xref: /netbsd/bin/ksh/eval.c (revision ce6c4c31)
1 /*	$NetBSD: eval.c,v 1.26 2019/09/26 11:01:09 mlelstv Exp $	*/
2 
3 /*
4  * Expansion - quoting, separation, substitution, globbing
5  */
6 #include <sys/cdefs.h>
7 
8 #ifndef lint
9 __RCSID("$NetBSD: eval.c,v 1.26 2019/09/26 11:01:09 mlelstv Exp $");
10 #endif
11 
12 #include <sys/stat.h>
13 #include <stdint.h>
14 #include <pwd.h>
15 
16 #include "sh.h"
17 #include "ksh_dir.h"
18 
19 /*
20  * string expansion
21  *
22  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
23  * second pass: alternation ({,}), filename expansion (*?[]).
24  */
25 
26 /* expansion generator state */
27 typedef struct Expand {
28 	/* int  type; */	/* see expand() */
29 	const char *str;	/* string */
30 	union {
31 		const char **strv;/* string[] */
32 		struct shf *shf;/* file */
33 	} u;			/* source */
34 	struct tbl *var;	/* variable in ${var..} */
35 	short	split;		/* split "$@" / call waitlast $() */
36 } Expand;
37 
38 #define	XBASE		0	/* scanning original */
39 #define	XSUB		1	/* expanding ${} string */
40 #define	XARGSEP		2	/* ifs0 between "$*" */
41 #define	XARG		3	/* expanding $*, $@ */
42 #define	XCOM		4	/* expanding $() */
43 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
44 
45 /* States used for field splitting */
46 #define IFS_WORD	0	/* word has chars (or quotes) */
47 #define IFS_WS		1	/* have seen IFS white-space */
48 #define IFS_NWS		2	/* have seen IFS non-white-space */
49 
50 static	int	varsub ARGS((Expand *xp, char *sp, char *word, int *stypep, int *slenp));
51 static	int	comsub ARGS((Expand *xp, char *cp));
52 static	char   *trimsub ARGS((char *str, char *pat, int how));
53 static	void	ksh_glob ARGS((char *cp, XPtrV *wp, int markdirs));
54 static	void	globit ARGS((XString *xs, char **xpp, char *sp, XPtrV *wp,
55 			     int check));
56 static char	*maybe_expand_tilde ARGS((char *p, XString *dsp, char **dpp,
57 					  int isassign));
58 static	char   *tilde ARGS((char *acp));
59 static	char   *homedir ARGS((char *name));
60 #ifdef BRACE_EXPAND
61 static void	alt_expand ARGS((XPtrV *wp, char *start, char *exp_start,
62 				 char *end, int fdo));
63 #endif
64 
65 /* compile and expand word */
66 char *
substitute(cp,f)67 substitute(cp, f)
68 	const char *cp;
69 	int f;
70 {
71 	struct source *s, *sold;
72 
73 	sold = source;
74 	s = pushs(SWSTR, ATEMP);
75 	s->start = s->str = cp;
76 	source = s;
77 	if (yylex(ONEWORD) != LWORD)
78 		internal_errorf(1, "substitute");
79 	source = sold;
80 	afree(s, ATEMP);
81 	return evalstr(yylval.cp, f);
82 }
83 
84 /*
85  * expand arg-list
86  */
87 char **
eval(ap,f)88 eval(ap, f)
89 	char **ap;
90 	int f;
91 {
92 	XPtrV w;
93 
94 	if (*ap == NULL)
95 		return ap;
96 	XPinit(w, 32);
97 	XPput(w, NULL);		/* space for shell name */
98 	while (*ap != NULL)
99 		expand(*ap++, &w, f);
100 	XPput(w, NULL);
101 	return (char **) XPclose(w) + 1;
102 }
103 
104 /*
105  * expand string
106  */
107 char *
evalstr(cp,f)108 evalstr(cp, f)
109 	char *cp;
110 	int f;
111 {
112 	XPtrV w;
113 
114 	XPinit(w, 1);
115 	expand(cp, &w, f);
116 	cp = (XPsize(w) == 0) ? null : (char*) *XPptrv(w);
117 	XPfree(w);
118 	return cp;
119 }
120 
121 /*
122  * expand string - return only one component
123  * used from iosetup to expand redirection files
124  */
125 char *
evalonestr(cp,f)126 evalonestr(cp, f)
127 	char *cp;
128 	int f;
129 {
130 	XPtrV w;
131 
132 	XPinit(w, 1);
133 	expand(cp, &w, f);
134 	switch (XPsize(w)) {
135 	case 0:
136 		cp = null;
137 		break;
138 	case 1:
139 		cp = (char*) *XPptrv(w);
140 		break;
141 	default:
142 		cp = evalstr(cp, f&~DOGLOB);
143 		break;
144 	}
145 	XPfree(w);
146 	return cp;
147 }
148 
149 /* for nested substitution: ${var:=$var2} */
150 typedef struct SubType {
151 	short	stype;		/* [=+-?%#] action after expanded word */
152 	short	base;		/* begin position of expanded word */
153 	short	f;		/* saved value of f (DOPAT, etc) */
154 	struct tbl *var;	/* variable for ${var..} */
155 	short	quote;		/* saved value of quote (for ${..[%#]..}) */
156 	struct SubType *prev;	/* old type */
157 	struct SubType *next;	/* poped type (to avoid re-allocating) */
158 } SubType;
159 
160 void
expand(cp,wp,f)161 expand(cp, wp, f)
162 	char *cp;		/* input word */
163 	XPtrV *wp;		/* output words */
164 	int f;			/* DO* flags */
165 {
166 	int UNINITIALIZED(c);
167 	int type;		/* expansion type */
168 	int quote = 0;		/* quoted */
169 	XString ds;		/* destination string */
170 	char *dp, *sp;		/* dest., source */
171 	int fdo, word;		/* second pass flags; have word */
172 	int doblank;		/* field splitting of parameter/command subst */
173 	Expand x;		/* expansion variables */
174 	SubType st_head, *st;
175 	int UNINITIALIZED(newlines); /* For trailing newlines in COMSUB */
176 	int saw_eq;
