xref: /netbsd-src/bin/ksh/eval.c (revision 4b896b232495b7a9b8b94a1cf1e21873296d53b8)
1 /*	$NetBSD: eval.c,v 1.4 2003/06/23 11:38:55 agc Exp $	*/
2 
3 /*
4  * Expansion - quoting, separation, substitution, globbing
5  */
6 #include <sys/cdefs.h>
7 
8 #ifndef lint
9 __RCSID("$NetBSD: eval.c,v 1.4 2003/06/23 11:38:55 agc Exp $");
10 #endif
11 
12 
13 #include "sh.h"
14 #include <pwd.h>
15 #include "ksh_dir.h"
16 #include "ksh_stat.h"
17 
18 /*
19  * string expansion
20  *
21  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
22  * second pass: alternation ({,}), filename expansion (*?[]).
23  */
24 
25 /* expansion generator state */
26 typedef struct Expand {
27 	/* int  type; */	/* see expand() */
28 	const char *str;	/* string */
29 	union {
30 		const char **strv;/* string[] */
31 		struct shf *shf;/* file */
32 	} u;			/* source */
33 	struct tbl *var;	/* variable in ${var..} */
34 	short	split;		/* split "$@" / call waitlast $() */
35 } Expand;
36 
37 #define	XBASE		0	/* scanning original */
38 #define	XSUB		1	/* expanding ${} string */
39 #define	XARGSEP		2	/* ifs0 between "$*" */
40 #define	XARG		3	/* expanding $*, $@ */
41 #define	XCOM		4	/* expanding $() */
42 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
43 
44 /* States used for field splitting */
45 #define IFS_WORD	0	/* word has chars (or quotes) */
46 #define IFS_WS		1	/* have seen IFS white-space */
47 #define IFS_NWS		2	/* have seen IFS non-white-space */
48 
49 static	int	varsub ARGS((Expand *xp, char *sp, char *word, int *stypep, int *slenp));
50 static	int	comsub ARGS((Expand *xp, char *cp));
51 static	char   *trimsub ARGS((char *str, char *pat, int how));
52 static	void	glob ARGS((char *cp, XPtrV *wp, int markdirs));
53 static	void	globit ARGS((XString *xs, char **xpp, char *sp, XPtrV *wp,
54 			     int check));
55 static char	*maybe_expand_tilde ARGS((char *p, XString *dsp, char **dpp,
56 					  int isassign));
57 static	char   *tilde ARGS((char *acp));
58 static	char   *homedir ARGS((char *name));
59 #ifdef BRACE_EXPAND
60 static void	alt_expand ARGS((XPtrV *wp, char *start, char *exp_start,
61 				 char *end, int fdo));
62 #endif
63 
64 /* compile and expand word */
65 char *
66 substitute(cp, f)
67 	const char *cp;
68 	int f;
69 {
70 	struct source *s, *sold;
71 
72 	sold = source;
73 	s = pushs(SWSTR, ATEMP);
74 	s->start = s->str = cp;
75 	source = s;
76 	if (yylex(ONEWORD) != LWORD)
77 		internal_errorf(1, "substitute");
78 	source = sold;
79 	afree(s, ATEMP);
80 	return evalstr(yylval.cp, f);
81 }
82 
83 /*
84  * expand arg-list
85  */
86 char **
87 eval(ap, f)
88 	register char **ap;
89 	int f;
90 {
91 	XPtrV w;
92 
93 	if (*ap == NULL)
94 		return ap;
95 	XPinit(w, 32);
96 	XPput(w, NULL);		/* space for shell name */
97 #ifdef	SHARPBANG
98 	XPput(w, NULL);		/* and space for one arg */
99 #endif
100 	while (*ap != NULL)
101 		expand(*ap++, &w, f);
102 	XPput(w, NULL);
103 #ifdef	SHARPBANG
104 	return (char **) XPclose(w) + 2;
105 #else
106 	return (char **) XPclose(w) + 1;
107 #endif
108 }
109 
110 /*
111  * expand string
112  */
113 char *
114 evalstr(cp, f)
115 	char *cp;
116 	int f;
117 {
118 	XPtrV w;
119 
120 	XPinit(w, 1);
121 	expand(cp, &w, f);
122 	cp = (XPsize(w) == 0) ? null : (char*) *XPptrv(w);
123 	XPfree(w);
124 	return cp;
125 }
126 
127 /*
128  * expand string - return only one component
129  * used from iosetup to expand redirection files
130  */
131 char *
132 evalonestr(cp, f)
133 	register char *cp;
134 	int f;
135 {
136 	XPtrV w;
137 
138 	XPinit(w, 1);
139 	expand(cp, &w, f);
140 	switch (XPsize(w)) {
141 	case 0:
142 		cp = null;
143 		break;
144 	case 1:
145 		cp = (char*) *XPptrv(w);
146 		break;
147 	default:
148 		cp = evalstr(cp, f&~DOGLOB);
149 		break;
150 	}
151 	XPfree(w);
152 	return cp;
153 }
154 
155 /* for nested substitution: ${var:=$var2} */
156 typedef struct SubType {
157 	short	stype;		/* [=+-?%#] action after expanded word */
158 	short	base;		/* begin position of expanded word */
159 	short	f;		/* saved value of f (DOPAT, etc) */
160 	struct tbl *var;	/* variable for ${var..} */
161 	short	quote;		/* saved value of quote (for ${..[%#]..}) */
162 	struct SubType *prev;	/* old type */
163 	struct SubType *next;	/* poped type (to avoid re-allocating) */
164 } SubType;
165 
166 void
167 expand(cp, wp, f)
168 	char *cp;		/* input word */
169 	register XPtrV *wp;	/* output words */
170 	int f;			/* DO* flags */
171 {
172 	register int UNINITIALIZED(c);
173 	register int type;	/* expansion type */
174 	register int quote = 0;	/* quoted */
175 	XString ds;		/* destination string */
176 	register char *dp, *sp;	/* dest., source */
177 	int fdo, word;		/* second pass flags; have word */
178 	int doblank;		/* field spliting of parameter/command subst */
