xref: /netbsd-src/bin/ksh/eval.c (revision 404fbe5fb94ca1e054339640cabb2801ce52dd30)
1 /*	$NetBSD: eval.c,v 1.10 2007/01/28 22:30:12 cbiere Exp $	*/
2 
3 /*
4  * Expansion - quoting, separation, substitution, globbing
5  */
6 #include <sys/cdefs.h>
7 
8 #ifndef lint
9 __RCSID("$NetBSD: eval.c,v 1.10 2007/01/28 22:30:12 cbiere Exp $");
10 #endif
11 
12 
13 #include "sh.h"
14 #include <pwd.h>
15 #include "ksh_dir.h"
16 #include "ksh_stat.h"
17 
18 /*
19  * string expansion
20  *
21  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
22  * second pass: alternation ({,}), filename expansion (*?[]).
23  */
24 
25 /* expansion generator state */
26 typedef struct Expand {
27 	/* int  type; */	/* see expand() */
28 	const char *str;	/* string */
29 	union {
30 		const char **strv;/* string[] */
31 		struct shf *shf;/* file */
32 	} u;			/* source */
33 	struct tbl *var;	/* variable in ${var..} */
34 	short	split;		/* split "$@" / call waitlast $() */
35 } Expand;
36 
37 #define	XBASE		0	/* scanning original */
38 #define	XSUB		1	/* expanding ${} string */
39 #define	XARGSEP		2	/* ifs0 between "$*" */
40 #define	XARG		3	/* expanding $*, $@ */
41 #define	XCOM		4	/* expanding $() */
42 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
43 
44 /* States used for field splitting */
45 #define IFS_WORD	0	/* word has chars (or quotes) */
46 #define IFS_WS		1	/* have seen IFS white-space */
47 #define IFS_NWS		2	/* have seen IFS non-white-space */
48 
49 static	int	varsub ARGS((Expand *xp, char *sp, char *word, int *stypep, int *slenp));
50 static	int	comsub ARGS((Expand *xp, char *cp));
51 static	char   *trimsub ARGS((char *str, char *pat, int how));
52 static	void	glob ARGS((char *cp, XPtrV *wp, int markdirs));
53 static	void	globit ARGS((XString *xs, char **xpp, char *sp, XPtrV *wp,
54 			     int check));
55 static char	*maybe_expand_tilde ARGS((char *p, XString *dsp, char **dpp,
56 					  int isassign));
57 static	char   *tilde ARGS((char *acp));
58 static	char   *homedir ARGS((char *name));
59 #ifdef BRACE_EXPAND
60 static void	alt_expand ARGS((XPtrV *wp, char *start, char *exp_start,
61 				 char *end, int fdo));
62 #endif
63 
64 /* compile and expand word */
65 char *
66 substitute(cp, f)
67 	const char *cp;
68 	int f;
69 {
70 	struct source *s, *sold;
71 
72 	sold = source;
73 	s = pushs(SWSTR, ATEMP);
74 	s->start = s->str = cp;
75 	source = s;
76 	if (yylex(ONEWORD) != LWORD)
77 		internal_errorf(1, "substitute");
78 	source = sold;
79 	afree(s, ATEMP);
80 	return evalstr(yylval.cp, f);
81 }
82 
83 /*
84  * expand arg-list
85  */
86 char **
87 eval(ap, f)
88 	register char **ap;
89 	int f;
90 {
91 	XPtrV w;
92 
93 	if (*ap == NULL)
94 		return ap;
95 	XPinit(w, 32);
96 	XPput(w, NULL);		/* space for shell name */
97 #ifdef	SHARPBANG
98 	XPput(w, NULL);		/* and space for one arg */
99 #endif
100 	while (*ap != NULL)
101 		expand(*ap++, &w, f);
102 	XPput(w, NULL);
103 #ifdef	SHARPBANG
104 	return (char **) XPclose(w) + 2;
105 #else
106 	return (char **) XPclose(w) + 1;
107 #endif
108 }
109 
110 /*
111  * expand string
112  */
113 char *
114 evalstr(cp, f)
115 	char *cp;
116 	int f;
117 {
118 	XPtrV w;
119 
120 	XPinit(w, 1);
121 	expand(cp, &w, f);
122 	cp = (XPsize(w) == 0) ? null : (char*) *XPptrv(w);
123 	XPfree(w);
124 	return cp;
125 }
126 
127 /*
128  * expand string - return only one component
129  * used from iosetup to expand redirection files
130  */
131 char *
132 evalonestr(cp, f)
133 	register char *cp;
134 	int f;
135 {
136 	XPtrV w;
137 
138 	XPinit(w, 1);
139 	expand(cp, &w, f);
140 	switch (XPsize(w)) {
141 	case 0:
142 		cp = null;
143 		break;
144 	case 1:
145 		cp = (char*) *XPptrv(w);
146 		break;
147 	default:
148 		cp = evalstr(cp, f&~DOGLOB);
149 		break;
150 	}
151 	XPfree(w);
152 	return cp;
153 }
154 
155 /* for nested substitution: ${var:=$var2} */
156 typedef struct SubType {
157 	short	stype;		/* [=+-?%#] action after expanded word */
158 	short	base;		/* begin position of expanded word */
159 	short	f;		/* saved value of f (DOPAT, etc) */
160 	struct tbl *var;	/* variable for ${var..} */
161 	short	quote;		/* saved value of quote (for ${..[%#]..}) */
162 	struct SubType *prev;	/* old type */
163 	struct SubType *next;	/* poped type (to avoid re-allocating) */
164 } SubType;
165 
166 void
167 expand(cp, wp, f)
168 	char *cp;		/* input word */
169 	register XPtrV *wp;	/* output words */
170 	int f;			/* DO* flags */
171 {
172 	register int UNINITIALIZED(c);
173 	register int type;	/* expansion type */
174 	register int quote = 0;	/* quoted */
175 	XString ds;		/* destination string */
176 	register char *dp, *sp;	/* dest., source */
177 	int fdo, word;		/* second pass flags; have word */
178 	int doblank;		/* field splitting of parameter/command subst */
179 	Expand x;		/* expansion variables */
