xref: /netbsd-src/bin/sh/parser.c (revision 122b5006ee1bd67145794b4cde92f4fe4781a5ec)
1 /*	$NetBSD: parser.c,v 1.174 2021/09/15 18:29:45 kre Exp $	*/
2 
3 /*-
4  * Copyright (c) 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Kenneth Almquist.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 #ifndef lint
37 #if 0
38 static char sccsid[] = "@(#)parser.c	8.7 (Berkeley) 5/16/95";
39 #else
40 __RCSID("$NetBSD: parser.c,v 1.174 2021/09/15 18:29:45 kre Exp $");
41 #endif
42 #endif /* not lint */
43 
44 #include <limits.h>
45 #include <signal.h>
46 #include <stdio.h>
47 #include <stdlib.h>
48 
49 #include "shell.h"
50 #include "parser.h"
51 #include "nodes.h"
52 #include "expand.h"	/* defines rmescapes() */
53 #include "eval.h"	/* defines commandname */
54 #include "syntax.h"
55 #include "options.h"
56 #include "input.h"
57 #include "output.h"
58 #include "redir.h"	/* defines max_user_fd */
59 #include "var.h"
60 #include "error.h"
61 #include "memalloc.h"
62 #include "mystring.h"
63 #include "alias.h"
64 #include "show.h"
65 #ifndef SMALL
66 #include "myhistedit.h"
67 #endif
68 #ifdef DEBUG
69 #include "nodenames.h"
70 #endif
71 
72 /*
73  * Shell command parser.
74  */
75 
76 /* values returned by readtoken */
77 #include "token.h"
78 
79 #define OPENBRACE '{'
80 #define CLOSEBRACE '}'
81 
82 struct HereDoc {
83 	struct HereDoc *next;	/* next here document in list */
84 	union node *here;		/* redirection node */
85 	char *eofmark;		/* string indicating end of input */
86 	int striptabs;		/* if set, strip leading tabs */
87 	int startline;		/* line number where << seen */
88 };
89 
90 MKINIT struct parse_state parse_state;
91 union parse_state_p psp = { .c_current_parser = &parse_state };
92 
93 static const struct parse_state init_parse_state = {	/* all 0's ... */
94 	.ps_heredoclist = NULL,
95 	.ps_parsebackquote = 0,
96 	.ps_doprompt = 0,
97 	.ps_needprompt = 0,
98 	.ps_lasttoken = 0,
99 	.ps_tokpushback = 0,
100 	.ps_wordtext = NULL,
101 	.ps_checkkwd = 0,
102 	.ps_redirnode = NULL,
103 	.ps_heredoc = NULL,
104 	.ps_quoteflag = 0,
105 	.ps_startlinno = 0,
106 	.ps_funclinno = 0,
107 	.ps_elided_nl = 0,
108 };
109 
110 STATIC union node *list(int);
111 STATIC union node *andor(void);
112 STATIC union node *pipeline(void);
113 STATIC union node *command(void);
114 STATIC union node *simplecmd(union node **, union node *);
115 STATIC union node *makeword(int);
116 STATIC void parsefname(void);
117 STATIC int slurp_heredoc(char *const, const int, const int);
118 STATIC void readheredocs(void);
119 STATIC int peektoken(void);
120 STATIC int readtoken(void);
121 STATIC int xxreadtoken(void);
122 STATIC int readtoken1(int, char const *, int);
123 STATIC int noexpand(char *);
124 STATIC void linebreak(void);
125 STATIC void consumetoken(int);
126 STATIC void synexpect(int, const char *) __dead;
127 STATIC void synerror(const char *) __dead;
128 STATIC void setprompt(int);
129 STATIC int pgetc_linecont(void);
130 
131 static const char EOFhere[] = "EOF reading here (<<) document";
132 
133 #ifdef DEBUG
134 int parsing = 0;
135 #endif
136 
137 /*
138  * Read and parse a command.  Returns NEOF on end of file.  (NULL is a
139  * valid parse tree indicating a blank line.)
140  */
141 
142 union node *
143 parsecmd(int interact)
144 {
145 	int t;
146 	union node *n;
147 
148 #ifdef DEBUG
149 	parsing++;
150 #endif
151 	tokpushback = 0;
152 	checkkwd = 0;
153 	doprompt = interact;
154 	if (doprompt)
155 		setprompt(1);
156 	else
157 		setprompt(0);
158 	needprompt = 0;
159 	t = readtoken();
160 #ifdef DEBUG
161 	parsing--;
162 #endif
163 	if (t == TEOF)
164 		return NEOF;
165 	if (t == TNL)
166 		return NULL;
167 
168 #ifdef DEBUG
169 	parsing++;
170 #endif
171 	tokpushback++;
172 	n = list(1);
173 #ifdef DEBUG
174 	parsing--;
175 #endif
176 	if (heredoclist)
177 		error("%d: Here document (<<%s) expected but not present",
178 			heredoclist->startline, heredoclist->eofmark);
179 	return n;
180 }
181 
182 
183 STATIC union node *
184 list(int nlflag)
185 {
186 	union node *ntop, *n1, *n2, *n3;
187 	int tok;
188 
189 	CTRACE(DBG_PARSE, ("list(%d): entered @%d\n",nlflag,plinno));
190 
191 	checkkwd = CHKNL | CHKKWD | CHKALIAS;
192 	if (nlflag == 0 && tokendlist[peektoken()])
193 		return NULL;
194 	ntop = n1 = NULL;
195 	for (;;) {
196 		n2 = andor();
197 		tok = readtoken();
198 		if (tok == TBACKGND) {
199 			if (n2->type == NCMD || n2->type == NPIPE)
200 				n2->ncmd.backgnd = 1;
201 			else if (n2->type == NREDIR)
202 				n2->type = NBACKGND;
203 			else {
204 				n3 = stalloc(sizeof(struct nredir));
205 				n3->type = NBACKGND;
206 				n3->nredir.n = n2;
207 				n3->nredir.redirect = NULL;
208 				n2 = n3;
209 			}
210 		}
211 
212 		if (ntop == NULL)
213 			ntop = n2;
214 		else if (n1 == NULL) {
215 			n1 = stalloc(sizeof(struct nbinary));
216 			n1->type = NSEMI;
217 			n1->nbinary.ch1 = ntop;
218 			n1->nbinary.ch2 = n2;
219 			ntop = n1;
220 		} else {
221 			n3 = stalloc(sizeof(struct nbinary));
222 			n3->type = NSEMI;
223 			n3->nbinary.ch1 = n1->nbinary.ch2;
224 			n3->nbinary.ch2 = n2;
225 			n1->nbinary.ch2 = n3;
226 			n1 = n3;
227 		}
228 
229 		switch (tok) {
230 		case TBACKGND:
231 		case TSEMI:
232 			tok = readtoken();
233 			/* FALLTHROUGH */
234 		case TNL:
235 			if (tok == TNL) {
236 				readheredocs();
237 				if (nlflag)
238 					return ntop;
239 			} else if (tok == TEOF && nlflag)
240 				return ntop;
241 			else
242 				tokpushback++;
243 
244 			checkkwd = CHKNL | CHKKWD | CHKALIAS;
245 			if (!nlflag && tokendlist[peektoken()])
246 				return ntop;
247 			break;
248 		case TEOF:
249 			pungetc();	/* push back EOF on input */
250 			return ntop;
251 		default:
252 			if (nlflag)
253 				synexpect(-1, 0);
254 			tokpushback++;
255 			return ntop;
256 		}
257 	}
258 }
259 
260 STATIC union node *
261 andor(void)
262 {
263 	union node *n1, *n2, *n3;
264 	int t;
265 
266 	CTRACE(DBG_PARSE, ("andor: entered @%d\n", plinno));
267 
268 	n1 = pipeline();
269 	for (;;) {
270 		if ((t = readtoken()) == TAND) {
271 			t = NAND;
272 		} else if (t == TOR) {
273 			t = NOR;
274 		} else {
275 			tokpushback++;
276 			return n1;
277 		}
278 		n2 = pipeline();
279 		n3 = stalloc(sizeof(struct nbinary));
280 		n3->type = t;
281 		n3->nbinary.ch1 = n1;
282 		n3->nbinary.ch2 = n2;
283 		n1 = n3;
284 	}
285 }
286 
287 STATIC union node *
288 pipeline(void)
289 {
290 	union node *n1, *n2, *pipenode;
291 	struct nodelist *lp, *prev;
292 	int negate;
293 
294 	CTRACE(DBG_PARSE, ("pipeline: entered @%d\n", plinno));
295 
296 	negate = 0;
297 	checkkwd = CHKNL | CHKKWD | CHKALIAS;
298 	while (readtoken() == TNOT) {
299 		CTRACE(DBG_PARSE, ("pipeline: TNOT recognized\n"));
300 #ifndef BOGUS_NOT_COMMAND
301 		if (posix && negate)
302 			synerror("2nd \"!\" unexpected");
303 #endif
304 		negate++;
305 	}
306 	tokpushback++;
307 	n1 = command();
308 	if (readtoken() == TPIPE) {
309 		pipenode = stalloc(sizeof(struct npipe));
310 		pipenode->type = NPIPE;
311 		pipenode->npipe.backgnd = 0;
312 		lp = stalloc(sizeof(struct nodelist));
313 		pipenode->npipe.cmdlist = lp;
314 		lp->n = n1;
315 		do {
316 			prev = lp;
317 			lp = stalloc(sizeof(struct nodelist));
318 			lp->n = command();
319 			prev->next = lp;
320 		} while (readtoken() == TPIPE);
321 		lp->next = NULL;
322 		n1 = pipenode;
323 	}
324 	tokpushback++;
325 	if (negate) {
326 		CTRACE(DBG_PARSE, ("%snegate pipeline\n",
327 		    (negate&1) ? "" : "double "));
328 		n2 = stalloc(sizeof(struct nnot));
329 		n2->type = (negate & 1) ? NNOT : NDNOT;
330 		n2->nnot.com = n1;
331 		return n2;
332 	} else
333 		return n1;
334 }
335 
336 
337 
338 STATIC union node *
339 command(void)
340 {
341 	union node *n1, *n2;
342 	union node *ap, **app;
343 	union node *cp, **cpp;
344 	union node *redir, **rpp;
345 	int t;
346 #ifdef BOGUS_NOT_COMMAND
347 	int negate = 0;
348 #endif
349 
350 	CTRACE(DBG_PARSE, ("command: entered @%d\n", plinno));
351 
352 	checkkwd = CHKNL | CHKKWD | CHKALIAS;
353 	redir = NULL;
354 	n1 = NULL;
355 	rpp = &redir;
356 
357 	/* Check for redirection which may precede command */
358 	while (readtoken() == TREDIR) {
359 		*rpp = n2 = redirnode;
360 		rpp = &n2->nfile.next;
361 		parsefname();
362 	}
363 	tokpushback++;
364 
365 #ifdef BOGUS_NOT_COMMAND		/* only in pileline() */
366 	while (readtoken() == TNOT) {
367 		CTRACE(DBG_PARSE, ("command: TNOT (bogus) recognized\n"));
368 		negate++;
369 	}
370 	tokpushback++;
371 #endif
372 
373 	switch (readtoken()) {
374 	case TIF:
375 		n1 = stalloc(sizeof(struct nif));
376 		n1->type = NIF;
377 		n1->nif.test = list(0);
378 		consumetoken(TTHEN);
379 		n1->nif.ifpart = list(0);
380 		n2 = n1;
381 		while (readtoken() == TELIF) {
382 			n2->nif.elsepart = stalloc(sizeof(struct nif));
383 			n2 = n2->nif.elsepart;
384 			n2->type = NIF;
385 			n2->nif.test = list(0);
386 			consumetoken(TTHEN);
387 			n2->nif.ifpart = list(0);
388 		}
389 		if (lasttoken == TELSE)
390 			n2->nif.elsepart = list(0);
391 		else {
392 			n2->nif.elsepart = NULL;
393 			tokpushback++;
394 		}
395 		consumetoken(TFI);
396 		checkkwd = CHKKWD | CHKALIAS;
397 		break;
398 	case TWHILE:
399 	case TUNTIL:
400 		n1 = stalloc(sizeof(struct nbinary));
401 		n1->type = (lasttoken == TWHILE)? NWHILE : NUNTIL;
402 		n1->nbinary.ch1 = list(0);
403 		consumetoken(TDO);
404 		n1->nbinary.ch2 = list(0);
405 		consumetoken(TDONE);
406 		checkkwd = CHKKWD | CHKALIAS;
407 		break;
408 	case TFOR:
409 		if (readtoken() != TWORD || quoteflag || ! goodname(wordtext))
410 			synerror("Bad for loop variable");
411 		n1 = stalloc(sizeof(struct nfor));
412 		n1->type = NFOR;
413 		n1->nfor.var = wordtext;
414 		linebreak();
415 		if (lasttoken==TWORD && !quoteflag && equal(wordtext,"in")) {
416 			app = &ap;
417 			while (readtoken() == TWORD) {
418 				n2 = makeword(startlinno);
419 				*app = n2;
420 				app = &n2->narg.next;
421 			}
422 			*app = NULL;
423 			n1->nfor.args = ap;
424 			if (lasttoken != TNL && lasttoken != TSEMI)
425 				synexpect(TSEMI, 0);
426 			if (lasttoken == TNL)
427 				readheredocs();
428 		} else {
429 			static char argvars[5] = {
430 			    CTLVAR, VSNORMAL|VSQUOTE, '@', '=', '\0'
431 			};
432 
433 			n2 = stalloc(sizeof(struct narg));
434 			n2->type = NARG;
435 			n2->narg.text = argvars;
436 			n2->narg.backquote = NULL;
437 			n2->narg.next = NULL;
438 			n2->narg.lineno = startlinno;
439 			n1->nfor.args = n2;
440 			/*
441 			 * Newline or semicolon here is optional (but note
442 			 * that the original Bourne shell only allowed NL).
