src/eval.c

   1 /*      $OpenBSD: eval.c,v 1.40 2013/09/14 20:09:30 millert Exp $       */
   2
   3 /*-
   4  * Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
   5  *               2011, 2012, 2013, 2014, 2015
   6  *      Thorsten Glaser <tg@mirbsd.org>
   7  *
   8  * Provided that these terms and disclaimer and all copyright notices
   9  * are retained or reproduced in an accompanying document, permission
  10  * is granted to deal in this work without restriction, including un-
  11  * limited rights to use, publicly perform, distribute, sell, modify,
  12  * merge, give away, or sublicence.
  13  *
  14  * This work is provided "AS IS" and WITHOUT WARRANTY of any kind, to
  15  * the utmost extent permitted by applicable law, neither express nor
  16  * implied; without malicious intent or gross negligence. In no event
  17  * may a licensor, author or contributor be held liable for indirect,
  18  * direct, other damage, loss, or other issues arising in any way out
  19  * of dealing in the work, even if advised of the possibility of such
  20  * damage or existence of a defect, except proven that it results out
  21  * of said person's immediate fault when using the work as intended.
  22  */
  23
  24 #include "sh.h"
  25
  26 __RCSID("$MirOS: src/bin/mksh/eval.c,v 1.170 2015/07/06 17:45:33 tg Exp $");
  27
  28 /*
  29  * string expansion
  30  *
  31  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
  32  * second pass: alternation ({,}), filename expansion (*?[]).
  33  */
  34
  35 /* expansion generator state */
  36 typedef struct {
  37         /* not including an "int type;" member, see expand() */
  38         /* string */
  39         const char *str;
  40         /* source */
  41         union {
  42                 /* string[] */
  43                 const char **strv;
  44                 /* file */
  45                 struct shf *shf;
  46         } u;
  47         /* variable in ${var...} */
  48         struct tbl *var;
  49         /* split "$@" / call waitlast in $() */
  50         bool split;
  51 } Expand;
  52
  53 #define XBASE           0       /* scanning original */
  54 #define XSUB            1       /* expanding ${} string */
  55 #define XARGSEP         2       /* ifs0 between "$*" */
  56 #define XARG            3       /* expanding $*, $@ */
  57 #define XCOM            4       /* expanding $() */
  58 #define XNULLSUB        5       /* "$@" when $# is 0 (don't generate word) */
  59 #define XSUBMID         6       /* middle of expanding ${} */
  60
  61 /* States used for field splitting */
  62 #define IFS_WORD        0       /* word has chars (or quotes except "$@") */
  63 #define IFS_WS          1       /* have seen IFS white-space */
  64 #define IFS_NWS         2       /* have seen IFS non-white-space */
  65 #define IFS_IWS         3       /* begin of word, ignore IFS WS */
  66 #define IFS_QUOTE       4       /* beg.w/quote, become IFS_WORD unless "$@" */
  67
  68 static int varsub(Expand *, const char *, const char *, int *, int *);
  69 static int comsub(Expand *, const char *, int);
  70 static char *valsub(struct op *, Area *);
  71 static char *trimsub(char *, char *, int);
  72 static void glob(char *, XPtrV *, bool);
  73 static void globit(XString *, char **, char *, XPtrV *, int);
  74 static const char *maybe_expand_tilde(const char *, XString *, char **, bool);
  75 #ifndef MKSH_NOPWNAM
  76 static char *homedir(char *);
  77 #endif
  78 static void alt_expand(XPtrV *, char *, char *, char *, int);
  79 static int utflen(const char *) MKSH_A_PURE;
  80 static void utfincptr(const char *, mksh_ari_t *);
  81
  82 /* UTFMODE functions */
  83 static int
  84 utflen(const char *s)
  85 {
  86         size_t n;
  87
  88         if (UTFMODE) {
  89                 n = 0;
  90                 while (*s) {
  91                         s += utf_ptradj(s);
  92                         ++n;
  93                 }
  94         } else
  95                 n = strlen(s);
  96
  97         if (n > 2147483647)
  98                 n = 2147483647;
  99         return ((int)n);
 100 }
 101
 102 static void
 103 utfincptr(const char *s, mksh_ari_t *lp)
 104 {
 105         const char *cp = s;
 106
 107         while ((*lp)--)
 108                 cp += utf_ptradj(cp);
 109         *lp = cp - s;
 110 }
 111
 112 /* compile and expand word */
 113 char *
 114 substitute(const char *cp, int f)
 115 {
 116         struct source *s, *sold;
 117
 118         sold = source;
 119         s = pushs(SWSTR, ATEMP);
 120         s->start = s->str = cp;
 121         source = s;
 122         if (yylex(ONEWORD) != LWORD)
 123                 internal_errorf("bad substitution");
 124         source = sold;
 125         afree(s, ATEMP);
 126         return (evalstr(yylval.cp, f));
 127 }
 128
 129 /*
 130  * expand arg-list
 131  */
 132 char **
 133 eval(const char **ap, int f)
 134 {
 135         XPtrV w;
 136
 137         if (*ap == NULL) {
 138                 union mksh_ccphack vap;
 139
 140                 vap.ro = ap;
 141                 return (vap.rw);
 142         }
 143         XPinit(w, 32);
 144         /* space for shell name */
 145         XPput(w, NULL);
 146         while (*ap != NULL)
 147                 expand(*ap++, &w, f);
 148         XPput(w, NULL);
 149         return ((char **)XPclose(w) + 1);
 150 }
 151
 152 /*
 153  * expand string
 154  */
 155 char *
 156 evalstr(const char *cp, int f)
 157 {
 158         XPtrV w;
 159         char *dp = null;
 160
 161         XPinit(w, 1);
 162         expand(cp, &w, f);
 163         if (XPsize(w))
 164                 dp = *XPptrv(w);
 165         XPfree(w);
 166         return (dp);
 167 }
 168
 169 /*
 170  * expand string - return only one component
 171  * used from iosetup to expand redirection files
 172  */
 173 char *
 174 evalonestr(const char *cp, int f)
 175 {
 176         XPtrV w;
 177         char *rv;
 178
 179         XPinit(w, 1);
 180         expand(cp, &w, f);
 181         switch (XPsize(w)) {
 182         case 0:
 183                 rv = null;
 184                 break;
 185         case 1:
 186                 rv = (char *) *XPptrv(w);
 187                 break;
 188         default:
 189                 rv = evalstr(cp, f&~DOGLOB);
 190                 break;
 191         }
 192         XPfree(w);
 193         return (rv);
 194 }
 195
 196 /* for nested substitution: ${var:=$var2} */
 197 typedef struct SubType {
 198         struct tbl *var;        /* variable for ${var..} */
 199         struct SubType *prev;   /* old type */
 200         struct SubType *next;   /* poped type (to avoid re-allocating) */
 201         size_t  base;           /* begin position of expanded word */
 202         short   stype;          /* [=+-?%#] action after expanded word */
