posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2015 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, see
  18    <http://www.gnu.org/licenses/>.  */
  19
  20 #include <alloca.h>
  21 #include <ctype.h>
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <fnmatch.h>
  25 #include <glob.h>
  26 #include <libintl.h>
  27 #include <paths.h>
  28 #include <pwd.h>
  29 #include <signal.h>
  30 #include <stdbool.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <sys/param.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/types.h>
  39 #include <sys/wait.h>
  40 #include <unistd.h>
  41 #include <wchar.h>
  42 #include <wordexp.h>
  43 #include <kernel-features.h>
  44
  45 #include <libc-lock.h>
  46 #include <_itoa.h>
  47
  48 /* Undefine the following line for the production version.  */
  49 /* #define NDEBUG 1 */
  50 #include <assert.h>
  51
  52 /* Get some device information.  */
  53 #include <device-nrs.h>
  54
  55 /*
  56  * This is a recursive-descent-style word expansion routine.
  57  */
  58
  59 /* These variables are defined and initialized in the startup code.  */
  60 extern int __libc_argc attribute_hidden;
  61 extern char **__libc_argv attribute_hidden;
  62
  63 /* Some forward declarations */
  64 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  65                           const char *words, size_t *offset, int flags,
  66                           wordexp_t *pwordexp, const char *ifs,
  67                           const char *ifs_white, int quoted)
  68      internal_function;
  69 static int parse_backtick (char **word, size_t *word_length,
  70                            size_t *max_length, const char *words,
  71                            size_t *offset, int flags, wordexp_t *pwordexp,
  72                            const char *ifs, const char *ifs_white)
  73      internal_function;
  74 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  75                          const char *words, size_t *offset, int flags,
  76                          wordexp_t *pwordexp, const char *ifs,
  77                          const char *ifs_white)
  78      internal_function;
  79 static int eval_expr (char *expr, long int *result) internal_function;
  80
  81 /* The w_*() functions manipulate word lists. */
  82
  83 #define W_CHUNK (100)
  84
  85 /* Result of w_newword will be ignored if it's the last word. */
  86 static inline char *
  87 w_newword (size_t *actlen, size_t *maxlen)
  88 {
  89   *actlen = *maxlen = 0;
  90   return NULL;
  91 }
  92
  93 static char *
  94 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  95      /* (lengths exclude trailing zero) */
  96 {
  97   /* Add a character to the buffer, allocating room for it if needed.  */
  98
  99   if (*actlen == *maxlen)
 100     {
 101       char *old_buffer = buffer;
 102       assert (buffer == NULL || *maxlen != 0);
 103       *maxlen += W_CHUNK;
 104       buffer = (char *) realloc (buffer, 1 + *maxlen);
 105
 106       if (buffer == NULL)
 107         free (old_buffer);
 108     }
 109
 110   if (buffer != NULL)
 111     {
 112       buffer[*actlen] = ch;
 113       buffer[++(*actlen)] = '\0';
 114     }
 115
 116   return buffer;
 117 }
 118
 119 static char *
 120 internal_function
 121 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 122           size_t len)
 123 {
 124   /* Add a string to the buffer, allocating room for it if needed.
 125    */
 126   if (*actlen + len > *maxlen)
 127     {
 128       char *old_buffer = buffer;
 129       assert (buffer == NULL || *maxlen != 0);
 130       *maxlen += MAX (2 * len, W_CHUNK);
 131       buffer = realloc (old_buffer, 1 + *maxlen);
 132
 133       if (buffer == NULL)
 134         free (old_buffer);
 135     }
 136
 137   if (buffer != NULL)
 138     {
 139       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 140       *actlen += len;
 141     }
 142
 143   return buffer;
 144 }
 145
 146 static char *
 147 internal_function
 148 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 149      /* (lengths exclude trailing zero) */
 150 {
 151   /* Add a string to the buffer, allocating room for it if needed.
 152    */
 153   size_t len;
 154
 155   assert (str != NULL); /* w_addstr only called from this file */
 156   len = strlen (str);
 157
 158   return w_addmem (buffer, actlen, maxlen, str, len);
 159 }
 160
 161 static int
 162 internal_function
 163 w_addword (wordexp_t *pwordexp, char *word)
 164 {
 165   /* Add a word to the wordlist */
 166   size_t num_p;
 167   char **new_wordv;
 168   bool allocated = false;
 169
 170   /* Internally, NULL acts like "".  Convert NULLs to "" before
 171    * the caller sees them.
 172    */
 173   if (word == NULL)
 174     {
 175       word = __strdup ("");
 176       if (word == NULL)
 177         goto no_space;
 178       allocated = true;
 179     }
 180
 181   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 182   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 183   if (new_wordv != NULL)
 184     {
 185       pwordexp->we_wordv = new_wordv;
 186       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 187       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 188       return 0;
 189     }
 190
 191   if (allocated)
 192     free (word);
 193
 194 no_space:
 195   return WRDE_NOSPACE;
 196 }
 197
 198 /* The parse_*() functions should leave *offset being the offset in 'words'
 199  * to the last character processed.
 200  */
 201
 202 static int
 203 internal_function
 204 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 205                  const char *words, size_t *offset)
 206 {
 207   /* We are poised _at_ a backslash, not in quotes */
 208
 209   switch (words[1 + *offset])
 210     {
 211     case 0:
 212       /* Backslash is last character of input words */
 213       return WRDE_SYNTAX;
 214
 215     case '\n':
 216       ++(*offset);
 217       break;
 218
 219     default:
 220       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 221       if (*word == NULL)
 222         return WRDE_NOSPACE;
 223
 224       ++(*offset);
 225       break;
 226     }
 227
 228   return 0;
 229 }
 230
 231 static int
 232 internal_function
 233 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 234                      const char *words, size_t *offset)
 235 {
 236   /* We are poised _at_ a backslash, inside quotes */
 237
 238   switch (words[1 + *offset])
 239     {
 240     case 0:
 241       /* Backslash is last character of input words */
 242       return WRDE_SYNTAX;
 243
 244     case '\n':
 245       ++(*offset);
 246       break;
 247
 248     case '$':
 249     case '`':
 250     case '"':
 251     case '\\':
 252       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 253       if (*word == NULL)
 254         return WRDE_NOSPACE;
 255
 256       ++(*offset);
 257       break;
 258
 259     default:
 260       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 261       if (*word != NULL)
 262         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 263
 264       if (*word == NULL)
 265         return WRDE_NOSPACE;
 266
 267       ++(*offset);
 268       break;
 269     }
 270
 271   return 0;
 272 }
 273
 274 static int
 275 internal_function
 276 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 277              const char *words, size_t *offset, size_t wordc)
 278 {
 279   /* We are poised _at_ a tilde */
 280   size_t i;
 281
 282   if (*word_length != 0)
 283     {
 284       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 285         {
 286           if (!((*word)[*word_length - 1] == ':'
 287                 && strchr (*word, '=') && wordc == 0))
 288             {
 289               *word = w_addchar (*word, word_length, max_length, '~');
 290               return *word ? 0 : WRDE_NOSPACE;
 291             }
 292         }
 293     }
 294
 295   for (i = 1 + *offset; words[i]; i++)
 296     {
 297       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 298           words[i] == '\t' || words[i] == 0 )
 299         break;
 300
 301       if (words[i] == '\\')
 302         {
 303           *word = w_addchar (*word, word_length, max_length, '~');
 304           return *word ? 0 : WRDE_NOSPACE;
 305         }
 306     }
 307
 308   if (i == 1 + *offset)
 309     {
 310       /* Tilde appears on its own */
 311       uid_t uid;
 312       struct passwd pwd, *tpwd;
 313       int buflen = 1000;
 314       char* home;
 315       char* buffer;
 316       int result;
 317
 318       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 319          results are unspecified.  We do a lookup on the uid if
 320          HOME is unset. */
 321
 322       home = getenv ("HOME");
 323       if (home != NULL)
 324         {
 325           *word = w_addstr (*word, word_length, max_length, home);
 326           if (*word == NULL)
 327             return WRDE_NOSPACE;
 328         }
 329       else
 330         {
 331           uid = __getuid ();
 332           buffer = __alloca (buflen);
 333
 334           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 335                  && errno == ERANGE)
 336             buffer = extend_alloca (buffer, buflen, buflen + 1000);
 337
 338           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 339             {
 340               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 341               if (*word == NULL)
 342                 return WRDE_NOSPACE;
 343             }
 344           else
 345             {
 346               *word = w_addchar (*word, word_length, max_length, '~');
 347               if (*word == NULL)
 348                 return WRDE_NOSPACE;
 349             }
 350         }
 351     }
 352   else
 353     {
 354       /* Look up user name in database to get home directory */
