posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997-2002, 2003, 2005, 2006 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, write to the Free
  18    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  19    02111-1307 USA.  */
  20
  21 #include <alloca.h>
  22 #include <ctype.h>
  23 #include <errno.h>
  24 #include <fcntl.h>
  25 #include <fnmatch.h>
  26 #include <glob.h>
  27 #include <libintl.h>
  28 #include <paths.h>
  29 #include <pwd.h>
  30 #include <signal.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <sys/param.h>
  35 #include <sys/stat.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/types.h>
  39 #include <sys/wait.h>
  40 #include <unistd.h>
  41 #ifdef USE_IN_LIBIO
  42 # include <wchar.h>
  43 #endif
  44 #include <wordexp.h>
  45
  46 #include <bits/libc-lock.h>
  47 #include <stdio-common/_itoa.h>
  48
  49 /* Undefine the following line for the production version.  */
  50 /* #define NDEBUG 1 */
  51 #include <assert.h>
  52
  53 /* Get some device information.  */
  54 #include <device-nrs.h>
  55
  56 /*
  57  * This is a recursive-descent-style word expansion routine.
  58  */
  59
  60 /* These variables are defined and initialized in the startup code.  */
  61 extern int __libc_argc attribute_hidden;
  62 extern char **__libc_argv attribute_hidden;
  63
  64 /* Some forward declarations */
  65 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  66                           const char *words, size_t *offset, int flags,
  67                           wordexp_t *pwordexp, const char *ifs,
  68                           const char *ifs_white, int quoted)
  69      internal_function;
  70 static int parse_backtick (char **word, size_t *word_length,
  71                            size_t *max_length, const char *words,
  72                            size_t *offset, int flags, wordexp_t *pwordexp,
  73                            const char *ifs, const char *ifs_white)
  74      internal_function;
  75 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  76                          const char *words, size_t *offset, int flags,
  77                          wordexp_t *pwordexp, const char *ifs,
  78                          const char *ifs_white)
  79      internal_function;
  80 static int eval_expr (char *expr, long int *result) internal_function;
  81
  82 /* The w_*() functions manipulate word lists. */
  83
  84 #define W_CHUNK (100)
  85
  86 /* Result of w_newword will be ignored if it's the last word. */
  87 static inline char *
  88 w_newword (size_t *actlen, size_t *maxlen)
  89 {
  90   *actlen = *maxlen = 0;
  91   return NULL;
  92 }
  93
  94 static char *
  95 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  96      /* (lengths exclude trailing zero) */
  97 {
  98   /* Add a character to the buffer, allocating room for it if needed.  */
  99
 100   if (*actlen == *maxlen)
 101     {
 102       char *old_buffer = buffer;
 103       assert (buffer == NULL || *maxlen != 0);
 104       *maxlen += W_CHUNK;
 105       buffer = (char *) realloc (buffer, 1 + *maxlen);
 106
 107       if (buffer == NULL)
 108         free (old_buffer);
 109     }
 110
 111   if (buffer != NULL)
 112     {
 113       buffer[*actlen] = ch;
 114       buffer[++(*actlen)] = '\0';
 115     }
 116
 117   return buffer;
 118 }
 119
 120 static char *
 121 internal_function
 122 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 123           size_t len)
 124 {
 125   /* Add a string to the buffer, allocating room for it if needed.
 126    */
 127   if (*actlen + len > *maxlen)
 128     {
 129       char *old_buffer = buffer;
 130       assert (buffer == NULL || *maxlen != 0);
 131       *maxlen += MAX (2 * len, W_CHUNK);
 132       buffer = realloc (old_buffer, 1 + *maxlen);
 133
 134       if (buffer == NULL)
 135         free (old_buffer);
 136     }
 137
 138   if (buffer != NULL)
 139     {
 140       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 141       *actlen += len;
 142     }
 143
 144   return buffer;
 145 }
 146
 147 static char *
 148 internal_function
 149 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 150      /* (lengths exclude trailing zero) */
 151 {
 152   /* Add a string to the buffer, allocating room for it if needed.
 153    */
 154   size_t len;
 155
 156   assert (str != NULL); /* w_addstr only called from this file */
 157   len = strlen (str);
 158
 159   return w_addmem (buffer, actlen, maxlen, str, len);
 160 }
 161
 162 static int
 163 internal_function
 164 w_addword (wordexp_t *pwordexp, char *word)
 165 {
 166   /* Add a word to the wordlist */
 167   size_t num_p;
 168   char **new_wordv;
 169   bool allocated = false;
 170
 171   /* Internally, NULL acts like "".  Convert NULLs to "" before
 172    * the caller sees them.
 173    */
 174   if (word == NULL)
 175     {
 176       word = __strdup ("");
 177       if (word == NULL)
 178         goto no_space;
 179       allocated = true;
 180     }
 181
 182   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 183   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 184   if (new_wordv != NULL)
 185     {
 186       pwordexp->we_wordv = new_wordv;
 187       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
 188       pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
 189       return 0;
 190     }
 191
 192   if (allocated)
 193     free (word);
 194
 195 no_space:
 196   return WRDE_NOSPACE;
 197 }
 198
 199 /* The parse_*() functions should leave *offset being the offset in 'words'
 200  * to the last character processed.
 201  */
 202
 203 static int
 204 internal_function
 205 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 206                  const char *words, size_t *offset)
 207 {
 208   /* We are poised _at_ a backslash, not in quotes */
 209
 210   switch (words[1 + *offset])
 211     {
 212     case 0:
 213       /* Backslash is last character of input words */
 214       return WRDE_SYNTAX;
 215
 216     case '\n':
 217       ++(*offset);
 218       break;
 219
 220     default:
 221       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 222       if (*word == NULL)
 223         return WRDE_NOSPACE;
 224
 225       ++(*offset);
 226       break;
 227     }
 228
 229   return 0;
 230 }
 231
 232 static int
 233 internal_function
 234 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 235                      const char *words, size_t *offset)
 236 {
 237   /* We are poised _at_ a backslash, inside quotes */
 238
 239   switch (words[1 + *offset])
 240     {
 241     case 0:
 242       /* Backslash is last character of input words */
 243       return WRDE_SYNTAX;
 244
 245     case '\n':
 246       ++(*offset);
 247       break;
 248
 249     case '$':
 250     case '`':
 251     case '"':
 252     case '\\':
 253       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 254       if (*word == NULL)
 255         return WRDE_NOSPACE;
 256
 257       ++(*offset);
 258       break;
 259
 260     default:
 261       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 262       if (*word != NULL)
 263         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 264
 265       if (*word == NULL)
 266         return WRDE_NOSPACE;
 267
 268       ++(*offset);
 269       break;
 270     }
 271
 272   return 0;
 273 }
 274
 275 static int
 276 internal_function
 277 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 278              const char *words, size_t *offset, size_t wordc)
 279 {
 280   /* We are poised _at_ a tilde */
 281   size_t i;
 282
 283   if (*word_length != 0)
 284     {
 285       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 286         {
 287           if (!((*word)[*word_length - 1] == ':'
 288                 && strchr (*word, '=') && wordc == 0))
 289             {
 290               *word = w_addchar (*word, word_length, max_length, '~');
 291               return *word ? 0 : WRDE_NOSPACE;
 292             }
 293         }
 294     }
 295
 296   for (i = 1 + *offset; words[i]; i++)
 297     {
 298       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 299           words[i] == '\t' || words[i] == 0 )
 300         break;
 301
 302       if (words[i] == '\\')
 303         {
 304           *word = w_addchar (*word, word_length, max_length, '~');
 305           return *word ? 0 : WRDE_NOSPACE;
 306         }
 307     }
 308
 309   if (i == 1 + *offset)
 310     {
 311       /* Tilde appears on its own */
 312       uid_t uid;
 313       struct passwd pwd, *tpwd;
 314       int buflen = 1000;
 315       char* home;
 316       char* buffer;
 317       int result;
 318
 319       /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
 320          results are unspecified.  We do a lookup on the uid if
 321          HOME is unset. */
 322
 323       home = getenv ("HOME");
 324       if (home != NULL)
 325         {
 326           *word = w_addstr (*word, word_length, max_length, home);
 327           if (*word == NULL)
 328             return WRDE_NOSPACE;
 329         }
 330       else
 331         {
 332           uid = __getuid ();
 333           buffer = __alloca (buflen);
 334
 335           while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 336                  && errno == ERANGE)
 337             buffer = extend_alloca (buffer, buflen, buflen + 1000);
 338
 339           if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
 340             {
 341               *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 342               if (*word == NULL)
 343                 return WRDE_NOSPACE;
 344             }
 345           else
 346             {
 347               *word = w_addchar (*word, word_length, max_length, '~');
 348               if (*word == NULL)
 349                 return WRDE_NOSPACE;
 350             }
 351         }