 203         short   f;              /* saved value of f (DOPAT, etc) */
 204         uint8_t quotep;         /* saved value of quote (for ${..[%#]..}) */
 205         uint8_t quotew;         /* saved value of quote (for ${..[+-=]..}) */
 206 } SubType;
 207
 208 void
 209 expand(
 210     /* input word */
 211     const char *ccp,
 212     /* output words */
 213     XPtrV *wp,
 214     /* DO* flags */
 215     int f)
 216 {
 217         int c = 0;
 218         /* expansion type */
 219         int type;
 220         /* quoted */
 221         int quote = 0;
 222         /* destination string and live pointer */
 223         XString ds;
 224         char *dp;
 225         /* source */
 226         const char *sp;
 227         /* second pass flags */
 228         int fdo;
 229         /* have word */
 230         int word;
 231         /* field splitting of parameter/command substitution */
 232         int doblank;
 233         /* expansion variables */
 234         Expand x = {
 235                 NULL, { NULL }, NULL, 0
 236         };
 237         SubType st_head, *st;
 238         /* record number of trailing newlines in COMSUB */
 239         int newlines = 0;
 240         bool saw_eq, make_magic;
 241         unsigned int tilde_ok;
 242         size_t len;
 243         char *cp;
 244
 245         if (ccp == NULL)
 246                 internal_errorf("expand(NULL)");
 247         /* for alias, readonly, set, typeset commands */
 248         if ((f & DOVACHECK) && is_wdvarassign(ccp)) {
 249                 f &= ~(DOVACHECK | DOBLANK | DOGLOB | DOTILDE);
 250                 f |= DOASNTILDE | DOSCALAR;
 251         }
 252         if (Flag(FNOGLOB))
 253                 f &= ~DOGLOB;
 254         if (Flag(FMARKDIRS))
 255                 f |= DOMARKDIRS;
 256         if (Flag(FBRACEEXPAND) && (f & DOGLOB))
 257                 f |= DOBRACE;
 258
 259         /* init destination string */
 260         Xinit(ds, dp, 128, ATEMP);
 261         type = XBASE;
 262         sp = ccp;
 263         fdo = 0;
 264         saw_eq = false;
 265         /* must be 1/0 */
 266         tilde_ok = (f & (DOTILDE | DOASNTILDE)) ? 1 : 0;
 267         doblank = 0;
 268         make_magic = false;
 269         word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
 270         /* clang doesn't know OSUBST comes before CSUBST */
 271         memset(&st_head, 0, sizeof(st_head));
 272         st = &st_head;
 273
 274         while (/* CONSTCOND */ 1) {
 275                 Xcheck(ds, dp);
 276
 277                 switch (type) {
 278                 case XBASE:
 279                         /* original prefixed string */
 280                         c = *sp++;
 281                         switch (c) {
 282                         case EOS:
 283                                 c = 0;
 284                                 break;
 285                         case CHAR:
 286                                 c = *sp++;
 287                                 break;
 288                         case QCHAR:
 289                                 /* temporary quote */
 290                                 quote |= 2;
 291                                 c = *sp++;
 292                                 break;
 293                         case OQUOTE:
 294                                 if (word != IFS_WORD)
 295                                         word = IFS_QUOTE;
 296                                 tilde_ok = 0;
 297                                 quote = 1;
 298                                 continue;
 299                         case CQUOTE:
 300                                 if (word == IFS_QUOTE)
 301                                         word = IFS_WORD;
 302                                 quote = st->quotew;
 303                                 continue;
 304                         case COMSUB:
 305                         case FUNSUB:
 306                         case VALSUB:
 307                                 tilde_ok = 0;
 308                                 if (f & DONTRUNCOMMAND) {
 309                                         word = IFS_WORD;
 310                                         *dp++ = '$';
 311                                         *dp++ = c == COMSUB ? '(' : '{';
 312                                         if (c != COMSUB)
 313                                                 *dp++ = c == FUNSUB ? ' ' : '|';
 314                                         while (*sp != '\0') {
 315                                                 Xcheck(ds, dp);
 316                                                 *dp++ = *sp++;
 317                                         }
 318                                         if (c != COMSUB) {
 319                                                 *dp++ = ';';
 320                                                 *dp++ = '}';
 321                                         } else
 322                                                 *dp++ = ')';
 323                                 } else {
 324                                         type = comsub(&x, sp, c);
 325                                         if (type != XBASE && (f & DOBLANK))
 326                                                 doblank++;
 327                                         sp = strnul(sp) + 1;
 328                                         newlines = 0;
 329                                 }
 330                                 continue;
 331                         case EXPRSUB:
 332                                 tilde_ok = 0;
 333                                 if (f & DONTRUNCOMMAND) {
 334                                         word = IFS_WORD;
 335                                         *dp++ = '$'; *dp++ = '('; *dp++ = '(';
 336                                         while (*sp != '\0') {
 337                                                 Xcheck(ds, dp);
 338                                                 *dp++ = *sp++;
 339                                         }
 340                                         *dp++ = ')'; *dp++ = ')';
 341                                 } else {
 342                                         struct tbl v;
 343
 344                                         v.flag = DEFINED|ISSET|INTEGER;
 345                                         /* not default */
 346                                         v.type = 10;
 347                                         v.name[0] = '\0';
 348                                         v_evaluate(&v, substitute(sp, 0),
 349                                             KSH_UNWIND_ERROR, true);
 350                                         sp = strnul(sp) + 1;
 351                                         x.str = str_val(&v);
 352                                         type = XSUB;
 353                                         if (f & DOBLANK)
 354                                                 doblank++;
