xref: /netbsd-src/bin/ksh/eval.c (revision 76dfffe33547c37f8bdd446e3e4ab0f3c16cea4b)
1 /*
2  * Expansion - quoting, separation, substitution, globbing
3  */
4 
5 #include "sh.h"
6 #include <pwd.h>
7 #include "ksh_dir.h"
8 #include "ksh_stat.h"
9 
10 /*
11  * string expansion
12  *
13  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
14  * second pass: alternation ({,}), filename expansion (*?[]).
15  */
16 
17 /* expansion generator state */
18 typedef struct Expand {
19 	/* int  type; */	/* see expand() */
20 	const char *str;	/* string */
21 	union {
22 		const char **strv;/* string[] */
23 		struct shf *shf;/* file */
24 	} u;			/* source */
25 	struct tbl *var;	/* variable in ${var..} */
26 	short	split;		/* split "$@" / call waitlast $() */
27 } Expand;
28 
29 #define	XBASE		0	/* scanning original */
30 #define	XSUB		1	/* expanding ${} string */
31 #define	XARGSEP		2	/* ifs0 between "$*" */
32 #define	XARG		3	/* expanding $*, $@ */
33 #define	XCOM		4	/* expanding $() */
34 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
35 
36 /* States used for field splitting */
37 #define IFS_WORD	0	/* word has chars (or quotes) */
38 #define IFS_WS		1	/* have seen IFS white-space */
39 #define IFS_NWS		2	/* have seen IFS non-white-space */
40 
41 static	int	varsub ARGS((Expand *xp, char *sp, char *word, int *stypep));
42 static	int	comsub ARGS((Expand *xp, char *cp));
43 static	char   *trimsub ARGS((char *str, char *pat, int how));
44 static	void	glob ARGS((char *cp, XPtrV *wp, int markdirs));
45 static	void	globit ARGS((XString *xs, char **xpp, char *sp, XPtrV *wp,
46 			     int check));
47 static char	*maybe_expand_tilde ARGS((char *p, XString *dsp, char **dpp,
48 					  int isassign));
49 static	char   *tilde ARGS((char *acp));
50 static	char   *homedir ARGS((char *name));
51 #ifdef BRACE_EXPAND
52 static void	alt_expand ARGS((XPtrV *wp, char *start, char *exp_start,
53 				 char *end, int fdo));
54 #endif
55 
56 /* compile and expand word */
57 char *
58 substitute(cp, f)
59 	const char *cp;
60 	int f;
61 {
62 	struct source *s, *sold;
63 
64 	sold = source;
65 	s = pushs(SWSTR, ATEMP);
66 	s->start = s->str = cp;
67 	source = s;
68 	if (yylex(ONEWORD) != LWORD)
69 		internal_errorf(1, "substitute");
70 	source = sold;
71 	afree(s, ATEMP);
72 	return evalstr(yylval.cp, f);
73 }
74 
75 /*
76  * expand arg-list
77  */
78 char **
79 eval(ap, f)
80 	register char **ap;
81 	int f;
82 {
83 	XPtrV w;
84 
85 	if (*ap == NULL)
86 		return ap;
87 	XPinit(w, 32);
88 	XPput(w, NULL);		/* space for shell name */
89 #ifdef	SHARPBANG
90 	XPput(w, NULL);		/* and space for one arg */
91 #endif
92 	while (*ap != NULL)
93 		expand(*ap++, &w, f);
94 	XPput(w, NULL);
95 #ifdef	SHARPBANG
96 	return (char **) XPclose(w) + 2;
97 #else
98 	return (char **) XPclose(w) + 1;
99 #endif
100 }
101 
102 /*
103  * expand string
104  */
105 char *
106 evalstr(cp, f)
107 	char *cp;
108 	int f;
109 {
110 	XPtrV w;
111 
112 	XPinit(w, 1);
113 	expand(cp, &w, f);
114 	cp = (XPsize(w) == 0) ? null : (char*) *XPptrv(w);
115 	XPfree(w);
116 	return cp;
117 }
118 
119 /*
120  * expand string - return only one component
121  * used from iosetup to expand redirection files
122  */
123 char *
124 evalonestr(cp, f)
125 	register char *cp;
126 	int f;
127 {
128 	XPtrV w;
129 
130 	XPinit(w, 1);
131 	expand(cp, &w, f);
132 	switch (XPsize(w)) {
133 	case 0:
134 		cp = null;
135 		break;
136 	case 1:
137 		cp = (char*) *XPptrv(w);
138 		break;
139 	default:
140 		cp = evalstr(cp, f&~DOGLOB);
141 		break;
142 	}
143 	XPfree(w);
144 	return cp;
145 }
146 
147 /* for nested substitution: ${var:=$var2} */
148 typedef struct SubType {
149 	short	stype;		/* [=+-?%#] action after expanded word */
150 	short	base;		/* begin position of expanded word */
151 	short	f;		/* saved value of f (DOPAT, etc) */
152 	struct tbl *var;	/* variable for ${var..} */
153 	short	quote;		/* saved value of quote (for ${..[%#]..}) */
154 	struct SubType *prev;	/* old type */
155 	struct SubType *next;	/* poped type (to avoid re-allocating) */
156 } SubType;
157 
158 void
159 expand(cp, wp, f)
160 	char *cp;		/* input word */
161 	register XPtrV *wp;	/* output words */
162 	int f;			/* DO* flags */
163 {
164 	register int UNINITIALIZED(c);
165 	register int type;	/* expansion type */
166 	register int quote = 0;	/* quoted */
167 	XString ds;		/* destination string */
168 	register char *dp, *sp;	/* dest., source */
169 	int fdo, word;		/* second pass flags; have word */
170 	int doblank;		/* field spliting of parameter/command subst */
171 	Expand x;		/* expansion variables */
172 	SubType st_head, *st;