 355       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 356       struct passwd pwd, *tpwd;
 357       int buflen = 1000;
 358       char* buffer = __alloca (buflen);
 359       int result;
 360
 361       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 362              && errno == ERANGE)
 363         buffer = extend_alloca (buffer, buflen, buflen + 1000);
 364
 365       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 366         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 367       else
 368         {
 369           /* (invalid login name) */
 370           *word = w_addchar (*word, word_length, max_length, '~');
 371           if (*word != NULL)
 372             *word = w_addstr (*word, word_length, max_length, user);
 373         }
 374
 375       *offset = i - 1;
 376     }
 377   return *word ? 0 : WRDE_NOSPACE;
 378 }
 379
 380
 381 static int
 382 internal_function
 383 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 384                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 385                const char *ifs_white)
 386 {
 387   int error;
 388   unsigned int match;
 389   glob_t globbuf;
 390
 391   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 392
 393   if (error != 0)
 394     {
 395       /* We can only run into memory problems.  */
 396       assert (error == GLOB_NOSPACE);
 397       return WRDE_NOSPACE;
 398     }
 399
 400   if (ifs && !*ifs)
 401     {
 402       /* No field splitting allowed. */
 403       assert (globbuf.gl_pathv[0] != NULL);
 404       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 405       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 406         {
 407           *word = w_addchar (*word, word_length, max_length, ' ');
 408           if (*word != NULL)
 409             *word = w_addstr (*word, word_length, max_length,
 410                               globbuf.gl_pathv[match]);
 411         }
 412
 413       globfree (&globbuf);
 414       return *word ? 0 : WRDE_NOSPACE;
 415     }
 416
 417   assert (ifs == NULL || *ifs != '\0');
 418   if (*word != NULL)
 419     {
 420       free (*word);
 421       *word = w_newword (word_length, max_length);
 422     }
 423
 424   for (match = 0; match < globbuf.gl_pathc; ++match)
 425     {
 426       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 427       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 428         {
 429           globfree (&globbuf);
 430           return WRDE_NOSPACE;
 431         }
 432     }
 433
 434   globfree (&globbuf);
 435   return 0;
 436 }
 437
 438 static int
 439 internal_function
 440 parse_glob (char **word, size_t *word_length, size_t *max_length,
 441             const char *words, size_t *offset, int flags,
 442             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 443 {
 444   /* We are poised just after a '*', a '[' or a '?'. */
 445   int error = WRDE_NOSPACE;
 446   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 447   size_t i;
 448   wordexp_t glob_list; /* List of words to glob */
 449
 450   glob_list.we_wordc = 0;
 451   glob_list.we_wordv = NULL;
 452   glob_list.we_offs = 0;
 453   for (; words[*offset] != '\0'; ++*offset)
 454     {
 455       if (strchr (ifs, words[*offset]) != NULL)
 456         /* Reached IFS */
 457         break;
 458
 459       /* Sort out quoting */
 460       if (words[*offset] == '\'')
 461         {
 462           if (quoted == 0)
 463             {
 464               quoted = 1;
 465               continue;
 466             }
 467           else if (quoted == 1)
 468             {
 469               quoted = 0;
 470               continue;
 471             }
 472         }
 473       else if (words[*offset] == '"')
 474         {
 475           if (quoted == 0)
 476             {
 477               quoted = 2;
 478               continue;
 479             }
 480           else if (quoted == 2)
 481             {
 482               quoted = 0;
 483               continue;
 484             }
 485         }
 486
 487       /* Sort out other special characters */
 488       if (quoted != 1 && words[*offset] == '$')
 489         {
 490           error = parse_dollars (word, word_length, max_length, words,
 491                                  offset, flags, &glob_list, ifs, ifs_white,
 492                                  quoted == 2);
 493           if (error)
 494             goto tidy_up;
 495
 496           continue;
 497         }
 498       else if (words[*offset] == '\\')
 499         {
 500           if (quoted)
 501             error = parse_qtd_backslash (word, word_length, max_length,
 502                                          words, offset);
 503           else
 504             error = parse_backslash (word, word_length, max_length,
 505                                      words, offset);
 506
 507           if (error)
 508             goto tidy_up;
 509
 510           continue;
 511         }
 512
 513       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 514       if (*word == NULL)
 515         goto tidy_up;
 516     }
 517
 518   /* Don't forget to re-parse the character we stopped at. */
 519   --*offset;
 520
 521   /* Glob the words */
 522   error = w_addword (&glob_list, *word);
 523   *word = w_newword (word_length, max_length);
 524   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 525     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 526                            max_length, pwordexp, ifs, ifs_white);
 527
 528   /* Now tidy up */
 529 tidy_up:
 530   wordfree (&glob_list);
 531   return error;
 532 }
 533
 534 static int
 535 internal_function
 536 parse_squote (char **word, size_t *word_length, size_t *max_length,
 537               const char *words, size_t *offset)
 538 {
 539   /* We are poised just after a single quote */
 540   for (; words[*offset]; ++(*offset))
 541     {
 542       if (words[*offset] != '\'')
 543         {
 544           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 545           if (*word == NULL)
 546             return WRDE_NOSPACE;
 547         }
 548       else return 0;
 549     }
 550
 551   /* Unterminated string */
 552   return WRDE_SYNTAX;
 553 }
 554
 555 /* Functions to evaluate an arithmetic expression */
 556 static int
 557 internal_function
 558 eval_expr_val (char **expr, long int *result)
 559 {
 560   char *digit;
 561
 562   /* Skip white space */
 563   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 564
 565   if (*digit == '(')
 566     {
 567       /* Scan for closing paren */
 568       for (++digit; **expr && **expr != ')'; ++(*expr));
 569
 570       /* Is there one? */
 571       if (!**expr)
 572         return WRDE_SYNTAX;
 573
 574       *(*expr)++ = 0;
 575
 576       if (eval_expr (digit, result))
 577         return WRDE_SYNTAX;
 578
 579       return 0;
 580     }
 581
 582   /* POSIX requires that decimal, octal, and hexadecimal constants are
 583      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 584   *result = strtol (digit, expr, 0);
 585   if (digit == *expr)
 586     return WRDE_SYNTAX;
 587
 588   return 0;
 589 }
 590
 591 static int
 592 internal_function
 593 eval_expr_multdiv (char **expr, long int *result)
 594 {
 595   long int arg;
 596
 597   /* Read a Value */
 598   if (eval_expr_val (expr, result) != 0)
 599     return WRDE_SYNTAX;
 600
 601   while (**expr)
 602     {
 603       /* Skip white space */
 604       for (; *expr && **expr && isspace (**expr); ++(*expr));
 605
 606       if (**expr == '*')
 607         {
 608           ++(*expr);
 609           if (eval_expr_val (expr, &arg) != 0)
 610             return WRDE_SYNTAX;
 611
 612           *result *= arg;
 613         }
 614       else if (**expr == '/')
 615         {
 616           ++(*expr);
 617           if (eval_expr_val (expr, &arg) != 0)
 618             return WRDE_SYNTAX;
 619
 620           /* Division by zero or integer overflow.  */
 621           if (arg == 0 || (arg == -1 && *result == LONG_MIN))
 622             return WRDE_SYNTAX;
 623
 624           *result /= arg;
 625         }
 626       else break;
 627     }
 628
 629   return 0;
 630 }
 631
 632 static int
 633 internal_function
 634 eval_expr (char *expr, long int *result)
 635 {
 636   long int arg;
 637
 638   /* Read a Multdiv */
 639   if (eval_expr_multdiv (&expr, result) != 0)
 640     return WRDE_SYNTAX;
 641
 642   while (*expr)
 643     {
 644       /* Skip white space */
 645       for (; expr && *expr && isspace (*expr); ++expr);
 646
 647       if (*expr == '+')
 648         {
 649           ++expr;
 650           if (eval_expr_multdiv (&expr, &arg) != 0)
 651             return WRDE_SYNTAX;
 652
 653           *result += arg;
 654         }
 655       else if (*expr == '-')
 656         {
 657           ++expr;
 658           if (eval_expr_multdiv (&expr, &arg) != 0)
 659             return WRDE_SYNTAX;
 660
 661           *result -= arg;
 662         }
 663       else break;
 664     }
 665
 666   return 0;
 667 }
 668
 669 static int
 670 internal_function
 671 parse_arith (char **word, size_t *word_length, size_t *max_length,
 672              const char *words, size_t *offset, int flags, int bracket)
 673 {
 674   /* We are poised just after "$((" or "$[" */
 675   int error;
 676   int paren_depth = 1;
 677   size_t expr_length;
 678   size_t expr_maxlen;
 679   char *expr;
 680
 681   expr = w_newword (&expr_length, &expr_maxlen);
 682   for (; words[*offset]; ++(*offset))
 683     {
 684       switch (words[*offset])
 685         {
 686         case '$':
 687           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 688                                  words, offset, flags, NULL, NULL, NULL, 1);
 689           /* The ``1'' here is to tell parse_dollars not to
 690            * split the fields.
