xref: /openbsd-src/bin/ksh/eval.c (revision 4b70baf6e17fc8b27fc1f7fa7929335753fa94c3)
1 /*	$OpenBSD: eval.c,v 1.64 2019/02/20 23:59:17 schwarze Exp $	*/
2 
3 /*
4  * Expansion - quoting, separation, substitution, globbing
5  */
6 
7 #include <sys/stat.h>
8 
9 #include <ctype.h>
10 #include <dirent.h>
11 #include <fcntl.h>
12 #include <pwd.h>
13 #include <stdio.h>
14 #include <string.h>
15 #include <unistd.h>
16 
17 #include "sh.h"
18 
19 /*
20  * string expansion
21  *
22  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
23  * second pass: alternation ({,}), filename expansion (*?[]).
24  */
25 
26 /* expansion generator state */
27 typedef struct Expand {
28 	/* int  type; */	/* see expand() */
29 	const char *str;	/* string */
30 	union {
31 		const char **strv;/* string[] */
32 		struct shf *shf;/* file */
33 	} u;			/* source */
34 	struct tbl *var;	/* variable in ${var..} */
35 	short	split;		/* split "$@" / call waitlast $() */
36 } Expand;
37 
38 #define	XBASE		0	/* scanning original */
39 #define	XSUB		1	/* expanding ${} string */
40 #define	XARGSEP		2	/* ifs0 between "$*" */
41 #define	XARG		3	/* expanding $*, $@ */
42 #define	XCOM		4	/* expanding $() */
43 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
44 #define XSUBMID		6	/* middle of expanding ${} */
45 
46 /* States used for field splitting */
47 #define IFS_WORD	0	/* word has chars (or quotes) */
48 #define IFS_WS		1	/* have seen IFS white-space */
49 #define IFS_NWS		2	/* have seen IFS non-white-space */
50 
51 static	int	varsub(Expand *, char *, char *, int *, int *);
52 static	int	comsub(Expand *, char *);
53 static	char   *trimsub(char *, char *, int);
54 static	void	glob(char *, XPtrV *, int);
55 static	void	globit(XString *, char **, char *, XPtrV *, int);
56 static char	*maybe_expand_tilde(char *, XString *, char **, int);
57 static	char   *tilde(char *);
58 static	char   *homedir(char *);
59 static void	alt_expand(XPtrV *, char *, char *, char *, int);
60 
61 static struct tbl *varcpy(struct tbl *);
62 
63 /* compile and expand word */
64 char *
65 substitute(const char *cp, int f)
66 {
67 	struct source *s, *sold;
68 
69 	if (disable_subst)
70 		return str_save(cp, ATEMP);
71 
72 	sold = source;
73 	s = pushs(SWSTR, ATEMP);
74 	s->start = s->str = cp;
75 	source = s;
76 	if (yylex(ONEWORD) != LWORD)
77 		internal_errorf("substitute");
78 	source = sold;
79 	afree(s, ATEMP);
80 	return evalstr(yylval.cp, f);
81 }
82 
83 /*
84  * expand arg-list
85  */
86 char **
87 eval(char **ap, int f)
88 {
89 	XPtrV w;
90 
91 	if (*ap == NULL)
92 		return ap;
93 	XPinit(w, 32);
94 	XPput(w, NULL);		/* space for shell name */
95 	while (*ap != NULL)
96 		expand(*ap++, &w, f);
97 	XPput(w, NULL);
98 	return (char **) XPclose(w) + 1;
99 }
100 
101 /*
102  * expand string
103  */
104 char *
105 evalstr(char *cp, int f)
106 {
107 	XPtrV w;
108 
109 	XPinit(w, 1);
110 	expand(cp, &w, f);
111 	cp = (XPsize(w) == 0) ? null : (char*) *XPptrv(w);
112 	XPfree(w);
113 	return cp;
114 }
115 
116 /*
117  * expand string - return only one component
118  * used from iosetup to expand redirection files
119  */
120 char *
121 evalonestr(char *cp, int f)
122 {
123 	XPtrV w;
124 
125 	XPinit(w, 1);
126 	expand(cp, &w, f);
127 	switch (XPsize(w)) {
128 	case 0:
129 		cp = null;
130 		break;
131 	case 1:
132 		cp = (char*) *XPptrv(w);
133 		break;
134 	default:
135 		cp = evalstr(cp, f&~DOGLOB);
136 		break;
137 	}
138 	XPfree(w);
139 	return cp;
140 }
141 
142 /* for nested substitution: ${var:=$var2} */
143 typedef struct SubType {
144 	short	stype;		/* [=+-?%#] action after expanded word */
145 	short	base;		/* begin position of expanded word */
146 	short	f;		/* saved value of f (DOPAT, etc) */
147 	struct tbl *var;	/* variable for ${var..} */
148 	short	quote;		/* saved value of quote (for ${..[%#]..}) */
149 	struct SubType *prev;	/* old type */
150 	struct SubType *next;	/* poped type (to avoid re-allocating) */
151 } SubType;
152 
153 void
154 expand(char *cp,	/* input word */
155     XPtrV *wp,		/* output words */
156     int f)		/* DO* flags */
157 {
158 	int c = 0;
159 	int type;		/* expansion type */
160 	int quote = 0;		/* quoted */
161 	XString ds;		/* destination string */
162 	char *dp, *sp;		/* dest., source */
163 	int fdo, word;		/* second pass flags; have word */
164 	int doblank;		/* field splitting of parameter/command subst */
165 	Expand x = {
166 		/* expansion variables */
167 		NULL, { NULL }, NULL, 0
168 	};
169 	SubType st_head, *st;
170 	int newlines = 0; /* For trailing newlines in COMSUB */
171 	int saw_eq, tilde_ok;
