Child */
 924       const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 925
 926       /* Redirect output.  */
 927       __dup2 (fildes[1], 1);
 928       __close (fildes[1]);
 929
 930       /* Redirect stderr to /dev/null if we have to.  */
 931       if ((flags & WRDE_SHOWERR) == 0)
 932         {
 933           int fd;
 934           __close (2);
 935           fd = __open (_PATH_DEVNULL, O_WRONLY);
 936           if (fd >= 0 && fd != 2)
 937             {
 938               __dup2 (fd, 2);
 939               __close (fd);
 940             }
 941         }
 942
 943       __close (fildes[0]);
 944       __execve (_PATH_BSHELL, (char *const *) args, __environ);
 945
 946       /* Bad.  What now?  */
 947       abort ();
 948     }
 949
 950   /* Parent */
 951
 952   __close (fildes[1]);
 953   buffer = __alloca (bufsize);
 954
 955   /* Read fildes[0] and put it into a word. */
 956   while (1)
 957     {
 958       if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 959         {
 960           if (__waitpid (pid, NULL, WNOHANG) == 0)
 961             continue;
 962           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 963             break;
 964         }
 965
 966       *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 967       if (*word == NULL)
 968         goto no_space;
 969     }
 970
 971   /* Bash chops off trailing newlines, which seems sensible.  */
 972   while (*word_length > 0 && (*word)[*word_length - 1] == '\n')
 973     {
 974       (*word)[--*word_length] = '\0';
 975
 976       /* If the last word was entirely newlines, turn it into a new word
 977        * which can be ignored if there's nothing following it. */
 978       if (*word_length == 0)
 979         {
 980           free (*word);
 981           *word = w_newword (word_length, max_length);
 982           break;
 983         }
 984     }
 985
 986   __close (fildes[0]);
 987   return 0;
 988
 989 no_space:
 990   __kill (pid, SIGKILL);
 991   __waitpid (pid, NULL, 0);
 992   __close (fildes[0]);
 993   return WRDE_NOSPACE;
 994 }
 995
 996 static int
 997 internal_function
 998 parse_comm (char **word, size_t *word_length, size_t *max_length,
 999             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1000             const char *ifs, const char *ifs_white)
1001 {
1002   /* We are poised just after "$(" */
1003   int paren_depth = 1;
1004   int error = 0;
1005   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1006   size_t comm_length;
1007   size_t comm_maxlen;
1008   char *comm = w_newword (&comm_length, &comm_maxlen);
1009
1010   for (; words[*offset]; ++(*offset))
1011     {
1012       switch (words[*offset])
1013         {
1014         case '\'':
1015           if (quoted == 0)
1016             quoted = 1;
1017           else if (quoted == 1)
1018             quoted = 0;
1019
1020           break;
1021
1022         case '"':
1023           if (quoted == 0)
1024             quoted = 2;
1025           else if (quoted == 2)
1026             quoted = 0;
1027
1028           break;
1029
1030         case ')':
1031           if (!quoted && --paren_depth == 0)
1032             {
1033               /* Go -- give script to the shell */
1034               if (comm)
1035                 {
1036                   error = exec_comm (comm, word, word_length, max_length,
1037                                      flags, pwordexp, ifs, ifs_white);
1038                   free (comm);
1039                 }
1040
1041               return error;
1042             }
1043
1044           /* This is just part of the script */
1045           break;
1046
1047         case '(':
1048           if (!quoted)
1049             ++paren_depth;
1050         }
1051
1052       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1053       if (comm == NULL)
1054         return WRDE_NOSPACE;
1055     }
1056
1057   /* Premature end */
1058   if (comm)
1059     free (comm);
1060
1061   return WRDE_SYNTAX;
1062 }
1063
1064 static int
1065 internal_function
1066 parse_param (char **word, size_t *word_length, size_t *max_length,
1067              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1068              const char *ifs, const char *ifs_white, int quoted)
1069 {
1070   /* We are poised just after "$" */
1071   enum action
1072   {
1073     ACT_NONE,
1074     ACT_RP_SHORT_LEFT = '#',
1075     ACT_RP_LONG_LEFT = 'L',
1076     ACT_RP_SHORT_RIGHT = '%',
1077     ACT_RP_LONG_RIGHT = 'R',
1078     ACT_NULL_ERROR = '?',
1079     ACT_NULL_SUBST = '-',
1080     ACT_NONNULL_SUBST = '+',
1081     ACT_NULL_ASSIGN = '='
1082   };
1083   size_t env_length;
1084   size_t env_maxlen;
1085   size_t pat_length;
1086   size_t pat_maxlen;
1087   size_t start = *offset;
1088   char *env;
1089   char *pattern;
1090   char *value = NULL;
1091   enum action action = ACT_NONE;
1092   int depth = 0;
1093   int colon_seen = 0;
1094   int seen_hash = 0;
1095   int free_value = 0;
1096   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1097   int error;