443 			 */
444 			if (lasttoken != TNL && lasttoken != TSEMI)
445 				tokpushback++;
446 		}
447 		checkkwd = CHKNL | CHKKWD | CHKALIAS;
448 		if ((t = readtoken()) == TDO)
449 			t = TDONE;
450 		else if (t == TBEGIN)
451 			t = TEND;
452 		else
453 			synexpect(TDO, 0);
454 		n1->nfor.body = list(0);
455 		consumetoken(t);
456 		checkkwd = CHKKWD | CHKALIAS;
457 		break;
458 	case TCASE:
459 		n1 = stalloc(sizeof(struct ncase));
460 		n1->type = NCASE;
461 		n1->ncase.lineno = startlinno - elided_nl;
462 		consumetoken(TWORD);
463 		n1->ncase.expr = makeword(startlinno);
464 		linebreak();
465 		if (lasttoken != TWORD || !equal(wordtext, "in"))
466 			synexpect(-1, "in");
467 		cpp = &n1->ncase.cases;
468 		checkkwd = CHKNL | CHKKWD;
469 		readtoken();
470 		/*
471 		 * Both ksh and bash accept 'case x in esac'
472 		 * so configure scripts started taking advantage of this.
473 		 * The page: http://pubs.opengroup.org/onlinepubs/\
474 		 * 009695399/utilities/xcu_chap02.html contradicts itself,
475 		 * as to if this is legal; the "Case Conditional Format"
476 		 * paragraph shows one case is required, but the "Grammar"
477 		 * section shows a grammar that explicitly allows the no
478 		 * case option.
479 		 *
480 		 * The standard also says (section 2.10):
481 		 *   This formal syntax shall take precedence over the
482 		 *   preceding text syntax description.
483 		 * ie: the "Grammar" section wins.  The text is just
484 		 * a rough guide (introduction to the common case.)
485 		 */
486 		while (lasttoken != TESAC) {
487 			*cpp = cp = stalloc(sizeof(struct nclist));
488 			cp->type = NCLIST;
489 			app = &cp->nclist.pattern;
490 			if (lasttoken == TLP)
491 				readtoken();
492 			for (;;) {
493 				if (lasttoken < TWORD)
494 					synexpect(TWORD, 0);
495 				*app = ap = makeword(startlinno);
496 				checkkwd = CHKNL | CHKKWD;
497 				if (readtoken() != TPIPE)
498 					break;
499 				app = &ap->narg.next;
500 				readtoken();
501 			}
502 			if (lasttoken != TRP)
503 				synexpect(TRP, 0);
504 			cp->nclist.lineno = startlinno;
505 			cp->nclist.body = list(0);
506 
507 			checkkwd = CHKNL | CHKKWD | CHKALIAS;
508 			if ((t = readtoken()) != TESAC) {
509 				if (t != TENDCASE && t != TCASEFALL) {
510 					synexpect(TENDCASE, 0);
511 				} else {
512 					if (t == TCASEFALL)
513 						cp->type = NCLISTCONT;
514 					checkkwd = CHKNL | CHKKWD;
515 					readtoken();
516 				}
517 			}
518 			cpp = &cp->nclist.next;
519 		}
520 		*cpp = NULL;
521 		checkkwd = CHKKWD | CHKALIAS;
522 		break;
523 	case TLP:
524 		n1 = stalloc(sizeof(struct nredir));
525 		n1->type = NSUBSHELL;
526 		n1->nredir.n = list(0);
527 		n1->nredir.redirect = NULL;
528 		if (n1->nredir.n == NULL)
529 			synexpect(-1, 0);
530 		consumetoken(TRP);
531 		checkkwd = CHKKWD | CHKALIAS;
532 		break;
533 	case TBEGIN:
534 		n1 = list(0);
535 		if (posix && n1 == NULL)
536 			synexpect(-1, 0);
537 		consumetoken(TEND);
538 		checkkwd = CHKKWD | CHKALIAS;
539 		break;
540 
541 	case TBACKGND:
542 	case TSEMI:
543 	case TAND:
544 	case TOR:
545 	case TPIPE:
546 	case TNL:
547 	case TEOF:
548 	case TRP:
549 	case TENDCASE:
550 	case TCASEFALL:
551 		/*
552 		 * simple commands must have something in them,
553 		 * either a word (which at this point includes a=b)
554 		 * or a redirection.  If we reached the end of the
555 		 * command (which one of these tokens indicates)
556 		 * when we are just starting, and have not had a
557 		 * redirect, then ...
558 		 *
559 		 * nb: it is still possible to end up with empty
560 		 * simple commands, if the "command" is a var
561 		 * expansion that produces nothing:
562 		 *	X= ; $X && $X
563 		 * -->          &&
564 		 * That is OK and is handled after word expansions.
565 		 */
566 		if (!redir)
567 			synexpect(-1, 0);
568 		/*
569 		 * continue to build a node containing the redirect.
570 		 * the tokpushback means that our ending token will be
571 		 * read again in simplecmd, causing it to terminate,
572 		 * so only the redirect(s) will be contained in the
573 		 * returned n1
574 		 */
575 		/* FALLTHROUGH */
576 	case TWORD:
577 		tokpushback++;
578 		n1 = simplecmd(rpp, redir);
579 		goto checkneg;
580 	default:
581 		synexpect(-1, 0);
582 		/* NOTREACHED */
583 	}
584 
585 	/* Now check for redirection which may follow command */
586 	while (readtoken() == TREDIR) {
587 		*rpp = n2 = redirnode;
588 		rpp = &n2->nfile.next;
589 		parsefname();
590 	}
591 	tokpushback++;
592 	*rpp = NULL;
593 	if (redir) {
594 		if (n1 == NULL || n1->type != NSUBSHELL) {
595 			n2 = stalloc(sizeof(struct nredir));
596 			n2->type = NREDIR;
597 			n2->nredir.n = n1;
598 			n1 = n2;
599 		}
600 		n1->nredir.redirect = redir;
601 	}
602 
603  checkneg:
604 #ifdef BOGUS_NOT_COMMAND
605 	if (negate) {
606 		VTRACE(DBG_PARSE, ("bogus %snegate command\n",
607 		    (negate&1) ? "" : "double "));
608 		n2 = stalloc(sizeof(struct nnot));
609 		n2->type = (negate & 1) ? NNOT : NDNOT;
610 		n2->nnot.com = n1;
611 		return n2;
612 	}
613 	else
614 #endif
615 		return n1;
616 }
617 
618 
619 STATIC union node *
620 simplecmd(union node **rpp, union node *redir)
621 {
622 	union node *args, **app;
623 	union node *n = NULL;
624 	int line = 0;
625 	int savecheckkwd;
626 #ifdef BOGUS_NOT_COMMAND
627 	union node *n2;
628 	int negate = 0;
629 #endif
630 
631 	CTRACE(DBG_PARSE, ("simple command with%s redir already @%d\n",
632 	    redir ? "" : "out", plinno));
633 
634 	/* If we don't have any redirections already, then we must reset */
635 	/* rpp to be the address of the local redir variable.  */
636 	if (redir == 0)
637 		rpp = &redir;
638 
639 	args = NULL;
640 	app = &args;
641 
642 #ifdef BOGUS_NOT_COMMAND	/* pipelines get negated, commands do not */
643 	while (readtoken() == TNOT) {
644 		VTRACE(DBG_PARSE, ("simplcmd: bogus TNOT recognized\n"));
645 		negate++;
646 	}
647 	tokpushback++;
648 #endif
649 
650 	savecheckkwd = CHKALIAS;
651 	for (;;) {
652 		checkkwd = savecheckkwd;
653 		if (readtoken() == TWORD) {
654 			if (line == 0)
655 				line = startlinno;
656 			n = makeword(startlinno);
657 			*app = n;
658 			app = &n->narg.next;
659 			if (savecheckkwd != 0 && !isassignment(wordtext))
660 				savecheckkwd = 0;
661 		} else if (lasttoken == TREDIR) {
662 			if (line == 0)
663 				line = startlinno;
664 			*rpp = n = redirnode;
665 			rpp = &n->nfile.next;
666 			parsefname();	/* read name of redirection file */
667 		} else if (lasttoken == TLP && app == &args->narg.next
668 					    && redir == 0) {
669 			/* We have a function */
670 			consumetoken(TRP);
671 			funclinno = plinno;
672 			/*
673 			 * Make sure there are no unquoted $'s in the
674 			 * name (allowing those, not expanding them,
675 			 * simply treating '$' as a character, is desireable
676 			 * but the parser has converted them to CTLxxx
677 			 * chars, and that's not what we want
678 			 *
679 			 * Fortunately here the user can simply quote
680 			 * the name to avoid this restriction.
681 			 */
682 			if (!noexpand(n->narg.text))
683 				synerror("Bad function name (use quotes)");
684 			rmescapes(n->narg.text);
685 			if (strchr(n->narg.text, '/'))
686 				synerror("Bad function name");
687 			VTRACE(DBG_PARSE, ("Function '%s' seen @%d\n",
688 			    n->narg.text, plinno));
689 			n->type = NDEFUN;
690 			n->narg.lineno = plinno - elided_nl;
691 			n->narg.next = command();
692 			funclinno = 0;
693 			goto checkneg;
694 		} else {
695 			tokpushback++;
696 			break;
697 		}
698 	}
699 
700 	if (args == NULL && redir == NULL)
701 		synexpect(-1, 0);
702 	*app = NULL;
703 	*rpp = NULL;
704 	n = stalloc(sizeof(struct ncmd));
705 	n->type = NCMD;
706 	n->ncmd.lineno = line - elided_nl;
707 	n->ncmd.backgnd = 0;
708 	n->ncmd.args = args;
709 	n->ncmd.redirect = redir;
710 	n->ncmd.lineno = startlinno;
711 
712  checkneg:
713 #ifdef BOGUS_NOT_COMMAND
714 	if (negate) {
715 		VTRACE(DBG_PARSE, ("bogus %snegate simplecmd\n",
716 		    (negate&1) ? "" : "double "));
717 		n2 = stalloc(sizeof(struct nnot));
718 		n2->type = (negate & 1) ? NNOT : NDNOT;
719 		n2->nnot.com = n;
720 		return n2;
721 	}
722 	else
723 #endif
724 		return n;
725 }
726 
727 STATIC union node *
728 makeword(int lno)
729 {
730 	union node *n;
731 
732 	n = stalloc(sizeof(struct narg));
733 	n->type = NARG;
734 	n->narg.next = NULL;
735 	n->narg.text = wordtext;
736 	n->narg.backquote = backquotelist;
737 	n->narg.lineno = lno;
738 	return n;
739 }
740 
741 void
742 fixredir(union node *n, const char *text, int err)
743 {
744 
745 	VTRACE(DBG_PARSE, ("Fix redir %s %d\n", text, err));
746 	if (!err)
747 		n->ndup.vname = NULL;
748 
749 	if (is_number(text)) {
750 		n->ndup.dupfd = number(text);
751 		if (n->ndup.dupfd < user_fd_limit &&
752 		    n->ndup.dupfd > max_user_fd)
753 			max_user_fd = n->ndup.dupfd;
754 	} else if (text[0] == '-' && text[1] == '\0')
755 		n->ndup.dupfd = -1;
756 	else {
757 
758 		if (err)
759 			synerror("Bad fd number");
760 		else
761 			n->ndup.vname = makeword(startlinno - elided_nl);
762 	}
763 }
764 
765 
766 STATIC void
767 parsefname(void)
768 {
769 	union node *n = redirnode;
770 
771 	if (readtoken() != TWORD)
772 		synexpect(-1, 0);
773 	if (n->type == NHERE) {
774 		struct HereDoc *here = heredoc;
775 		struct HereDoc *p;
776 
777 		if (quoteflag == 0)
778 			n->type = NXHERE;
779 		VTRACE(DBG_PARSE, ("Here document %d @%d\n", n->type, plinno));
780 		if (here->striptabs) {
781 			while (*wordtext == '\t')
782 				wordtext++;
783 		}
784 
785 		/*
786 		 * this test is not really necessary, we are not
787 		 * required to expand wordtext, but there's no reason
788 		 * it cannot be $$ or something like that - that would
789 		 * not mean the pid, but literally two '$' characters.