172 	int make_magic;
173 	size_t len;
174 
175 	if (cp == NULL)
176 		internal_errorf("expand(NULL)");
177 	/* for alias, readonly, set, typeset commands */
178 	if ((f & DOVACHECK) && is_wdvarassign(cp)) {
179 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
180 		f |= DOASNTILDE;
181 	}
182 	if (Flag(FNOGLOB))
183 		f &= ~DOGLOB;
184 	if (Flag(FMARKDIRS))
185 		f |= DOMARKDIRS;
186 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
187 		f |= DOBRACE_;
188 
189 	Xinit(ds, dp, 128, ATEMP);	/* init dest. string */
190 	type = XBASE;
191 	sp = cp;
192 	fdo = 0;
193 	saw_eq = 0;
194 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0; /* must be 1/0 */
195 	doblank = 0;
196 	make_magic = 0;
197 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
198 
199 	memset(&st_head, 0, sizeof(st_head));
200 	st = &st_head;
201 
202 	while (1) {
203 		Xcheck(ds, dp);
204 
205 		switch (type) {
206 		case XBASE:	/* original prefixed string */
207 			c = *sp++;
208 			switch (c) {
209 			case EOS:
210 				c = 0;
211 				break;
212 			case CHAR:
213 				c = *sp++;
214 				break;
215 			case QCHAR:
216 				quote |= 2; /* temporary quote */
217 				c = *sp++;
218 				break;
219 			case OQUOTE:
220 				word = IFS_WORD;
221 				tilde_ok = 0;
222 				quote = 1;
223 				continue;
224 			case CQUOTE:
225 				quote = 0;
226 				continue;
227 			case COMSUB:
228 				tilde_ok = 0;
229 				if (f & DONTRUNCOMMAND) {
230 					word = IFS_WORD;
231 					*dp++ = '$'; *dp++ = '(';
232 					while (*sp != '\0') {
233 						Xcheck(ds, dp);
234 						*dp++ = *sp++;
235 					}
236 					*dp++ = ')';
237 				} else {
238 					type = comsub(&x, sp);
239 					if (type == XCOM && (f&DOBLANK))
240 						doblank++;
241 					sp = strchr(sp, 0) + 1;
242 					newlines = 0;
243 				}
244 				continue;
245 			case EXPRSUB:
246 				word = IFS_WORD;
247 				tilde_ok = 0;
248 				if (f & DONTRUNCOMMAND) {
249 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
250 					while (*sp != '\0') {
251 						Xcheck(ds, dp);
252 						*dp++ = *sp++;
253 					}
254 					*dp++ = ')'; *dp++ = ')';
255 				} else {
256 					struct tbl v;
257 					char *p;
258 
259 					v.flag = DEFINED|ISSET|INTEGER;
260 					v.type = 10; /* not default */
261 					v.name[0] = '\0';
262 					v_evaluate(&v, substitute(sp, 0),
263 					    KSH_UNWIND_ERROR, true);
264 					sp = strchr(sp, 0) + 1;
265 					for (p = str_val(&v); *p; ) {
266 						Xcheck(ds, dp);
267 						*dp++ = *p++;
268 					}
269 				}
270 				continue;
271 			case OSUBST: /* ${{#}var{:}[=+-?#%]word} */
272 			  /* format is:
273 			   *   OSUBST [{x] plain-variable-part \0
274 			   *     compiled-word-part CSUBST [}x]
275 			   * This is where all syntax checking gets done...
276 			   */
277 			    {
278 				char *varname = ++sp; /* skip the { or x (}) */
279 				int stype;
280 				int slen = 0;
281 
282 				sp = strchr(sp, '\0') + 1; /* skip variable */
283 				type = varsub(&x, varname, sp, &stype, &slen);
284 				if (type < 0) {
285 					char endc;
286 					char *str, *end;
287 
288 					sp = varname - 2; /* restore sp */
289 					end = (char *) wdscan(sp, CSUBST);
290 					/* ({) the } or x is already skipped */
291 					endc = *end;
292 					*end = EOS;
293 					str = snptreef(NULL, 64, "%S", sp);
294 					*end = endc;
295 					errorf("%s: bad substitution", str);
296 				}
297 				if (f&DOBLANK)
298 					doblank++;
299 				tilde_ok = 0;
300 				if (type == XBASE) {	/* expand? */
301 					if (!st->next) {
302 						SubType *newst;
303 
304 						newst = alloc(
305 						    sizeof(SubType), ATEMP);
306 						newst->next = NULL;
307 						newst->prev = st;
308 						st->next = newst;
309 					}
310 					st = st->next;
311 					st->stype = stype;
312 					st->base = Xsavepos(ds, dp);
313 					st->f = f;
314 					st->var = varcpy(x.var);
315 					st->quote = quote;
316 					/* skip qualifier(s) */
317 					if (stype)
318 						sp += slen;
319 					switch (stype & 0x7f) {
320 					case '#':
321 					case '%':
322 						/* ! DOBLANK,DOBRACE_,DOTILDE */
323 						f = DOPAT | (f&DONTRUNCOMMAND) |
324 						    DOTEMP_;
325 						quote = 0;
326 						/* Prepend open pattern (so |
327 						 * in a trim will work as
328 						 * expected)
329 						 */
330 						*dp++ = MAGIC;
331 						*dp++ = '@' + 0x80U;
332 						break;
333 					case '=':
334 						/* Enabling tilde expansion
335 						 * after :'s here is
336 						 * non-standard ksh, but is
337 						 * consistent with rules for
338 						 * other assignments.  Not
339 						 * sure what POSIX thinks of
340 						 * this.
