posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997, 1998 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Library General Public License as
   8    published by the Free Software Foundation; either version 2 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Library General Public License for more details.
  15
  16    You should have received a copy of the GNU Library General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 #include <wordexp.h>
  22 #include <signal.h>
  23 #include <stdlib.h>
  24 #include <pwd.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <glob.h>
  28 #include <ctype.h>
  29 #include <sys/time.h>
  30 #include <sys/types.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <fcntl.h>
  34 #include <sys/stat.h>
  35 #include <paths.h>
  36 #include <errno.h>
  37 #include <sys/param.h>
  38 #include <stdio.h>
  39 #include <fnmatch.h>
  40
  41 #include <stdio-common/_itoa.h>
  42
  43 /* Undefine the following line for the production version.  */
  44 /* #define NDEBUG 1 */
  45 #include <assert.h>
  46
  47 /*
  48  * This is a recursive-descent-style word expansion routine.
  49  */
  50
  51 /* These variables are defined and initialized in the startup code.  */
  52 extern int __libc_argc;
  53 extern char **__libc_argv;
  54
  55 /* Some forward declarations */
  56 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  57                           const char *words, size_t *offset, int flags,
  58                           wordexp_t *pwordexp, const char *ifs,
  59                           const char *ifs_white, int quoted)
  60      internal_function;
  61 static int parse_backtick (char **word, size_t *word_length,
  62                            size_t *max_length, const char *words,
  63                            size_t *offset, int flags, wordexp_t *pwordexp,
  64                            const char *ifs, const char *ifs_white)
  65      internal_function;
  66 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  67                          const char *words, size_t *offset, int flags,
  68                          wordexp_t *pwordexp, const char *ifs,
  69                          const char *ifs_white)
  70      internal_function;
  71 static int eval_expr (char *expr, long int *result) internal_function;
  72
  73 /* The w_*() functions manipulate word lists. */
  74
  75 #define W_CHUNK (100)
  76
  77 static inline char *
  78 w_newword (size_t *actlen, size_t *maxlen)
  79 {
  80   *actlen = *maxlen = 0;
  81   return NULL;
  82 }
  83
  84 static inline char *
  85 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  86      /* (lengths exclude trailing zero) */
  87 {
  88   /* Add a character to the buffer, allocating room for it if needed.
  89    */
  90
  91   if (*actlen == *maxlen)
  92     {
  93       char *old_buffer = buffer;
  94       assert (buffer == NULL || *maxlen != 0);
  95       *maxlen += W_CHUNK;
  96       buffer = realloc (buffer, 1 + *maxlen);
  97
  98       if (buffer == NULL)
  99         free (old_buffer);
 100     }
 101
 102   if (buffer != NULL)
 103     {
 104       buffer[*actlen] = ch;
 105       buffer[++(*actlen)] = '\0';
 106     }
 107
 108   return buffer;
 109 }
 110
 111 static char *
 112 internal_function
 113 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 114           size_t len)
 115 {
 116   /* Add a string to the buffer, allocating room for it if needed.
 117    */
 118   if (*actlen + len > *maxlen)
 119     {
 120       char *old_buffer = buffer;
 121       assert (buffer == NULL || *maxlen != 0);
 122       *maxlen += MAX (2 * len, W_CHUNK);
 123       buffer = realloc (old_buffer, 1 + *maxlen);
 124
 125       if (buffer == NULL)
 126         free (old_buffer);
 127     }
 128
 129   if (buffer != NULL)
 130     {
 131       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 132       *actlen += len;
 133     }
 134
 135   return buffer;
 136 }
 137
 138
 139 static char *
 140 internal_function
 141 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 142      /* (lengths exclude trailing zero) */
 143 {
 144   /* Add a string to the buffer, allocating room for it if needed.
 145    */
 146   size_t len;
 147
 148   assert (str != NULL); /* w_addstr only called from this file */
 149   len = strlen (str);
 150
 151   return w_addmem (buffer, actlen, maxlen, str, len);
 152 }
 153
 154 static int
 155 internal_function
 156 w_addword (wordexp_t *pwordexp, char *word)
 157 {
 158   /* Add a word to the wordlist */
 159   size_t num_p;
 160   char **new_wordv;
 161
 162   /* Internally, NULL acts like "".  Convert NULLs to "" before
 163    * the caller sees them.
 164    */
 165   if (word == NULL)
 166     {
 167       word = __strdup ("");
 168       if (word == NULL)
 169         goto no_space;
 170     }
 171
 172   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 173   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 174   if (new_wordv != NULL)
 175     {
 176       pwordexp->we_wordv = new_wordv;
 177       pwordexp->we_wordv[pwordexp->we_wordc++] = word;
 178       pwordexp->we_wordv[pwordexp->we_wordc] = NULL;
 179       return 0;
 180     }
 181
 182 no_space:
 183   return WRDE_NOSPACE;
 184 }
 185
 186 /* The parse_*() functions should leave *offset being the offset in 'words'
 187  * to the last character processed.
 188  */
 189
 190 static int
 191 internal_function
 192 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 193                  const char *words, size_t *offset)
 194 {
 195   /* We are poised _at_ a backslash, not in quotes */
 196
 197   switch (words[1 + *offset])
 198     {
 199     case 0:
 200       /* Backslash is last character of input words */
 201       return WRDE_SYNTAX;
 202
 203     case '\n':
 204       ++(*offset);
 205       break;
 206
 207     default:
 208       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 209       if (*word == NULL)
 210         return WRDE_NOSPACE;
 211
 212       ++(*offset);
 213       break;
 214     }
 215
 216   return 0;
 217 }
 218
 219 static int
 220 internal_function
 221 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 222                      const char *words, size_t *offset)
 223 {
 224   /* We are poised _at_ a backslash, inside quotes */
 225
 226   switch (words[1 + *offset])
 227     {
 228     case 0:
 229       /* Backslash is last character of input words */
 230       return WRDE_SYNTAX;
 231
 232     case '\n':
 233       ++(*offset);
 234       break;
 235
 236     case '$':
 237     case '`':
 238     case '"':
 239     case '\\':
 240       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 241       if (*word == NULL)
 242         return WRDE_NOSPACE;
 243
 244       ++(*offset);
 245       break;
 246
 247     default:
 248       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 249       if (*word != NULL)
 250         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 251
 252       if (*word == NULL)
 253         return WRDE_NOSPACE;
 254
 255       ++(*offset);
 256       break;
 257     }
 258
 259   return 0;
 260 }
 261
 262 static int
 263 internal_function
 264 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 265              const char *words, size_t *offset, size_t wordc)
 266 {
 267   /* We are poised _at_ a tilde */
 268   size_t i;
 269
 270   if (*word_length != 0)
 271     {
 272       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 273         {
 274           if (!((*word)[*word_length - 1] == ':'
 275                 && strchr (*word, '=') && wordc == 0))
 276             {
 277               *word = w_addchar (*word, word_length, max_length, '~');
 278               return *word ? 0 : WRDE_NOSPACE;
 279             }
 280         }
 281     }
 282
 283   for (i = 1 + *offset; words[i]; i++)
 284     {
 285       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 286           words[i] == '\t' || words[i] == 0 )
 287         break;
 288
 289       if (words[i] == '\\')
 290         {
 291           *word = w_addchar (*word, word_length, max_length, '~');
 292           return *word ? 0 : WRDE_NOSPACE;
 293         }
 294     }
 295
 296   if (i == 1 + *offset)
 297     {
 298       /* Tilde appears on its own */
 299       uid_t uid;
 300       struct passwd pwd, *tpwd;
 301       int buflen = 1000;
 302       char* buffer = __alloca (buflen);
 303       int result;
 304
 305       uid = __getuid ();
 306
 307       while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 308              && errno == ERANGE)
 309         {
 310           buflen += 1000;
 311           buffer = __alloca (buflen);
 312         }
 313
 314       if (result == 0 && pwd.pw_dir != NULL)
 315         {
 316           *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 317           if (*word == NULL)
 318             return WRDE_NOSPACE;
 319         }
 320       else
 321         {
 322           *word = w_addchar (*word, word_length, max_length, '~');
 323           if (*word == NULL)
 324             return WRDE_NOSPACE;
 325         }
 326     }
 327   else
 328     {
 329       /* Look up user name in database to get home directory */
 330       char *user = __strndup (&words[1 + *offset], i - *offset);
