Home | History | Annotate | Download | only in src
      1 /*	$OpenBSD: eval.c,v 1.39 2013/07/01 17:25:27 jca Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
      5  *		 2011, 2012, 2013
      6  *	Thorsten Glaser <tg (at) mirbsd.org>
      7  *
      8  * Provided that these terms and disclaimer and all copyright notices
      9  * are retained or reproduced in an accompanying document, permission
     10  * is granted to deal in this work without restriction, including un-
     11  * limited rights to use, publicly perform, distribute, sell, modify,
     12  * merge, give away, or sublicence.
     13  *
     14  * This work is provided "AS IS" and WITHOUT WARRANTY of any kind, to
     15  * the utmost extent permitted by applicable law, neither express nor
     16  * implied; without malicious intent or gross negligence. In no event
     17  * may a licensor, author or contributor be held liable for indirect,
     18  * direct, other damage, loss, or other issues arising in any way out
     19  * of dealing in the work, even if advised of the possibility of such
     20  * damage or existence of a defect, except proven that it results out
     21  * of said person's immediate fault when using the work as intended.
     22  */
     23 
     24 #include "sh.h"
     25 
     26 __RCSID("$MirOS: src/bin/mksh/eval.c,v 1.142 2013/07/24 18:03:57 tg Exp $");
     27 
     28 /*
     29  * string expansion
     30  *
     31  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
     32  * second pass: alternation ({,}), filename expansion (*?[]).
     33  */
     34 
     35 /* expansion generator state */
     36 typedef struct {
     37 	/* not including an "int type;" member, see expand() */
     38 	/* string */
     39 	const char *str;
     40 	/* source */
     41 	union {
     42 		/* string[] */
     43 		const char **strv;
     44 		/* file */
     45 		struct shf *shf;
     46 	} u;
     47 	/* variable in ${var...} */
     48 	struct tbl *var;
     49 	/* split "$@" / call waitlast in $() */
     50 	bool split;
     51 } Expand;
     52 
     53 #define	XBASE		0	/* scanning original */
     54 #define	XSUB		1	/* expanding ${} string */
     55 #define	XARGSEP		2	/* ifs0 between "$*" */
     56 #define	XARG		3	/* expanding $*, $@ */
     57 #define	XCOM		4	/* expanding $() */
     58 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
     59 #define XSUBMID		6	/* middle of expanding ${} */
     60 
     61 /* States used for field splitting */
     62 #define IFS_WORD	0	/* word has chars (or quotes) */
     63 #define IFS_WS		1	/* have seen IFS white-space */
     64 #define IFS_NWS		2	/* have seen IFS non-white-space */
     65 
     66 static int varsub(Expand *, const char *, const char *, int *, int *);
     67 static int comsub(Expand *, const char *, int);
     68 static char *valsub(struct op *, Area *);
     69 static char *trimsub(char *, char *, int);
     70 static void glob(char *, XPtrV *, bool);
     71 static void globit(XString *, char **, char *, XPtrV *, int);
     72 static const char *maybe_expand_tilde(const char *, XString *, char **, int);
     73 #ifndef MKSH_NOPWNAM
     74 static char *homedir(char *);
     75 #endif
     76 static void alt_expand(XPtrV *, char *, char *, char *, int);
     77 static int utflen(const char *);
     78 static void utfincptr(const char *, mksh_ari_t *);
     79 
     80 /* UTFMODE functions */
     81 static int
     82 utflen(const char *s)
     83 {
     84 	size_t n;
     85 
     86 	if (UTFMODE) {
     87 		n = 0;
     88 		while (*s) {
     89 			s += utf_ptradj(s);
     90 			++n;
     91 		}
     92 	} else
     93 		n = strlen(s);
     94 
     95 	if (n > 2147483647)
     96 		n = 2147483647;
     97 	return ((int)n);
     98 }
     99 
    100 static void
    101 utfincptr(const char *s, mksh_ari_t *lp)
    102 {
    103 	const char *cp = s;
    104 
    105 	while ((*lp)--)
    106 		cp += utf_ptradj(cp);
    107 	*lp = cp - s;
    108 }
    109 
    110 /* compile and expand word */
    111 char *
    112 substitute(const char *cp, int f)
    113 {
    114 	struct source *s, *sold;
    115 
    116 	sold = source;
    117 	s = pushs(SWSTR, ATEMP);
    118 	s->start = s->str = cp;
    119 	source = s;
    120 	if (yylex(ONEWORD) != LWORD)
    121 		internal_errorf("bad substitution");
    122 	source = sold;
    123 	afree(s, ATEMP);
    124 	return (evalstr(yylval.cp, f));
    125 }
    126 
    127 /*
    128  * expand arg-list
    129  */
    130 char **
    131 eval(const char **ap, int f)
    132 {
    133 	XPtrV w;
    134 
    135 	if (*ap == NULL) {
    136 		union mksh_ccphack vap;
    137 
    138 		vap.ro = ap;
    139 		return (vap.rw);
    140 	}
    141 	XPinit(w, 32);
    142 	/* space for shell name */
    143 	XPput(w, NULL);
    144 	while (*ap != NULL)
    145 		expand(*ap++, &w, f);
    146 	XPput(w, NULL);
    147 	return ((char **)XPclose(w) + 1);
    148 }
    149 
    150 /*
    151  * expand string
    152  */
    153 char *
    154 evalstr(const char *cp, int f)
    155 {
    156 	XPtrV w;
    157 	char *dp = null;
    158 
    159 	XPinit(w, 1);
    160 	expand(cp, &w, f);
    161 	if (XPsize(w))
    162 		dp = *XPptrv(w);
    163 	XPfree(w);
    164 	return (dp);
    165 }
    166 
    167 /*
    168  * expand string - return only one component
    169  * used from iosetup to expand redirection files
    170  */
    171 char *
    172 evalonestr(const char *cp, int f)
    173 {
    174 	XPtrV w;
    175 	char *rv;
    176 
    177 	XPinit(w, 1);
    178 	expand(cp, &w, f);
    179 	switch (XPsize(w)) {
    180 	case 0:
    181 		rv = null;
    182 		break;
    183 	case 1:
    184 		rv = (char *) *XPptrv(w);
    185 		break;
    186 	default:
    187 		rv = evalstr(cp, f&~DOGLOB);
    188 		break;
    189 	}
    190 	XPfree(w);
    191 	return (rv);
    192 }
    193 
    194 /* for nested substitution: ${var:=$var2} */
    195 typedef struct SubType {
    196 	struct tbl *var;	/* variable for ${var..} */
    197 	struct SubType *prev;	/* old type */
    198 	struct SubType *next;	/* poped type (to avoid re-allocating) */
    199 	size_t	base;		/* begin position of expanded word */
    200 	short	stype;		/* [=+-?%#] action after expanded word */
    201 	short	f;		/* saved value of f (DOPAT, etc) */
    202 	uint8_t	quotep;		/* saved value of quote (for ${..[%#]..}) */
    203 	uint8_t	quotew;		/* saved value of quote (for ${..[+-=]..}) */
    204 } SubType;
    205 
    206 void
    207 expand(
    208     /* input word */
    209     const char *ccp,
    210     /* output words */
    211     XPtrV *wp,
    212     /* DO* flags */
    213     int f)
    214 {
    215 	int c = 0;
    216 	/* expansion type */
    217 	int type;
    218 	/* quoted */
    219 	int quote = 0;
    220 	/* destination string and live pointer */
    221 	XString ds;
    222 	char *dp;
    223 	/* source */
    224 	const char *sp;
    225 	/* second pass flags */
    226 	int fdo;
    227 	/* have word */
    228 	int word;
    229 	/* field splitting of parameter/command substitution */
    230 	int doblank;
    231 	/* expansion variables */
    232 	Expand x = {
    233 		NULL, { NULL }, NULL, 0
    234 	};
    235 	SubType st_head, *st;
    236 	/* record number of trailing newlines in COMSUB */
    237 	int newlines = 0;
    238 	bool saw_eq, make_magic;
    239 	int tilde_ok;
    240 	size_t len;
    241 	char *cp;
    242 
    243 	if (ccp == NULL)
    244 		internal_errorf("expand(NULL)");