177 	unsigned int tilde_ok;
178 	int make_magic;
179 	size_t len;
180 
181 	x.split = 0;	/* XXX gcc */
182 	x.str = NULL;	/* XXX gcc */
183 	x.u.strv = NULL;/* XXX gcc */
184 	if (cp == NULL)
185 		internal_errorf(1, "expand(NULL)");
186 	/* for alias, readonly, set, typeset commands */
187 	if ((f & DOVACHECK) && is_wdvarassign(cp)) {
188 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
189 		f |= DOASNTILDE;
190 	}
191 	if (Flag(FNOGLOB))
192 		f &= ~DOGLOB;
193 	if (Flag(FMARKDIRS))
194 		f |= DOMARKDIRS;
195 #ifdef BRACE_EXPAND
196 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
197 		f |= DOBRACE_;
198 #endif /* BRACE_EXPAND */
199 
200 	Xinit(ds, dp, 128, ATEMP);	/* init dest. string */
201 	type = XBASE;
202 	sp = cp;
203 	fdo = 0;
204 	saw_eq = 0;
205 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0; /* must be 1/0 */
206 	doblank = 0;
207 	make_magic = 0;
208 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
209 	st_head.next = (SubType *) 0;
210 	st = &st_head;
211 
212 	while (1) {
213 		Xcheck(ds, dp);
214 
215 		switch (type) {
216 		  case XBASE:	/* original prefixed string */
217 			c = *sp++;
218 			switch (c) {
219 			  case EOS:
220 				c = 0;
221 				break;
222 			  case CHAR:
223 				c = *sp++;
224 				break;
225 			  case QCHAR:
226 				quote |= 2; /* temporary quote */
227 				c = *sp++;
228 				break;
229 			  case OQUOTE:
230 				word = IFS_WORD;
231 				tilde_ok = 0;
232 				quote = 1;
233 				continue;
234 			  case CQUOTE:
235 				quote = 0;
236 				continue;
237 			  case COMSUB:
238 				tilde_ok = 0;
239 				if (f & DONTRUNCOMMAND) {
240 					word = IFS_WORD;
241 					*dp++ = '$'; *dp++ = '(';
242 					while (*sp != '\0') {
243 						Xcheck(ds, dp);
244 						*dp++ = *sp++;
245 					}
246 					*dp++ = ')';
247 				} else {
248 					type = comsub(&x, sp);
249 					if (type == XCOM && (f&DOBLANK))
250 						doblank++;
251 					sp = strchr(sp, 0) + 1;
252 					newlines = 0;
253 				}
254 				continue;
255 			  case EXPRSUB:
256 				word = IFS_WORD;
257 				tilde_ok = 0;
258 				if (f & DONTRUNCOMMAND) {
259 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
260 					while (*sp != '\0') {
261 						Xcheck(ds, dp);
262 						*dp++ = *sp++;
263 					}
264 					*dp++ = ')'; *dp++ = ')';
265 				} else {
266 					struct tbl v;
267 					char *p;
268 
269 					v.flag = DEFINED|ISSET|INTEGER;
270 					v.type = 10; /* not default */
271 					v.name[0] = '\0';
272 					v_evaluate(&v, substitute(sp, 0),
273 						KSH_UNWIND_ERROR);
274 					sp = strchr(sp, 0) + 1;
275 					for (p = str_val(&v); *p; ) {
276 						Xcheck(ds, dp);
277 						*dp++ = *p++;
278 					}
279 				}
280 				continue;
281 			  case OSUBST: /* ${{#}var{:}[=+-?#%]word} */
282 			  /* format is:
283 			   *   OSUBST [{x] plain-variable-part \0
284 			   *     compiled-word-part CSUBST [}x]
285 			   * This is were all syntax checking gets done...
286 			   */
287 			  {
288 				char *varname = ++sp; /* skip the { or x (}) */
289 				int stype;
290 				int slen;
291 
292 				slen = -1;	/* XXX gcc */
293 				sp = strchr(sp, '\0') + 1; /* skip variable */
294 				type = varsub(&x, varname, sp, &stype, &slen);
295 				if (type < 0) {
296 					char endc;
297 					char *str, *end;
298 
299 					end = (char *) wdscan(sp, CSUBST);
300 					/* ({) the } or x is already skipped */
301 					endc = *end;
302 					*end = EOS;
303 					str = snptreef((char *) 0, 64, "%S",
304 							varname - 1);
305 					*end = endc;
306 					errorf("%s: bad substitution", str);
307 				}
308 				if (f&DOBLANK)
309 					doblank++;
310 				tilde_ok = 0;
311 				if (type == XBASE) {	/* expand? */
312 					if (!st->next) {
313 						SubType *newst;
314 
315 						newst = (SubType *) alloc(
316 							sizeof(SubType), ATEMP);
317 						newst->next = (SubType *) 0;
318 						newst->prev = st;
319 						st->next = newst;
320 					}
321 					st = st->next;
322 					st->stype = stype;
323 					st->base = Xsavepos(ds, dp);
324 					st->f = f;
325 					st->var = x.var;
326 					st->quote = quote;
327 					/* skip qualifier(s) */
328 					if (stype)
329 						sp += slen;
330 					switch (stype & 0x7f) {
331 					  case '#':
332 					  case '%':
333 						/* ! DOBLANK,DOBRACE_,DOTILDE */
334 						f = DOPAT | (f&DONTRUNCOMMAND)
335 						    | DOTEMP_;
336 						quote = 0;
337 						/* Prepend open pattern (so |
338 						 * in a trim will work as
339 						 * expected)
340 						 */
341 						*dp++ = MAGIC;
342 						*dp++ = (char)('@' + 0x80);
343 						break;
344 					  case '=':
345 						/* Enabling tilde expansion
346 						 * after :'s here is
347 						 * non-standard ksh, but is
348 						 * consistent with rules for
349 						 * other assignments.  Not
350 						 * sure what POSIX thinks of
351 						 * this.