173 	int UNINITIALIZED(newlines); /* For trailing newlines in COMSUB */
174 	int saw_eq, tilde_ok;
175 	int make_magic;
176 
177 	if (cp == NULL)
178 		internal_errorf(1, "expand(NULL)");
179 	/* for alias, readonly, set, typeset commands */
180 	if ((f & DOVACHECK) && is_wdvarassign(cp)) {
181 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
182 		f |= DOASNTILDE;
183 	}
184 	if (Flag(FNOGLOB))
185 		f &= ~DOGLOB;
186 	if (Flag(FMARKDIRS))
187 		f |= DOMARKDIRS;
188 #ifdef BRACE_EXPAND
189 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
190 		f |= DOBRACE_;
191 #endif /* BRACE_EXPAND */
192 
193 	Xinit(ds, dp, 128, ATEMP);	/* init dest. string */
194 	type = XBASE;
195 	sp = cp;
196 	fdo = 0;
197 	saw_eq = 0;
198 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0; /* must be 1/0 */
199 	doblank = 0;
200 	make_magic = 0;
201 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
202 	st_head.next = (SubType *) 0;
203 	st = &st_head;
204 
205 	while (1) {
206 		Xcheck(ds, dp);
207 
208 		switch (type) {
209 		  case XBASE:	/* original prefixed string */
210 			c = *sp++;
211 			switch (c) {
212 			  case EOS:
213 				c = 0;
214 				break;
215 			  case CHAR:
216 				c = *sp++;
217 				break;
218 			  case QCHAR:
219 				quote |= 2; /* temporary quote */
220 				c = *sp++;
221 				break;
222 			  case OQUOTE:
223 				word = IFS_WORD;
224 				tilde_ok = 0;
225 				quote = 1;
226 				continue;
227 			  case CQUOTE:
228 				quote = 0;
229 				continue;
230 			  case COMSUB:
231 				tilde_ok = 0;
232 				if (f & DONTRUNCOMMAND) {
233 					word = IFS_WORD;
234 					*dp++ = '$'; *dp++ = '(';
235 					while (*sp != '\0') {
236 						Xcheck(ds, dp);
237 						*dp++ = *sp++;
238 					}
239 					*dp++ = ')';
240 				} else {
241 					type = comsub(&x, sp);
242 					if (type == XCOM && (f&DOBLANK))
243 						doblank++;
244 					sp = strchr(sp, 0) + 1;
245 					newlines = 0;
246 				}
247 				continue;
248 			  case EXPRSUB:
249 				word = IFS_WORD;
250 				tilde_ok = 0;
251 				if (f & DONTRUNCOMMAND) {
252 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
253 					while (*sp != '\0') {
254 						Xcheck(ds, dp);
255 						*dp++ = *sp++;
256 					}
257 					*dp++ = ')'; *dp++ = ')';
258 				} else {
259 					struct tbl v;
260 					char *p;
261 
262 					v.flag = DEFINED|ISSET|INTEGER;
263 					v.type = 10; /* not default */
264 					v.name[0] = '\0';
265 					v_evaluate(&v, substitute(sp, 0),
266 						FALSE);
267 					sp = strchr(sp, 0) + 1;
268 					for (p = str_val(&v); *p; ) {
269 						Xcheck(ds, dp);
270 						*dp++ = *p++;
271 					}
272 				}
273 				continue;
274 			  case OSUBST: /* ${{#}var{:}[=+-?#%]word} */
275 			  /* format is:
276 			   *   OSUBST plain-variable-part \0
277 			   *     compiled-word-part CSUBST
278 			   * This is were all syntax checking gets done...
279 			   */
280 			  {
281 				char *varname = sp;
282 				int stype;
283 
284 				sp = strchr(sp, '\0') + 1; /* skip variable */
285 				type = varsub(&x, varname, sp, &stype);
286 				if (type < 0) {
287 					char endc;
288 					char *str, *end;
289 
290 					end = (char *) wdscan(sp, CSUBST);
291 					endc = *end;
292 					*end = EOS;
293 					str = snptreef((char *) 0, 64, "%S",
294 							varname - 1);
295 					*end = endc;
296 					errorf("%s: bad substitution", str);
297 				}
298 				if (f&DOBLANK)
299 					doblank++;
300 				tilde_ok = 0;
301 				if (type == XBASE) {	/* expand? */
302 					if (!st->next) {
303 						SubType *newst;
304 
305 						newst = (SubType *) alloc(
306 							sizeof(SubType), ATEMP);
307 						newst->next = (SubType *) 0;
308 						newst->prev = st;
309 						st->next = newst;
310 					}
311 					st = st->next;
312 					st->stype = stype;
313 					st->base = Xsavepos(ds, dp);
314 					st->f = f;
315 					st->var = x.var;
316 					st->quote = quote;
317 					/* skip qualifier(s) */
318 					if (stype) {
319 						sp += 2;
320 						/* :[-+=?] or double [#%] */
321 						if (stype & 0x80)
322 							sp += 2;
323 					}
324 					switch (stype & 0x7f) {
325 					  case '#':
326 					  case '%':
327 						/* ! DOBLANK,DOBRACE_,DOTILDE */
328 						f = DOPAT | (f&DONTRUNCOMMAND)
329 						    | DOTEMP_;
330 						quote = 0;
331 						break;
332 					  case '=':
333 						/* Enabling tilde expansion
334 						 * after :'s here is
335 						 * non-standard ksh, but is
336 						 * consistent with rules for
337 						 * other assignments.  Not
338 						 * sure what POSIX thinks of
339 						 * this.
340 						 * Not doing tilde expansion
341 						 * for integer variables is a
342 						 * non-POSIX thing - makes
343 						 * sense though, since ~ is
344 						 * a arithmetic operator.
