ex/ex_argv.c

   1 /*-
   2  * Copyright (c) 1993, 1994
   3  *      The Regents of the University of California.  All rights reserved.
   4  * Copyright (c) 1993, 1994, 1995, 1996
   5  *      Keith Bostic.  All rights reserved.
   6  *
   7  * See the LICENSE file for redistribution information.
   8  */
   9
  10 #include "config.h"
  11
  12 #ifndef lint
  13 static const char sccsid[] = "$Id: ex_argv.c,v 10.31 2000/07/16 20:49:31 skimo Exp $ (Berkeley) $Date: 2000/07/16 20:49:31 $";
  14 #endif /* not lint */
  15
  16 #include <sys/types.h>
  17 #include <sys/queue.h>
  18
  19 #include <bitstring.h>
  20 #include <ctype.h>
  21 #include <dirent.h>
  22 #include <errno.h>
  23 #include <limits.h>
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <unistd.h>
  28
  29 #include "../common/common.h"
  30
  31 static int argv_alloc __P((SCR *, size_t));
  32 static int argv_comp __P((const void *, const void *));
  33 static int argv_fexp __P((SCR *, EXCMD *,
  34         CHAR_T *, size_t, CHAR_T *, size_t *, CHAR_T **, size_t *, int));
  35 static int argv_lexp __P((SCR *, EXCMD *, char *));
  36 static int argv_sexp __P((SCR *, CHAR_T **, size_t *, size_t *));
  37
  38 /*
  39  * argv_init --
  40  *      Build  a prototype arguments list.
  41  *
  42  * PUBLIC: int argv_init __P((SCR *, EXCMD *));
  43  */
  44 int
  45 argv_init(sp, excp)
  46         SCR *sp;
  47         EXCMD *excp;
  48 {
  49         EX_PRIVATE *exp;
  50
  51         exp = EXP(sp);
  52         exp->argsoff = 0;
  53         argv_alloc(sp, 1);
  54
  55         excp->argv = exp->args;
  56         excp->argc = exp->argsoff;
  57         return (0);
  58 }
  59
  60 /*
  61  * argv_exp0 --
  62  *      Append a string to the argument list.
  63  *
  64  * PUBLIC: int argv_exp0 __P((SCR *, EXCMD *, CHAR_T *, size_t));
  65  */
  66 int
  67 argv_exp0(sp, excp, cmd, cmdlen)
  68         SCR *sp;
  69         EXCMD *excp;
  70         CHAR_T *cmd;
  71         size_t cmdlen;
  72 {
  73         EX_PRIVATE *exp;
  74
  75         exp = EXP(sp);
  76         argv_alloc(sp, cmdlen);
  77         MEMCPYW(exp->args[exp->argsoff]->bp, cmd, cmdlen);
  78         exp->args[exp->argsoff]->bp[cmdlen] = '\0';
  79         exp->args[exp->argsoff]->len = cmdlen;
  80         ++exp->argsoff;
  81         excp->argv = exp->args;
  82         excp->argc = exp->argsoff;
  83         return (0);
  84 }
  85
  86 /*
  87  * argv_exp1 --
  88  *      Do file name expansion on a string, and append it to the
  89  *      argument list.
  90  *
  91  * PUBLIC: int argv_exp1 __P((SCR *, EXCMD *, CHAR_T *, size_t, int));
  92  */
  93 int
  94 argv_exp1(sp, excp, cmd, cmdlen, is_bang)
  95         SCR *sp;
  96         EXCMD *excp;
  97         CHAR_T *cmd;
  98         size_t cmdlen;
  99         int is_bang;
 100 {
 101         EX_PRIVATE *exp;
 102         size_t blen, len;
 103         CHAR_T *p, *t, *bp;
 104         size_t wlen;
 105         CHAR_T *wp;
 106
 107         GET_SPACE_RETW(sp, bp, blen, 512);
 108
 109         len = 0;
 110         exp = EXP(sp);
 111         if (argv_fexp(sp, excp, cmd, cmdlen, bp, &len, &bp, &blen, is_bang)) {
 112                 FREE_SPACEW(sp, bp, blen);
 113                 return (1);
 114         }
 115
 116         /* If it's empty, we're done. */
 117         if (len != 0) {
 118                 for (p = bp, t = bp + len; p < t; ++p)
 119                         if (!isblank(*p))
 120                                 break;
 121                 if (p == t)
 122                         goto ret;
 123         } else
 124                 goto ret;
 125
 126         (void)argv_exp0(sp, excp, bp, len);
 127
 128 ret:    FREE_SPACEW(sp, bp, blen);
 129         return (0);
 130 }
 131
 132 /*
 133  * argv_exp2 --
 134  *      Do file name and shell expansion on a string, and append it to
 135  *      the argument list.