 691            */
 692           if (error)
 693             {
 694               free (expr);
 695               return error;
 696             }
 697           break;
 698
 699         case '`':
 700           (*offset)++;
 701           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 702                                   words, offset, flags, NULL, NULL, NULL);
 703           /* The first NULL here is to tell parse_backtick not to
 704            * split the fields.
 705            */
 706           if (error)
 707             {
 708               free (expr);
 709               return error;
 710             }
 711           break;
 712
 713         case '\\':
 714           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 715                                        words, offset);
 716           if (error)
 717             {
 718               free (expr);
 719               return error;
 720             }
 721           /* I think that a backslash within an
 722            * arithmetic expansion is bound to
 723            * cause an error sooner or later anyway though.
 724            */
 725           break;
 726
 727         case ')':
 728           if (--paren_depth == 0)
 729             {
 730               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 731               long int numresult = 0;
 732               long long int convertme;
 733
 734               if (bracket || words[1 + *offset] != ')')
 735                 {
 736                   free (expr);
 737                   return WRDE_SYNTAX;
 738                 }
 739
 740               ++(*offset);
 741
 742               /* Go - evaluate. */
 743               if (*expr && eval_expr (expr, &numresult) != 0)
 744                 {
 745                   free (expr);
 746                   return WRDE_SYNTAX;
 747                 }
 748
 749               if (numresult < 0)
 750                 {
 751                   convertme = -numresult;
 752                   *word = w_addchar (*word, word_length, max_length, '-');
 753                   if (!*word)
 754                     {
 755                       free (expr);
 756                       return WRDE_NOSPACE;
 757                     }
 758                 }
 759               else
 760                 convertme = numresult;
 761
 762               result[20] = '\0';
 763               *word = w_addstr (*word, word_length, max_length,
 764                                 _itoa (convertme, &result[20], 10, 0));
 765               free (expr);
 766               return *word ? 0 : WRDE_NOSPACE;
 767             }
 768           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 769           if (expr == NULL)
 770             return WRDE_NOSPACE;
 771
 772           break;
 773
 774         case ']':
 775           if (bracket && paren_depth == 1)
 776             {
 777               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 778               long int numresult = 0;
 779
 780               /* Go - evaluate. */
 781               if (*expr && eval_expr (expr, &numresult) != 0)
 782                 {
 783                   free (expr);
 784                   return WRDE_SYNTAX;
 785                 }
 786
 787               result[20] = '\0';
 788               *word = w_addstr (*word, word_length, max_length,
 789                                 _itoa_word (numresult, &result[20], 10, 0));
 790               free (expr);
 791               return *word ? 0 : WRDE_NOSPACE;
 792             }
 793
 794           free (expr);
 795           return WRDE_SYNTAX;
 796
 797         case '\n':
 798         case ';':
 799         case '{':
 800         case '}':
 801           free (expr);
 802           return WRDE_BADCHAR;
 803
 804         case '(':
 805           ++paren_depth;
 806         default:
 807           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 808           if (expr == NULL)
 809             return WRDE_NOSPACE;
 810         }
 811     }
 812
 813   /* Premature end */
 814   free (expr);
 815   return WRDE_SYNTAX;
 816 }
 817
 818 /* Function called by child process in exec_comm() */
 819 static inline void
 820 internal_function __attribute__ ((always_inline))
 821 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 822 {
 823   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 824
 825   /* Execute the command, or just check syntax? */
 826   if (noexec)
 827     args[1] = "-nc";
 828
 829   /* Redirect output.  */
 830   if (__glibc_likely (fildes[1] != STDOUT_FILENO))
 831     {
 832       __dup2 (fildes[1], STDOUT_FILENO);
 833       __close (fildes[1]);
 834     }
 835   else
 836     {
 837 #ifdef O_CLOEXEC
 838       /* Reset the close-on-exec flag (if necessary).  */
 839 # ifndef __ASSUME_PIPE2
 840       if (__have_pipe2 > 0)
 841 # endif
 842         __fcntl (fildes[1], F_SETFD, 0);
 843 #endif
 844     }
 845
 846   /* Redirect stderr to /dev/null if we have to.  */
 847   if (showerr == 0)
 848     {
 849       struct stat64 st;
 850       int fd;
 851       __close (STDERR_FILENO);
 852       fd = __open (_PATH_DEVNULL, O_WRONLY);
 853       if (fd >= 0 && fd != STDERR_FILENO)
 854         {
 855           __dup2 (fd, STDERR_FILENO);
 856           __close (fd);
 857         }
 858       /* Be paranoid.  Check that we actually opened the /dev/null
 859          device.  */
 860       if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
 861           || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
 862 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 863           || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 864 #endif
 865           )
 866         /* It's not the /dev/null device.  Stop right here.  The
 867            problem is: how do we stop?  We use _exit() with an
 868            hopefully unusual exit code.  */
 869         _exit (90);
 870     }
 871
 872   /* Make sure the subshell doesn't field-split on our behalf. */
 873   __unsetenv ("IFS");
 874
 875   __close (fildes[0]);
 876   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 877
 878   /* Bad.  What now?  */
 879   abort ();
 880 }
 881
 882 /* Function to execute a command and retrieve the results */
 883 /* pwordexp contains NULL if field-splitting is forbidden */
 884 static int
 885 internal_function
 886 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 887            int flags, wordexp_t *pwordexp, const char *ifs,
 888            const char *ifs_white)
 889 {
 890   int fildes[2];
 891 #define bufsize 128
 892   int buflen;
 893   int i;
 894   int status = 0;
 895   size_t maxnewlines = 0;
 896   char buffer[bufsize];
 897   pid_t pid;
 898   int noexec = 0;
 899
 900   /* Do nothing if command substitution should not succeed.  */
 901   if (flags & WRDE_NOCMD)
 902     return WRDE_CMDSUB;
 903
 904   /* Don't fork() unless necessary */
 905   if (!comm || !*comm)
 906     return 0;
 907
 908 #ifdef O_CLOEXEC
 909 # ifndef __ASSUME_PIPE2
 910   if (__have_pipe2 >= 0)
 911 # endif
 912     {
 913       int r = __pipe2 (fildes, O_CLOEXEC);
 914 # ifndef __ASSUME_PIPE2
 915       if (__have_pipe2 == 0)
 916         __have_pipe2 = r != -1 || errno != ENOSYS ? 1 : -1;
 917
 918       if (__have_pipe2 > 0)
 919 # endif
 920         if (r < 0)
 921           /* Bad */
 922           return WRDE_NOSPACE;
 923     }
 924 #endif
 925 #ifndef __ASSUME_PIPE2
 926 # ifdef O_CLOEXEC
 927   if (__have_pipe2 < 0)
 928 # endif
 929     if (__pipe (fildes) < 0)
 930       /* Bad */
 931       return WRDE_NOSPACE;
 932 #endif
 933
 934  again:
 935   if ((pid = __fork ()) < 0)
 936     {
 937       /* Bad */
 938       __close (fildes[0]);
 939       __close (fildes[1]);
 940       return WRDE_NOSPACE;
 941     }
 942
 943   if (pid == 0)
 944     exec_comm_child (comm, fildes, noexec ? 0 : flags & WRDE_SHOWERR, noexec);
 945
 946   /* Parent */
 947
 948   /* If we are just testing the syntax, only wait.  */
 949   if (noexec)
 950     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 951             && status != 0) ? WRDE_SYNTAX : 0;
 952
 953   __close (fildes[1]);
 954   fildes[1] = -1;
 955
 956   if (!pwordexp)
 957     /* Quoted - no field splitting */
 958     {
 959       while (1)
 960         {
 961           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 962                                                     bufsize))) < 1)
 963             {
 964               /* If read returned 0 then the process has closed its
 965                  stdout.  Don't use WNOHANG in that case to avoid busy