179 	Expand x;		/* expansion variables */
180 	SubType st_head, *st;
181 	int UNINITIALIZED(newlines); /* For trailing newlines in COMSUB */
182 	int saw_eq, tilde_ok;
183 	int make_magic;
184 
185 	if (cp == NULL)
186 		internal_errorf(1, "expand(NULL)");
187 	/* for alias, readonly, set, typeset commands */
188 	if ((f & DOVACHECK) && is_wdvarassign(cp)) {
189 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
190 		f |= DOASNTILDE;
191 	}
192 	if (Flag(FNOGLOB))
193 		f &= ~DOGLOB;
194 	if (Flag(FMARKDIRS))
195 		f |= DOMARKDIRS;
196 #ifdef BRACE_EXPAND
197 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
198 		f |= DOBRACE_;
199 #endif /* BRACE_EXPAND */
200 
201 	Xinit(ds, dp, 128, ATEMP);	/* init dest. string */
202 	type = XBASE;
203 	sp = cp;
204 	fdo = 0;
205 	saw_eq = 0;
206 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0; /* must be 1/0 */
207 	doblank = 0;
208 	make_magic = 0;
209 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
210 	st_head.next = (SubType *) 0;
211 	st = &st_head;
212 
213 	while (1) {
214 		Xcheck(ds, dp);
215 
216 		switch (type) {
217 		  case XBASE:	/* original prefixed string */
218 			c = *sp++;
219 			switch (c) {
220 			  case EOS:
221 				c = 0;
222 				break;
223 			  case CHAR:
224 				c = *sp++;
225 				break;
226 			  case QCHAR:
227 				quote |= 2; /* temporary quote */
228 				c = *sp++;
229 				break;
230 			  case OQUOTE:
231 				word = IFS_WORD;
232 				tilde_ok = 0;
233 				quote = 1;
234 				continue;
235 			  case CQUOTE:
236 				quote = 0;
237 				continue;
238 			  case COMSUB:
239 				tilde_ok = 0;
240 				if (f & DONTRUNCOMMAND) {
241 					word = IFS_WORD;
242 					*dp++ = '$'; *dp++ = '(';
243 					while (*sp != '\0') {
244 						Xcheck(ds, dp);
245 						*dp++ = *sp++;
246 					}
247 					*dp++ = ')';
248 				} else {
249 					type = comsub(&x, sp);
250 					if (type == XCOM && (f&DOBLANK))
251 						doblank++;
252 					sp = strchr(sp, 0) + 1;
253 					newlines = 0;
254 				}
255 				continue;
256 			  case EXPRSUB:
257 				word = IFS_WORD;
258 				tilde_ok = 0;
259 				if (f & DONTRUNCOMMAND) {
260 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
261 					while (*sp != '\0') {
262 						Xcheck(ds, dp);
263 						*dp++ = *sp++;
264 					}
265 					*dp++ = ')'; *dp++ = ')';
266 				} else {
267 					struct tbl v;
268 					char *p;
269 
270 					v.flag = DEFINED|ISSET|INTEGER;
271 					v.type = 10; /* not default */
272 					v.name[0] = '\0';
273 					v_evaluate(&v, substitute(sp, 0),
274 						KSH_UNWIND_ERROR);
275 					sp = strchr(sp, 0) + 1;
276 					for (p = str_val(&v); *p; ) {
277 						Xcheck(ds, dp);
278 						*dp++ = *p++;
279 					}
280 				}
281 				continue;
282 			  case OSUBST: /* ${{#}var{:}[=+-?#%]word} */
283 			  /* format is:
284 			   *   OSUBST [{x] plain-variable-part \0
285 			   *     compiled-word-part CSUBST [}x]
286 			   * This is were all syntax checking gets done...
287 			   */
288 			  {
289 				char *varname = ++sp; /* skip the { or x (}) */
290 				int stype;
291 				int slen;
292 
293 				sp = strchr(sp, '\0') + 1; /* skip variable */
294 				type = varsub(&x, varname, sp, &stype, &slen);
295 				if (type < 0) {
296 					char endc;
297 					char *str, *end;
298 
299 					end = (char *) wdscan(sp, CSUBST);
300 					/* ({) the } or x is already skipped */
301 					endc = *end;
302 					*end = EOS;
303 					str = snptreef((char *) 0, 64, "%S",
304 							varname - 1);
305 					*end = endc;
306 					errorf("%s: bad substitution", str);
307 				}
308 				if (f&DOBLANK)
309 					doblank++;
310 				tilde_ok = 0;
311 				if (type == XBASE) {	/* expand? */
312 					if (!st->next) {
313 						SubType *newst;
314 
315 						newst = (SubType *) alloc(
316 							sizeof(SubType), ATEMP);
317 						newst->next = (SubType *) 0;
318 						newst->prev = st;
319 						st->next = newst;
320 					}
321 					st = st->next;
322 					st->stype = stype;
323 					st->base = Xsavepos(ds, dp);
324 					st->f = f;
325 					st->var = x.var;
326 					st->quote = quote;
327 					/* skip qualifier(s) */
328 					if (stype)
329 						sp += slen;
330 					switch (stype & 0x7f) {
331 					  case '#':
332 					  case '%':
333 						/* ! DOBLANK,DOBRACE_,DOTILDE */
334 						f = DOPAT | (f&DONTRUNCOMMAND)
335 						    | DOTEMP_;
336 						quote = 0;
337 						/* Prepend open pattern (so |
338 						 * in a trim will work as
339 						 * expected)
340 						 */
341 						*dp++ = MAGIC;
342 						*dp++ = '@' + 0x80;
343 						break;
344 					  case '=':
345 						/* Enabling tilde expansion
346 						 * after :'s here is
347 						 * non-standard ksh, but is
348 						 * consistent with rules for
349 						 * other assignments.  Not
350 						 * sure what POSIX thinks of
351 						 * this.