 136  *
 137  * PUBLIC: int argv_exp2 __P((SCR *, EXCMD *, CHAR_T *, size_t));
 138  */
 139 int
 140 argv_exp2(sp, excp, cmd, cmdlen)
 141         SCR *sp;
 142         EXCMD *excp;
 143         CHAR_T *cmd;
 144         size_t cmdlen;
 145 {
 146         size_t blen, len, n;
 147         int rval;
 148         CHAR_T *bp, *p;
 149         char *mp, *np;
 150
 151         GET_SPACE_RETW(sp, bp, blen, 512);
 152
 153 #define SHELLECHO       "echo "
 154 #define SHELLOFFSET     (sizeof(SHELLECHO) - 1)
 155         p = bp;
 156         *p++ = 'e';
 157         *p++ = 'c';
 158         *p++ = 'h';
 159         *p++ = 'o';
 160         *p++ = ' ';
 161         len = SHELLOFFSET;
 162
 163 #if defined(DEBUG) && 0
 164         vtrace(sp, "file_argv: {%.*s}\n", (int)cmdlen, cmd);
 165 #endif
 166
 167         if (argv_fexp(sp, excp, cmd, cmdlen, p, &len, &bp, &blen, 0)) {
 168                 rval = 1;
 169                 goto err;
 170         }
 171
 172 #if defined(DEBUG) && 0
 173         vtrace(sp, "before shell: %d: {%s}\n", len, bp);
 174 #endif
 175
 176         /*
 177          * Do shell word expansion -- it's very, very hard to figure out what
 178          * magic characters the user's shell expects.  Historically, it was a
 179          * union of v7 shell and csh meta characters.  We match that practice
 180          * by default, so ":read \%" tries to read a file named '%'.  It would
 181          * make more sense to pass any special characters through the shell,
 182          * but then, if your shell was csh, the above example will behave
 183          * differently in nvi than in vi.  If you want to get other characters
 184          * passed through to your shell, change the "meta" option.
 185          *
 186          * To avoid a function call per character, we do a first pass through
 187          * the meta characters looking for characters that aren't expected
 188          * to be there, and then we can ignore them in the user's argument.
 189          */
 190         if (opts_empty(sp, O_SHELL, 1) || opts_empty(sp, O_SHELLMETA, 1))
 191                 n = 0;
 192         else {
 193                 for (np = mp = O_STR(sp, O_SHELLMETA); *np != '\0'; ++np)
 194                         if (isblank(*np) || isalnum(*np))
 195                                 break;
 196                 p = bp + SHELLOFFSET;
 197                 n = len - SHELLOFFSET;
 198                 if (*p != '\0') {
 199                         for (; n > 0; --n, ++p)
 200                                 if (strchr(mp, *p) != NULL)
 201                                         break;
 202                 } else
 203                         for (; n > 0; --n, ++p)
 204                                 if (!isblank(*p) &&
 205                                     !isalnum(*p) && strchr(mp, *p) != NULL)
 206                                         break;
 207         }
 208
 209         /*
 210          * If we found a meta character in the string, fork a shell to expand
 211          * it.  Unfortunately, this is comparatively slow.  Historically, it
 212          * didn't matter much, since users don't enter meta characters as part
 213          * of pathnames that frequently.  The addition of filename completion
 214          * broke that assumption because it's easy to use.  As a result, lots
 215          * folks have complained that the expansion code is too slow.  So, we
 216          * detect filename completion as a special case, and do it internally.