352 						 * Not doing tilde expansion
353 						 * for integer variables is a
354 						 * non-POSIX thing - makes
355 						 * sense though, since ~ is
356 						 * a arithmetic operator.
357 						 */
358 						if (!(x.var->flag & INTEGER))
359 							f |= DOASNTILDE|DOTILDE;
360 						f |= DOTEMP_;
361 						/* These will be done after the
362 						 * value has been assigned.
363 						 */
364 						f &= ~(DOBLANK|DOGLOB|DOBRACE_);
365 						tilde_ok = 1;
366 						break;
367 					  case '?':
368 						f &= ~DOBLANK;
369 						f |= DOTEMP_;
370 						/* fall through */
371 					  default:
372 						/* Enable tilde expansion */
373 						tilde_ok = 1;
374 						f |= DOTILDE;
375 					}
376 				} else
377 					/* skip word */
378 					sp = (char *) wdscan(sp, CSUBST);
379 				continue;
380 			  }
381 			  case CSUBST: /* only get here if expanding word */
382 				sp++; /* ({) skip the } or x */
383 				tilde_ok = 0;	/* in case of ${unset:-} */
384 				*dp = '\0';
385 				quote = st->quote;
386 				f = st->f;
387 				if (f&DOBLANK)
388 					doblank--;
389 				switch (st->stype&0x7f) {
390 				  case '#':
391 				  case '%':
392 					/* Append end-pattern */
393 					*dp++ = MAGIC; *dp++ = ')'; *dp = '\0';
394 					dp = Xrestpos(ds, dp, st->base);
395 					/* Must use st->var since calling
396 					 * global would break things
397 					 * like x[i+=1].
398 					 */
399 					x.str = trimsub(str_val(st->var),
400 						dp, st->stype);
401 					type = XSUB;
402 					if (f&DOBLANK)
403 						doblank++;
404 					st = st->prev;
405 					continue;
406 				  case '=':
407 					/* Restore our position and substitute
408 					 * the value of st->var (may not be
409 					 * the assigned value in the presence
410 					 * of integer/right-adj/etc attributes).
411 					 */
412 					dp = Xrestpos(ds, dp, st->base);
413 					/* Must use st->var since calling
414 					 * global would cause with things
415 					 * like x[i+=1] to be evaluated twice.
416 					 */
417 					/* Note: not exported by FEXPORT
418 					 * in at&t ksh.
419 					 */
420 					/* XXX POSIX says readonly is only
421 					 * fatal for special builtins (setstr
422 					 * does readonly check).
423 					 */
424 					len = strlen(dp) + 1;
425 					setstr(st->var,
426 					    debunk((char *) alloc(len, ATEMP),
427 						dp, len),
428 					    KSH_UNWIND_ERROR);
429 					x.str = str_val(st->var);
430 					type = XSUB;
431 					if (f&DOBLANK)
432 						doblank++;
433 					st = st->prev;
434 					continue;
435 				  case '?':
436 				    {
437 					char *s = Xrestpos(ds, dp, st->base);
438 
439 					errorf("%s: %s", st->var->name,
440 					    dp == s ?
441 					      "parameter null or not set"
442 					    : (debunk(s, s, strlen(s) + 1), s));
443 				    }
444 				}
445 				st = st->prev;
446 				type = XBASE;
447 				continue;
448 
449 			  case OPAT: /* open pattern: *(foo|bar) */
450 				/* Next char is the type of pattern */
451 				make_magic = 1;
452 				c = *sp++ + 0x80;
453 				break;
454 
455 			  case SPAT: /* pattern separator (|) */
456 				make_magic = 1;
457 				c = '|';
458 				break;
459 
460 			  case CPAT: /* close pattern */
461 				make_magic = 1;
462 				c = /*(*/ ')';
463 				break;
464 			}
465 			break;
466 
467 		  case XNULLSUB:
468 			/* Special case for "$@" (and "${foo[@]}") - no
469 			 * word is generated if $# is 0 (unless there is
470 			 * other stuff inside the quotes).
471 			 */
472 			type = XBASE;
473 			if (f&DOBLANK) {
474 				doblank--;
475 				/* not really correct: x=; "$x$@" should
476 				 * generate a null argument and
477 				 * set A; "${@:+}" shouldn't.
478 				 */
479 				if (dp == Xstring(ds, dp))
480 					word = IFS_WS;
481 			}
482 			continue;
483 
484 		  case XSUB:
485 			if ((c = *x.str++) == 0) {
486 				type = XBASE;
487 				if (f&DOBLANK)
488 					doblank--;
489 				continue;
490 			}
491 			break;
492 
493 		  case XARGSEP:
494 			type = XARG;
495 			quote = 1;
496 			/* FALLTHROUGH */
497 		  case XARG:
498 			if ((c = *x.str++) == '\0') {
499 				/* force null words to be created so
500 				 * set -- '' 2 ''; foo "$@" will do
501 				 * the right thing
502 				 */
503 				if (quote && x.split)
504 					word = IFS_WORD;
505 				if ((x.str = *x.u.strv++) == NULL) {
506 					type = XBASE;
507 					if (f&DOBLANK)
508 						doblank--;
509 					continue;
510 				}
511 				c = ifs0;
512 				if (c == 0) {
513 					if (quote && !x.split)
514 						continue;
515 					c = ' ';
516 				}
517 				if (quote && x.split) {
518 					/* terminate word for "$@" */
519 					type = XARGSEP;
520 					quote = 0;
521 				}
522 			}
523 			break;
524 
525 		  case XCOM:
526 			if (newlines) {		/* Spit out saved nl's */
527 				c = '\n';
528 				--newlines;
529 			} else {
530 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
531 				    if (c == '\n')
532 					    newlines++;	/* Save newlines */
533 				if (newlines && c != EOF) {
534 					shf_ungetc(c, x.u.shf);
535 					c = '\n';
536 					--newlines;
537 				}
538 			}
539 			if (c == EOF) {
540 				newlines = 0;
541 				shf_close(x.u.shf);
542 				if (x.split)
543 					subst_exstat = waitlast();
544 				type = XBASE;
545 				if (f&DOBLANK)
546 					doblank--;
547 				continue;
548 			}
549 			break;
550 		}
551 
552 		/* check for end of word or IFS separation */
553 		if (c == 0 || (!quote && (f & DOBLANK) && doblank && !make_magic
554 			       && ctype(c, C_IFS)))
555 		{
556 			/* How words are broken up:
557 			 *		   |       value of c
558 			 *	  word	   |	ws	nws	0
559 			 *	-----------------------------------
560 			 *	IFS_WORD	w/WS	w/NWS	w
561 			 *	IFS_WS		-/WS	w/NWS	-
562 			 *	IFS_NWS		-/NWS	w/NWS	w
563 			 *   (w means generate a word)
564 			 * Note that IFS_NWS/0 generates a word (at&t ksh
565 			 * doesn't do this, but POSIX does).