1098   int special = 0;
1099   char buffer[21];
1100   int brace = words[*offset] == '{';
1101
1102   env = w_newword (&env_length, &env_maxlen);
1103   pattern = w_newword (&pat_length, &pat_maxlen);
1104
1105   if (brace)
1106     ++*offset;
1107
1108   /* First collect the parameter name. */
1109
1110   if (words[*offset] == '#')
1111     {
1112       seen_hash = 1;
1113       if (!brace)
1114         goto envsubst;
1115       ++*offset;
1116     }
1117
1118   if (isalpha (words[*offset]) || words[*offset] == '_')
1119     {
1120       /* Normal parameter name. */
1121       do
1122         {
1123           env = w_addchar (env, &env_length, &env_maxlen,
1124                            words[*offset]);
1125           if (env == NULL)
1126             goto no_space;
1127         }
1128       while (isalnum (words[++*offset]) || words[*offset] == '_');
1129     }
1130   else if (isdigit (words[*offset]))
1131     {
1132       /* Numeric parameter name. */
1133       special = 1;
1134       do
1135         {
1136           env = w_addchar (env, &env_length, &env_maxlen,
1137                            words[*offset]);
1138           if (env == NULL)
1139             goto no_space;
1140           if (!brace)
1141             goto envsubst;
1142         }
1143       while (isdigit(words[++*offset]));
1144     }
1145   else if (strchr ("*@$", words[*offset]) != NULL)
1146     {
1147       /* Special parameter. */
1148       special = 1;
1149       env = w_addchar (env, &env_length, &env_maxlen,
1150                        words[*offset]);
1151       if (env == NULL)
1152         goto no_space;
1153       ++*offset;
1154     }
1155   else
1156     {
1157       if (brace)
1158         goto syntax;
1159     }
1160
1161   if (brace)
1162     {
1163       /* Check for special action to be applied to the value. */
1164       switch (words[*offset])
1165         {
1166         case '}':
1167           /* Evaluate. */
1168           goto envsubst;
1169
1170         case '#':
1171           action = ACT_RP_SHORT_LEFT;
1172           if (words[1 + *offset] == '#')
1173             {
1174               ++*offset;
1175               action = ACT_RP_LONG_LEFT;
1176             }
1177           break;
1178
1179         case '%':
1180           action = ACT_RP_SHORT_RIGHT;
1181           if (words[1 + *offset] == '%')
1182             {
1183               ++*offset;
1184               action = ACT_RP_LONG_RIGHT;
1185             }
1186           break;
1187
1188         case ':':
1189           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1190             goto syntax;
1191
1192           colon_seen = 1;
1193           action = words[++*offset];
1194           break;
1195
1196         case '-':
1197         case '=':
1198         case '?':
1199         case '+':
1200           action = words[*offset];
1201           break;
1202
1203         default:
1204           goto syntax;
1205         }
1206
1207       /* Now collect the pattern. */
1208       ++*offset;
1209       for (; words[*offset]; ++(*offset))
1210         {
1211           switch (words[*offset])
1212             {
1213             case '{':
1214               if (!pattern_is_quoted)
1215                 ++depth;
1216               break;
1217
1218             case '}':
1219               if (!pattern_is_quoted)
1220                 {
1221                   if (depth == 0)
1222                     goto envsubst;
1223                   --depth;
1224                 }
1225               break;
1226
1227             case '\\':
1228               if (!pattern_is_quoted && words[++*offset] == '\0')
1229                 goto syntax;
1230               break;
1231
1232             case '\'':
1233               if (pattern_is_quoted == 0)
1234                 pattern_is_quoted = 1;
1235               else if (pattern_is_quoted == 1)
1236                 pattern_is_quoted = 0;
1237
1238               break;
1239
1240             case '"':
1241               if (pattern_is_quoted == 0)
1242                 pattern_is_quoted = 2;
1243               else if (pattern_is_quoted == 2)
1244                 pattern_is_quoted = 0;
1245
1246               break;
1247             }
1248
1249           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1250                                words[*offset]);
1251           if (pattern == NULL)
1252             goto no_space;
1253         }
1254     }
1255
1256   /* End of input string -- remember to reparse the character that we
1257    * stopped at.  */
1258   --(*offset);
1259
1260 envsubst:
1261   if (words[start] == '{' && words[*offset] != '}')
1262     goto syntax;
1263
1264   if (env == NULL)
1265     {
1266       if (seen_hash)
1267         {
1268           /* $# expands to the number of positional parameters */
1269           buffer[20] = '\0';
1270           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1271           seen_hash = 0;
1272         }
1273       else
1274         {
1275           /* Just $ on its own */
1276           *offset = start - 1;