 217          * Note that this code assumes that the <asterisk> character is the
 218          * match-anything meta character.  That feels safe -- if anyone writes
 219          * a shell that doesn't follow that convention, I'd suggest giving them
 220          * a festive hot-lead enema.
 221          */
 222         switch (n) {
 223         case 0:
 224                 p = bp + SHELLOFFSET;
 225                 len -= SHELLOFFSET;
 226                 rval = argv_exp3(sp, excp, p, len);
 227                 break;
 228         case 1:
 229                 if (*p == '*') {
 230                         char *np, *d;
 231                         size_t nlen;
 232
 233                         *p = '\0';
 234                         INT2CHAR(sp, bp + SHELLOFFSET,
 235                                  v_strlen(bp + SHELLOFFSET) + 1, np, nlen);
 236                         d = strdup(np);
 237                         rval = argv_lexp(sp, excp, d);
 238                         free (d);
 239                         break;
 240                 }
 241                 /* FALLTHROUGH */
 242         default:
 243                 if (argv_sexp(sp, &bp, &blen, &len)) {
 244                         rval = 1;
 245                         goto err;
 246                 }
 247                 p = bp;
 248                 rval = argv_exp3(sp, excp, p, len);
 249                 break;
 250         }
 251
 252 err:    FREE_SPACEW(sp, bp, blen);
 253         return (rval);
 254 }
 255
 256 /*
 257  * argv_exp3 --
 258  *      Take a string and break it up into an argv, which is appended
 259  *      to the argument list.
 260  *
 261  * PUBLIC: int argv_exp3 __P((SCR *, EXCMD *, CHAR_T *, size_t));
 262  */
 263 int
 264 argv_exp3(sp, excp, cmd, cmdlen)
 265         SCR *sp;
 266         EXCMD *excp;
 267         CHAR_T *cmd;
 268         size_t cmdlen;
 269 {
 270         EX_PRIVATE *exp;
 271         size_t len;
 272         int ch, off;
 273         CHAR_T *ap, *p;
 274
 275         for (exp = EXP(sp); cmdlen > 0; ++exp->argsoff) {
 276                 /* Skip any leading whitespace. */
 277                 for (; cmdlen > 0; --cmdlen, ++cmd) {
 278                         ch = *cmd;
 279                         if (!isblank(ch))
 280                                 break;
 281                 }
 282                 if (cmdlen == 0)
 283                         break;
 284
 285                 /*
 286                  * Determine the length of this whitespace delimited
 287                  * argument.
 288                  *
 289                  * QUOTING NOTE:
 290                  *
 291                  * Skip any character preceded by the user's quoting
 292                  * character.
 293                  */
 294                 for (ap = cmd, len = 0; cmdlen > 0; ++cmd, --cmdlen, ++len) {
 295                         ch = *cmd;
 296                         if (IS_ESCAPE(sp, excp, ch) && cmdlen > 1) {
 297                                 ++cmd;
 298                                 --cmdlen;
 299                         } else if (isblank(ch))
 300                                 break;
 301                 }
 302
 303                 /*
 304                  * Copy the argument into place.
 305                  *
 306                  * QUOTING NOTE:
 307                  *
 308                  * Lose quote chars.
 309                  */
 310                 argv_alloc(sp, len);
 311                 off = exp->argsoff;
 312                 exp->args[off]->len = len;
 313                 for (p = exp->args[off]->bp; len > 0; --len, *p++ = *ap++)
 314                         if (IS_ESCAPE(sp, excp, *ap))
 315                                 ++ap;
 316                 *p = '\0';
 317         }
 318         excp->argv = exp->args;
 319         excp->argc = exp->argsoff;
 320
 321 #if defined(DEBUG) && 0
 322         for (cnt = 0; cnt < exp->argsoff; ++cnt)
 323                 vtrace(sp, "arg %d: {%s}\n", cnt, exp->argv[cnt]);
 324 #endif
 325         return (0);
 326 }
 327
 328 /*
 329  * argv_fexp --
 330  *      Do file name and bang command expansion.