352 						 * Not doing tilde expansion
353 						 * for integer variables is a
354 						 * non-POSIX thing - makes
355 						 * sense though, since ~ is
356 						 * a arithmetic operator.
357 						 */
358 						if (!(x.var->flag & INTEGER))
359 							f |= DOASNTILDE|DOTILDE;
360 						f |= DOTEMP_;
361 						/* These will be done after the
362 						 * value has been assigned.
363 						 */
364 						f &= ~(DOBLANK|DOGLOB|DOBRACE_);
365 						tilde_ok = 1;
366 						break;
367 					  case '?':
368 						f &= ~DOBLANK;
369 						f |= DOTEMP_;
370 						/* fall through */
371 					  default:
372 						/* Enable tilde expansion */
373 						tilde_ok = 1;
374 						f |= DOTILDE;
375 					}
376 				} else
377 					/* skip word */
378 					sp = (char *) wdscan(sp, CSUBST);
379 				continue;
380 			  }
381 			  case CSUBST: /* only get here if expanding word */
382 				sp++; /* ({) skip the } or x */
383 				tilde_ok = 0;	/* in case of ${unset:-} */
384 				*dp = '\0';
385 				quote = st->quote;
386 				f = st->f;
387 				if (f&DOBLANK)
388 					doblank--;
389 				switch (st->stype&0x7f) {
390 				  case '#':
391 				  case '%':
392 					/* Append end-pattern */
393 					*dp++ = MAGIC; *dp++ = ')'; *dp = '\0';
394 					dp = Xrestpos(ds, dp, st->base);
395 					/* Must use st->var since calling
396 					 * global would break things
397 					 * like x[i+=1].
398 					 */
399 					x.str = trimsub(str_val(st->var),
400 						dp, st->stype);
401 					type = XSUB;
402 					if (f&DOBLANK)
403 						doblank++;
404 					st = st->prev;
405 					continue;
406 				  case '=':
407 					/* Restore our position and substitute
408 					 * the value of st->var (may not be
409 					 * the assigned value in the presence
410 					 * of integer/right-adj/etc attributes).
411 					 */
412 					dp = Xrestpos(ds, dp, st->base);
413 					/* Must use st->var since calling
414 					 * global would cause with things
415 					 * like x[i+=1] to be evaluated twice.
416 					 */
417 					/* Note: not exported by FEXPORT
418 					 * in at&t ksh.
419 					 */
420 					/* XXX POSIX says readonly is only
421 					 * fatal for special builtins (setstr
422 					 * does readonly check).
423 					 */
424 					setstr(st->var, debunk(
425 						(char *) alloc(strlen(dp) + 1,
426 							ATEMP), dp),
427 						KSH_UNWIND_ERROR);
428 					x.str = str_val(st->var);
429 					type = XSUB;
430 					if (f&DOBLANK)
431 						doblank++;
432 					st = st->prev;
433 					continue;
434 				  case '?':
435 				    {
436 					char *s = Xrestpos(ds, dp, st->base);
437 
438 					errorf("%s: %s", st->var->name,
439 					    dp == s ?
440 					      "parameter null or not set"
441 					    : (debunk(s, s), s));
442 				    }
443 				}
444 				st = st->prev;
445 				type = XBASE;
446 				continue;
447 
448 			  case OPAT: /* open pattern: *(foo|bar) */
449 				/* Next char is the type of pattern */
450 				make_magic = 1;
451 				c = *sp++ + 0x80;
452 				break;
453 
454 			  case SPAT: /* pattern seperator (|) */
455 				make_magic = 1;
456 				c = '|';
457 				break;
458 
459 			  case CPAT: /* close pattern */
460 				make_magic = 1;
461 				c = /*(*/ ')';
462 				break;
463 			}
464 			break;
465 
466 		  case XNULLSUB:
467 			/* Special case for "$@" (and "${foo[@]}") - no
468 			 * word is generated if $# is 0 (unless there is
469 			 * other stuff inside the quotes).
470 			 */
471 			type = XBASE;
472 			if (f&DOBLANK) {
473 				doblank--;
474 				/* not really correct: x=; "$x$@" should
475 				 * generate a null argument and
476 				 * set A; "${@:+}" shouldn't.
477 				 */
478 				if (dp == Xstring(ds, dp))
479 					word = IFS_WS;
480 			}
481 			continue;
482 
483 		  case XSUB:
484 			if ((c = *x.str++) == 0) {
485 				type = XBASE;
486 				if (f&DOBLANK)
487 					doblank--;
488 				continue;
489 			}
490 			break;
491 
492 		  case XARGSEP:
493 			type = XARG;
494 			quote = 1;
495 		  case XARG:
496 			if ((c = *x.str++) == '\0') {
497 				/* force null words to be created so
498 				 * set -- '' 2 ''; foo "$@" will do
499 				 * the right thing
500 				 */
501 				if (quote && x.split)
502 					word = IFS_WORD;
503 				if ((x.str = *x.u.strv++) == NULL) {
504 					type = XBASE;
505 					if (f&DOBLANK)
506 						doblank--;
507 					continue;
508 				}
509 				c = ifs0;
510 				if (c == 0) {
511 					if (quote && !x.split)
512 						continue;
513 					c = ' ';
514 				}
515 				if (quote && x.split) {
516 					/* terminate word for "$@" */
517 					type = XARGSEP;
518 					quote = 0;
519 				}
520 			}
521 			break;
522 
523 		  case XCOM:
524 			if (newlines) {		/* Spit out saved nl's */
525 				c = '\n';
526 				--newlines;
527 			} else {
528 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
529 				    if (c == '\n')
530 					    newlines++;	/* Save newlines */
531 				if (newlines && c != EOF) {
532 					shf_ungetc(c, x.u.shf);
533 					c = '\n';
534 					--newlines;
535 				}
536 			}
537 			if (c == EOF) {
538 				newlines = 0;
539 				shf_close(x.u.shf);
540 				if (x.split)
541 					subst_exstat = waitlast();
542 				type = XBASE;
543 				if (f&DOBLANK)
544 					doblank--;
545 				continue;
546 			}
547 			break;
548 		}
549 
550 		/* check for end of word or IFS separation */
551 		if (c == 0 || (!quote && (f & DOBLANK) && doblank && !make_magic
552 			       && ctype(c, C_IFS)))
553 		{
554 			/* How words are broken up:
555 			 *		   |       value of c
556 			 *	  word	   |	ws	nws	0
557 			 *	-----------------------------------
558 			 *	IFS_WORD	w/WS	w/NWS	w
559 			 *	IFS_WS		-/WS	w/NWS	-
560 			 *	IFS_NWS		-/NWS	w/NWS	w
561 			 *   (w means generate a word)
562 			 * Note that IFS_NWS/0 generates a word (at&t ksh
563 			 * doesn't do this, but POSIX does).