345 						 */
346 #if !defined(__hppa) || __GNUC__ != 2	/* gcc 2.3.3 on hp-pa dies on this - ifdef goes away as soon as I get a new version of gcc.. */
347 						if (!(x.var->flag & INTEGER))
348 							f |= DOASNTILDE|DOTILDE;
349 						f |= DOTEMP_;
350 #else
351 						f |= DOTEMP_|DOASNTILDE|DOTILDE;
352 #endif
353 						/* These will be done after the
354 						 * value has been assigned.
355 						 */
356 						f &= ~(DOBLANK|DOGLOB|DOBRACE_);
357 						tilde_ok = 1;
358 						break;
359 					  case '?':
360 						f &= ~DOBLANK;
361 						f |= DOTEMP_;
362 						/* fall through */
363 					  default:
364 						/* Enable tilde expansion */
365 						tilde_ok = 1;
366 						f |= DOTILDE;
367 					}
368 				} else
369 					/* skip word */
370 					sp = (char *) wdscan(sp, CSUBST);
371 				continue;
372 			  }
373 			  case CSUBST: /* only get here if expanding word */
374 				tilde_ok = 0;	/* in case of ${unset:-} */
375 				*dp = '\0';
376 				quote = st->quote;
377 				f = st->f;
378 				if (f&DOBLANK)
379 					doblank--;
380 				switch (st->stype&0x7f) {
381 				  case '#':
382 				  case '%':
383 					dp = Xrestpos(ds, dp, st->base);
384 					/* Must use st->var since calling
385 					 * global would break things
386 					 * like x[i+=1].
387 					 */
388 					x.str = trimsub(str_val(st->var),
389 						dp, st->stype);
390 					type = XSUB;
391 					if (f&DOBLANK)
392 						doblank++;
393 					st = st->prev;
394 					continue;
395 				  case '=':
396 					if (st->var->flag & RDONLY)
397 						/* XXX POSIX says this is only
398 						 * fatal for special builtins
399 						 */
400 						errorf("%s: is read only",
401 							st->var->name);
402 					/* Restore our position and substitute
403 					 * the value of st->var (may not be
404 					 * the assigned value in the presence
405 					 * of integer/right-adj/etc attributes).
406 					 */
407 					dp = Xrestpos(ds, dp, st->base);
408 					/* Must use st->var since calling
409 					 * global would cause with things
410 					 * like x[i+=1] to be evaluated twice.
411 					 */
412 					setstr(st->var, debunk(
413 						(char *) alloc(strlen(dp) + 1,
414 							ATEMP), dp));
415 					x.str = str_val(st->var);
416 					type = XSUB;
417 					if (f&DOBLANK)
418 						doblank++;
419 					st = st->prev;
420 					continue;
421 				  case '?':
422 				    {
423 					char *s = Xrestpos(ds, dp, st->base);
424 
425 					errorf("%s: %s", st->var->name,
426 					    dp == s ?
427 					      "parameter null or not set"
428 					    : (debunk(s, s), s));
429 				    }
430 				}
431 				st = st->prev;
432 				type = XBASE;
433 				continue;
434 
435 			  case OPAT: /* open pattern: *(foo|bar) */
436 				/* Next char is the type of pattern */
437 				make_magic = 1;
438 				c = *sp++ + 0x80;
439 				break;
440 
441 			  case SPAT: /* pattern seperator (|) */
442 				make_magic = 1;
443 				c = '|';
444 				break;
445 
446 			  case CPAT: /* close pattern */
447 				make_magic = 1;
448 				c = /*(*/ ')';
449 				break;
450 			}
451 			break;
452 
453 		  case XNULLSUB:
454 			/* Special case for "$@" (and "${foo[@]}") - no
455 			 * word is generated if $# is 0 (unless there is
456 			 * other stuff inside the quotes).
457 			 */
458 			type = XBASE;
459 			if (f&DOBLANK) {
460 				doblank--;
461 				/* not really correct: x=; "$x$@" should
462 				 * generate a null argument and
463 				 * set A; "${@:+}" shouldn't.
464 				 */
465 				if (dp == Xstring(ds, dp))
466 					word = IFS_WS;
467 			}
468 			continue;
469 
470 		  case XSUB:
471 			if ((c = *x.str++) == 0) {
472 				type = XBASE;
473 				if (f&DOBLANK)
474 					doblank--;
475 				continue;
476 			}
477 			break;
478 
479 		  case XARGSEP:
480 			type = XARG;
481 			quote = 1;
482 		  case XARG:
483 			if ((c = *x.str++) == '\0') {
484 				/* force null words to be created so
485 				 * set -- '' 2 ''; foo "$@" will do
486 				 * the right thing
487 				 */
488 				if (quote && x.split)
489 					word = IFS_WORD;
490 				if ((x.str = *x.u.strv++) == NULL) {
491 					type = XBASE;
492 					if (f&DOBLANK)
493 						doblank--;
494 					continue;
495 				}
496 				c = ifs0;
497 				if (c == 0) {
498 					if (quote && !x.split)
499 						continue;
500 					c = ' ';
501 				}
502 				if (quote && x.split) {
503 					/* terminate word for "$@" */
504 					type = XARGSEP;
505 					quote = 0;
506 				}
507 			}
508 			break;
509 
510 		  case XCOM:
511 			if (newlines) {		/* Spit out saved nl's */
512 				c = '\n';
513 				--newlines;
514 			} else {
515 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
516 				    if (c == '\n')
517 					    newlines++;	/* Save newlines */
518 				if (newlines && c != EOF) {
519 					shf_ungetc(c, x.u.shf);
520 					c = '\n';
521 					--newlines;
522 				}
523 			}
524 			if (c == EOF) {
525 				newlines = 0;
526 				shf_close(x.u.shf);
527 				if (x.split)
528 					subst_exstat = waitlast();
529 				type = XBASE;
530 				if (f&DOBLANK)
531 					doblank--;
532 				continue;
533 			}
534 			break;
535 		}
536 
537 		/* check for end of word or IFS separation */
538 		if (c == 0 || (!quote && (f & DOBLANK) && doblank && !make_magic
539 			       && ctype(c, C_IFS)))
540 		{
541 			/* How words are broken up:
542 			 *		   |       value of c
543 			 *	  word	   |	ws	nws	0
544 			 *	-----------------------------------
545 			 *	IFS_WORD	w/WS	w/NWS	w
546 			 *	IFS_WS		-/WS	w/NWS	-
547 			 *	IFS_NWS		-/NWS	w/NWS	w
548 			 *   (w means generate a word)
549 			 * Note that IFS_NWS/0 generates a word (at&t ksh
550 			 * doesn't do this, but POSIX does).