180 	SubType st_head, *st;
181 	int UNINITIALIZED(newlines); /* For trailing newlines in COMSUB */
182 	int saw_eq, tilde_ok;
183 	int make_magic;
184 	size_t len;
185 
186 	x.split = 0;	/* XXX gcc */
187 	x.str = NULL;	/* XXX gcc */
188 	if (cp == NULL)
189 		internal_errorf(1, "expand(NULL)");
190 	/* for alias, readonly, set, typeset commands */
191 	if ((f & DOVACHECK) && is_wdvarassign(cp)) {
192 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
193 		f |= DOASNTILDE;
194 	}
195 	if (Flag(FNOGLOB))
196 		f &= ~DOGLOB;
197 	if (Flag(FMARKDIRS))
198 		f |= DOMARKDIRS;
199 #ifdef BRACE_EXPAND
200 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
201 		f |= DOBRACE_;
202 #endif /* BRACE_EXPAND */
203 
204 	Xinit(ds, dp, 128, ATEMP);	/* init dest. string */
205 	type = XBASE;
206 	sp = cp;
207 	fdo = 0;
208 	saw_eq = 0;
209 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0; /* must be 1/0 */
210 	doblank = 0;
211 	make_magic = 0;
212 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
213 	st_head.next = (SubType *) 0;
214 	st = &st_head;
215 
216 	while (1) {
217 		Xcheck(ds, dp);
218 
219 		switch (type) {
220 		  case XBASE:	/* original prefixed string */
221 			c = *sp++;
222 			switch (c) {
223 			  case EOS:
224 				c = 0;
225 				break;
226 			  case CHAR:
227 				c = *sp++;
228 				break;
229 			  case QCHAR:
230 				quote |= 2; /* temporary quote */
231 				c = *sp++;
232 				break;
233 			  case OQUOTE:
234 				word = IFS_WORD;
235 				tilde_ok = 0;
236 				quote = 1;
237 				continue;
238 			  case CQUOTE:
239 				quote = 0;
240 				continue;
241 			  case COMSUB:
242 				tilde_ok = 0;
243 				if (f & DONTRUNCOMMAND) {
244 					word = IFS_WORD;
245 					*dp++ = '$'; *dp++ = '(';
246 					while (*sp != '\0') {
247 						Xcheck(ds, dp);
248 						*dp++ = *sp++;
249 					}
250 					*dp++ = ')';
251 				} else {
252 					type = comsub(&x, sp);
253 					if (type == XCOM && (f&DOBLANK))
254 						doblank++;
255 					sp = strchr(sp, 0) + 1;
256 					newlines = 0;
257 				}
258 				continue;
259 			  case EXPRSUB:
260 				word = IFS_WORD;
261 				tilde_ok = 0;
262 				if (f & DONTRUNCOMMAND) {
263 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
264 					while (*sp != '\0') {
265 						Xcheck(ds, dp);
266 						*dp++ = *sp++;
267 					}
268 					*dp++ = ')'; *dp++ = ')';
269 				} else {
270 					struct tbl v;
271 					char *p;
272 
273 					v.flag = DEFINED|ISSET|INTEGER;
274 					v.type = 10; /* not default */
275 					v.name[0] = '\0';
276 					v_evaluate(&v, substitute(sp, 0),
277 						KSH_UNWIND_ERROR);
278 					sp = strchr(sp, 0) + 1;
279 					for (p = str_val(&v); *p; ) {
280 						Xcheck(ds, dp);
281 						*dp++ = *p++;
282 					}
283 				}
284 				continue;
285 			  case OSUBST: /* ${{#}var{:}[=+-?#%]word} */
286 			  /* format is:
287 			   *   OSUBST [{x] plain-variable-part \0
288 			   *     compiled-word-part CSUBST [}x]
289 			   * This is were all syntax checking gets done...
290 			   */
291 			  {
292 				char *varname = ++sp; /* skip the { or x (}) */
293 				int stype;
294 				int slen;
295 
296 				slen = -1;	/* XXX gcc */
297 				sp = strchr(sp, '\0') + 1; /* skip variable */
298 				type = varsub(&x, varname, sp, &stype, &slen);
299 				if (type < 0) {
300 					char endc;
301 					char *str, *end;
302 
303 					end = (char *) wdscan(sp, CSUBST);
304 					/* ({) the } or x is already skipped */
305 					endc = *end;
306 					*end = EOS;
307 					str = snptreef((char *) 0, 64, "%S",
308 							varname - 1);
309 					*end = endc;
310 					errorf("%s: bad substitution", str);
311 				}
312 				if (f&DOBLANK)
313 					doblank++;
314 				tilde_ok = 0;
315 				if (type == XBASE) {	/* expand? */
316 					if (!st->next) {
317 						SubType *newst;
318 
319 						newst = (SubType *) alloc(
320 							sizeof(SubType), ATEMP);
321 						newst->next = (SubType *) 0;
322 						newst->prev = st;
323 						st->next = newst;
324 					}
325 					st = st->next;
326 					st->stype = stype;
327 					st->base = Xsavepos(ds, dp);
328 					st->f = f;
329 					st->var = x.var;
330 					st->quote = quote;
331 					/* skip qualifier(s) */
332 					if (stype)
333 						sp += slen;
334 					switch (stype & 0x7f) {
335 					  case '#':
336 					  case '%':
337 						/* ! DOBLANK,DOBRACE_,DOTILDE */
338 						f = DOPAT | (f&DONTRUNCOMMAND)
339 						    | DOTEMP_;
340 						quote = 0;
341 						/* Prepend open pattern (so |
342 						 * in a trim will work as
343 						 * expected)
344 						 */
345 						*dp++ = MAGIC;
346 						*dp++ = '@' + 0x80;
347 						break;
348 					  case '=':
349 						/* Enabling tilde expansion
350 						 * after :'s here is
351 						 * non-standard ksh, but is
352 						 * consistent with rules for
353 						 * other assignments.  Not
354 						 * sure what POSIX thinks of
355 						 * this.