 331  */
 332 static int
 333 argv_fexp(sp, excp, cmd, cmdlen, p, lenp, bpp, blenp, is_bang)
 334         SCR *sp;
 335         EXCMD *excp;
 336         CHAR_T *cmd, *p, **bpp;
 337         size_t cmdlen, *lenp, *blenp;
 338         int is_bang;
 339 {
 340         EX_PRIVATE *exp;
 341         char *t;
 342         size_t blen, len, off, tlen;
 343         CHAR_T *bp;
 344
 345         /* Replace file name characters. */
 346         for (bp = *bpp, blen = *blenp, len = *lenp; cmdlen > 0; --cmdlen, ++cmd)
 347                 switch (*cmd) {
 348                 case '!':
 349                         if (!is_bang)
 350                                 goto ins_ch;
 351                         exp = EXP(sp);
 352                         if (exp->lastbcomm == NULL) {
 353                                 msgq(sp, M_ERR,
 354                                     "115|No previous command to replace \"!\"");
 355                                 return (1);
 356                         }
 357                         len += tlen = v_strlen(exp->lastbcomm);
 358                         off = p - bp;
 359                         ADD_SPACE_RETW(sp, bp, blen, len);
 360                         p = bp + off;
 361                         MEMCPYW(p, exp->lastbcomm, tlen);
 362                         p += tlen;
 363                         F_SET(excp, E_MODIFY);
 364                         break;
 365                 case '%':
 366                         if ((t = sp->frp->name) == NULL) {
 367                                 msgq(sp, M_ERR,
 368                                     "116|No filename to substitute for %%");
 369                                 return (1);
 370                         }
 371                         tlen = strlen(t);
 372                         len += tlen;
 373                         off = p - bp;
 374                         ADD_SPACE_RETW(sp, bp, blen, len);
 375                         p = bp + off;
 376                         MEMCPYW(p, t, tlen);
 377                         p += tlen;
 378                         F_SET(excp, E_MODIFY);
 379                         break;
 380                 case '#':
 381                         if ((t = sp->alt_name) == NULL) {
 382                                 msgq(sp, M_ERR,
 383                                     "117|No filename to substitute for #");
 384                                 return (1);
 385                         }
 386                         len += tlen = strlen(t);
 387                         off = p - bp;
 388                         ADD_SPACE_RETW(sp, bp, blen, len);
 389                         p = bp + off;
 390                         MEMCPYW(p, t, tlen);
 391                         p += tlen;
 392                         F_SET(excp, E_MODIFY);
 393                         break;
 394                 case '\\':
 395                         /*
 396                          * QUOTING NOTE:
 397                          *
 398                          * Strip any backslashes that protected the file
 399                          * expansion characters.
 400                          */
 401                         if (cmdlen > 1 &&
 402                             (cmd[1] == '%' || cmd[1] == '#' || cmd[1] == '!')) {
 403                                 ++cmd;
 404                                 --cmdlen;
 405                         }
 406                         /* FALLTHROUGH */
 407                 default:
 408 ins_ch:                 ++len;
 409                         off = p - bp;
 410                         ADD_SPACE_RETW(sp, bp, blen, len);
 411                         p = bp + off;
 412                         *p++ = *cmd;
 413                 }
 414
 415         /* Nul termination. */
 416         ++len;
 417         off = p - bp;
 418         ADD_SPACE_RETW(sp, bp, blen, len);
 419         p = bp + off;
 420         *p = '\0';
 421
 422         /* Return the new string length, buffer, buffer length. */
 423         *lenp = len - 1;
 424         *bpp = bp;
 425         *blenp = blen;
 426         return (0);
 427 }
 428
 429 /*
 430  * argv_alloc --
 431  *      Make more space for arguments.
 432  */
 433 static int
 434 argv_alloc(sp, len)
 435         SCR *sp;
 436         size_t len;
 437 {
 438         ARGS *ap;
 439         EX_PRIVATE *exp;
 440         int cnt, off;
 441
 442         /*
 443          * Allocate room for another argument, always leaving
 444          * enough room for an ARGS structure with a length of 0.