551 			 */
552 			if (word == IFS_WORD
553 			    || (!ctype(c, C_IFSWS) && (c || word == IFS_NWS)))
554 			{
555 				char *p;
556 
557 				*dp++ = '\0';
558 				p = Xclose(ds, dp);
559 #ifdef BRACE_EXPAND
560 				if (fdo & DOBRACE_)
561 					/* also does globbing */
562 					alt_expand(wp, p, p,
563 						   p + Xlength(ds, (dp - 1)),
564 						   fdo | (f & DOMARKDIRS));
565 				else
566 #endif /* BRACE_EXPAND */
567 				if (fdo & DOGLOB)
568 					glob(p, wp, f & DOMARKDIRS);
569 				else if ((f & DOPAT) || !(fdo & DOMAGIC_))
570 					XPput(*wp, p);
571 				else
572 					XPput(*wp, debunk(p, p));
573 				fdo = 0;
574 				saw_eq = 0;
575 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
576 				if (c != 0)
577 					Xinit(ds, dp, 128, ATEMP);
578 			}
579 			if (c == 0)
580 				return;
581 			if (word != IFS_NWS)
582 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
583 		} else {
584 			/* age tilde_ok info - ~ code tests second bit */
585 			tilde_ok <<= 1;
586 			/* mark any special second pass chars */
587 			if (!quote)
588 				switch (c) {
589 				  case '[':
590 				  case NOT:
591 				  case '-':
592 				  case ']':
593 					/* For character classes - doesn't hurt
594 					 * to have magic !,-,]'s outside of
595 					 * [...] expressions.
596 					 */
597 					if (f & (DOPAT | DOGLOB)) {
598 						fdo |= DOMAGIC_;
599 						if (c == '[')
600 							fdo |= f & DOGLOB;
601 						*dp++ = MAGIC;
602 					}
603 					break;
604 				  case '*':
605 				  case '?':
606 					if (f & (DOPAT | DOGLOB)) {
607 						fdo |= DOMAGIC_ | (f & DOGLOB);
608 						*dp++ = MAGIC;
609 					}
610 					break;
611 #ifdef BRACE_EXPAND
612 				  case OBRACE:
613 				  case ',':
614 				  case CBRACE:
615 					if ((f & DOBRACE_) && (c == OBRACE
616 						|| (fdo & DOBRACE_)))
617 					{
618 						fdo |= DOBRACE_|DOMAGIC_;
619 						*dp++ = MAGIC;
620 					}
621 					break;
622 #endif /* BRACE_EXPAND */
623 				  case '=':
624 					/* Note first unquoted = for ~ */
625 					if (!(f & DOTEMP_) && !saw_eq) {
626 						saw_eq = 1;
627 						tilde_ok = 1;
628 					}
629 					break;
630 				  case PATHSEP: /* : */
631 					/* Note unquoted : for ~ */
632 					if (!(f & DOTEMP_) && (f & DOASNTILDE))
633 						tilde_ok = 1;
634 					break;
635 				  case '~':
636 					/* tilde_ok is reset whenever
637 					 * any of ' " $( $(( ${ } are seen.
638 					 * Note that tilde_ok must be preserved
639 					 * through the sequence ${A=a=}~
640 					 */
641 					if (type == XBASE
642 					    && (f & (DOTILDE|DOASNTILDE))
643 					    && (tilde_ok & 2))
644 					{
645 						char *p, *dp_x;
646 
647 						dp_x = dp;
648 						p = maybe_expand_tilde(sp,
649 							&ds, &dp_x,
650 							f & DOASNTILDE);
651 						if (p) {
652 							if (dp != dp_x)
653 								word = IFS_WORD;
654 							dp = dp_x;
655 							sp = p;
656 							continue;
657 						}
658 					}
659 					break;
660 				}
661 			else
662 				quote &= ~2; /* undo temporary */
663 
664 			if (make_magic) {
665 				make_magic = 0;
666 				fdo |= DOMAGIC_ | (f & DOGLOB);
667 				*dp++ = MAGIC;
668 			} else if (ISMAGIC(c)) {
669 				fdo |= DOMAGIC_;
670 				*dp++ = MAGIC;
671 			}
672 			*dp++ = c; /* save output char */
673 			word = IFS_WORD;
674 		}
675 	}
676 }
677 
678 /*
679  * Prepare to generate the string returned by ${} substitution.