 331       struct passwd pwd, *tpwd;
 332       int buflen = 1000;
 333       char* buffer = __alloca (buflen);
 334       int result;
 335
 336       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 337              && errno == ERANGE)
 338         {
 339           buflen += 1000;
 340           buffer = __alloca (buflen);
 341         }
 342
 343       if (result == 0 && pwd.pw_dir)
 344         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 345       else
 346         {
 347           /* (invalid login name) */
 348           *word = w_addchar (*word, word_length, max_length, '~');
 349           if (*word != NULL)
 350             *word = w_addstr (*word, word_length, max_length, user);
 351         }
 352
 353       *offset = i - 1;
 354     }
 355   return *word ? 0 : WRDE_NOSPACE;
 356 }
 357
 358
 359 static int
 360 internal_function
 361 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 362                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 363                const char *ifs_white)
 364 {
 365   int error;
 366   int match;
 367   glob_t globbuf;
 368
 369   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 370
 371   if (error != 0)
 372     {
 373       /* We can only run into memory problems.  */
 374       assert (error == GLOB_NOSPACE);
 375       return WRDE_NOSPACE;
 376     }
 377
 378   if (ifs && !*ifs)
 379     {
 380       /* No field splitting allowed. */
 381       assert (globbuf.gl_pathv[0] != NULL);
 382       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 383       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 384         {
 385           *word = w_addchar (*word, word_length, max_length, ' ');
 386           if (*word != NULL)
 387             *word = w_addstr (*word, word_length, max_length,
 388                               globbuf.gl_pathv[match]);
 389         }
 390
 391       globfree (&globbuf);
 392       return *word ? 0 : WRDE_NOSPACE;
 393     }
 394
 395   assert (ifs == NULL || *ifs != '\0');
 396   if (*word != NULL)
 397     {
 398       free (*word);
 399       *word = w_newword (word_length, max_length);
 400     }
 401
 402   for (match = 0; match < globbuf.gl_pathc; ++match)
 403     {
 404       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 405       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 406         {
 407           globfree (&globbuf);
 408           return WRDE_NOSPACE;
 409         }
 410     }
 411
 412   globfree (&globbuf);
 413   return 0;
 414 }
 415
 416 static int
 417 internal_function
 418 parse_glob (char **word, size_t *word_length, size_t *max_length,
 419             const char *words, size_t *offset, int flags,
 420             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 421 {
 422   /* We are poised just after a '*', a '[' or a '?'. */
 423   int error = WRDE_NOSPACE;
 424   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 425   int i;
 426   wordexp_t glob_list; /* List of words to glob */
 427
 428   glob_list.we_wordc = 0;
 429   glob_list.we_wordv = NULL;
 430   glob_list.we_offs = 0;
 431   for (; words[*offset] != '\0'; ++*offset)
 432     {
 433       if ((ifs && strchr (ifs, words[*offset])) ||
 434           (!ifs && strchr (" \t\n", words[*offset])))
 435         /* Reached IFS */
 436         break;
 437
 438       /* Sort out quoting */
 439       if (words[*offset] == '\'')
 440         {
 441           if (quoted == 0)
 442             {
 443               quoted = 1;
 444               continue;
 445             }
 446           else if (quoted == 1)
 447             {
 448               quoted = 0;
 449               continue;
 450             }
 451         }
 452       else if (words[*offset] == '"')
 453         {
 454           if (quoted == 0)
 455             {
 456               quoted = 2;
 457               continue;
 458             }
 459           else if (quoted == 2)
 460             {
 461               quoted = 0;
 462               continue;
 463             }
 464         }
 465
 466       /* Sort out other special characters */
 467       if (quoted != 1 && words[*offset] == '$')
 468         {
 469           error = parse_dollars (word, word_length, max_length, words,
 470                                  offset, flags, &glob_list, ifs, ifs_white,
 471                                  quoted == 2);
 472           if (error)
 473             goto tidy_up;
 474
 475           continue;
 476         }
 477       else if (words[*offset] == '\\')
 478         {
 479           if (quoted)
 480             error = parse_qtd_backslash (word, word_length, max_length,
 481                                          words, offset);
 482           else
 483             error = parse_backslash (word, word_length, max_length,
 484                                      words, offset);
 485
 486           if (error)
 487             goto tidy_up;
 488
 489           continue;
 490         }
 491
 492       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 493       if (*word == NULL)
 494         goto tidy_up;
 495     }
 496
 497   /* Don't forget to re-parse the character we stopped at. */
 498   --*offset;
 499
 500   /* Glob the words */
 501   error = w_addword (&glob_list, *word);
 502   *word = w_newword (word_length, max_length);
 503   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 504     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 505                            max_length, pwordexp, ifs, ifs_white);
 506
 507   /* Now tidy up */
 508 tidy_up:
 509   wordfree (&glob_list);
 510   return error;
 511 }
 512
 513 static int
 514 internal_function
 515 parse_squote (char **word, size_t *word_length, size_t *max_length,
 516               const char *words, size_t *offset)
 517 {
 518   /* We are poised just after a single quote */
 519   for (; words[*offset]; ++(*offset))
 520     {
 521       if (words[*offset] != '\'')
 522         {
 523           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 524           if (*word == NULL)
 525             return WRDE_NOSPACE;
 526         }
 527       else return 0;
 528     }
 529
 530   /* Unterminated string */
 531   return WRDE_SYNTAX;
 532 }
 533
 534 /* Functions to evaluate an arithmetic expression */
 535 static int
 536 internal_function
 537 eval_expr_val (char **expr, long int *result)
 538 {
 539   int sgn = +1;
 540   char *digit;
 541
 542   /* Skip white space */
 543   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 544
 545   switch (*digit)
 546     {
 547     case '(':
 548
 549       /* Scan for closing paren */
 550       for (++digit; **expr && **expr != ')'; ++(*expr));
 551
 552       /* Is there one? */
 553       if (!**expr)
 554         return WRDE_SYNTAX;
 555
 556       *(*expr)++ = 0;
 557
 558       if (eval_expr (digit, result))
 559         return WRDE_SYNTAX;
 560
 561       return 0;
 562
 563     case '+':   /* Positive value */
 564       ++digit;
 565       break;
 566
 567     case '-':   /* Negative value */
 568       ++digit;
 569       sgn = -1;
 570       break;
 571
 572     default:
 573       if (!isdigit (*digit))
 574         return WRDE_SYNTAX;
 575     }
 576
 577   *result = 0;
 578   for (; *digit && isdigit (*digit); ++digit)
 579     *result = (*result * 10) + (*digit - '0');
 580
 581   *expr = digit;
 582   *result *= sgn;
 583   return 0;
 584 }
 585
 586 static int
 587 internal_function
 588 eval_expr_multdiv (char **expr, long int *result)
 589 {
 590   long int arg;
 591
 592   /* Read a Value */
 593   if (eval_expr_val (expr, result) != 0)
 594     return WRDE_SYNTAX;
 595
 596   while (**expr)
 597     {
 598       /* Skip white space */
 599       for (; *expr && **expr && isspace (**expr); ++(*expr));
 600
 601       if (**expr == '*')
 602         {
 603           ++(*expr);
 604           if (eval_expr_val (expr, &arg) != 0)
 605             return WRDE_SYNTAX;
 606
 607           *result *= arg;
 608         }
 609       else if (**expr == '/')
 610         {
 611           ++(*expr);
 612           if (eval_expr_val (expr, &arg) != 0)
 613             return WRDE_SYNTAX;
 614
 615           *result /= arg;
 616         }
 617       else break;
 618     }
 619
 620   return 0;
 621 }
 622
 623 static int
 624 internal_function
 625 eval_expr (char *expr, long int *result)
 626 {
 627   long int arg;
 628
 629   /* Read a Multdiv */
 630   if (eval_expr_multdiv (&expr, result) != 0)
 631     return WRDE_SYNTAX;
 632
 633   while (*expr)
 634     {
 635       /* Skip white space */
 636       for (; expr && *expr && isspace (*expr); ++expr);
 637
 638       if (*expr == '+')
 639         {
 640           ++expr;
 641           if (eval_expr_multdiv (&expr, &arg) != 0)
 642             return WRDE_SYNTAX;
 643
 644           *result += arg;
 645         }
 646       else if (*expr == '-')
 647         {
 648           ++expr;
 649           if (eval_expr_multdiv (&expr, &arg) != 0)
 650             return WRDE_SYNTAX;
 651
 652           *result -= arg;
 653         }
 654       else break;
 655     }
 656
 657   return 0;
 658 }
 659
 660 static int
 661 internal_function