1277           *word = w_addchar (*word, word_length, max_length, '$');
1278           return *word ? 0 : WRDE_NOSPACE;
1279         }
1280     }
1281   /* Is it a numeric parameter? */
1282   else if (isdigit (env[0]))
1283     {
1284       int n = atoi (env);
1285
1286       if (n >= __libc_argc)
1287         /* Substitute NULL. */
1288         value = NULL;
1289       else
1290         /* Replace with appropriate positional parameter. */
1291         value = __libc_argv[n];
1292     }
1293   /* Is it a special parameter? */
1294   else if (special)
1295     {
1296       /* Is it `$$'? */
1297       if (*env == '$')
1298         {
1299           buffer[20] = '\0';
1300           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1301         }
1302       /* Is it `${#*}' or `${#@}'? */
1303       else if ((*env == '*' || *env == '@') && seen_hash)
1304         {
1305           buffer[20] = '\0';
1306           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1307                               &buffer[20], 10, 0);
1308           *word = w_addstr (*word, word_length, max_length, value);
1309           free (env);
1310           if (pattern)
1311             free (pattern);
1312           return *word ? 0 : WRDE_NOSPACE;
1313         }
1314       /* Is it `$*' or `$@' (unquoted) ? */
1315       else if (*env == '*' || (*env == '@' && !quoted))
1316         {
1317           size_t plist_len = 0;
1318           int p;
1319           char *end;
1320
1321           /* Build up value parameter by parameter (copy them) */
1322           for (p = 1; __libc_argv[p]; ++p)
1323             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1324           value = malloc (plist_len);
1325           if (value == NULL)
1326             goto no_space;
1327           end = value;
1328           *end = 0;
1329           for (p = 1; __libc_argv[p]; ++p)
1330             {
1331               if (p > 1)
1332                 *end++ = ' ';
1333               end = __stpcpy (end, __libc_argv[p]);
1334             }
1335
1336           free_value = 1;
1337         }
1338       else
1339         {
1340           /* Must be a quoted `$@' */
1341           assert (*env == '@' && quoted);
1342
1343           /* Each parameter is a separate word ("$@") */
1344           if (__libc_argc == 2)
1345             value = __libc_argv[1];
1346           else if (__libc_argc > 2)
1347             {
1348               int p;
1349
1350               /* Append first parameter to current word. */
1351               value = w_addstr (*word, word_length, max_length,
1352                                 __libc_argv[1]);
1353               if (value == NULL || w_addword (pwordexp, value))
1354                 goto no_space;
1355
1356               for (p = 2; __libc_argv[p + 1]; p++)
1357                 {
1358                   char *newword = __strdup (__libc_argv[p]);
1359                   if (newword == NULL || w_addword (pwordexp, newword))
1360                     goto no_space;
1361                 }
1362
1363               /* Start a new word with the last parameter. */
1364               *word = w_newword (word_length, max_length);
1365               value = __libc_argv[p];
1366             }
1367           else
1368             {
1369               free (env);
1370               free (pattern);
1371               return 0;
1372             }
1373         }
1374     }
1375   else
1376     value = getenv (env);
1377
1378   if (value == NULL && (flags & WRDE_UNDEF))
1379     {
1380       /* Variable not defined. */
1381       error = WRDE_BADVAL;
1382       goto do_error;
1383     }
1384
1385   if (action != ACT_NONE)
1386     {
1387       switch (action)
1388         {
1389         case ACT_RP_SHORT_LEFT:
1390         case ACT_RP_LONG_LEFT:
1391         case ACT_RP_SHORT_RIGHT:
1392         case ACT_RP_LONG_RIGHT:
1393           {
1394             char *p;
1395             char c;
1396             char *end;
1397
1398             if (value == NULL || pattern == NULL || *pattern == '\0')
1399               break;
1400
1401             end = value + strlen (value);
1402
1403             switch (action)
1404               {
1405               case ACT_RP_SHORT_LEFT:
1406                 for (p = value; p <= end; ++p)
1407                   {
1408                     c = *p;
1409                     *p = '\0';
1410                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1411                       {
1412                         *p = c;
1413                         if (free_value)
1414                           {
1415                             char *newval = __strdup (p);
1416                             if (newval == NULL)
1417                               {
1418                                 free (value);
1419                                 goto no_space;
1420                               }
1421                             free (value);
1422                             value = newval;
1423                           }