790 		 * There is no need for limits on what the word can be.
791 		 * However, it needs to stay literal as entered, not
792 		 * have $ converted to CTLVAR or something, which as
793 		 * the parser is, at the minute, is impossible to prevent.
794 		 * So, leave it like this until the rest of the parser is fixed.
795 		 */
796 		if (!noexpand(wordtext))
797 			synerror("Illegal eof marker for << redirection");
798 
799 		rmescapes(wordtext);
800 		here->eofmark = wordtext;
801 		here->next = NULL;
802 		if (heredoclist == NULL)
803 			heredoclist = here;
804 		else {
805 			for (p = heredoclist ; p->next ; p = p->next)
806 				continue;
807 			p->next = here;
808 		}
809 	} else if (n->type == NTOFD || n->type == NFROMFD) {
810 		fixredir(n, wordtext, 0);
811 	} else {
812 		n->nfile.fname = makeword(startlinno - elided_nl);
813 	}
814 }
815 
816 /*
817  * Check to see whether we are at the end of the here document.  When this
818  * is called, c is set to the first character of the next input line.  If
819  * we are at the end of the here document, this routine sets the c to PEOF.
820  * The new value of c is returned.
821  */
822 
823 static int
824 checkend(int c, char * const eofmark, const int striptabs)
825 {
826 
827 	if (striptabs) {
828 		while (c == '\t')
829 			c = pgetc();
830 	}
831 	if (c == PEOF) {
832 		if (*eofmark == '\0')
833 			return (c);
834 		synerror(EOFhere);
835 	}
836 	if (c == *eofmark) {
837 		int c2;
838 		char *q;
839 
840 		for (q = eofmark + 1; c2 = pgetc(), *q != '\0' && c2 == *q; q++)
841 			if (c2 == '\n') {
842 				plinno++;
843 				needprompt = doprompt;
844 			}
845 		if ((c2 == PEOF || c2 == '\n') && *q == '\0') {
846 			c = PEOF;
847 			if (c2 == '\n') {
848 				plinno++;
849 				needprompt = doprompt;
850 			}
851 		} else {
852 			pungetc();
853 			pushstring(eofmark + 1, q - (eofmark + 1), NULL);
854 		}
855 	} else if (c == '\n' && *eofmark == '\0') {
856 		c = PEOF;
857 		plinno++;
858 		needprompt = doprompt;
859 	}
860 	return (c);
861 }
862 
863 
864 /*
865  * Input any here documents.
866  */
867 
868 STATIC int
869 slurp_heredoc(char *const eofmark, const int striptabs, const int sq)
870 {
871 	int c;
872 	char *out;
873 	int lines = plinno;
874 
875 	c = pgetc();
876 
877 	/*
878 	 * If we hit EOF on the input, and the eofmark is a null string ('')
879 	 * we consider this empty line to be the eofmark, and exit without err.
880 	 */
881 	if (c == PEOF && *eofmark != '\0')
882 		synerror(EOFhere);
883 
884 	STARTSTACKSTR(out);
885 
886 	while ((c = checkend(c, eofmark, striptabs)) != PEOF) {
887 		do {
888 			if (sq) {
889 				/*
890 				 * in single quoted mode (eofmark quoted)
891 				 * all we look for is \n so we can check
892 				 * for the epfmark - everything saved literally.
893 				 */
894 				STPUTC(c, out);
895 				if (c == '\n') {
896 					plinno++;
897 					break;
898 				}
899 				continue;
900 			}
901 			/*
902 			 * In double quoted (non-quoted eofmark)
903 			 * we must handle \ followed by \n here
904 			 * otherwise we can mismatch the end mark.
905 			 * All other uses of \ will be handled later
906 			 * when the here doc is expanded.
907 			 *
908 			 * This also makes sure \\ followed by \n does
909 			 * not suppress the newline (the \ quotes itself)
910 			 */
911 			if (c == '\\') {		/* A backslash */
912 				STPUTC(c, out);
913 				c = pgetc();		/* followed by */
914 				if (c == '\n') {	/* a newline?  */
915 					STPUTC(c, out);
916 					plinno++;
917 					continue;	/* don't break */
918 				}
919 			}
920 			STPUTC(c, out);			/* keep the char */
921 			if (c == '\n') {		/* at end of line */
922 				plinno++;
923 				break;			/* look for eofmark */
924 			}
925 		} while ((c = pgetc()) != PEOF);
926 
927 		/*
928 		 * If we have read a line, and reached EOF, without
929 		 * finding the eofmark, whether the EOF comes before
930 		 * or immediately after the \n, that is an error.
931 		 */
932 		if (c == PEOF || (c = pgetc()) == PEOF)
933 			synerror(EOFhere);
934 	}
935 	STPUTC('\0', out);
936 
937 	c = out - stackblock();
938 	out = stackblock();
939 	grabstackblock(c);
940 	wordtext = out;
941 
942 	VTRACE(DBG_PARSE,
943 	   ("Slurped a %d line %sheredoc (to '%s')%s: len %d, \"%.*s%s\" @%d\n",
944 		plinno - lines, sq ? "quoted " : "",  eofmark,
945 		striptabs ? " tab stripped" : "", c, (c > 16 ? 16 : c),
946 		wordtext, (c > 16 ? "..." : ""), plinno));
947 
948 	return (plinno - lines);
949 }
950 
951 static char *
952 insert_elided_nl(char *str)
953 {
954 	while (elided_nl > 0) {
955 		STPUTC(CTLNONL, str);
956 		elided_nl--;
957 	}
958 	return str;
959 }
960 
961 STATIC void
962 readheredocs(void)
963 {
964 	struct HereDoc *here;
965 	union node *n;
966 	int line, l;
967 
968 	line = 0;		/*XXX - gcc!  obviously unneeded */
969 	if (heredoclist)
970 		line = heredoclist->startline + 1;
971 	l = 0;
972 	while (heredoclist) {
973 		line += l;
974 		here = heredoclist;
975 		heredoclist = here->next;
976 		if (needprompt) {
977 			setprompt(2);
978 			needprompt = 0;
979 		}
980 
981 		l = slurp_heredoc(here->eofmark, here->striptabs,
982 		    here->here->nhere.type == NHERE);
983 
984 		here->here->nhere.doc = n = makeword(line);
985 
986 		if (here->here->nhere.type == NHERE)
987 			continue;
988 
989 		/*
990 		 * Now "parse" here docs that have unquoted eofmarkers.
991 		 */
992 		setinputstring(wordtext, 1, line);
993 		VTRACE(DBG_PARSE, ("Reprocessing %d line here doc from %d\n",
994 			l, line));
995 		readtoken1(pgetc(), DQSYNTAX, 1);
996 		n->narg.text = wordtext;
997 		n->narg.backquote = backquotelist;
998 		popfile();
999 	}
1000 }
1001 
1002 STATIC int
1003 peektoken(void)
1004 {
1005 	int t;
1006 
1007 	t = readtoken();
1008 	tokpushback++;
1009 	return (t);
1010 }
1011 
1012 STATIC int
1013 readtoken(void)
1014 {
1015 	int t;
1016 #ifdef DEBUG
1017 	int alreadyseen = tokpushback;
1018 	int savecheckkwd = checkkwd;
1019 #endif
1020 	struct alias *ap;
1021 
1022  top:
1023 	t = xxreadtoken();
1024 
1025 	if (checkkwd & CHKNL) {
1026 		while (t == TNL) {
1027 			readheredocs();
1028 			t = xxreadtoken();
1029 		}
1030 	}
1031 
1032 	/*
1033 	 * check for keywords and aliases
1034 	 */
1035 	if (t == TWORD && !quoteflag) {
1036 		const char *const *pp;
1037 
1038 		if (checkkwd & CHKKWD)
1039 			for (pp = parsekwd; *pp; pp++) {
1040 				if (**pp == *wordtext && equal(*pp, wordtext)) {
1041 					lasttoken = t = pp -
1042 					    parsekwd + KWDOFFSET;
1043 					VTRACE(DBG_PARSE,
1044 					    ("keyword %s recognized @%d\n",
1045 					    tokname[t], plinno));
1046 					goto out;
1047 				}
1048 			}
1049 
1050 		if (checkkwd & CHKALIAS &&
1051 		    (ap = lookupalias(wordtext, 1)) != NULL) {
1052 			VTRACE(DBG_PARSE,
1053 			    ("alias '%s' recognized -> <:%s:>\n",
1054 			    wordtext, ap->val));
1055 			pushstring(ap->val, strlen(ap->val), ap);
1056 			goto top;
1057 		}
1058 	}
1059  out:
1060 	if (t != TNOT)
1061 		checkkwd = 0;
1062 
1063 	VTRACE(DBG_PARSE, ("%stoken %s %s @%d (chkkwd %x->%x)\n",
1064 	    alreadyseen ? "reread " : "", tokname[t],
1065 	    t == TWORD ? wordtext : "", plinno, savecheckkwd, checkkwd));
1066 	return (t);
1067 }
1068 
1069 
1070 /*
1071  * Read the next input token.
1072  * If the token is a word, we set backquotelist to the list of cmds in
1073  *	backquotes.  We set quoteflag to true if any part of the word was
1074  *	quoted.
1075  * If the token is TREDIR, then we set redirnode to a structure containing
1076  *	the redirection.
1077  * In all cases, the variable startlinno is set to the number of the line
1078  *	on which the token starts.
1079  *
1080  * [Change comment:  here documents and internal procedures]
1081  * [Readtoken shouldn't have any arguments.  Perhaps we should make the
1082  *  word parsing code into a separate routine.  In this case, readtoken
1083  *  doesn't need to have any internal procedures, but parseword does.
1084  *  We could also make parseoperator in essence the main routine, and
1085  *  have parseword (readtoken1?) handle both words and redirection.]
1086  */
1087 
1088 #define RETURN(token)	return lasttoken = (token)
1089 
1090 STATIC int
1091 xxreadtoken(void)
1092 {
1093 	int c;
1094 
1095 	if (tokpushback) {
1096 		tokpushback = 0;
1097 		CTRACE(DBG_LEXER,
1098 		    ("xxreadtoken() returns %s (%d) again\n",
1099 			tokname[lasttoken], lasttoken));
1100 		return lasttoken;
1101 	}
1102 	if (needprompt) {
1103 		setprompt(2);
1104 		needprompt = 0;
1105 	}
1106 	elided_nl = 0;
1107 	startlinno = plinno;
1108 	for (;;) {	/* until token or start of word found */
1109 		c = pgetc_macro();
1110 		CTRACE(DBG_LEXER, ("xxreadtoken() sees '%c' (%#.2x) ",
1111 		    c&0xFF, c&0x1FF));
1112 		switch (c) {
1113 		case ' ': case '\t': case PFAKE:
1114 			CTRACE(DBG_LEXER, (" ignored\n"));
1115 			continue;
1116 		case '#':
1117 			while ((c = pgetc()) != '\n' && c != PEOF)
1118 				continue;
1119 			CTRACE(DBG_LEXER,
1120 			    ("skipped comment to (not incl) \\n\n"));
1121 			pungetc();
1122 			continue;
1123 
1124 		case '\n':
1125 			plinno++;
1126 			CTRACE(DBG_LEXER, ("newline now @%d\n", plinno));
1127 			needprompt = doprompt;
1128 			RETURN(TNL);
1129 		case PEOF:
1130 			CTRACE(DBG_LEXER, ("EOF -> TEOF (return)\n"));
1131 			RETURN(TEOF);
1132 
1133 		case '&':
1134 			if (pgetc_linecont() == '&') {
1135 				CTRACE(DBG_LEXER,
1136 				    ("and another  -> TAND (return)\n"));
1137 				RETURN(TAND);
1138 			}
1139 			pungetc();
1140 			CTRACE(DBG_LEXER, (" -> TBACKGND (return)\n"));
1141 			RETURN(TBACKGND);
1142 		case '|':
1143 			if (pgetc_linecont() == '|') {
1144 				CTRACE(DBG_LEXER,
1145 				    ("and another  -> TOR (return)\n"));
1146 				RETURN(TOR);
1147 			}
1148 			pungetc();
1149 			CTRACE(DBG_LEXER, (" -> TPIPE (return)\n"));
1150 			RETURN(TPIPE);
1151 		case ';':
1152 			switch (pgetc_linecont()) {
1153 			case ';':
1154 				CTRACE(DBG_LEXER,
1155 				    ("and another -> TENDCASE (return)\n"));
1156 				RETURN(TENDCASE);
1157 			case '&':
1158 				CTRACE(DBG_LEXER,
1159 				    ("and '&' -> TCASEFALL (return)\n"));
1160 				RETURN(TCASEFALL);
1161 			default:
1162 				pungetc();
1163 				CTRACE(DBG_LEXER, (" -> TSEMI (return)\n"));
1164 				RETURN(TSEMI);
1165 			}
1166 		case '(':
1167 			CTRACE(DBG_LEXER, (" -> TLP (return)\n"));
1168 			RETURN(TLP);
1169 		case ')':
1170 			CTRACE(DBG_LEXER, (" -> TRP (return)\n"));
1171 			RETURN(TRP);
1172 
1173 		case '\\':
1174 			switch (pgetc()) {
1175 			case '\n':
1176 				startlinno = ++plinno;
1177 				CTRACE(DBG_LEXER, ("\\\n ignored, now @%d\n",
1178 				    plinno));
1179 				if (doprompt)
1180 					setprompt(2);
1181 				else
1182 					setprompt(0);
1183 				continue;
1184 			case PEOF:
1185 				CTRACE(DBG_LEXER,
1186 				  ("then EOF -> TEOF (return) '\\' dropped\n"));
1187 				RETURN(TEOF);
1188 			default:
1189 				CTRACE(DBG_LEXER, ("not \\\n or EOF: "));
1190 				pungetc();
1191 				break;
1192 			}
1193 			/* FALLTHROUGH */
1194 		default:
1195 			CTRACE(DBG_LEXER, ("getting a word\n"));
1196 			return readtoken1(c, BASESYNTAX, 0);
1197 		}
1198 	}
1199 #undef RETURN
1200 }
1201 
1202 
1203 
1204 /*
1205  * If eofmark is NULL, read a word or a redirection symbol.  If eofmark
1206  * is not NULL, read a here document.  In the latter case, eofmark is the
1207  * word which marks the end of the document and striptabs is true if
1208  * leading tabs should be stripped from the document.  The argument firstc
1209  * is the first character of the input token or document.