 445          */
 446 #define INCREMENT       20
 447         exp = EXP(sp);
 448         off = exp->argsoff;
 449         if (exp->argscnt == 0 || off + 2 >= exp->argscnt - 1) {
 450                 cnt = exp->argscnt + INCREMENT;
 451                 REALLOC(sp, exp->args, ARGS **, cnt * sizeof(ARGS *));
 452                 if (exp->args == NULL) {
 453                         (void)argv_free(sp);
 454                         goto mem;
 455                 }
 456                 memset(&exp->args[exp->argscnt], 0, INCREMENT * sizeof(ARGS *));
 457                 exp->argscnt = cnt;
 458         }
 459
 460         /* First argument. */
 461         if (exp->args[off] == NULL) {
 462                 CALLOC(sp, exp->args[off], ARGS *, 1, sizeof(ARGS));
 463                 if (exp->args[off] == NULL)
 464                         goto mem;
 465         }
 466
 467         /* First argument buffer. */
 468         ap = exp->args[off];
 469         ap->len = 0;
 470         if (ap->blen < len + 1) {
 471                 ap->blen = len + 1;
 472                 REALLOC(sp, ap->bp, CHAR_T *, ap->blen * sizeof(CHAR_T));
 473                 if (ap->bp == NULL) {
 474                         ap->bp = NULL;
 475                         ap->blen = 0;
 476                         F_CLR(ap, A_ALLOCATED);
 477 mem:                    msgq(sp, M_SYSERR, NULL);
 478                         return (1);
 479                 }
 480                 F_SET(ap, A_ALLOCATED);
 481         }
 482
 483         /* Second argument. */
 484         if (exp->args[++off] == NULL) {
 485                 CALLOC(sp, exp->args[off], ARGS *, 1, sizeof(ARGS));
 486                 if (exp->args[off] == NULL)
 487                         goto mem;
 488         }
 489         /* 0 length serves as end-of-argument marker. */
 490         exp->args[off]->len = 0;
 491         return (0);
 492 }
 493
 494 /*
 495  * argv_free --
 496  *      Free up argument structures.
 497  *
 498  * PUBLIC: int argv_free __P((SCR *));
 499  */
 500 int
 501 argv_free(sp)
 502         SCR *sp;
 503 {
 504         EX_PRIVATE *exp;
 505         int off;
 506
 507         exp = EXP(sp);
 508         if (exp->args != NULL) {
 509                 for (off = 0; off < exp->argscnt; ++off) {
 510                         if (exp->args[off] == NULL)
 511                                 continue;
 512                         if (F_ISSET(exp->args[off], A_ALLOCATED))
 513                                 free(exp->args[off]->bp);
 514                         free(exp->args[off]);
 515                 }
 516                 free(exp->args);
 517         }
 518         exp->args = NULL;
 519         exp->argscnt = 0;
 520         exp->argsoff = 0;
 521         return (0);
 522 }
 523
 524 /*
 525  * argv_lexp --
 526  *      Find all file names matching the prefix and append them to the
 527  *      buffer.
 528  */
 529 static int
 530 argv_lexp(SCR *sp, EXCMD *excp, char *path)
 531 {
 532         struct dirent *dp;
 533         DIR *dirp;
 534         EX_PRIVATE *exp;
 535         int off;
 536         size_t dlen, len, nlen;
 537         char *dname, *name;
 538         char *p;
 539         size_t wlen;
 540         CHAR_T *wp;
 541         CHAR_T *n;
 542
 543         exp = EXP(sp);
 544
 545         /* Set up the name and length for comparison. */
 546         if ((p = strrchr(path, '/')) == NULL) {
 547                 dname = ".";
 548                 dlen = 0;
 549                 name = path;
 550         } else {
 551                 if (p == path) {
 552                         dname = "/";
 553                         dlen = 1;
 554                 } else {
 555                         *p = '\0';
 556                         dname = path;
 557                         dlen = strlen(path);
 558                 }
 559                 name = p + 1;
 560         }
 561         nlen = strlen(name);
 562
 563         /*
 564          * XXX
 565          * We don't use the d_namlen field, it's not portable enough; we
 566          * assume that d_name is nul terminated, instead.