 352     }
 353   else
 354     {
 355       /* Look up user name in database to get home directory */
 356       char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
 357       struct passwd pwd, *tpwd;
 358       int buflen = 1000;
 359       char* buffer = __alloca (buflen);
 360       int result;
 361
 362       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 363              && errno == ERANGE)
 364         buffer = extend_alloca (buffer, buflen, buflen + 1000);
 365
 366       if (result == 0 && tpwd != NULL && pwd.pw_dir)
 367         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 368       else
 369         {
 370           /* (invalid login name) */
 371           *word = w_addchar (*word, word_length, max_length, '~');
 372           if (*word != NULL)
 373             *word = w_addstr (*word, word_length, max_length, user);
 374         }
 375
 376       *offset = i - 1;
 377     }
 378   return *word ? 0 : WRDE_NOSPACE;
 379 }
 380
 381
 382 static int
 383 internal_function
 384 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 385                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 386                const char *ifs_white)
 387 {
 388   int error;
 389   unsigned int match;
 390   glob_t globbuf;
 391
 392   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 393
 394   if (error != 0)
 395     {
 396       /* We can only run into memory problems.  */
 397       assert (error == GLOB_NOSPACE);
 398       return WRDE_NOSPACE;
 399     }
 400
 401   if (ifs && !*ifs)
 402     {
 403       /* No field splitting allowed. */
 404       assert (globbuf.gl_pathv[0] != NULL);
 405       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 406       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 407         {
 408           *word = w_addchar (*word, word_length, max_length, ' ');
 409           if (*word != NULL)
 410             *word = w_addstr (*word, word_length, max_length,
 411                               globbuf.gl_pathv[match]);
 412         }
 413
 414       globfree (&globbuf);
 415       return *word ? 0 : WRDE_NOSPACE;
 416     }
 417
 418   assert (ifs == NULL || *ifs != '\0');
 419   if (*word != NULL)
 420     {
 421       free (*word);
 422       *word = w_newword (word_length, max_length);
 423     }
 424
 425   for (match = 0; match < globbuf.gl_pathc; ++match)
 426     {
 427       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 428       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 429         {
 430           globfree (&globbuf);
 431           return WRDE_NOSPACE;
 432         }
 433     }
 434
 435   globfree (&globbuf);
 436   return 0;
 437 }
 438
 439 static int
 440 internal_function
 441 parse_glob (char **word, size_t *word_length, size_t *max_length,
 442             const char *words, size_t *offset, int flags,
 443             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 444 {
 445   /* We are poised just after a '*', a '[' or a '?'. */
 446   int error = WRDE_NOSPACE;
 447   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 448   size_t i;
 449   wordexp_t glob_list; /* List of words to glob */
 450
 451   glob_list.we_wordc = 0;
 452   glob_list.we_wordv = NULL;
 453   glob_list.we_offs = 0;
 454   for (; words[*offset] != '\0'; ++*offset)
 455     {
 456       if ((ifs && strchr (ifs, words[*offset])) ||
 457           (!ifs && strchr (" \t\n", words[*offset])))
 458         /* Reached IFS */
 459         break;
 460
 461       /* Sort out quoting */
 462       if (words[*offset] == '\'')
 463         {
 464           if (quoted == 0)
 465             {
 466               quoted = 1;
 467               continue;
 468             }
 469           else if (quoted == 1)
 470             {
 471               quoted = 0;
 472               continue;
 473             }
 474         }
 475       else if (words[*offset] == '"')
 476         {
 477           if (quoted == 0)
 478             {
 479               quoted = 2;
 480               continue;
 481             }
 482           else if (quoted == 2)
 483             {
 484               quoted = 0;
 485               continue;
 486             }
 487         }
 488
 489       /* Sort out other special characters */
 490       if (quoted != 1 && words[*offset] == '$')
 491         {
 492           error = parse_dollars (word, word_length, max_length, words,
 493                                  offset, flags, &glob_list, ifs, ifs_white,
 494                                  quoted == 2);
 495           if (error)
 496             goto tidy_up;
 497
 498           continue;
 499         }
 500       else if (words[*offset] == '\\')
 501         {
 502           if (quoted)
 503             error = parse_qtd_backslash (word, word_length, max_length,
 504                                          words, offset);
 505           else
 506             error = parse_backslash (word, word_length, max_length,
 507                                      words, offset);
 508
 509           if (error)
 510             goto tidy_up;
 511
 512           continue;
 513         }
 514
 515       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 516       if (*word == NULL)
 517         goto tidy_up;
 518     }
 519
 520   /* Don't forget to re-parse the character we stopped at. */
 521   --*offset;
 522
 523   /* Glob the words */
 524   error = w_addword (&glob_list, *word);
 525   *word = w_newword (word_length, max_length);
 526   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 527     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 528                            max_length, pwordexp, ifs, ifs_white);
 529
 530   /* Now tidy up */
 531 tidy_up:
 532   wordfree (&glob_list);
 533   return error;
 534 }
 535
 536 static int
 537 internal_function
 538 parse_squote (char **word, size_t *word_length, size_t *max_length,
 539               const char *words, size_t *offset)
 540 {
 541   /* We are poised just after a single quote */
 542   for (; words[*offset]; ++(*offset))
 543     {
 544       if (words[*offset] != '\'')
 545         {
 546           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 547           if (*word == NULL)
 548             return WRDE_NOSPACE;
 549         }
 550       else return 0;
 551     }
 552
 553   /* Unterminated string */
 554   return WRDE_SYNTAX;
 555 }
 556
 557 /* Functions to evaluate an arithmetic expression */
 558 static int
 559 internal_function
 560 eval_expr_val (char **expr, long int *result)
 561 {
 562   char *digit;
 563
 564   /* Skip white space */
 565   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 566
 567   if (*digit == '(')
 568     {
 569       /* Scan for closing paren */
 570       for (++digit; **expr && **expr != ')'; ++(*expr));
 571
 572       /* Is there one? */
 573       if (!**expr)
 574         return WRDE_SYNTAX;
 575
 576       *(*expr)++ = 0;
 577
 578       if (eval_expr (digit, result))
 579         return WRDE_SYNTAX;
 580
 581       return 0;
 582     }
 583
 584   /* POSIX requires that decimal, octal, and hexadecimal constants are
 585      recognized.  Therefore we pass 0 as the third parameter to strtol.  */
 586   *result = strtol (digit, expr, 0);
 587   if (digit == *expr)
 588     return WRDE_SYNTAX;
 589
 590   return 0;
 591 }
 592
 593 static int
 594 internal_function
 595 eval_expr_multdiv (char **expr, long int *result)
 596 {
 597   long int arg;
 598
 599   /* Read a Value */
 600   if (eval_expr_val (expr, result) != 0)
 601     return WRDE_SYNTAX;
 602
 603   while (**expr)
 604     {
 605       /* Skip white space */
 606       for (; *expr && **expr && isspace (**expr); ++(*expr));
 607
 608       if (**expr == '*')
 609         {
 610           ++(*expr);
 611           if (eval_expr_val (expr, &arg) != 0)
 612             return WRDE_SYNTAX;
 613
 614           *result *= arg;
 615         }
 616       else if (**expr == '/')
 617         {
 618           ++(*expr);
 619           if (eval_expr_val (expr, &arg) != 0)
 620             return WRDE_SYNTAX;
 621
 622           *result /= arg;
 623         }
 624       else break;
 625     }
 626
 627   return 0;
 628 }
 629
 630 static int
 631 internal_function
 632 eval_expr (char *expr, long int *result)
 633 {
 634   long int arg;
 635
 636   /* Read a Multdiv */
 637   if (eval_expr_multdiv (&expr, result) != 0)
 638     return WRDE_SYNTAX;
 639
 640   while (*expr)
 641     {
 642       /* Skip white space */
 643       for (; expr && *expr && isspace (*expr); ++expr);
 644
 645       if (*expr == '+')
 646         {
 647           ++expr;
 648           if (eval_expr_multdiv (&expr, &arg) != 0)
 649             return WRDE_SYNTAX;
 650
 651           *result += arg;
 652         }
 653       else if (*expr == '-')
 654         {
 655           ++expr;
 656           if (eval_expr_multdiv (&expr, &arg) != 0)
 657             return WRDE_SYNTAX;
 658
 659           *result -= arg;
 660         }
 661       else break;
 662     }
 663
 664   return 0;
 665 }
 666
 667 static int
 668 internal_function
 669 parse_arith (char **word, size_t *word_length, size_t *max_length,
 670              const char *words, size_t *offset, int flags, int bracket)
 671 {
 672   /* We are poised just after "$((" or "$[" */
 673   int error;
 674   int paren_depth = 1;
 675   size_t expr_length;
 676   size_t expr_maxlen;
 677   char *expr;
 678
 679   expr = w_newword (&expr_length, &expr_maxlen);
 680   for (; words[*offset]; ++(*offset))
 681     {
 682       switch (words[*offset])
 683         {
 684         case '$':
 685           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 686                                  words, offset, flags, NULL, NULL, NULL, 1);
 687           /* The ``1'' here is to tell parse_dollars not to
 688            * split the fields.