1424                         else
1425                           value = p;
1426                         break;
1427                       }
1428                     *p = c;
1429                   }
1430
1431                 break;
1432
1433               case ACT_RP_LONG_LEFT:
1434                 for (p = end; p >= value; --p)
1435                   {
1436                     c = *p;
1437                     *p = '\0';
1438                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1439                       {
1440                         *p = c;
1441                         if (free_value)
1442                           {
1443                             char *newval = __strdup (p);
1444                             if (newval == NULL)
1445                               {
1446                                 free (value);
1447                                 goto no_space;
1448                               }
1449                             free (value);
1450                             value = newval;
1451                           }
1452                         else
1453                           value = p;
1454                         break;
1455                       }
1456                     *p = c;
1457                   }
1458
1459                 break;
1460
1461               case ACT_RP_SHORT_RIGHT:
1462                 for (p = end; p >= value; --p)
1463                   {
1464                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1465                       {
1466                         char *newval;
1467                         newval = malloc (p - value + 1);
1468
1469                         if (newval == NULL)
1470                           {
1471                             if (free_value)
1472                               free (value);
1473                             goto no_space;
1474                           }
1475
1476                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1477                         if (free_value)
1478                           free (value);
1479                         value = newval;
1480                         free_value = 1;
1481                         break;
1482                       }
1483                   }
1484
1485                 break;
1486
1487               case ACT_RP_LONG_RIGHT:
1488                 for (p = value; p <= end; ++p)
1489                   {
1490                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1491                       {
1492                         char *newval;
1493                         newval = malloc (p - value + 1);
1494
1495                         if (newval == NULL)
1496                           {
1497                             if (free_value)
1498                               free (value);
1499                             goto no_space;
1500                           }
1501
1502                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1503                         if (free_value)
1504                           free (value);
1505                         value = newval;
1506                         free_value = 1;
1507                         break;
1508                       }
1509                   }
1510
1511                 break;
1512
1513               default:
1514                 break;
1515               }
1516
1517             break;
1518           }
1519
1520         case ACT_NULL_ERROR:
1521           if (value && *value)
1522             /* Substitute parameter */
1523             break;
1524
1525           if (!colon_seen && value)
1526             /* Substitute NULL */
1527             error = 0;
1528           else if (*pattern)
1529             {
1530               /* Expand 'pattern' and write it to stderr */
1531               wordexp_t we;
1532
1533               error = wordexp (pattern, &we, flags);
1534
1535               if (error == 0)
1536                 {
1537                   int i;
1538
1539                   fprintf (stderr, "%s:", env);
1540
1541                   for (i = 0; i < we.we_wordc; ++i)
1542                     {
1543                       fprintf (stderr, " %s", we.we_wordv[i]);
1544                     }
1545
1546                   fprintf (stderr, "\n");
1547                   error = WRDE_BADVAL;
1548                 }
1549
1550               wordfree (&we);
1551             }
1552           else
1553             {
1554               fprintf (stderr, "%s: parameter null or not set\n", env);
1555               error = WRDE_BADVAL;
1556             }
1557
1558           if (free_value)
1559             free (value);
1560           goto do_error;
1561
1562         case ACT_NULL_SUBST:
1563           if (value && *value)
1564             /* Substitute parameter */
1565             break;
1566
1567           if (!colon_seen && value)
1568             {
1569               /* Substitute NULL */
1570               if (free_value)
1571                 free (value);
1572               goto success;
1573             }
1574
1575         subst_word:
1576           {
1577             /* Substitute word */
1578             wordexp_t we;
1579             int i;
1580
1581             if (free_value)
1582               free (value);
1583
1584             if (quoted)
1585               {
1586                 /* No field-splitting is allowed, so imagine
1587                    quotes around the word.  */
1588                 char *qtd_pattern = malloc (3 + strlen (pattern));
1589                 if (qtd_pattern)
1590                   sprintf (qtd_pattern, "\"%s\"", pattern);
1591                 free (pattern);
1592                 pattern = qtd_pattern;
1593               }
1594
1595             if (pattern == NULL && (pattern = __strdup ("")) == NULL)
1596               goto no_space;
1597
1598             error = wordexp (pattern, &we, flags);
1599             if (error)
1600               goto do_error;
1601
1602             /* Fingers crossed that the quotes worked.. */
1603             assert (!quoted || we.we_wordc == 1);
1604
1605             /* Substitute */
1606             for (i = 0; i < we.we_wordc; ++i)
1607               if ((error = w_addword (pwordexp, __strdup (we.we_wordv[i])))
1608                   != 0)
1609                 break;
1610
1611             if (i < we.we_wordc)
1612               {
1613                 /* Ran out of space */
1614                 wordfree (&we);
1615                 goto do_error;
1616               }
1617
1618             if (action == ACT_NULL_ASSIGN)
1619               {
1620                 char *words;
1621                 char *cp;
1622                 size_t words_size = 0;
1623
1624                 if (special)
1625                   /* Cannot assign special parameters. */
1626                   goto syntax;
1627
1628                 for (i = 0; i < we.we_wordc; i++)
1629                   words_size += strlen (we.we_wordv[i]) + 1; /* for <space> */
1630                 words_size++;
1631
1632                 cp = words = __alloca (words_size);
1633                 *words = 0;
1634                 for (i = 0; i < we.we_wordc - 1; i++)
1635                   {
1636                     cp = __stpcpy (cp, we.we_wordv[i]);
1637                     *cp++ = ' ';
1638                   }
1639
1640                 strcpy (cp, we.we_wordv[i]);
1641
1642                 /* Also assign */
1643                 setenv (env, words, 1);
1644               }
1645
1646             wordfree (&we);
1647             goto success;
1648           }
1649
1650         case ACT_NONNULL_SUBST:
1651           if (value && *value)
1652             goto subst_word;
1653
1654           if (!colon_seen && value)
1655             goto subst_word;
1656
1657           /* Substitute NULL */
1658           if (free_value)
1659             free (value);
1660           goto success;
1661
1662         case ACT_NULL_ASSIGN:
1663           if (value && *value)
1664             /* Substitute parameter */
1665             break;
1666
1667           if (!colon_seen && value)
1668             {
1669               /* Substitute NULL */
1670               if (free_value)
1671                 free (value);
1672               goto success;
1673             }
1674
1675           /* This checks for '=' so it knows to assign */
1676           goto subst_word;
1677
1678         default:
1679           assert (! "Unrecognised action!");
1680         }
1681     }
1682
1683   free (env); env = NULL;
1684   free (pattern); pattern = NULL;
1685
1686   if (seen_hash)
1687     {
1688       char param_length[21];
1689       param_length[20] = '\0';
1690       *word = w_addstr (*word, word_length, max_length,
1691                         _itoa_word (value ? strlen (value) : 0,
1692                                     &param_length[20], 10, 0));
1693       if (free_value)
1694         {
1695           assert (value != NULL);
1696           free (value);
1697         }
1698
1699       return *word ? 0 : WRDE_NOSPACE;
1700     }
1701
1702   if (value == NULL)
1703     return 0;
1704
1705   *word = w_addstr (*word, word_length, max_length, value);
1706   if (free_value)
1707     free (value);
1708
1709   return *word ? 0 : WRDE_NOSPACE;
1710
1711 success:
1712   error = 0;
1713   goto do_error;
1714
1715 no_space:
1716   error = WRDE_NOSPACE;
1717   goto do_error;
1718
1719 syntax:
1720   error = WRDE_SYNTAX;
1721
1722 do_error:
1723   if (env)
1724     free (env);
1725
1726   if (pattern)
1727     free (pattern);
1728
1729   return error;
1730 }
1731
1732 static int
1733 internal_function
1734 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1735                const char *words, size_t *offset, int flags,
1736                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
1737                int quoted, int *fsplit)
1738 {
1739   /* We are poised _at_ "$" */
1740   switch (words[1 + *offset])
1741     {
1742     case '"':
1743     case '\'':
1744     case 0:
1745       *word = w_addchar (*word, word_length, max_length, '$');
1746       return *word ? 0 : WRDE_NOSPACE;
1747