564 			 */
565 			if (word == IFS_WORD
566 			    || (!ctype(c, C_IFSWS) && (c || word == IFS_NWS)))
567 			{
568 				char *p;
569 
570 				*dp++ = '\0';
571 				p = Xclose(ds, dp);
572 #ifdef BRACE_EXPAND
573 				if (fdo & DOBRACE_)
574 					/* also does globbing */
575 					alt_expand(wp, p, p,
576 						   p + Xlength(ds, (dp - 1)),
577 						   fdo | (f & DOMARKDIRS));
578 				else
579 #endif /* BRACE_EXPAND */
580 				if (fdo & DOGLOB)
581 					glob(p, wp, f & DOMARKDIRS);
582 				else if ((f & DOPAT) || !(fdo & DOMAGIC_))
583 					XPput(*wp, p);
584 				else
585 					XPput(*wp, debunk(p, p));
586 				fdo = 0;
587 				saw_eq = 0;
588 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
589 				if (c != 0)
590 					Xinit(ds, dp, 128, ATEMP);
591 			}
592 			if (c == 0)
593 				return;
594 			if (word != IFS_NWS)
595 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
596 		} else {
597 			/* age tilde_ok info - ~ code tests second bit */
598 			tilde_ok <<= 1;
599 			/* mark any special second pass chars */
600 			if (!quote)
601 				switch (c) {
602 				  case '[':
603 				  case NOT:
604 				  case '-':
605 				  case ']':
606 					/* For character classes - doesn't hurt
607 					 * to have magic !,-,]'s outside of
608 					 * [...] expressions.
609 					 */
610 					if (f & (DOPAT | DOGLOB)) {
611 						fdo |= DOMAGIC_;
612 						if (c == '[')
613 							fdo |= f & DOGLOB;
614 						*dp++ = MAGIC;
615 					}
616 					break;
617 				  case '*':
618 				  case '?':
619 					if (f & (DOPAT | DOGLOB)) {
620 						fdo |= DOMAGIC_ | (f & DOGLOB);
621 						*dp++ = MAGIC;
622 					}
623 					break;
624 #ifdef BRACE_EXPAND
625 				  case OBRACE:
626 				  case ',':
627 				  case CBRACE:
628 					if ((f & DOBRACE_) && (c == OBRACE
629 						|| (fdo & DOBRACE_)))
630 					{
631 						fdo |= DOBRACE_|DOMAGIC_;
632 						*dp++ = MAGIC;
633 					}
634 					break;
635 #endif /* BRACE_EXPAND */
636 				  case '=':
637 					/* Note first unquoted = for ~ */
638 					if (!(f & DOTEMP_) && !saw_eq) {
639 						saw_eq = 1;
640 						tilde_ok = 1;
641 					}
642 					break;
643 				  case PATHSEP: /* : */
644 					/* Note unquoted : for ~ */
645 					if (!(f & DOTEMP_) && (f & DOASNTILDE))
646 						tilde_ok = 1;
647 					break;
648 				  case '~':
649 					/* tilde_ok is reset whenever
650 					 * any of ' " $( $(( ${ } are seen.
651 					 * Note that tilde_ok must be preserved
652 					 * through the sequence ${A=a=}~
653 					 */
654 					if (type == XBASE
655 					    && (f & (DOTILDE|DOASNTILDE))
656 					    && (tilde_ok & 2))
657 					{
658 						char *p, *dp_x;
659 
660 						dp_x = dp;
661 						p = maybe_expand_tilde(sp,
662 							&ds, &dp_x,
663 							f & DOASNTILDE);
664 						if (p) {
665 							if (dp != dp_x)
666 								word = IFS_WORD;
667 							dp = dp_x;
668 							sp = p;
669 							continue;
670 						}
671 					}
672 					break;
673 				}
674 			else
675 				quote &= ~2; /* undo temporary */
676 
677 			if (make_magic) {
678 				make_magic = 0;
679 				fdo |= DOMAGIC_ | (f & DOGLOB);
680 				*dp++ = MAGIC;
681 			} else if (ISMAGIC(c)) {
682 				fdo |= DOMAGIC_;
683 				*dp++ = MAGIC;
684 			}
685 			*dp++ = c; /* save output char */
686 			word = IFS_WORD;
687 		}
688 	}
689 }
690 
691 /*
692  * Prepare to generate the string returned by ${} substitution.