680  */
681 static int
682 varsub(xp, sp, word, stypep)
683 	Expand *xp;
684 	char *sp;
685 	char *word;
686 	int *stypep;
687 {
688 	int c;
689 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
690 	int stype;	/* substitution type */
691 	char *p;
692 	struct tbl *vp;
693 
694 	if (sp[0] == '\0')	/* Bad variable name */
695 		return -1;
696 
697 	xp->var = (struct tbl *) 0;
698 
699 	/* ${#var}, string length or array size */
700 	if (sp[0] == '#' && (c = sp[1]) != '\0') {
701 		int zero_ok = 0;
702 
703 		/* Can't have any modifiers for ${#...} */
704 		if (*word != CSUBST)
705 			return -1;
706 		sp++;
707 		/* Check for size of array */
708 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
709 			c = 0;
710 			vp = global(arrayname(sp));
711 			if (vp->flag & (ISSET|ARRAY))
712 				zero_ok = 1;
713 			for (; vp; vp = vp->u.array)
714 				if (vp->flag&ISSET)
715 					c = vp->index+1;
716 		} else if (c == '*' || c == '@')
717 			c = e->loc->argc;
718 		else {
719 			p = str_val(global(sp));
720 			zero_ok = p != null;
721 			c = strlen(p);
722 		}
723 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
724 			errorf("%s: parameter not set", sp);
725 		*stypep = 0; /* unqualified variable/string substitution */
726 		xp->str = str_save(ulton((unsigned long)c, 10), ATEMP);
727 		return XSUB;
728 	}
729 
730 	/* Check for qualifiers in word part */
731 	stype = 0;
732 	c = *word == CHAR ? word[1] : 0;
733 	if (c == ':') {
734 		stype = 0x80;
735 		c = word[2] == CHAR ? word[3] : 0;
736 	}
737 	if (ctype(c, C_SUBOP1))
738 		stype |= c;
739 	else if (stype)	/* :, :# or :% is not ok */
740 		return -1;
741 	else if (ctype(c, C_SUBOP2)) {
742 		stype = c;
743 		if (word[2] == CHAR && c == word[3])
744 			stype |= 0x80;
745 	}
746 	if (!stype && *word != CSUBST)
747 		return -1;
748 	*stypep = stype;
749 
750 	c = sp[0];
751 	if (c == '*' || c == '@') {
752 		switch (stype & 0x7f) {
753 		  case '=':	/* can't assign to a vector */
754 		  case '%':	/* can't trim a vector */
755 		  case '#':
756 			return -1;
757 		}
758 		if (e->loc->argc == 0) {
759 			xp->str = null;
760 			state = c == '@' ? XNULLSUB : XSUB;
761 		} else {
762 			xp->u.strv = (const char **) e->loc->argv + 1;
763 			xp->str = *xp->u.strv++;
764 			xp->split = c == '@'; /* $@ */
765 			state = XARG;
766 		}
767 	} else {
768 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
769 			XPtrV wv;
770 
771 			switch (stype & 0x7f) {
772 			  case '=':	/* can't assign to a vector */
773 			  case '%':	/* can't trim a vector */
774 			  case '#':
775 				return -1;
776 			}
777 			XPinit(wv, 32);
778 			vp = global(arrayname(sp));
779 			for (; vp; vp = vp->u.array) {
780 				if (!(vp->flag&ISSET))
781 					continue;
782 				XPput(wv, str_val(vp));
783 			}
784 			if (XPsize(wv) == 0) {
785 				xp->str = null;
786 				state = p[1] == '@' ? XNULLSUB : XSUB;
787 				XPfree(wv);
788 			} else {
789 				XPput(wv, 0);
790 				xp->u.strv = (const char **) XPptrv(wv);
791 				xp->str = *xp->u.strv++;
792 				xp->split = p[1] == '@'; /* ${foo[@]} */
793 				state = XARG;
794 			}
795 		} else {
796 			/* Can't assign things like $! or $1 */
797 			if ((stype & 0x7f) == '='
798 			    && (ctype(*sp, C_VAR1) || digit(*sp)))
799 				return -1;
800 			xp->var = global(sp);
801 			xp->str = str_val(xp->var);
802 			state = XSUB;
803 		}
804 	}
805 
806 	c = stype&0x7f;
807 	/* test the compiler's code generator */
808 	if (ctype(c, C_SUBOP2) ||
809 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
810 	     c == '=' || c == '-' || c == '?' : c == '+'))
811 		state = XBASE;	/* expand word instead of variable value */
812 	if (Flag(FNOUNSET) && xp->str == null
813 	    && (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
814 		errorf("%s: parameter not set", sp);
815 	return state;
816 }
817 
818 /*
819  * Run the command in $(...) and read its output.