1210  *
1211  * Because C does not have internal subroutines, I have simulated them
1212  * using goto's to implement the subroutine linkage.  The following macros
1213  * will run code that appears at the end of readtoken1.
1214  */
1215 
1216 /*
1217  * We used to remember only the current syntax, variable nesting level,
1218  * double quote state for each var nesting level, and arith nesting
1219  * level (unrelated to var nesting) and one prev syntax when in arith
1220  * syntax.  This worked for simple cases, but can't handle arith inside
1221  * var expansion inside arith inside var with some quoted and some not.
1222  *
1223  * Inspired by FreeBSD's implementation (though it was the obvious way)
1224  * though implemented differently, we now have a stack that keeps track
1225  * of what we are doing now, and what we were doing previously.
1226  * Every time something changes, which will eventually end and should
1227  * revert to the previous state, we push this stack, and then pop it
1228  * again later (that is every ${} with an operator (to parse the word
1229  * or pattern that follows) ${x} and $x are too simple to need it)
1230  * $(( )) $( ) and "...".   Always.   Really, always!
1231  *
1232  * The stack is implemented as one static (on the C stack) base block
1233  * containing LEVELS_PER_BLOCK (8) stack entries, which should be
1234  * enough for the vast majority of cases.  For torture tests, we
1235  * malloc more blocks as needed.  All accesses through the inline
1236  * functions below.
1237  */
1238 
1239 /*
1240  * varnest & arinest will typically be 0 or 1
1241  * (varnest can increment in usages like ${x=${y}} but probably
1242  *  does not really need to)
1243  * parenlevel allows balancing parens inside a $(( )), it is reset
1244  * at each new nesting level ( $(( ( x + 3 ${unset-)} )) does not work.
1245  * quoted is special - we need to know 2 things ... are we inside "..."
1246  * (even if inherited from some previous nesting level) and was there
1247  * an opening '"' at this level (so the next will be closing).
1248  * "..." can span nesting levels, but cannot be opened in one and
1249  * closed in a different one.
1250  * To handle this, "quoted" has two fields, the bottom 4 (really 2)
1251  * bits are 0, 1, or 2, for un, single, and double quoted (single quoted
1252  * is really so special that this setting is not very important)
1253  * and 0x10 that indicates that an opening quote has been seen.
1254  * The bottom 4 bits are inherited, the 0x10 bit is not.
1255  */
1256 struct tokenstate {
1257 	const char *ts_syntax;
1258 	unsigned short ts_parenlevel;	/* counters */
1259 	unsigned short ts_varnest;	/* 64000 levels should be enough! */
1260 	unsigned short ts_arinest;
1261 	unsigned short ts_quoted;	/* 1 -> single, 2 -> double */
1262 	unsigned short ts_magicq;	/* heredoc or word expand */
1263 };
1264 
1265 #define	NQ	0x00	/* Unquoted */
1266 #define	SQ	0x01	/* Single Quotes */
1267 #define	DQ	0x02	/* Double Quotes (or equivalent) */
1268 #define	CQ	0x03	/* C style Single Quotes */
1269 #define	QF	0x0F		/* Mask to extract previous values */
1270 #define	QS	0x10	/* Quoting started at this level in stack */
1271 
1272 #define	LEVELS_PER_BLOCK	8
1273 #define	VSS			struct statestack
1274 
1275 struct statestack {
1276 	VSS *prev;		/* previous block in list */
1277 	int cur;		/* which of our tokenstates is current */
1278 	struct tokenstate tokenstate[LEVELS_PER_BLOCK];
1279 };
1280 
1281 static inline struct tokenstate *
1282 currentstate(VSS *stack)
1283 {
1284 	return &stack->tokenstate[stack->cur];
1285 }
1286 
1287 #ifdef notdef
1288 static inline struct tokenstate *
1289 prevstate(VSS *stack)
1290 {
1291 	if (stack->cur != 0)
1292 		return &stack->tokenstate[stack->cur - 1];
1293 	if (stack->prev == NULL)	/* cannot drop below base */
1294 		return &stack->tokenstate[0];
1295 	return &stack->prev->tokenstate[LEVELS_PER_BLOCK - 1];
1296 }
1297 #endif
1298 
1299 static inline VSS *
1300 bump_state_level(VSS *stack)
1301 {
1302 	struct tokenstate *os, *ts;
1303 
1304 	os = currentstate(stack);
1305 
1306 	if (++stack->cur >= LEVELS_PER_BLOCK) {
1307 		VSS *ss;
1308 
1309 		ss = (VSS *)ckmalloc(sizeof (struct statestack));
1310 		ss->cur = 0;
1311 		ss->prev = stack;
1312 		stack = ss;
1313 	}
1314 
1315 	ts = currentstate(stack);
1316 
1317 	ts->ts_parenlevel = 0;	/* parens inside never match outside */
1318 
1319 	ts->ts_quoted  = os->ts_quoted & QF;	/* these are default settings */
1320 	ts->ts_varnest = os->ts_varnest;
1321 	ts->ts_arinest = os->ts_arinest;	/* when appropriate	   */
1322 	ts->ts_syntax  = os->ts_syntax;		/*    they will be altered */
1323 	ts->ts_magicq  = os->ts_magicq;
1324 
1325 	return stack;
1326 }
1327 
1328 static inline VSS *
1329 drop_state_level(VSS *stack)
1330 {
1331 	if (stack->cur == 0) {
1332 		VSS *ss;
1333 
1334 		ss = stack;
1335 		stack = ss->prev;
1336 		if (stack == NULL)
1337 			return ss;
1338 		ckfree(ss);
1339 	}
1340 	--stack->cur;
1341 	return stack;
1342 }
1343 
1344 static inline void
1345 cleanup_state_stack(VSS *stack)
1346 {
1347 	while (stack->prev != NULL) {
1348 		stack->cur = 0;
1349 		stack = drop_state_level(stack);
1350 	}
1351 }
1352 
1353 #define	PARSESUB()	{goto parsesub; parsesub_return:;}
1354 #define	PARSEARITH()	{goto parsearith; parsearith_return:;}
1355 
1356 /*
1357  * The following macros all assume the existance of a local var "stack"
1358  * which contains a pointer to the current struct stackstate
1359  */
1360 
1361 /*
1362  * These are macros rather than inline funcs to avoid code churn as much
1363  * as possible - they replace macros of the same name used previously.
1364  */
1365 #define	ISDBLQUOTE()	(currentstate(stack)->ts_quoted & QS)
1366 #define	SETDBLQUOTE()	(currentstate(stack)->ts_quoted = QS | DQ)
1367 #ifdef notdef
1368 #define	CLRDBLQUOTE()	(currentstate(stack)->ts_quoted =		\
1369 			    stack->cur != 0 || stack->prev ?		\
1370 				prevstate(stack)->ts_quoted & QF : 0)
1371 #endif
1372 
1373 /*
1374  * This set are just to avoid excess typing and line lengths...
1375  * The ones that "look like" var names must be implemented to be lvalues
1376  */
1377 #define	syntax		(currentstate(stack)->ts_syntax)
1378 #define	parenlevel	(currentstate(stack)->ts_parenlevel)
1379 #define	varnest		(currentstate(stack)->ts_varnest)
1380 #define	arinest		(currentstate(stack)->ts_arinest)
1381 #define	quoted		(currentstate(stack)->ts_quoted)
1382 #define	magicq		(currentstate(stack)->ts_magicq)
1383 #define	TS_PUSH()	(stack = bump_state_level(stack))
1384 #define	TS_POP()	(stack = drop_state_level(stack))
1385 
1386 /*
1387  * Called to parse command substitutions.  oldstyle is true if the command
1388  * is enclosed inside `` (otherwise it was enclosed in "$( )")
1389  *
1390  * Internally nlpp is a pointer to the head of the linked
1391  * list of commands (passed by reference), and savelen is the number of
1392  * characters on the top of the stack which must be preserved.
1393  */
1394 static char *
1395 parsebackq(VSS *const stack, char * const in,
1396     struct nodelist **const pbqlist, const int oldstyle)
1397 {
1398 	struct nodelist **nlpp;
1399 	const int savepbq = parsebackquote;
1400 	union node *n;
1401 	char *out;
1402 	char *str = NULL;
1403 	char *volatile sstr = str;
1404 	struct jmploc jmploc;
1405 	struct jmploc *const savehandler = handler;
1406 	struct parsefile *const savetopfile = getcurrentfile();
1407 	const int savelen = in - stackblock();
1408 	int saveprompt;
1409 	int lno;
1410 
1411 	if (setjmp(jmploc.loc)) {
1412 		popfilesupto(savetopfile);
1413 		if (sstr)
1414 			ckfree(__UNVOLATILE(sstr));
1415 		cleanup_state_stack(stack);
1416 		parsebackquote = 0;
1417 		handler = savehandler;
1418 		CTRACE(DBG_LEXER, ("parsebackq() err (%d), unwinding\n",
1419 		    exception));
1420 		longjmp(handler->loc, 1);
1421 	}
1422 	INTOFF;
1423 	sstr = str = NULL;
1424 	if (savelen > 0) {
1425 		sstr = str = ckmalloc(savelen);
1426 		memcpy(str, stackblock(), savelen);
1427 	}
1428 	handler = &jmploc;
1429 	INTON;
1430 	if (oldstyle) {
1431 		/*
1432 		 * We must read until the closing backquote, giving special
1433 		 * treatment to some slashes, and then push the string and
1434 		 * reread it as input, interpreting it normally.
1435 		 */
1436 		int pc;
1437 		int psavelen;
1438 		char *pstr;
1439 		int line1 = plinno;
1440 
1441 		VTRACE(DBG_PARSE|DBG_LEXER,
1442 		    ("parsebackq: repackaging `` as $( )"));
1443 		/*
1444 		 * Because the entire `...` is read here, we don't
1445 		 * need to bother the state stack.  That will be used
1446 		 * (as appropriate) when the processed string is re-read.