693  */
694 static int
695 varsub(xp, sp, word, stypep, slenp)
696 	Expand *xp;
697 	char *sp;
698 	char *word;
699 	int *stypep;	/* becomes qualifier type */
700 	int *slenp;	/* " " len (=, :=, etc.) valid iff *stypep != 0 */
701 {
702 	int c;
703 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
704 	int stype;	/* substitution type */
705 	int slen;
706 	char *p;
707 	struct tbl *vp;
708 
709 	if (sp[0] == '\0')	/* Bad variable name */
710 		return -1;
711 
712 	xp->var = (struct tbl *) 0;
713 
714 	/* ${#var}, string length or array size */
715 	if (sp[0] == '#' && (c = sp[1]) != '\0') {
716 		int zero_ok = 0;
717 
718 		/* Can't have any modifiers for ${#...} */
719 		if (*word != CSUBST)
720 			return -1;
721 		sp++;
722 		/* Check for size of array */
723 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
724 			int n = 0;
725 			int max = 0;
726 			vp = global(arrayname(sp));
727 			if (vp->flag & (ISSET|ARRAY))
728 				zero_ok = 1;
729 			for (; vp; vp = vp->u.array)
730 				if (vp->flag & ISSET) {
731 					max = vp->index + 1;
732 					n++;
733 				}
734 			c = n; /* ksh88/ksh93 go for number, not max index */
735 		} else if (c == '*' || c == '@')
736 			c = e->loc->argc;
737 		else {
738 			p = str_val(global(sp));
739 			zero_ok = p != null;
740 			c = strlen(p);
741 		}
742 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
743 			errorf("%s: parameter not set", sp);
744 		*stypep = 0; /* unqualified variable/string substitution */
745 		xp->str = str_save(ulton((unsigned long)c, 10), ATEMP);
746 		return XSUB;
747 	}
748 
749 	/* Check for qualifiers in word part */
750 	stype = 0;
751 	c = word[slen = 0] == CHAR ? word[1] : 0;
752 	if (c == ':') {
753 		slen += 2;
754 		stype = 0x80;
755 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
756 	}
757 	if (ctype(c, C_SUBOP1)) {
758 		slen += 2;
759 		stype |= c;
760 	} else if (ctype(c, C_SUBOP2)) { /* Note: ksh88 allows :%, :%%, etc */
761 		slen += 2;
762 		stype = c;
763 		if (word[slen + 0] == CHAR && c == word[slen + 1]) {
764 			stype |= 0x80;
765 			slen += 2;
766 		}
767 	} else if (stype)	/* : is not ok */
768 		return -1;
769 	if (!stype && *word != CSUBST)
770 		return -1;
771 	*stypep = stype;
772 	*slenp = slen;
773 
774 	c = sp[0];
775 	if (c == '*' || c == '@') {
776 		switch (stype & 0x7f) {
777 		  case '=':	/* can't assign to a vector */
778 		  case '%':	/* can't trim a vector (yet) */
779 		  case '#':
780 			return -1;
781 		}
782 		if (e->loc->argc == 0) {
783 			xp->str = null;
784 			state = c == '@' ? XNULLSUB : XSUB;
785 		} else {
786 			xp->u.strv = (const char **) e->loc->argv + 1;
787 			xp->str = *xp->u.strv++;
788 			xp->split = c == '@'; /* $@ */
789 			state = XARG;
790 		}
791 	} else {
792 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
793 			XPtrV wv;
794 
795 			switch (stype & 0x7f) {
796 			  case '=':	/* can't assign to a vector */
797 			  case '%':	/* can't trim a vector (yet) */
798 			  case '#':
799 				return -1;
800 			}
801 			XPinit(wv, 32);
802 			vp = global(arrayname(sp));
803 			for (; vp; vp = vp->u.array) {
804 				if (!(vp->flag&ISSET))
805 					continue;
806 				XPput(wv, str_val(vp));
807 			}
808 			if (XPsize(wv) == 0) {
809 				xp->str = null;
810 				state = p[1] == '@' ? XNULLSUB : XSUB;
811 				XPfree(wv);
812 			} else {
813 				XPput(wv, 0);
814 				xp->u.strv = (const char **) XPptrv(wv);
815 				xp->str = *xp->u.strv++;
816 				xp->split = p[1] == '@'; /* ${foo[@]} */
817 				state = XARG;
818 			}
819 		} else {
820 			/* Can't assign things like $! or $1 */
821 			if ((stype & 0x7f) == '='
822 			    && (ctype(*sp, C_VAR1) || digit(*sp)))
823 				return -1;
824 			xp->var = global(sp);
825 			xp->str = str_val(xp->var);
826 			state = XSUB;
827 		}
828 	}
829 
830 	c = stype&0x7f;
831 	/* test the compiler's code generator */
832 	if (ctype(c, C_SUBOP2) ||
833 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
834 	     c == '=' || c == '-' || c == '?' : c == '+'))
835 		state = XBASE;	/* expand word instead of variable value */
836 	if (Flag(FNOUNSET) && xp->str == null
837 	    && (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
838 		errorf("%s: parameter not set", sp);
839 	return state;
840 }
841 
842 /*
843  * Run the command in $(...) and read its output.