820  */
821 static int
822 comsub(xp, cp)
823 	register Expand *xp;
824 	char *cp;
825 {
826 	Source *s, *sold;
827 	register struct op *t;
828 	struct shf *shf;
829 
830 	s = pushs(SSTRING, ATEMP);
831 	s->start = s->str = cp;
832 	sold = source;
833 	t = compile(s);
834 	source = sold;
835 
836 	if (t == NULL)
837 		return XBASE;
838 
839 	if (t != NULL && t->type == TCOM && /* $(<file) */
840 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
841 		register struct ioword *io = *t->ioact;
842 		char *name;
843 
844 		if ((io->flag&IOTYPE) != IOREAD)
845 			errorf("funny $() command: %s",
846 				snptreef((char *) 0, 32, "%R", io));
847 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
848 			SHF_MAPHI|SHF_CLEXEC);
849 		if (shf == NULL)
850 			errorf("%s: cannot open $() input", name);
851 		xp->split = 0;	/* no waitlast() */
852 	} else {
853 		int ofd1, pv[2];
854 		openpipe(pv);
855 		shf = shf_fdopen(pv[0], SHF_RD, (struct shf *) 0);
856 		ofd1 = savefd(1, 0);	/* fd 1 may be closed... */
857 		ksh_dup2(pv[1], 1, FALSE);
858 		close(pv[1]);
859 		execute(t, XFORK|XXCOM|XPIPEO);
860 		restfd(1, ofd1);
861 		startlast();
862 		xp->split = 1;	/* waitlast() */
863 	}
864 
865 	xp->u.shf = shf;
866 	return XCOM;
867 }
868 
869 /*
870  * perform #pattern and %pattern substitution in ${}
871  */
872 
873 static char *
874 trimsub(str, pat, how)
875 	register char *str;
876 	char *pat;
877 	int how;
878 {
879 	register char *end = strchr(str, 0);
880 	register char *p, c;
881 
882 	switch (how&0xff) {	/* UCHAR_MAX maybe? */
883 	  case '#':		/* shortest at begining */
884 		for (p = str; p <= end; p++) {
885 			c = *p; *p = '\0';
886 			if (gmatch(str, pat, FALSE)) {
887 				*p = c;
888 				return p;
889 			}
890 			*p = c;
891 		}
892 		break;
893 	  case '#'|0x80:	/* longest match at begining */
894 		for (p = end; p >= str; p--) {
895 			c = *p; *p = '\0';
896 			if (gmatch(str, pat, FALSE)) {
897 				*p = c;
898 				return p;
899 			}
900 			*p = c;
901 		}
902 		break;
903 	  case '%':		/* shortest match at end */
904 		for (p = end; p >= str; p--) {
905 			if (gmatch(p, pat, FALSE))
906 				return str_nsave(str, p - str, ATEMP);
907 		}
908 		break;
909 	  case '%'|0x80:	/* longest match at end */
910 		for (p = str; p <= end; p++) {
911 			if (gmatch(p, pat, FALSE))
912 				return str_nsave(str, p - str, ATEMP);
913 		}
914 		break;
915 	}
916 
917 	return str;		/* no match, return string */
918 }
919 
920 /*
921  * glob
922  * Name derived from V6's /etc/glob, the program that expanded filenames.
923  */
924 
925 /* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
926 static void
927 glob(cp, wp, markdirs)
928 	char *cp;
929 	register XPtrV *wp;
930 	int markdirs;
931 {
932 	int oldsize = XPsize(*wp);
933 
934 	if (glob_str(cp, wp, markdirs) == 0)
935 		XPput(*wp, debunk(cp, cp));
936 	else
937 		qsortp(XPptrv(*wp) + oldsize, (size_t)(XPsize(*wp) - oldsize),
938 			xstrcmp);
939 }
940 
941 #define GF_NONE		0
942 #define GF_EXCHECK	BIT(0)		/* do existance check on file */
943 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
944 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
945 
946 /* Apply file globbing to cp and store the matching files in wp.  Returns
947  * the number of matches found.
948  */
949 int
950 glob_str(cp, wp, markdirs)
951 	char *cp;
952 	XPtrV *wp;
953 	int markdirs;
954 {
955 	int oldsize = XPsize(*wp);
956 	XString xs;
957 	char *xp;
958 
959 	Xinit(xs, xp, 256, ATEMP);
960 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
961 	Xfree(xs, xp);
962 
963 	return XPsize(*wp) - oldsize;
964 }
965 
966 static void
967 globit(xs, xpp, sp, wp, check)
968 	XString *xs;		/* dest string */
969 	char **xpp;		/* ptr to dest end */
970 	char *sp;		/* source path */
971 	register XPtrV *wp;	/* output list */
972 	int check;		/* GF_* flags */
973 {
974 	register char *np;	/* next source component */
975 	char *xp = *xpp;
976 	char *se;
977 	char odirsep;
978 
979 	/* This to allow long expansions to be interrupted */
980 	intrcheck();
981 
982 	if (sp == NULL) {	/* end of source path */
983 		/* We only need to check if the file exists if a pattern
984 		 * is followed by a non-pattern (eg, foo*x/bar; no check
985 		 * is needed for foo* since the match must exist) or if
986 		 * any patterns were expanded and the markdirs option is set.
987 		 * Symlinks make things a bit tricky...
988 		 */
989 		if ((check & GF_EXCHECK)
990 		    || ((check & GF_MARKDIR) && (check & GF_GLOBBED)))
991 		{
992 #define stat_check()	(stat_done ? stat_done : \
993 			    (stat_done = stat(Xstring(*xs, xp), &statb) < 0 \
994 				? -1 : 1))
995 			struct stat lstatb, statb;
996 			int stat_done = 0;	 /* -1: failed, 1 ok */
997 
998 			if (lstat(Xstring(*xs, xp), &lstatb) < 0)
999 				return;
1000 			/* special case for systems which strip trailing
1001 			 * slashes from regular files (eg, /etc/passwd/).
1002 			 * SunOS 4.1.3 does this...
1003 			 */
1004 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp)
1005 			    && ISDIRSEP(xp[-1]) && !S_ISDIR(lstatb.st_mode)
1006 #ifdef S_ISLNK
1007 			    && (!S_ISLNK(lstatb.st_mode)
1008 				|| stat_check() < 0
1009 				|| !S_ISDIR(statb.st_mode))
1010 #endif /* S_ISLNK */
1011 				)
1012 				return;
1013 			/* Possibly tack on a trailing / if there isn't already
1014 			 * one and if the file is a directory or a symlink to a
1015 			 * directory
1016 			 */
1017 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED))
1018 			    && xp > Xstring(*xs, xp) && !ISDIRSEP(xp[-1])
1019 			    && (S_ISDIR(lstatb.st_mode)
1020 #ifdef S_ISLNK
1021 				|| (S_ISLNK(lstatb.st_mode)
1022 				    && stat_check() > 0
1023 				    && S_ISDIR(statb.st_mode))
1024 #endif /* S_ISLNK */
1025 				    ))
1026 			{
1027 				*xp++ = DIRSEP;
1028 				*xp = '\0';
1029 			}
1030 		}
1031 #ifdef OS2 /* Done this way to avoid bug in gcc 2.7.2... */
1032     /* Ugly kludge required for command
1033      * completion - see how search_access()
1034      * is implemented for OS/2...