    245 	/* for alias, readonly, set, typeset commands */
    246 	if ((f & DOVACHECK) && is_wdvarassign(ccp)) {
    247 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
    248 		f |= DOASNTILDE;
    249 	}
    250 	if (Flag(FNOGLOB))
    251 		f &= ~DOGLOB;
    252 	if (Flag(FMARKDIRS))
    253 		f |= DOMARKDIRS;
    254 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
    255 		f |= DOBRACE;
    256 
    257 	/* init destination string */
    258 	Xinit(ds, dp, 128, ATEMP);
    259 	type = XBASE;
    260 	sp = ccp;
    261 	fdo = 0;
    262 	saw_eq = false;
    263 	/* must be 1/0 */
    264 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
    265 	doblank = 0;
    266 	make_magic = false;
    267 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
    268 	/* clang doesn't know OSUBST comes before CSUBST */
    269 	memset(&st_head, 0, sizeof(st_head));
    270 	st = &st_head;
    271 
    272 	while (/* CONSTCOND */ 1) {
    273 		Xcheck(ds, dp);
    274 
    275 		switch (type) {
    276 		case XBASE:
    277 			/* original prefixed string */
    278 			c = *sp++;
    279 			switch (c) {
    280 			case EOS:
    281 				c = 0;
    282 				break;
    283 			case CHAR:
    284 				c = *sp++;
    285 				break;
    286 			case QCHAR:
    287 				/* temporary quote */
    288 				quote |= 2;
    289 				c = *sp++;
    290 				break;
    291 			case OQUOTE:
    292 				word = IFS_WORD;
    293 				tilde_ok = 0;
    294 				quote = 1;
    295 				continue;
    296 			case CQUOTE:
    297 				quote = st->quotew;
    298 				continue;
    299 			case COMSUB:
    300 			case FUNSUB:
    301 			case VALSUB:
    302 				tilde_ok = 0;
    303 				if (f & DONTRUNCOMMAND) {
    304 					word = IFS_WORD;
    305 					*dp++ = '$';
    306 					*dp++ = c == COMSUB ? '(' : '{';
    307 					if (c != COMSUB)
    308 						*dp++ = c == FUNSUB ? ' ' : '|';
    309 					while (*sp != '\0') {
    310 						Xcheck(ds, dp);
    311 						*dp++ = *sp++;
    312 					}
    313 					if (c != COMSUB) {
    314 						*dp++ = ';';
    315 						*dp++ = '}';
    316 					} else
    317 						*dp++ = ')';
    318 				} else {
    319 					type = comsub(&x, sp, c);
    320 					if (type != XBASE && (f & DOBLANK))
    321 						doblank++;
    322 					sp = strnul(sp) + 1;
    323 					newlines = 0;
    324 				}
    325 				continue;
    326 			case EXPRSUB:
    327 				word = IFS_WORD;
    328 				tilde_ok = 0;
    329 				if (f & DONTRUNCOMMAND) {
    330 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
    331 					while (*sp != '\0') {
    332 						Xcheck(ds, dp);
    333 						*dp++ = *sp++;
    334 					}
    335 					*dp++ = ')'; *dp++ = ')';
    336 				} else {
    337 					struct tbl v;
    338 
    339 					v.flag = DEFINED|ISSET|INTEGER;
    340 					/* not default */
    341 					v.type = 10;
    342 					v.name[0] = '\0';
    343 					v_evaluate(&v, substitute(sp, 0),
    344 					    KSH_UNWIND_ERROR, true);
    345 					sp = strnul(sp) + 1;
    346 					cp = str_val(&v);
    347 					while (*cp) {
    348 						Xcheck(ds, dp);
    349 						*dp++ = *cp++;
    350 					}
    351 				}
    352 				continue;
    353 			case OSUBST: {
    354 				/* ${{#}var{:}[=+-?#%]word} */
    355 			/*-
    356 			 * format is:
    357 			 *	OSUBST [{x] plain-variable-part \0
    358 			 *	    compiled-word-part CSUBST [}x]
    359 			 * This is where all syntax checking gets done...
    360 			 */
    361 				/* skip the { or x (}) */
    362 				const char *varname = ++sp;
    363 				int stype;
    364 				int slen = 0;
    365 
    366 				/* skip variable */
    367 				sp = cstrchr(sp, '\0') + 1;
    368 				type = varsub(&x, varname, sp, &stype, &slen);
    369 				if (type < 0) {
    370 					char *beg, *end, *str;
    371  unwind_substsyn:
    372 					/* restore sp */
    373 					sp = varname - 2;
    374 					end = (beg = wdcopy(sp, ATEMP)) +
    375 					    (wdscan(sp, CSUBST) - sp);
    376 					/* ({) the } or x is already skipped */
    377 					if (end < wdscan(beg, EOS))
    378 						*end = EOS;
    379 					str = snptreef(NULL, 64, "%S", beg);
    380 					afree(beg, ATEMP);
    381 					errorf("%s: %s", str, "bad substitution");
    382 				}
    383 				if (f & DOBLANK)
    384 					doblank++;
    385 				tilde_ok = 0;
    386 				if (type == XBASE) {
    387 					/* expand? */
    388 					if (!st->next) {
    389 						SubType *newst;
    390 
    391 						newst = alloc(sizeof(SubType), ATEMP);
    392 						newst->next = NULL;
    393 						newst->prev = st;
    394 						st->next = newst;
    395 					}
    396 					st = st->next;
    397 					st->stype = stype;
    398 					st->base = Xsavepos(ds, dp);
    399 					st->f = f;
    400 					if (x.var == &vtemp) {
    401 						st->var = tempvar();
    402 						st->var->flag &= ~INTEGER;
    403 						/* can't fail here */
    404 						setstr(st->var,
    405 						    str_val(x.var),
    406 						    KSH_RETURN_ERROR | 0x4);
    407 					} else
    408 						st->var = x.var;
    409 
    410 					st->quotew = st->quotep = quote;
    411 					/* skip qualifier(s) */
    412 					if (stype)
    413 						sp += slen;
    414 					switch (stype & 0x17F) {
    415 					case 0x100 | '#': {
    416 						char *beg, *end;
    417 						mksh_ari_t seed;
    418 						register uint32_t h;
    419 
    420 						beg = wdcopy(sp, ATEMP);
    421 						end = beg + (wdscan(sp, CSUBST) - sp);
    422 						end[-2] = EOS;
    423 						end = wdstrip(beg, 0);
    424 						afree(beg, ATEMP);
    425 						evaluate(substitute(end, 0),
    426 						    &seed, KSH_UNWIND_ERROR, true);
    427 						/* hash with seed, for now */
    428 						h = seed;
    429 						NZATUpdateString(h,
    430 						    str_val(st->var));
    431 						NZAATFinish(h);
    432 						x.str = shf_smprintf("%08X",
    433 						    (unsigned int)h);
    434 						break;
    435 					}
    436 					case 0x100 | 'Q': {
    437 						struct shf shf;
    438 
    439 						shf_sopen(NULL, 0, SHF_WR|SHF_DYNAMIC, &shf);
    440 						print_value_quoted(&shf, str_val(st->var));
    441 						x.str = shf_sclose(&shf);
    442 						break;
    443 					}
    444 					case '0': {
    445 						char *beg, *mid, *end, *stg;
    446 						mksh_ari_t from = 0, num = -1, flen, finc = 0;
    447 
    448 						beg = wdcopy(sp, ATEMP);
    449 						mid = beg + (wdscan(sp, ADELIM) - sp);
    450 						stg = beg + (wdscan(sp, CSUBST) - sp);
    451 						if (mid >= stg)
    452 							goto unwind_substsyn;
    453 						mid[-2] = EOS;
    454 						if (mid[-1] == /*{*/'}') {
    455 							sp += mid - beg - 1;
    456 							end = NULL;
    457 						} else {
    458 							end = mid +
    459 							    (wdscan(mid, ADELIM) - mid);
    460 							if (end >= stg ||
    461 							    /* more than max delimiters */
    462 							    end[-1] != /*{*/ '}')
    463 								goto unwind_substsyn;
    464 							end[-2] = EOS;
    465 							sp += end - beg - 1;
    466 						}
    467 						evaluate(substitute(stg = wdstrip(beg, 0), 0),
    468 						    &from, KSH_UNWIND_ERROR, true);
    469 						afree(stg, ATEMP);
    470 						if (end) {
    471 							evaluate(substitute(stg = wdstrip(mid, 0), 0),
    472 							    &num, KSH_UNWIND_ERROR, true);
    473 							afree(stg, ATEMP);
    474 						}
    475 						afree(beg, ATEMP);
    476 						beg = str_val(st->var);
    477 						flen = utflen(beg);
    478 						if (from < 0) {
    479 							if (-from < flen)
    480 								finc = flen + from;