356 						 * Not doing tilde expansion
357 						 * for integer variables is a
358 						 * non-POSIX thing - makes
359 						 * sense though, since ~ is
360 						 * a arithmetic operator.
361 						 */
362 						if (!(x.var->flag & INTEGER))
363 							f |= DOASNTILDE|DOTILDE;
364 						f |= DOTEMP_;
365 						/* These will be done after the
366 						 * value has been assigned.
367 						 */
368 						f &= ~(DOBLANK|DOGLOB|DOBRACE_);
369 						tilde_ok = 1;
370 						break;
371 					  case '?':
372 						f &= ~DOBLANK;
373 						f |= DOTEMP_;
374 						/* fall through */
375 					  default:
376 						/* Enable tilde expansion */
377 						tilde_ok = 1;
378 						f |= DOTILDE;
379 					}
380 				} else
381 					/* skip word */
382 					sp = (char *) wdscan(sp, CSUBST);
383 				continue;
384 			  }
385 			  case CSUBST: /* only get here if expanding word */
386 				sp++; /* ({) skip the } or x */
387 				tilde_ok = 0;	/* in case of ${unset:-} */
388 				*dp = '\0';
389 				quote = st->quote;
390 				f = st->f;
391 				if (f&DOBLANK)
392 					doblank--;
393 				switch (st->stype&0x7f) {
394 				  case '#':
395 				  case '%':
396 					/* Append end-pattern */
397 					*dp++ = MAGIC; *dp++ = ')'; *dp = '\0';
398 					dp = Xrestpos(ds, dp, st->base);
399 					/* Must use st->var since calling
400 					 * global would break things
401 					 * like x[i+=1].
402 					 */
403 					x.str = trimsub(str_val(st->var),
404 						dp, st->stype);
405 					type = XSUB;
406 					if (f&DOBLANK)
407 						doblank++;
408 					st = st->prev;
409 					continue;
410 				  case '=':
411 					/* Restore our position and substitute
412 					 * the value of st->var (may not be
413 					 * the assigned value in the presence
414 					 * of integer/right-adj/etc attributes).
415 					 */
416 					dp = Xrestpos(ds, dp, st->base);
417 					/* Must use st->var since calling
418 					 * global would cause with things
419 					 * like x[i+=1] to be evaluated twice.
420 					 */
421 					/* Note: not exported by FEXPORT
422 					 * in at&t ksh.
423 					 */
424 					/* XXX POSIX says readonly is only
425 					 * fatal for special builtins (setstr
426 					 * does readonly check).
427 					 */
428 					len = strlen(dp) + 1;
429 					setstr(st->var,
430 					    debunk((char *) alloc(len, ATEMP),
431 						dp, len),
432 					    KSH_UNWIND_ERROR);
433 					x.str = str_val(st->var);
434 					type = XSUB;
435 					if (f&DOBLANK)
436 						doblank++;
437 					st = st->prev;
438 					continue;
439 				  case '?':
440 				    {
441 					char *s = Xrestpos(ds, dp, st->base);
442 
443 					errorf("%s: %s", st->var->name,
444 					    dp == s ?
445 					      "parameter null or not set"
446 					    : (debunk(s, s, strlen(s) + 1), s));
447 				    }
448 				}
449 				st = st->prev;
450 				type = XBASE;
451 				continue;
452 
453 			  case OPAT: /* open pattern: *(foo|bar) */
454 				/* Next char is the type of pattern */
455 				make_magic = 1;
456 				c = *sp++ + 0x80;
457 				break;
458 
459 			  case SPAT: /* pattern separator (|) */
460 				make_magic = 1;
461 				c = '|';
462 				break;
463 
464 			  case CPAT: /* close pattern */
465 				make_magic = 1;
466 				c = /*(*/ ')';
467 				break;
468 			}
469 			break;
470 
471 		  case XNULLSUB:
472 			/* Special case for "$@" (and "${foo[@]}") - no
473 			 * word is generated if $# is 0 (unless there is
474 			 * other stuff inside the quotes).
475 			 */
476 			type = XBASE;
477 			if (f&DOBLANK) {
478 				doblank--;
479 				/* not really correct: x=; "$x$@" should
480 				 * generate a null argument and
481 				 * set A; "${@:+}" shouldn't.
482 				 */
483 				if (dp == Xstring(ds, dp))
484 					word = IFS_WS;
485 			}
486 			continue;
487 
488 		  case XSUB:
489 			if ((c = *x.str++) == 0) {
490 				type = XBASE;
491 				if (f&DOBLANK)
492 					doblank--;
493 				continue;
494 			}
495 			break;
496 
497 		  case XARGSEP:
498 			type = XARG;
499 			quote = 1;
500 		  case XARG:
501 			if ((c = *x.str++) == '\0') {
502 				/* force null words to be created so
503 				 * set -- '' 2 ''; foo "$@" will do
504 				 * the right thing
505 				 */
506 				if (quote && x.split)
507 					word = IFS_WORD;
508 				if ((x.str = *x.u.strv++) == NULL) {
509 					type = XBASE;
510 					if (f&DOBLANK)
511 						doblank--;
512 					continue;
513 				}
514 				c = ifs0;
515 				if (c == 0) {
516 					if (quote && !x.split)
517 						continue;
518 					c = ' ';
519 				}
520 				if (quote && x.split) {
521 					/* terminate word for "$@" */
522 					type = XARGSEP;
523 					quote = 0;
524 				}
525 			}
526 			break;
527 
528 		  case XCOM:
529 			if (newlines) {		/* Spit out saved nl's */
530 				c = '\n';
531 				--newlines;
532 			} else {
533 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
534 				    if (c == '\n')
535 					    newlines++;	/* Save newlines */
536 				if (newlines && c != EOF) {
537 					shf_ungetc(c, x.u.shf);
538 					c = '\n';
539 					--newlines;
540 				}
541 			}
542 			if (c == EOF) {
543 				newlines = 0;
544 				shf_close(x.u.shf);
545 				if (x.split)
546 					subst_exstat = waitlast();
547 				type = XBASE;
548 				if (f&DOBLANK)
549 					doblank--;
550 				continue;
551 			}
552 			break;
553 		}
554 
555 		/* check for end of word or IFS separation */
556 		if (c == 0 || (!quote && (f & DOBLANK) && doblank && !make_magic
557 			       && ctype(c, C_IFS)))
558 		{
559 			/* How words are broken up:
560 			 *		   |       value of c
561 			 *	  word	   |	ws	nws	0
562 			 *	-----------------------------------
563 			 *	IFS_WORD	w/WS	w/NWS	w
564 			 *	IFS_WS		-/WS	w/NWS	-
565 			 *	IFS_NWS		-/NWS	w/NWS	w
566 			 *   (w means generate a word)
567 			 * Note that IFS_NWS/0 generates a word (at&t ksh
568 			 * doesn't do this, but POSIX does).