 355                                 }
 356                                 continue;
 357                         case OSUBST: {
 358                                 /* ${{#}var{:}[=+-?#%]word} */
 359                         /*-
 360                          * format is:
 361                          *      OSUBST [{x] plain-variable-part \0
 362                          *          compiled-word-part CSUBST [}x]
 363                          * This is where all syntax checking gets done...
 364                          */
 365                                 /* skip the { or x (}) */
 366                                 const char *varname = ++sp;
 367                                 int stype;
 368                                 int slen = 0;
 369
 370                                 /* skip variable */
 371                                 sp = cstrchr(sp, '\0') + 1;
 372                                 type = varsub(&x, varname, sp, &stype, &slen);
 373                                 if (type < 0) {
 374                                         char *beg, *end, *str;
 375  unwind_substsyn:
 376                                         /* restore sp */
 377                                         sp = varname - 2;
 378                                         end = (beg = wdcopy(sp, ATEMP)) +
 379                                             (wdscan(sp, CSUBST) - sp);
 380                                         /* ({) the } or x is already skipped */
 381                                         if (end < wdscan(beg, EOS))
 382                                                 *end = EOS;
 383                                         str = snptreef(NULL, 64, "%S", beg);
 384                                         afree(beg, ATEMP);
 385                                         errorf("%s: %s", str, "bad substitution");
 386                                 }
 387                                 if (f & DOBLANK)
 388                                         doblank++;
 389                                 tilde_ok = 0;
 390                                 if (word == IFS_QUOTE && type != XNULLSUB)
 391                                         word = IFS_WORD;
 392                                 if (type == XBASE) {
 393                                         /* expand? */
 394                                         if (!st->next) {
 395                                                 SubType *newst;
 396
 397                                                 newst = alloc(sizeof(SubType), ATEMP);
 398                                                 newst->next = NULL;
 399                                                 newst->prev = st;
 400                                                 st->next = newst;
 401                                         }
 402                                         st = st->next;
 403                                         st->stype = stype;
 404                                         st->base = Xsavepos(ds, dp);
 405                                         st->f = f;
 406                                         if (x.var == &vtemp) {
 407                                                 st->var = tempvar();
 408                                                 st->var->flag &= ~INTEGER;
 409                                                 /* can't fail here */
 410                                                 setstr(st->var,
 411                                                     str_val(x.var),
 412                                                     KSH_RETURN_ERROR | 0x4);
 413                                         } else
 414                                                 st->var = x.var;
 415
 416                                         st->quotew = st->quotep = quote;
 417                                         /* skip qualifier(s) */
 418                                         if (stype)
 419                                                 sp += slen;
 420                                         switch (stype & 0x17F) {
 421                                         case 0x100 | '#':
 422                                                 x.str = shf_smprintf("%08X",
 423                                                     (unsigned int)hash(str_val(st->var)));
 424                                                 break;
 425                                         case 0x100 | 'Q': {
 426                                                 struct shf shf;
 427
 428                                                 shf_sopen(NULL, 0, SHF_WR|SHF_DYNAMIC, &shf);
 429                                                 print_value_quoted(&shf, str_val(st->var));
 430                                                 x.str = shf_sclose(&shf);
 431                                                 break;
 432                                             }
 433                                         case '0': {
 434                                                 char *beg, *mid, *end, *stg;
 435                                                 mksh_ari_t from = 0, num = -1, flen, finc = 0;
 436
 437                                                 beg = wdcopy(sp, ATEMP);
 438                                                 mid = beg + (wdscan(sp, ADELIM) - sp);
 439                                                 stg = beg + (wdscan(sp, CSUBST) - sp);
 440                                                 if (mid >= stg)
 441                                                         goto unwind_substsyn;
 442                                                 mid[-2] = EOS;
 443                                                 if (mid[-1] == /*{*/'}') {
 444                                                         sp += mid - beg - 1;
 445                                                         end = NULL;
 446                                                 } else {
 447                                                         end = mid +
 448                                                             (wdscan(mid, ADELIM) - mid);
 449                                                         if (end >= stg ||
 450                                                             /* more than max delimiters */
 451                                                             end[-1] != /*{*/ '}')
 452                                                                 goto unwind_substsyn;
 453                                                         end[-2] = EOS;
 454                                                         sp += end - beg - 1;
 455                                                 }
 456                                                 evaluate(substitute(stg = wdstrip(beg, 0), 0),
 457                                                     &from, KSH_UNWIND_ERROR, true);