566 			 */
567 			if (word == IFS_WORD
568 			    || (!ctype(c, C_IFSWS) && (c || word == IFS_NWS)))
569 			{
570 				char *p;
571 
572 				*dp++ = '\0';
573 				p = Xclose(ds, dp);
574 #ifdef BRACE_EXPAND
575 				if (fdo & DOBRACE_)
576 					/* also does globbing */
577 					alt_expand(wp, p, p,
578 						   p + Xlength(ds, (dp - 1)),
579 						   fdo | (f & DOMARKDIRS));
580 				else
581 #endif /* BRACE_EXPAND */
582 				if (fdo & DOGLOB)
583 					ksh_glob(p, wp, f & DOMARKDIRS);
584 				else if ((f & DOPAT) || !(fdo & DOMAGIC_))
585 					XPput(*wp, p);
586 				else
587 					XPput(*wp, debunk(p, p, strlen(p) + 1));
588 				fdo = 0;
589 				saw_eq = 0;
590 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
591 				if (c != 0)
592 					Xinit(ds, dp, 128, ATEMP);
593 			}
594 			if (c == 0)
595 				return;
596 			if (word != IFS_NWS)
597 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
598 		} else {
599 			/* age tilde_ok info - ~ code tests second bit */
600 			tilde_ok <<= 1;
601 			/* mark any special second pass chars */
602 			if (!quote)
603 				switch (c) {
604 				  case '[':
605 				  case NOT:
606 				  case '-':
607 				  case ']':
608 					/* For character classes - doesn't hurt
609 					 * to have magic !,-,]'s outside of
610 					 * [...] expressions.
611 					 */
612 					if (f & (DOPAT | DOGLOB)) {
613 						fdo |= DOMAGIC_;
614 						if (c == '[')
615 							fdo |= f & DOGLOB;
616 						*dp++ = MAGIC;
617 					}
618 					break;
619 				  case '*':
620 				  case '?':
621 					if (f & (DOPAT | DOGLOB)) {
622 						fdo |= DOMAGIC_ | (f & DOGLOB);
623 						*dp++ = MAGIC;
624 					}
625 					break;
626 #ifdef BRACE_EXPAND
627 				  case OBRACE:
628 				  case ',':
629 				  case CBRACE:
630 					if ((f & DOBRACE_) && (c == OBRACE
631 						|| (fdo & DOBRACE_)))
632 					{
633 						fdo |= DOBRACE_|DOMAGIC_;
634 						*dp++ = MAGIC;
635 					}
636 					break;
637 #endif /* BRACE_EXPAND */
638 				  case '=':
639 					/* Note first unquoted = for ~ */
640 					if (!(f & DOTEMP_) && !saw_eq) {
641 						saw_eq = 1;
642 						tilde_ok = 1;
643 					}
644 					break;
645 				  case PATHSEP: /* : */
646 					/* Note unquoted : for ~ */
647 					if (!(f & DOTEMP_) && (f & DOASNTILDE))
648 						tilde_ok = 1;
649 					break;
650 				  case '~':
651 					/* tilde_ok is reset whenever
652 					 * any of ' " $( $(( ${ } are seen.
653 					 * Note that tilde_ok must be preserved
654 					 * through the sequence ${A=a=}~
655 					 */
656 					if (type == XBASE
657 					    && (f & (DOTILDE|DOASNTILDE))
658 					    && (tilde_ok & 2))
659 					{
660 						char *p, *dp_x;
661 
662 						dp_x = dp;
663 						p = maybe_expand_tilde(sp,
664 							&ds, &dp_x,
665 							f & DOASNTILDE);
666 						if (p) {
667 							if (dp != dp_x)
668 								word = IFS_WORD;
669 							dp = dp_x;
670 							sp = p;
671 							continue;
672 						}
673 					}
674 					break;
675 				}
676 			else
677 				quote &= ~2; /* undo temporary */
678 
679 			if (make_magic) {
680 				make_magic = 0;
681 				fdo |= DOMAGIC_ | (f & DOGLOB);
682 				*dp++ = MAGIC;
683 			} else if (ISMAGIC(c)) {
684 				fdo |= DOMAGIC_;
685 				*dp++ = MAGIC;
686 			}
687 			*dp++ = c; /* save output char */
688 			word = IFS_WORD;
689 		}
690 	}
691 }
692 
693 /*
694  * Prepare to generate the string returned by ${} substitution.