 966                  looping until the process eventually exits.  */
 967               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
 968                                                  buflen == 0 ? 0 : WNOHANG))
 969                   == 0)
 970                 continue;
 971               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 972                                                         bufsize))) < 1)
 973                 break;
 974             }
 975
 976           maxnewlines += buflen;
 977
 978           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 979           if (*word == NULL)
 980             goto no_space;
 981         }
 982     }
 983   else
 984     /* Not quoted - split fields */
 985     {
 986       int copying = 0;
 987       /* 'copying' is:
 988        *  0 when searching for first character in a field not IFS white space
 989        *  1 when copying the text of a field
 990        *  2 when searching for possible non-whitespace IFS
 991        *  3 when searching for non-newline after copying field
 992        */
 993
 994       while (1)
 995         {
 996           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 997                                                     bufsize))) < 1)
 998             {
 999               /* If read returned 0 then the process has closed its
1000                  stdout.  Don't use WNOHANG in that case to avoid busy
1001                  looping until the process eventually exits.  */
1002               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
1003                                                  buflen == 0 ? 0 : WNOHANG))
1004                   == 0)
1005                 continue;
1006               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
1007                                                         bufsize))) < 1)
1008                 break;
1009             }
1010
1011           for (i = 0; i < buflen; ++i)
1012             {
1013               if (strchr (ifs, buffer[i]) != NULL)
1014                 {
1015                   /* Current character is IFS */
1016                   if (strchr (ifs_white, buffer[i]) == NULL)
1017                     {
1018                       /* Current character is IFS but not whitespace */
1019                       if (copying == 2)
1020                         {
1021                           /*            current character
1022                            *                   |
1023                            *                   V
1024                            * eg: text<space><comma><space>moretext
1025                            *
1026                            * So, strip whitespace IFS (like at the start)
1027                            */
1028                           copying = 0;
1029                           continue;
1030                         }
1031
1032                       copying = 0;
1033                       /* fall through and delimit field.. */
1034                     }
1035                   else
1036                     {
1037                       if (buffer[i] == '\n')
1038                         {
1039                           /* Current character is (IFS) newline */
1040
1041                           /* If copying a field, this is the end of it,
1042                              but maybe all that's left is trailing newlines.
1043                              So start searching for a non-newline. */
1044                           if (copying == 1)
1045                             copying = 3;
1046
1047                           continue;
1048                         }
1049                       else
1050                         {
1051                           /* Current character is IFS white space, but
1052                              not a newline */
1053
1054                           /* If not either copying a field or searching
1055                              for non-newline after a field, ignore it */
1056                           if (copying != 1 && copying != 3)
1057                             continue;
1058
1059                           /* End of field (search for non-ws IFS afterwards) */
1060                           copying = 2;
1061                         }
1062                     }
1063
1064                   /* First IFS white space (non-newline), or IFS non-whitespace.
1065                    * Delimit the field.  Nulls are converted by w_addword. */
1066                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1067                     goto no_space;
1068
1069                   *word = w_newword (word_length, max_length);
1070
1071                   maxnewlines = 0;
1072                   /* fall back round the loop.. */
1073                 }
1074               else
1075                 {
1076                   /* Not IFS character */
1077
1078                   if (copying == 3)
1079                     {
1080                       /* Nothing but (IFS) newlines since the last field,
1081                          so delimit it here before starting new word */
1082                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1083                         goto no_space;
1084
1085                       *word = w_newword (word_length, max_length);
1086                     }
1087
1088                   copying = 1;
1089
1090                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1091                     maxnewlines++;
1092                   else
1093                     maxnewlines = 0;
1094
1095                   *word = w_addchar (*word, word_length, max_length,
1096                                      buffer[i]);
1097                   if (*word == NULL)
1098                     goto no_space;
1099                 }
1100             }
1101         }
1102     }
1103
1104   /* Chop off trailing newlines (required by POSIX.2)  */
1105   /* Ensure we don't go back further than the beginning of the
1106      substitution (i.e. remove maxnewlines bytes at most) */
1107   while (maxnewlines-- != 0 &&
1108          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1109     {
1110       (*word)[--*word_length] = '\0';
1111
1112       /* If the last word was entirely newlines, turn it into a new word
1113        * which can be ignored if there's nothing following it. */
1114       if (*word_length == 0)
1115         {
1116           free (*word);
1117           *word = w_newword (word_length, max_length);
1118           break;
1119         }
1120     }
1121
1122   __close (fildes[0]);
1123   fildes[0] = -1;
1124
1125   /* Check for syntax error (re-execute but with "-n" flag) */
1126   if (buflen < 1 && status != 0)
1127     {
1128       noexec = 1;
1129       goto again;
1130     }
1131
1132   return 0;
1133
1134 no_space:
1135   __kill (pid, SIGKILL);
1136   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1137   __close (fildes[0]);
1138   return WRDE_NOSPACE;
1139 }
1140
1141 static int
1142 internal_function
1143 parse_comm (char **word, size_t *word_length, size_t *max_length,
1144             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1145             const char *ifs, const char *ifs_white)
1146 {
1147   /* We are poised just after "$(" */
1148   int paren_depth = 1;
1149   int error = 0;
1150   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1151   size_t comm_length;
1152   size_t comm_maxlen;
1153   char *comm = w_newword (&comm_length, &comm_maxlen);
1154
1155   for (; words[*offset]; ++(*offset))
1156     {
1157       switch (words[*offset])
1158         {
1159         case '\'':
1160           if (quoted == 0)
1161             quoted = 1;
1162           else if (quoted == 1)
1163             quoted = 0;
1164
1165           break;
1166
1167         case '"':
1168           if (quoted == 0)
1169             quoted = 2;
1170           else if (quoted == 2)
1171             quoted = 0;
1172
1173           break;
1174
1175         case ')':
1176           if (!quoted && --paren_depth == 0)
1177             {
1178               /* Go -- give script to the shell */
1179               if (comm)
1180                 {
1181 #ifdef __libc_ptf_call
1182                   /* We do not want the exec_comm call to be cut short
1183                      by a thread cancellation since cleanup is very
1184                      ugly.  Therefore disable cancellation for
1185                      now.  */
1186                   // XXX Ideally we do want the thread being cancelable.
1187                   // XXX If demand is there we'll change it.