569 			 */
570 			if (word == IFS_WORD
571 			    || (!ctype(c, C_IFSWS) && (c || word == IFS_NWS)))
572 			{
573 				char *p;
574 
575 				*dp++ = '\0';
576 				p = Xclose(ds, dp);
577 #ifdef BRACE_EXPAND
578 				if (fdo & DOBRACE_)
579 					/* also does globbing */
580 					alt_expand(wp, p, p,
581 						   p + Xlength(ds, (dp - 1)),
582 						   fdo | (f & DOMARKDIRS));
583 				else
584 #endif /* BRACE_EXPAND */
585 				if (fdo & DOGLOB)
586 					glob(p, wp, f & DOMARKDIRS);
587 				else if ((f & DOPAT) || !(fdo & DOMAGIC_))
588 					XPput(*wp, p);
589 				else
590 					XPput(*wp, debunk(p, p, strlen(p) + 1));
591 				fdo = 0;
592 				saw_eq = 0;
593 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
594 				if (c != 0)
595 					Xinit(ds, dp, 128, ATEMP);
596 			}
597 			if (c == 0)
598 				return;
599 			if (word != IFS_NWS)
600 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
601 		} else {
602 			/* age tilde_ok info - ~ code tests second bit */
603 			tilde_ok <<= 1;
604 			/* mark any special second pass chars */
605 			if (!quote)
606 				switch (c) {
607 				  case '[':
608 					{
609 						const char *p = sp;
610 						bool_t special = FALSE;
611 						while (*p != EOS) {
612 							if (p[0] == CHAR &&
613 								p[1] == ']') {
614 								special = TRUE;
615 								break;
616 							}
617 
618 							p += 2;
619 						}
620 						if (!special)
621 							break;
622 					}
623 				  case NOT:
624 				  case '-':
625 				  case ']':
626 					/* For character classes - doesn't hurt
627 					 * to have magic !,-,]'s outside of
628 					 * [...] expressions.
629 					 */
630 					if (f & (DOPAT | DOGLOB)) {
631 						fdo |= DOMAGIC_;
632 						if (c == '[')
633 							fdo |= f & DOGLOB;
634 						*dp++ = MAGIC;
635 					}
636 					break;
637 				  case '*':
638 				  case '?':
639 					if (f & (DOPAT | DOGLOB)) {
640 						fdo |= DOMAGIC_ | (f & DOGLOB);
641 						*dp++ = MAGIC;
642 					}
643 					break;
644 #ifdef BRACE_EXPAND
645 				  case OBRACE:
646 				  case ',':
647 				  case CBRACE:
648 					if ((f & DOBRACE_) && (c == OBRACE
649 						|| (fdo & DOBRACE_)))
650 					{
651 						fdo |= DOBRACE_|DOMAGIC_;
652 						*dp++ = MAGIC;
653 					}
654 					break;
655 #endif /* BRACE_EXPAND */
656 				  case '=':
657 					/* Note first unquoted = for ~ */
658 					if (!(f & DOTEMP_) && !saw_eq) {
659 						saw_eq = 1;
660 						tilde_ok = 1;
661 					}
662 					break;
663 				  case PATHSEP: /* : */
664 					/* Note unquoted : for ~ */
665 					if (!(f & DOTEMP_) && (f & DOASNTILDE))
666 						tilde_ok = 1;
667 					break;
668 				  case '~':
669 					/* tilde_ok is reset whenever
670 					 * any of ' " $( $(( ${ } are seen.
671 					 * Note that tilde_ok must be preserved
672 					 * through the sequence ${A=a=}~
673 					 */
674 					if (type == XBASE
675 					    && (f & (DOTILDE|DOASNTILDE))
676 					    && (tilde_ok & 2))
677 					{
678 						char *p, *dp_x;
679 
680 						dp_x = dp;
681 						p = maybe_expand_tilde(sp,
682 							&ds, &dp_x,
683 							f & DOASNTILDE);
684 						if (p) {
685 							if (dp != dp_x)
686 								word = IFS_WORD;
687 							dp = dp_x;
688 							sp = p;
689 							continue;
690 						}
691 					}
692 					break;
693 				}
694 			else
695 				quote &= ~2; /* undo temporary */
696 
697 			if (make_magic) {
698 				make_magic = 0;
699 				fdo |= DOMAGIC_ | (f & DOGLOB);
700 				*dp++ = MAGIC;
701 			} else if (ISMAGIC(c)) {
702 				fdo |= DOMAGIC_;
703 				*dp++ = MAGIC;
704 			}
705 			*dp++ = c; /* save output char */
706 			word = IFS_WORD;
707 		}
708 	}
709 }
710 
711 /*
712  * Prepare to generate the string returned by ${} substitution.