341 						 * Not doing tilde expansion
342 						 * for integer variables is a
343 						 * non-POSIX thing - makes
344 						 * sense though, since ~ is
345 						 * a arithmetic operator.
346 						 */
347 						if (!(x.var->flag & INTEGER))
348 							f |= DOASNTILDE|DOTILDE;
349 						f |= DOTEMP_;
350 						/* These will be done after the
351 						 * value has been assigned.
352 						 */
353 						f &= ~(DOBLANK|DOGLOB|DOBRACE_);
354 						tilde_ok = 1;
355 						break;
356 					case '?':
357 						f &= ~DOBLANK;
358 						f |= DOTEMP_;
359 						/* FALLTHROUGH */
360 					default:
361 						/* Enable tilde expansion */
362 						tilde_ok = 1;
363 						f |= DOTILDE;
364 					}
365 				} else
366 					/* skip word */
367 					sp = (char *) wdscan(sp, CSUBST);
368 				continue;
369 			    }
370 			case CSUBST: /* only get here if expanding word */
371 				sp++; /* ({) skip the } or x */
372 				tilde_ok = 0;	/* in case of ${unset:-} */
373 				*dp = '\0';
374 				quote = st->quote;
375 				f = st->f;
376 				if (f&DOBLANK)
377 					doblank--;
378 				switch (st->stype&0x7f) {
379 				case '#':
380 				case '%':
381 					/* Append end-pattern */
382 					*dp++ = MAGIC; *dp++ = ')'; *dp = '\0';
383 					dp = Xrestpos(ds, dp, st->base);
384 					/* Must use st->var since calling
385 					 * global would break things
386 					 * like x[i+=1].
387 					 */
388 					x.str = trimsub(str_val(st->var),
389 						dp, st->stype);
390 					if (x.str[0] != '\0' || st->quote)
391 						type = XSUB;
392 					else
393 						type = XNULLSUB;
394 					if (f&DOBLANK)
395 						doblank++;
396 					st = st->prev;
397 					continue;
398 				case '=':
399 					/* Restore our position and substitute
400 					 * the value of st->var (may not be
401 					 * the assigned value in the presence
402 					 * of integer/right-adj/etc attributes).
403 					 */
404 					dp = Xrestpos(ds, dp, st->base);
405 					/* Must use st->var since calling
406 					 * global would cause with things
407 					 * like x[i+=1] to be evaluated twice.
408 					 */
409 					/* Note: not exported by FEXPORT
410 					 * in at&t ksh.
411 					 */
412 					/* XXX POSIX says readonly is only
413 					 * fatal for special builtins (setstr
414 					 * does readonly check).
415 					 */
416 					len = strlen(dp) + 1;
417 					setstr(st->var,
418 					    debunk(alloc(len, ATEMP),
419 					    dp, len), KSH_UNWIND_ERROR);
420 					x.str = str_val(st->var);
421 					type = XSUB;
422 					if (f&DOBLANK)
423 						doblank++;
424 					st = st->prev;
425 					continue;
426 				case '?':
427 				    {
428 					char *s = Xrestpos(ds, dp, st->base);
429 
430 					errorf("%s: %s", st->var->name,
431 					    dp == s ?
432 					    "parameter null or not set" :
433 					    (debunk(s, s, strlen(s) + 1), s));
434 				    }
435 				}
436 				st = st->prev;
437 				type = XBASE;
438 				continue;
439 
440 			case OPAT: /* open pattern: *(foo|bar) */
441 				/* Next char is the type of pattern */
442 				make_magic = 1;
443 				c = *sp++ + 0x80;
444 				break;
445 
446 			case SPAT: /* pattern separator (|) */
447 				make_magic = 1;
448 				c = '|';
449 				break;
450 
451 			case CPAT: /* close pattern */
452 				make_magic = 1;
453 				c = /*(*/ ')';
454 				break;
455 			}
456 			break;
457 
458 		case XNULLSUB:
459 			/* Special case for "$@" (and "${foo[@]}") - no
460 			 * word is generated if $# is 0 (unless there is
461 			 * other stuff inside the quotes).
462 			 */
463 			type = XBASE;
464 			if (f&DOBLANK) {
465 				doblank--;
466 				/* not really correct: x=; "$x$@" should
467 				 * generate a null argument and
468 				 * set A; "${@:+}" shouldn't.