 458                                                 afree(stg, ATEMP);
 459                                                 if (end) {
 460                                                         evaluate(substitute(stg = wdstrip(mid, 0), 0),
 461                                                             &num, KSH_UNWIND_ERROR, true);
 462                                                         afree(stg, ATEMP);
 463                                                 }
 464                                                 afree(beg, ATEMP);
 465                                                 beg = str_val(st->var);
 466                                                 flen = utflen(beg);
 467                                                 if (from < 0) {
 468                                                         if (-from < flen)
 469                                                                 finc = flen + from;
 470                                                 } else
 471                                                         finc = from < flen ? from : flen;
 472                                                 if (UTFMODE)
 473                                                         utfincptr(beg, &finc);
 474                                                 beg += finc;
 475                                                 flen = utflen(beg);
 476                                                 if (num < 0 || num > flen)
 477                                                         num = flen;
 478                                                 if (UTFMODE)
 479                                                         utfincptr(beg, &num);
 480                                                 strndupx(x.str, beg, num, ATEMP);
 481                                                 goto do_CSUBST;
 482                                             }
 483                                         case '/': {
 484                                                 char *s, *p, *d, *sbeg, *end;
 485                                                 char *pat, *rrep;
 486                                                 char *tpat0, *tpat1, *tpat2;
 487
 488                                                 s = wdcopy(sp, ATEMP);
 489                                                 p = s + (wdscan(sp, ADELIM) - sp);
 490                                                 d = s + (wdscan(sp, CSUBST) - sp);
 491                                                 if (p >= d)
 492                                                         goto unwind_substsyn;
 493                                                 p[-2] = EOS;
 494                                                 if (p[-1] == /*{*/'}')
 495                                                         d = NULL;
 496                                                 else
 497                                                         d[-2] = EOS;
 498                                                 sp += (d ? d : p) - s - 1;
 499                                                 tpat0 = wdstrip(s,
 500                                                     WDS_KEEPQ | WDS_MAGIC);
 501                                                 pat = substitute(tpat0, 0);
 502                                                 if (d) {
 503                                                         d = wdstrip(p, WDS_KEEPQ);
 504                                                         rrep = substitute(d, 0);
 505                                                         afree(d, ATEMP);
 506                                                 } else
 507                                                         rrep = null;
 508                                                 afree(s, ATEMP);
 509                                                 s = d = pat;
 510                                                 while (*s)
 511                                                         if (*s != '\\' ||
 512                                                             s[1] == '%' ||
 513                                                             s[1] == '#' ||
 514                                                             s[1] == '\0' ||
 515                                 /* XXX really? */           s[1] == '\\' ||
 516                                                             s[1] == '/')
 517                                                                 *d++ = *s++;
 518                                                         else
 519                                                                 s++;
 520                                                 *d = '\0';
 521                                                 afree(tpat0, ATEMP);
 522
 523                                                 /* check for special cases */
 524                                                 switch (*pat) {
 525                                                 case '#':
 526                                                 case '%':
 527                                                         tpat0 = pat + 1;
 528                                                         break;
 529                                                 case '\0':
 530                                                         /* empty pattern, reject */
 531                                                         goto no_repl;
 532                                                 default:
 533                                                         tpat0 = pat;
 534                                                 }
 535                                                 if (gmatchx(null, tpat0, false)) {
 536                                                         /*
 537                                                          * pattern matches empty
 538                                                          * string => don't loop
 539                                                          */
 540                                                         stype &= ~0x80;
 541                                                 }
 542
 543                                                 /* prepare string on which to work */
 544                                                 strdupx(s, str_val(st->var), ATEMP);
 545                                                 sbeg = s;
 546
 547                                                 /* first see if we have any match at all */
 548                                                 tpat0 = pat;
 549                                                 if (*pat == '#') {
 550                                                         /* anchor at the beginning */
 551                                                         tpat1 = shf_smprintf("%s%c*", ++tpat0, MAGIC);
 552                                                         tpat2 = tpat1;