1748     case '(':
1749       if (words[2 + *offset] == '(')
1750         {
1751           /* Differentiate between $((1+3)) and $((echo);(ls)) */
1752           int i = 3 + *offset;
1753           int depth = 0;
1754           while (words[i] && !(depth == 0 && words[i] == ')'))
1755             {
1756               if (words[i] == '(')
1757                 ++depth;
1758               else if (words[i] == ')')
1759                 --depth;
1760
1761               ++i;
1762             }
1763
1764           if (words[i] == ')' && words[i + 1] == ')')
1765             {
1766               (*offset) += 3;
1767
1768               /* This word is subject to field-splitting as long as
1769                * it isn't quoted. */
1770               if (fsplit)
1771                 *fsplit = !quoted;
1772
1773               /* Call parse_arith -- 0 is for "no brackets" */
1774               return parse_arith (word, word_length, max_length, words, offset,
1775                                   flags, 0);
1776             }
1777         }
1778
1779       if (flags & WRDE_NOCMD)
1780         return WRDE_CMDSUB;
1781
1782       (*offset) += 2;
1783
1784       /* This word is subject to field-splitting as long as
1785        * it isn't quoted. */
1786       if (fsplit)
1787         *fsplit = !quoted;
1788
1789       return parse_comm (word, word_length, max_length, words, offset, flags,
1790                          quoted? NULL : pwordexp, ifs, ifs_white);
1791
1792     case '[':
1793       (*offset) += 2;
1794
1795       /* This word is subject to field-splitting as long as
1796        * it isn't quoted. */
1797       if (fsplit)
1798         *fsplit = !quoted;
1799
1800       /* Call parse_arith -- 1 is for "brackets" */
1801       return parse_arith (word, word_length, max_length, words, offset, flags,
1802                           1);
1803
1804     case '{':
1805     default:
1806       ++(*offset);      /* parse_param needs to know if "{" is there */
1807
1808       /* This word is subject to field-splitting as long as
1809        * it isn't quoted. */
1810       if (fsplit)
1811         *fsplit = !quoted;
1812
1813       return parse_param (word, word_length, max_length, words, offset, flags,
1814                            pwordexp, ifs, ifs_white, quoted);
1815     }
1816 }
1817
1818 static int
1819 parse_backtick (char **word, size_t *word_length, size_t *max_length,
1820                 const char *words, size_t *offset, int flags,
1821                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
1822 {
1823   /* We are poised just after "`" */
1824   int error;
1825   int squoting = 0;
1826   size_t comm_length;
1827   size_t comm_maxlen;
1828   char *comm = w_newword (&comm_length, &comm_maxlen);
1829
1830   for (; words[*offset]; ++(*offset))
1831     {
1832       switch (words[*offset])
1833         {
1834         case '`':
1835           /* Go -- give the script to the shell */
1836           error = exec_comm (comm, word, word_length, max_length, flags,
1837                              pwordexp, ifs, ifs_white);
1838           free (comm);
1839           return error;
1840
1841         case '\\':
1842           if (squoting)
1843             {
1844               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
1845                                            words, offset);
1846
1847               if (error)
1848                 {
1849                   free (comm);
1850                   return error;
1851                 }
1852
1853               break;
1854             }
1855
1856           ++(*offset);
1857           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
1858                                    offset);
1859
1860           if (error)
1861             {
1862               free (comm);
1863               return error;
1864             }
1865
1866           break;
1867
1868         case '\'':
1869           squoting = 1 - squoting;
1870         default:
1871           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1872           if (comm == NULL)
1873             return WRDE_NOSPACE;
1874         }
1875     }
1876
1877   /* Premature end */
1878   free (comm);
1879   return WRDE_SYNTAX;
1880 }
1881
1882 static int
1883 internal_function
1884 parse_dquote (char **word, size_t *word_length, size_t *max_length,
1885               const char *words, size_t *offset, int flags,
1886               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
1887 {
1888   /* We are poised just after a double-quote */
1889   int error;
1890
1891   for (; words[*offset]; ++(*offset))
1892     {
1893       switch (words[*offset])
1894         {
1895         case '"':
1896           return 0;
1897
1898         case '$':
1899           error = parse_dollars (word, word_length, max_length, words, offset,
1900                                  flags, pwordexp, ifs, ifs_white, 1, NULL);
1901           /* The ``1'' here is to tell parse_dollars not to
1902            * split the fields.  It may need to, however ("$@").