469 				 */
470 				if (dp == Xstring(ds, dp))
471 					word = IFS_WS;
472 			}
473 			continue;
474 
475 		case XSUB:
476 		case XSUBMID:
477 			if ((c = *x.str++) == 0) {
478 				type = XBASE;
479 				if (f&DOBLANK)
480 					doblank--;
481 				continue;
482 			}
483 			break;
484 
485 		case XARGSEP:
486 			type = XARG;
487 			quote = 1;
488 		case XARG:
489 			if ((c = *x.str++) == '\0') {
490 				/* force null words to be created so
491 				 * set -- '' 2 ''; foo "$@" will do
492 				 * the right thing
493 				 */
494 				if (quote && x.split)
495 					word = IFS_WORD;
496 				if ((x.str = *x.u.strv++) == NULL) {
497 					type = XBASE;
498 					if (f&DOBLANK)
499 						doblank--;
500 					continue;
501 				}
502 				c = ifs0;
503 				if (c == 0) {
504 					if (quote && !x.split)
505 						continue;
506 					c = ' ';
507 				}
508 				if (quote && x.split) {
509 					/* terminate word for "$@" */
510 					type = XARGSEP;
511 					quote = 0;
512 				}
513 			}
514 			break;
515 
516 		case XCOM:
517 			if (x.u.shf == NULL)	/* $(< ...) failed, fake EOF */
518 				c = EOF;
519 			else if (newlines) {		/* Spit out saved nl's */
520 				c = '\n';
521 				--newlines;
522 			} else {
523 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
524 				    if (c == '\n')
525 					    newlines++;	/* Save newlines */
526 				if (newlines && c != EOF) {
527 					shf_ungetc(c, x.u.shf);
528 					c = '\n';
529 					--newlines;
530 				}
531 			}
532 			if (c == EOF) {
533 				newlines = 0;
534 				if (x.u.shf != NULL)
535 					shf_close(x.u.shf);
536 				if (x.split)
537 					subst_exstat = waitlast();
538 				else
539 					subst_exstat = (x.u.shf == NULL);
540 				type = XBASE;
541 				if (f&DOBLANK)
542 					doblank--;
543 				continue;
544 			}
545 			break;
546 		}
547 
548 		/* check for end of word or IFS separation */
549 		if (c == 0 || (!quote && (f & DOBLANK) && doblank &&
550 		    !make_magic && ctype(c, C_IFS))) {
551 			/* How words are broken up:
552 			 *		   |       value of c
553 			 *	  word	   |	ws	nws	0
554 			 *	-----------------------------------
555 			 *	IFS_WORD	w/WS	w/NWS	w
556 			 *	IFS_WS		-/WS	w/NWS	-
557 			 *	IFS_NWS		-/NWS	w/NWS	w
558 			 *   (w means generate a word)
559 			 * Note that IFS_NWS/0 generates a word (at&t ksh
560 			 * doesn't do this, but POSIX does).
561 			 */
562 			if (word == IFS_WORD ||
563 			    (!ctype(c, C_IFSWS) && c && word == IFS_NWS)) {
564 				char *p;
565 
566 				*dp++ = '\0';
567 				p = Xclose(ds, dp);
568 				if (fdo & DOBRACE_)
569 					/* also does globbing */
570 					alt_expand(wp, p, p,
571 					    p + Xlength(ds, (dp - 1)),
572 					    fdo | (f & DOMARKDIRS));
573 				else if (fdo & DOGLOB)
574 					glob(p, wp, f & DOMARKDIRS);
575 				else if ((f & DOPAT) || !(fdo & DOMAGIC_))
576 					XPput(*wp, p);
577 				else
578 					XPput(*wp, debunk(p, p, strlen(p) + 1));
579 				fdo = 0;
580 				saw_eq = 0;
581 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
582 				if (c != 0)
583 					Xinit(ds, dp, 128, ATEMP);
584 			}
585 			if (c == 0)
586 				goto done;
587 			if (word != IFS_NWS)
588 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
589 		} else {
590 			if (type == XSUB) {
591 				if (word == IFS_NWS &&
592 				    Xlength(ds, dp) == 0) {
593 					char *p;
594 
595 					if ((p = strdup("")) == NULL)
596 						internal_errorf("unable "
597 						    "to allocate memory");
598 					XPput(*wp, p);
599 				}
600 				type = XSUBMID;
601 			}
602 
603 			/* age tilde_ok info - ~ code tests second bit */
604 			tilde_ok <<= 1;
605 			/* mark any special second pass chars */
606 			if (!quote)
607 				switch (c) {
608 				case '[':
609 				case '!':
610 				case '-':
611 				case ']':
612 					/* For character classes - doesn't hurt
613 					 * to have magic !,-,]'s outside of
614 					 * [...] expressions.
615 					 */
616 					if (f & (DOPAT | DOGLOB)) {
617 						fdo |= DOMAGIC_;
618 						if (c == '[')
619 							fdo |= f & DOGLOB;
620 						*dp++ = MAGIC;
621 					}
622 					break;
623 				case '*':
624 				case '?':
625 					if (f & (DOPAT | DOGLOB)) {
626 						fdo |= DOMAGIC_ | (f & DOGLOB);
627 						*dp++ = MAGIC;
628 					}
629 					break;
630 				case OBRACE:
631 				case ',':
632 				case CBRACE:
633 					if ((f & DOBRACE_) && (c == OBRACE ||
634 					    (fdo & DOBRACE_))) {
635 						fdo |= DOBRACE_|DOMAGIC_;
636 						*dp++ = MAGIC;
637 					}
638 					break;
639 				case '=':
640 					/* Note first unquoted = for ~ */
641 					if (!(f & DOTEMP_) && !saw_eq) {
642 						saw_eq = 1;
643 						tilde_ok = 1;
644 					}
645 					break;
646 				case ':': /* : */
647 					/* Note unquoted : for ~ */
648 					if (!(f & DOTEMP_) && (f & DOASNTILDE))
649 						tilde_ok = 1;
650 					break;
651 				case '~':
652 					/* tilde_ok is reset whenever
653 					 * any of ' " $( $(( ${ } are seen.
654 					 * Note that tilde_ok must be preserved
655 					 * through the sequence ${A=a=}~
656 					 */
657 					if (type == XBASE &&
658 					    (f & (DOTILDE|DOASNTILDE)) &&
659 					    (tilde_ok & 2)) {
660 						char *p, *dp_x;
661 
662 						dp_x = dp;
663 						p = maybe_expand_tilde(sp,
664 						    &ds, &dp_x,
665 						    f & DOASNTILDE);
666 						if (p) {
667 							if (dp != dp_x)
668 								word = IFS_WORD;
669 							dp = dp_x;
670 							sp = p;
671 							continue;
672 						}
673 					}
674 					break;
675 				}
676 			else
677 				quote &= ~2; /* undo temporary */
678 
679 			if (make_magic) {
680 				make_magic = 0;
681 				fdo |= DOMAGIC_ | (f & DOGLOB);
682 				*dp++ = MAGIC;
683 			} else if (ISMAGIC(c)) {
684 				fdo |= DOMAGIC_;
685 				*dp++ = MAGIC;
686 			}
687 			*dp++ = c; /* save output char */
688 			word = IFS_WORD;
689 		}
690 	}
691 
692 done:
693 	for (st = &st_head; st != NULL; st = st->next) {
694 		if (st->var == NULL || (st->var->flag & RDONLY) == 0)
695 			continue;
696 
697 		afree(st->var, ATEMP);
698 	}
699 }
700 
701 /*
702  * Prepare to generate the string returned by ${} substitution.