 662 parse_arith (char **word, size_t *word_length, size_t *max_length,
 663              const char *words, size_t *offset, int flags, int bracket)
 664 {
 665   /* We are poised just after "$((" or "$[" */
 666   int error;
 667   int paren_depth = 1;
 668   size_t expr_length;
 669   size_t expr_maxlen;
 670   char *expr;
 671
 672   expr = w_newword (&expr_length, &expr_maxlen);
 673   for (; words[*offset]; ++(*offset))
 674     {
 675       switch (words[*offset])
 676         {
 677         case '$':
 678           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 679                                  words, offset, flags, NULL, NULL, NULL, 1);
 680           /* The ``1'' here is to tell parse_dollars not to
 681            * split the fields.
 682            */
 683           if (error)
 684             {
 685               free (expr);
 686               return error;
 687             }
 688           break;
 689
 690         case '`':
 691           (*offset)++;
 692           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 693                                   words, offset, flags, NULL, NULL, NULL);
 694           /* The first NULL here is to tell parse_backtick not to
 695            * split the fields.
 696            */
 697           if (error)
 698             {
 699               free (expr);
 700               return error;
 701             }
 702           break;
 703
 704         case '\\':
 705           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 706                                        words, offset);
 707           if (error)
 708             {
 709               free (expr);
 710               return error;
 711             }
 712           /* I think that a backslash within an
 713            * arithmetic expansion is bound to
 714            * cause an error sooner or later anyway though.
 715            */
 716           break;
 717
 718         case ')':
 719           if (--paren_depth == 0)
 720             {
 721               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 722               long int numresult = 0;
 723               long long int convertme;
 724
 725               if (bracket || words[1 + *offset] != ')')
 726                 return WRDE_SYNTAX;
 727
 728               ++(*offset);
 729
 730               /* Go - evaluate. */
 731               if (*expr && eval_expr (expr, &numresult) != 0)
 732                 return WRDE_SYNTAX;
 733
 734               if (numresult < 0)
 735                 {
 736                   convertme = -numresult;
 737                   *word = w_addchar (*word, word_length, max_length, '-');
 738                   if (!*word)
 739                     {
 740                       free (expr);
 741                       return WRDE_NOSPACE;
 742                     }
 743                 }
 744               else
 745                 convertme = numresult;
 746
 747               result[20] = '\0';
 748               *word = w_addstr (*word, word_length, max_length,
 749                                 _itoa (convertme, &result[20], 10, 0));
 750               free (expr);
 751               return *word ? 0 : WRDE_NOSPACE;
 752             }
 753           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 754           if (expr == NULL)
 755             return WRDE_NOSPACE;
 756
 757           break;
 758
 759         case ']':
 760           if (bracket && paren_depth == 1)
 761             {
 762               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 763               long int numresult = 0;
 764
 765               /* Go - evaluate. */
 766               if (*expr && eval_expr (expr, &numresult) != 0)
 767                 return WRDE_SYNTAX;
 768
 769               result[20] = '\0';
 770               *word = w_addstr (*word, word_length, max_length,
 771                                 _itoa_word (numresult, &result[20], 10, 0));
 772               free (expr);
 773               return *word ? 0 : WRDE_NOSPACE;
 774             }
 775
 776           free (expr);
 777           return WRDE_SYNTAX;
 778
 779         case '\n':
 780         case ';':
 781         case '{':
 782         case '}':
 783           free (expr);
 784           return WRDE_BADCHAR;
 785
 786         case '(':
 787           ++paren_depth;
 788         default:
 789           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 790           if (expr == NULL)
 791             return WRDE_NOSPACE;
 792         }
 793     }
 794
 795   /* Premature end */
 796   free (expr);
 797   return WRDE_SYNTAX;
 798 }
 799
 800 /* Function to execute a command and retrieve the results */
 801 /* pwordexp contains NULL if field-splitting is forbidden */
 802 static int
 803 internal_function
 804 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 805            int flags, wordexp_t *pwordexp, const char *ifs,
 806            const char *ifs_white)
 807 {
 808   int fildes[2];
 809   int bufsize = 128;
 810   int buflen;
 811   int i;
 812   char *buffer;
 813   pid_t pid;
 814
 815   /* Don't fork() unless necessary */
 816   if (!comm || !*comm)
 817     return 0;
 818
 819   if (__pipe (fildes))
 820     /* Bad */
 821     return WRDE_NOSPACE;
 822
 823   if ((pid = __fork ()) < 0)
 824     {
 825       /* Bad */
 826       return WRDE_NOSPACE;
 827     }
 828
 829   if (pid == 0)
 830     {
 831       /* Child */
 832       const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 833
 834       /* Redirect output.  */
 835       __dup2 (fildes[1], 1);
 836       __close (fildes[1]);
 837
 838       /* Redirect stderr to /dev/null if we have to.  */
 839       if ((flags & WRDE_SHOWERR) == 0)
 840         {
 841           int fd;
 842           __close (2);
 843           fd = __open (_PATH_DEVNULL, O_WRONLY);
 844           if (fd >= 0 && fd != 2)
 845             {
 846               __dup2 (fd, 2);
 847               __close (fd);
 848             }
 849         }
 850
 851       __close (fildes[0]);
 852       __execve (_PATH_BSHELL, (char *const *) args, __environ);
 853
 854       /* Bad.  What now?  */
 855       abort ();
 856     }
 857
 858   /* Parent */
 859
 860   __close (fildes[1]);
 861   buffer = __alloca (bufsize);
 862
 863   if (!pwordexp)
 864     { /* Quoted - no field splitting */
 865
 866       while (1)
 867         {
 868           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 869             {
 870               if (__waitpid (pid, NULL, WNOHANG) == 0)
 871                 continue;
 872               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 873                 break;
 874             }
 875
 876           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 877           if (*word == NULL)
 878             {
 879               __kill (pid, SIGKILL);
 880               __waitpid (pid, NULL, 0);
 881               __close (fildes[0]);
 882               return WRDE_NOSPACE;
 883             }
 884         }
 885     }
 886   else
 887     /* Not quoted - split fields */
 888     {
 889       int copying = 0;
 890       /* 'copying' is:
 891        *  0 when searching for first character in a field not IFS white space
 892        *  1 when copying the text of a field
 893        *  2 when searching for possible non-whitespace IFS
 894        */
 895
 896       while (1)
 897         {
 898           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 899             {
 900               if (__waitpid (pid, NULL, WNOHANG) == 0)
 901                 continue;
 902               if ((__read (fildes[0], buffer, bufsize)) < 1)
 903                 break;
 904             }
 905
 906           for (i = 0; i < buflen; ++i)
 907             {
 908               if (strchr (ifs, buffer[i]) != NULL)
 909                 {
 910                   /* Current character is IFS */
 911                   if (strchr (ifs_white, buffer[i]) == NULL)
 912                     {
 913                       /* Current character is IFS but not whitespace */
 914                       if (copying == 2)
 915                         {
 916                           /*            current character
 917                            *                   |
 918                            *                   V
 919                            * eg: text<space><comma><space>moretext
 920                            *
 921                            * So, strip whitespace IFS (like at the start)
 922                            */
 923                           copying = 0;
 924                           continue;
 925                         }
 926
 927                       copying = 0;
 928                       /* fall through and delimit field.. */
 929                     }
 930                   else
 931                     {
 932                       /* Current character is IFS white space */
 933
 934                       /* If not copying a field, ignore it */
 935                       if (copying != 1)
 936                         continue;
 937
 938                       /* End of field (search for non-IFS afterwards) */
 939                       copying = 2;
 940                     }
 941
 942                   /* First IFS white space, or IFS non-whitespace.