695  */
696 static int
varsub(xp,sp,word,stypep,slenp)697 varsub(xp, sp, word, stypep, slenp)
698 	Expand *xp;
699 	char *sp;
700 	char *word;
701 	int *stypep;	/* becomes qualifier type */
702 	int *slenp;	/* " " len (=, :=, etc.) valid iff *stypep != 0 */
703 {
704 	int c;
705 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
706 	int stype;	/* substitution type */
707 	int slen;
708 	char *p;
709 	struct tbl *vp;
710 
711 	if (sp[0] == '\0')	/* Bad variable name */
712 		return -1;
713 
714 	xp->var = NULL;
715 
716 	/* ${#var}, string length or array size */
717 	if (sp[0] == '#' && (c = sp[1]) != '\0') {
718 		int zero_ok = 0;
719 
720 		/* Can't have any modifiers for ${#...} */
721 		if (*word != CSUBST)
722 			return -1;
723 		sp++;
724 		/* Check for size of array */
725 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
726 			int n = 0;
727 			vp = global(arrayname(sp));
728 			if (vp->flag & (ISSET|ARRAY))
729 				zero_ok = 1;
730 			for (; vp; vp = vp->u.array)
731 				if (vp->flag & ISSET) {
732 					n++;
733 				}
734 			c = n; /* ksh88/ksh93 go for number, not max index */
735 		} else if (c == '*' || c == '@')
736 			c = e->loc->argc;
737 		else {
738 			p = str_val(global(sp));
739 			zero_ok = p != null;
740 			c = strlen(p);
741 		}
742 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
743 			errorf("%s: parameter not set", sp);
744 		*stypep = 0; /* unqualified variable/string substitution */
745 		xp->str = str_save(ulton((unsigned long)c, 10), ATEMP);
746 		return XSUB;
747 	}
748 
749 	/* Check for qualifiers in word part */
750 	stype = 0;
751 	c = word[slen = 0] == CHAR ? word[1] : 0;
752 	if (c == ':') {
753 		slen += 2;
754 		stype = 0x80;
755 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
756 	}
757 	if (ctype(c, C_SUBOP1)) {
758 		slen += 2;
759 		stype |= c;
760 	} else if (ctype(c, C_SUBOP2)) { /* Note: ksh88 allows :%, :%%, etc */
761 		slen += 2;
762 		stype = c;
763 		if (word[slen + 0] == CHAR && c == word[slen + 1]) {
764 			stype |= 0x80;
765 			slen += 2;
766 		}
767 	} else if (stype)	/* : is not ok */
768 		return -1;
769 	if (!stype && *word != CSUBST)
770 		return -1;
771 	*stypep = stype;
772 	*slenp = slen;
773 
774 	c = sp[0];
775 	if (c == '*' || c == '@') {
776 		switch (stype & 0x7f) {
777 		  case '=':	/* can't assign to a vector */
778 		  case '%':	/* can't trim a vector (yet) */
779 		  case '#':
780 			return -1;
781 		}
782 		if (e->loc->argc == 0) {
783 			xp->u.strv = NULL;
784 			xp->str = null;
785 			state = c == '@' ? XNULLSUB : XSUB;
786 		} else {
787 			char **t = &e->loc->argv[1];
788 			xp->u.strv = (void *)(uintptr_t)t;
789 			xp->str = *xp->u.strv++;
790 			xp->split = c == '@'; /* $@ */
791 			state = XARG;
792 		}
793 	} else {
794 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
795 			XPtrV wv;
796 
797 			switch (stype & 0x7f) {
798 			  case '=':	/* can't assign to a vector */
799 			  case '%':	/* can't trim a vector (yet) */
800 			  case '#':
801 				return -1;
802 			}
803 			XPinit(wv, 32);
804 			vp = global(arrayname(sp));
805 			for (; vp; vp = vp->u.array) {
806 				if (!(vp->flag&ISSET))
807 					continue;
808 				XPput(wv, str_val(vp));
809 			}
810 			if (XPsize(wv) == 0) {
811 				xp->str = null;
812 				state = p[1] == '@' ? XNULLSUB : XSUB;
813 				XPfree(wv);
814 			} else {
815 				XPput(wv, 0);
816 				xp->u.strv = (const char **) XPptrv(wv);
817 				xp->str = *xp->u.strv++;
818 				xp->split = p[1] == '@'; /* ${foo[@]} */
819 				state = XARG;
820 			}
821 		} else {
822 			/* Can't assign things like $! or $1 */
823 			if ((stype & 0x7f) == '='
824 			    && (ctype(*sp, C_VAR1) || digit(*sp)))
825 				return -1;
826 			xp->var = global(sp);
827 			xp->str = str_val(xp->var);
828 			state = XSUB;
829 		}
830 	}
831 
832 	c = stype&0x7f;
833 	/* test the compiler's code generator */
834 	if (ctype(c, C_SUBOP2) ||
835 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
836 	     c == '=' || c == '-' || c == '?' : c == '+'))
837 		state = XBASE;	/* expand word instead of variable value */
838 	if (Flag(FNOUNSET) && xp->str == null
839 	    && (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
840 		errorf("%s: parameter not set", sp);
841 	return state;
842 }
843 
844 /*
845  * Run the command in $(...) and read its output.