 689            */
 690           if (error)
 691             {
 692               free (expr);
 693               return error;
 694             }
 695           break;
 696
 697         case '`':
 698           (*offset)++;
 699           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 700                                   words, offset, flags, NULL, NULL, NULL);
 701           /* The first NULL here is to tell parse_backtick not to
 702            * split the fields.
 703            */
 704           if (error)
 705             {
 706               free (expr);
 707               return error;
 708             }
 709           break;
 710
 711         case '\\':
 712           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 713                                        words, offset);
 714           if (error)
 715             {
 716               free (expr);
 717               return error;
 718             }
 719           /* I think that a backslash within an
 720            * arithmetic expansion is bound to
 721            * cause an error sooner or later anyway though.
 722            */
 723           break;
 724
 725         case ')':
 726           if (--paren_depth == 0)
 727             {
 728               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 729               long int numresult = 0;
 730               long long int convertme;
 731
 732               if (bracket || words[1 + *offset] != ')')
 733                 {
 734                   free (expr);
 735                   return WRDE_SYNTAX;
 736                 }
 737
 738               ++(*offset);
 739
 740               /* Go - evaluate. */
 741               if (*expr && eval_expr (expr, &numresult) != 0)
 742                 {
 743                   free (expr);
 744                   return WRDE_SYNTAX;
 745                 }
 746
 747               if (numresult < 0)
 748                 {
 749                   convertme = -numresult;
 750                   *word = w_addchar (*word, word_length, max_length, '-');
 751                   if (!*word)
 752                     {
 753                       free (expr);
 754                       return WRDE_NOSPACE;
 755                     }
 756                 }
 757               else
 758                 convertme = numresult;
 759
 760               result[20] = '\0';
 761               *word = w_addstr (*word, word_length, max_length,
 762                                 _itoa (convertme, &result[20], 10, 0));
 763               free (expr);
 764               return *word ? 0 : WRDE_NOSPACE;
 765             }
 766           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 767           if (expr == NULL)
 768             return WRDE_NOSPACE;
 769
 770           break;
 771
 772         case ']':
 773           if (bracket && paren_depth == 1)
 774             {
 775               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 776               long int numresult = 0;
 777
 778               /* Go - evaluate. */
 779               if (*expr && eval_expr (expr, &numresult) != 0)
 780                 {
 781                   free (expr);
 782                   return WRDE_SYNTAX;
 783                 }
 784
 785               result[20] = '\0';
 786               *word = w_addstr (*word, word_length, max_length,
 787                                 _itoa_word (numresult, &result[20], 10, 0));
 788               free (expr);
 789               return *word ? 0 : WRDE_NOSPACE;
 790             }
 791
 792           free (expr);
 793           return WRDE_SYNTAX;
 794
 795         case '\n':
 796         case ';':
 797         case '{':
 798         case '}':
 799           free (expr);
 800           return WRDE_BADCHAR;
 801
 802         case '(':
 803           ++paren_depth;
 804         default:
 805           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 806           if (expr == NULL)
 807             return WRDE_NOSPACE;
 808         }
 809     }
 810
 811   /* Premature end */
 812   free (expr);
 813   return WRDE_SYNTAX;
 814 }
 815
 816 /* Function called by child process in exec_comm() */
 817 static inline void
 818 internal_function __attribute__ ((always_inline))
 819 exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
 820 {
 821   const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 822
 823   /* Execute the command, or just check syntax? */
 824   if (noexec)
 825     args[1] = "-nc";
 826
 827   /* Redirect output.  */
 828   __dup2 (fildes[1], STDOUT_FILENO);
 829   __close (fildes[1]);
 830
 831   /* Redirect stderr to /dev/null if we have to.  */
 832   if (showerr == 0)
 833     {
 834       struct stat64 st;
 835       int fd;
 836       __close (2);
 837       fd = __open (_PATH_DEVNULL, O_WRONLY);
 838       if (fd >= 0 && fd != 2)
 839         {
 840           __dup2 (fd, STDERR_FILENO);
 841           __close (fd);
 842         }
 843       /* Be paranoid.  Check that we actually opened the /dev/null
 844          device.  */
 845       if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
 846           || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
 847 #if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
 848           || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
 849 #endif
 850           )
 851         /* It's not the /dev/null device.  Stop right here.  The
 852            problem is: how do we stop?  We use _exit() with an
 853            hopefully unusual exit code.  */
 854         _exit (90);
 855     }
 856
 857   /* Make sure the subshell doesn't field-split on our behalf. */
 858   __unsetenv ("IFS");
 859
 860   __close (fildes[0]);
 861   __execve (_PATH_BSHELL, (char *const *) args, __environ);
 862
 863   /* Bad.  What now?  */
 864   abort ();
 865 }
 866
 867 /* Function to execute a command and retrieve the results */
 868 /* pwordexp contains NULL if field-splitting is forbidden */
 869 static int
 870 internal_function
 871 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 872            int flags, wordexp_t *pwordexp, const char *ifs,
 873            const char *ifs_white)
 874 {
 875   int fildes[2];
 876 #define bufsize 128
 877   int buflen;
 878   int i;
 879   int status = 0;
 880   size_t maxnewlines = 0;
 881   char buffer[bufsize];
 882   pid_t pid;
 883   int noexec = 0;
 884
 885   /* Don't fork() unless necessary */
 886   if (!comm || !*comm)
 887     return 0;
 888
 889   if (__pipe (fildes))
 890     /* Bad */
 891     return WRDE_NOSPACE;
 892
 893  again:
 894   if ((pid = __fork ()) < 0)
 895     {
 896       /* Bad */
 897       if (fildes[0] != -1)
 898         __close (fildes[0]);
 899       if (fildes[1] != -1)
 900         __close (fildes[1]);
 901       return WRDE_NOSPACE;
 902     }
 903
 904   if (pid == 0)
 905     exec_comm_child (comm, fildes, noexec ? 0 : flags & WRDE_SHOWERR, noexec);
 906
 907   /* Parent */
 908
 909   /* If we are just testing the syntax, only wait.  */
 910   if (noexec)
 911     return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
 912             && status != 0) ? WRDE_SYNTAX : 0;
 913
 914   __close (fildes[1]);
 915   fildes[1] = -1;
 916
 917   if (!pwordexp)
 918     /* Quoted - no field splitting */
 919     {
 920       while (1)
 921         {
 922           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 923                                                     bufsize))) < 1)
 924             {
 925               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, WNOHANG)) == 0)
 926                 continue;
 927               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 928                                                         bufsize))) < 1)
 929                 break;
 930             }
 931
 932           maxnewlines += buflen;
 933
 934           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 935           if (*word == NULL)
 936             goto no_space;
 937         }
 938     }
 939   else
 940     /* Not quoted - split fields */
 941     {
 942       int copying = 0;
 943       /* 'copying' is:
 944        *  0 when searching for first character in a field not IFS white space
 945        *  1 when copying the text of a field
 946        *  2 when searching for possible non-whitespace IFS
 947        *  3 when searching for non-newline after copying field
 948        */
 949
 950       while (1)
 951         {
 952           if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 953                                                     bufsize))) < 1)
 954             {
 955               if (TEMP_FAILURE_RETRY (__waitpid (pid, &status, WNOHANG)) == 0)
 956                 continue;
 957               if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
 958                                                         bufsize))) < 1)
 959                 break;
 960             }
 961
 962           for (i = 0; i < buflen; ++i)
 963             {
 964               if (strchr (ifs, buffer[i]) != NULL)
 965                 {
 966                   /* Current character is IFS */
 967                   if (strchr (ifs_white, buffer[i]) == NULL)
 968                     {
 969                       /* Current character is IFS but not whitespace */
 970                       if (copying == 2)
 971                         {
 972                           /*            current character
 973                            *                   |
 974                            *                   V
 975                            * eg: text<space><comma><space>moretext
 976                            *
 977                            * So, strip whitespace IFS (like at the start)
 978                            */
 979                           copying = 0;
 980                           continue;
 981                         }
 982
 983                       copying = 0;
 984                       /* fall through and delimit field.. */
 985                     }
 986                   else
 987                     {
 988                       if (buffer[i] == '\n')
 989                         {
 990                           /* Current character is (IFS) newline */
 991
 992                           /* If copying a field, this is the end of it,
 993                              but maybe all that's left is trailing newlines.