 943                    * Delimit the field. */
 944                   if (!*word)
 945                     {
 946                       /* This field is null, so make it an empty string */
 947                       *word = w_addchar (*word, word_length, max_length, 0);
 948                       if (*word == NULL)
 949                         {
 950                           __kill (pid, SIGKILL);
 951                           __waitpid (pid, NULL, 0);
 952                           __close (fildes[0]);
 953                           return WRDE_NOSPACE;
 954                         }
 955                     }
 956
 957                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
 958                     {
 959                       __kill (pid, SIGKILL);
 960                       __waitpid (pid, NULL, 0);
 961                       __close (fildes[0]);
 962                       return WRDE_NOSPACE;
 963                     }
 964
 965                   *word = w_newword (word_length, max_length);
 966                   /* fall back round the loop.. */
 967                 }
 968               else
 969                 {
 970                   /* Not IFS character */
 971                   copying = 1;
 972                   *word = w_addchar (*word, word_length, max_length,
 973                                      buffer[i]);
 974                   if (*word == NULL)
 975                     {
 976                       __kill (pid, SIGKILL);
 977                       __waitpid (pid, NULL, 0);
 978                       __close (fildes[0]);
 979                       return WRDE_NOSPACE;
 980                     }
 981                 }
 982             }
 983         }
 984     }
 985
 986   /* Bash chops off trailing newlines, which seems sensible.  */
 987   while (*word_length > 0 && (*word)[*word_length - 1] == '\n')
 988     (*word)[--*word_length] = '\0';
 989
 990   __close (fildes[0]);
 991   return 0;
 992 }
 993
 994 static int
 995 internal_function
 996 parse_comm (char **word, size_t *word_length, size_t *max_length,
 997             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
 998             const char *ifs, const char *ifs_white)
 999 {
1000   /* We are poised just after "$(" */
1001   int paren_depth = 1;
1002   int error = 0;
1003   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1004   size_t comm_length;
1005   size_t comm_maxlen;
1006   char *comm = w_newword (&comm_length, &comm_maxlen);
1007
1008   for (; words[*offset]; ++(*offset))
1009     {
1010       switch (words[*offset])
1011         {
1012         case '\'':
1013           if (quoted == 0)
1014             quoted = 1;
1015           else if (quoted == 1)
1016             quoted = 0;
1017
1018           break;
1019
1020         case '"':
1021           if (quoted == 0)
1022             quoted = 2;
1023           else if (quoted == 2)
1024             quoted = 0;
1025
1026           break;
1027
1028         case ')':
1029           if (!quoted && --paren_depth == 0)
1030             {
1031               /* Go -- give script to the shell */
1032               if (comm)
1033                 {
1034                   error = exec_comm (comm, word, word_length, max_length,
1035                                      flags, pwordexp, ifs, ifs_white);
1036                   free (comm);
1037                 }
1038
1039               return error;
1040             }
1041
1042           /* This is just part of the script */
1043           break;
1044
1045         case '(':
1046           if (!quoted)
1047             ++paren_depth;
1048         }
1049
1050       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1051       if (comm == NULL)
1052         return WRDE_NOSPACE;
1053     }
1054
1055   /* Premature end */
1056   if (comm)
1057     free (comm);
1058
1059   return WRDE_SYNTAX;
1060 }
1061
1062 static int
1063 internal_function
1064 parse_param (char **word, size_t *word_length, size_t *max_length,
1065              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1066              const char *ifs, const char *ifs_white, int quoted)
1067 {
1068   /* We are poised just after "$" */
1069   enum action
1070   {
1071     ACT_NONE,
1072     ACT_RP_SHORT_LEFT = '#',
1073     ACT_RP_LONG_LEFT = 'L',
1074     ACT_RP_SHORT_RIGHT = '%',
1075     ACT_RP_LONG_RIGHT = 'R',
1076     ACT_NULL_ERROR = '?',
1077     ACT_NULL_SUBST = '-',
1078     ACT_NONNULL_SUBST = '+',
1079     ACT_NULL_ASSIGN = '='
1080   };
1081   size_t env_length;
1082   size_t env_maxlen;
1083   size_t pat_length;
1084   size_t pat_maxlen;
1085   size_t start = *offset;
1086   char *env;
1087   char *pattern;
1088   char *value = NULL;
1089   enum action action = ACT_NONE;
1090   int depth = 0;
1091   int colon_seen = 0;
1092   int seen_hash = 0;
1093   int free_value = 0;
1094   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1095   int error;
1096   int special = 0;
1097   char buffer[21];
1098   int brace = words[*offset] == '{';
1099
1100   env = w_newword (&env_length, &env_maxlen);
1101   pattern = w_newword (&pat_length, &pat_maxlen);
1102
1103   if (brace)
1104     ++*offset;
1105
1106   /* First collect the parameter name. */
1107
1108   if (words[*offset] == '#')
1109     {
1110       seen_hash = 1;
1111       if (!brace)
1112         goto envsubst;
1113       ++*offset;
1114     }
1115
1116   if (isalpha (words[*offset]) || words[*offset] == '_')
1117     {
1118       /* Normal parameter name. */
1119       do
1120         {
1121           env = w_addchar (env, &env_length, &env_maxlen,
1122                            words[*offset]);
1123           if (env == NULL)
1124             goto no_space;
1125         }
1126       while (isalnum (words[++*offset]) || words[*offset] == '_');
1127     }
1128   else if (isdigit (words[*offset]))
1129     {
1130       /* Numeric parameter name. */
1131       special = 1;
1132       do
1133         {
1134           env = w_addchar (env, &env_length, &env_maxlen,
1135                            words[*offset]);
1136           if (env == NULL)
1137             goto no_space;
1138           if (!brace)
1139             goto envsubst;
1140         }
1141       while (isdigit(words[++*offset]));
1142     }
1143   else if (strchr ("*@$", words[*offset]) != NULL)
1144     {
1145       /* Special parameter. */
1146       special = 1;
1147       env = w_addchar (env, &env_length, &env_maxlen,
1148                        words[*offset]);
1149       if (env == NULL)
1150         goto no_space;
1151       ++*offset;
1152     }
1153   else
1154     {
1155       if (brace)
1156         goto syntax;
1157     }
1158
1159   if (brace)
1160     {
1161       /* Check for special action to be applied to the value. */
1162       switch (words[*offset])
1163         {
1164         case '}':
1165           /* Evaluate. */
1166           goto envsubst;
1167
1168         case '#':
1169           action = ACT_RP_SHORT_LEFT;
1170           if (words[1 + *offset] == '#')
1171             {
1172               ++*offset;
1173               action = ACT_RP_LONG_LEFT;
1174             }
1175           break;
1176
1177         case '%':
1178           action = ACT_RP_SHORT_RIGHT;
1179           if (words[1 + *offset] == '%')
1180             {
1181               ++*offset;
1182               action = ACT_RP_LONG_RIGHT;
1183             }
1184           break;
1185
1186         case ':':
1187           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1188             goto syntax;
1189
1190           colon_seen = 1;
1191           action = words[++*offset];
1192           break;
1193
1194         case '-':
1195         case '=':
1196         case '?':
1197         case '+':
1198           action = words[*offset];
1199           break;
1200
1201         default:
1202           goto syntax;
1203         }
1204
1205       /* Now collect the pattern. */
1206       ++*offset;
1207       for (; words[*offset]; ++(*offset))
1208         {
1209           switch (words[*offset])
1210             {
1211             case '{':