1035      */
1036 # define KLUDGE_VAL	4
1037 #else /* OS2 */
1038 # define KLUDGE_VAL	0
1039 #endif /* OS2 */
1040 		XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp)
1041 			+ KLUDGE_VAL, ATEMP));
1042 		return;
1043 	}
1044 
1045 	if (xp > Xstring(*xs, xp))
1046 		*xp++ = DIRSEP;
1047 	while (ISDIRSEP(*sp)) {
1048 		Xcheck(*xs, xp);
1049 		*xp++ = *sp++;
1050 	}
1051 	np = ksh_strchr_dirsep(sp);
1052 	if (np != NULL) {
1053 		se = np;
1054 		odirsep = *np;	/* don't assume DIRSEP, can be multiple kinds */
1055 		*np++ = '\0';
1056 	} else {
1057 		odirsep = '\0'; /* keep gcc quiet */
1058 		se = sp + strlen(sp);
1059 	}
1060 
1061 
1062 	/* Check if sp needs globbing - done to avoid pattern checks for strings
1063 	 * containing MAGIC characters, open ['s without the matching close ],
1064 	 * etc. (otherwise opendir() will be called which may fail because the
1065 	 * directory isn't readable - if no globbing is needed, only execute
1066 	 * permission should be required (as per POSIX)).
1067 	 */
1068 	if (!has_globbing(sp, se)) {
1069 		XcheckN(*xs, xp, se - sp + 1);
1070 		debunk(xp, sp);
1071 		xp += strlen(xp);
1072 		*xpp = xp;
1073 		globit(xs, xpp, np, wp, check);
1074 	} else {
1075 		DIR *dirp;
1076 		struct dirent *d;
1077 		char *name;
1078 		int len;
1079 		int prefix_len;
1080 
1081 		/* xp = *xpp;	   copy_non_glob() may have re-alloc'd xs */
1082 		*xp = '\0';
1083 		prefix_len = Xlength(*xs, xp);
1084 		dirp = ksh_opendir(prefix_len ? Xstring(*xs, xp) : ".");
1085 		if (dirp == NULL)
1086 			goto Nodir;
1087 		while ((d = readdir(dirp)) != NULL) {
1088 			name = d->d_name;
1089 			if (name[0] == '.' &&
1090 			    (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
1091 				continue; /* always ignore . and .. */
1092 			if ((*name == '.' && *sp != '.')
1093 			    || !gmatch(name, sp, TRUE))
1094 				continue;
1095 
1096 			len = NLENGTH(d) + 1;
1097 			XcheckN(*xs, xp, len);
1098 			memcpy(xp, name, len);
1099 			*xpp = xp + len - 1;
1100 			globit(xs, xpp, np, wp,
1101 				(check & GF_MARKDIR) | GF_GLOBBED
1102 				| (np ? GF_EXCHECK : GF_NONE));
1103 			xp = Xstring(*xs, xp) + prefix_len;
1104 		}
1105 		closedir(dirp);
1106 	  Nodir:;
1107 	}
1108 
1109 	if (np != NULL)
1110 		*--np = odirsep;
1111 }
1112 
1113 #if 0
1114 /* Check if p contains something that needs globbing; if it does, 0 is
1115  * returned; if not, p is copied into xs/xp after stripping any MAGICs
1116  */
1117 static int	copy_non_glob ARGS((XString *xs, char **xpp, char *p));
1118 static int
1119 copy_non_glob(xs, xpp, p)
1120 	XString *xs;
1121 	char **xpp;
1122 	char *p;
1123 {
1124 	char *xp;
1125 	int len = strlen(p);
1126 
1127 	XcheckN(*xs, *xpp, len);
1128 	xp = *xpp;
1129 	for (; *p; p++) {
1130 		if (ISMAGIC(*p)) {
1131 			int c = *++p;
1132 
1133 			if (c == '*' || c == '?')
1134 				return 0;
1135 			if (*p == '[') {
1136 				char *q = p + 1;
1137 
1138 				if (ISMAGIC(*q) && q[1] == NOT)
1139 					q += 2;
1140 				if (ISMAGIC(*q) && q[1] == ']')
1141 					q += 2;
1142 				for (; *q; q++)
1143 					if (ISMAGIC(*q) && *++q == ']')
1144 						return 0;
1145 				/* pass a literal [ through */
1146 			}
1147 			/* must be a MAGIC-MAGIC, or MAGIC-!, MAGIC--, etc. */
1148 		}
1149 		*xp++ = *p;
1150 	}
1151 	*xp = '\0';
1152 	*xpp = xp;
1153 	return 1;
1154 }
1155 #endif /* 0 */
1156 
1157 /* remove MAGIC from string */
1158 char *
1159 debunk(dp, sp)
1160 	char *dp;
1161 	const char *sp;
1162 {
1163 	char *d, *s;
1164 
1165 	if ((s = strchr(sp, MAGIC))) {
1166 		memcpy(dp, sp, s - sp);
1167 		for (d = dp + (s - sp); *s; s++)
1168 			if (!ISMAGIC(*s) || !(*++s & 0x80)
1169 			    || !strchr("*+?@!", *s & 0x7f))
1170 				*d++ = *s;
1171 			else {
1172 				/* extended pattern operators: *+?@! */
1173 				*d++ = *s & 0x7f;
1174 				*d++ = '(';
1175 			}
1176 		*d = '\0';
1177 	} else if (dp != sp)
1178 		strcpy(dp, sp);
1179 	return dp;
1180 }
1181 
1182 /* Check if p is an unquoted name, possibly followed by a / or :.  If so
1183  * puts the expanded version in *dcp,dp and returns a pointer in p just
1184  * past the name, otherwise returns 0.