844  */
845 static int
846 comsub(xp, cp)
847 	register Expand *xp;
848 	char *cp;
849 {
850 	Source *s, *sold;
851 	register struct op *t;
852 	struct shf *shf;
853 
854 	s = pushs(SSTRING, ATEMP);
855 	s->start = s->str = cp;
856 	sold = source;
857 	t = compile(s);
858 	source = sold;
859 
860 	if (t == NULL)
861 		return XBASE;
862 
863 	if (t != NULL && t->type == TCOM && /* $(<file) */
864 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
865 		register struct ioword *io = *t->ioact;
866 		char *name;
867 
868 		if ((io->flag&IOTYPE) != IOREAD)
869 			errorf("funny $() command: %s",
870 				snptreef((char *) 0, 32, "%R", io));
871 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
872 			SHF_MAPHI|SHF_CLEXEC);
873 		if (shf == NULL)
874 			errorf("%s: cannot open $() input", name);
875 		xp->split = 0;	/* no waitlast() */
876 	} else {
877 		int ofd1, pv[2];
878 		openpipe(pv);
879 		shf = shf_fdopen(pv[0], SHF_RD, (struct shf *) 0);
880 		ofd1 = savefd(1, 0);	/* fd 1 may be closed... */
881 		ksh_dup2(pv[1], 1, FALSE);
882 		close(pv[1]);
883 		execute(t, XFORK|XXCOM|XPIPEO);
884 		restfd(1, ofd1);
885 		startlast();
886 		xp->split = 1;	/* waitlast() */
887 	}
888 
889 	xp->u.shf = shf;
890 	return XCOM;
891 }
892 
893 /*
894  * perform #pattern and %pattern substitution in ${}
895  */
896 
897 static char *
898 trimsub(str, pat, how)
899 	register char *str;
900 	char *pat;
901 	int how;
902 {
903 	register char *end = strchr(str, 0);
904 	register char *p, c;
905 
906 	switch (how&0xff) {	/* UCHAR_MAX maybe? */
907 	  case '#':		/* shortest at begining */
908 		for (p = str; p <= end; p++) {
909 			c = *p; *p = '\0';
910 			if (gmatch(str, pat, FALSE)) {
911 				*p = c;
912 				return p;
913 			}
914 			*p = c;
915 		}
916 		break;
917 	  case '#'|0x80:	/* longest match at begining */
918 		for (p = end; p >= str; p--) {
919 			c = *p; *p = '\0';
920 			if (gmatch(str, pat, FALSE)) {
921 				*p = c;
922 				return p;
923 			}
924 			*p = c;
925 		}
926 		break;
927 	  case '%':		/* shortest match at end */
928 		for (p = end; p >= str; p--) {
929 			if (gmatch(p, pat, FALSE))
930 				return str_nsave(str, p - str, ATEMP);
931 		}
932 		break;
933 	  case '%'|0x80:	/* longest match at end */
934 		for (p = str; p <= end; p++) {
935 			if (gmatch(p, pat, FALSE))
936 				return str_nsave(str, p - str, ATEMP);
937 		}
938 		break;
939 	}
940 
941 	return str;		/* no match, return string */
942 }
943 
944 /*
945  * glob
946  * Name derived from V6's /etc/glob, the program that expanded filenames.
947  */
948 
949 /* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
950 static void
951 glob(cp, wp, markdirs)
952 	char *cp;
953 	register XPtrV *wp;
954 	int markdirs;
955 {
956 	int oldsize = XPsize(*wp);
957 
958 	if (glob_str(cp, wp, markdirs) == 0)
959 		XPput(*wp, debunk(cp, cp));
960 	else
961 		qsortp(XPptrv(*wp) + oldsize, (size_t)(XPsize(*wp) - oldsize),
962 			xstrcmp);
963 }
964 
965 #define GF_NONE		0
966 #define GF_EXCHECK	BIT(0)		/* do existance check on file */
967 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
968 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
969 
970 /* Apply file globbing to cp and store the matching files in wp.  Returns
971  * the number of matches found.
972  */
973 int
974 glob_str(cp, wp, markdirs)
975 	char *cp;
976 	XPtrV *wp;
977 	int markdirs;
978 {
979 	int oldsize = XPsize(*wp);
980 	XString xs;
981 	char *xp;
982 
983 	Xinit(xs, xp, 256, ATEMP);
984 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
985 	Xfree(xs, xp);
986 
987 	return XPsize(*wp) - oldsize;
988 }
989 
990 static void
991 globit(xs, xpp, sp, wp, check)
992 	XString *xs;		/* dest string */
993 	char **xpp;		/* ptr to dest end */
994 	char *sp;		/* source path */
995 	register XPtrV *wp;	/* output list */
996 	int check;		/* GF_* flags */
997 {
998 	register char *np;	/* next source component */
999 	char *xp = *xpp;
1000 	char *se;
1001 	char odirsep;
1002 
1003 	/* This to allow long expansions to be interrupted */
1004 	intrcheck();
1005 
1006 	if (sp == NULL) {	/* end of source path */
1007 		/* We only need to check if the file exists if a pattern
1008 		 * is followed by a non-pattern (eg, foo*x/bar; no check
1009 		 * is needed for foo* since the match must exist) or if
1010 		 * any patterns were expanded and the markdirs option is set.
1011 		 * Symlinks make things a bit tricky...
1012 		 */
1013 		if ((check & GF_EXCHECK)
1014 		    || ((check & GF_MARKDIR) && (check & GF_GLOBBED)))
1015 		{
1016 #define stat_check()	(stat_done ? stat_done : \
1017 			    (stat_done = stat(Xstring(*xs, xp), &statb) < 0 \
1018 				? -1 : 1))
1019 			struct stat lstatb, statb;
1020 			int stat_done = 0;	 /* -1: failed, 1 ok */
1021 
1022 			if (lstat(Xstring(*xs, xp), &lstatb) < 0)
1023 				return;
1024 			/* special case for systems which strip trailing
1025 			 * slashes from regular files (eg, /etc/passwd/).
1026 			 * SunOS 4.1.3 does this...
1027 			 */
1028 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp)
1029 			    && ISDIRSEP(xp[-1]) && !S_ISDIR(lstatb.st_mode)
1030 #ifdef S_ISLNK
1031 			    && (!S_ISLNK(lstatb.st_mode)
1032 				|| stat_check() < 0
1033 				|| !S_ISDIR(statb.st_mode))
1034 #endif /* S_ISLNK */
1035 				)
1036 				return;
1037 			/* Possibly tack on a trailing / if there isn't already
1038 			 * one and if the file is a directory or a symlink to a
1039 			 * directory
1040 			 */
1041 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED))
1042 			    && xp > Xstring(*xs, xp) && !ISDIRSEP(xp[-1])
1043 			    && (S_ISDIR(lstatb.st_mode)
1044 #ifdef S_ISLNK
1045 				|| (S_ISLNK(lstatb.st_mode)
1046 				    && stat_check() > 0
1047 				    && S_ISDIR(statb.st_mode))
1048 #endif /* S_ISLNK */
1049 				    ))
1050 			{
1051 				*xp++ = DIRSEP;
1052 				*xp = '\0';
1053 			}
1054 		}
1055 #ifdef OS2 /* Done this way to avoid bug in gcc 2.7.2... */
1056     /* Ugly kludge required for command
1057      * completion - see how search_access()
1058      * is implemented for OS/2...