    481 						} else
    482 							finc = from < flen ? from : flen;
    483 						if (UTFMODE)
    484 							utfincptr(beg, &finc);
    485 						beg += finc;
    486 						flen = utflen(beg);
    487 						if (num < 0 || num > flen)
    488 							num = flen;
    489 						if (UTFMODE)
    490 							utfincptr(beg, &num);
    491 						strndupx(x.str, beg, num, ATEMP);
    492 						goto do_CSUBST;
    493 					}
    494 					case '/': {
    495 						char *s, *p, *d, *sbeg, *end;
    496 						char *pat, *rrep;
    497 						char *tpat0, *tpat1, *tpat2;
    498 
    499 						s = wdcopy(sp, ATEMP);
    500 						p = s + (wdscan(sp, ADELIM) - sp);
    501 						d = s + (wdscan(sp, CSUBST) - sp);
    502 						if (p >= d)
    503 							goto unwind_substsyn;
    504 						p[-2] = EOS;
    505 						if (p[-1] == /*{*/'}')
    506 							d = NULL;
    507 						else
    508 							d[-2] = EOS;
    509 						sp += (d ? d : p) - s - 1;
    510 						tpat0 = wdstrip(s,
    511 						    WDS_KEEPQ | WDS_MAGIC);
    512 						pat = substitute(tpat0, 0);
    513 						if (d) {
    514 							d = wdstrip(p, WDS_KEEPQ);
    515 							rrep = substitute(d, 0);
    516 							afree(d, ATEMP);
    517 						} else
    518 							rrep = null;
    519 						afree(s, ATEMP);
    520 						s = d = pat;
    521 						while (*s)
    522 							if (*s != '\\' ||
    523 							    s[1] == '%' ||
    524 							    s[1] == '#' ||
    525 							    s[1] == '\0' ||
    526 				/* XXX really? */	    s[1] == '\\' ||
    527 							    s[1] == '/')
    528 								*d++ = *s++;
    529 							else
    530 								s++;
    531 						*d = '\0';
    532 						afree(tpat0, ATEMP);
    533 
    534 						/* check for special cases */
    535 						d = str_val(st->var);
    536 						mkssert(d != NULL);
    537 						switch (*pat) {
    538 						case '#':
    539 							/* anchor at begin */
    540 							tpat0 = pat + 1;
    541 							tpat1 = rrep;
    542 							tpat2 = d;
    543 							break;
    544 						case '%':
    545 							/* anchor at end */
    546 							tpat0 = pat + 1;
    547 							tpat1 = d;
    548 							tpat2 = rrep;
    549 							break;
    550 						case '\0':
    551 							/* empty pattern */
    552 							goto no_repl;
    553 						default:
    554 							tpat0 = pat;
    555 							/* silence gcc */
    556 							tpat1 = tpat2 = NULL;
    557 						}
    558 						if (gmatchx(null, tpat0, false)) {
    559 							/*
    560 							 * pattern matches
    561 							 * the empty string
    562 							 */
    563 							if (tpat0 == pat)
    564 								goto no_repl;
    565 							/* but is anchored */
    566 							s = shf_smprintf("%s%s",
    567 							    tpat1, tpat2);
    568 							goto do_repl;
    569 						}
    570 
    571 						/* prepare string on which to work */
    572 						strdupx(s, d, ATEMP);
    573 						sbeg = s;
    574 
    575 						/* first see if we have any match at all */
    576 						tpat0 = pat;
    577 						if (*pat == '#') {
    578 							/* anchor at the beginning */
    579 							tpat1 = shf_smprintf("%s%c*", ++tpat0, MAGIC);
    580 							tpat2 = tpat1;
    581 						} else if (*pat == '%') {
    582 							/* anchor at the end */
    583 							tpat1 = shf_smprintf("%c*%s", MAGIC, ++tpat0);
    584 							tpat2 = tpat0;
    585 						} else {
    586 							/* float */
    587 							tpat1 = shf_smprintf("%c*%s%c*", MAGIC, pat, MAGIC);
    588 							tpat2 = tpat1 + 2;
    589 						}
    590  again_repl:
    591 						/*
    592 						 * this would not be necessary if gmatchx would return
    593 						 * the start and end values of a match found, like re*
    594 						 */
    595 						if (!gmatchx(sbeg, tpat1, false))
    596 							goto end_repl;
    597 						end = strnul(s);
    598 						/* now anchor the beginning of the match */
    599 						if (*pat != '#')
    600 							while (sbeg <= end) {
    601 								if (gmatchx(sbeg, tpat2, false))
    602 									break;
    603 								else
    604 									sbeg++;
    605 							}
    606 						/* now anchor the end of the match */
    607 						p = end;
    608 						if (*pat != '%')
    609 							while (p >= sbeg) {
    610 								bool gotmatch;
    611 
    612 								c = *p;
    613 								*p = '\0';
    614 								gotmatch = tobool(gmatchx(sbeg, tpat0, false));
    615 								*p = c;
    616 								if (gotmatch)
    617 									break;
    618 								p--;
    619 							}
    620 						strndupx(end, s, sbeg - s, ATEMP);
    621 						d = shf_smprintf("%s%s%s", end, rrep, p);
    622 						afree(end, ATEMP);
    623 						sbeg = d + (sbeg - s) + strlen(rrep);
    624 						afree(s, ATEMP);
    625 						s = d;
    626 						if (stype & 0x80)
    627 							goto again_repl;
    628  end_repl:
    629 						afree(tpat1, ATEMP);
    630  do_repl:
    631 						x.str = s;
    632  no_repl:
    633 						afree(pat, ATEMP);
    634 						if (rrep != null)
    635 							afree(rrep, ATEMP);
    636 						goto do_CSUBST;
    637 					}
    638 					case '#':
    639 					case '%':
    640 						/* ! DOBLANK,DOBRACE,DOTILDE */
    641 						f = (f & DONTRUNCOMMAND) |
    642 						    DOPAT | DOTEMP;
    643 						st->quotew = quote = 0;
    644 						/*
    645 						 * Prepend open pattern (so |
    646 						 * in a trim will work as
    647 						 * expected)
    648 						 */
    649 						if (!Flag(FSH)) {
    650 							*dp++ = MAGIC;
    651 							*dp++ = '@' | 0x80;
    652 						}
    653 						break;
    654 					case '=':
    655 						/*
    656 						 * Enabling tilde expansion
    657 						 * after :s here is
    658 						 * non-standard ksh, but is
    659 						 * consistent with rules for
    660 						 * other assignments. Not
    661 						 * sure what POSIX thinks of
    662 						 * this.
    663 						 * Not doing tilde expansion
    664 						 * for integer variables is a
    665 						 * non-POSIX thing - makes
    666 						 * sense though, since ~ is
    667 						 * a arithmetic operator.
    668 						 */
    669 						if (!(x.var->flag & INTEGER))
    670 							f |= DOASNTILDE|DOTILDE;
    671 						f |= DOTEMP;
    672 						/*
    673 						 * These will be done after the
    674 						 * value has been assigned.
    675 						 */
    676 						f &= ~(DOBLANK|DOGLOB|DOBRACE);
    677 						tilde_ok = 1;
    678 						break;
    679 					case '?':
    680 						f &= ~DOBLANK;
    681 						f |= DOTEMP;
    682 						/* FALLTHROUGH */
    683 					default:
    684 						/* Enable tilde expansion */
    685 						tilde_ok = 1;
    686 						f |= DOTILDE;
    687 					}
    688 				} else
    689 					/* skip word */
    690 					sp += wdscan(sp, CSUBST) - sp;
    691 				continue;
    692 			}
    693 			case CSUBST:
    694 				/* only get here if expanding word */
    695  do_CSUBST:
    696 				/* ({) skip the } or x */
    697 				sp++;
    698 				/* in case of ${unset:-} */
    699 				tilde_ok = 0;
    700 				*dp = '\0';
    701 				quote = st->quotep;
    702 				f = st->f;
    703 				if (f&DOBLANK)
    704 					doblank--;
    705 				switch (st->stype & 0x17F) {
    706 				case '#':
    707 				case '%':
    708 					if (!Flag(FSH)) {
    709 						/* Append end-pattern */
    710 						*dp++ = MAGIC;
    711 						*dp++ = ')';
    712 					}
    713 					*dp = '\0';
    714 					dp = Xrestpos(ds, dp, st->base);
    715 					/*
    716 					 * Must use st->var since calling
    717 					 * global would break things
    718 					 * like x[i+=1].