 994                              So start searching for a non-newline. */
 995                           if (copying == 1)
 996                             copying = 3;
 997
 998                           continue;
 999                         }
1000                       else
1001                         {
1002                           /* Current character is IFS white space, but
1003                              not a newline */
1004
1005                           /* If not either copying a field or searching
1006                              for non-newline after a field, ignore it */
1007                           if (copying != 1 && copying != 3)
1008                             continue;
1009
1010                           /* End of field (search for non-ws IFS afterwards) */
1011                           copying = 2;
1012                         }
1013                     }
1014
1015                   /* First IFS white space (non-newline), or IFS non-whitespace.
1016                    * Delimit the field.  Nulls are converted by w_addword. */
1017                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1018                     goto no_space;
1019
1020                   *word = w_newword (word_length, max_length);
1021
1022                   maxnewlines = 0;
1023                   /* fall back round the loop.. */
1024                 }
1025               else
1026                 {
1027                   /* Not IFS character */
1028
1029                   if (copying == 3)
1030                     {
1031                       /* Nothing but (IFS) newlines since the last field,
1032                          so delimit it here before starting new word */
1033                       if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1034                         goto no_space;
1035
1036                       *word = w_newword (word_length, max_length);
1037                     }
1038
1039                   copying = 1;
1040
1041                   if (buffer[i] == '\n') /* happens if newline not in IFS */
1042                     maxnewlines++;
1043                   else
1044                     maxnewlines = 0;
1045
1046                   *word = w_addchar (*word, word_length, max_length,
1047                                      buffer[i]);
1048                   if (*word == NULL)
1049                     goto no_space;
1050                 }
1051             }
1052         }
1053     }
1054
1055   /* Chop off trailing newlines (required by POSIX.2)  */
1056   /* Ensure we don't go back further than the beginning of the
1057      substitution (i.e. remove maxnewlines bytes at most) */
1058   while (maxnewlines-- != 0 &&
1059          *word_length > 0 && (*word)[*word_length - 1] == '\n')
1060     {
1061       (*word)[--*word_length] = '\0';
1062
1063       /* If the last word was entirely newlines, turn it into a new word
1064        * which can be ignored if there's nothing following it. */
1065       if (*word_length == 0)
1066         {
1067           free (*word);
1068           *word = w_newword (word_length, max_length);
1069           break;
1070         }
1071     }
1072
1073   __close (fildes[0]);
1074   fildes[0] = -1;
1075
1076   /* Check for syntax error (re-execute but with "-n" flag) */
1077   if (buflen < 1 && status != 0)
1078     {
1079       noexec = 1;
1080       goto again;
1081     }
1082
1083   return 0;
1084
1085 no_space:
1086   __kill (pid, SIGKILL);
1087   TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1088   __close (fildes[0]);
1089   return WRDE_NOSPACE;
1090 }
1091
1092 static int
1093 internal_function
1094 parse_comm (char **word, size_t *word_length, size_t *max_length,
1095             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1096             const char *ifs, const char *ifs_white)
1097 {
1098   /* We are poised just after "$(" */
1099   int paren_depth = 1;
1100   int error = 0;
1101   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1102   size_t comm_length;
1103   size_t comm_maxlen;
1104   char *comm = w_newword (&comm_length, &comm_maxlen);
1105
1106   for (; words[*offset]; ++(*offset))
1107     {
1108       switch (words[*offset])
1109         {
1110         case '\'':
1111           if (quoted == 0)
1112             quoted = 1;
1113           else if (quoted == 1)
1114             quoted = 0;
1115
1116           break;
1117
1118         case '"':
1119           if (quoted == 0)
1120             quoted = 2;
1121           else if (quoted == 2)
1122             quoted = 0;
1123
1124           break;
1125
1126         case ')':
1127           if (!quoted && --paren_depth == 0)
1128             {
1129               /* Go -- give script to the shell */
1130               if (comm)
1131                 {
1132 #ifdef __libc_ptf_call
1133                   /* We do not want the exec_comm call to be cut short
1134                      by a thread cancellation since cleanup is very
1135                      ugly.  Therefore disable cancellation for
1136                      now.  */
1137                   // XXX Ideally we do want the thread being cancelable.
1138                   // XXX If demand is there we'll change it.