713  */
714 static int
715 varsub(xp, sp, word, stypep, slenp)
716 	Expand *xp;
717 	char *sp;
718 	char *word;
719 	int *stypep;	/* becomes qualifier type */
720 	int *slenp;	/* " " len (=, :=, etc.) valid iff *stypep != 0 */
721 {
722 	int c;
723 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
724 	int stype;	/* substitution type */
725 	int slen;
726 	char *p;
727 	struct tbl *vp;
728 
729 	if (sp[0] == '\0')	/* Bad variable name */
730 		return -1;
731 
732 	xp->var = (struct tbl *) 0;
733 
734 	/* ${#var}, string length or array size */
735 	if (sp[0] == '#' && (c = sp[1]) != '\0') {
736 		int zero_ok = 0;
737 
738 		/* Can't have any modifiers for ${#...} */
739 		if (*word != CSUBST)
740 			return -1;
741 		sp++;
742 		/* Check for size of array */
743 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
744 			int n = 0;
745 			int max = 0;
746 			vp = global(arrayname(sp));
747 			if (vp->flag & (ISSET|ARRAY))
748 				zero_ok = 1;
749 			for (; vp; vp = vp->u.array)
750 				if (vp->flag & ISSET) {
751 					max = vp->index + 1;
752 					n++;
753 				}
754 			c = n; /* ksh88/ksh93 go for number, not max index */
755 		} else if (c == '*' || c == '@')
756 			c = e->loc->argc;
757 		else {
758 			p = str_val(global(sp));
759 			zero_ok = p != null;
760 			c = strlen(p);
761 		}
762 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
763 			errorf("%s: parameter not set", sp);
764 		*stypep = 0; /* unqualified variable/string substitution */
765 		xp->str = str_save(ulton((unsigned long)c, 10), ATEMP);
766 		return XSUB;
767 	}
768 
769 	/* Check for qualifiers in word part */
770 	stype = 0;
771 	c = word[slen = 0] == CHAR ? word[1] : 0;
772 	if (c == ':') {
773 		slen += 2;
774 		stype = 0x80;
775 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
776 	}
777 	if (ctype(c, C_SUBOP1)) {
778 		slen += 2;
779 		stype |= c;
780 	} else if (ctype(c, C_SUBOP2)) { /* Note: ksh88 allows :%, :%%, etc */
781 		slen += 2;
782 		stype = c;
783 		if (word[slen + 0] == CHAR && c == word[slen + 1]) {
784 			stype |= 0x80;
785 			slen += 2;
786 		}
787 	} else if (stype)	/* : is not ok */
788 		return -1;
789 	if (!stype && *word != CSUBST)
790 		return -1;
791 	*stypep = stype;
792 	*slenp = slen;
793 
794 	c = sp[0];
795 	if (c == '*' || c == '@') {
796 		switch (stype & 0x7f) {
797 		  case '=':	/* can't assign to a vector */
798 		  case '%':	/* can't trim a vector (yet) */
799 		  case '#':
800 			return -1;
801 		}
802 		if (e->loc->argc == 0) {
803 			xp->str = null;
804 			state = c == '@' ? XNULLSUB : XSUB;
805 		} else {
806 			xp->u.strv = (const char **) e->loc->argv + 1;
807 			xp->str = *xp->u.strv++;
808 			xp->split = c == '@'; /* $@ */
809 			state = XARG;
810 		}
811 	} else {
812 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
813 			XPtrV wv;
814 
815 			switch (stype & 0x7f) {
816 			  case '=':	/* can't assign to a vector */
817 			  case '%':	/* can't trim a vector (yet) */
818 			  case '#':
819 				return -1;
820 			}
821 			XPinit(wv, 32);
822 			vp = global(arrayname(sp));
823 			for (; vp; vp = vp->u.array) {
824 				if (!(vp->flag&ISSET))
825 					continue;
826 				XPput(wv, str_val(vp));
827 			}
828 			if (XPsize(wv) == 0) {
829 				xp->str = null;
830 				state = p[1] == '@' ? XNULLSUB : XSUB;
831 				XPfree(wv);
832 			} else {
833 				XPput(wv, 0);
834 				xp->u.strv = (const char **) XPptrv(wv);
835 				xp->str = *xp->u.strv++;
836 				xp->split = p[1] == '@'; /* ${foo[@]} */
837 				state = XARG;
838 			}
839 		} else {
840 			/* Can't assign things like $! or $1 */
841 			if ((stype & 0x7f) == '='
842 			    && (ctype(*sp, C_VAR1) || digit(*sp)))
843 				return -1;
844 			xp->var = global(sp);
845 			xp->str = str_val(xp->var);
846 			state = XSUB;
847 		}
848 	}
849 
850 	c = stype&0x7f;
851 	/* test the compiler's code generator */
852 	if (ctype(c, C_SUBOP2) ||
853 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
854 	     c == '=' || c == '-' || c == '?' : c == '+'))
855 		state = XBASE;	/* expand word instead of variable value */
856 	if (Flag(FNOUNSET) && xp->str == null
857 	    && (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
858 		errorf("%s: parameter not set", sp);
859 	return state;
860 }
861 
862 /*
863  * Run the command in $(...) and read its output.