    719 					 */
    720 					x.str = trimsub(str_val(st->var),
    721 						dp, st->stype);
    722 					if (x.str[0] != '\0' || st->quotep)
    723 						type = XSUB;
    724 					else
    725 						type = XNULLSUB;
    726 					if (f&DOBLANK)
    727 						doblank++;
    728 					st = st->prev;
    729 					continue;
    730 				case '=':
    731 					/*
    732 					 * Restore our position and substitute
    733 					 * the value of st->var (may not be
    734 					 * the assigned value in the presence
    735 					 * of integer/right-adj/etc attributes).
    736 					 */
    737 					dp = Xrestpos(ds, dp, st->base);
    738 					/*
    739 					 * Must use st->var since calling
    740 					 * global would cause with things
    741 					 * like x[i+=1] to be evaluated twice.
    742 					 */
    743 					/*
    744 					 * Note: not exported by FEXPORT
    745 					 * in AT&T ksh.
    746 					 */
    747 					/*
    748 					 * XXX POSIX says readonly is only
    749 					 * fatal for special builtins (setstr
    750 					 * does readonly check).
    751 					 */
    752 					len = strlen(dp) + 1;
    753 					setstr(st->var,
    754 					    debunk(alloc(len, ATEMP),
    755 					    dp, len), KSH_UNWIND_ERROR);
    756 					x.str = str_val(st->var);
    757 					type = XSUB;
    758 					if (f&DOBLANK)
    759 						doblank++;
    760 					st = st->prev;
    761 					continue;
    762 				case '?': {
    763 					char *s = Xrestpos(ds, dp, st->base);
    764 
    765 					errorf("%s: %s", st->var->name,
    766 					    dp == s ?
    767 					    "parameter null or not set" :
    768 					    (debunk(s, s, strlen(s) + 1), s));
    769 				}
    770 				case '0':
    771 				case '/':
    772 				case 0x100 | '#':
    773 				case 0x100 | 'Q':
    774 					dp = Xrestpos(ds, dp, st->base);
    775 					type = XSUB;
    776 					if (f&DOBLANK)
    777 						doblank++;
    778 					st = st->prev;
    779 					continue;
    780 				}
    781 				st = st->prev;
    782 				type = XBASE;
    783 				continue;
    784 
    785 			case OPAT:
    786 				/* open pattern: *(foo|bar) */
    787 				/* Next char is the type of pattern */
    788 				make_magic = true;
    789 				c = *sp++ | 0x80;
    790 				break;
    791 
    792 			case SPAT:
    793 				/* pattern separator (|) */
    794 				make_magic = true;
    795 				c = '|';
    796 				break;
    797 
    798 			case CPAT:
    799 				/* close pattern */
    800 				make_magic = true;
    801 				c = /*(*/ ')';
    802 				break;
    803 			}
    804 			break;
    805 
    806 		case XNULLSUB:
    807 			/*
    808 			 * Special case for "$@" (and "${foo[@]}") - no
    809 			 * word is generated if $# is 0 (unless there is
    810 			 * other stuff inside the quotes).
    811 			 */
    812 			type = XBASE;
    813 			if (f&DOBLANK) {
    814 				doblank--;
    815 				/*
    816 				 * not really correct: x=; "$x$@" should
    817 				 * generate a null argument and
    818 				 * set A; "${@:+}" shouldn't.
    819 				 */
    820 				if (dp == Xstring(ds, dp))
    821 					word = IFS_WS;
    822 			}
    823 			continue;
    824 
    825 		case XSUB:
    826 		case XSUBMID:
    827 			if ((c = *x.str++) == 0) {
    828 				type = XBASE;
    829 				if (f&DOBLANK)
    830 					doblank--;
    831 				continue;
    832 			}
    833 			break;
    834 
    835 		case XARGSEP:
    836 			type = XARG;
    837 			quote = 1;
    838 			/* FALLTHROUGH */
    839 		case XARG:
    840 			if ((c = *x.str++) == '\0') {
    841 				/*
    842 				 * force null words to be created so
    843 				 * set -- '' 2 ''; foo "$@" will do
    844 				 * the right thing
    845 				 */
    846 				if (quote && x.split)
    847 					word = IFS_WORD;
    848 				if ((x.str = *x.u.strv++) == NULL) {
    849 					type = XBASE;
    850 					if (f&DOBLANK)
    851 						doblank--;
    852 					continue;
    853 				}
    854 				c = ifs0;
    855 				if (c == 0) {
    856 					if (quote && !x.split)
    857 						continue;
    858 					/* this is so we don't terminate */
    859 					c = ' ';
    860 					/* now force-emit a word */
    861 					goto emit_word;
    862 				}
    863 				if (quote && x.split) {
    864 					/* terminate word for "$@" */
    865 					type = XARGSEP;
    866 					quote = 0;
    867 				}
    868 			}
    869 			break;
    870 
    871 		case XCOM:
    872 			if (x.u.shf == NULL) {
    873 				/* $(<...) failed */
    874 				subst_exstat = 1;
    875 				/* fake EOF */
    876 				c = EOF;
    877 			} else if (newlines) {
    878 				/* spit out saved NLs */
    879 				c = '\n';
    880 				--newlines;
    881 			} else {
    882 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
    883 					if (c == '\n')
    884 						/* save newlines */
    885 						newlines++;
    886 				if (newlines && c != EOF) {
    887 					shf_ungetc(c, x.u.shf);
    888 					c = '\n';
    889 					--newlines;
    890 				}
    891 			}
    892 			if (c == EOF) {
    893 				newlines = 0;
    894 				if (x.u.shf)
    895 					shf_close(x.u.shf);
    896 				if (x.split)
    897 					subst_exstat = waitlast();
    898 				type = XBASE;
    899 				if (f&DOBLANK)
    900 					doblank--;
    901 				continue;
    902 			}
    903 			break;
    904 		}
    905 
    906 		/* check for end of word or IFS separation */
    907 		if (c == 0 || (!quote && (f & DOBLANK) && doblank &&
    908 		    !make_magic && ctype(c, C_IFS))) {
    909 			/*-
    910 			 * How words are broken up:
    911 			 *			|	value of c
    912 			 *	word		|	ws	nws	0
    913 			 *	-----------------------------------
    914 			 *	IFS_WORD		w/WS	w/NWS	w
    915 			 *	IFS_WS			-/WS	w/NWS	-
    916 			 *	IFS_NWS			-/NWS	w/NWS	w
    917 			 * (w means generate a word)
    918 			 * Note that IFS_NWS/0 generates a word (AT&T ksh
    919 			 * doesn't do this, but POSIX does).
    920 			 */
    921 			if (word == IFS_WORD ||
    922 			    (!ctype(c, C_IFSWS) && c && word == IFS_NWS)) {
    923  emit_word:
    924 				*dp++ = '\0';
    925 				cp = Xclose(ds, dp);
    926 				if (fdo & DOBRACE)
    927 					/* also does globbing */
    928 					alt_expand(wp, cp, cp,
    929 					    cp + Xlength(ds, (dp - 1)),
    930 					    fdo | (f & DOMARKDIRS));
    931 				else if (fdo & DOGLOB)
    932 					glob(cp, wp, tobool(f & DOMARKDIRS));
    933 				else if ((f & DOPAT) || !(fdo & DOMAGIC))
    934 					XPput(*wp, cp);
    935 				else
    936 					XPput(*wp, debunk(cp, cp,
    937 					    strlen(cp) + 1));
    938 				fdo = 0;
    939 				saw_eq = false;
    940 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
    941 				if (c == 0)
    942 					return;
    943 				Xinit(ds, dp, 128, ATEMP);
    944 			} else if (c == 0) {
    945 				return;
    946 			} else if (type == XSUB && ctype(c, C_IFS) &&
    947 			    !ctype(c, C_IFSWS) && Xlength(ds, dp) == 0) {
    948 				*(cp = alloc(1, ATEMP)) = '\0';
    949 				XPput(*wp, cp);
    950 				type = XSUBMID;
    951 			}
    952 			if (word != IFS_NWS)
    953 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
    954 		} else {
    955 			if (type == XSUB) {
    956 				if (word == IFS_NWS &&
    957 				    Xlength(ds, dp) == 0) {
    958 					*(cp = alloc(1, ATEMP)) = '\0';
    959 					XPput(*wp, cp);
    960 				}
    961 				type = XSUBMID;
    962 			}
    963 
    964 			/* age tilde_ok info - ~ code tests second bit */
    965 			tilde_ok <<= 1;
    966 			/* mark any special second pass chars */
    967 			if (!quote)
    968 				switch (c) {
    969 				case '[':
    970 				case '!':
    971 				case '-':
    972 				case ']':
    973 					/*
    974 					 * For character classes - doesn't hurt
    975 					 * to have magic !,-,]s outside of
    976 					 * [...] expressions.