1903            */
1904           if (error)
1905             return error;
1906
1907           break;
1908
1909         case '`':
1910           if (flags & WRDE_NOCMD)
1911             return WRDE_CMDSUB;
1912
1913           ++(*offset);
1914           error = parse_backtick (word, word_length, max_length, words,
1915                                   offset, flags, NULL, NULL, NULL);
1916           /* The first NULL here is to tell parse_backtick not to
1917            * split the fields.
1918            */
1919           if (error)
1920             return error;
1921
1922           break;
1923
1924         case '\\':
1925           error = parse_qtd_backslash (word, word_length, max_length, words,
1926                                        offset);
1927
1928           if (error)
1929             return error;
1930
1931           break;
1932
1933         default:
1934           *word = w_addchar (*word, word_length, max_length, words[*offset]);
1935           if (*word == NULL)
1936             return WRDE_NOSPACE;
1937         }
1938     }
1939
1940   /* Unterminated string */
1941   return WRDE_SYNTAX;
1942 }
1943
1944 /*
1945  * wordfree() is to be called after pwordexp is finished with.
1946  */
1947
1948 void
1949 wordfree (wordexp_t *pwordexp)
1950 {
1951
1952   /* wordexp can set pwordexp to NULL */
1953   if (pwordexp && pwordexp->we_wordv)
1954     {
1955       char **wordv = pwordexp->we_wordv;
1956
1957       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
1958         free (*wordv);
1959
1960       free (pwordexp->we_wordv);
1961       pwordexp->we_wordv = NULL;
1962     }
1963 }
1964
1965 /*
1966  * wordexp()
1967  */
1968
1969 int
1970 wordexp (const char *words, wordexp_t *pwordexp, int flags)
1971 {
1972   size_t wordv_offset;
1973   size_t words_offset;
1974   size_t word_length;
1975   size_t max_length;
1976   char *word = w_newword (&word_length, &max_length);
1977   int error;
1978   char *ifs;
1979   char ifs_white[4];
1980   char **old_wordv = pwordexp->we_wordv;
1981   size_t old_wordc = (flags & WRDE_REUSE) ? pwordexp->we_wordc : 0;
1982   int fieldsplit_this_word = 0;
1983
1984   if (flags & WRDE_REUSE)
1985     {
1986       /* Minimal implementation of WRDE_REUSE for now */
1987       wordfree (pwordexp);
1988       old_wordv = NULL;
1989     }
1990
1991   if (flags & WRDE_DOOFFS)
1992     {
1993       pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
1994       if (pwordexp->we_wordv == NULL)
1995         {
1996           error = WRDE_NOSPACE;
1997           goto do_error;
1998         }
1999     }
2000   else
2001     {
2002       pwordexp->we_wordv = calloc (1, sizeof (char *));
2003       if (pwordexp->we_wordv == NULL)
2004         {
2005           error = WRDE_NOSPACE;
2006           goto do_error;
2007         }
2008
2009       pwordexp->we_offs = 0;
2010     }
2011
2012   if ((flags & WRDE_APPEND) == 0)
2013     pwordexp->we_wordc = 0;
2014
2015   wordv_offset = pwordexp->we_offs + pwordexp->we_wordc;
2016
2017   /* Find out what the field separators are.
2018    * There are two types: whitespace and non-whitespace.