 553                                                 } else if (*pat == '%') {
 554                                                         /* anchor at the end */
 555                                                         tpat1 = shf_smprintf("%c*%s", MAGIC, ++tpat0);
 556                                                         tpat2 = tpat0;
 557                                                 } else {
 558                                                         /* float */
 559                                                         tpat1 = shf_smprintf("%c*%s%c*", MAGIC, pat, MAGIC);
 560                                                         tpat2 = tpat1 + 2;
 561                                                 }
 562  again_repl:
 563                                                 /*
 564                                                  * this would not be necessary if gmatchx would return
 565                                                  * the start and end values of a match found, like re*
 566                                                  */
 567                                                 if (!gmatchx(sbeg, tpat1, false))
 568                                                         goto end_repl;
 569                                                 end = strnul(s);
 570                                                 /* now anchor the beginning of the match */
 571                                                 if (*pat != '#')
 572                                                         while (sbeg <= end) {
 573                                                                 if (gmatchx(sbeg, tpat2, false))
 574                                                                         break;
 575                                                                 else
 576                                                                         sbeg++;
 577                                                         }
 578                                                 /* now anchor the end of the match */
 579                                                 p = end;
 580                                                 if (*pat != '%')
 581                                                         while (p >= sbeg) {
 582                                                                 bool gotmatch;
 583
 584                                                                 c = *p;
 585                                                                 *p = '\0';
 586                                                                 gotmatch = tobool(gmatchx(sbeg, tpat0, false));
 587                                                                 *p = c;
 588                                                                 if (gotmatch)
 589                                                                         break;
 590                                                                 p--;
 591                                                         }
 592                                                 strndupx(end, s, sbeg - s, ATEMP);
 593                                                 d = shf_smprintf("%s%s%s", end, rrep, p);
 594                                                 afree(end, ATEMP);
 595                                                 sbeg = d + (sbeg - s) + strlen(rrep);
 596                                                 afree(s, ATEMP);
 597                                                 s = d;
 598                                                 if (stype & 0x80)
 599                                                         goto again_repl;
 600  end_repl:
 601                                                 afree(tpat1, ATEMP);
 602                                                 x.str = s;
 603  no_repl:
 604                                                 afree(pat, ATEMP);
 605                                                 if (rrep != null)
 606                                                         afree(rrep, ATEMP);
 607                                                 goto do_CSUBST;
 608                                             }
 609                                         case '#':
 610                                         case '%':
 611                                                 /* ! DOBLANK,DOBRACE,DOTILDE */
 612                                                 f = (f & DONTRUNCOMMAND) |
 613                                                     DOPAT | DOTEMP | DOSCALAR;
 614                                                 st->quotew = quote = 0;
 615                                                 /*
 616                                                  * Prepend open pattern (so |
 617                                                  * in a trim will work as
 618                                                  * expected)
 619                                                  */
 620                                                 if (!Flag(FSH)) {
 621                                                         *dp++ = MAGIC;
 622                                                         *dp++ = 0x80 | '@';
 623                                                 }
 624                                                 break;
 625                                         case '=':
 626                                                 /*
 627                                                  * Enabling tilde expansion
 628                                                  * after :s here is
 629                                                  * non-standard ksh, but is
 630                                                  * consistent with rules for
 631                                                  * other assignments. Not
 632                                                  * sure what POSIX thinks of
 633                                                  * this.
 634                                                  * Not doing tilde expansion
 635                                                  * for integer variables is a
 636                                                  * non-POSIX thing - makes
 637                                                  * sense though, since ~ is
 638                                                  * a arithmetic operator.
 639                                                  */
 640                                                 if (!(x.var->flag & INTEGER))
 641                                                         f |= DOASNTILDE | DOTILDE;
 642                                                 f |= DOTEMP;
 643                                                 /*
 644                                                  * These will be done after the
 645                                                  * value has been assigned.