    977 					 */
    978 					if (f & (DOPAT | DOGLOB)) {
    979 						fdo |= DOMAGIC;
    980 						if (c == '[')
    981 							fdo |= f & DOGLOB;
    982 						*dp++ = MAGIC;
    983 					}
    984 					break;
    985 				case '*':
    986 				case '?':
    987 					if (f & (DOPAT | DOGLOB)) {
    988 						fdo |= DOMAGIC | (f & DOGLOB);
    989 						*dp++ = MAGIC;
    990 					}
    991 					break;
    992 				case '{':
    993 				case '}':
    994 				case ',':
    995 					if ((f & DOBRACE) && (c == '{' /*}*/ ||
    996 					    (fdo & DOBRACE))) {
    997 						fdo |= DOBRACE|DOMAGIC;
    998 						*dp++ = MAGIC;
    999 					}
   1000 					break;
   1001 				case '=':
   1002 					/* Note first unquoted = for ~ */
   1003 					if (!(f & DOTEMP) && !saw_eq &&
   1004 					    (Flag(FBRACEEXPAND) ||
   1005 					    (f & DOASNTILDE))) {
   1006 						saw_eq = true;
   1007 						tilde_ok = 1;
   1008 					}
   1009 					break;
   1010 				case ':':
   1011 					/* : */
   1012 					/* Note unquoted : for ~ */
   1013 					if (!(f & DOTEMP) && (f & DOASNTILDE))
   1014 						tilde_ok = 1;
   1015 					break;
   1016 				case '~':
   1017 					/*
   1018 					 * tilde_ok is reset whenever
   1019 					 * any of ' " $( $(( ${ } are seen.
   1020 					 * Note that tilde_ok must be preserved
   1021 					 * through the sequence ${A=a=}~
   1022 					 */
   1023 					if (type == XBASE &&
   1024 					    (f & (DOTILDE|DOASNTILDE)) &&
   1025 					    (tilde_ok & 2)) {
   1026 						const char *tcp;
   1027 						char *tdp = dp;
   1028 
   1029 						tcp = maybe_expand_tilde(sp,
   1030 						    &ds, &tdp,
   1031 						    f & DOASNTILDE);
   1032 						if (tcp) {
   1033 							if (dp != tdp)
   1034 								word = IFS_WORD;
   1035 							dp = tdp;
   1036 							sp = tcp;
   1037 							continue;
   1038 						}
   1039 					}
   1040 					break;
   1041 				}
   1042 			else
   1043 				/* undo temporary */
   1044 				quote &= ~2;
   1045 
   1046 			if (make_magic) {
   1047 				make_magic = false;
   1048 				fdo |= DOMAGIC | (f & DOGLOB);
   1049 				*dp++ = MAGIC;
   1050 			} else if (ISMAGIC(c)) {
   1051 				fdo |= DOMAGIC;
   1052 				*dp++ = MAGIC;
   1053 			}
   1054 			/* save output char */
   1055 			*dp++ = c;
   1056 			word = IFS_WORD;
   1057 		}
   1058 	}
   1059 }
   1060 
   1061 /*
   1062  * Prepare to generate the string returned by ${} substitution.
   1063  */
   1064 static int
   1065 varsub(Expand *xp, const char *sp, const char *word,
   1066     int *stypep,	/* becomes qualifier type */
   1067     int *slenp)		/* " " len (=, :=, etc.) valid iff *stypep != 0 */
   1068 {
   1069 	int c;
   1070 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
   1071 	int stype;	/* substitution type */
   1072 	int slen;
   1073 	const char *p;
   1074 	struct tbl *vp;
   1075 	bool zero_ok = false;
   1076 
   1077 	if ((stype = sp[0]) == '\0')
   1078 		/* Bad variable name */
   1079 		return (-1);
   1080 
   1081 	xp->var = NULL;
   1082 
   1083 	/*-
   1084 	 * ${#var}, string length (-U: characters, +U: octets) or array size
   1085 	 * ${%var}, string width (-U: screen columns, +U: octets)
   1086 	 */
   1087 	c = sp[1];
   1088 	if (stype == '%' && c == '\0')
   1089 		return (-1);
   1090 	if ((stype == '#' || stype == '%') && c != '\0') {
   1091 		/* Can't have any modifiers for ${#...} or ${%...} */
   1092 		if (*word != CSUBST)
   1093 			return (-1);
   1094 		sp++;
   1095 		/* Check for size of array */
   1096 		if ((p = cstrchr(sp, '[')) && (p[1] == '*' || p[1] == '@') &&
   1097 		    p[2] == ']') {
   1098 			int n = 0;
   1099 
   1100 			if (stype != '#')
   1101 				return (-1);
   1102 			vp = global(arrayname(sp));
   1103 			if (vp->flag & (ISSET|ARRAY))
   1104 				zero_ok = true;
   1105 			for (; vp; vp = vp->u.array)
   1106 				if (vp->flag & ISSET)
   1107 					n++;
   1108 			c = n;
   1109 		} else if (c == '*' || c == '@') {
   1110 			if (stype != '#')
   1111 				return (-1);
   1112 			c = e->loc->argc;
   1113 		} else {
   1114 			p = str_val(global(sp));
   1115 			zero_ok = p != null;
   1116 			if (stype == '#')
   1117 				c = utflen(p);
   1118 			else {
   1119 				/* partial utf_mbswidth reimplementation */
   1120 				const char *s = p;
   1121 				unsigned int wc;
   1122 				size_t len;
   1123 				int cw;
   1124 
   1125 				c = 0;
   1126 				while (*s) {
   1127 					if (!UTFMODE || (len = utf_mbtowc(&wc,
   1128 					    s)) == (size_t)-1)
   1129 						/* not UTFMODE or not UTF-8 */
   1130 						wc = (unsigned char)(*s++);
   1131 					else
   1132 						/* UTFMODE and UTF-8 */
   1133 						s += len;
   1134 					/* wc == char or wchar at s++ */
   1135 					if ((cw = utf_wcwidth(wc)) == -1) {
   1136 						/* 646, 8859-1, 10646 C0/C1 */
   1137 						c = -1;
   1138 						break;
   1139 					}
   1140 					c += cw;
   1141 				}
   1142 			}
   1143 		}
   1144 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
   1145 			errorf("%s: %s", sp, "parameter not set");
   1146 		/* unqualified variable/string substitution */
   1147 		*stypep = 0;
   1148 		xp->str = shf_smprintf("%d", c);
   1149 		return (XSUB);
   1150 	}
   1151 
   1152 	/* Check for qualifiers in word part */
   1153 	stype = 0;
   1154 	c = word[slen = 0] == CHAR ? word[1] : 0;
   1155 	if (c == ':') {
   1156 		slen += 2;
   1157 		stype = 0x80;
   1158 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
   1159 	}
   1160 	if (!stype && c == '/') {
   1161 		slen += 2;
   1162 		stype = c;
   1163 		if (word[slen] == ADELIM) {
   1164 			slen += 2;
   1165 			stype |= 0x80;
   1166 		}
   1167 	} else if (stype == 0x80 && (c == ' ' || c == '0')) {
   1168 		stype |= '0';
   1169 	} else if (ctype(c, C_SUBOP1)) {
   1170 		slen += 2;
   1171 		stype |= c;
   1172 	} else if (ctype(c, C_SUBOP2)) {
   1173 		/* Note: ksh88 allows :%, :%%, etc */
   1174 		slen += 2;
   1175 		stype = c;
   1176 		if (word[slen + 0] == CHAR && c == word[slen + 1]) {
   1177 			stype |= 0x80;
   1178 			slen += 2;
   1179 		}
   1180 	} else if (c == '@') {
   1181 		/* @x where x is command char */
   1182 		slen += 2;
   1183 		stype |= 0x100;
   1184 		if (word[slen] == CHAR) {
   1185 			stype |= word[slen + 1];
   1186 			slen += 2;
   1187 		}
   1188 	} else if (stype)
   1189 		/* : is not ok */
   1190 		return (-1);
   1191 	if (!stype && *word != CSUBST)
   1192 		return (-1);
   1193 	*stypep = stype;
   1194 	*slenp = slen;
   1195 
   1196 	c = sp[0];
   1197 	if (c == '*' || c == '@') {
   1198 		switch (stype & 0x17F) {
   1199 		/* can't assign to a vector */
   1200 		case '=':
   1201 		/* can't trim a vector (yet) */
   1202 		case '%':
   1203 		case '#':
   1204 		case '0':
   1205 		case '/':
   1206 		case 0x100 | '#':
   1207 		case 0x100 | 'Q':
   1208 			return (-1);
   1209 		}
   1210 		if (e->loc->argc == 0) {
   1211 			xp->str = null;
   1212 			xp->var = global(sp);
   1213 			state = c == '@' ? XNULLSUB : XSUB;
   1214 		} else {
   1215 			xp->u.strv = (const char **)e->loc->argv + 1;
   1216 			xp->str = *xp->u.strv++;
   1217 			/* $@ */
   1218 			xp->split = tobool(c == '@');
   1219 			state = XARG;
   1220 		}
   1221 		/* POSIX 2009? */
   1222 		zero_ok = true;
   1223 	} else {
   1224 		if ((p = cstrchr(sp, '[')) && (p[1] == '*' || p[1] == '@') &&
   1225 		    p[2] == ']') {
   1226 			XPtrV wv;
   1227 
   1228 			switch (stype & 0x17F) {
   1229 			/* can't assign to a vector */
   1230 			case '=':
   1231 			/* can't trim a vector (yet) */
   1232 			case '%':
   1233 			case '#':
   1234 			case '?':
   1235 			case '0':
   1236 			case '/':
   1237 			case 0x100 | '#':
   1238 			case 0x100 | 'Q':
   1239 				return (-1);
   1240 			}
   1241 			XPinit(wv, 32);
   1242 			if ((c = sp[0]) == '!')