1447 		 */
1448 		STARTSTACKSTR(out);
1449 #ifdef DEBUG
1450 		for (psavelen = 0;;psavelen++) {	/* } */
1451 #else
1452 		for (;;) {
1453 #endif
1454 			if (needprompt) {
1455 				setprompt(2);
1456 				needprompt = 0;
1457 			}
1458 			pc = pgetc();
1459 			VTRACE(DBG_LEXER,
1460 			    ("parsebackq() got '%c'(%#.2x) in `` %s", pc&0xFF,
1461 				pc&0x1FF, pc == '`' ? "terminator\n" : ""));
1462 			if (pc == '`')
1463 				break;
1464 			switch (pc) {
1465 			case '\\':
1466 				pc = pgetc();
1467 				VTRACE(DBG_LEXER, ("then '%c'(%#.2x) ",
1468 				    pc&0xFF, pc&0x1FF));
1469 #ifdef DEBUG
1470 				psavelen++;
1471 #endif
1472 				if (pc == '\n') {   /* keep \ \n for later */
1473 					plinno++;
1474 					VTRACE(DBG_LEXER, ("@%d ", plinno));
1475 					needprompt = doprompt;
1476 				}
1477 				if (pc != '\\' && pc != '`' && pc != '$'
1478 				    && (!ISDBLQUOTE() || pc != '"')) {
1479 					VTRACE(DBG_LEXER, ("keep '\\' "));
1480 					STPUTC('\\', out);
1481 				}
1482 				break;
1483 
1484 			case '\n':
1485 				plinno++;
1486 				VTRACE(DBG_LEXER, ("@%d ", plinno));
1487 				needprompt = doprompt;
1488 				break;
1489 
1490 			case PEOF:
1491 			        startlinno = line1;
1492 				VTRACE(DBG_LEXER, ("EOF\n", plinno));
1493 				synerror("EOF in backquote substitution");
1494  				break;
1495 
1496 			default:
1497 				break;
1498 			}
1499 			VTRACE(DBG_LEXER, (".\n", plinno));
1500 			STPUTC(pc, out);
1501 		}
1502 		STPUTC('\0', out);
1503 		VTRACE(DBG_LEXER, ("parsebackq() ``:"));
1504 		VTRACE(DBG_PARSE|DBG_LEXER, (" read %d", psavelen));
1505 		psavelen = out - stackblock();
1506 		VTRACE(DBG_PARSE|DBG_LEXER, (" produced %d\n", psavelen));
1507 		if (psavelen > 0) {
1508 			pstr = grabstackstr(out);
1509 			CTRACE(DBG_LEXER,
1510 			    ("parsebackq() reprocessing as $(%s)\n", pstr));
1511 			setinputstring(pstr, 1, line1);
1512 		}
1513 	}
1514 	nlpp = pbqlist;
1515 	while (*nlpp)
1516 		nlpp = &(*nlpp)->next;
1517 	*nlpp = stalloc(sizeof(struct nodelist));
1518 	(*nlpp)->next = NULL;
1519 	parsebackquote = oldstyle;
1520 
1521 	if (oldstyle) {
1522 		saveprompt = doprompt;
1523 		doprompt = 0;
1524 	} else
1525 		saveprompt = 0;
1526 
1527 	lno = -plinno;
1528 	CTRACE(DBG_LEXER, ("parsebackq() parsing embedded command list\n"));
1529 	n = list(0);
1530 	CTRACE(DBG_LEXER, ("parsebackq() parsed $() (%d -> %d)\n", -lno,
1531 	    lno + plinno));
1532 	lno += plinno;
1533 
1534 	if (oldstyle) {
1535 		if (peektoken() != TEOF)
1536 			synexpect(-1, 0);
1537 		doprompt = saveprompt;
1538 	} else
1539 		consumetoken(TRP);
1540 
1541 	(*nlpp)->n = n;
1542 	if (oldstyle) {
1543 		/*
1544 		 * Start reading from old file again, ignoring any pushed back
1545 		 * tokens left from the backquote parsing
1546 		 */
1547 		CTRACE(DBG_LEXER, ("parsebackq() back to previous input\n"));
1548 		popfile();
1549 		tokpushback = 0;
1550 	}
1551 
1552 	while (stackblocksize() <= savelen)
1553 		growstackblock();
1554 	STARTSTACKSTR(out);
1555 	if (str) {
1556 		memcpy(out, str, savelen);
1557 		STADJUST(savelen, out);
1558 		INTOFF;
1559 		ckfree(str);
1560 		sstr = str = NULL;
1561 		INTON;
1562 	}
1563 	parsebackquote = savepbq;
1564 	handler = savehandler;
1565 	if (arinest || ISDBLQUOTE()) {
1566 		STPUTC(CTLBACKQ | CTLQUOTE, out);
1567 		while (--lno >= 0)
1568 			STPUTC(CTLNONL, out);
1569 	} else
1570 		STPUTC(CTLBACKQ, out);
1571 
1572 	return out;
1573 }
1574 
1575 /*
1576  * Parse a redirection operator.  The parameter "out" points to a string
1577  * specifying the fd to be redirected.  It is guaranteed to be either ""
1578  * or a numeric string (for now anyway).  The parameter "c" contains the
1579  * first character of the redirection operator.
1580  *
1581  * Note the string "out" is on the stack, which we are about to clobber,
1582  * so process it first...
1583  */
1584 
1585 static void
1586 parseredir(const char *out,  int c)
1587 {
1588 	union node *np;
1589 	int fd;
1590 
1591 	np = stalloc(sizeof(struct nfile));
1592 
1593 	fd = (*out == '\0') ? -1 : number(out);		/* number(out) >= 0 */
1594 	np->nfile.fd = fd;	/* do this again later with updated fd */
1595 	if (fd != np->nfile.fd)
1596 		error("file descriptor (%d) out of range (max %ld)",
1597 		    fd, user_fd_limit - 1);
1598 	if (fd < user_fd_limit && fd > max_user_fd)
1599 		max_user_fd = fd;
1600 
1601 	VTRACE(DBG_LEXER, ("parseredir after '%s%c' ", out, c));
1602 	if (c == '>') {
1603 		if (fd < 0)
1604 			fd = 1;
1605 		c = pgetc_linecont();
1606 		VTRACE(DBG_LEXER, ("is '%c'(%#.2x) ", c&0xFF, c&0x1FF));
1607 		if (c == '>')
1608 			np->type = NAPPEND;
1609 		else if (c == '|')
1610 			np->type = NCLOBBER;
1611 		else if (c == '&')
1612 			np->type = NTOFD;
1613 		else {
1614 			np->type = NTO;
1615 			VTRACE(DBG_LEXER, ("unwanted ", c));
1616 			pungetc();
1617 		}
1618 	} else {	/* c == '<' */
1619 		if (fd < 0)
1620 			fd = 0;
1621 		c = pgetc_linecont();
1622 		VTRACE(DBG_LEXER, ("is '%c'(%#.2x) ", c&0xFF, c&0x1FF));
1623 		switch (c) {
1624 		case '<':
1625 			/* if sizes differ, just discard the old one */
1626 			if (sizeof (struct nfile) != sizeof (struct nhere))
1627 				np = stalloc(sizeof(struct nhere));
1628 			np->type = NHERE;
1629 			np->nhere.fd = 0;
1630 			heredoc = stalloc(sizeof(struct HereDoc));
1631 			heredoc->here = np;
1632 			heredoc->startline = plinno;
1633 			if ((c = pgetc_linecont()) == '-') {
1634 				CTRACE(DBG_LEXER, ("and '%c'(%#.2x) ",
1635 				    c & 0xFF, c & 0x1FF));
1636 				heredoc->striptabs = 1;
1637 			} else {
1638 				heredoc->striptabs = 0;
1639 				pungetc();
1640 			}
1641 			break;
1642 
1643 		case '&':
1644 			np->type = NFROMFD;
1645 			break;
1646 
1647 		case '>':
1648 			np->type = NFROMTO;
1649 			break;
1650 
1651 		default:
1652 			np->type = NFROM;
1653 			VTRACE(DBG_LEXER, ("unwanted('%c'0#.2x)", c&0xFF,
1654 			    c&0x1FF));
1655 			pungetc();
1656 			break;
1657 		}
1658 	}
1659 	np->nfile.fd = fd;
1660 
1661 	VTRACE(DBG_LEXER, (" ->%"PRIdsNT" fd=%d\n", NODETYPENAME(np->type),fd));
1662 
1663 	redirnode = np;		/* this is the "value" of TRENODE */
1664 }
1665 
1666 /*
1667  * Called to parse a backslash escape sequence inside $'...'.
1668  * The backslash has already been read.
1669  */
1670 static char *
1671 readcstyleesc(char *out)
1672 {
1673 	int c, vc, i, n;
1674 	unsigned int v;
1675 
1676 	c = pgetc();
1677 	VTRACE(DBG_LEXER, ("CSTR(\\%c)(\\%#x)", c&0xFF, c&0x1FF));
1678 	switch (c) {
1679 	case '\0':
1680 	case PEOF:
1681 		synerror("Unterminated quoted string ($'...)");
1682 	case '\n':
1683 		plinno++;
1684 		VTRACE(DBG_LEXER, ("@%d ", plinno));
1685 		if (doprompt)
1686 			setprompt(2);
1687 		else
1688 			setprompt(0);
1689 		return out;
1690 
1691 	case '\\':
1692 	case '\'':
1693 	case '"':
1694 		v = c;
1695 		break;
1696 
1697 	case 'a': v = '\a'; break;
1698 	case 'b': v = '\b'; break;
1699 	case 'e': v = '\033'; break;
1700 	case 'f': v = '\f'; break;
1701 	case 'n': v = '\n'; break;
1702 	case 'r': v = '\r'; break;
1703 	case 't': v = '\t'; break;
1704 	case 'v': v = '\v'; break;
1705 
1706 	case '0': case '1': case '2': case '3':
1707 	case '4': case '5': case '6': case '7':
1708 		v = c - '0';
1709 		c = pgetc();
1710 		if (c >= '0' && c <= '7') {
1711 			v <<= 3;
1712 			v += c - '0';
1713 			c = pgetc();
1714 			if (c >= '0' && c <= '7') {
1715 				v <<= 3;
1716 				v += c - '0';
1717 			} else
1718 				pungetc();
1719 		} else
1720 			pungetc();
1721 		break;
1722 
1723 	case 'c':
1724 		c = pgetc();
1725 		if (c < 0x3f || c > 0x7a || c == 0x60)
1726 			synerror("Bad \\c escape sequence");
1727 		if (c == '\\' && pgetc() != '\\')
1728 			synerror("Bad \\c\\ escape sequence");
1729 		if (c == '?')
1730 			v = 127;
1731 		else
1732 			v = c & 0x1f;
1733 		break;
1734 
1735 	case 'x':
1736 		n = 2;
1737 		goto hexval;
1738 	case 'u':
1739 		n = 4;
1740 		goto hexval;
1741 	case 'U':
1742 		n = 8;
1743 	hexval:
1744 		v = 0;
1745 		for (i = 0; i < n; i++) {
1746 			c = pgetc();
1747 			if (c >= '0' && c <= '9')
1748 				v = (v << 4) + c - '0';
1749 			else if (c >= 'A' && c <= 'F')
1750 				v = (v << 4) + c - 'A' + 10;
1751 			else if (c >= 'a' && c <= 'f')
1752 				v = (v << 4) + c - 'a' + 10;
1753 			else {
1754 				pungetc();
1755 				break;
1756 			}
1757 		}
1758 		if (n > 2 && v > 127) {
1759 			if (v >= 0xd800 && v <= 0xdfff)
1760 				synerror("Invalid \\u escape sequence");
1761 
1762 			/* XXX should we use iconv here. What locale? */
1763 			CHECKSTRSPACE(12, out);
1764 
1765 /*
1766  * Add a byte to output string, while checking if it needs to
1767  * be escaped -- if its value happens to match the value of one
1768  * of our internal CTL* chars - which would (at a minumum) be
1769  * summarily removed later, if not escaped.
1770  *
1771  * The current definition of ISCTL() allows the compiler to
1772  * optimise away either half, or all, of the test in most of
1773  * the cases here (0xc0 | anything) cannot be between 0x80 and 0x9f
1774  * for example, so there a test is not needed).
1775  *
1776  * Which tests can be removed depends upon the actual values
1777  * selected for the CTL* chars.
1778  */
1779 #define	ESC_USTPUTC(c, o) do {				\
1780 		char _ch = (c);				\
1781 							\
1782 		if (ISCTL(_ch))				\
1783 			USTPUTC(CTLESC, o);		\
1784 		USTPUTC(_ch, o);			\
1785 	} while (0)
1786 
1787 			VTRACE(DBG_LEXER, ("CSTR(\\%c%8.8x)", n==4?'u':'U', v));
1788 			if (v <= 0x7ff) {
1789 				ESC_USTPUTC(0xc0 | v >> 6, out);
1790 				ESC_USTPUTC(0x80 | (v & 0x3f), out);
1791 				return out;
1792 			} else if (v <= 0xffff) {
1793 				ESC_USTPUTC(0xe0 | v >> 12, out);
1794 				ESC_USTPUTC(0x80 | ((v >> 6) & 0x3f), out);
1795 				ESC_USTPUTC(0x80 | (v & 0x3f), out);
1796 				return out;
1797 			} else if (v <= 0x10ffff) {
1798 				ESC_USTPUTC(0xf0 | v >> 18, out);
1799 				ESC_USTPUTC(0x80 | ((v >> 12) & 0x3f), out);
1800 				ESC_USTPUTC(0x80 | ((v >> 6) & 0x3f), out);
1801 				ESC_USTPUTC(0x80 | (v & 0x3f), out);
1802 				return out;
1803 
1804 	/* these next two are not very likely, but we may as well be complete */
1805 			} else if (v <= 0x3FFFFFF) {
1806 				ESC_USTPUTC(0xf8 | v >> 24, out);
1807 				ESC_USTPUTC(0x80 | ((v >> 18) & 0x3f), out);
1808 				ESC_USTPUTC(0x80 | ((v >> 12) & 0x3f), out);
1809 				ESC_USTPUTC(0x80 | ((v >> 6) & 0x3f), out);
1810 				ESC_USTPUTC(0x80 | (v & 0x3f), out);
1811 				return out;
1812 			} else if (v <= 0x7FFFFFFF) {
1813 				ESC_USTPUTC(0xfC | v >> 30, out);
1814 				ESC_USTPUTC(0x80 | ((v >> 24) & 0x3f), out);
1815 				ESC_USTPUTC(0x80 | ((v >> 18) & 0x3f), out);
1816 				ESC_USTPUTC(0x80 | ((v >> 12) & 0x3f), out);
1817 				ESC_USTPUTC(0x80 | ((v >> 6) & 0x3f), out);
1818 				ESC_USTPUTC(0x80 | (v & 0x3f), out);
1819 				return out;
1820 			}
1821 			if (v > 127)
1822 				v = '?';
1823 		}
1824 		break;
1825 	default:
1826 		synerror("Unknown $'' escape sequence");
1827 	}
1828 	vc = (char)v;
1829 	VTRACE(DBG_LEXER, ("->%u(%#x)['%c']", v, v, vc&0xFF));
1830 
1831 	/*
1832 	 * If we managed to create a \n from a \ sequence (no matter how)
1833 	 * then we replace it with the magic CRTCNL control char, which
1834 	 * will turn into a \n again later, but in the meantime, never
1835 	 * causes LINENO increments.