846  */
847 static int
comsub(xp,cp)848 comsub(xp, cp)
849 	Expand *xp;
850 	char *cp;
851 {
852 	Source *s, *sold;
853 	struct op *t;
854 	struct shf *shf;
855 
856 	s = pushs(SSTRING, ATEMP);
857 	s->start = s->str = cp;
858 	sold = source;
859 	t = compile(s);
860 	afree(s, ATEMP);
861 	source = sold;
862 
863 	if (t == NULL)
864 		return XBASE;
865 
866 	if (t != NULL && t->type == TCOM && /* $(<file) */
867 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
868 		struct ioword *io = *t->ioact;
869 		char *name;
870 
871 		if ((io->flag&IOTYPE) != IOREAD)
872 			errorf("funny $() command: %s",
873 				snptreef((char *) 0, 32, "%R", io));
874 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
875 			SHF_MAPHI|SHF_CLEXEC);
876 		if (shf == NULL)
877 			errorf("%s: cannot open $() input", name);
878 		xp->split = 0;	/* no waitlast() */
879 	} else {
880 		int ofd1, pv[2];
881 		openpipe(pv);
882 		shf = shf_fdopen(pv[0], SHF_RD, (struct shf *) 0);
883 		ofd1 = savefd(1, 0);	/* fd 1 may be closed... */
884 		if (pv[1] != 1) {
885 			ksh_dup2(pv[1], 1, false);
886 			close(pv[1]);
887 		}
888 		execute(t, XFORK|XXCOM|XPIPEO);
889 		restfd(1, ofd1);
890 		startlast();
891 		xp->split = 1;	/* waitlast() */
892 	}
893 
894 	xp->u.shf = shf;
895 	return XCOM;
896 }
897 
898 /*
899  * perform #pattern and %pattern substitution in ${}
900  */
901 
902 static char *
trimsub(str,pat,how)903 trimsub(str, pat, how)
904 	char *str;
905 	char *pat;
906 	int how;
907 {
908 	char *end = strchr(str, 0);
909 	char *p, c;
910 
911 	switch (how&0xff) {	/* UCHAR_MAX maybe? */
912 	  case '#':		/* shortest at beginning */
913 		for (p = str; p <= end; p++) {
914 			c = *p; *p = '\0';
915 			if (gmatch(str, pat, false)) {
916 				*p = c;
917 				return p;
918 			}
919 			*p = c;
920 		}
921 		break;
922 	  case '#'|0x80:	/* longest match at beginning */
923 		for (p = end; p >= str; p--) {
924 			c = *p; *p = '\0';
925 			if (gmatch(str, pat, false)) {
926 				*p = c;
927 				return p;
928 			}
929 			*p = c;
930 		}
931 		break;
932 	  case '%':		/* shortest match at end */
933 		for (p = end; p >= str; p--) {
934 			if (gmatch(p, pat, false))
935 				return str_nsave(str, p - str, ATEMP);
936 		}
937 		break;
938 	  case '%'|0x80:	/* longest match at end */
939 		for (p = str; p <= end; p++) {
940 			if (gmatch(p, pat, false))
941 				return str_nsave(str, p - str, ATEMP);
942 		}
943 		break;
944 	}
945 
946 	return str;		/* no match, return string */
947 }
948 
949 /*
950  * ksh_glob
951  * Name derived from V6's /etc/glob, the program that expanded filenames.
952  */
953 
954 /* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
955 static void
ksh_glob(cp,wp,markdirs)956 ksh_glob(cp, wp, markdirs)
957 	char *cp;
958 	XPtrV *wp;
959 	int markdirs;
960 {
961 	int oldsize = XPsize(*wp);
962 
963 	if (glob_str(cp, wp, markdirs) == 0)
964 		XPput(*wp, debunk(cp, cp, strlen(cp) + 1));
965 	else
966 		qsortp(XPptrv(*wp) + oldsize, (size_t)(XPsize(*wp) - oldsize),
967 			xstrcmp);
968 }
969 
970 #define GF_NONE		0
971 #define GF_EXCHECK	BIT(0)		/* do existence check on file */
972 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
973 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
974 
975 /* Apply file globbing to cp and store the matching files in wp.  Returns
976  * the number of matches found.
977  */
978 int
glob_str(cp,wp,markdirs)979 glob_str(cp, wp, markdirs)
980 	char *cp;
981 	XPtrV *wp;
982 	int markdirs;
983 {
984 	int oldsize = XPsize(*wp);
985 	XString xs;
986 	char *xp;
987 
988 	Xinit(xs, xp, 256, ATEMP);
989 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
990 	Xfree(xs, xp);
991 
992 	return XPsize(*wp) - oldsize;
993 }
994 
995 static void
globit(xs,xpp,sp,wp,check)996 globit(xs, xpp, sp, wp, check)
997 	XString *xs;		/* dest string */
998 	char **xpp;		/* ptr to dest end */
999 	char *sp;		/* source path */
1000 	XPtrV *wp;		/* output list */
1001 	int check;		/* GF_* flags */
1002 {
1003 	char *np;		/* next source component */
1004 	char *xp = *xpp;
1005 	char *se;
1006 	char odirsep;
1007 
1008 	/* This to allow long expansions to be interrupted */
1009 	intrcheck();
1010 
1011 	if (sp == NULL) {	/* end of source path */
1012 		/* We only need to check if the file exists if a pattern
1013 		 * is followed by a non-pattern (eg, foo*x/bar; no check
1014 		 * is needed for foo* since the match must exist) or if
1015 		 * any patterns were expanded and the markdirs option is set.
1016 		 * Symlinks make things a bit tricky...
1017 		 */
1018 		if ((check & GF_EXCHECK)
1019 		    || ((check & GF_MARKDIR) && (check & GF_GLOBBED)))
1020 		{
1021 #define stat_check()	(stat_done ? stat_done : \
1022 			    (stat_done = stat(Xstring(*xs, xp), &statb) < 0 \
1023 				? -1 : 1))
1024 			struct stat lstatb, statb;
1025 			int stat_done = 0;	 /* -1: failed, 1 ok */
1026 
1027 			if (lstat(Xstring(*xs, xp), &lstatb) < 0)
1028 				return;
1029 			/* special case for systems which strip trailing
1030 			 * slashes from regular files (eg, /etc/passwd/).
1031 			 * SunOS 4.1.3 does this...
1032 			 */
1033 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp)
1034 			    && ISDIRSEP(xp[-1]) && !S_ISDIR(lstatb.st_mode)
1035 #ifdef S_ISLNK
1036 			    && (!S_ISLNK(lstatb.st_mode)
1037 				|| stat_check() < 0
1038 				|| !S_ISDIR(statb.st_mode))
1039 #endif /* S_ISLNK */
1040 				)
1041 				return;
1042 			/* Possibly tack on a trailing / if there isn't already
1043 			 * one and if the file is a directory or a symlink to a
1044 			 * directory
1045 			 */
1046 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED))
1047 			    && xp > Xstring(*xs, xp) && !ISDIRSEP(xp[-1])
1048 			    && (S_ISDIR(lstatb.st_mode)
1049 #ifdef S_ISLNK
1050 				|| (S_ISLNK(lstatb.st_mode)
1051 				    && stat_check() > 0
1052 				    && S_ISDIR(statb.st_mode))
1053 #endif /* S_ISLNK */
1054 				    ))
1055 			{
1056 				*xp++ = DIRSEP;
1057 				*xp = '\0';
1058 			}
1059 		}
1060 # define KLUDGE_VAL	0
1061 		XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp)
1062 			+ KLUDGE_VAL, ATEMP));
1063 		return;
1064 	}
1065 
1066 	if (xp > Xstring(*xs, xp))
1067 		*xp++ = DIRSEP;
1068 	while (ISDIRSEP(*sp)) {
1069 		Xcheck(*xs, xp);
1070 		*xp++ = *sp++;
1071 	}
1072 	np = ksh_strchr_dirsep(sp);
1073 	if (np != NULL) {
1074 		se = np;
1075 		odirsep = *np;	/* don't assume DIRSEP, can be multiple kinds */
1076 		*np++ = '\0';
1077 	} else {
1078 		odirsep = '\0'; /* keep gcc quiet */
1079 		se = sp + strlen(sp);
1080 	}
1081 
1082 
1083 	/* Check if sp needs globbing - done to avoid pattern checks for strings
1084 	 * containing MAGIC characters, open ['s without the matching close ],
1085 	 * etc. (otherwise opendir() will be called which may fail because the
1086 	 * directory isn't readable - if no globbing is needed, only execute
1087 	 * permission should be required (as per POSIX)).