703  */
704 static int
705 varsub(Expand *xp, char *sp, char *word,
706     int *stypep,	/* becomes qualifier type */
707     int *slenp)		/* " " len (=, :=, etc.) valid iff *stypep != 0 */
708 {
709 	int c;
710 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
711 	int stype;	/* substitution type */
712 	int slen;
713 	char *p;
714 	struct tbl *vp;
715 	int zero_ok = 0;
716 
717 	if (sp[0] == '\0')	/* Bad variable name */
718 		return -1;
719 
720 	xp->var = NULL;
721 
722 	/* ${#var}, string length or array size */
723 	if (sp[0] == '#' && (c = sp[1]) != '\0') {
724 		/* Can't have any modifiers for ${#...} */
725 		if (*word != CSUBST)
726 			return -1;
727 		sp++;
728 		/* Check for size of array */
729 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
730 			int n = 0;
731 
732 			vp = global(arrayname(sp));
733 			if (vp->flag & (ISSET|ARRAY))
734 				zero_ok = 1;
735 			for (; vp; vp = vp->u.array)
736 				if (vp->flag & ISSET)
737 					n++;
738 			c = n; /* ksh88/ksh93 go for number, not max index */
739 		} else if (c == '*' || c == '@')
740 			c = genv->loc->argc;
741 		else {
742 			p = str_val(global(sp));
743 			zero_ok = p != null;
744 			c = strlen(p);
745 		}
746 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
747 			errorf("%s: parameter not set", sp);
748 		*stypep = 0; /* unqualified variable/string substitution */
749 		xp->str = str_save(u64ton((uint64_t)c, 10), ATEMP);
750 		return XSUB;
751 	}
752 
753 	/* Check for qualifiers in word part */
754 	stype = 0;
755 	c = word[slen = 0] == CHAR ? word[1] : 0;
756 	if (c == ':') {
757 		slen += 2;
758 		stype = 0x80;
759 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
760 	}
761 	if (ctype(c, C_SUBOP1)) {
762 		slen += 2;
763 		stype |= c;
764 	} else if (ctype(c, C_SUBOP2)) { /* Note: ksh88 allows :%, :%%, etc */
765 		slen += 2;
766 		stype = c;
767 		if (word[slen + 0] == CHAR && c == word[slen + 1]) {
768 			stype |= 0x80;
769 			slen += 2;
770 		}
771 	} else if (stype)	/* : is not ok */
772 		return -1;
773 	if (!stype && *word != CSUBST)
774 		return -1;
775 	*stypep = stype;
776 	*slenp = slen;
777 
778 	c = sp[0];
779 	if (c == '*' || c == '@') {
780 		switch (stype & 0x7f) {
781 		case '=':	/* can't assign to a vector */
782 		case '%':	/* can't trim a vector (yet) */
783 		case '#':
784 			return -1;
785 		}
786 		if (genv->loc->argc == 0) {
787 			xp->str = null;
788 			xp->var = global(sp);
789 			state = c == '@' ? XNULLSUB : XSUB;
790 		} else {
791 			xp->u.strv = (const char **) genv->loc->argv + 1;
792 			xp->str = *xp->u.strv++;
793 			xp->split = c == '@'; /* $@ */
794 			state = XARG;
795 		}
796 		zero_ok = 1;	/* exempt "$@" and "$*" from 'set -u' */
797 	} else {
798 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
799 			XPtrV wv;
800 
801 			switch (stype & 0x7f) {
802 			case '=':	/* can't assign to a vector */
803 			case '%':	/* can't trim a vector (yet) */
804 			case '#':
805 			case '?':
806 				return -1;
807 			}
808 			XPinit(wv, 32);
809 			vp = global(arrayname(sp));
810 			for (; vp; vp = vp->u.array) {
811 				if (!(vp->flag&ISSET))
812 					continue;
813 				XPput(wv, str_val(vp));
814 			}
815 			if (XPsize(wv) == 0) {
816 				xp->str = null;
817 				state = p[1] == '@' ? XNULLSUB : XSUB;
818 				XPfree(wv);
819 			} else {
820 				XPput(wv, 0);
821 				xp->u.strv = (const char **) XPptrv(wv);
822 				xp->str = *xp->u.strv++;
823 				xp->split = p[1] == '@'; /* ${foo[@]} */
824 				state = XARG;
825 			}
826 		} else {
827 			/* Can't assign things like $! or $1 */
828 			if ((stype & 0x7f) == '=' &&
829 			    (ctype(*sp, C_VAR1) || digit(*sp)))
830 				return -1;
831 			xp->var = global(sp);
832 			xp->str = str_val(xp->var);
833 			state = XSUB;
834 		}
835 	}
836 
837 	c = stype&0x7f;
838 	/* test the compiler's code generator */
839 	if (ctype(c, C_SUBOP2) ||
840 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
841 	    c == '=' || c == '-' || c == '?' : c == '+'))
842 		state = XBASE;	/* expand word instead of variable value */
843 	if (Flag(FNOUNSET) && xp->str == null && !zero_ok &&
844 	    (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
845 		errorf("%s: parameter not set", sp);
846 	return state;
847 }
848 
849 /*
850  * Run the command in $(...) and read its output.