   1243 				++sp;
   1244 			vp = global(arrayname(sp));
   1245 			for (; vp; vp = vp->u.array) {
   1246 				if (!(vp->flag&ISSET))
   1247 					continue;
   1248 				XPput(wv, c == '!' ? shf_smprintf("%lu",
   1249 				    arrayindex(vp)) :
   1250 				    str_val(vp));
   1251 			}
   1252 			if (XPsize(wv) == 0) {
   1253 				xp->str = null;
   1254 				state = p[1] == '@' ? XNULLSUB : XSUB;
   1255 				XPfree(wv);
   1256 			} else {
   1257 				XPput(wv, 0);
   1258 				xp->u.strv = (const char **)XPptrv(wv);
   1259 				xp->str = *xp->u.strv++;
   1260 				/* ${foo[@]} */
   1261 				xp->split = tobool(p[1] == '@');
   1262 				state = XARG;
   1263 			}
   1264 		} else {
   1265 			/* Can't assign things like $! or $1 */
   1266 			if ((stype & 0x17F) == '=' &&
   1267 			    ctype(*sp, C_VAR1 | C_DIGIT))
   1268 				return (-1);
   1269 			if (*sp == '!' && sp[1]) {
   1270 				++sp;
   1271 				xp->var = global(sp);
   1272 				if (vstrchr(sp, '[')) {
   1273 					if (xp->var->flag & ISSET)
   1274 						xp->str = shf_smprintf("%lu",
   1275 						    arrayindex(xp->var));
   1276 					else
   1277 						xp->str = null;
   1278 				} else if (xp->var->flag & ISSET)
   1279 					xp->str = xp->var->name;
   1280 				else
   1281 					/* ksh93 compat */
   1282 					xp->str = "0";
   1283 			} else {
   1284 				xp->var = global(sp);
   1285 				xp->str = str_val(xp->var);
   1286 			}
   1287 			state = XSUB;
   1288 		}
   1289 	}
   1290 
   1291 	c = stype & 0x7F;
   1292 	/* test the compiler's code generator */
   1293 	if (((stype < 0x100) && (ctype(c, C_SUBOP2) || c == '/' ||
   1294 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
   1295 	    c == '=' || c == '-' || c == '?' : c == '+'))) ||
   1296 	    stype == (0x80 | '0') || stype == (0x100 | '#') ||
   1297 	    stype == (0x100 | 'Q'))
   1298 		/* expand word instead of variable value */
   1299 		state = XBASE;
   1300 	if (Flag(FNOUNSET) && xp->str == null && !zero_ok &&
   1301 	    (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
   1302 		errorf("%s: %s", sp, "parameter not set");
   1303 	return (state);
   1304 }
   1305 
   1306 /*
   1307  * Run the command in $(...) and read its output.
   1308  */
   1309 static int
   1310 comsub(Expand *xp, const char *cp, int fn MKSH_A_UNUSED)
   1311 {
   1312 	Source *s, *sold;
   1313 	struct op *t;
   1314 	struct shf *shf;
   1315 	uint8_t old_utfmode = UTFMODE;
   1316 
   1317 	s = pushs(SSTRING, ATEMP);
   1318 	s->start = s->str = cp;
   1319 	sold = source;
   1320 	t = compile(s, true);
   1321 	afree(s, ATEMP);
   1322 	source = sold;
   1323 
   1324 	UTFMODE = old_utfmode;
   1325 
   1326 	if (t == NULL)
   1327 		return (XBASE);
   1328 
   1329 	/* no waitlast() unless specifically enabled later */
   1330 	xp->split = false;
   1331 
   1332 	if (t->type == TCOM &&
   1333 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
   1334 		/* $(<file) */
   1335 		struct ioword *io = *t->ioact;
   1336 		char *name;
   1337 
   1338 		if ((io->flag & IOTYPE) != IOREAD)
   1339 			errorf("%s: %s", "funny $() command",
   1340 			    snptreef(NULL, 32, "%R", io));
   1341 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
   1342 			SHF_MAPHI|SHF_CLEXEC);
   1343 		if (shf == NULL)
   1344 			warningf(!Flag(FTALKING), "%s: %s %s: %s", name,
   1345 			    "can't open", "$(<...) input", cstrerror(errno));
   1346 	} else if (fn == FUNSUB) {
   1347 		int ofd1;
   1348 		struct temp *tf = NULL;
   1349 
   1350 		/*
   1351 		 * create a temporary file, open for reading and writing,
   1352 		 * with an shf open for reading (buffered) but yet unused
   1353 		 */
   1354 		maketemp(ATEMP, TT_FUNSUB, &tf);
   1355 		if (!tf->shf) {
   1356 			errorf("can't %s temporary file %s: %s",
   1357 			    "create", tf->tffn, cstrerror(errno));
   1358 		}
   1359 		/* extract shf from temporary file, unlink and free it */
   1360 		shf = tf->shf;
   1361 		unlink(tf->tffn);
   1362 		afree(tf, ATEMP);
   1363 		/* save stdout and let it point to the tempfile */
   1364 		ofd1 = savefd(1);
   1365 		ksh_dup2(shf_fileno(shf), 1, false);
   1366 		/*
   1367 		 * run tree, with output thrown into the tempfile,
   1368 		 * in a new function block
   1369 		 */
   1370 		valsub(t, NULL);
   1371 		subst_exstat = exstat & 0xFF;
   1372 		/* rewind the tempfile and restore regular stdout */
   1373 		lseek(shf_fileno(shf), (off_t)0, SEEK_SET);
   1374 		restfd(1, ofd1);
   1375 	} else if (fn == VALSUB) {
   1376 		xp->str = valsub(t, ATEMP);
   1377 		subst_exstat = exstat & 0xFF;
   1378 		return (XSUB);
   1379 	} else {
   1380 		int ofd1, pv[2];
   1381 
   1382 		openpipe(pv);
   1383 		shf = shf_fdopen(pv[0], SHF_RD, NULL);
   1384 		ofd1 = savefd(1);
   1385 		if (pv[1] != 1) {
   1386 			ksh_dup2(pv[1], 1, false);
   1387 			close(pv[1]);
   1388 		}
   1389 		execute(t, XXCOM | XPIPEO | XFORK, NULL);
   1390 		restfd(1, ofd1);
   1391 		startlast();
   1392 		/* waitlast() */
   1393 		xp->split = true;
   1394 	}
   1395 
   1396 	xp->u.shf = shf;
   1397 	return (XCOM);
   1398 }
   1399 
   1400 /*
   1401  * perform #pattern and %pattern substitution in ${}
   1402  */
   1403 static char *
   1404 trimsub(char *str, char *pat, int how)
   1405 {
   1406 	char *end = strnul(str);
   1407 	char *p, c;
   1408 
   1409 	switch (how & 0xFF) {
   1410 	case '#':
   1411 		/* shortest match at beginning */
   1412 		for (p = str; p <= end; p += utf_ptradj(p)) {
   1413 			c = *p; *p = '\0';
   1414 			if (gmatchx(str, pat, false)) {
   1415 				*p = c;
   1416 				return (p);
   1417 			}
   1418 			*p = c;
   1419 		}
   1420 		break;
   1421 	case '#'|0x80:
   1422 		/* longest match at beginning */
   1423 		for (p = end; p >= str; p--) {
   1424 			c = *p; *p = '\0';
   1425 			if (gmatchx(str, pat, false)) {
   1426 				*p = c;
   1427 				return (p);
   1428 			}
   1429 			*p = c;
   1430 		}
   1431 		break;
   1432 	case '%':
   1433 		/* shortest match at end */
   1434 		p = end;
   1435 		while (p >= str) {
   1436 			if (gmatchx(p, pat, false))
   1437 				goto trimsub_match;
   1438 			if (UTFMODE) {
   1439 				char *op = p;
   1440 				while ((p-- > str) && ((*p & 0xC0) == 0x80))
   1441 					;
   1442 				if ((p < str) || (p + utf_ptradj(p) != op))
   1443 					p = op - 1;
   1444 			} else
   1445 				--p;
   1446 		}
   1447 		break;
   1448 	case '%'|0x80:
   1449 		/* longest match at end */
   1450 		for (p = str; p <= end; p++)
   1451 			if (gmatchx(p, pat, false)) {
   1452  trimsub_match:
   1453 				strndupx(end, str, p - str, ATEMP);
   1454 				return (end);
   1455 			}
   1456 		break;
   1457 	}
   1458 
   1459 	/* no match, return string */
   1460 	return (str);
   1461 }
   1462 
   1463 /*
   1464  * glob
   1465  * Name derived from V6's /etc/glob, the program that expanded filenames.