1188                   int state = PTHREAD_CANCEL_ENABLE;
1189                   __libc_ptf_call (__pthread_setcancelstate,
1190                                    (PTHREAD_CANCEL_DISABLE, &state), 0);
1191 #endif
1192
1193                   error = exec_comm (comm, word, word_length, max_length,
1194                                      flags, pwordexp, ifs, ifs_white);
1195
1196 #ifdef __libc_ptf_call
1197                   __libc_ptf_call (__pthread_setcancelstate,
1198                                    (state, NULL), 0);
1199 #endif
1200
1201                   free (comm);
1202                 }
1203
1204               return error;
1205             }
1206
1207           /* This is just part of the script */
1208           break;
1209
1210         case '(':
1211           if (!quoted)
1212             ++paren_depth;
1213         }
1214
1215       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1216       if (comm == NULL)
1217         return WRDE_NOSPACE;
1218     }
1219
1220   /* Premature end.  */
1221   free (comm);
1222
1223   return WRDE_SYNTAX;
1224 }
1225
1226 #define CHAR_IN_SET(ch, char_set) \
1227   (memchr (char_set "", ch, sizeof (char_set) - 1) != NULL)
1228
1229 static int
1230 internal_function
1231 parse_param (char **word, size_t *word_length, size_t *max_length,
1232              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1233              const char *ifs, const char *ifs_white, int quoted)
1234 {
1235   /* We are poised just after "$" */
1236   enum action
1237   {
1238     ACT_NONE,
1239     ACT_RP_SHORT_LEFT = '#',
1240     ACT_RP_LONG_LEFT = 'L',
1241     ACT_RP_SHORT_RIGHT = '%',
1242     ACT_RP_LONG_RIGHT = 'R',
1243     ACT_NULL_ERROR = '?',
1244     ACT_NULL_SUBST = '-',
1245     ACT_NONNULL_SUBST = '+',
1246     ACT_NULL_ASSIGN = '='
1247   };
1248   size_t env_length;
1249   size_t env_maxlen;
1250   size_t pat_length;
1251   size_t pat_maxlen;
1252   size_t start = *offset;
1253   char *env;
1254   char *pattern;
1255   char *value = NULL;
1256   enum action action = ACT_NONE;
1257   int depth = 0;
1258   int colon_seen = 0;
1259   int seen_hash = 0;
1260   int free_value = 0;
1261   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1262   int error;
1263   int special = 0;
1264   char buffer[21];
1265   int brace = words[*offset] == '{';
1266
1267   env = w_newword (&env_length, &env_maxlen);
1268   pattern = w_newword (&pat_length, &pat_maxlen);
1269
1270   if (brace)
1271     ++*offset;
1272
1273   /* First collect the parameter name. */
1274
1275   if (words[*offset] == '#')
1276     {
1277       seen_hash = 1;
1278       if (!brace)
1279         goto envsubst;
1280       ++*offset;
1281     }
1282
1283   if (isalpha (words[*offset]) || words[*offset] == '_')
1284     {
1285       /* Normal parameter name. */
1286       do
1287         {
1288           env = w_addchar (env, &env_length, &env_maxlen,
1289                            words[*offset]);
1290           if (env == NULL)
1291             goto no_space;
1292         }
1293       while (isalnum (words[++*offset]) || words[*offset] == '_');
1294     }
1295   else if (isdigit (words[*offset]))
1296     {
1297       /* Numeric parameter name. */
1298       special = 1;
1299       do
1300         {
1301           env = w_addchar (env, &env_length, &env_maxlen,
1302                            words[*offset]);
1303           if (env == NULL)
1304             goto no_space;
1305           if (!brace)
1306             goto envsubst;
1307         }
1308       while (isdigit(words[++*offset]));
1309     }
1310   else if (CHAR_IN_SET (words[*offset], "*@$"))
1311     {
1312       /* Special parameter. */
1313       special = 1;
1314       env = w_addchar (env, &env_length, &env_maxlen,
1315                        words[*offset]);
1316       if (env == NULL)
1317         goto no_space;
1318       ++*offset;
1319     }
1320   else
1321     {
1322       if (brace)
1323         goto syntax;
1324     }
1325
1326   if (brace)
1327     {
1328       /* Check for special action to be applied to the value. */
1329       switch (words[*offset])
1330         {
1331         case '}':
1332           /* Evaluate. */
1333           goto envsubst;
1334
1335         case '#':
1336           action = ACT_RP_SHORT_LEFT;
1337           if (words[1 + *offset] == '#')
1338             {
1339               ++*offset;
1340               action = ACT_RP_LONG_LEFT;
1341             }
1342           break;
1343
1344         case '%':
1345           action = ACT_RP_SHORT_RIGHT;
1346           if (words[1 + *offset] == '%')
1347             {
1348               ++*offset;
1349               action = ACT_RP_LONG_RIGHT;
1350             }
1351           break;
1352
1353         case ':':
1354           if (!CHAR_IN_SET (words[1 + *offset], "-=?+"))
1355             goto syntax;
1356
1357           colon_seen = 1;
1358           action = words[++*offset];
1359           break;
1360
1361         case '-':
1362         case '=':
1363         case '?':
1364         case '+':
1365           action = words[*offset];
1366           break;
1367
1368         default:
1369           goto syntax;
1370         }
1371
1372       /* Now collect the pattern, but don't expand it yet. */
1373       ++*offset;
1374       for (; words[*offset]; ++(*offset))
1375         {
1376           switch (words[*offset])
1377             {
1378             case '{':
1379               if (!pattern_is_quoted)
1380                 ++depth;
1381               break;
1382
1383             case '}':
1384               if (!pattern_is_quoted)
1385                 {
1386                   if (depth == 0)
1387                     goto envsubst;
1388                   --depth;
1389                 }
1390               break;
1391
1392             case '\\':
1393               if (pattern_is_quoted)
1394                 /* Quoted; treat as normal character. */
1395                 break;
1396
1397               /* Otherwise, it's an escape: next character is literal. */
1398               if (words[++*offset] == '\0')
1399                 goto syntax;
1400
1401               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1402               if (pattern == NULL)
1403                 goto no_space;
1404
1405               break;
1406
1407             case '\'':
1408               if (pattern_is_quoted == 0)
1409                 pattern_is_quoted = 1;
1410               else if (pattern_is_quoted == 1)
1411                 pattern_is_quoted = 0;
1412
1413               break;
1414
1415             case '"':
1416               if (pattern_is_quoted == 0)
1417                 pattern_is_quoted = 2;
1418               else if (pattern_is_quoted == 2)
1419                 pattern_is_quoted = 0;
1420
1421               break;
1422             }
1423
1424           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1425                                words[*offset]);
1426           if (pattern == NULL)
1427             goto no_space;
1428         }
1429     }
1430
1431   /* End of input string -- remember to reparse the character that we
1432    * stopped at.  */
1433   --(*offset);
1434
1435 envsubst:
1436   if (words[start] == '{' && words[*offset] != '}')
1437     goto syntax;
1438
1439   if (env == NULL)
1440     {
1441       if (seen_hash)
1442         {
1443           /* $# expands to the number of positional parameters */
1444           buffer[20] = '\0';
1445           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1446           seen_hash = 0;
1447         }
1448       else
1449         {
1450           /* Just $ on its own */
1451           *offset = start - 1;
1452           *word = w_addchar (*word, word_length, max_length, '$');
1453           return *word ? 0 : WRDE_NOSPACE;
1454         }
1455     }
1456   /* Is it a numeric parameter? */
1457   else if (isdigit (env[0]))
1458     {
1459       int n = atoi (env);
1460
1461       if (n >= __libc_argc)
1462         /* Substitute NULL. */
1463         value = NULL;
1464       else
1465         /* Replace with appropriate positional parameter. */
1466         value = __libc_argv[n];
1467     }
1468   /* Is it a special parameter? */
1469   else if (special)
1470     {
1471       /* Is it `$$'? */
1472       if (*env == '$')
1473         {
1474           buffer[20] = '\0';
1475           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1476         }
1477       /* Is it `${#*}' or `${#@}'? */
1478       else if ((*env == '*' || *env == '@') && seen_hash)
1479         {
1480           buffer[20] = '\0';
1481           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1482                               &buffer[20], 10, 0);
1483           *word = w_addstr (*word, word_length, max_length, value);
1484           free (env);
1485           free (pattern);
1486           return *word ? 0 : WRDE_NOSPACE;
1487         }
1488       /* Is it `$*' or `$@' (unquoted) ? */
1489       else if (*env == '*' || (*env == '@' && !quoted))
1490         {
1491           size_t plist_len = 0;
1492           int p;
1493           char *end;
1494
1495           /* Build up value parameter by parameter (copy them) */
1496           for (p = 1; __libc_argv[p]; ++p)
1497             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1498           value = malloc (plist_len);
1499           if (value == NULL)
1500             goto no_space;
1501           end = value;
1502           *end = 0;
1503           for (p = 1; __libc_argv[p]; ++p)
1504             {
1505               if (p > 1)
1506                 *end++ = ' ';
1507               end = __stpcpy (end, __libc_argv[p]);
1508             }
1509
1510           free_value = 1;
1511         }
1512       else
1513         {
1514           /* Must be a quoted `$@' */
1515           assert (*env == '@' && quoted);
1516
1517           /* Each parameter is a separate word ("$@") */
1518           if (__libc_argc == 2)
1519             value = __libc_argv[1];
1520           else if (__libc_argc > 2)
1521             {
1522               int p;
1523
1524               /* Append first parameter to current word. */
1525               value = w_addstr (*word, word_length, max_length,
1526                                 __libc_argv[1]);
1527               if (value == NULL || w_addword (pwordexp, value))
1528                 goto no_space;
1529
1530               for (p = 2; __libc_argv[p + 1]; p++)
1531                 {
1532                   char *newword = __strdup (__libc_argv[p]);
1533                   if (newword == NULL || w_addword (pwordexp, newword))