1212               if (!pattern_is_quoted)
1213                 ++depth;
1214               break;
1215
1216             case '}':
1217               if (!pattern_is_quoted)
1218                 {
1219                   if (depth == 0)
1220                     goto envsubst;
1221                   --depth;
1222                 }
1223               break;
1224
1225             case '\\':
1226               if (!pattern_is_quoted && words[++*offset] == '\0')
1227                 goto syntax;
1228               break;
1229
1230             case '\'':
1231               if (pattern_is_quoted == 0)
1232                 pattern_is_quoted = 1;
1233               else if (pattern_is_quoted == 1)
1234                 pattern_is_quoted = 0;
1235
1236               break;
1237
1238             case '"':
1239               if (pattern_is_quoted == 0)
1240                 pattern_is_quoted = 2;
1241               else if (pattern_is_quoted == 2)
1242                 pattern_is_quoted = 0;
1243
1244               break;
1245             }
1246
1247           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1248                                words[*offset]);
1249           if (pattern == NULL)
1250             goto no_space;
1251         }
1252     }
1253
1254   /* End of input string -- remember to reparse the character that we
1255    * stopped at.  */
1256   --(*offset);
1257
1258 envsubst:
1259   if (words[start] == '{' && words[*offset] != '}')
1260     goto syntax;
1261
1262   if (env == NULL)
1263     {
1264       if (seen_hash)
1265         {
1266           /* $# expands to the number of positional parameters */
1267           buffer[20] = '\0';
1268           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1269           seen_hash = 0;
1270         }
1271       else
1272         {
1273           /* Just $ on its own */
1274           *offset = start - 1;
1275           *word = w_addchar (*word, word_length, max_length, '$');
1276           return *word ? 0 : WRDE_NOSPACE;
1277         }
1278     }
1279   /* Is it a numeric parameter? */
1280   else if (isdigit (env[0]))
1281     {
1282       int n = atoi (env);
1283
1284       if (n >= __libc_argc)
1285         /* Substitute NULL. */
1286         value = NULL;
1287       else
1288         /* Replace with appropriate positional parameter. */
1289         value = __libc_argv[n];
1290     }
1291   /* Is it a special parameter? */
1292   else if (special)
1293     {
1294       /* Is it `$$'? */
1295       if (*env == '$')
1296         {
1297           buffer[20] = '\0';
1298           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1299         }
1300       /* Is it `${#*}' or `${#@}'? */
1301       else if ((*env == '*' || *env == '@') && seen_hash)
1302         {
1303           buffer[20] = '\0';
1304           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1305                               &buffer[20], 10, 0);
1306           *word = w_addstr (*word, word_length, max_length, value);
1307           free (env);
1308           return *word ? 0 : WRDE_NOSPACE;
1309         }
1310       /* Is it `$*' or `$@' (unquoted) ? */
1311       else if (*env == '*' || (*env == '@' && !quoted))
1312         {
1313           size_t plist_len = 0;
1314           int p;
1315           char *end;
1316
1317           /* Build up value parameter by parameter (copy them) */
1318           for (p = 1; __libc_argv[p]; ++p)
1319             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1320           value = malloc (plist_len);
1321           if (value == NULL)
1322             goto no_space;
1323           end = value;
1324           *end = 0;
1325           for (p = 1; __libc_argv[p]; ++p)
1326             {
1327               if (p > 1)
1328                 *end++ = ' ';
1329               end = __stpcpy (end, __libc_argv[p]);
1330             }
1331
1332           free_value = 1;
1333         }
1334       else
1335         {
1336           /* Must be a quoted `$@' */
1337           assert (*env == '@' && quoted);
1338
1339           /* Each parameter is a separate word ("$@") */
1340           if (__libc_argc == 2)
1341             value = __libc_argv[1];
1342           else if (__libc_argc > 2)
1343             {
1344               int p;
1345
1346               /* Append first parameter to current word. */
1347               value = w_addstr (*word, word_length, max_length,
1348                                 __libc_argv[1]);
1349               if (value == NULL || w_addword (pwordexp, value))
1350                 goto no_space;
1351
1352               for (p = 2; __libc_argv[p + 1]; p++)
1353                 {
1354                   char *newword = __strdup (__libc_argv[p]);
1355                   if (newword == NULL || w_addword (pwordexp, newword))
1356                     goto no_space;
1357                 }
1358
1359               /* Start a new word with the last parameter. */
1360               *word = w_newword (word_length, max_length);
1361               value = __libc_argv[p];
1362             }
1363           else
1364             {
1365               free (env);
1366               free (pattern);
1367               return 0;
1368             }
1369         }
1370     }
1371   else
1372     value = getenv (env);
1373
1374   if (value == NULL && (flags & WRDE_UNDEF))
1375     {
1376       /* Variable not defined. */
1377       if (pattern)
1378         free (pattern);
1379       if (env)
1380         free (env);
1381       return WRDE_BADVAL;
1382     }
1383
1384   if (action != ACT_NONE)
1385     {
1386       switch (action)
1387         {
1388         case ACT_RP_SHORT_LEFT:
1389         case ACT_RP_LONG_LEFT:
1390         case ACT_RP_SHORT_RIGHT:
1391         case ACT_RP_LONG_RIGHT:
1392           {
1393             char *p;
1394             char c;
1395             char *end;
1396
1397             if (value == NULL || pattern == NULL || *pattern == '\0')
1398               break;
1399
1400             end = value + strlen (value);
1401
1402             switch (action)
1403               {
1404               case ACT_RP_SHORT_LEFT:
1405                 for (p = value; p <= end; ++p)
1406                   {
1407                     c = *p;
1408                     *p = '\0';
1409                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1410                       {
1411                         *p = c;
1412                         if (free_value)
1413                           {
1414                             char *newval = __strdup (p);
1415                             if (newval == NULL)
1416                               {
1417                                 free (value);
1418                                 goto no_space;
1419                               }
1420                             free (value);
1421                             value = newval;
1422                           }
1423                         else
1424                           value = p;
1425                         break;
1426                       }
1427                     *p = c;
1428                   }
1429
1430                 break;
1431
1432               case ACT_RP_LONG_LEFT:
1433                 for (p = end; p >= value; --p)
1434                   {
1435                     c = *p;
1436                     *p = '\0';
1437                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1438                       {
1439                         *p = c;
1440                         if (free_value)
1441                           {
1442                             char *newval = __strdup (p);
1443                             if (newval == NULL)
1444                               {
1445                                 free (value);
1446                                 goto no_space;
1447                               }
1448                             free (value);
1449                             value = newval;
1450                           }
1451                         else
1452                           value = p;
1453                         break;