   1466  */
   1467 
   1468 /* XXX cp not const 'cause slashes are temporarily replaced with NULs... */
   1469 static void
   1470 glob(char *cp, XPtrV *wp, bool markdirs)
   1471 {
   1472 	int oldsize = XPsize(*wp);
   1473 
   1474 	if (glob_str(cp, wp, markdirs) == 0)
   1475 		XPput(*wp, debunk(cp, cp, strlen(cp) + 1));
   1476 	else
   1477 		qsort(XPptrv(*wp) + oldsize, XPsize(*wp) - oldsize,
   1478 		    sizeof(void *), xstrcmp);
   1479 }
   1480 
   1481 #define GF_NONE		0
   1482 #define GF_EXCHECK	BIT(0)		/* do existence check on file */
   1483 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
   1484 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
   1485 
   1486 /*
   1487  * Apply file globbing to cp and store the matching files in wp. Returns
   1488  * the number of matches found.
   1489  */
   1490 int
   1491 glob_str(char *cp, XPtrV *wp, bool markdirs)
   1492 {
   1493 	int oldsize = XPsize(*wp);
   1494 	XString xs;
   1495 	char *xp;
   1496 
   1497 	Xinit(xs, xp, 256, ATEMP);
   1498 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
   1499 	Xfree(xs, xp);
   1500 
   1501 	return (XPsize(*wp) - oldsize);
   1502 }
   1503 
   1504 static void
   1505 globit(XString *xs,	/* dest string */
   1506     char **xpp,		/* ptr to dest end */
   1507     char *sp,		/* source path */
   1508     XPtrV *wp,		/* output list */
   1509     int check)		/* GF_* flags */
   1510 {
   1511 	char *np;		/* next source component */
   1512 	char *xp = *xpp;
   1513 	char *se;
   1514 	char odirsep;
   1515 
   1516 	/* This to allow long expansions to be interrupted */
   1517 	intrcheck();
   1518 
   1519 	if (sp == NULL) {
   1520 		/* end of source path */
   1521 		/*
   1522 		 * We only need to check if the file exists if a pattern
   1523 		 * is followed by a non-pattern (eg, foo*x/bar; no check
   1524 		 * is needed for foo* since the match must exist) or if
   1525 		 * any patterns were expanded and the markdirs option is set.
   1526 		 * Symlinks make things a bit tricky...
   1527 		 */
   1528 		if ((check & GF_EXCHECK) ||
   1529 		    ((check & GF_MARKDIR) && (check & GF_GLOBBED))) {
   1530 #define stat_check()	(stat_done ? stat_done : (stat_done = \
   1531 			    stat(Xstring(*xs, xp), &statb) < 0 ? -1 : 1))
   1532 			struct stat lstatb, statb;
   1533 			/* -1: failed, 1 ok, 0 not yet done */
   1534 			int stat_done = 0;
   1535 
   1536 			if (mksh_lstat(Xstring(*xs, xp), &lstatb) < 0)
   1537 				return;
   1538 			/*
   1539 			 * special case for systems which strip trailing
   1540 			 * slashes from regular files (eg, /etc/passwd/).
   1541 			 * SunOS 4.1.3 does this...
   1542 			 */
   1543 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp) &&
   1544 			    xp[-1] == '/' && !S_ISDIR(lstatb.st_mode) &&
   1545 			    (!S_ISLNK(lstatb.st_mode) ||
   1546 			    stat_check() < 0 || !S_ISDIR(statb.st_mode)))
   1547 				return;
   1548 			/*
   1549 			 * Possibly tack on a trailing / if there isn't already
   1550 			 * one and if the file is a directory or a symlink to a
   1551 			 * directory
   1552 			 */
   1553 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED)) &&
   1554 			    xp > Xstring(*xs, xp) && xp[-1] != '/' &&
   1555 			    (S_ISDIR(lstatb.st_mode) ||
   1556 			    (S_ISLNK(lstatb.st_mode) && stat_check() > 0 &&
   1557 			    S_ISDIR(statb.st_mode)))) {
   1558 				*xp++ = '/';
   1559 				*xp = '\0';
   1560 			}
   1561 		}
   1562 		strndupx(np, Xstring(*xs, xp), Xlength(*xs, xp), ATEMP);
   1563 		XPput(*wp, np);
   1564 		return;
   1565 	}
   1566 
   1567 	if (xp > Xstring(*xs, xp))
   1568 		*xp++ = '/';
   1569 	while (*sp == '/') {
   1570 		Xcheck(*xs, xp);
   1571 		*xp++ = *sp++;
   1572 	}
   1573 	np = strchr(sp, '/');
   1574 	if (np != NULL) {
   1575 		se = np;
   1576 		/* don't assume '/', can be multiple kinds */
   1577 		odirsep = *np;
   1578 		*np++ = '\0';
   1579 	} else {
   1580 		odirsep = '\0'; /* keep gcc quiet */
   1581 		se = sp + strlen(sp);
   1582 	}
   1583 
   1584 
   1585 	/*
   1586 	 * Check if sp needs globbing - done to avoid pattern checks for strings
   1587 	 * containing MAGIC characters, open [s without the matching close ],
   1588 	 * etc. (otherwise opendir() will be called which may fail because the
   1589 	 * directory isn't readable - if no globbing is needed, only execute
   1590 	 * permission should be required (as per POSIX)).