1139                   int state = PTHREAD_CANCEL_ENABLE;
1140                   __libc_ptf_call (pthread_setcancelstate,
1141                                    (PTHREAD_CANCEL_DISABLE, &state), 0);
1142 #endif
1143
1144                   error = exec_comm (comm, word, word_length, max_length,
1145                                      flags, pwordexp, ifs, ifs_white);
1146
1147 #ifdef __libc_ptf_call
1148                   __libc_ptf_call (pthread_setcancelstate, (state, NULL), 0);
1149 #endif
1150
1151                   free (comm);
1152                 }
1153
1154               return error;
1155             }
1156
1157           /* This is just part of the script */
1158           break;
1159
1160         case '(':
1161           if (!quoted)
1162             ++paren_depth;
1163         }
1164
1165       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1166       if (comm == NULL)
1167         return WRDE_NOSPACE;
1168     }
1169
1170   /* Premature end */
1171   if (comm)
1172     free (comm);
1173
1174   return WRDE_SYNTAX;
1175 }
1176
1177 static int
1178 internal_function
1179 parse_param (char **word, size_t *word_length, size_t *max_length,
1180              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1181              const char *ifs, const char *ifs_white, int quoted)
1182 {
1183   /* We are poised just after "$" */
1184   enum action
1185   {
1186     ACT_NONE,
1187     ACT_RP_SHORT_LEFT = '#',
1188     ACT_RP_LONG_LEFT = 'L',
1189     ACT_RP_SHORT_RIGHT = '%',
1190     ACT_RP_LONG_RIGHT = 'R',
1191     ACT_NULL_ERROR = '?',
1192     ACT_NULL_SUBST = '-',
1193     ACT_NONNULL_SUBST = '+',
1194     ACT_NULL_ASSIGN = '='
1195   };
1196   size_t env_length;
1197   size_t env_maxlen;
1198   size_t pat_length;
1199   size_t pat_maxlen;
1200   size_t start = *offset;
1201   char *env;
1202   char *pattern;
1203   char *value = NULL;
1204   enum action action = ACT_NONE;
1205   int depth = 0;
1206   int colon_seen = 0;
1207   int seen_hash = 0;
1208   int free_value = 0;
1209   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1210   int error;
1211   int special = 0;
1212   char buffer[21];
1213   int brace = words[*offset] == '{';
1214
1215   env = w_newword (&env_length, &env_maxlen);
1216   pattern = w_newword (&pat_length, &pat_maxlen);
1217
1218   if (brace)
1219     ++*offset;
1220
1221   /* First collect the parameter name. */
1222
1223   if (words[*offset] == '#')
1224     {
1225       seen_hash = 1;
1226       if (!brace)
1227         goto envsubst;
1228       ++*offset;
1229     }
1230
1231   if (isalpha (words[*offset]) || words[*offset] == '_')
1232     {
1233       /* Normal parameter name. */
1234       do
1235         {
1236           env = w_addchar (env, &env_length, &env_maxlen,
1237                            words[*offset]);
1238           if (env == NULL)
1239             goto no_space;
1240         }
1241       while (isalnum (words[++*offset]) || words[*offset] == '_');
1242     }
1243   else if (isdigit (words[*offset]))
1244     {
1245       /* Numeric parameter name. */
1246       special = 1;
1247       do
1248         {
1249           env = w_addchar (env, &env_length, &env_maxlen,
1250                            words[*offset]);
1251           if (env == NULL)
1252             goto no_space;
1253           if (!brace)
1254             goto envsubst;
1255         }
1256       while (isdigit(words[++*offset]));
1257     }
1258   else if (strchr ("*@$", words[*offset]) != NULL)
1259     {
1260       /* Special parameter. */
1261       special = 1;
1262       env = w_addchar (env, &env_length, &env_maxlen,
1263                        words[*offset]);
1264       if (env == NULL)
1265         goto no_space;
1266       ++*offset;
1267     }
1268   else
1269     {
1270       if (brace)
1271         goto syntax;
1272     }
1273
1274   if (brace)
1275     {
1276       /* Check for special action to be applied to the value. */
1277       switch (words[*offset])
1278         {
1279         case '}':
1280           /* Evaluate. */
1281           goto envsubst;
1282
1283         case '#':
1284           action = ACT_RP_SHORT_LEFT;
1285           if (words[1 + *offset] == '#')
1286             {
1287               ++*offset;
1288               action = ACT_RP_LONG_LEFT;
1289             }
1290           break;
1291
1292         case '%':
1293           action = ACT_RP_SHORT_RIGHT;
1294           if (words[1 + *offset] == '%')
1295             {
1296               ++*offset;
1297               action = ACT_RP_LONG_RIGHT;
1298             }
1299           break;
1300
1301         case ':':
1302           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1303             goto syntax;
1304
1305           colon_seen = 1;
1306           action = words[++*offset];
1307           break;
1308
1309         case '-':
1310         case '=':
1311         case '?':
1312         case '+':
1313           action = words[*offset];
1314           break;
1315
1316         default:
1317           goto syntax;
1318         }
1319
1320       /* Now collect the pattern, but don't expand it yet. */
1321       ++*offset;
1322       for (; words[*offset]; ++(*offset))
1323         {
1324           switch (words[*offset])
1325             {
1326             case '{':
1327               if (!pattern_is_quoted)
1328                 ++depth;
1329               break;
1330
1331             case '}':
1332               if (!pattern_is_quoted)
1333                 {
1334                   if (depth == 0)
1335                     goto envsubst;
1336                   --depth;
1337                 }
1338               break;
1339
1340             case '\\':
1341               if (pattern_is_quoted)
1342                 /* Quoted; treat as normal character. */
1343                 break;
1344
1345               /* Otherwise, it's an escape: next character is literal. */
1346               if (words[++*offset] == '\0')
1347                 goto syntax;
1348
1349               pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1350               if (pattern == NULL)
1351                 goto no_space;
1352
1353               break;
1354
1355             case '\'':
1356               if (pattern_is_quoted == 0)
1357                 pattern_is_quoted = 1;
1358               else if (pattern_is_quoted == 1)
1359                 pattern_is_quoted = 0;
1360
1361               break;
1362
1363             case '"':
1364               if (pattern_is_quoted == 0)
1365                 pattern_is_quoted = 2;
1366               else if (pattern_is_quoted == 2)
1367                 pattern_is_quoted = 0;
1368
1369               break;
1370             }
1371
1372           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1373                                words[*offset]);
1374           if (pattern == NULL)
1375             goto no_space;
1376         }
1377     }
1378
1379   /* End of input string -- remember to reparse the character that we
1380    * stopped at.  */
1381   --(*offset);
1382
1383 envsubst:
1384   if (words[start] == '{' && words[*offset] != '}')
1385     goto syntax;
1386
1387   if (env == NULL)
1388     {
1389       if (seen_hash)
1390         {
1391           /* $# expands to the number of positional parameters */
1392           buffer[20] = '\0';
1393           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1394           seen_hash = 0;
1395         }
1396       else
1397         {
1398           /* Just $ on its own */
1399           *offset = start - 1;
1400           *word = w_addchar (*word, word_length, max_length, '$');
1401           return *word ? 0 : WRDE_NOSPACE;
1402         }
1403     }
1404   /* Is it a numeric parameter? */
1405   else if (isdigit (env[0]))
1406     {
1407       int n = atoi (env);
1408
1409       if (n >= __libc_argc)
1410         /* Substitute NULL. */
1411         value = NULL;
1412       else
1413         /* Replace with appropriate positional parameter. */
1414         value = __libc_argv[n];
1415     }
1416   /* Is it a special parameter? */
1417   else if (special)
1418     {
1419       /* Is it `$$'? */
1420       if (*env == '$')
1421         {
1422           buffer[20] = '\0';
1423           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1424         }
1425       /* Is it `${#*}' or `${#@}'? */
1426       else if ((*env == '*' || *env == '@') && seen_hash)
1427         {
1428           buffer[20] = '\0';
1429           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1430                               &buffer[20], 10, 0);
1431           *word = w_addstr (*word, word_length, max_length, value);
1432           free (env);
1433           if (pattern)
1434             free (pattern);
1435           return *word ? 0 : WRDE_NOSPACE;
1436         }
1437       /* Is it `$*' or `$@' (unquoted) ? */
1438       else if (*env == '*' || (*env == '@' && !quoted))
1439         {
1440           size_t plist_len = 0;
1441           int p;
1442           char *end;
1443
1444           /* Build up value parameter by parameter (copy them) */
1445           for (p = 1; __libc_argv[p]; ++p)
1446             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1447           value = malloc (plist_len);
1448           if (value == NULL)
1449             goto no_space;
1450           end = value;
1451           *end = 0;
1452           for (p = 1; __libc_argv[p]; ++p)
1453             {
1454               if (p > 1)
1455                 *end++ = ' ';
1456               end = __stpcpy (end, __libc_argv[p]);
1457             }
1458
1459           free_value = 1;
1460         }
1461       else
1462         {
1463           /* Must be a quoted `$@' */
1464           assert (*env == '@' && quoted);
1465
1466           /* Each parameter is a separate word ("$@") */
1467           if (__libc_argc == 2)
1468             value = __libc_argv[1];
1469           else if (__libc_argc > 2)
1470             {
1471               int p;
1472
1473               /* Append first parameter to current word. */
1474               value = w_addstr (*word, word_length, max_length,
1475                                 __libc_argv[1]);
1476               if (value == NULL || w_addword (pwordexp, value))
1477                 goto no_space;
1478
1479               for (p = 2; __libc_argv[p + 1]; p++)
1480                 {
1481                   char *newword = __strdup (__libc_argv[p]);
1482                   if (newword == NULL || w_addword (pwordexp, newword))
1483                     goto no_space;
1484                 }
1485
1486               /* Start a new word with the last parameter. */