 567          */
 568         if ((dirp = opendir(dname)) == NULL) {
 569                 msgq_str(sp, M_SYSERR, dname, "%s");
 570                 return (1);
 571         }
 572         for (off = exp->argsoff; (dp = readdir(dirp)) != NULL;) {
 573                 if (nlen == 0) {
 574                         if (dp->d_name[0] == '.')
 575                                 continue;
 576                         len = strlen(dp->d_name);
 577                 } else {
 578                         len = strlen(dp->d_name);
 579                         if (len < nlen || memcmp(dp->d_name, name, nlen))
 580                                 continue;
 581                 }
 582
 583                 /* Directory + name + slash + null. */
 584                 argv_alloc(sp, dlen + len + 2);
 585                 n = exp->args[exp->argsoff]->bp;
 586                 if (dlen != 0) {
 587                         CHAR2INT(sp, dname, dlen, wp, wlen);
 588                         MEMCPYW(n, wp, wlen);
 589                         n += dlen;
 590                         if (dlen > 1 || dname[0] != '/')
 591                                 *n++ = '/';
 592                 }
 593                 CHAR2INT(sp, dp->d_name, len + 1, wp, wlen);
 594                 MEMCPYW(n, wp, wlen);
 595                 exp->args[exp->argsoff]->len = dlen + len + 1;
 596                 ++exp->argsoff;
 597                 excp->argv = exp->args;
 598                 excp->argc = exp->argsoff;
 599         }
 600         closedir(dirp);
 601
 602         if (off == exp->argsoff) {
 603                 /*
 604                  * If we didn't find a match, complain that the expansion
 605                  * failed.  We can't know for certain that's the error, but
 606                  * it's a good guess, and it matches historic practice.
 607                  */
 608                 msgq(sp, M_ERR, "304|Shell expansion failed");
 609                 return (1);
 610         }
 611         qsort(exp->args + off, exp->argsoff - off, sizeof(ARGS *), argv_comp);
 612         return (0);
 613 }
 614
 615 /*
 616  * argv_comp --
 617  *      Alphabetic comparison.
 618  */
 619 static int
 620 argv_comp(a, b)
 621         const void *a, *b;
 622 {
 623         return (strcmp((char *)(*(ARGS **)a)->bp, (char *)(*(ARGS **)b)->bp));
 624 }
 625
 626 /*
 627  * argv_sexp --
 628  *      Fork a shell, pipe a command through it, and read the output into
 629  *      a buffer.
 630  */
 631 static int
 632 argv_sexp(sp, bpp, blenp, lenp)
 633         SCR *sp;
 634         CHAR_T **bpp;
 635         size_t *blenp, *lenp;
 636 {
 637         enum { SEXP_ERR, SEXP_EXPANSION_ERR, SEXP_OK } rval;
 638         FILE *ifp;
 639         pid_t pid;
 640         size_t blen, len;
 641         int ch, std_output[2];
 642         CHAR_T *bp, *p;
 643         char *sh, *sh_path;
 644
 645         /* Secure means no shell access. */
 646         if (O_ISSET(sp, O_SECURE)) {
 647                 msgq(sp, M_ERR,
 648 "289|Shell expansions not supported when the secure edit option is set");
 649                 return (1);
 650         }
 651
 652         sh_path = O_STR(sp, O_SHELL);
 653         if ((sh = strrchr(sh_path, '/')) == NULL)
 654                 sh = sh_path;
 655         else
 656                 ++sh;
 657
 658         /* Local copies of the buffer variables. */
 659         bp = *bpp;
 660         blen = *blenp;
 661
 662         /*
 663          * There are two different processes running through this code, named
 664          * the utility (the shell) and the parent. The utility reads standard
 665          * input and writes standard output and standard error output.  The
 666          * parent writes to the utility, reads its standard output and ignores
 667          * its standard error output.  Historically, the standard error output
 668          * was discarded by vi, as it produces a lot of noise when file patterns
 669          * don't match.
 670          *
 671          * The parent reads std_output[0], and the utility writes std_output[1].