   1591 	 */
   1592 	if (!has_globbing(sp, se)) {
   1593 		XcheckN(*xs, xp, se - sp + 1);
   1594 		debunk(xp, sp, Xnleft(*xs, xp));
   1595 		xp += strlen(xp);
   1596 		*xpp = xp;
   1597 		globit(xs, xpp, np, wp, check);
   1598 	} else {
   1599 		DIR *dirp;
   1600 		struct dirent *d;
   1601 		char *name;
   1602 		size_t len, prefix_len;
   1603 
   1604 		/* xp = *xpp;	copy_non_glob() may have re-alloc'd xs */
   1605 		*xp = '\0';
   1606 		prefix_len = Xlength(*xs, xp);
   1607 		dirp = opendir(prefix_len ? Xstring(*xs, xp) : ".");
   1608 		if (dirp == NULL)
   1609 			goto Nodir;
   1610 		while ((d = readdir(dirp)) != NULL) {
   1611 			name = d->d_name;
   1612 			if (name[0] == '.' &&
   1613 			    (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
   1614 				/* always ignore . and .. */
   1615 				continue;
   1616 			if ((*name == '.' && *sp != '.') ||
   1617 			    !gmatchx(name, sp, true))
   1618 				continue;
   1619 
   1620 			len = strlen(d->d_name) + 1;
   1621 			XcheckN(*xs, xp, len);
   1622 			memcpy(xp, name, len);
   1623 			*xpp = xp + len - 1;
   1624 			globit(xs, xpp, np, wp,
   1625 				(check & GF_MARKDIR) | GF_GLOBBED
   1626 				| (np ? GF_EXCHECK : GF_NONE));
   1627 			xp = Xstring(*xs, xp) + prefix_len;
   1628 		}
   1629 		closedir(dirp);
   1630  Nodir:
   1631 		;
   1632 	}
   1633 
   1634 	if (np != NULL)
   1635 		*--np = odirsep;
   1636 }
   1637 
   1638 /* remove MAGIC from string */
   1639 char *
   1640 debunk(char *dp, const char *sp, size_t dlen)
   1641 {
   1642 	char *d;
   1643 	const char *s;
   1644 
   1645 	if ((s = cstrchr(sp, MAGIC))) {
   1646 		if (s - sp >= (ssize_t)dlen)
   1647 			return (dp);
   1648 		memmove(dp, sp, s - sp);
   1649 		for (d = dp + (s - sp); *s && (d - dp < (ssize_t)dlen); s++)
   1650 			if (!ISMAGIC(*s) || !(*++s & 0x80) ||
   1651 			    !vstrchr("*+?@! ", *s & 0x7f))
   1652 				*d++ = *s;
   1653 			else {
   1654 				/* extended pattern operators: *+?@! */
   1655 				if ((*s & 0x7f) != ' ')
   1656 					*d++ = *s & 0x7f;
   1657 				if (d - dp < (ssize_t)dlen)
   1658 					*d++ = '(';
   1659 			}
   1660 		*d = '\0';
   1661 	} else if (dp != sp)
   1662 		strlcpy(dp, sp, dlen);
   1663 	return (dp);
   1664 }
   1665 
   1666 /*
   1667  * Check if p is an unquoted name, possibly followed by a / or :. If so
   1668  * puts the expanded version in *dcp,dp and returns a pointer in p just
   1669  * past the name, otherwise returns 0.
   1670  */
   1671 static const char *
   1672 maybe_expand_tilde(const char *p, XString *dsp, char **dpp, int isassign)
   1673 {
   1674 	XString ts;
   1675 	char *dp = *dpp;
   1676 	char *tp;
   1677 	const char *r;
   1678 
   1679 	Xinit(ts, tp, 16, ATEMP);
   1680 	/* : only for DOASNTILDE form */
   1681 	while (p[0] == CHAR && p[1] != '/' && (!isassign || p[1] != ':'))
   1682 	{
   1683 		Xcheck(ts, tp);
   1684 		*tp++ = p[1];
   1685 		p += 2;
   1686 	}
   1687 	*tp = '\0';
   1688 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ?
   1689 	    tilde(Xstring(ts, tp)) : NULL;
   1690 	Xfree(ts, tp);
   1691 	if (r) {
   1692 		while (*r) {
   1693 			Xcheck(*dsp, dp);
   1694 			if (ISMAGIC(*r))
   1695 				*dp++ = MAGIC;
   1696 			*dp++ = *r++;
   1697 		}
   1698 		*dpp = dp;
   1699 		r = p;
   1700 	}
   1701 	return (r);
   1702 }
   1703 
   1704 /*
   1705  * tilde expansion
   1706  *
   1707  * based on a version by Arnold Robbins
   1708  */
   1709 
   1710 char *
   1711 tilde(char *cp)
   1712 {
   1713 	char *dp = null;
   1714 
   1715 	if (cp[0] == '\0')
   1716 		dp = str_val(global("HOME"));
   1717 	else if (cp[0] == '+' && cp[1] == '\0')
   1718 		dp = str_val(global("PWD"));
   1719 	else if (cp[0] == '-' && cp[1] == '\0')
   1720 		dp = str_val(global("OLDPWD"));
   1721 #ifndef MKSH_NOPWNAM
   1722 	else
   1723 		dp = homedir(cp);
   1724 #endif
   1725 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
   1726 	return (dp == null ? NULL : dp);
   1727 }
   1728 
   1729 #ifndef MKSH_NOPWNAM
   1730 /*
   1731  * map userid to user's home directory.
   1732  * note that 4.3's getpw adds more than 6K to the shell,
   1733  * and the YP version probably adds much more.
   1734  * we might consider our own version of getpwnam() to keep the size down.
   1735  */
   1736 static char *
   1737 homedir(char *name)
   1738 {
   1739 	struct tbl *ap;
   1740 
   1741 	ap = ktenter(&homedirs, name, hash(name));
   1742 	if (!(ap->flag & ISSET)) {
   1743 		struct passwd *pw;
   1744 
   1745 		pw = getpwnam(name);
   1746 		if (pw == NULL)
   1747 			return (NULL);
   1748 		strdupx(ap->val.s, pw->pw_dir, APERM);
   1749 		ap->flag |= DEFINED|ISSET|ALLOC;
   1750 	}
   1751 	return (ap->val.s);
   1752 }
   1753 #endif
   1754 
   1755 static void
   1756 alt_expand(XPtrV *wp, char *start, char *exp_start, char *end, int fdo)
   1757 {
   1758 	int count = 0;
   1759 	char *brace_start, *brace_end, *comma = NULL;
   1760 	char *field_start;
   1761 	char *p;
   1762 
   1763 	/* search for open brace */
   1764 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != '{' /*}*/; p += 2)
   1765 		;
   1766 	brace_start = p;
   1767 
   1768 	/* find matching close brace, if any */
   1769 	if (p) {
   1770 		comma = NULL;
   1771 		count = 1;
   1772 		for (p += 2; *p && count; p++) {
   1773 			if (ISMAGIC(*p)) {
   1774 				if (*++p == '{' /*}*/)
   1775 					count++;
   1776 				else if (*p == /*{*/ '}')
   1777 					--count;
   1778 				else if (*p == ',' && count == 1)
   1779 					comma = p;
   1780 			}
   1781 		}
   1782 	}
   1783 	/* no valid expansions... */
   1784 	if (!p || count != 0) {
   1785 		/*
   1786 		 * Note that given a{{b,c} we do not expand anything (this is
   1787 		 * what AT&T ksh does. This may be changed to do the {b,c}
   1788 		 * expansion. }
   1789 		 */
   1790 		if (fdo & DOGLOB)
   1791 			glob(start, wp, tobool(fdo & DOMARKDIRS));
   1792 		else
   1793 			XPput(*wp, debunk(start, start, end - start));
   1794 		return;
   1795 	}
   1796 	brace_end = p;
   1797 	if (!comma) {
   1798 		alt_expand(wp, start, brace_end, end, fdo);
   1799 		return;
   1800 	}
   1801 
   1802 	/* expand expression */
   1803 	field_start = brace_start + 2;
   1804 	count = 1;
   1805 	for (p = brace_start + 2; p != brace_end; p++) {
   1806 		if (ISMAGIC(*p)) {
   1807 			if (*++p == '{' /*}*/)
   1808 				count++;
   1809 			else if ((*p == /*{*/ '}' && --count == 0) ||
   1810 			    (*p == ',' && count == 1)) {
   1811 				char *news;
   1812 				int l1, l2, l3;
   1813 
   1814 				/*
   1815 				 * addition safe since these operate on
   1816 				 * one string (separate substrings)
   1817 				 */
   1818 				l1 = brace_start - start;
   1819 				l2 = (p - 1) - field_start;
   1820 				l3 = end - brace_end;
   1821 				news = alloc(l1 + l2 + l3 + 1, ATEMP);
   1822 				memcpy(news, start, l1);
   1823 				memcpy(news + l1, field_start, l2);
   1824 				memcpy(news + l1 + l2, brace_end, l3);
   1825 				news[l1 + l2 + l3] = '\0';
   1826 				alt_expand(wp, news, news + l1,
   1827 				    news + l1 + l2 + l3, fdo);
   1828 				field_start = p + 1;
   1829 			}
   1830 		}
   1831 	}
   1832 	return;
   1833 }
   1834 
   1835 /* helper function due to setjmp/longjmp woes */
   1836 static char *
   1837 valsub(struct op *t, Area *ap)
   1838 {
   1839 	char * volatile cp = NULL;
   1840 	struct tbl * volatile vp = NULL;
   1841 
   1842 	newenv(E_FUNC);
   1843 	newblock();
   1844 	if (ap)
   1845 		vp = local("REPLY", false);
   1846 	if (!kshsetjmp(e->jbuf))
   1847 		execute(t, XXCOM | XERROK, NULL);
   1848 	if (vp)
   1849 		strdupx(cp, str_val(vp), ap);
   1850 	quitenv(NULL);
   1851 
   1852 	return (cp);
   1853 }
   1854