851  */
852 static int
853 comsub(Expand *xp, char *cp)
854 {
855 	Source *s, *sold;
856 	struct op *t;
857 	struct shf *shf;
858 
859 	s = pushs(SSTRING, ATEMP);
860 	s->start = s->str = cp;
861 	sold = source;
862 	t = compile(s);
863 	afree(s, ATEMP);
864 	source = sold;
865 
866 	if (t == NULL)
867 		return XBASE;
868 
869 	if (t != NULL && t->type == TCOM && /* $(<file) */
870 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
871 		struct ioword *io = *t->ioact;
872 		char *name;
873 
874 		if ((io->flag&IOTYPE) != IOREAD)
875 			errorf("funny $() command: %s",
876 			    snptreef(NULL, 32, "%R", io));
877 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
878 			SHF_MAPHI|SHF_CLEXEC);
879 		if (shf == NULL)
880 			warningf(!Flag(FTALKING),
881 			    "%s: cannot open $(<) input", name);
882 		xp->split = 0;	/* no waitlast() */
883 	} else {
884 		int ofd1, pv[2];
885 		openpipe(pv);
886 		shf = shf_fdopen(pv[0], SHF_RD, NULL);
887 		ofd1 = savefd(1);
888 		if (pv[1] != 1) {
889 			ksh_dup2(pv[1], 1, false);
890 			close(pv[1]);
891 		}
892 		execute(t, XFORK|XXCOM|XPIPEO, NULL);
893 		restfd(1, ofd1);
894 		startlast();
895 		xp->split = 1;	/* waitlast() */
896 	}
897 
898 	xp->u.shf = shf;
899 	return XCOM;
900 }
901 
902 /*
903  * perform #pattern and %pattern substitution in ${}
904  */
905 
906 static char *
907 trimsub(char *str, char *pat, int how)
908 {
909 	char *end = strchr(str, 0);
910 	char *p, c;
911 
912 	switch (how&0xff) {	/* UCHAR_MAX maybe? */
913 	case '#':		/* shortest at beginning */
914 		for (p = str; p <= end; p++) {
915 			c = *p; *p = '\0';
916 			if (gmatch(str, pat, false)) {
917 				*p = c;
918 				return p;
919 			}
920 			*p = c;
921 		}
922 		break;
923 	case '#'|0x80:	/* longest match at beginning */
924 		for (p = end; p >= str; p--) {
925 			c = *p; *p = '\0';
926 			if (gmatch(str, pat, false)) {
927 				*p = c;
928 				return p;
929 			}
930 			*p = c;
931 		}
932 		break;
933 	case '%':		/* shortest match at end */
934 		for (p = end; p >= str; p--) {
935 			if (gmatch(p, pat, false))
936 				return str_nsave(str, p - str, ATEMP);
937 		}
938 		break;
939 	case '%'|0x80:	/* longest match at end */
940 		for (p = str; p <= end; p++) {
941 			if (gmatch(p, pat, false))
942 				return str_nsave(str, p - str, ATEMP);
943 		}
944 		break;
945 	}
946 
947 	return str;		/* no match, return string */
948 }
949 
950 /*
951  * glob
952  * Name derived from V6's /etc/glob, the program that expanded filenames.
953  */
954 
955 /* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
956 static void
957 glob(char *cp, XPtrV *wp, int markdirs)
958 {
959 	int oldsize = XPsize(*wp);
960 
961 	if (glob_str(cp, wp, markdirs) == 0)
962 		XPput(*wp, debunk(cp, cp, strlen(cp) + 1));
963 	else
964 		qsortp(XPptrv(*wp) + oldsize, (size_t)(XPsize(*wp) - oldsize),
965 			xstrcmp);
966 }
967 
968 #define GF_NONE		0
969 #define GF_EXCHECK	BIT(0)		/* do existence check on file */
970 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
971 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
972 
973 /* Apply file globbing to cp and store the matching files in wp.  Returns
974  * the number of matches found.
975  */
976 int
977 glob_str(char *cp, XPtrV *wp, int markdirs)
978 {
979 	int oldsize = XPsize(*wp);
980 	XString xs;
981 	char *xp;
982 
983 	Xinit(xs, xp, 256, ATEMP);
984 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
985 	Xfree(xs, xp);
986 
987 	return XPsize(*wp) - oldsize;
988 }
989 
990 static void
991 globit(XString *xs,	/* dest string */
992     char **xpp,		/* ptr to dest end */
993     char *sp,		/* source path */
994     XPtrV *wp,		/* output list */
995     int check)		/* GF_* flags */
996 {
997 	char *np;		/* next source component */
998 	char *xp = *xpp;
999 	char *se;
1000 	char odirsep;
1001 
1002 	/* This to allow long expansions to be interrupted */
1003 	intrcheck();
1004 
1005 	if (sp == NULL) {	/* end of source path */
1006 		/* We only need to check if the file exists if a pattern
1007 		 * is followed by a non-pattern (eg, foo*x/bar; no check
1008 		 * is needed for foo* since the match must exist) or if
1009 		 * any patterns were expanded and the markdirs option is set.
1010 		 * Symlinks make things a bit tricky...
1011 		 */
1012 		if ((check & GF_EXCHECK) ||
1013 		    ((check & GF_MARKDIR) && (check & GF_GLOBBED))) {
1014 #define stat_check()	(stat_done ? stat_done : \
1015 			    (stat_done = stat(Xstring(*xs, xp), &statb) < 0 \
1016 				? -1 : 1))
1017 			struct stat lstatb, statb;
1018 			int stat_done = 0;	 /* -1: failed, 1 ok */
1019 
1020 			if (lstat(Xstring(*xs, xp), &lstatb) < 0)
1021 				return;
1022 			/* special case for systems which strip trailing
1023 			 * slashes from regular files (eg, /etc/passwd/).