1487               *word = w_newword (word_length, max_length);
1488               value = __libc_argv[p];
1489             }
1490           else
1491             {
1492               free (env);
1493               free (pattern);
1494               return 0;
1495             }
1496         }
1497     }
1498   else
1499     value = getenv (env);
1500
1501   if (value == NULL && (flags & WRDE_UNDEF))
1502     {
1503       /* Variable not defined. */
1504       error = WRDE_BADVAL;
1505       goto do_error;
1506     }
1507
1508   if (action != ACT_NONE)
1509     {
1510       int expand_pattern = 0;
1511
1512       /* First, find out if we need to expand pattern (i.e. if we will
1513        * use it). */
1514       switch (action)
1515         {
1516         case ACT_RP_SHORT_LEFT:
1517         case ACT_RP_LONG_LEFT:
1518         case ACT_RP_SHORT_RIGHT:
1519         case ACT_RP_LONG_RIGHT:
1520           /* Always expand for these. */
1521           expand_pattern = 1;
1522           break;
1523
1524         case ACT_NULL_ERROR:
1525         case ACT_NULL_SUBST:
1526         case ACT_NULL_ASSIGN:
1527           if (!value || (!*value && colon_seen))
1528             /* If param is unset, or set but null and a colon has been seen,
1529                the expansion of the pattern will be needed. */
1530             expand_pattern = 1;
1531
1532           break;
1533
1534         case ACT_NONNULL_SUBST:
1535           /* Expansion of word will be needed if parameter is set and not null,
1536              or set null but no colon has been seen. */
1537           if (value && (*value || !colon_seen))
1538             expand_pattern = 1;
1539
1540           break;
1541
1542         default:
1543           assert (! "Unrecognised action!");
1544         }
1545
1546       if (expand_pattern)
1547         {
1548           /* We need to perform tilde expansion, parameter expansion,
1549              command substitution, and arithmetic expansion.  We also
1550              have to be a bit careful with wildcard characters, as
1551              pattern might be given to fnmatch soon.  To do this, we
1552              convert quotes to escapes. */
1553
1554           char *expanded;
1555           size_t exp_len;
1556           size_t exp_maxl;
1557           char *p;
1558           int quoted = 0; /* 1: single quotes; 2: double */
1559
1560           expanded = w_newword (&exp_len, &exp_maxl);
1561           for (p = pattern; p && *p; p++)
1562             {
1563               size_t offset;
1564
1565               switch (*p)
1566                 {
1567                 case '"':
1568                   if (quoted == 2)
1569                     quoted = 0;
1570                   else if (quoted == 0)
1571                     quoted = 2;
1572                   else break;
1573
1574                   continue;
1575
1576                 case '\'':
1577                   if (quoted == 1)
1578                     quoted = 0;
1579                   else if (quoted == 0)
1580                     quoted = 1;
1581                   else break;
1582
1583                   continue;
1584
1585                 case '*':
1586                 case '?':
1587                   if (quoted)
1588                     {
1589                       /* Convert quoted wildchar to escaped wildchar. */
1590                       expanded = w_addchar (expanded, &exp_len,
1591                                             &exp_maxl, '\\');
1592
1593                       if (expanded == NULL)
1594                         goto no_space;
1595                     }
1596                   break;
1597
1598                 case '$':
1599                   offset = 0;
1600                   error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1601                                          &offset, flags, NULL, NULL, NULL, 1);
1602                   if (error)
1603                     {
1604                       if (free_value)
1605                         free (value);
1606
1607                       if (expanded)
1608                         free (expanded);
1609
1610                       goto do_error;
1611                     }
1612
1613                   p += offset;
1614                   continue;
1615
1616                 case '~':
1617                   if (quoted || exp_len)
1618                     break;
1619
1620                   offset = 0;
1621                   error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1622                                        &offset, 0);
1623                   if (error)
1624                     {
1625                       if (free_value)
1626                         free (value);
1627
1628                       if (expanded)
1629                         free (expanded);
1630
1631                       goto do_error;
1632                     }
1633
1634                   p += offset;
1635                   continue;
1636
1637                 case '\\':
1638                   expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1639                   ++p;
1640                   assert (*p); /* checked when extracted initially */
1641                   if (expanded == NULL)
1642                     goto no_space;
1643                 }
1644
1645               expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1646
1647               if (expanded == NULL)
1648                 goto no_space;
1649             }
1650
1651           if (pattern)
1652                   free (pattern);
1653
1654           pattern = expanded;
1655         }
1656
1657       switch (action)
1658         {
1659         case ACT_RP_SHORT_LEFT:
1660         case ACT_RP_LONG_LEFT:
1661         case ACT_RP_SHORT_RIGHT:
1662         case ACT_RP_LONG_RIGHT:
1663           {
1664             char *p;
1665             char c;
1666             char *end;
1667
1668             if (value == NULL || pattern == NULL || *pattern == '\0')
1669               break;
1670
1671             end = value + strlen (value);
1672
1673             switch (action)
1674               {
1675               case ACT_RP_SHORT_LEFT:
1676                 for (p = value; p <= end; ++p)
1677                   {
1678                     c = *p;
1679                     *p = '\0';
1680                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1681                       {
1682                         *p = c;
1683                         if (free_value)
1684                           {
1685                             char *newval = __strdup (p);
1686                             if (newval == NULL)
1687                               {
1688                                 free (value);
1689                                 goto no_space;
1690                               }
1691                             free (value);
1692                             value = newval;
1693                           }
1694                         else
1695                           value = p;
1696                         break;
1697                       }
1698                     *p = c;
1699                   }
1700
1701                 break;
1702
1703               case ACT_RP_LONG_LEFT:
1704                 for (p = end; p >= value; --p)
1705                   {
1706                     c = *p;
1707                     *p = '\0';
1708                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1709                       {
1710                         *p = c;
1711                         if (free_value)
1712                           {
1713                             char *newval = __strdup (p);
1714                             if (newval == NULL)
1715                               {
1716                                 free (value);
1717                                 goto no_space;
1718                               }
1719                             free (value);
1720                             value = newval;
1721                           }
1722                         else
1723                           value = p;
1724                         break;
1725                       }
1726                     *p = c;
1727                   }
1728
1729                 break;
1730
1731               case ACT_RP_SHORT_RIGHT:
1732                 for (p = end; p >= value; --p)
1733                   {
1734                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1735                       {
1736                         char *newval;
1737                         newval = malloc (p - value + 1);
1738
1739                         if (newval == NULL)
1740                           {
1741                             if (free_value)
1742                               free (value);
1743                             goto no_space;
1744                           }
1745
1746                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1747                         if (free_value)
1748                           free (value);
1749                         value = newval;
1750                         free_value = 1;
1751                         break;
1752                       }
1753                   }
1754
1755                 break;
1756
1757               case ACT_RP_LONG_RIGHT:
1758                 for (p = value; p <= end; ++p)
1759                   {
1760                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1761                       {
1762                         char *newval;
1763                         newval = malloc (p - value + 1);
1764
1765                         if (newval == NULL)
1766                           {
1767                             if (free_value)
1768                               free (value);
1769                             goto no_space;
1770                           }
1771
1772                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1773                         if (free_value)
1774                           free (value);
1775                         value = newval;
1776                         free_value = 1;
1777                         break;
1778                       }
1779                   }
1780
1781                 break;
1782
1783               default:
1784                 break;
1785               }
1786
1787             break;
1788           }
1789
1790         case ACT_NULL_ERROR:
1791           if (value && *value)
1792             /* Substitute parameter */
1793             break;
1794
1795           error = 0;
1796           if (!colon_seen && value)
1797             /* Substitute NULL */
1798             ;
1799           else
1800             {
1801               const char *str = pattern;