1059      */
1060 # define KLUDGE_VAL	4
1061 #else /* OS2 */
1062 # define KLUDGE_VAL	0
1063 #endif /* OS2 */
1064 		XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp)
1065 			+ KLUDGE_VAL, ATEMP));
1066 		return;
1067 	}
1068 
1069 	if (xp > Xstring(*xs, xp))
1070 		*xp++ = DIRSEP;
1071 	while (ISDIRSEP(*sp)) {
1072 		Xcheck(*xs, xp);
1073 		*xp++ = *sp++;
1074 	}
1075 	np = ksh_strchr_dirsep(sp);
1076 	if (np != NULL) {
1077 		se = np;
1078 		odirsep = *np;	/* don't assume DIRSEP, can be multiple kinds */
1079 		*np++ = '\0';
1080 	} else {
1081 		odirsep = '\0'; /* keep gcc quiet */
1082 		se = sp + strlen(sp);
1083 	}
1084 
1085 
1086 	/* Check if sp needs globbing - done to avoid pattern checks for strings
1087 	 * containing MAGIC characters, open ['s without the matching close ],
1088 	 * etc. (otherwise opendir() will be called which may fail because the
1089 	 * directory isn't readable - if no globbing is needed, only execute
1090 	 * permission should be required (as per POSIX)).
1091 	 */
1092 	if (!has_globbing(sp, se)) {
1093 		XcheckN(*xs, xp, se - sp + 1);
1094 		debunk(xp, sp);
1095 		xp += strlen(xp);
1096 		*xpp = xp;
1097 		globit(xs, xpp, np, wp, check);
1098 	} else {
1099 		DIR *dirp;
1100 		struct dirent *d;
1101 		char *name;
1102 		int len;
1103 		int prefix_len;
1104 
1105 		/* xp = *xpp;	   copy_non_glob() may have re-alloc'd xs */
1106 		*xp = '\0';
1107 		prefix_len = Xlength(*xs, xp);
1108 		dirp = ksh_opendir(prefix_len ? Xstring(*xs, xp) : ".");
1109 		if (dirp == NULL)
1110 			goto Nodir;
1111 		while ((d = readdir(dirp)) != NULL) {
1112 			name = d->d_name;
1113 			if (name[0] == '.' &&
1114 			    (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
1115 				continue; /* always ignore . and .. */
1116 			if ((*name == '.' && *sp != '.')
1117 			    || !gmatch(name, sp, TRUE))
1118 				continue;
1119 
1120 			len = NLENGTH(d) + 1;
1121 			XcheckN(*xs, xp, len);
1122 			memcpy(xp, name, len);
1123 			*xpp = xp + len - 1;
1124 			globit(xs, xpp, np, wp,
1125 				(check & GF_MARKDIR) | GF_GLOBBED
1126 				| (np ? GF_EXCHECK : GF_NONE));
1127 			xp = Xstring(*xs, xp) + prefix_len;
1128 		}
1129 		closedir(dirp);
1130 	  Nodir:;
1131 	}
1132 
1133 	if (np != NULL)
1134 		*--np = odirsep;
1135 }
1136 
1137 #if 0
1138 /* Check if p contains something that needs globbing; if it does, 0 is
1139  * returned; if not, p is copied into xs/xp after stripping any MAGICs
1140  */
1141 static int	copy_non_glob ARGS((XString *xs, char **xpp, char *p));
1142 static int
1143 copy_non_glob(xs, xpp, p)
1144 	XString *xs;
1145 	char **xpp;
1146 	char *p;
1147 {
1148 	char *xp;
1149 	int len = strlen(p);
1150 
1151 	XcheckN(*xs, *xpp, len);
1152 	xp = *xpp;
1153 	for (; *p; p++) {
1154 		if (ISMAGIC(*p)) {
1155 			int c = *++p;
1156 
1157 			if (c == '*' || c == '?')
1158 				return 0;
1159 			if (*p == '[') {
1160 				char *q = p + 1;
1161 
1162 				if (ISMAGIC(*q) && q[1] == NOT)
1163 					q += 2;
1164 				if (ISMAGIC(*q) && q[1] == ']')
1165 					q += 2;
1166 				for (; *q; q++)
1167 					if (ISMAGIC(*q) && *++q == ']')
1168 						return 0;
1169 				/* pass a literal [ through */
1170 			}
1171 			/* must be a MAGIC-MAGIC, or MAGIC-!, MAGIC--, etc. */
1172 		}
1173 		*xp++ = *p;
1174 	}
1175 	*xp = '\0';
1176 	*xpp = xp;
1177 	return 1;
1178 }
1179 #endif /* 0 */
1180 
1181 /* remove MAGIC from string */
1182 char *
1183 debunk(dp, sp)
1184 	char *dp;
1185 	const char *sp;
1186 {
1187 	char *d, *s;
1188 
1189 	if ((s = strchr(sp, MAGIC))) {
1190 		memcpy(dp, sp, s - sp);
1191 		for (d = dp + (s - sp); *s; s++)
1192 			if (!ISMAGIC(*s) || !(*++s & 0x80)
1193 			    || !strchr("*+?@! ", *s & 0x7f))
1194 				*d++ = *s;
1195 			else {
1196 				/* extended pattern operators: *+?@! */
1197 				if ((*s & 0x7f) != ' ')
1198 					*d++ = *s & 0x7f;
1199 				*d++ = '(';
1200 			}
1201 		*d = '\0';
1202 	} else if (dp != sp)
1203 		strcpy(dp, sp);
1204 	return dp;
1205 }
1206 
1207 /* Check if p is an unquoted name, possibly followed by a / or :.  If so
1208  * puts the expanded version in *dcp,dp and returns a pointer in p just
1209  * past the name, otherwise returns 0.