1836 	 */
1837 	if (vc == '\n') {
1838 		VTRACE(DBG_LEXER, ("CTLCNL."));
1839 		USTPUTC(CTLCNL, out);
1840 		return out;
1841 	}
1842 
1843 	/*
1844 	 * We can't handle NUL bytes.
1845 	 * POSIX says we should skip till the closing quote.
1846 	 */
1847 	if (vc == '\0') {
1848 		CTRACE(DBG_LEXER, ("\\0: skip to '", v, v, vc&0xFF));
1849 		while ((c = pgetc()) != '\'') {
1850 			if (c == '\\')
1851 				c = pgetc();
1852 			if (c == PEOF)
1853 				synerror("Unterminated quoted string ($'...)");
1854 			if (c == '\n') {
1855 				plinno++;
1856 				if (doprompt)
1857 					setprompt(2);
1858 				else
1859 					setprompt(0);
1860 			}
1861 		}
1862 		pungetc();
1863 		return out;
1864 	}
1865 	CVTRACE(DBG_LEXER, NEEDESC(vc), ("CTLESC-"));
1866 	VTRACE(DBG_LEXER, ("'%c'(%#.2x)", vc&0xFF, vc&0x1FF));
1867 	if (NEEDESC(vc))
1868 		USTPUTC(CTLESC, out);
1869 	USTPUTC(vc, out);
1870 	return out;
1871 }
1872 
1873 /*
1874  * The lowest level basic tokenizer.
1875  *
1876  * The next input byte (character) is in firstc, syn says which
1877  * syntax tables we are to use (basic, single or double quoted, or arith)
1878  * and magicq (used with sqsyntax and dqsyntax only) indicates that the
1879  * quote character itself is not special (used parsing here docs and similar)
1880  *
1881  * The result is the type of the next token (its value, when there is one,
1882  * is saved in the relevant global var - must fix that someday!) which is
1883  * also saved for re-reading ("lasttoken").
1884  *
1885  * Overall, this routine does far more parsing than it is supposed to.
1886  * That will also need fixing, someday...
1887  */
1888 STATIC int
1889 readtoken1(int firstc, char const *syn, int oneword)
1890 {
1891 	int c;
1892 	char * out;
1893 	int len;
1894 	struct nodelist *bqlist;
1895 	int quotef;
1896 	VSS static_stack;
1897 	VSS *stack = &static_stack;
1898 
1899 	stack->prev = NULL;
1900 	stack->cur = 0;
1901 
1902 	syntax = syn;
1903 
1904 #ifdef DEBUG
1905 #define SYNTAX      (	syntax == BASESYNTAX ? "BASE"	:		\
1906 			syntax == DQSYNTAX   ? "DQ"	:		\
1907 			syntax == SQSYNTAX   ? "SQ"	:		\
1908 			syntax == ARISYNTAX  ? "ARI"	:		\
1909 					"???"			)
1910 #endif
1911 
1912 	startlinno = plinno;
1913 	varnest = 0;
1914 	quoted = 0;
1915 	if (syntax == DQSYNTAX)
1916 		SETDBLQUOTE();
1917 	quotef = 0;
1918 	bqlist = NULL;
1919 	arinest = 0;
1920 	parenlevel = 0;
1921 	elided_nl = 0;
1922 	magicq = oneword;
1923 
1924 	CTRACE(DBG_LEXER, ("readtoken1(%c) syntax=%s %s%s(quoted=%x)\n",
1925 	    firstc&0xFF, SYNTAX, magicq ? "magic quotes" : "",
1926 	    ISDBLQUOTE()?" ISDBLQUOTE":"", quoted));
1927 
1928 	STARTSTACKSTR(out);
1929 
1930 	for (c = firstc ;; c = pgetc_macro()) {	/* until of token */
1931 		if (syntax == ARISYNTAX)
1932 			out = insert_elided_nl(out);
1933 		CHECKSTRSPACE(6, out);	/* permit 6 calls to USTPUTC */
1934 		switch (syntax[c]) {
1935 		case CFAKE:
1936 			VTRACE(DBG_LEXER, ("CFAKE"));
1937 			if (syntax == BASESYNTAX && varnest == 0)
1938 				break;
1939 			VTRACE(DBG_LEXER, (","));
1940 			continue;
1941 		case CNL:	/* '\n' */
1942 			VTRACE(DBG_LEXER, ("CNL"));
1943 			if (syntax == BASESYNTAX && varnest == 0)
1944 				break;	/* exit loop */
1945 			USTPUTC(c, out);
1946 			plinno++;
1947 			VTRACE(DBG_LEXER, ("@%d,", plinno));
1948 			if (doprompt)
1949 				setprompt(2);
1950 			else
1951 				setprompt(0);
1952 			continue;
1953 
1954 		case CSBACK:	/* single quoted backslash */
1955 			if ((quoted & QF) == CQ) {
1956 				out = readcstyleesc(out);
1957 				continue;
1958 			}
1959 			VTRACE(DBG_LEXER, ("ESC:"));
1960 			USTPUTC(CTLESC, out);
1961 			/* FALLTHROUGH */
1962 		case CWORD:
1963 			VTRACE(DBG_LEXER, ("'%c'", c));
1964 			USTPUTC(c, out);
1965 			continue;
1966 
1967 		case CCTL:
1968 			CVTRACE(DBG_LEXER, !magicq || ISDBLQUOTE(),
1969 			    ("%s%sESC:",!magicq?"!m":"",ISDBLQUOTE()?"DQ":""));
1970 			if (!magicq || ISDBLQUOTE())
1971 				USTPUTC(CTLESC, out);
1972 			VTRACE(DBG_LEXER, ("'%c'", c));
1973 			USTPUTC(c, out);
1974 			continue;
1975 		case CBACK:	/* backslash */
1976 			c = pgetc();
1977 			VTRACE(DBG_LEXER, ("\\'%c'(%#.2x)", c&0xFF, c&0x1FF));
1978 			if (c == PEOF) {
1979 				VTRACE(DBG_LEXER, ("EOF, keep \\ "));
1980 				USTPUTC('\\', out);
1981 				pungetc();
1982 				continue;
1983 			}
1984 			if (c == '\n') {
1985 				plinno++;
1986 				elided_nl++;
1987 				VTRACE(DBG_LEXER, ("eli \\n (%d) @%d ",
1988 				    elided_nl, plinno));
1989 				if (doprompt)
1990 					setprompt(2);
1991 				else
1992 					setprompt(0);
1993 				continue;
1994 			}
1995 			CVTRACE(DBG_LEXER, quotef==0, (" QF=1 "));
1996 			quotef = 1;	/* current token is quoted */
1997 			if (quoted && c != '\\' && c != '`' &&
1998 			    (c != '}' || varnest == 0) &&
1999 			    c != '$' && (c != '"' || magicq)) {
2000 				/*
2001 				 * retain the \ (which we *know* needs CTLESC)
2002 				 * when in "..." and the following char is
2003 				 * not one of the magic few.)
2004 				 * Otherwise the \ has done its work, and
2005 				 * is dropped.
2006 				 */
2007 				VTRACE(DBG_LEXER, ("ESC:'\\'"));
2008 				USTPUTC(CTLESC, out);
2009 				USTPUTC('\\', out);
2010 			}
2011 			CVTRACE(DBG_LEXER, NEEDESC(c) || !magicq,
2012 			    ("%sESC:", NEEDESC(c) ? "+" : "m"));
2013 			VTRACE(DBG_LEXER, ("'%c'(%#.2x)", c&0xFF, c&0x1FF));
2014 			if (NEEDESC(c))
2015 				USTPUTC(CTLESC, out);
2016 			else if (!magicq) {
2017 				USTPUTC(CTLESC, out);
2018 				USTPUTC(c, out);
2019 				continue;
2020 			}
2021 			USTPUTC(c, out);
2022 			continue;
2023 		case CSQUOTE:
2024 			if (syntax != SQSYNTAX) {
2025 				CVTRACE(DBG_LEXER, !magicq, (" CQM "));
2026 				if (!magicq)
2027 					USTPUTC(CTLQUOTEMARK, out);
2028 				CVTRACE(DBG_LEXER, quotef==0, (" QF=1 "));
2029 				quotef = 1;
2030 				TS_PUSH();
2031 				syntax = SQSYNTAX;
2032 				quoted = SQ;
2033 				VTRACE(DBG_LEXER, (" TS_PUSH(SQ)"));
2034 				continue;
2035 			}
2036 			if (magicq && arinest == 0 && varnest == 0) {
2037 				/* Ignore inside quoted here document */
2038 				VTRACE(DBG_LEXER, ("<<'>>"));
2039 				USTPUTC(c, out);
2040 				continue;
2041 			}
2042 			/* End of single quotes... */
2043 			TS_POP();
2044 			VTRACE(DBG_LEXER, ("SQ TS_POP->%s ", SYNTAX));
2045 			CVTRACE(DBG_LEXER, syntax == BASESYNTAX, (" CQE "));
2046 			if (syntax == BASESYNTAX)
2047 				USTPUTC(CTLQUOTEEND, out);
2048 			continue;
2049 		case CDQUOTE:
2050 			if (magicq && arinest == 0 /* && varnest == 0 */) {
2051 				VTRACE(DBG_LEXER, ("<<\">>"));
2052 				/* Ignore inside here document */
2053 				USTPUTC(c, out);
2054 				continue;
2055 			}
2056 			CVTRACE(DBG_LEXER, quotef==0, (" QF=1 "));
2057 			quotef = 1;
2058 			if (arinest) {
2059 				if (ISDBLQUOTE()) {
2060 					VTRACE(DBG_LEXER,
2061 					    (" CQE ari(%d", arinest));
2062 					USTPUTC(CTLQUOTEEND, out);
2063 					TS_POP();
2064 					VTRACE(DBG_LEXER, ("%d)TS_POP->%s ",
2065 					    arinest, SYNTAX));
2066 				} else {
2067 					VTRACE(DBG_LEXER,
2068 					  (" ari(%d) %s TS_PUSH->DQ CQM ",
2069 					   arinest, SYNTAX));
2070 					TS_PUSH();
2071 					syntax = DQSYNTAX;
2072 					SETDBLQUOTE();
2073 					USTPUTC(CTLQUOTEMARK, out);
2074 				}
2075 				continue;
2076 			}
2077 			CVTRACE(DBG_LEXER, magicq, (" MQignDQ "));
2078 			if (magicq)
2079 				continue;
2080 			if (ISDBLQUOTE()) {
2081 				TS_POP();
2082 				VTRACE(DBG_LEXER,
2083 				    (" DQ TS_POP->%s CQE ", SYNTAX));
2084 				USTPUTC(CTLQUOTEEND, out);
2085 			} else {
2086 				VTRACE(DBG_LEXER,
2087 				    (" %s TS_POP->DQ CQM ", SYNTAX));
2088 				TS_PUSH();
2089 				syntax = DQSYNTAX;
2090 				SETDBLQUOTE();
2091 				USTPUTC(CTLQUOTEMARK, out);
2092 			}
2093 			continue;
2094 		case CVAR:	/* '$' */
2095 			VTRACE(DBG_LEXER, ("'$'..."));
2096 			out = insert_elided_nl(out);
2097 			PARSESUB();		/* parse substitution */
2098 			continue;
2099 		case CENDVAR:	/* CLOSEBRACE */
2100 			if (varnest > 0 && !ISDBLQUOTE()) {
2101 				VTRACE(DBG_LEXER, ("vn=%d !DQ", varnest));
2102 				TS_POP();
2103 				VTRACE(DBG_LEXER, (" TS_POP->%s CEV ", SYNTAX));
2104 				USTPUTC(CTLENDVAR, out);
2105 			} else {
2106 				VTRACE(DBG_LEXER, ("'%c'", c));
2107 				USTPUTC(c, out);
2108 			}
2109 			out = insert_elided_nl(out);
2110 			continue;
2111 		case CLP:	/* '(' in arithmetic */
2112 			parenlevel++;
2113 			VTRACE(DBG_LEXER, ("'('(%d)", parenlevel));
2114 			USTPUTC(c, out);
2115 			continue;
2116 		case CRP:	/* ')' in arithmetic */
2117 			if (parenlevel > 0) {
2118 				USTPUTC(c, out);
2119 				--parenlevel;
2120 				VTRACE(DBG_LEXER, ("')'(%d)", parenlevel));