1802
1803               if (str[0] == '\0')
1804                 str = _("parameter null or not set");
1805
1806               __fxprintf (NULL, "%s: %s\n", env, str);
1807             }
1808
1809           if (free_value)
1810             free (value);
1811           goto do_error;
1812
1813         case ACT_NULL_SUBST:
1814           if (value && *value)
1815             /* Substitute parameter */
1816             break;
1817
1818           if (free_value && value)
1819             free (value);
1820
1821           if (!colon_seen && value)
1822             /* Substitute NULL */
1823             goto success;
1824
1825           value = pattern ? __strdup (pattern) : pattern;
1826           free_value = 1;
1827
1828           if (pattern && !value)
1829             goto no_space;
1830
1831           break;
1832
1833         case ACT_NONNULL_SUBST:
1834           if (value && (*value || !colon_seen))
1835             {
1836               if (free_value && value)
1837                 free (value);
1838
1839               value = pattern ? __strdup (pattern) : pattern;
1840               free_value = 1;
1841
1842               if (pattern && !value)
1843                 goto no_space;
1844
1845               break;
1846             }
1847
1848           /* Substitute NULL */
1849           if (free_value)
1850             free (value);
1851           goto success;
1852
1853         case ACT_NULL_ASSIGN:
1854           if (value && *value)
1855             /* Substitute parameter */
1856             break;
1857
1858           if (!colon_seen && value)
1859             {
1860               /* Substitute NULL */
1861               if (free_value)
1862                 free (value);
1863               goto success;
1864             }
1865
1866           if (free_value && value)
1867             free (value);
1868
1869           value = pattern ? __strdup (pattern) : pattern;
1870           free_value = 1;
1871
1872           if (pattern && !value)
1873             goto no_space;
1874
1875           __setenv (env, value, 1);
1876           break;
1877
1878         default:
1879           assert (! "Unrecognised action!");
1880         }
1881     }
1882
1883   free (env); env = NULL;
1884   free (pattern); pattern = NULL;
1885
1886   if (seen_hash)
1887     {
1888       char param_length[21];
1889       param_length[20] = '\0';
1890       *word = w_addstr (*word, word_length, max_length,
1891                         _itoa_word (value ? strlen (value) : 0,
1892                                     &param_length[20], 10, 0));
1893       if (free_value)
1894         {
1895           assert (value != NULL);
1896           free (value);
1897         }
1898
1899       return *word ? 0 : WRDE_NOSPACE;
1900     }
1901
1902   if (value == NULL)
1903     return 0;
1904
1905   if (quoted || !pwordexp)
1906     {
1907       /* Quoted - no field split */
1908       *word = w_addstr (*word, word_length, max_length, value);
1909       if (free_value)
1910         free (value);
1911
1912       return *word ? 0 : WRDE_NOSPACE;
1913     }
1914   else
1915     {
1916       /* Need to field-split */
1917       char *value_copy = __strdup (value); /* Don't modify value */
1918       char *field_begin = value_copy;
1919       int seen_nonws_ifs = 0;
1920
1921       if (free_value)
1922         free (value);
1923
1924       if (value_copy == NULL)
1925         goto no_space;
1926
1927       do
1928         {
1929           char *field_end = field_begin;
1930           char *next_field;
1931
1932           /* If this isn't the first field, start a new word */
1933           if (field_begin != value_copy)
1934             {
1935               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1936                 {
1937                   free (value_copy);
1938                   goto no_space;
1939                 }
1940
1941               *word = w_newword (word_length, max_length);
1942             }
1943
1944           /* Skip IFS whitespace before the field */
1945           field_begin += strspn (field_begin, ifs_white);
1946
1947           if (!seen_nonws_ifs && *field_begin == 0)
1948             /* Nothing but whitespace */
1949             break;
1950
1951           /* Search for the end of the field */
1952           field_end = field_begin + strcspn (field_begin, ifs);
1953
1954           /* Set up pointer to the character after end of field and
1955              skip whitespace IFS after it. */
1956           next_field = field_end + strspn (field_end, ifs_white);
1957
1958           /* Skip at most one non-whitespace IFS character after the field */
1959           seen_nonws_ifs = 0;
1960           if (*next_field && strchr (ifs, *next_field))
1961             {
1962               seen_nonws_ifs = 1;
1963               next_field++;
1964             }
1965
1966           /* Null-terminate it */
1967           *field_end = 0;
1968
1969           /* Tag a copy onto the current word */
1970           *word = w_addstr (*word, word_length, max_length, field_begin);
1971
1972           if (*word == NULL && *field_begin != '\0')
1973             {
1974               free (value_copy);
1975               goto no_space;
1976             }
1977
1978           field_begin = next_field;
1979         }
1980       while (seen_nonws_ifs || *field_begin);
1981
1982       free (value_copy);
1983     }
1984
1985   return 0;
1986
1987 success:
1988   error = 0;
1989   goto do_error;
1990
1991 no_space:
1992   error = WRDE_NOSPACE;
1993   goto do_error;
1994
1995 syntax:
1996   error = WRDE_SYNTAX;
1997
1998 do_error:
1999   if (env)
2000     free (env);
2001
2002   if (pattern)
2003     free (pattern);
2004
2005   return error;
2006 }
2007
2008 static int
2009 internal_function
2010 parse_dollars (char **word, size_t *word_length, size_t *max_length,
2011                const char *words, size_t *offset, int flags,
2012                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2013                int quoted)
2014 {
2015   /* We are poised _at_ "$" */
2016   switch (words[1 + *offset])
2017     {
2018     case '"':
2019     case '\'':
2020     case 0:
2021       *word = w_addchar (*word, word_length, max_length, '$');
2022       return *word ? 0 : WRDE_NOSPACE;
2023
2024     case '(':
2025       if (words[2 + *offset] == '(')
2026         {
2027           /* Differentiate between $((1+3)) and $((echo);(ls)) */
2028           int i = 3 + *offset;
2029           int depth = 0;
2030           while (words[i] && !(depth == 0 && words[i] == ')'))
2031             {
2032               if (words[i] == '(')
2033                 ++depth;
2034               else if (words[i] == ')')
2035                 --depth;
2036
2037               ++i;
2038             }
2039
2040           if (words[i] == ')' && words[i + 1] == ')')
2041             {
2042               (*offset) += 3;
2043               /* Call parse_arith -- 0 is for "no brackets" */
2044               return parse_arith (word, word_length, max_length, words, offset,
2045                                   flags, 0);
2046             }
2047         }
2048
2049       if (flags & WRDE_NOCMD)
2050         return WRDE_CMDSUB;
2051
2052       (*offset) += 2;
2053       return parse_comm (word, word_length, max_length, words, offset, flags,
2054                          quoted? NULL : pwordexp, ifs, ifs_white);
2055
2056     case '[':
2057       (*offset) += 2;
2058       /* Call parse_arith -- 1 is for "brackets" */
2059       return parse_arith (word, word_length, max_length, words, offset, flags,
2060                           1);
2061
2062     case '{':
2063     default:
2064       ++(*offset);      /* parse_param needs to know if "{" is there */
2065       return parse_param (word, word_length, max_length, words, offset, flags,
2066                            pwordexp, ifs, ifs_white, quoted);
2067     }
2068 }
2069
2070 static int
2071 internal_function
2072 parse_backtick (char **word, size_t *word_length, size_t *max_length,
2073                 const char *words, size_t *offset, int flags,
2074                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2075 {
2076   /* We are poised just after "`" */
2077   int error;
2078   int squoting = 0;
2079   size_t comm_length;
2080   size_t comm_maxlen;
2081   char *comm = w_newword (&comm_length, &comm_maxlen);
2082
2083   for (; words[*offset]; ++(*offset))
2084     {
2085       switch (words[*offset])
2086         {
2087         case '`':
2088           /* Go -- give the script to the shell */
2089           error = exec_comm (comm, word, word_length, max_length, flags,
2090                              pwordexp, ifs, ifs_white);
2091           free (comm);
2092           return error;
2093
2094         case '\\':
2095           if (squoting)
2096             {
2097               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2098                                            words, offset);
2099
2100               if (error)
2101                 {
2102                   free (comm);
2103                   return error;
2104                 }
2105
2106               break;
2107             }
2108
2109           ++(*offset);
2110           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2111                                    offset);
2112
2113           if (error)
2114             {
2115               free (comm);
2116               return error;
2117             }
2118
2119           break;
2120
2121         case '\'':
2122           squoting = 1 - squoting;
2123         default:
2124           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2125           if (comm == NULL)
2126             return WRDE_NOSPACE;
2127         }
2128     }
2129
2130   /* Premature end */
2131   free (comm);
2132   return WRDE_SYNTAX;
2133 }
2134
2135 static int
2136 internal_function
2137 parse_dquote (char **word, size_t *word_length, size_t *max_length,
2138               const char *words, size_t *offset, int flags,
2139               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2140 {
2141   /* We are poised just after a double-quote */
2142   int error;
2143
2144   for (; words[*offset]; ++(*offset))
2145     {
2146       switch (words[*offset])
2147         {
2148         case '"':
2149           return 0;
2150
2151         case '$':
2152           error = parse_dollars (word, word_length, max_length, words, offset,
2153                                  flags, pwordexp, ifs, ifs_white, 1);
2154           /* The ``1'' here is to tell parse_dollars not to
2155            * split the fields.  It may need to, however ("$@").