 646                                                  */
 647                                                 f &= ~(DOBLANK|DOGLOB|DOBRACE);
 648                                                 tilde_ok = 1;
 649                                                 break;
 650                                         case '?':
 651                                                 f &= ~DOBLANK;
 652                                                 f |= DOTEMP;
 653                                                 /* FALLTHROUGH */
 654                                         default:
 655                                                 /* '-' '+' '?' */
 656                                                 if (quote)
 657                                                         word = IFS_WORD;
 658                                                 else if (dp == Xstring(ds, dp))
 659                                                         word = IFS_IWS;
 660                                                 /* Enable tilde expansion */
 661                                                 tilde_ok = 1;
 662                                                 f |= DOTILDE;
 663                                         }
 664                                 } else
 665                                         /* skip word */
 666                                         sp += wdscan(sp, CSUBST) - sp;
 667                                 continue;
 668                             }
 669                         case CSUBST:
 670                                 /* only get here if expanding word */
 671  do_CSUBST:
 672                                 /* ({) skip the } or x */
 673                                 sp++;
 674                                 /* in case of ${unset:-} */
 675                                 tilde_ok = 0;
 676                                 *dp = '\0';
 677                                 quote = st->quotep;
 678                                 f = st->f;
 679                                 if (f & DOBLANK)
 680                                         doblank--;
 681                                 switch (st->stype & 0x17F) {
 682                                 case '#':
 683                                 case '%':
 684                                         if (!Flag(FSH)) {
 685                                                 /* Append end-pattern */
 686                                                 *dp++ = MAGIC;
 687                                                 *dp++ = ')';
 688                                         }
 689                                         *dp = '\0';
 690                                         dp = Xrestpos(ds, dp, st->base);
 691                                         /*
 692                                          * Must use st->var since calling
 693                                          * global would break things
 694                                          * like x[i+=1].
 695                                          */
 696                                         x.str = trimsub(str_val(st->var),
 697                                                 dp, st->stype);
 698                                         if (x.str[0] != '\0') {
 699                                                 word = IFS_IWS;
 700                                                 type = XSUB;
 701                                         } else if (quote) {
 702                                                 word = IFS_WORD;
 703                                                 type = XSUB;
 704                                         } else {
 705                                                 if (dp == Xstring(ds, dp))
 706                                                         word = IFS_IWS;
 707                                                 type = XNULLSUB;
 708                                         }
 709                                         if (f & DOBLANK)
 710                                                 doblank++;
 711                                         st = st->prev;
 712                                         continue;
 713                                 case '=':
 714                                         /*
 715                                          * Restore our position and substitute
 716                                          * the value of st->var (may not be
 717                                          * the assigned value in the presence
 718                                          * of integer/right-adj/etc attributes).
 719                                          */
 720                                         dp = Xrestpos(ds, dp, st->base);
 721                                         /*
 722                                          * Must use st->var since calling
 723                                          * global would cause with things
 724                                          * like x[i+=1] to be evaluated twice.
 725                                          */
 726                                         /*
 727                                          * Note: not exported by FEXPORT
 728                                          * in AT&T ksh.
 729                                          */
 730                                         /*
 731                                          * XXX POSIX says readonly is only
 732                                          * fatal for special builtins (setstr
 733                                          * does readonly check).
 734                                          */
 735                                         len = strlen(dp) + 1;
 736                                         setstr(st->var,
 737                                             debunk(alloc(len, ATEMP),
 738                                             dp, len), KSH_UNWIND_ERROR);
 739                                         x.str = str_val(st->var);
 740                                         type = XSUB;
 741                                         if (f & DOBLANK)
 742                                                 doblank++;
 743                                         st = st->prev;
 744                                         word = quote || (!*x.str && (f & DOSCALAR)) ? IFS_WORD : IFS_IWS;
 745                                         continue;
 746                                 case '?': {
 747                                         char *s = Xrestpos(ds, dp, st->base);
 748
 749                                         errorf("%s: %s", st->var->name,
 750                                             dp == s ?
 751                                             "parameter null or not set" :
 752                                             (debunk(s, s, strlen(s) + 1), s));
 753                                     }
 754                                 case '0':
 755                                 case '/':
 756                                 case 0x100 | '#':
 757                                 case 0x100 | 'Q':
 758                                         dp = Xrestpos(ds, dp, st->base);
 759                                         type = XSUB;
 760                                         word = quote || (!*x.str && (f & DOSCALAR)) ? IFS_WORD : IFS_IWS;
 761                                         if (f & DOBLANK)
 762                                                 doblank++;
 763                                         st = st->prev;
 764                                         continue;
 765                                 /* default: '-' '+' */
 766                                 }
 767                                 st = st->prev;
 768                                 type = XBASE;
 769                                 continue;
 770
 771                         case OPAT:
 772                                 /* open pattern: *(foo|bar) */
 773                                 /* Next char is the type of pattern */
 774                                 make_magic = true;
 775                                 c = *sp++ | 0x80;
 776                                 break;
 777
 778                         case SPAT:
 779                                 /* pattern separator (|) */
 780                                 make_magic = true;
 781                                 c = '|';
 782                                 break;
 783
 784                         case CPAT:
 785                                 /* close pattern */
 786                                 make_magic = true;
 787                                 c = /*(*/ ')';
 788                                 break;
 789                         }
 790                         break;
 791
 792                 case XNULLSUB:
 793                         /*
 794                          * Special case for "$@" (and "${foo[@]}") - no
 795                          * word is generated if $# is 0 (unless there is
 796                          * other stuff inside the quotes).