1454                       }
1455                     *p = c;
1456                   }
1457
1458                 break;
1459
1460               case ACT_RP_SHORT_RIGHT:
1461                 for (p = end; p >= value; --p)
1462                   {
1463                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1464                       {
1465                         char *newval;
1466                         newval = malloc (p - value + 1);
1467                         if (newval == NULL)
1468                           goto no_space;
1469                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1470                         if (free_value)
1471                           free (value);
1472                         value = newval;
1473                         free_value = 1;
1474                         break;
1475                       }
1476                   }
1477
1478                 break;
1479
1480               case ACT_RP_LONG_RIGHT:
1481                 for (p = value; p <= end; ++p)
1482                   {
1483                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1484                       {
1485                         char *newval;
1486                         newval = malloc (p - value + 1);
1487                         if (newval == NULL)
1488                           goto no_space;
1489                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1490                         if (free_value)
1491                           free (value);
1492                         value = newval;
1493                         free_value = 1;
1494                         break;
1495                       }
1496                   }
1497
1498                 break;
1499
1500               default:
1501                 break;
1502               }
1503
1504             break;
1505           }
1506
1507         case ACT_NULL_ERROR:
1508           if (value && *value)
1509             /* Substitute parameter */
1510             break;
1511
1512           if (!colon_seen && value)
1513             /* Substitute NULL */
1514             error = 0;
1515           else if (*pattern)
1516             {
1517               /* Expand 'pattern' and write it to stderr */
1518               wordexp_t we;
1519
1520               error = wordexp (pattern, &we, flags);
1521
1522               if (error == 0)
1523                 {
1524                   int i;
1525
1526                   fprintf (stderr, "%s:", env);
1527
1528                   for (i = 0; i < we.we_wordc; ++i)
1529                     {
1530                       fprintf (stderr, " %s", we.we_wordv[i]);
1531                     }
1532
1533                   fprintf (stderr, "\n");
1534                   error = WRDE_BADVAL;
1535                 }
1536
1537               wordfree (&we);
1538             }
1539           else
1540             {
1541               fprintf (stderr, "%s: parameter null or not set\n", env);
1542               error = WRDE_BADVAL;
1543             }
1544
1545           free (env);
1546           free (pattern);
1547           if (free_value)
1548             free (value);
1549           return error;
1550
1551         case ACT_NULL_SUBST:
1552           if (value && *value)
1553             /* Substitute parameter */
1554             break;
1555
1556           if (!colon_seen && value)
1557             {
1558               /* Substitute NULL */
1559               free (env);
1560               free (pattern);
1561               if (free_value)
1562                 free (value);
1563               return 0;
1564             }
1565
1566         subst_word:
1567           {
1568             /* Substitute word */
1569             wordexp_t we;
1570             int i;
1571
1572             if (free_value)
1573               free (value);
1574
1575             if (quoted)
1576               {
1577                 /* No field-splitting is allowed, so imagine
1578                    quotes around the word.  */
1579                 char *qtd_pattern = malloc (3 + strlen (pattern));
1580                 if (qtd_pattern)
1581                   sprintf (qtd_pattern, "\"%s\"", pattern);
1582                 free (pattern);
1583                 pattern = qtd_pattern;
1584               }
1585
1586             if (pattern == NULL && (pattern = __strdup ("")) == NULL)
1587               goto no_space;
1588
1589             error = wordexp (pattern, &we, flags);
1590             if (error)
1591               {
1592                 free (env);
1593                 free (pattern);
1594                 return error;
1595               }
1596
1597             /* Fingers crossed that the quotes worked.. */
1598             assert (!quoted || we.we_wordc == 1);
1599
1600             /* Substitute */
1601             for (i = 0; i < we.we_wordc; ++i)
1602               if (w_addword (pwordexp, __strdup (we.we_wordv[i]))
1603                   == WRDE_NOSPACE)
1604                 break;
1605
1606             if (i < we.we_wordc)
1607               {
1608                 /* Ran out of space */
1609                 wordfree (&we);
1610                 goto no_space;
1611               }
1612
1613             if (action == ACT_NULL_ASSIGN)
1614               {
1615                 char *words;
1616                 char *cp;
1617                 size_t words_size = 0;
1618
1619                 if (special)
1620                   /* Cannot assign special parameters. */
1621                   goto syntax;
1622
1623                 for (i = 0; i < we.we_wordc; i++)
1624                   words_size += strlen (we.we_wordv[i]) + 1; /* for <space> */
1625                 words_size++;
1626
1627                 cp = words = __alloca (words_size);
1628                 *words = 0;
1629                 for (i = 0; i < we.we_wordc - 1; i++)
1630                   {
1631                     cp = __stpcpy (cp, we.we_wordv[i]);
1632                     *cp++ = ' ';
1633                   }
1634
1635                 strcpy (cp, we.we_wordv[i]);
1636
1637                 /* Also assign */
1638                 setenv (env, words, 1);
1639               }
1640
1641             wordfree (&we);
1642             free (env);
1643             free (pattern);
1644             return 0;
1645           }
1646
1647         case ACT_NONNULL_SUBST:
1648           if (value && *value)
1649             goto subst_word;
1650
1651           if (!colon_seen && value)
1652             goto subst_word;
1653
1654           /* Substitute NULL */
1655           free (env);
1656           free (pattern);
1657           if (free_value)
1658             free (value);
1659           return 0;
1660
1661         case ACT_NULL_ASSIGN:
1662           if (value && *value)
1663             /* Substitute parameter */
1664             break;
1665
1666           if (!colon_seen && value)
1667             {
1668               /* Substitute NULL */
1669               free (env);
1670               free (pattern);
1671               if (free_value)
1672                 free (value);
1673               return 0;
1674             }
1675
1676           /* This checks for '=' so it knows to assign */
1677           goto subst_word;
1678
1679         default:
1680           assert (! "Unrecognised action!");
1681         }
1682     }
1683
1684   free (env);
1685   free (pattern);
1686
1687   if (seen_hash)
1688     {
1689       char param_length[21];
1690       param_length[20] = '\0';
1691       *word = w_addstr (*word, word_length, max_length,
1692                         _itoa_word (value ? strlen (value) : 0,
1693                                     &param_length[20], 10, 0));
1694       if (free_value)
1695         {
1696           assert (value != NULL);
1697           free (value);
1698         }
1699
1700       return *word ? 0 : WRDE_NOSPACE;
1701     }
1702
1703   if (value == NULL)
1704     return 0;
1705
1706   if (quoted || !pwordexp)
1707     {
1708       /* Quoted - no field split */
1709       *word = w_addstr (*word, word_length, max_length, value);
1710       if (free_value)