1024 			 * SunOS 4.1.3 does this...
1025 			 */
1026 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp) &&
1027 			    xp[-1] == '/' && !S_ISDIR(lstatb.st_mode) &&
1028 			    (!S_ISLNK(lstatb.st_mode) ||
1029 			    stat_check() < 0 || !S_ISDIR(statb.st_mode)))
1030 				return;
1031 			/* Possibly tack on a trailing / if there isn't already
1032 			 * one and if the file is a directory or a symlink to a
1033 			 * directory
1034 			 */
1035 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED)) &&
1036 			    xp > Xstring(*xs, xp) && xp[-1] != '/' &&
1037 			    (S_ISDIR(lstatb.st_mode) ||
1038 			    (S_ISLNK(lstatb.st_mode) && stat_check() > 0 &&
1039 			    S_ISDIR(statb.st_mode)))) {
1040 				*xp++ = '/';
1041 				*xp = '\0';
1042 			}
1043 		}
1044 		XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp), ATEMP));
1045 		return;
1046 	}
1047 
1048 	if (xp > Xstring(*xs, xp))
1049 		*xp++ = '/';
1050 	while (*sp == '/') {
1051 		Xcheck(*xs, xp);
1052 		*xp++ = *sp++;
1053 	}
1054 	np = strchr(sp, '/');
1055 	if (np != NULL) {
1056 		se = np;
1057 		odirsep = *np;	/* don't assume '/', can be multiple kinds */
1058 		*np++ = '\0';
1059 	} else {
1060 		odirsep = '\0'; /* keep gcc quiet */
1061 		se = sp + strlen(sp);
1062 	}
1063 
1064 
1065 	/* Check if sp needs globbing - done to avoid pattern checks for strings
1066 	 * containing MAGIC characters, open ['s without the matching close ],
1067 	 * etc. (otherwise opendir() will be called which may fail because the
1068 	 * directory isn't readable - if no globbing is needed, only execute
1069 	 * permission should be required (as per POSIX)).
1070 	 */
1071 	if (!has_globbing(sp, se)) {
1072 		XcheckN(*xs, xp, se - sp + 1);
1073 		debunk(xp, sp, Xnleft(*xs, xp));
1074 		xp += strlen(xp);
1075 		*xpp = xp;
1076 		globit(xs, xpp, np, wp, check);
1077 	} else {
1078 		DIR *dirp;
1079 		struct dirent *d;
1080 		char *name;
1081 		int len;
1082 		int prefix_len;
1083 
1084 		*xp = '\0';
1085 		prefix_len = Xlength(*xs, xp);
1086 		dirp = opendir(prefix_len ? Xstring(*xs, xp) : ".");
1087 		if (dirp == NULL)
1088 			goto Nodir;
1089 		while ((d = readdir(dirp)) != NULL) {
1090 			name = d->d_name;
1091 			if (name[0] == '.' &&
1092 			    (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
1093 				continue; /* always ignore . and .. */
1094 			if ((*name == '.' && *sp != '.') ||
1095 			    !gmatch(name, sp, true))
1096 				continue;
1097 
1098 			len = strlen(d->d_name) + 1;
1099 			XcheckN(*xs, xp, len);
1100 			memcpy(xp, name, len);
1101 			*xpp = xp + len - 1;
1102 			globit(xs, xpp, np, wp,
1103 				(check & GF_MARKDIR) | GF_GLOBBED
1104 				| (np ? GF_EXCHECK : GF_NONE));
1105 			xp = Xstring(*xs, xp) + prefix_len;
1106 		}
1107 		closedir(dirp);
1108 	  Nodir:;
1109 	}
1110 
1111 	if (np != NULL)
1112 		*--np = odirsep;
1113 }
1114 
1115 /* remove MAGIC from string */
1116 char *
1117 debunk(char *dp, const char *sp, size_t dlen)
1118 {
1119 	char *d, *s;
1120 
1121 	if ((s = strchr(sp, MAGIC))) {
1122 		size_t slen = s - sp;
1123 		if (slen >= dlen)
1124 			return dp;
1125 		memcpy(dp, sp, slen);
1126 		for (d = dp + slen; *s && (d < dp + dlen); s++)
1127 			if (!ISMAGIC(*s) || !(*++s & 0x80) ||
1128 			    !strchr("*+?@! ", *s & 0x7f))
1129 				*d++ = *s;
1130 			else {
1131 				/* extended pattern operators: *+?@! */
1132 				if ((*s & 0x7f) != ' ')
1133 					*d++ = *s & 0x7f;
1134 				if (d < dp + dlen)
1135 					*d++ = '(';
1136 			}
1137 		*d = '\0';
1138 	} else if (dp != sp)
1139 		strlcpy(dp, sp, dlen);
1140 	return dp;
1141 }
1142 
1143 /* Check if p is an unquoted name, possibly followed by a / or :.  If so
1144  * puts the expanded version in *dcp,dp and returns a pointer in p just
1145  * past the name, otherwise returns 0.
1146  */
1147 static char *
1148 maybe_expand_tilde(char *p, XString *dsp, char **dpp, int isassign)
1149 {
1150 	XString ts;
1151 	char *dp = *dpp;
1152 	char *tp, *r;
1153 
1154 	Xinit(ts, tp, 16, ATEMP);
1155 	/* : only for DOASNTILDE form */
1156 	while (p[0] == CHAR && p[1] != '/' && (!isassign || p[1] != ':'))
1157 	{
1158 		Xcheck(ts, tp);
1159 		*tp++ = p[1];
1160 		p += 2;
1161 	}
1162 	*tp = '\0';
1163 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ?