1534                     goto no_space;
1535                 }
1536
1537               /* Start a new word with the last parameter. */
1538               *word = w_newword (word_length, max_length);
1539               value = __libc_argv[p];
1540             }
1541           else
1542             {
1543               free (env);
1544               free (pattern);
1545               return 0;
1546             }
1547         }
1548     }
1549   else
1550     value = getenv (env);
1551
1552   if (value == NULL && (flags & WRDE_UNDEF))
1553     {
1554       /* Variable not defined. */
1555       error = WRDE_BADVAL;
1556       goto do_error;
1557     }
1558
1559   if (action != ACT_NONE)
1560     {
1561       int expand_pattern = 0;
1562
1563       /* First, find out if we need to expand pattern (i.e. if we will
1564        * use it). */
1565       switch (action)
1566         {
1567         case ACT_RP_SHORT_LEFT:
1568         case ACT_RP_LONG_LEFT:
1569         case ACT_RP_SHORT_RIGHT:
1570         case ACT_RP_LONG_RIGHT:
1571           /* Always expand for these. */
1572           expand_pattern = 1;
1573           break;
1574
1575         case ACT_NULL_ERROR:
1576         case ACT_NULL_SUBST:
1577         case ACT_NULL_ASSIGN:
1578           if (!value || (!*value && colon_seen))
1579             /* If param is unset, or set but null and a colon has been seen,
1580                the expansion of the pattern will be needed. */
1581             expand_pattern = 1;
1582
1583           break;
1584
1585         case ACT_NONNULL_SUBST:
1586           /* Expansion of word will be needed if parameter is set and not null,
1587              or set null but no colon has been seen. */
1588           if (value && (*value || !colon_seen))
1589             expand_pattern = 1;
1590
1591           break;
1592
1593         default:
1594           assert (! "Unrecognised action!");
1595         }
1596
1597       if (expand_pattern)
1598         {
1599           /* We need to perform tilde expansion, parameter expansion,
1600              command substitution, and arithmetic expansion.  We also
1601              have to be a bit careful with wildcard characters, as
1602              pattern might be given to fnmatch soon.  To do this, we
1603              convert quotes to escapes. */
1604
1605           char *expanded;
1606           size_t exp_len;
1607           size_t exp_maxl;
1608           char *p;
1609           int quoted = 0; /* 1: single quotes; 2: double */
1610
1611           expanded = w_newword (&exp_len, &exp_maxl);
1612           for (p = pattern; p && *p; p++)
1613             {
1614               size_t offset;
1615
1616               switch (*p)
1617                 {
1618                 case '"':
1619                   if (quoted == 2)
1620                     quoted = 0;
1621                   else if (quoted == 0)
1622                     quoted = 2;
1623                   else break;
1624
1625                   continue;
1626
1627                 case '\'':
1628                   if (quoted == 1)
1629                     quoted = 0;
1630                   else if (quoted == 0)
1631                     quoted = 1;
1632                   else break;
1633
1634                   continue;
1635
1636                 case '*':
1637                 case '?':
1638                   if (quoted)
1639                     {
1640                       /* Convert quoted wildchar to escaped wildchar. */
1641                       expanded = w_addchar (expanded, &exp_len,
1642                                             &exp_maxl, '\\');
1643
1644                       if (expanded == NULL)
1645                         goto no_space;
1646                     }
1647                   break;
1648
1649                 case '$':
1650                   offset = 0;
1651                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1652                                          &offset, flags, NULL, NULL, NULL, 1);
1653                   if (error)
1654                     {
1655                       if (free_value)
1656                         free (value);
1657
1658                       free (expanded);
1659
1660                       goto do_error;
1661                     }
1662
1663                   p += offset;
1664                   continue;
1665
1666                 case '~':
1667                   if (quoted || exp_len)
1668                     break;
1669
1670                   offset = 0;
1671                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1672                                        &offset, 0);
1673                   if (error)
1674                     {
1675                       if (free_value)
1676                         free (value);
1677
1678                       free (expanded);
1679
1680                       goto do_error;
1681                     }
1682
1683                   p += offset;
1684                   continue;
1685
1686                 case '\\':
1687                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1688                   ++p;
1689                   assert (*p); /* checked when extracted initially */
1690                   if (expanded == NULL)
1691                     goto no_space;
1692                 }
1693
1694               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1695
1696               if (expanded == NULL)
1697                 goto no_space;
1698             }
1699
1700           free (pattern);
1701
1702           pattern = expanded;
1703         }
1704
1705       switch (action)
1706         {
1707         case ACT_RP_SHORT_LEFT:
1708         case ACT_RP_LONG_LEFT:
1709         case ACT_RP_SHORT_RIGHT:
1710         case ACT_RP_LONG_RIGHT:
1711           {
1712             char *p;
1713             char c;
1714             char *end;
1715
1716             if (value == NULL || pattern == NULL || *pattern == '\0')
1717               break;
1718
1719             end = value + strlen (value);
1720
1721             switch (action)
1722               {
1723               case ACT_RP_SHORT_LEFT:
1724                 for (p = value; p <= end; ++p)
1725                   {
1726                     c = *p;
1727                     *p = '\0';
1728                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1729                       {
1730                         *p = c;
1731                         if (free_value)
1732                           {
1733                             char *newval = __strdup (p);
1734                             if (newval == NULL)
1735                               {
1736                                 free (value);
1737                                 goto no_space;
1738                               }
1739                             free (value);
1740                             value = newval;
1741                           }
1742                         else
1743                           value = p;
1744                         break;
1745                       }
1746                     *p = c;
1747                   }
1748
1749                 break;
1750
1751               case ACT_RP_LONG_LEFT:
1752                 for (p = end; p >= value; --p)
1753                   {
1754                     c = *p;
1755                     *p = '\0';
1756                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1757                       {
1758                         *p = c;
1759                         if (free_value)
1760                           {
1761                             char *newval = __strdup (p);
1762                             if (newval == NULL)
1763                               {
1764                                 free (value);
1765                                 goto no_space;
1766                               }
1767                             free (value);
1768                             value = newval;
1769                           }
1770                         else
1771                           value = p;
1772                         break;
1773                       }
1774                     *p = c;
1775                   }
1776
1777                 break;
1778
1779               case ACT_RP_SHORT_RIGHT:
1780                 for (p = end; p >= value; --p)
1781                   {
1782                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1783                       {
1784                         char *newval;
1785                         newval = malloc (p - value + 1);
1786
1787                         if (newval == NULL)
1788                           {
1789                             if (free_value)
1790                               free (value);
1791                             goto no_space;
1792                           }
1793
1794                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1795                         if (free_value)
1796                           free (value);
1797                         value = newval;
1798                         free_value = 1;
1799                         break;
1800                       }
1801                   }
1802
1803                 break;
1804
1805               case ACT_RP_LONG_RIGHT:
1806                 for (p = value; p <= end; ++p)
1807                   {
1808                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1809                       {
1810                         char *newval;
1811                         newval = malloc (p - value + 1);
1812
1813                         if (newval == NULL)
1814                           {
1815                             if (free_value)
1816                               free (value);
1817                             goto no_space;
1818                           }
1819
1820                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1821                         if (free_value)
1822                           free (value);
1823                         value = newval;
1824                         free_value = 1;
1825                         break;
1826                       }
1827                   }
1828
1829                 break;
1830
1831               default:
1832                 break;
1833               }
1834
1835             break;
1836           }
1837
1838         case ACT_NULL_ERROR:
1839           if (value && *value)
1840             /* Substitute parameter */
1841             break;
1842
1843           error = 0;
1844           if (!colon_seen && value)
1845             /* Substitute NULL */