1711         free (value);
1712
1713       return *word ? 0 : WRDE_NOSPACE;
1714     }
1715   else
1716     {
1717       /* Need to field-split */
1718       char *value_copy = __strdup (value); /* Don't modify value */
1719       char *field_begin = value_copy;
1720       int seen_nonws_ifs = 0;
1721
1722       if (free_value)
1723         free (value);
1724
1725       if (value_copy == NULL)
1726         return WRDE_NOSPACE;
1727
1728       do
1729         {
1730           char *field_end = field_begin;
1731           char *next_field;
1732
1733           /* If this isn't the first field, start a new word */
1734           if (field_begin != value_copy)
1735             {
1736               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1737                 {
1738                   free (value_copy);
1739                   return WRDE_NOSPACE;
1740                 }
1741
1742               *word = w_newword (word_length, max_length);
1743             }
1744
1745           /* Skip IFS whitespace before the field */
1746           field_begin += strspn (field_begin, ifs_white);
1747
1748           if (!seen_nonws_ifs && *field_begin == 0)
1749             /* Nothing but whitespace */
1750             break;
1751
1752           /* Search for the end of the field */
1753           field_end = field_begin + strcspn (field_begin, ifs);
1754
1755           /* Set up pointer to the character after end of field and
1756              skip whitespace IFS after it. */
1757           next_field = field_end + strspn (field_end, ifs_white);
1758
1759           /* Skip at most one non-whitespace IFS character after the field */
1760           seen_nonws_ifs = 0;
1761           if (*next_field && strchr (ifs, *next_field))
1762             {
1763               seen_nonws_ifs = 1;
1764               next_field++;
1765             }
1766
1767           /* Null-terminate it */
1768           *field_end = 0;
1769
1770           /* Tag a copy onto the current word */
1771           *word = w_addstr (*word, word_length, max_length, field_begin);
1772
1773           if (*word == NULL && *field_begin != '\0')
1774             {
1775               free (value_copy);
1776               return WRDE_NOSPACE;
1777             }
1778
1779           field_begin = next_field;
1780         }
1781       while (seen_nonws_ifs || *field_begin);
1782
1783       free (value_copy);
1784     }
1785
1786   return 0;
1787
1788 no_space:
1789   if (env)
1790     free (env);
1791
1792   if (pattern)
1793     free (pattern);
1794
1795   return WRDE_NOSPACE;
1796
1797 syntax:
1798   if (env)
1799     free (env);
1800
1801   if (pattern)
1802     free (pattern);
1803
1804   return WRDE_SYNTAX;
1805 }
1806
1807 static int
1808 internal_function
1809 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1810                const char *words, size_t *offset, int flags,
1811                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
1812                int quoted)
1813 {
1814   /* We are poised _at_ "$" */
1815   switch (words[1 + *offset])
1816     {
1817     case '"':
1818     case '\'':
1819     case 0:
1820       *word = w_addchar (*word, word_length, max_length, '$');
1821       return *word ? 0 : WRDE_NOSPACE;
1822
1823     case '(':
1824       if (words[2 + *offset] == '(')
1825         {
1826           /* Differentiate between $((1+3)) and $((echo);(ls)) */
1827           int i = 3 + *offset;
1828           int depth = 0;
1829           while (words[i] && !(depth == 0 && words[i] == ')'))
1830             {
1831               if (words[i] == '(')
1832                 ++depth;
1833               else if (words[i] == ')')
1834                 --depth;
1835
1836               ++i;
1837             }
1838
1839           if (words[i] == ')' && words[i + 1] == ')')
1840             {
1841               (*offset) += 3;
1842               /* Call parse_arith -- 0 is for "no brackets" */
1843               return parse_arith (word, word_length, max_length, words, offset,
1844                                   flags, 0);
1845             }
1846         }
1847
1848       if (flags & WRDE_NOCMD)
1849         return WRDE_CMDSUB;
1850
1851       (*offset) += 2;
1852       return parse_comm (word, word_length, max_length, words, offset, flags,
1853                          quoted? NULL : pwordexp, ifs, ifs_white);
1854
1855     case '[':
1856       (*offset) += 2;
1857       /* Call parse_arith -- 1 is for "brackets" */
1858       return parse_arith (word, word_length, max_length, words, offset, flags,
1859                           1);
1860
1861     case '{':
1862     default:
1863       ++(*offset);      /* parse_param needs to know if "{" is there */
1864       return parse_param (word, word_length, max_length, words, offset, flags,
1865                            pwordexp, ifs, ifs_white, quoted);
1866     }
1867 }
1868
1869 static int
1870 parse_backtick (char **word, size_t *word_length, size_t *max_length,
1871                 const char *words, size_t *offset, int flags,
1872                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
1873 {
1874   /* We are poised just after "`" */
1875   int error;
1876   int squoting = 0;
1877   size_t comm_length;
1878   size_t comm_maxlen;
1879   char *comm = w_newword (&comm_length, &comm_maxlen);
1880
1881   for (; words[*offset]; ++(*offset))
1882     {
1883       switch (words[*offset])
1884         {
1885         case '`':
1886           /* Go -- give the script to the shell */
1887           error = exec_comm (comm, word, word_length, max_length, flags,
1888                              pwordexp, ifs, ifs_white);
1889           free (comm);
1890           return error;
1891
1892         case '\\':
1893           if (squoting)
1894             {
1895               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
1896                                            words, offset);
1897
1898               if (error)
1899                 {
1900                   free (comm);
1901                   return error;
1902                 }
1903
1904               break;
1905             }
1906
1907           ++(*offset);
1908           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
1909                                    offset);
1910
1911           if (error)
1912             {
1913               free (comm);
1914               return error;
1915             }
1916
1917           break;
1918
1919         case '\'':
1920           squoting = 1 - squoting;
1921         default:
1922           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1923           if (comm == NULL)
1924             return WRDE_NOSPACE;
1925         }
1926     }
1927
1928   /* Premature end */
1929   free (comm);
1930   return WRDE_SYNTAX;
1931 }
1932
1933 static int
1934 internal_function
1935 parse_dquote (char **word, size_t *word_length, size_t *max_length,
1936               const char *words, size_t *offset, int flags,
1937               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
1938 {
1939   /* We are poised just after a double-quote */
1940   int error;
1941
1942   for (; words[*offset]; ++(*offset))
1943     {
1944       switch (words[*offset])
1945         {
1946         case '"':
1947           return 0;
1948
1949         case '$':
1950           error = parse_dollars (word, word_length, max_length, words, offset,
1951                                  flags, pwordexp, ifs, ifs_white, 1);
1952           /* The ``1'' here is to tell parse_dollars not to
1953            * split the fields.  It may need to, however ("$@").
1954            */
1955           if (error)
1956             return error;
1957
1958           break;
1959
1960         case '`':
1961           if (flags & WRDE_NOCMD)
1962             return WRDE_CMDSUB;
1963
1964           ++(*offset);
1965           error = parse_backtick (word, word_length, max_length, words,
1966                                   offset, flags, NULL, NULL, NULL);
1967           /* The first NULL here is to tell parse_backtick not to
1968            * split the fields.