1164 	    tilde(Xstring(ts, tp)) : NULL;
1165 	Xfree(ts, tp);
1166 	if (r) {
1167 		while (*r) {
1168 			Xcheck(*dsp, dp);
1169 			if (ISMAGIC(*r))
1170 				*dp++ = MAGIC;
1171 			*dp++ = *r++;
1172 		}
1173 		*dpp = dp;
1174 		r = p;
1175 	}
1176 	return r;
1177 }
1178 
1179 /*
1180  * tilde expansion
1181  *
1182  * based on a version by Arnold Robbins
1183  */
1184 
1185 static char *
1186 tilde(char *cp)
1187 {
1188 	char *dp;
1189 
1190 	if (cp[0] == '\0')
1191 		dp = str_val(global("HOME"));
1192 	else if (cp[0] == '+' && cp[1] == '\0')
1193 		dp = str_val(global("PWD"));
1194 	else if (cp[0] == '-' && cp[1] == '\0')
1195 		dp = str_val(global("OLDPWD"));
1196 	else
1197 		dp = homedir(cp);
1198 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
1199 	if (dp == null)
1200 		dp = NULL;
1201 	return dp;
1202 }
1203 
1204 /*
1205  * map userid to user's home directory.
1206  * note that 4.3's getpw adds more than 6K to the shell,
1207  * and the YP version probably adds much more.
1208  * we might consider our own version of getpwnam() to keep the size down.
1209  */
1210 
1211 static char *
1212 homedir(char *name)
1213 {
1214 	struct tbl *ap;
1215 
1216 	ap = ktenter(&homedirs, name, hash(name));
1217 	if (!(ap->flag & ISSET)) {
1218 		struct passwd *pw;
1219 
1220 		pw = getpwnam(name);
1221 		if (pw == NULL)
1222 			return NULL;
1223 		ap->val.s = str_save(pw->pw_dir, APERM);
1224 		ap->flag |= DEFINED|ISSET|ALLOC;
1225 	}
1226 	return ap->val.s;
1227 }
1228 
1229 static void
1230 alt_expand(XPtrV *wp, char *start, char *exp_start, char *end, int fdo)
1231 {
1232 	int count = 0;
1233 	char *brace_start, *brace_end, *comma = NULL;
1234 	char *field_start;
1235 	char *p;
1236 
1237 	/* search for open brace */
1238 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != OBRACE; p += 2)
1239 		;
1240 	brace_start = p;
1241 
1242 	/* find matching close brace, if any */
1243 	if (p) {
1244 		comma = NULL;
1245 		count = 1;
1246 		for (p += 2; *p && count; p++) {
1247 			if (ISMAGIC(*p)) {
1248 				if (*++p == OBRACE)
1249 					count++;
1250 				else if (*p == CBRACE)
1251 					--count;
1252 				else if (*p == ',' && count == 1)
1253 					comma = p;
1254 			}
1255 		}
1256 	}
1257 	/* no valid expansions... */
1258 	if (!p || count != 0) {
1259 		/* Note that given a{{b,c} we do not expand anything (this is
1260 		 * what at&t ksh does.  This may be changed to do the {b,c}
1261 		 * expansion. }
1262 		 */
1263 		if (fdo & DOGLOB)
1264 			glob(start, wp, fdo & DOMARKDIRS);
1265 		else
1266 			XPput(*wp, debunk(start, start, end - start));
1267 		return;
1268 	}
1269 	brace_end = p;
1270 	if (!comma) {
1271 		alt_expand(wp, start, brace_end, end, fdo);
1272 		return;
1273 	}
1274 
1275 	/* expand expression */
1276 	field_start = brace_start + 2;
1277 	count = 1;
1278 	for (p = brace_start + 2; p != brace_end; p++) {
1279 		if (ISMAGIC(*p)) {
1280 			if (*++p == OBRACE)
1281 				count++;
1282 			else if ((*p == CBRACE && --count == 0) ||
1283 			    (*p == ',' && count == 1)) {
1284 				char *new;
1285 				int l1, l2, l3;
1286 
1287 				l1 = brace_start - start;
1288 				l2 = (p - 1) - field_start;
1289 				l3 = end - brace_end;
1290 				new = alloc(l1 + l2 + l3 + 1, ATEMP);
1291 				memcpy(new, start, l1);
1292 				memcpy(new + l1, field_start, l2);
1293 				memcpy(new + l1 + l2, brace_end, l3);
1294 				new[l1 + l2 + l3] = '\0';
1295 				alt_expand(wp, new, new + l1,
1296 				    new + l1 + l2 + l3, fdo);
1297 				field_start = p + 1;
1298 			}
1299 		}
1300 	}
1301 	return;
1302 }
1303 
1304 /*
1305  * Copy the given variable if it's flagged as read-only.
1306  * Such variables have static storage and only one can therefore be referenced
1307  * at a time.
1308  * This is necessary in order to allow variable expansion expressions to refer
1309  * to multiple read-only variables.
1310  */
1311 static struct tbl *
1312 varcpy(struct tbl *vp)
1313 {
1314 	struct tbl *cpy;
1315 
1316 	if (vp == NULL || (vp->flag & RDONLY) == 0)
1317 		return vp;
1318 
1319 	cpy = alloc(sizeof(struct tbl), ATEMP);
1320 	memcpy(cpy, vp, sizeof(struct tbl));
1321 	return cpy;
1322 }
1323