1210  */
1211 static char *
1212 maybe_expand_tilde(p, dsp, dpp, isassign)
1213 	char *p;
1214 	XString *dsp;
1215 	char **dpp;
1216 	int isassign;
1217 {
1218 	XString ts;
1219 	char *dp = *dpp;
1220 	char *tp, *r;
1221 
1222 	Xinit(ts, tp, 16, ATEMP);
1223 	/* : only for DOASNTILDE form */
1224 	while (p[0] == CHAR && !ISDIRSEP(p[1])
1225 	       && (!isassign || p[1] != PATHSEP))
1226 	{
1227 		Xcheck(ts, tp);
1228 		*tp++ = p[1];
1229 		p += 2;
1230 	}
1231 	*tp = '\0';
1232 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ? tilde(Xstring(ts, tp)) : (char *) 0;
1233 	Xfree(ts, tp);
1234 	if (r) {
1235 		while (*r) {
1236 			Xcheck(*dsp, dp);
1237 			if (ISMAGIC(*r))
1238 				*dp++ = MAGIC;
1239 			*dp++ = *r++;
1240 		}
1241 		*dpp = dp;
1242 		r = p;
1243 	}
1244 	return r;
1245 }
1246 
1247 /*
1248  * tilde expansion
1249  *
1250  * based on a version by Arnold Robbins
1251  */
1252 
1253 static char *
1254 tilde(cp)
1255 	char *cp;
1256 {
1257 	char *dp;
1258 
1259 	if (cp[0] == '\0')
1260 		dp = str_val(global("HOME"));
1261 	else if (cp[0] == '+' && cp[1] == '\0')
1262 		dp = str_val(global("PWD"));
1263 	else if (cp[0] == '-' && cp[1] == '\0')
1264 		dp = str_val(global("OLDPWD"));
1265 	else
1266 		dp = homedir(cp);
1267 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
1268 	if (dp == null)
1269 		dp = (char *) 0;
1270 	return dp;
1271 }
1272 
1273 /*
1274  * map userid to user's home directory.
1275  * note that 4.3's getpw adds more than 6K to the shell,
1276  * and the YP version probably adds much more.
1277  * we might consider our own version of getpwnam() to keep the size down.
1278  */
1279 
1280 static char *
1281 homedir(name)
1282 	char *name;
1283 {
1284 	register struct tbl *ap;
1285 
1286 	ap = tenter(&homedirs, name, hash(name));
1287 	if (!(ap->flag & ISSET)) {
1288 #ifdef OS2
1289 		/* No usernames in OS2 - punt */
1290 		return NULL;
1291 #else /* OS2 */
1292 		struct passwd *pw;
1293 
1294 		pw = getpwnam(name);
1295 		if (pw == NULL)
1296 			return NULL;
1297 		ap->val.s = str_save(pw->pw_dir, APERM);
1298 		ap->flag |= DEFINED|ISSET|ALLOC;
1299 #endif /* OS2 */
1300 	}
1301 	return ap->val.s;
1302 }
1303 
1304 #ifdef BRACE_EXPAND
1305 static void
1306 alt_expand(wp, start, exp_start, end, fdo)
1307 	XPtrV *wp;
1308 	char *start, *exp_start;
1309 	char *end;
1310 	int fdo;
1311 {
1312 	int UNINITIALIZED(count);
1313 	char *brace_start, *brace_end, *UNINITIALIZED(comma);
1314 	char *field_start;
1315 	char *p;
1316 
1317 	/* search for open brace */
1318 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != OBRACE; p += 2)
1319 		;
1320 	brace_start = p;
1321 
1322 	/* find matching close brace, if any */
1323 	if (p) {
1324 		comma = (char *) 0;
1325 		count = 1;
1326 		for (p += 2; *p && count; p++) {
1327 			if (ISMAGIC(*p)) {
1328 				if (*++p == OBRACE)
1329 					count++;
1330 				else if (*p == CBRACE)
1331 					--count;
1332 				else if (*p == ',' && count == 1)
1333 					comma = p;
1334 			}
1335 		}
1336 	}
1337 	/* no valid expansions... */
1338 	if (!p || count != 0) {
1339 		/* Note that given a{{b,c} we do not expand anything (this is
1340 		 * what at&t ksh does.  This may be changed to do the {b,c}
1341 		 * expansion. }
1342 		 */
1343 		if (fdo & DOGLOB)
1344 			glob(start, wp, fdo & DOMARKDIRS);
1345 		else
1346 			XPput(*wp, debunk(start, start));
1347 		return;
1348 	}
1349 	brace_end = p;
1350 	if (!comma) {
1351 		alt_expand(wp, start, brace_end, end, fdo);
1352 		return;
1353 	}
1354 
1355 	/* expand expression */
1356 	field_start = brace_start + 2;
1357 	count = 1;
1358 	for (p = brace_start + 2; p != brace_end; p++) {
1359 		if (ISMAGIC(*p)) {
1360 			if (*++p == OBRACE)
1361 				count++;
1362 			else if ((*p == CBRACE && --count == 0)
1363 				 || (*p == ',' && count == 1))
1364 			{
1365 				char *new;
1366 				int l1, l2, l3;
1367 
1368 				l1 = brace_start - start;
1369 				l2 = (p - 1) - field_start;
1370 				l3 = end - brace_end;
1371 				new = (char *) alloc(l1 + l2 + l3 + 1, ATEMP);
1372 				memcpy(new, start, l1);
1373 				memcpy(new + l1, field_start, l2);
1374 				memcpy(new + l1 + l2, brace_end, l3);
1375 				new[l1 + l2 + l3] = '\0';
1376 				alt_expand(wp, new, new + l1,
1377 					   new + l1 + l2 + l3, fdo);
1378 				field_start = p + 1;
1379 			}
1380 		}
1381 	}
1382 	return;
1383 }
1384 #endif /* BRACE_EXPAND */
1385