2121 			} else {
2122 				VTRACE(DBG_LEXER, ("')'(%d)", parenlevel));
2123 				if (pgetc_linecont() == /*(*/ ')') {
2124 					out = insert_elided_nl(out);
2125 					if (--arinest == 0) {
2126 						TS_POP();
2127 						USTPUTC(CTLENDARI, out);
2128 					} else
2129 						USTPUTC(/*(*/ ')', out);
2130 				} else {
2131 					break;	/* to synerror() just below */
2132 #if 0	/* the old way, causes weird errors on bad input */
2133 					/*
2134 					 * unbalanced parens
2135 					 *  (don't 2nd guess - no error)
2136 					 */
2137 					pungetc();
2138 					USTPUTC(/*(*/ ')', out);
2139 #endif
2140 				}
2141 			}
2142 			continue;
2143 		case CBQUOTE:	/* '`' */
2144 			VTRACE(DBG_LEXER, ("'`' -> parsebackq()\n"));
2145 			out = parsebackq(stack, out, &bqlist, 1);
2146 			VTRACE(DBG_LEXER, ("parsebackq() -> readtoken1: "));
2147 			continue;
2148 		case CEOF:		/* --> c == PEOF */
2149 			VTRACE(DBG_LEXER, ("EOF "));
2150 			break;		/* will exit loop */
2151 		default:
2152 			VTRACE(DBG_LEXER, ("['%c'(%#.2x)]", c&0xFF, c&0x1FF));
2153 			if (varnest == 0 && !ISDBLQUOTE())
2154 				break;	/* exit loop */
2155 			USTPUTC(c, out);
2156 			VTRACE(DBG_LEXER, (","));
2157 			continue;
2158 		}
2159 		VTRACE(DBG_LEXER, (" END TOKEN\n", c&0xFF, c&0x1FF));
2160 		break;	/* break from switch -> break from for loop too */
2161 	}
2162 
2163 	if (syntax == ARISYNTAX) {
2164 		cleanup_state_stack(stack);
2165 		synerror(/*((*/ "Missing '))'");
2166 	}
2167 	if (syntax != BASESYNTAX && /* ! parsebackquote && */ !magicq) {
2168 		cleanup_state_stack(stack);
2169 		synerror("Unterminated quoted string");
2170 	}
2171 	if (varnest != 0) {
2172 		cleanup_state_stack(stack);
2173 		startlinno = plinno;
2174 		/* { */
2175 		synerror("Missing '}'");
2176 	}
2177 
2178 	STPUTC('\0', out);
2179 	len = out - stackblock();
2180 	out = stackblock();
2181 
2182 	if (!magicq) {
2183 		if ((c == '<' || c == '>')
2184 		 && quotef == 0 && (*out == '\0' || is_number(out))) {
2185 			parseredir(out, c);
2186 			cleanup_state_stack(stack);
2187 			return lasttoken = TREDIR;
2188 		} else {
2189 			pungetc();
2190 		}
2191 	}
2192 
2193 	VTRACE(DBG_PARSE|DBG_LEXER,
2194 	    ("readtoken1 %sword \"%s\", completed%s (%d) left %d enl\n",
2195 	    (quotef ? "quoted " : ""), out, (bqlist ? " with cmdsubs" : ""),
2196 	    len, elided_nl));
2197 
2198 	quoteflag = quotef;
2199 	backquotelist = bqlist;
2200 	grabstackblock(len);
2201 	wordtext = out;
2202 	cleanup_state_stack(stack);
2203 	return lasttoken = TWORD;
2204 /* end of readtoken routine */
2205 
2206 
2207 /*
2208  * Parse a substitution.  At this point, we have read the dollar sign
2209  * and nothing else.
2210  */
2211 
2212 parsesub: {
2213 	int subtype;
2214 	int typeloc;
2215 	int flags;
2216 	char *p;
2217 	static const char types[] = "}-+?=";
2218 
2219 	c = pgetc_linecont();
2220 	VTRACE(DBG_LEXER, ("\"$%c\"(%#.2x)", c&0xFF, c&0x1FF));
2221 	if (c == '(' /*)*/) {	/* $(command) or $((arith)) */
2222 		if (pgetc_linecont() == '(' /*')'*/ ) {
2223 			VTRACE(DBG_LEXER, ("\"$((\" ARITH "));
2224 			out = insert_elided_nl(out);
2225 			PARSEARITH();
2226 		} else {
2227 			VTRACE(DBG_LEXER, ("\"$(\" CSUB->parsebackq()\n"));
2228 			out = insert_elided_nl(out);
2229 			pungetc();
2230 			out = parsebackq(stack, out, &bqlist, 0);
2231 			VTRACE(DBG_LEXER, ("parseback()->readtoken1(): "));
2232 		}
2233 	} else if (c == OPENBRACE || is_name(c) || is_special(c)) {
2234 		VTRACE(DBG_LEXER, (" $EXP:CTLVAR "));
2235 		USTPUTC(CTLVAR, out);
2236 		typeloc = out - stackblock();
2237 		USTPUTC(VSNORMAL, out);
2238 		subtype = VSNORMAL;
2239 		flags = 0;
2240 		if (c == OPENBRACE) {
2241 			c = pgetc_linecont();
2242 			if (c == '#') {
2243 				if ((c = pgetc_linecont()) == CLOSEBRACE)
2244 					c = '#';
2245 				else if (is_name(c) || isdigit(c))
2246 					subtype = VSLENGTH;
2247 				else if (is_special(c)) {
2248 					/*
2249 					 * ${#} is $# - the number of sh params
2250 					 * ${##} is the length of ${#}
2251 					 * ${###} is ${#} with as much nothing
2252 					 *        as possible removed from start
2253 					 * ${##1} is ${#} with leading 1 gone
2254 					 * ${##\#} is ${#} with leading # gone
2255 					 *
2256 					 * this stuff is UGLY!
2257 					 */
2258 					if (pgetc_linecont() == CLOSEBRACE) {
2259 						pungetc();
2260 						subtype = VSLENGTH;
2261 					} else {
2262 						static char cbuf[2];
2263 
2264 						pungetc();   /* would like 2 */
2265 						cbuf[0] = c; /* so ... */
2266 						cbuf[1] = '\0';
2267 						pushstring(cbuf, 1, NULL);
2268 						c = '#';     /* ${#:...} */
2269 						subtype = 0; /* .. or similar */
2270 					}
2271 				} else {
2272 					pungetc();
2273 					c = '#';
2274 					subtype = 0;
2275 				}
2276 			}
2277 			else
2278 				subtype = 0;
2279 			VTRACE(DBG_LEXER, ("${ st=%d ", subtype));
2280 		}
2281 		if (is_name(c)) {
2282 			p = out;
2283 			do {
2284 				VTRACE(DBG_LEXER, ("%c", c));
2285 				STPUTC(c, out);
2286 				c = pgetc_linecont();
2287 			} while (is_in_name(c));
2288 
2289 #if 0
2290 			if (out - p == 6 && strncmp(p, "LINENO", 6) == 0) {
2291 				int i;
2292 				int linno;
2293 				char buf[10];
2294 
2295 				/*
2296 				 * The "LINENO hack"
2297 				 *
2298 				 * Replace the variable name with the
2299 				 * current line number.
2300 				 */
2301 				linno = plinno;
2302 				if (funclinno != 0)
2303 					linno -= funclinno - 1;
2304 				snprintf(buf, sizeof(buf), "%d", linno);
2305 				STADJUST(-6, out);
2306 				for (i = 0; buf[i] != '\0'; i++)
2307 					STPUTC(buf[i], out);
2308 				flags |= VSLINENO;
2309 			}
2310 #endif
2311 		} else if (is_digit(c)) {
2312 			do {
2313 				VTRACE(DBG_LEXER, ("%c", c));
2314 				STPUTC(c, out);
2315 				c = pgetc_linecont();
2316 			} while (subtype != VSNORMAL && is_digit(c));
2317 		}
2318 		else if (is_special(c)) {
2319 			VTRACE(DBG_LEXER, ("\"$%c", c));
2320 			USTPUTC(c, out);
2321 			c = pgetc_linecont();
2322 		}
2323 		else {
2324 			VTRACE(DBG_LEXER, ("\"$%c(%#.2x)??\n", c&0xFF,c&0x1FF));
2325  badsub:
2326 			cleanup_state_stack(stack);
2327 			synerror("Bad substitution");
2328 		}
2329 
2330 		STPUTC('=', out);
2331 		if (subtype == 0) {
2332 			switch (c) {
2333 			case ':':
2334 				flags |= VSNUL;
2335 				c = pgetc_linecont();
2336 				/*FALLTHROUGH*/
2337 			default:
2338 				p = strchr(types, c);
2339 				if (p == NULL)
2340 					goto badsub;
2341 				subtype = p - types + VSNORMAL;
2342 				break;
2343 			case '%':
2344 			case '#':
2345 				{
2346 					int cc = c;
2347 					subtype = c == '#' ? VSTRIMLEFT :
2348 							     VSTRIMRIGHT;
2349 					c = pgetc_linecont();
2350 					if (c == cc)
2351 						subtype++;
2352 					else
2353 						pungetc();
2354 					break;
2355 				}
2356 			}
2357 		} else {
2358 			if (subtype == VSLENGTH && c != /*{*/ '}')
2359 				synerror("no modifiers allowed with ${#var}");
2360 			pungetc();
2361 		}
2362 		if (quoted || arinest)
2363 			flags |= VSQUOTE;
2364 		if (subtype >= VSTRIMLEFT && subtype <= VSTRIMRIGHTMAX)
2365 			flags |= VSPATQ;
2366 		VTRACE(DBG_LEXER, (" st%d:%x", subtype, flags));
2367 		*(stackblock() + typeloc) = subtype | flags;
2368 		if (subtype != VSNORMAL) {
2369 			TS_PUSH();
2370 			varnest++;
2371 			arinest = 0;
2372 			if (subtype > VSASSIGN) {	/* # ## % %% */
2373 				syntax = BASESYNTAX;
2374 				quoted = 0;
2375 				magicq = 0;
2376 			}
2377 			VTRACE(DBG_LEXER, (" TS_PUSH->%s vn=%d%s ",
2378 			    SYNTAX, varnest, quoted ? " Q" : ""));
2379 		}
2380 	} else if (c == '\'' && syntax == BASESYNTAX) {
2381 		USTPUTC(CTLQUOTEMARK, out);
2382 		VTRACE(DBG_LEXER, (" CSTR \"$'\" CQM "));
2383 		CVTRACE(DBG_LEXER, quotef==0, ("QF=1 "));
2384 		quotef = 1;
2385 		TS_PUSH();
2386 		syntax = SQSYNTAX;
2387 		quoted = CQ;
2388 		VTRACE(DBG_LEXER, ("%s->TS_PUSH()->SQ ", SYNTAX));
2389 	} else {
2390 		VTRACE(DBG_LEXER, ("$unk -> '$' (pushback '%c'%#.2x)",
2391 			c & 0xFF, c & 0x1FF));
2392 		USTPUTC('$', out);
2393 		pungetc();
2394 	}
2395 	goto parsesub_return;
2396 }
2397 
2398 
2399 /*
2400  * Parse an arithmetic expansion (indicate start of one and set state)
2401  */
2402 parsearith: {
2403 
2404 #if 0
2405 	if (syntax == ARISYNTAX) {
2406 		/*
2407 		 * we collapse embedded arithmetic expansion to
2408 		 * parentheses, which should be equivalent
2409 		 *
2410 		 *	XXX It isn't, must fix, soonish...
2411 		 */
2412 		USTPUTC('(' /*)*/, out);
2413 		USTPUTC('(' /*)*/, out);
2414 		/*
2415 		 * Need 2 of them because there will (should be)
2416 		 * two closing ))'s to follow later.