1088 	 */
1089 	if (!has_globbing(sp, se)) {
1090 		XcheckN(*xs, xp, se - sp + 1);
1091 		debunk(xp, sp, Xnleft(*xs, xp));
1092 		xp += strlen(xp);
1093 		*xpp = xp;
1094 		globit(xs, xpp, np, wp, check);
1095 	} else {
1096 		DIR *dirp;
1097 		struct dirent *d;
1098 		char *name;
1099 		int len;
1100 		int prefix_len;
1101 
1102 		/* xp = *xpp;	   copy_non_glob() may have re-alloc'd xs */
1103 		*xp = '\0';
1104 		prefix_len = Xlength(*xs, xp);
1105 		dirp = ksh_opendir(prefix_len ? Xstring(*xs, xp) : ".");
1106 		if (dirp == NULL)
1107 			goto Nodir;
1108 		while ((d = readdir(dirp)) != NULL) {
1109 			name = d->d_name;
1110 			if ((*name == '.' && *sp != '.')
1111 			    || !gmatch(name, sp, true))
1112 				continue;
1113 
1114 			len = NLENGTH(d) + 1;
1115 			XcheckN(*xs, xp, len);
1116 			memcpy(xp, name, len);
1117 			*xpp = xp + len - 1;
1118 			globit(xs, xpp, np, wp,
1119 				(check & GF_MARKDIR) | GF_GLOBBED
1120 				| (np ? GF_EXCHECK : GF_NONE));
1121 			xp = Xstring(*xs, xp) + prefix_len;
1122 		}
1123 		closedir(dirp);
1124 	  Nodir:;
1125 	}
1126 
1127 	if (np != NULL)
1128 		*--np = odirsep;
1129 }
1130 
1131 #if 0
1132 /* Check if p contains something that needs globbing; if it does, 0 is
1133  * returned; if not, p is copied into xs/xp after stripping any MAGICs
1134  */
1135 static int	copy_non_glob ARGS((XString *xs, char **xpp, char *p));
1136 static int
1137 copy_non_glob(xs, xpp, p)
1138 	XString *xs;
1139 	char **xpp;
1140 	char *p;
1141 {
1142 	char *xp;
1143 	int len = strlen(p);
1144 
1145 	XcheckN(*xs, *xpp, len);
1146 	xp = *xpp;
1147 	for (; *p; p++) {
1148 		if (ISMAGIC(*p)) {
1149 			int c = *++p;
1150 
1151 			if (c == '*' || c == '?')
1152 				return 0;
1153 			if (*p == '[') {
1154 				char *q = p + 1;
1155 
1156 				if (ISMAGIC(*q) && q[1] == NOT)
1157 					q += 2;
1158 				if (ISMAGIC(*q) && q[1] == ']')
1159 					q += 2;
1160 				for (; *q; q++)
1161 					if (ISMAGIC(*q) && *++q == ']')
1162 						return 0;
1163 				/* pass a literal [ through */
1164 			}
1165 			/* must be a MAGIC-MAGIC, or MAGIC-!, MAGIC--, etc. */
1166 		}
1167 		*xp++ = *p;
1168 	}
1169 	*xp = '\0';
1170 	*xpp = xp;
1171 	return 1;
1172 }
1173 #endif /* 0 */
1174 
1175 /* remove MAGIC from string */
1176 char *
debunk(dp,sp,dlen)1177 debunk(dp, sp, dlen)
1178 	char *dp;
1179 	const char *sp;
1180 	size_t dlen;
1181 {
1182 	char *d, *s;
1183 
1184 	if ((s = strchr(sp, MAGIC))) {
1185 		if (s - sp >= (ptrdiff_t)dlen)
1186 			return dp;
1187 		memcpy(dp, sp, s - sp);
1188 		for (d = dp + (s - sp); *s && (d - dp < (ptrdiff_t)dlen); s++)
1189 			if (!ISMAGIC(*s) || !(*++s & 0x80)
1190 			    || !strchr("*+?@! ", *s & 0x7f))
1191 				*d++ = *s;
1192 			else {
1193 				/* extended pattern operators: *+?@! */
1194 				if ((*s & 0x7f) != ' ')
1195 					*d++ = *s & 0x7f;
1196 				if (d - dp < (ptrdiff_t)dlen)
1197 					*d++ = '(';
1198 			}
1199 		*d = '\0';
1200 	} else if (dp != sp)
1201 		strlcpy(dp, sp, dlen);
1202 	return dp;
1203 }
1204 
1205 /* Check if p is an unquoted name, possibly followed by a / or :.  If so
1206  * puts the expanded version in *dcp,dp and returns a pointer in p just
1207  * past the name, otherwise returns 0.