864  */
865 static int
866 comsub(xp, cp)
867 	register Expand *xp;
868 	char *cp;
869 {
870 	Source *s, *sold;
871 	register struct op *t;
872 	struct shf *shf;
873 
874 	s = pushs(SSTRING, ATEMP);
875 	s->start = s->str = cp;
876 	sold = source;
877 	t = compile(s);
878 	afree(s, ATEMP);
879 	source = sold;
880 
881 	if (t == NULL)
882 		return XBASE;
883 
884 	if (t != NULL && t->type == TCOM && /* $(<file) */
885 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
886 		register struct ioword *io = *t->ioact;
887 		char *name;
888 
889 		if ((io->flag&IOTYPE) != IOREAD)
890 			errorf("funny $() command: %s",
891 				snptreef((char *) 0, 32, "%R", io));
892 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
893 			SHF_MAPHI|SHF_CLEXEC);
894 		if (shf == NULL)
895 			errorf("%s: cannot open $() input", name);
896 		xp->split = 0;	/* no waitlast() */
897 	} else {
898 		int ofd1, pv[2];
899 		openpipe(pv);
900 		shf = shf_fdopen(pv[0], SHF_RD, (struct shf *) 0);
901 		ofd1 = savefd(1, 0);	/* fd 1 may be closed... */
902 		if (pv[1] != 1) {
903 			ksh_dup2(pv[1], 1, FALSE);
904 			close(pv[1]);
905 		}
906 		execute(t, XFORK|XXCOM|XPIPEO);
907 		restfd(1, ofd1);
908 		startlast();
909 		xp->split = 1;	/* waitlast() */
910 	}
911 
912 	xp->u.shf = shf;
913 	return XCOM;
914 }
915 
916 /*
917  * perform #pattern and %pattern substitution in ${}
918  */
919 
920 static char *
921 trimsub(str, pat, how)
922 	register char *str;
923 	char *pat;
924 	int how;
925 {
926 	register char *end = strchr(str, 0);
927 	register char *p, c;
928 
929 	switch (how&0xff) {	/* UCHAR_MAX maybe? */
930 	  case '#':		/* shortest at beginning */
931 		for (p = str; p <= end; p++) {
932 			c = *p; *p = '\0';
933 			if (gmatch(str, pat, FALSE)) {
934 				*p = c;
935 				return p;
936 			}
937 			*p = c;
938 		}
939 		break;
940 	  case '#'|0x80:	/* longest match at beginning */
941 		for (p = end; p >= str; p--) {
942 			c = *p; *p = '\0';
943 			if (gmatch(str, pat, FALSE)) {
944 				*p = c;
945 				return p;
946 			}
947 			*p = c;
948 		}
949 		break;
950 	  case '%':		/* shortest match at end */
951 		for (p = end; p >= str; p--) {
952 			if (gmatch(p, pat, FALSE))
953 				return str_nsave(str, p - str, ATEMP);
954 		}
955 		break;
956 	  case '%'|0x80:	/* longest match at end */
957 		for (p = str; p <= end; p++) {
958 			if (gmatch(p, pat, FALSE))
959 				return str_nsave(str, p - str, ATEMP);
960 		}
961 		break;
962 	}
963 
964 	return str;		/* no match, return string */
965 }
966 
967 /*
968  * glob
969  * Name derived from V6's /etc/glob, the program that expanded filenames.
970  */
971 
972 /* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
973 static void
974 glob(cp, wp, markdirs)
975 	char *cp;
976 	register XPtrV *wp;
977 	int markdirs;
978 {
979 	int oldsize = XPsize(*wp);
980 
981 	if (glob_str(cp, wp, markdirs) == 0)
982 		XPput(*wp, debunk(cp, cp, strlen(cp) + 1));
983 	else
984 		qsortp(XPptrv(*wp) + oldsize, (size_t)(XPsize(*wp) - oldsize),
985 			xstrcmp);
986 }
987 
988 #define GF_NONE		0
989 #define GF_EXCHECK	BIT(0)		/* do existence check on file */
990 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
991 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
992 
993 /* Apply file globbing to cp and store the matching files in wp.  Returns
994  * the number of matches found.
995  */
996 int
997 glob_str(cp, wp, markdirs)
998 	char *cp;
999 	XPtrV *wp;
1000 	int markdirs;
1001 {
1002 	int oldsize = XPsize(*wp);
1003 	XString xs;
1004 	char *xp;
1005 
1006 	Xinit(xs, xp, 256, ATEMP);
1007 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
1008 	Xfree(xs, xp);
1009 
1010 	return XPsize(*wp) - oldsize;
1011 }
1012 
1013 static void
1014 globit(xs, xpp, sp, wp, check)
1015 	XString *xs;		/* dest string */
1016 	char **xpp;		/* ptr to dest end */
1017 	char *sp;		/* source path */
1018 	register XPtrV *wp;	/* output list */
1019 	int check;		/* GF_* flags */
1020 {
1021 	register char *np;	/* next source component */
1022 	char *xp = *xpp;
1023 	char *se;
1024 	char odirsep;
1025 
1026 	/* This to allow long expansions to be interrupted */
1027 	intrcheck();
1028 
1029 	if (sp == NULL) {	/* end of source path */
1030 		/* We only need to check if the file exists if a pattern
1031 		 * is followed by a non-pattern (eg, foo*x/bar; no check
1032 		 * is needed for foo* since the match must exist) or if
1033 		 * any patterns were expanded and the markdirs option is set.
1034 		 * Symlinks make things a bit tricky...
1035 		 */
1036 		if ((check & GF_EXCHECK)
1037 		    || ((check & GF_MARKDIR) && (check & GF_GLOBBED)))
1038 		{
1039 #define stat_check()	(stat_done ? stat_done : \
1040 			    (stat_done = stat(Xstring(*xs, xp), &statb) < 0 \
1041 				? -1 : 1))
1042 			struct stat lstatb, statb;
1043 			int stat_done = 0;	 /* -1: failed, 1 ok */
1044 
1045 			if (lstat(Xstring(*xs, xp), &lstatb) < 0)
1046 				return;
1047 			/* special case for systems which strip trailing
1048 			 * slashes from regular files (eg, /etc/passwd/).
1049 			 * SunOS 4.1.3 does this...
1050 			 */
1051 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp)
1052 			    && ISDIRSEP(xp[-1]) && !S_ISDIR(lstatb.st_mode)
1053 #ifdef S_ISLNK
1054 			    && (!S_ISLNK(lstatb.st_mode)
1055 				|| stat_check() < 0
1056 				|| !S_ISDIR(statb.st_mode))
1057 #endif /* S_ISLNK */
1058 				)
1059 				return;
1060 			/* Possibly tack on a trailing / if there isn't already
1061 			 * one and if the file is a directory or a symlink to a
1062 			 * directory
1063 			 */
1064 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED))
1065 			    && xp > Xstring(*xs, xp) && !ISDIRSEP(xp[-1])
1066 			    && (S_ISDIR(lstatb.st_mode)
1067 #ifdef S_ISLNK
1068 				|| (S_ISLNK(lstatb.st_mode)
1069 				    && stat_check() > 0
1070 				    && S_ISDIR(statb.st_mode))
1071 #endif /* S_ISLNK */
1072 				    ))
1073 			{
1074 				*xp++ = DIRSEP;
1075 				*xp = '\0';
1076 			}
1077 		}
1078 #ifdef OS2 /* Done this way to avoid bug in gcc 2.7.2... */
1079     /* Ugly kludge required for command
1080      * completion - see how search_access()
1081      * is implemented for OS/2...