2019    */
2020   ifs = getenv ("IFS");
2021
2022   if (!ifs)
2023     /* IFS unset - use <space><tab><newline>. */
2024     ifs = strcpy (ifs_white, " \t\n");
2025   else
2026     {
2027       char *ifsch = ifs;
2028       char *whch = ifs_white;
2029
2030       /* Start off with no whitespace IFS characters */
2031       ifs_white[0] = '\0';
2032
2033       while (*ifsch != '\0')
2034         {
2035           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2036             {
2037               /* Whitespace IFS.  See first whether it is already in our
2038                  collection.  */
2039               char *runp = ifs_white;
2040
2041               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2042                 ++runp;
2043
2044               if (runp == whch)
2045                 *whch++ = *ifsch;
2046             }
2047
2048           ++ifsch;
2049         }
2050       *whch = '\0';
2051     }
2052
2053   fieldsplit_this_word = 0;
2054   for (words_offset = 0 ; ; ++words_offset)
2055     switch (words[words_offset])
2056       {
2057       case '\\':
2058         error = parse_backslash (&word, &word_length, &max_length, words,
2059                                  &words_offset);
2060
2061         if (error)
2062           goto do_error;
2063
2064         break;
2065
2066       case '$':
2067         error = parse_dollars (&word, &word_length, &max_length, words,
2068                                &words_offset, flags, pwordexp, ifs, ifs_white,
2069                                0, &fieldsplit_this_word);
2070
2071         if (error)
2072           goto do_error;
2073
2074         break;
2075
2076       case '`':
2077         if (flags & WRDE_NOCMD)
2078           {
2079             error = WRDE_CMDSUB;
2080             goto do_error;
2081           }
2082
2083         ++words_offset;
2084         error = parse_backtick (&word, &word_length, &max_length, words,
2085                                 &words_offset, flags, pwordexp, ifs,
2086                                 ifs_white);
2087
2088         if (error)
2089           goto do_error;
2090
2091         fieldsplit_this_word = 1;
2092
2093         break;
2094
2095       case '"':
2096         ++words_offset;
2097         error = parse_dquote (&word, &word_length, &max_length, words,
2098                               &words_offset, flags, pwordexp, ifs, ifs_white);
2099
2100         if (error)
2101           goto do_error;
2102
2103         break;
2104
2105       case '\'':
2106         ++words_offset;
2107         error = parse_squote (&word, &word_length, &max_length, words,
2108                               &words_offset);
2109
2110         if (error)
2111           goto do_error;
2112
2113         break;
2114
2115       case '~':
2116         error = parse_tilde (&word, &word_length, &max_length, words,
2117                              &words_offset, pwordexp->we_wordc);
2118
2119         if (error)
2120           goto do_error;
2121
2122         break;
2123
2124       case '*':
2125       case '[':
2126       case '?':
2127         error = parse_glob (&word, &word_length, &max_length, words,
2128                             &words_offset, flags, pwordexp, ifs, ifs_white);
2129
2130         if (error)
2131           goto do_error;
2132
2133         break;
2134
2135       default:
2136         /* Is it a word separator? */
2137         if (words[words_offset] != '\0' &&
2138             strchr (" \t", words[words_offset]) == NULL)
2139           {
2140             char ch = words[words_offset];
2141
2142             /* Not a word separator -- but is it a valid word char? */
2143             if (strchr ("\n|&;<>(){}", ch))
2144               {
2145                 /* Fail */
2146                 wordfree (pwordexp);
2147                 pwordexp->we_wordc = 0;
2148                 pwordexp->we_wordv = old_wordv;
2149                 return WRDE_BADCHAR;
2150               }
2151
2152             /* "Ordinary" character -- add it to word */
2153             word = w_addchar (word, &word_length, &max_length,
2154                               ch);
2155             if (word == NULL)
2156               {
2157                 error = WRDE_NOSPACE;
2158                 goto do_error;
2159               }
2160
2161             break;
2162           }
2163
2164         /* If a word has been delimited, add it to the list. */
2165         if (word != NULL)
2166           {
2167             if (fieldsplit_this_word)
2168               {
2169                 error = field_split_word (word, pwordexp, ifs, ifs_white);
2170                 free (word);
2171               }
2172             else
2173               error = w_addword (pwordexp, word);
2174
2175             if (error)
2176               goto do_error;
2177           }
2178
2179         fieldsplit_this_word = 0;
2180
2181         if (words[words_offset] == '\0')
2182           /* End of string. */
2183           goto end_of_string;
2184
2185         word = w_newword (&word_length, &max_length);
2186       }
2187
2188 end_of_string:
2189   return 0;
2190
2191 do_error:
2192   /* Error:
2193    *    free memory used (unless error is WRDE_NOSPACE), and
2194    *    set we_wordc and wd_wordv back to what they were.
2195    */
2196
2197   if (word != NULL)
2198     free (word);
2199
2200   if (error == WRDE_NOSPACE)
2201     return WRDE_NOSPACE;
2202
2203   wordfree (pwordexp);
2204   pwordexp->we_wordv = old_wordv;
2205   pwordexp->we_wordc = old_wordc;
2206   return error;
2207 }