1846             ;
1847           else
1848             {
1849               const char *str = pattern;
1850
1851               if (str[0] == '\0')
1852                 str = _("parameter null or not set");
1853
1854               __fxprintf (NULL, "%s: %s\n", env, str);
1855             }
1856
1857           if (free_value)
1858             free (value);
1859           goto do_error;
1860
1861         case ACT_NULL_SUBST:
1862           if (value && *value)
1863             /* Substitute parameter */
1864             break;
1865
1866           if (free_value)
1867             free (value);
1868
1869           if (!colon_seen && value)
1870             /* Substitute NULL */
1871             goto success;
1872
1873           value = pattern ? __strdup (pattern) : pattern;
1874           free_value = 1;
1875
1876           if (pattern && !value)
1877             goto no_space;
1878
1879           break;
1880
1881         case ACT_NONNULL_SUBST:
1882           if (value && (*value || !colon_seen))
1883             {
1884               if (free_value)
1885                 free (value);
1886
1887               value = pattern ? __strdup (pattern) : pattern;
1888               free_value = 1;
1889
1890               if (pattern && !value)
1891                 goto no_space;
1892
1893               break;
1894             }
1895
1896           /* Substitute NULL */
1897           if (free_value)
1898             free (value);
1899           goto success;
1900
1901         case ACT_NULL_ASSIGN:
1902           if (value && *value)
1903             /* Substitute parameter */
1904             break;
1905
1906           if (!colon_seen && value)
1907             {
1908               /* Substitute NULL */
1909               if (free_value)
1910                 free (value);
1911               goto success;
1912             }
1913
1914           if (free_value)
1915             free (value);
1916
1917           value = pattern ? __strdup (pattern) : pattern;
1918           free_value = 1;
1919
1920           if (pattern && !value)
1921             goto no_space;
1922
1923           __setenv (env, value ?: "", 1);
1924           break;
1925
1926         default:
1927           assert (! "Unrecognised action!");
1928         }
1929     }
1930
1931   free (env);
1932   env = NULL;
1933   free (pattern);
1934   pattern = NULL;
1935
1936   if (seen_hash)
1937     {
1938       char param_length[21];
1939       param_length[20] = '\0';
1940       *word = w_addstr (*word, word_length, max_length,
1941                         _itoa_word (value ? strlen (value) : 0,
1942                                     &param_length[20], 10, 0));
1943       if (free_value)
1944         {
1945           assert (value != NULL);
1946           free (value);
1947         }
1948
1949       return *word ? 0 : WRDE_NOSPACE;
1950     }
1951
1952   if (value == NULL)
1953     return 0;
1954
1955   if (quoted || !pwordexp)
1956     {
1957       /* Quoted - no field split */
1958       *word = w_addstr (*word, word_length, max_length, value);
1959       if (free_value)
1960         free (value);
1961
1962       return *word ? 0 : WRDE_NOSPACE;
1963     }
1964   else
1965     {
1966       /* Need to field-split */
1967       char *value_copy = __strdup (value); /* Don't modify value */
1968       char *field_begin = value_copy;
1969       int seen_nonws_ifs = 0;
1970
1971       if (free_value)
1972         free (value);
1973
1974       if (value_copy == NULL)
1975         goto no_space;
1976
1977       do
1978         {
1979           char *field_end = field_begin;
1980           char *next_field;
1981
1982           /* If this isn't the first field, start a new word */
1983           if (field_begin != value_copy)
1984             {
1985               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1986                 {
1987                   free (value_copy);
1988                   goto no_space;
1989                 }
1990
1991               *word = w_newword (word_length, max_length);
1992             }
1993
1994           /* Skip IFS whitespace before the field */
1995           field_begin += strspn (field_begin, ifs_white);
1996
1997           if (!seen_nonws_ifs && *field_begin == 0)
1998             /* Nothing but whitespace */
1999             break;
2000
2001           /* Search for the end of the field */
2002           field_end = field_begin + strcspn (field_begin, ifs);
2003
2004           /* Set up pointer to the character after end of field and
2005              skip whitespace IFS after it. */
2006           next_field = field_end + strspn (field_end, ifs_white);
2007
2008           /* Skip at most one non-whitespace IFS character after the field */
2009           seen_nonws_ifs = 0;
2010           if (*next_field && strchr (ifs, *next_field))
2011             {
2012               seen_nonws_ifs = 1;
2013               next_field++;
2014             }
2015
2016           /* Null-terminate it */
2017           *field_end = 0;
2018
2019           /* Tag a copy onto the current word */
2020           *word = w_addstr (*word, word_length, max_length, field_begin);
2021
2022           if (*word == NULL && *field_begin != '\0')
2023             {
2024               free (value_copy);
2025               goto no_space;
2026             }
2027
2028           field_begin = next_field;
2029         }
2030       while (seen_nonws_ifs || *field_begin);
2031
2032       free (value_copy);
2033     }
2034
2035   return 0;
2036
2037 success:
2038   error = 0;
2039   goto do_error;
2040
2041 no_space:
2042   error = WRDE_NOSPACE;
2043   goto do_error;
2044
2045 syntax:
2046   error = WRDE_SYNTAX;
2047
2048 do_error:
2049   free (env);
2050
2051   free (pattern);
2052
2053   return error;
2054 }
2055
2056 #undef CHAR_IN_SET
2057
2058 static int
2059 internal_function
2060 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2061                const char *words, size_t *offset, int flags,
2062                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2063                int quoted)
2064 {
2065   /* We are poised _at_ "$" */
2066   switch (words[1 + *offset])
2067     {
2068     case '"':
2069     case '\'':
2070     case 0:
2071       *word = w_addchar (*word, word_length, max_length, '$');
2072       return *word ? 0 : WRDE_NOSPACE;
2073
2074     case '(':
2075       if (words[2 + *offset] == '(')
2076         {
2077           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2078           int i = 3 + *offset;
2079           int depth = 0;
2080           while (words[i] && !(depth == 0 && words[i] == ')'))
2081             {
2082               if (words[i] == '(')
2083                 ++depth;
2084               else if (words[i] == ')')
2085                 --depth;
2086
2087               ++i;
2088             }
2089
2090           if (words[i] == ')' && words[i + 1] == ')')
2091             {
2092               (*offset) += 3;
2093               /* Call parse_arith -- 0 is for "no brackets" */
2094               return parse_arith (word, word_length, max_length, words, offset,
2095                                   flags, 0);
2096             }
2097         }
2098
2099       (*offset) += 2;
2100       return parse_comm (word, word_length, max_length, words, offset, flags,
2101                          quoted? NULL : pwordexp, ifs, ifs_white);
2102
2103     case '[':
2104       (*offset) += 2;
2105       /* Call parse_arith -- 1 is for "brackets" */
2106       return parse_arith (word, word_length, max_length, words, offset, flags,
2107                           1);
2108
2109     case '{':
2110     default:
2111       ++(*offset);      /* parse_param needs to know if "{" is there */
2112       return parse_param (word, word_length, max_length, words, offset, flags,
2113                            pwordexp, ifs, ifs_white, quoted);
2114     }
2115 }
2116
2117 static int
2118 internal_function
2119 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2120                 const char *words, size_t *offset, int flags,
2121                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2122 {
2123   /* We are poised just after "`" */
2124   int error;
2125   int squoting = 0;
2126   size_t comm_length;
2127   size_t comm_maxlen;
2128   char *comm = w_newword (&comm_length, &comm_maxlen);
2129
2130   for (; words[*offset]; ++(*offset))
2131     {
2132       switch (words[*offset])
2133         {
2134         case '`':
2135           /* Go -- give the script to the shell */
2136           error = exec_comm (comm, word, word_length, max_length, flags,
2137                              pwordexp, ifs, ifs_white);
2138           free (comm);
2139           return error;
2140
2141         case '\\':
2142           if (squoting)
2143             {
2144               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2145                                            words, offset);
2146
2147               if (error)
2148                 {
2149                   free (comm);
2150                   return error;
2151                 }
2152
2153               break;
2154             }
2155
2156           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2157                                    offset);
2158
2159           if (error)
2160             {
2161               free (comm);
2162               return error;
2163             }
2164
2165           break;
2166
2167         case '\'':
2168           squoting = 1 - squoting;
2169         default:
2170           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2171           if (comm == NULL)
2172             return WRDE_NOSPACE;
2173         }
2174     }
2175
2176   /* Premature end */
2177   free (comm);
2178   return WRDE_SYNTAX;
2179 }
2180
2181 static int
2182 internal_function
2183 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2184               const char *words, size_t *offset, int flags,
2185               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2186 {
2187   /* We are poised just after a double-quote */
2188   int error;
2189
2190   for (; words[*offset]; ++(*offset))
2191     {
2192       switch (words[*offset])
2193         {
2194         case '"':
2195           return 0;
2196
2197         case '$':
2198           error = parse_dollars (word, word_length, max_length, words, offset,
2199                                  flags, pwordexp, ifs, ifs_white, 1);
2200           /* The ``1'' here is to tell parse_dollars not to
2201            * split the fields.  It may need to, however ("$@").