2156            */
2157           if (error)
2158             return error;
2159
2160           break;
2161
2162         case '`':
2163           if (flags & WRDE_NOCMD)
2164             return WRDE_CMDSUB;
2165
2166           ++(*offset);
2167           error = parse_backtick (word, word_length, max_length, words,
2168                                   offset, flags, NULL, NULL, NULL);
2169           /* The first NULL here is to tell parse_backtick not to
2170            * split the fields.
2171            */
2172           if (error)
2173             return error;
2174
2175           break;
2176
2177         case '\\':
2178           error = parse_qtd_backslash (word, word_length, max_length, words,
2179                                        offset);
2180
2181           if (error)
2182             return error;
2183
2184           break;
2185
2186         default:
2187           *word = w_addchar (*word, word_length, max_length, words[*offset]);
2188           if (*word == NULL)
2189             return WRDE_NOSPACE;
2190         }
2191     }
2192
2193   /* Unterminated string */
2194   return WRDE_SYNTAX;
2195 }
2196
2197 /*
2198  * wordfree() is to be called after pwordexp is finished with.
2199  */
2200
2201 void
2202 wordfree (wordexp_t *pwordexp)
2203 {
2204
2205   /* wordexp can set pwordexp to NULL */
2206   if (pwordexp && pwordexp->we_wordv)
2207     {
2208       char **wordv = pwordexp->we_wordv;
2209
2210       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2211         free (*wordv);
2212
2213       free (pwordexp->we_wordv);
2214       pwordexp->we_wordv = NULL;
2215     }
2216 }
2217 libc_hidden_def (wordfree)
2218
2219 /*
2220  * wordexp()
2221  */
2222
2223 int
2224 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2225 {
2226   size_t words_offset;
2227   size_t word_length;
2228   size_t max_length;
2229   char *word = w_newword (&word_length, &max_length);
2230   int error;
2231   char *ifs;
2232   char ifs_white[4];
2233   wordexp_t old_word = *pwordexp;
2234
2235   if (flags & WRDE_REUSE)
2236     {
2237       /* Minimal implementation of WRDE_REUSE for now */
2238       wordfree (pwordexp);
2239       old_word.we_wordv = NULL;
2240     }
2241
2242   if ((flags & WRDE_APPEND) == 0)
2243     {
2244       pwordexp->we_wordc = 0;
2245
2246       if (flags & WRDE_DOOFFS)
2247         {
2248           pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2249           if (pwordexp->we_wordv == NULL)
2250             {
2251               error = WRDE_NOSPACE;
2252               goto do_error;
2253             }
2254         }
2255       else
2256         {
2257           pwordexp->we_wordv = calloc (1, sizeof (char *));
2258           if (pwordexp->we_wordv == NULL)
2259             {
2260               error = WRDE_NOSPACE;
2261               goto do_error;
2262             }
2263
2264           pwordexp->we_offs = 0;
2265         }
2266     }
2267
2268   /* Find out what the field separators are.
2269    * There are two types: whitespace and non-whitespace.
2270    */
2271   ifs = getenv ("IFS");
2272
2273   if (!ifs)
2274     /* IFS unset - use <space><tab><newline>. */
2275     ifs = strcpy (ifs_white, " \t\n");
2276   else
2277     {
2278       char *ifsch = ifs;
2279       char *whch = ifs_white;
2280
2281       /* Start off with no whitespace IFS characters */
2282       ifs_white[0] = '\0';
2283
2284       while (*ifsch != '\0')
2285         {
2286           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2287             {
2288               /* Whitespace IFS.  See first whether it is already in our
2289                  collection.  */
2290               char *runp = ifs_white;
2291
2292               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2293                 ++runp;
2294
2295               if (runp == whch)
2296                 *whch++ = *ifsch;
2297             }
2298
2299           ++ifsch;
2300         }
2301       *whch = '\0';
2302     }
2303
2304   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2305     switch (words[words_offset])
2306       {
2307       case '\\':
2308         error = parse_backslash (&word, &word_length, &max_length, words,
2309                                  &words_offset);
2310
2311         if (error)
2312           goto do_error;
2313
2314         break;
2315
2316       case '$':
2317         error = parse_dollars (&word, &word_length, &max_length, words,
2318                                &words_offset, flags, pwordexp, ifs, ifs_white,
2319                                0);
2320
2321         if (error)
2322           goto do_error;
2323
2324         break;
2325
2326       case '`':
2327         if (flags & WRDE_NOCMD)
2328           {
2329             error = WRDE_CMDSUB;
2330             goto do_error;
2331           }
2332
2333         ++words_offset;
2334         error = parse_backtick (&word, &word_length, &max_length, words,
2335                                 &words_offset, flags, pwordexp, ifs,
2336                                 ifs_white);
2337
2338         if (error)
2339           goto do_error;
2340
2341         break;
2342
2343       case '"':
2344         ++words_offset;
2345         error = parse_dquote (&word, &word_length, &max_length, words,
2346                               &words_offset, flags, pwordexp, ifs, ifs_white);
2347
2348         if (error)
2349           goto do_error;
2350
2351         if (!word_length)
2352           {
2353             error = w_addword (pwordexp, NULL);
2354
2355             if (error)
2356               return error;
2357           }
2358
2359         break;
2360
2361       case '\'':
2362         ++words_offset;
2363         error = parse_squote (&word, &word_length, &max_length, words,
2364                               &words_offset);
2365
2366         if (error)
2367           goto do_error;
2368
2369         if (!word_length)
2370           {
2371             error = w_addword (pwordexp, NULL);
2372
2373             if (error)
2374               return error;
2375           }
2376
2377         break;
2378
2379       case '~':
2380         error = parse_tilde (&word, &word_length, &max_length, words,
2381                              &words_offset, pwordexp->we_wordc);
2382
2383         if (error)
2384           goto do_error;
2385
2386         break;
2387
2388       case '*':
2389       case '[':
2390       case '?':
2391         error = parse_glob (&word, &word_length, &max_length, words,
2392                             &words_offset, flags, pwordexp, ifs, ifs_white);
2393
2394         if (error)
2395           goto do_error;
2396
2397         break;
2398
2399       default:
2400         /* Is it a word separator? */
2401         if (strchr (" \t", words[words_offset]) == NULL)
2402           {
2403             char ch = words[words_offset];
2404
2405             /* Not a word separator -- but is it a valid word char? */
2406             if (strchr ("\n|&;<>(){}", ch))
2407               {
2408                 /* Fail */
2409                 error = WRDE_BADCHAR;
2410                 goto do_error;
2411               }
2412
2413             /* "Ordinary" character -- add it to word */
2414             word = w_addchar (word, &word_length, &max_length,
2415                               ch);
2416             if (word == NULL)
2417               {
2418                 error = WRDE_NOSPACE;
2419                 goto do_error;
2420               }
2421
2422             break;
2423           }
2424
2425         /* If a word has been delimited, add it to the list. */
2426         if (word != NULL)
2427           {
2428             error = w_addword (pwordexp, word);
2429             if (error)
2430               goto do_error;
2431           }
2432
2433         word = w_newword (&word_length, &max_length);
2434       }
2435
2436   /* End of string */
2437
2438   /* There was a word separator at the end */
2439   if (word == NULL) /* i.e. w_newword */
2440     return 0;
2441
2442   /* There was no field separator at the end */
2443   return w_addword (pwordexp, word);
2444
2445 do_error:
2446   /* Error:
2447    *    free memory used (unless error is WRDE_NOSPACE), and
2448    *    set pwordexp members back to what they were.
2449    */
2450
2451   if (word != NULL)
2452     free (word);
2453
2454   if (error == WRDE_NOSPACE)
2455     return WRDE_NOSPACE;
2456
2457   if ((flags & WRDE_APPEND) == 0)
2458     wordfree (pwordexp);
2459
2460   *pwordexp = old_word;
2461   return error;
2462 }