1082      */
1083 # define KLUDGE_VAL	4
1084 #else /* OS2 */
1085 # define KLUDGE_VAL	0
1086 #endif /* OS2 */
1087 		XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp)
1088 			+ KLUDGE_VAL, ATEMP));
1089 		return;
1090 	}
1091 
1092 	if (xp > Xstring(*xs, xp))
1093 		*xp++ = DIRSEP;
1094 	while (ISDIRSEP(*sp)) {
1095 		Xcheck(*xs, xp);
1096 		*xp++ = *sp++;
1097 	}
1098 	np = ksh_strchr_dirsep(sp);
1099 	if (np != NULL) {
1100 		se = np;
1101 		odirsep = *np;	/* don't assume DIRSEP, can be multiple kinds */
1102 		*np++ = '\0';
1103 	} else {
1104 		odirsep = '\0'; /* keep gcc quiet */
1105 		se = sp + strlen(sp);
1106 	}
1107 
1108 
1109 	/* Check if sp needs globbing - done to avoid pattern checks for strings
1110 	 * containing MAGIC characters, open ['s without the matching close ],
1111 	 * etc. (otherwise opendir() will be called which may fail because the
1112 	 * directory isn't readable - if no globbing is needed, only execute
1113 	 * permission should be required (as per POSIX)).
1114 	 */
1115 	if (!has_globbing(sp, se)) {
1116 		XcheckN(*xs, xp, se - sp + 1);
1117 		debunk(xp, sp, Xnleft(*xs, xp));
1118 		xp += strlen(xp);
1119 		*xpp = xp;
1120 		globit(xs, xpp, np, wp, check);
1121 	} else {
1122 		DIR *dirp;
1123 		struct dirent *d;
1124 		char *name;
1125 		int len;
1126 		int prefix_len;
1127 
1128 		/* xp = *xpp;	   copy_non_glob() may have re-alloc'd xs */
1129 		*xp = '\0';
1130 		prefix_len = Xlength(*xs, xp);
1131 		dirp = ksh_opendir(prefix_len ? Xstring(*xs, xp) : ".");
1132 		if (dirp == NULL)
1133 			goto Nodir;
1134 		while ((d = readdir(dirp)) != NULL) {
1135 			name = d->d_name;
1136 			if ((*name == '.' && *sp != '.')
1137 			    || !gmatch(name, sp, TRUE))
1138 				continue;
1139 
1140 			len = NLENGTH(d) + 1;
1141 			XcheckN(*xs, xp, len);
1142 			memcpy(xp, name, len);
1143 			*xpp = xp + len - 1;
1144 			globit(xs, xpp, np, wp,
1145 				(check & GF_MARKDIR) | GF_GLOBBED
1146 				| (np ? GF_EXCHECK : GF_NONE));
1147 			xp = Xstring(*xs, xp) + prefix_len;
1148 		}
1149 		closedir(dirp);
1150 	  Nodir:;
1151 	}
1152 
1153 	if (np != NULL)
1154 		*--np = odirsep;
1155 }
1156 
1157 #if 0
1158 /* Check if p contains something that needs globbing; if it does, 0 is
1159  * returned; if not, p is copied into xs/xp after stripping any MAGICs
1160  */
1161 static int	copy_non_glob ARGS((XString *xs, char **xpp, char *p));
1162 static int
1163 copy_non_glob(xs, xpp, p)
1164 	XString *xs;
1165 	char **xpp;
1166 	char *p;
1167 {
1168 	char *xp;
1169 	int len = strlen(p);
1170 
1171 	XcheckN(*xs, *xpp, len);
1172 	xp = *xpp;
1173 	for (; *p; p++) {
1174 		if (ISMAGIC(*p)) {
1175 			int c = *++p;
1176 
1177 			if (c == '*' || c == '?')
1178 				return 0;
1179 			if (*p == '[') {
1180 				char *q = p + 1;
1181 
1182 				if (ISMAGIC(*q) && q[1] == NOT)
1183 					q += 2;
1184 				if (ISMAGIC(*q) && q[1] == ']')
1185 					q += 2;
1186 				for (; *q; q++)
1187 					if (ISMAGIC(*q) && *++q == ']')
1188 						return 0;
1189 				/* pass a literal [ through */
1190 			}
1191 			/* must be a MAGIC-MAGIC, or MAGIC-!, MAGIC--, etc. */
1192 		}
1193 		*xp++ = *p;
1194 	}
1195 	*xp = '\0';
1196 	*xpp = xp;
1197 	return 1;
1198 }
1199 #endif /* 0 */
1200 
1201 /* remove MAGIC from string */
1202 char *
1203 debunk(dp, sp, dlen)
1204 	char *dp;
1205 	const char *sp;
1206 	size_t dlen;
1207 {
1208 	char *d, *s;
1209 
1210 	if ((s = strchr(sp, MAGIC))) {
1211 		if (s - sp >= dlen)
1212 			return dp;
1213 		memcpy(dp, sp, s - sp);
1214 		for (d = dp + (s - sp); *s && (d - dp < dlen); s++)
1215 			if (!ISMAGIC(*s) || !(*++s & 0x80)
1216 			    || !strchr("*+?@! ", *s & 0x7f))
1217 				*d++ = *s;
1218 			else {
1219 				/* extended pattern operators: *+?@! */
1220 				if ((*s & 0x7f) != ' ')
1221 					*d++ = *s & 0x7f;
1222 				if (d - dp < dlen)
1223 					*d++ = '(';
1224 			}
1225 		*d = '\0';
1226 	} else if (dp != sp)
1227 		strlcpy(dp, sp, dlen);
1228 	return dp;
1229 }
1230 
1231 /* Check if p is an unquoted name, possibly followed by a / or :.  If so
1232  * puts the expanded version in *dcp,dp and returns a pointer in p just
1233  * past the name, otherwise returns 0.