 797                          */
 798                         type = XBASE;
 799                         if (f & DOBLANK) {
 800                                 doblank--;
 801                                 if (dp == Xstring(ds, dp) && word != IFS_WORD)
 802                                         word = IFS_IWS;
 803                         }
 804                         continue;
 805
 806                 case XSUB:
 807                 case XSUBMID:
 808                         if ((c = *x.str++) == 0) {
 809                                 type = XBASE;
 810                                 if (f & DOBLANK)
 811                                         doblank--;
 812                                 continue;
 813                         }
 814                         break;
 815
 816                 case XARGSEP:
 817                         type = XARG;
 818                         quote = 1;
 819                         /* FALLTHROUGH */
 820                 case XARG:
 821                         if ((c = *x.str++) == '\0') {
 822                                 /*
 823                                  * force null words to be created so
 824                                  * set -- "" 2 ""; echo "$@" will do
 825                                  * the right thing
 826                                  */
 827                                 if (quote && x.split)
 828                                         word = IFS_WORD;
 829                                 if ((x.str = *x.u.strv++) == NULL) {
 830                                         type = XBASE;
 831                                         if (f & DOBLANK)
 832                                                 doblank--;
 833                                         continue;
 834                                 }
 835                                 c = ifs0;
 836                                 if ((f & DOHEREDOC)) {
 837                                         /* pseudo-field-split reliably */
 838                                         if (c == 0)
 839                                                 c = ' ';
 840                                         break;
 841                                 }
 842                                 if ((f & DOSCALAR)) {
 843                                         /* do not field-split */
 844                                         if (x.split) {
 845                                                 c = ' ';
 846                                                 break;
 847                                         }
 848                                         if (c == 0)
 849                                                 continue;
 850                                 }
 851                                 if (c == 0) {
 852                                         if (quote && !x.split)
 853                                                 continue;
 854                                         if (!quote && word == IFS_WS)
 855                                                 continue;
 856                                         /* this is so we don't terminate */
 857                                         c = ' ';
 858                                         /* now force-emit a word */
 859                                         goto emit_word;
 860                                 }
 861                                 if (quote && x.split) {
 862                                         /* terminate word for "$@" */
 863                                         type = XARGSEP;
 864                                         quote = 0;
 865                                 }
 866                         }
 867                         break;
 868
 869                 case XCOM:
 870                         if (x.u.shf == NULL) {
 871                                 /* $(<...) failed */
 872                                 subst_exstat = 1;
 873                                 /* fake EOF */
 874                                 c = -1;
 875                         } else if (newlines) {
 876                                 /* spit out saved NLs */
 877                                 c = '\n';
 878                                 --newlines;
 879                         } else {
 880                                 while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
 881                                         if (c == '\n')
 882                                                 /* save newlines */
 883                                                 newlines++;
 884                                 if (newlines && c != -1) {
 885                                         shf_ungetc(c, x.u.shf);
 886                                         c = '\n';
 887                                         --newlines;
 888                                 }
 889                         }
 890                         if (c == -1) {
 891                                 newlines = 0;
 892                                 if (x.u.shf)
 893                                         shf_close(x.u.shf);
 894                                 if (x.split)
 895                                         subst_exstat = waitlast();
 896                                 type = XBASE;
 897                                 if (f & DOBLANK)
 898                                         doblank--;
 899                                 continue;
 900                         }
 901                         break;
 902                 }
 903
 904                 /* check for end of word or IFS separation */
 905                 if (c == 0 || (!quote && (f & DOBLANK) && doblank &&
 906                     !make_magic && ctype(c, C_IFS))) {
 907                         /*-
 908                          * How words are broken up:
 909                          *                      |       value of c
 910                          *      word            |       ws      nws     0
 911                          *      -----------------------------------
 912                          *      IFS_WORD                w/WS    w/NWS   w
 913                          *      IFS_WS                  -/WS    -/NWS   -
 914                          *      IFS_NWS                 -/NWS   w/NWS   -
 915                          *      IFS_IWS                 -/WS    w/NWS   -
 916                          * (w means generate a word)
 917                          */
 918                         if ((word == IFS_WORD) || (word == IFS_QUOTE) || (c &&
 919                             (word == IFS_IWS || word == IFS_NWS) &&
 920                             !ctype(c, C_IFSWS))) {
 921  emit_word:
 922                                 *dp++ = '\0';
 923                                 cp = Xclose(ds, dp);
 924                                 if (fdo & DOBRACE)
 925                                         /* also does globbing */
 926                                         alt_expand(wp, cp, cp,
 927                                             cp + Xlength(ds, (dp - 1)),
 928                                             fdo | (f & DOMARKDIRS));
 929                                 else if (fdo & DOGLOB)