1185  */
1186 static char *
1187 maybe_expand_tilde(p, dsp, dpp, isassign)
1188 	char *p;
1189 	XString *dsp;
1190 	char **dpp;
1191 	int isassign;
1192 {
1193 	XString ts;
1194 	char *dp = *dpp;
1195 	char *tp, *r;
1196 
1197 	Xinit(ts, tp, 16, ATEMP);
1198 	/* : only for DOASNTILDE form */
1199 	while (p[0] == CHAR && !ISDIRSEP(p[1])
1200 	       && (!isassign || p[1] != PATHSEP))
1201 	{
1202 		Xcheck(ts, tp);
1203 		*tp++ = p[1];
1204 		p += 2;
1205 	}
1206 	*tp = '\0';
1207 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ? tilde(Xstring(ts, tp)) : (char *) 0;
1208 	Xfree(ts, tp);
1209 	if (r) {
1210 		while (*r) {
1211 			Xcheck(*dsp, dp);
1212 			if (ISMAGIC(*r))
1213 				*dp++ = MAGIC;
1214 			*dp++ = *r++;
1215 		}
1216 		*dpp = dp;
1217 		r = p;
1218 	}
1219 	return r;
1220 }
1221 
1222 /*
1223  * tilde expansion
1224  *
1225  * based on a version by Arnold Robbins
1226  */
1227 
1228 static char *
1229 tilde(cp)
1230 	char *cp;
1231 {
1232 	char *dp;
1233 
1234 	if (cp[0] == '\0')
1235 		dp = str_val(global("HOME"));
1236 	else if (cp[0] == '+' && cp[1] == '\0')
1237 		dp = str_val(global("PWD"));
1238 	else if (cp[0] == '-' && cp[1] == '\0')
1239 		dp = str_val(global("OLDPWD"));
1240 	else
1241 		dp = homedir(cp);
1242 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
1243 	if (dp == null)
1244 		dp = (char *) 0;
1245 	return dp;
1246 }
1247 
1248 /*
1249  * map userid to user's home directory.
1250  * note that 4.3's getpw adds more than 6K to the shell,
1251  * and the YP version probably adds much more.
1252  * we might consider our own version of getpwnam() to keep the size down.
1253  */
1254 
1255 static char *
1256 homedir(name)
1257 	char *name;
1258 {
1259 	register struct tbl *ap;
1260 
1261 	ap = tenter(&homedirs, name, hash(name));
1262 	if (!(ap->flag & ISSET)) {
1263 #ifdef OS2
1264 		/* No usernames in OS2 - punt */
1265 		return NULL;
1266 #else /* OS2 */
1267 		struct passwd *pw;
1268 
1269 		pw = getpwnam(name);
1270 		if (pw == NULL)
1271 			return NULL;
1272 		ap->val.s = str_save(pw->pw_dir, APERM);
1273 		ap->flag |= DEFINED|ISSET|ALLOC;
1274 #endif /* OS2 */
1275 	}
1276 	return ap->val.s;
1277 }
1278 
1279 #ifdef BRACE_EXPAND
1280 static void
1281 alt_expand(wp, start, exp_start, end, fdo)
1282 	XPtrV *wp;
1283 	char *start, *exp_start;
1284 	char *end;
1285 	int fdo;
1286 {
1287 	int UNINITIALIZED(count);
1288 	char *brace_start, *brace_end, *UNINITIALIZED(comma);
1289 	char *field_start;
1290 	char *p;
1291 
1292 	/* search for open brace */
1293 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != OBRACE; p += 2)
1294 		;
1295 	brace_start = p;
1296 
1297 	/* find matching close brace, if any */
1298 	if (p) {
1299 		comma = (char *) 0;
1300 		count = 1;
1301 		for (p += 2; *p && count; p++) {
1302 			if (ISMAGIC(*p)) {
1303 				if (*++p == OBRACE)
1304 					count++;
1305 				else if (*p == CBRACE)
1306 					--count;
1307 				else if (*p == ',' && count == 1)
1308 					comma = p;
1309 			}
1310 		}
1311 	}
1312 	/* no valid expansions... */
1313 	if (!p || count != 0) {
1314 		/* Note that given a{{b,c} we do not expand anything (this is
1315 		 * what at&t ksh does.  This may be changed to do the {b,c}
1316 		 * expansion. }
1317 		 */
1318 		if (fdo & DOGLOB)
1319 			glob(start, wp, fdo & DOMARKDIRS);
1320 		else
1321 			XPput(*wp, debunk(start, start));
1322 		return;
1323 	}
1324 	brace_end = p;
1325 	if (!comma) {
1326 		alt_expand(wp, start, brace_end, end, fdo);
1327 		return;
1328 	}
1329 
1330 	/* expand expression */
1331 	field_start = brace_start + 2;
1332 	count = 1;
1333 	for (p = brace_start + 2; p != brace_end; p++) {
1334 		if (ISMAGIC(*p)) {
1335 			if (*++p == OBRACE)
1336 				count++;
1337 			else if ((*p == CBRACE && --count == 0)
1338 				 || (*p == ',' && count == 1))
1339 			{
1340 				char *new;
1341 				int l1, l2, l3;
1342 
1343 				l1 = brace_start - start;
1344 				l2 = (p - 1) - field_start;
1345 				l3 = end - brace_end;
1346 				new = (char *) alloc(l1 + l2 + l3 + 1, ATEMP);
1347 				memcpy(new, start, l1);
1348 				memcpy(new + l1, field_start, l2);
1349 				memcpy(new + l1 + l2, brace_end, l3);
1350 				new[l1 + l2 + l3] = '\0';
1351 				alt_expand(wp, new, new + l1,
1352 					   new + l1 + l2 + l3, fdo);
1353 				field_start = p + 1;
1354 			}
1355 		}
1356 	}
1357 	return;
1358 }
1359 #endif /* BRACE_EXPAND */
1360