1234  */
1235 static char *
1236 maybe_expand_tilde(p, dsp, dpp, isassign)
1237 	char *p;
1238 	XString *dsp;
1239 	char **dpp;
1240 	int isassign;
1241 {
1242 	XString ts;
1243 	char *dp = *dpp;
1244 	char *tp, *r;
1245 
1246 	Xinit(ts, tp, 16, ATEMP);
1247 	/* : only for DOASNTILDE form */
1248 	while (p[0] == CHAR && !ISDIRSEP(p[1])
1249 	       && (!isassign || p[1] != PATHSEP))
1250 	{
1251 		Xcheck(ts, tp);
1252 		*tp++ = p[1];
1253 		p += 2;
1254 	}
1255 	*tp = '\0';
1256 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ? tilde(Xstring(ts, tp)) : (char *) 0;
1257 	Xfree(ts, tp);
1258 	if (r) {
1259 		while (*r) {
1260 			Xcheck(*dsp, dp);
1261 			if (ISMAGIC(*r))
1262 				*dp++ = MAGIC;
1263 			*dp++ = *r++;
1264 		}
1265 		*dpp = dp;
1266 		r = p;
1267 	}
1268 	return r;
1269 }
1270 
1271 /*
1272  * tilde expansion
1273  *
1274  * based on a version by Arnold Robbins
1275  */
1276 
1277 static char *
1278 tilde(cp)
1279 	char *cp;
1280 {
1281 	char *dp;
1282 
1283 	if (cp[0] == '\0')
1284 		dp = str_val(global("HOME"));
1285 	else if (cp[0] == '+' && cp[1] == '\0')
1286 		dp = str_val(global("PWD"));
1287 	else if (cp[0] == '-' && cp[1] == '\0')
1288 		dp = str_val(global("OLDPWD"));
1289 	else
1290 		dp = homedir(cp);
1291 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
1292 	if (dp == null)
1293 		dp = (char *) 0;
1294 	return dp;
1295 }
1296 
1297 /*
1298  * map userid to user's home directory.
1299  * note that 4.3's getpw adds more than 6K to the shell,
1300  * and the YP version probably adds much more.
1301  * we might consider our own version of getpwnam() to keep the size down.
1302  */
1303 
1304 static char *
1305 homedir(name)
1306 	char *name;
1307 {
1308 	register struct tbl *ap;
1309 
1310 	ap = tenter(&homedirs, name, hash(name));
1311 	if (!(ap->flag & ISSET)) {
1312 #ifdef OS2
1313 		/* No usernames in OS2 - punt */
1314 		return NULL;
1315 #else /* OS2 */
1316 		struct passwd *pw;
1317 		size_t n;
1318 
1319 		pw = getpwnam(name);
1320 		if (pw == NULL)
1321 			return NULL;
1322 		n = strlen(pw->pw_dir);
1323 		if (n > 0 && '/' != pw->pw_dir[n - 1]) {
1324 			ap->val.s = str_nsave(pw->pw_dir, n + 1, APERM);
1325 			ap->val.s[n] = '/';
1326 			ap->val.s[n + 1] = '\0';
1327 		} else {
1328 			ap->val.s = str_save(pw->pw_dir, APERM);
1329 		}
1330 		ap->flag |= DEFINED|ISSET|ALLOC;
1331 #endif /* OS2 */
1332 	}
1333 	return ap->val.s;
1334 }
1335 
1336 #ifdef BRACE_EXPAND
1337 static void
1338 alt_expand(wp, start, exp_start, end, fdo)
1339 	XPtrV *wp;
1340 	char *start, *exp_start;
1341 	char *end;
1342 	int fdo;
1343 {
1344 	int UNINITIALIZED(count);
1345 	char *brace_start, *brace_end, *UNINITIALIZED(comma);
1346 	char *field_start;
1347 	char *p;
1348 
1349 	/* search for open brace */
1350 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != OBRACE; p += 2)
1351 		;
1352 	brace_start = p;
1353 
1354 	/* find matching close brace, if any */
1355 	if (p) {
1356 		comma = (char *) 0;
1357 		count = 1;
1358 		for (p += 2; *p && count; p++) {
1359 			if (ISMAGIC(*p)) {
1360 				if (*++p == OBRACE)
1361 					count++;
1362 				else if (*p == CBRACE)
1363 					--count;
1364 				else if (*p == ',' && count == 1)
1365 					comma = p;
1366 			}
1367 		}
1368 	}
1369 	/* no valid expansions... */
1370 	if (!p || count != 0) {
1371 		/* Note that given a{{b,c} we do not expand anything (this is
1372 		 * what at&t ksh does.  This may be changed to do the {b,c}
1373 		 * expansion. }
1374 		 */
1375 		if (fdo & DOGLOB)
1376 			glob(start, wp, fdo & DOMARKDIRS);
1377 		else
1378 			XPput(*wp, debunk(start, start, end - start));
1379 		return;
1380 	}
1381 	brace_end = p;
1382 	if (!comma) {
1383 		alt_expand(wp, start, brace_end, end, fdo);
1384 		return;
1385 	}
1386 
1387 	/* expand expression */
1388 	field_start = brace_start + 2;
1389 	count = 1;
1390 	for (p = brace_start + 2; p != brace_end; p++) {
1391 		if (ISMAGIC(*p)) {
1392 			if (*++p == OBRACE)
1393 				count++;
1394 			else if ((*p == CBRACE && --count == 0)
1395 				 || (*p == ',' && count == 1))
1396 			{
1397 				char *new;
1398 				int l1, l2, l3;
1399 
1400 				l1 = brace_start - start;
1401 				l2 = (p - 1) - field_start;
1402 				l3 = end - brace_end;
1403 				new = (char *) alloc(l1 + l2 + l3 + 1, ATEMP);
1404 				memcpy(new, start, l1);
1405 				memcpy(new + l1, field_start, l2);
1406 				memcpy(new + l1 + l2, brace_end, l3);
1407 				new[l1 + l2 + l3] = '\0';
1408 				alt_expand(wp, new, new + l1,
1409 					   new + l1 + l2 + l3, fdo);
1410 				field_start = p + 1;
1411 			}
1412 		}
1413 	}
1414 	return;
1415 }
1416 #endif /* BRACE_EXPAND */
1417