2202            */
2203           if (error)
2204             return error;
2205
2206           break;
2207
2208         case '`':
2209           ++(*offset);
2210           error = parse_backtick (word, word_length, max_length, words,
2211                                   offset, flags, NULL, NULL, NULL);
2212           /* The first NULL here is to tell parse_backtick not to
2213            * split the fields.
2214            */
2215           if (error)
2216             return error;
2217
2218           break;
2219
2220         case '\\':
2221           error = parse_qtd_backslash (word, word_length, max_length, words,
2222                                        offset);
2223
2224           if (error)
2225             return error;
2226
2227           break;
2228
2229         default:
2230           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2231           if (*word == NULL)
2232             return WRDE_NOSPACE;
2233         }
2234     }
2235
2236   /* Unterminated string */
2237   return WRDE_SYNTAX;
2238 }
2239
2240 /*
2241  * wordfree() is to be called after pwordexp is finished with.
2242  */
2243
2244 void
2245 wordfree (wordexp_t *pwordexp)
2246 {
2247
2248   /* wordexp can set pwordexp to NULL */
2249   if (pwordexp && pwordexp->we_wordv)
2250     {
2251       char **wordv = pwordexp->we_wordv;
2252
2253       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2254         free (*wordv);
2255
2256       free (pwordexp->we_wordv);
2257       pwordexp->we_wordv = NULL;
2258     }
2259 }
2260 libc_hidden_def (wordfree)
2261
2262 /*
2263  * wordexp()
2264  */
2265
2266 int
2267 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2268 {
2269   size_t words_offset;
2270   size_t word_length;
2271   size_t max_length;
2272   char *word = w_newword (&word_length, &max_length);
2273   int error;
2274   char *ifs;
2275   char ifs_white[4];
2276   wordexp_t old_word = *pwordexp;
2277
2278   if (flags & WRDE_REUSE)
2279     {
2280       /* Minimal implementation of WRDE_REUSE for now */
2281       wordfree (pwordexp);
2282       old_word.we_wordv = NULL;
2283     }
2284
2285   if ((flags & WRDE_APPEND) == 0)
2286     {
2287       pwordexp->we_wordc = 0;
2288
2289       if (flags & WRDE_DOOFFS)
2290         {
2291           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2292           if (pwordexp->we_wordv == NULL)
2293             {
2294               error = WRDE_NOSPACE;
2295               goto do_error;
2296             }
2297         }
2298       else
2299         {
2300           pwordexp->we_wordv = calloc (1, sizeof (char *));
2301           if (pwordexp->we_wordv == NULL)
2302             {
2303               error = WRDE_NOSPACE;
2304               goto do_error;
2305             }
2306
2307           pwordexp->we_offs = 0;
2308         }
2309     }
2310
2311   /* Find out what the field separators are.
2312    * There are two types: whitespace and non-whitespace.
2313    */
2314   ifs = getenv ("IFS");
2315
2316   if (ifs == NULL)
2317     /* IFS unset - use <space><tab><newline>. */
2318     ifs = strcpy (ifs_white, " \t\n");
2319   else
2320     {
2321       char *ifsch = ifs;
2322       char *whch = ifs_white;
2323
2324       while (*ifsch != '\0')
2325         {
2326           if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2327             {
2328               /* Whitespace IFS.  See first whether it is already in our
2329                  collection.  */
2330               char *runp = ifs_white;
2331
2332               while (runp < whch && *runp != *ifsch)
2333                 ++runp;
2334
2335               if (runp == whch)
2336                 *whch++ = *ifsch;
2337             }
2338
2339           ++ifsch;
2340         }
2341       *whch = '\0';
2342     }
2343
2344   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2345     switch (words[words_offset])
2346       {
2347       case '\\':
2348         error = parse_backslash (&word, &word_length, &max_length, words,
2349                                  &words_offset);
2350
2351         if (error)
2352           goto do_error;
2353
2354         break;
2355
2356       case '$':
2357         error = parse_dollars (&word, &word_length, &max_length, words,
2358                                &words_offset, flags, pwordexp, ifs, ifs_white,
2359                                0);
2360
2361         if (error)
2362           goto do_error;
2363
2364         break;
2365
2366       case '`':
2367         ++words_offset;
2368         error = parse_backtick (&word, &word_length, &max_length, words,
2369                                 &words_offset, flags, pwordexp, ifs,
2370                                 ifs_white);
2371
2372         if (error)
2373           goto do_error;
2374
2375         break;
2376
2377       case '"':
2378         ++words_offset;
2379         error = parse_dquote (&word, &word_length, &max_length, words,
2380                               &words_offset, flags, pwordexp, ifs, ifs_white);
2381
2382         if (error)
2383           goto do_error;
2384
2385         if (!word_length)
2386           {
2387             error = w_addword (pwordexp, NULL);
2388
2389             if (error)
2390               return error;
2391           }
2392
2393         break;
2394
2395       case '\'':
2396         ++words_offset;
2397         error = parse_squote (&word, &word_length, &max_length, words,
2398                               &words_offset);
2399
2400         if (error)
2401           goto do_error;
2402
2403         if (!word_length)
2404           {
2405             error = w_addword (pwordexp, NULL);
2406
2407             if (error)
2408               return error;
2409           }
2410
2411         break;
2412
2413       case '~':
2414         error = parse_tilde (&word, &word_length, &max_length, words,
2415                              &words_offset, pwordexp->we_wordc);
2416
2417         if (error)
2418           goto do_error;
2419
2420         break;
2421
2422       case '*':
2423       case '[':
2424       case '?':
2425         error = parse_glob (&word, &word_length, &max_length, words,
2426                             &words_offset, flags, pwordexp, ifs, ifs_white);
2427
2428         if (error)
2429           goto do_error;
2430
2431         break;
2432
2433       default:
2434         /* Is it a word separator? */
2435         if (strchr (" \t", words[words_offset]) == NULL)
2436           {
2437             char ch = words[words_offset];
2438
2439             /* Not a word separator -- but is it a valid word char? */
2440             if (strchr ("\n|&;<>(){}", ch))
2441               {
2442                 /* Fail */
2443                 error = WRDE_BADCHAR;
2444                 goto do_error;
2445               }
2446
2447             /* "Ordinary" character -- add it to word */
2448             word = w_addchar (word, &word_length, &max_length,
2449                               ch);
2450             if (word == NULL)
2451               {
2452                 error = WRDE_NOSPACE;
2453                 goto do_error;
2454               }
2455
2456             break;
2457           }
2458
2459         /* If a word has been delimited, add it to the list. */
2460         if (word != NULL)
2461           {
2462             error = w_addword (pwordexp, word);
2463             if (error)
2464               goto do_error;
2465           }
2466
2467         word = w_newword (&word_length, &max_length);
2468       }
2469
2470   /* End of string */
2471
2472   /* There was a word separator at the end */
2473   if (word == NULL) /* i.e. w_newword */
2474     return 0;
2475
2476   /* There was no field separator at the end */
2477   return w_addword (pwordexp, word);
2478
2479 do_error:
2480   /* Error:
2481    *    free memory used (unless error is WRDE_NOSPACE), and
2482    *    set pwordexp members back to what they were.
2483    */
2484
2485   free (word);
2486
2487   if (error == WRDE_NOSPACE)
2488     return WRDE_NOSPACE;
2489
2490   if ((flags & WRDE_APPEND) == 0)
2491     wordfree (pwordexp);
2492
2493   *pwordexp = old_word;
2494   return error;
2495 }