1208  */
1209 static char *
maybe_expand_tilde(p,dsp,dpp,isassign)1210 maybe_expand_tilde(p, dsp, dpp, isassign)
1211 	char *p;
1212 	XString *dsp;
1213 	char **dpp;
1214 	int isassign;
1215 {
1216 	XString ts;
1217 	char *dp = *dpp;
1218 	char *tp, *r;
1219 
1220 	Xinit(ts, tp, 16, ATEMP);
1221 	/* : only for DOASNTILDE form */
1222 	while (p[0] == CHAR && !ISDIRSEP(p[1])
1223 	       && (!isassign || p[1] != PATHSEP))
1224 	{
1225 		Xcheck(ts, tp);
1226 		*tp++ = p[1];
1227 		p += 2;
1228 	}
1229 	*tp = '\0';
1230 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ? tilde(Xstring(ts, tp)) : (char *) 0;
1231 	Xfree(ts, tp);
1232 	if (r) {
1233 		while (*r) {
1234 			Xcheck(*dsp, dp);
1235 			if (ISMAGIC(*r))
1236 				*dp++ = MAGIC;
1237 			*dp++ = *r++;
1238 		}
1239 		*dpp = dp;
1240 		r = p;
1241 	}
1242 	return r;
1243 }
1244 
1245 /*
1246  * tilde expansion
1247  *
1248  * based on a version by Arnold Robbins
1249  */
1250 
1251 static char *
tilde(cp)1252 tilde(cp)
1253 	char *cp;
1254 {
1255 	char *dp;
1256 
1257 	if (cp[0] == '\0')
1258 		dp = str_val(global("HOME"));
1259 	else if (cp[0] == '+' && cp[1] == '\0')
1260 		dp = str_val(global("PWD"));
1261 	else if (cp[0] == '-' && cp[1] == '\0')
1262 		dp = str_val(global("OLDPWD"));
1263 	else
1264 		dp = homedir(cp);
1265 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
1266 	if (dp == null)
1267 		dp = (char *) 0;
1268 	return dp;
1269 }
1270 
1271 /*
1272  * map userid to user's home directory.
1273  * note that 4.3's getpw adds more than 6K to the shell,
1274  * and the YP version probably adds much more.
1275  * we might consider our own version of getpwnam() to keep the size down.
1276  */
1277 
1278 static char *
homedir(name)1279 homedir(name)
1280 	char *name;
1281 {
1282 	struct tbl *ap;
1283 
1284 	ap = tenter(&homedirs, name, hash(name));
1285 	if (!(ap->flag & ISSET)) {
1286 		struct passwd *pw;
1287 		size_t n;
1288 
1289 		pw = getpwnam(name);
1290 		if (pw == NULL)
1291 			return NULL;
1292 		n = strlen(pw->pw_dir);
1293 		if (n > 0 && '/' != pw->pw_dir[n - 1]) {
1294 			ap->val.s = str_nsave(pw->pw_dir, n + 1, APERM);
1295 			ap->val.s[n] = '/';
1296 			ap->val.s[n + 1] = '\0';
1297 		} else {
1298 			ap->val.s = str_save(pw->pw_dir, APERM);
1299 		}
1300 		ap->flag |= DEFINED|ISSET|ALLOC;
1301 	}
1302 	return ap->val.s;
1303 }
1304 
1305 #ifdef BRACE_EXPAND
1306 static void
alt_expand(wp,start,exp_start,end,fdo)1307 alt_expand(wp, start, exp_start, end, fdo)
1308 	XPtrV *wp;
1309 	char *start, *exp_start;
1310 	char *end;
1311 	int fdo;
1312 {
1313 	int UNINITIALIZED(count);
1314 	char *brace_start, *brace_end, *UNINITIALIZED(comma);
1315 	char *field_start;
1316 	char *p;
1317 
1318 	/* search for open brace */
1319 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != OBRACE; p += 2)
1320 		;
1321 	brace_start = p;
1322 
1323 	/* find matching close brace, if any */
1324 	if (p) {
1325 		comma = (char *) 0;
1326 		count = 1;
1327 		for (p += 2; *p && count; p++) {
1328 			if (ISMAGIC(*p)) {
1329 				if (*++p == OBRACE)
1330 					count++;
1331 				else if (*p == CBRACE)
1332 					--count;
1333 				else if (*p == ',' && count == 1)
1334 					comma = p;
1335 			}
1336 		}
1337 	}
1338 	/* no valid expansions... */
1339 	if (!p || count != 0) {
1340 		/* Note that given a{{b,c} we do not expand anything (this is
1341 		 * what at&t ksh does.  This may be changed to do the {b,c}
1342 		 * expansion. }
1343 		 */
1344 		if (fdo & DOGLOB)
1345 			ksh_glob(start, wp, fdo & DOMARKDIRS);
1346 		else
1347 			XPput(*wp, debunk(start, start, end - start));
1348 		return;
1349 	}
1350 	brace_end = p;
1351 	if (!comma) {
1352 		alt_expand(wp, start, brace_end, end, fdo);
1353 		return;
1354 	}
1355 
1356 	/* expand expression */
1357 	field_start = brace_start + 2;
1358 	count = 1;
1359 	for (p = brace_start + 2; p != brace_end; p++) {
1360 		if (ISMAGIC(*p)) {
1361 			if (*++p == OBRACE)
1362 				count++;
1363 			else if ((*p == CBRACE && --count == 0)
1364 				 || (*p == ',' && count == 1))
1365 			{
1366 				char *new;
1367 				int l1, l2, l3;
1368 
1369 				l1 = brace_start - start;
1370 				l2 = (p - 1) - field_start;
1371 				l3 = end - brace_end;
1372 				new = (char *) alloc(l1 + l2 + l3 + 1, ATEMP);
1373 				memcpy(new, start, l1);
1374 				memcpy(new + l1, field_start, l2);
1375 				memcpy(new + l1 + l2, brace_end, l3);
1376 				new[l1 + l2 + l3] = '\0';
1377 				alt_expand(wp, new, new + l1,
1378 					   new + l1 + l2 + l3, fdo);
1379 				field_start = p + 1;
1380 			}
1381 		}
1382 	}
1383 	return;
1384 }
1385 #endif /* BRACE_EXPAND */
1386