2417 		 */
2418 		parenlevel += 2;
2419 	} else
2420 #endif
2421 	{
2422 		VTRACE(DBG_LEXER, (" CTLARI%c ", ISDBLQUOTE()?'"':'_'));
2423 		USTPUTC(CTLARI, out);
2424 		if (ISDBLQUOTE())
2425 			USTPUTC('"',out);
2426 		else
2427 			USTPUTC(' ',out);
2428 
2429 		VTRACE(DBG_LEXER, ("%s->TS_PUSH->ARI(1)", SYNTAX));
2430 		TS_PUSH();
2431 		syntax = ARISYNTAX;
2432 		arinest = 1;
2433 		varnest = 0;
2434 		magicq = 1;
2435 	}
2436 	goto parsearith_return;
2437 }
2438 
2439 } /* end of readtoken */
2440 
2441 
2442 
2443 
2444 #ifdef mkinit
2445 INCLUDE "parser.h"
2446 
2447 RESET {
2448 	psp.v_current_parser = &parse_state;
2449 
2450 	parse_state.ps_tokpushback = 0;
2451 	parse_state.ps_checkkwd = 0;
2452 	parse_state.ps_heredoclist = NULL;
2453 }
2454 #endif
2455 
2456 /*
2457  * Returns true if the text contains nothing to expand (no dollar signs
2458  * or backquotes).
2459  */
2460 
2461 STATIC int
2462 noexpand(char *text)
2463 {
2464 	char *p;
2465 	char c;
2466 
2467 	p = text;
2468 	while ((c = *p++) != '\0') {
2469 		if (c == CTLQUOTEMARK || c == CTLQUOTEEND)
2470 			continue;
2471 		if (c == CTLESC)
2472 			p++;
2473 		else if (ISCTL(c))
2474 			return 0;
2475 	}
2476 	return 1;
2477 }
2478 
2479 
2480 /*
2481  * Return true if the argument is a legal variable name (a letter or
2482  * underscore followed by zero or more letters, underscores, and digits).
2483  */
2484 
2485 int
2486 goodname(const char *name)
2487 {
2488 	const char *p;
2489 
2490 	p = name;
2491 	if (! is_name(*p))
2492 		return 0;
2493 	while (*++p) {
2494 		if (! is_in_name(*p))
2495 			return 0;
2496 	}
2497 	return 1;
2498 }
2499 
2500 int
2501 isassignment(const char *p)
2502 {
2503 	if (!is_name(*p))
2504 		return 0;
2505 	while (*++p != '=')
2506 		if (*p == '\0' || !is_in_name(*p))
2507 			return 0;
2508 	return 1;
2509 }
2510 
2511 /*
2512  * skip past any \n's, and leave lasttoken set to whatever follows
2513  */
2514 STATIC void
2515 linebreak(void)
2516 {
2517 	while (readtoken() == TNL)
2518 		readheredocs();
2519 }
2520 
2521 /*
2522  * The next token must be "token" -- check, then move past it
2523  */
2524 STATIC void
2525 consumetoken(int token)
2526 {
2527 	if (readtoken() != token) {
2528 		VTRACE(DBG_PARSE, ("consumetoken(%d): expecting %s got %s",
2529 		    token, tokname[token], tokname[lasttoken]));
2530 		CVTRACE(DBG_PARSE, (lasttoken==TWORD), (" \"%s\"", wordtext));
2531 		VTRACE(DBG_PARSE, ("\n"));
2532 		synexpect(token, NULL);
2533 	}
2534 }
2535 
2536 /*
2537  * Called when an unexpected token is read during the parse.  The argument
2538  * is the token that is expected, or -1 if more than one type of token can
2539  * occur at this point.
2540  */
2541 
2542 STATIC void
2543 synexpect(int token, const char *text)
2544 {
2545 	char msg[64];
2546 	char *p;
2547 
2548 	if (lasttoken == TWORD) {
2549 		size_t len = strlen(wordtext);
2550 
2551 		if (len <= 13)
2552 			fmtstr(msg, 34, "Word \"%.13s\" unexpected", wordtext);
2553 		else
2554 			fmtstr(msg, 34,
2555 			    "Word \"%.10s...\" unexpected", wordtext);
2556 	} else
2557 		fmtstr(msg, 34, "%s unexpected", tokname[lasttoken]);
2558 
2559 	p = strchr(msg, '\0');
2560 	if (text)
2561 		fmtstr(p, 30, " (expecting \"%.10s\")", text);
2562 	else if (token >= 0)
2563 		fmtstr(p, 30, " (expecting %s)",  tokname[token]);
2564 
2565 	synerror(msg);
2566 	/* NOTREACHED */
2567 }
2568 
2569 
2570 STATIC void
2571 synerror(const char *msg)
2572 {
2573 	error("%d: Syntax error: %s", startlinno, msg);
2574 	/* NOTREACHED */
2575 }
2576 
2577 STATIC void
2578 setprompt(int which)
2579 {
2580 	whichprompt = which;
2581 
2582 #ifndef SMALL
2583 	if (!el)
2584 #endif
2585 		out2str(getprompt(NULL));
2586 }
2587 
2588 /*
2589  * handle getting the next character, while ignoring \ \n
2590  * (which is a little tricky as we only have one char of pushback
2591  * and we need that one elsewhere).
2592  */
2593 STATIC int
2594 pgetc_linecont(void)
2595 {
2596 	int c;
2597 
2598 	while ((c = pgetc()) == '\\') {
2599 		c = pgetc();
2600 		if (c == '\n') {
2601 			plinno++;
2602 			elided_nl++;
2603 			VTRACE(DBG_LEXER, ("\"\\n\"drop(el=%d@%d)",
2604 			    elided_nl, plinno));
2605 			if (doprompt)
2606 				setprompt(2);
2607 			else
2608 				setprompt(0);
2609 		} else {
2610 			pungetc();
2611 			/* Allow the backslash to be pushed back. */
2612 			pushstring("\\", 1, NULL);
2613 			return (pgetc());
2614 		}
2615 	}
2616 	return (c);
2617 }
2618 
2619 /*
2620  * called by editline -- any expansions to the prompt
2621  *    should be added here.
2622  */
2623 const char *
2624 getprompt(void *unused)
2625 {
2626 	char *p;
2627 	const char *cp;
2628 	int wp;
2629 
2630 	if (!doprompt)
2631 		return "";
2632 
2633 	VTRACE(DBG_PARSE|DBG_EXPAND, ("getprompt %d\n", whichprompt));
2634 
2635 	switch (wp = whichprompt) {
2636 	case 0:
2637 		return "";
2638 	case 1:
2639 		p = ps1val();
2640 		break;
2641 	case 2:
2642 		p = ps2val();
2643 		break;
2644 	default:
2645 		return "<internal prompt error>";
2646 	}
2647 	if (p == NULL)
2648 		return "";
2649 
2650 	VTRACE(DBG_PARSE|DBG_EXPAND, ("prompt <<%s>>\n", p));
2651 
2652 	cp = expandstr(p, plinno);
2653 	whichprompt = wp;	/* history depends on it not changing */
2654 
2655 	VTRACE(DBG_PARSE|DBG_EXPAND, ("prompt -> <<%s>>\n", cp));
2656 
2657 	return cp;
2658 }
2659 
2660 /*
2661  * Expand a string ... used for expanding prompts (PS1...)
2662  *
2663  * Never return NULL, always some string (return input string if invalid)
2664  *
2665  * The internal routine does the work, leaving the result on the
2666  * stack (or in a static string, or even the input string) and
2667  * handles parser recursion, and cleanup after an error while parsing.
2668  *
2669  * The visible interface copies the result off the stack (if it is there),
2670  * and handles stack management, leaving the stack in the exact same
2671  * state it was when expandstr() was called (so it can be used part way
2672  * through building a stack data structure - as in when PS2 is being
2673  * expanded half way through reading a "command line")
2674  *
2675  * on error, expandonstack() cleans up the parser state, but then
2676  * simply jumps out through expandstr() withut doing any stack cleanup,
2677  * which is OK, as the error handler must deal with that anyway.
2678  *
2679  * The split into two funcs is to avoid problems with setjmp/longjmp
2680  * and local variables which could otherwise be optimised into bizarre
2681  * behaviour.
2682  */
2683 static const char *
2684 expandonstack(char *ps, int cmdsub, int lineno)
2685 {
2686 	union node n;
2687 	struct jmploc jmploc;
2688 	struct jmploc *const savehandler = handler;
2689 	struct parsefile *const savetopfile = getcurrentfile();
2690 	const int save_x = xflag;
2691 	const int save_e_s = errors_suppressed;
2692 	struct parse_state new_state = init_parse_state;
2693 	struct parse_state *const saveparser = psp.v_current_parser;
2694 	const char *result = NULL;
2695 
2696 	if (!setjmp(jmploc.loc)) {
2697 		handler = &jmploc;
2698 		errors_suppressed = 1;
2699 
2700 		psp.v_current_parser = &new_state;
2701 		setinputstring(ps, 1, lineno);
2702 
2703 		readtoken1(pgetc(), DQSYNTAX, 1);
2704 		if (backquotelist != NULL) {
2705 			if (!cmdsub)
2706 				result = ps;
2707 			else if (!promptcmds)
2708 				result = "-o promptcmds not set: ";
2709 		}
2710 		if (result == NULL) {
2711 			n.narg.type = NARG;
2712 			n.narg.next = NULL;
2713 			n.narg.text = wordtext;
2714 			n.narg.lineno = lineno;
2715 			n.narg.backquote = backquotelist;
2716 
2717 			xflag = 0;	/* we might be expanding PS4 ... */
2718 			expandarg(&n, NULL, 0);
2719 			result = stackblock();
2720 		}
2721 	} else {
2722 		psp.v_current_parser = saveparser;
2723 		xflag = save_x;
2724 		popfilesupto(savetopfile);
2725 		handler = savehandler;
2726 		errors_suppressed = save_e_s;
2727 
2728 		if (exception == EXEXIT)
2729 			longjmp(handler->loc, 1);
2730 		if (exception == EXINT)
2731 			exraise(SIGINT);
2732 		return "";
2733 	}
2734 	psp.v_current_parser = saveparser;
2735 	xflag = save_x;
2736 	popfilesupto(savetopfile);
2737 	handler = savehandler;
2738 	errors_suppressed = save_e_s;
2739 
2740 	if (result == NULL)
2741 		result = ps;
2742 
2743 	return result;
2744 }
2745 
2746 const char *
2747 expandstr(char *ps, int lineno)
2748 {
2749 	const char *result = NULL;
2750 	struct stackmark smark;
2751 	static char *buffer = NULL;	/* storage for prompt, never freed */
2752 	static size_t bufferlen = 0;
2753 
2754 	setstackmark(&smark);
2755 	/*
2756 	 * At this point we anticipate that there may be a string
2757 	 * growing on the stack, but we have no idea how big it is.
2758 	 * However we know that it cannot be bigger than the current
2759 	 * allocated stack block, so simply reserve the whole thing,
2760 	 * then we can use the stack without barfing all over what
2761 	 * is there already...   (the stack mark undoes this later.)
2762 	 */
2763 	(void) stalloc(stackblocksize());
2764 
2765 	result = expandonstack(ps, 1, lineno);
2766 
2767 	if (__predict_true(result == stackblock())) {
2768 		size_t len = strlen(result) + 1;
2769 
2770 		/*
2771 		 * the result (usual case) is on the stack, which we
2772 		 * are just about to discard (popstackmark()) so we
2773 		 * need to move it somewhere safe first.
2774 		 */
2775 
2776 		if (__predict_false(len > bufferlen)) {
2777 			char *new;
2778 			size_t newlen = bufferlen;
2779 
2780 			if (__predict_false(len > (SIZE_MAX >> 4))) {
2781 				result = "huge prompt: ";
2782 				goto getout;
2783 			}
2784 
2785 			if (newlen == 0)
2786 				newlen = 32;
2787 			while (newlen <= len)
2788 				newlen <<= 1;
2789 
2790 			new = (char *)realloc(buffer, newlen);
2791 
2792 			if (__predict_false(new == NULL)) {
2793 				/*
2794 				 * this should rarely (if ever) happen
2795 				 * but we must do something when it does...
2796 				 */
2797 				result = "No mem for prompt: ";
2798 				goto getout;
2799 			} else {
2800 				buffer = new;
2801 				bufferlen = newlen;
2802 			}
2803 		}
2804 		(void)memcpy(buffer, result, len);
2805 		result = buffer;
2806 	}
2807 
2808   getout:;
2809 	popstackmark(&smark);
2810 
2811 	return result;
2812 }
2813 
2814 /*
2815  * and a simpler version, which does no $( ) expansions, for
2816  * use during shell startup when we know we are not parsing,
2817  * and so the stack is not in use - we can do what we like,
2818  * and do not need to clean up (that's handled externally).
2819  *
2820  * Simply return the result, even if it is on the stack
2821  */
2822 const char *
2823 expandenv(char *arg)
2824 {
2825 	return expandonstack(arg, 0, 0);
2826 }
2827