1969            */
1970           if (error)
1971             return error;
1972
1973           break;
1974
1975         case '\\':
1976           error = parse_qtd_backslash (word, word_length, max_length, words,
1977                                        offset);
1978
1979           if (error)
1980             return error;
1981
1982           break;
1983
1984         default:
1985           *word = w_addchar (*word, word_length, max_length, words[*offset]);
1986           if (*word == NULL)
1987             return WRDE_NOSPACE;
1988         }
1989     }
1990
1991   /* Unterminated string */
1992   return WRDE_SYNTAX;
1993 }
1994
1995 /*
1996  * wordfree() is to be called after pwordexp is finished with.
1997  */
1998
1999 void
2000 wordfree (wordexp_t *pwordexp)
2001 {
2002
2003   /* wordexp can set pwordexp to NULL */
2004   if (pwordexp && pwordexp->we_wordv)
2005     {
2006       char **wordv = pwordexp->we_wordv;
2007
2008       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2009         free (*wordv);
2010
2011       free (pwordexp->we_wordv);
2012       pwordexp->we_wordv = NULL;
2013     }
2014 }
2015
2016 /*
2017  * wordexp()
2018  */
2019
2020 int
2021 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2022 {
2023   size_t wordv_offset;
2024   size_t words_offset;
2025   size_t word_length;
2026   size_t max_length;
2027   char *word = w_newword (&word_length, &max_length);
2028   int error;
2029   char *ifs;
2030   char ifs_white[4];
2031   char **old_wordv = pwordexp->we_wordv;
2032   size_t old_wordc = (flags & WRDE_REUSE) ? pwordexp->we_wordc : 0;
2033
2034   if (flags & WRDE_REUSE)
2035     {
2036       /* Minimal implementation of WRDE_REUSE for now */
2037       wordfree (pwordexp);
2038       old_wordv = NULL;
2039     }
2040
2041   if (flags & WRDE_DOOFFS)
2042     {
2043       pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2044       if (pwordexp->we_wordv == NULL)
2045         return WRDE_NOSPACE;
2046     }
2047   else
2048     {
2049       pwordexp->we_wordv = calloc (1, sizeof (char *));
2050       if (pwordexp->we_wordv == NULL)
2051         return WRDE_NOSPACE;
2052
2053       pwordexp->we_offs = 0;
2054     }
2055
2056   if ((flags & WRDE_APPEND) == 0)
2057     pwordexp->we_wordc = 0;
2058
2059   wordv_offset = pwordexp->we_offs + pwordexp->we_wordc;
2060
2061   /* Find out what the field separators are.
2062    * There are two types: whitespace and non-whitespace.
2063    */
2064   ifs = getenv ("IFS");
2065
2066   if (!ifs)
2067     /* IFS unset - use <space><tab><newline>. */
2068     ifs = strcpy (ifs_white, " \t\n");
2069   else
2070     {
2071       char *ifsch = ifs;
2072       char *whch = ifs_white;
2073
2074       /* Start off with no whitespace IFS characters */
2075       ifs_white[0] = '\0';
2076
2077       while (*ifsch != '\0')
2078         {
2079           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2080             {
2081               /* Whitespace IFS.  See first whether it is already in our
2082                  collection.  */
2083               char *runp = ifs_white;
2084
2085               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2086                 ++runp;
2087
2088               if (runp == whch)
2089                 *whch++ = *ifsch;
2090             }
2091
2092           ++ifsch;
2093         }
2094       *whch = '\0';
2095     }
2096
2097   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2098     switch (words[words_offset])
2099       {
2100       case '\\':
2101         error = parse_backslash (&word, &word_length, &max_length, words,
2102                                  &words_offset);
2103
2104         if (error)
2105           goto do_error;
2106
2107         break;
2108
2109       case '$':
2110         error = parse_dollars (&word, &word_length, &max_length, words,
2111                                &words_offset, flags, pwordexp, ifs, ifs_white,
2112                                0);
2113
2114         if (error)
2115           goto do_error;
2116
2117         break;
2118
2119       case '`':
2120         if (flags & WRDE_NOCMD)
2121           return WRDE_CMDSUB;
2122
2123         ++words_offset;
2124         error = parse_backtick (&word, &word_length, &max_length, words,
2125                                 &words_offset, flags, pwordexp, ifs,
2126                                 ifs_white);
2127
2128         if (error)
2129           goto do_error;
2130
2131         break;
2132
2133       case '"':
2134         ++words_offset;
2135         error = parse_dquote (&word, &word_length, &max_length, words,
2136                               &words_offset, flags, pwordexp, ifs, ifs_white);
2137
2138         if (error)
2139           goto do_error;
2140
2141         break;
2142
2143       case '\'':
2144         ++words_offset;
2145         error = parse_squote (&word, &word_length, &max_length, words,
2146                               &words_offset);
2147
2148         if (error)
2149           goto do_error;
2150
2151         break;
2152
2153       case '~':
2154         error = parse_tilde (&word, &word_length, &max_length, words,
2155                              &words_offset, pwordexp->we_wordc);
2156
2157         if (error)
2158           goto do_error;
2159
2160         break;
2161
2162       case '*':
2163       case '[':
2164       case '?':
2165         error = parse_glob (&word, &word_length, &max_length, words,
2166                             &words_offset, flags, pwordexp, ifs, ifs_white);
2167
2168         if (error)
2169           goto do_error;
2170
2171         break;
2172
2173       default:
2174         /* Is it a word separator? */
2175         if (strchr (" \t", words[words_offset]) == NULL)
2176           {
2177             char ch = words[words_offset];
2178
2179             /* Not a word separator -- but is it a valid word char? */
2180             if (strchr ("\n|&;<>(){}", ch))
2181               {
2182                 /* Fail */
2183                 wordfree (pwordexp);
2184                 pwordexp->we_wordc = 0;
2185                 pwordexp->we_wordv = old_wordv;
2186                 return WRDE_BADCHAR;
2187               }
2188
2189             /* "Ordinary" character -- add it to word */
2190
2191             /* Convert IFS chars to blanks -- bash does this */
2192             if (strchr (ifs, ch))
2193               ch = ' ';
2194
2195             word = w_addchar (word, &word_length, &max_length,
2196                               ch);
2197             if (word == NULL)
2198               {
2199                 error = WRDE_NOSPACE;
2200                 goto do_error;
2201               }
2202
2203             break;
2204           }
2205
2206         /* If a word has been delimited, add it to the list. */
2207         if (word != NULL)
2208           {
2209             error = w_addword (pwordexp, word);
2210             if (error)
2211               goto do_error;
2212           }
2213
2214         word = w_newword (&word_length, &max_length);
2215       }
2216
2217   /* End of string */
2218
2219   /* There was a word separator at the end */
2220   if (word == NULL)
2221     return 0;
2222
2223   /* There was no field separator at the end */
2224   return w_addword (pwordexp, word);
2225
2226 do_error:
2227   /* Error:
2228    *    free memory used (unless error is WRDE_NOSPACE), and
2229    *    set we_wordc and wd_wordv back to what they were.
2230    */
2231
2232   if (word != NULL)
2233     free (word);
2234
2235   if (error == WRDE_NOSPACE)
2236     return WRDE_NOSPACE;
2237
2238   wordfree (pwordexp);
2239   pwordexp->we_wordv = old_wordv;
2240   pwordexp->we_wordc = old_wordc;
2241   return error;
2242 }