 672          */
 673         ifp = NULL;
 674         std_output[0] = std_output[1] = -1;
 675         if (pipe(std_output) < 0) {
 676                 msgq(sp, M_SYSERR, "pipe");
 677                 return (1);
 678         }
 679         if ((ifp = fdopen(std_output[0], "r")) == NULL) {
 680                 msgq(sp, M_SYSERR, "fdopen");
 681                 goto err;
 682         }
 683
 684         /*
 685          * Do the minimal amount of work possible, the shell is going to run
 686          * briefly and then exit.  We sincerely hope.
 687          */
 688         switch (pid = vfork()) {
 689         case -1:                        /* Error. */
 690                 msgq(sp, M_SYSERR, "vfork");
 691 err:            if (ifp != NULL)
 692                         (void)fclose(ifp);
 693                 else if (std_output[0] != -1)
 694                         close(std_output[0]);
 695                 if (std_output[1] != -1)
 696                         close(std_output[0]);
 697                 return (1);
 698         case 0:                         /* Utility. */
 699                 /* Redirect stdout to the write end of the pipe. */
 700                 (void)dup2(std_output[1], STDOUT_FILENO);
 701
 702                 /* Close the utility's file descriptors. */
 703                 (void)close(std_output[0]);
 704                 (void)close(std_output[1]);
 705                 (void)close(STDERR_FILENO);
 706
 707                 /*
 708                  * XXX
 709                  * Assume that all shells have -c.
 710                  */
 711                 execl(sh_path, sh, "-c", bp, NULL);
 712                 msgq_str(sp, M_SYSERR, sh_path, "118|Error: execl: %s");
 713                 _exit(127);
 714         default:                        /* Parent. */
 715                 /* Close the pipe ends the parent won't use. */
 716                 (void)close(std_output[1]);
 717                 break;
 718         }
 719
 720         /*
 721          * Copy process standard output into a buffer.
 722          *
 723          * !!!
 724          * Historic vi apparently discarded leading \n and \r's from
 725          * the shell output stream.  We don't on the grounds that any
 726          * shell that does that is broken.
 727          */
 728         for (p = bp, len = 0, ch = EOF;
 729             (ch = getc(ifp)) != EOF; *p++ = ch, --blen, ++len)
 730                 if (blen < 5) {
 731                         ADD_SPACE_GOTOW(sp, bp, *blenp, *blenp * 2);
 732                         p = bp + len;
 733                         blen = *blenp - len;
 734                 }
 735
 736         /* Delete the final newline, nul terminate the string. */
 737         if (p > bp && (p[-1] == '\n' || p[-1] == '\r')) {
 738                 --p;
 739                 --len;
 740         }
 741         *p = '\0';
 742         *lenp = len;
 743         *bpp = bp;              /* *blenp is already updated. */
 744
 745         if (ferror(ifp))
 746                 goto ioerr;
 747         if (fclose(ifp)) {
 748 ioerr:          msgq_str(sp, M_ERR, sh, "119|I/O error: %s");
 749 alloc_err:      rval = SEXP_ERR;
 750         } else
 751                 rval = SEXP_OK;
 752
 753         /*
 754          * Wait for the process.  If the shell process fails (e.g., "echo $q"
 755          * where q wasn't a defined variable) or if the returned string has
 756          * no characters or only blank characters, (e.g., "echo $5"), complain
 757          * that the shell expansion failed.  We can't know for certain that's
 758          * the error, but it's a good guess, and it matches historic practice.
 759          * This won't catch "echo foo_$5", but that's not a common error and
 760          * historic vi didn't catch it either.
 761          */
 762         if (proc_wait(sp, (long)pid, sh, 1, 0))
 763                 rval = SEXP_EXPANSION_ERR;
 764
 765         for (p = bp; len; ++p, --len)
 766                 if (!isblank(*p))
 767                         break;
 768         if (len == 0)
 769                 rval = SEXP_EXPANSION_ERR;
 770
 771         if (rval == SEXP_EXPANSION_ERR)
 772                 msgq(sp, M_ERR, "304|Shell expansion failed");
 773
 774         return (rval == SEXP_OK ? 0 : 1);
 775 }