 930                                         glob(cp, wp, tobool(f & DOMARKDIRS));
 931                                 else if ((f & DOPAT) || !(fdo & DOMAGIC))
 932                                         XPput(*wp, cp);
 933                                 else
 934                                         XPput(*wp, debunk(cp, cp,
 935                                             strlen(cp) + 1));
 936                                 fdo = 0;
 937                                 saw_eq = false;
 938                                 /* must be 1/0 */
 939                                 tilde_ok = (f & (DOTILDE | DOASNTILDE)) ? 1 : 0;
 940                                 if (c == 0)
 941                                         return;
 942                                 Xinit(ds, dp, 128, ATEMP);
 943                         } else if (c == 0) {
 944                                 return;
 945                         } else if (type == XSUB && ctype(c, C_IFS) &&
 946                             !ctype(c, C_IFSWS) && Xlength(ds, dp) == 0) {
 947                                 *(cp = alloc(1, ATEMP)) = '\0';
 948                                 XPput(*wp, cp);
 949                                 type = XSUBMID;
 950                         }
 951                         if (word != IFS_NWS)
 952                                 word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
 953                 } else {
 954                         if (type == XSUB) {
 955                                 if (word == IFS_NWS &&
 956                                     Xlength(ds, dp) == 0) {
 957                                         *(cp = alloc(1, ATEMP)) = '\0';
 958                                         XPput(*wp, cp);
 959                                 }
 960                                 type = XSUBMID;
 961                         }
 962
 963                         /* age tilde_ok info - ~ code tests second bit */
 964                         tilde_ok <<= 1;
 965                         /* mark any special second pass chars */
 966                         if (!quote)
 967                                 switch (c) {
 968                                 case '[':
 969                                 case '!':
 970                                 case '-':
 971                                 case ']':
 972                                         /*
 973                                          * For character classes - doesn't hurt
 974                                          * to have magic !,-,]s outside of
 975                                          * [...] expressions.
 976                                          */
 977                                         if (f & (DOPAT | DOGLOB)) {
 978                                                 fdo |= DOMAGIC;
 979                                                 if (c == '[')
 980                                                         fdo |= f & DOGLOB;
 981                                                 *dp++ = MAGIC;
 982                                         }
 983                                         break;
 984                                 case '*':
 985                                 case '?':
 986                                         if (f & (DOPAT | DOGLOB)) {
 987                                                 fdo |= DOMAGIC | (f & DOGLOB);
 988                                                 *dp++ = MAGIC;
 989                                         }
 990                                         break;
 991                                 case '{':
 992                                 case '}':
 993                                 case ',':
 994                                         if ((f & DOBRACE) && (c == '{' /*}*/ ||
 995                                             (fdo & DOBRACE))) {
 996                                                 fdo |= DOBRACE|DOMAGIC;
 997                                                 *dp++ = MAGIC;
 998                                         }
 999                                         break;
1000                                 case '=':
1001                                         /* Note first unquoted = for ~ */
1002                                         if (!(f & DOTEMP) && !saw_eq &&
1003                                             (Flag(FBRACEEXPAND) ||
1004                                             (f & DOASNTILDE))) {
1005                                                 saw_eq = true;
1006                                                 tilde_ok = 1;
1007                                         }
1008                                         break;
1009                                 case ':':
1010                                         /* : */
1011                                         /* Note unquoted : for ~ */
1012                                         if (!(f & DOTEMP) && (f & DOASNTILDE))
1013                                                 tilde_ok = 1;
1014                                         break;
1015                                 case '~':
1016                                         /*
1017                                          * tilde_ok is reset whenever
1018                                          * any of ' " $( $(( ${ } are seen.
1019                                          * Note that tilde_ok must be preserved
1020                                          * through the sequence ${A=a=}~
1021                                          */
1022                                         if (type == XBASE &&
1023                                             (f & (DOTILDE | DOASNTILDE)) &&
1024                                             (tilde_ok & 2)) {
1025                                                 const char *tcp;
1026                                                 char *tdp = dp;
1027
1028                                                 tcp = maybe_expand_tilde(sp,
1029                                                     &ds, &tdp,
1030                                                     tobool(f & DOASNTILDE));
1031                                                 if (tcp) {
1032                                                         if (dp != tdp)
1033                                                                 word = IFS_WORD;
1034                                                         dp = tdp;
1035                                                         sp = tcp;
1036                                                         continue;
1037                                                 }
1038                                         }
1039                                         break;
1040                                 }
1041                         else
1042                                 /* undo temporary */
1043                                 quote &= ~2;
1044
1045                         if (make_magic) {
1046                                 make_magic = false;
1047                                 fdo |= DOMAGIC | (f & DOGLOB);
1048                                 *dp++ = MAGIC;
1049                         } else if (ISMAGIC(c)) {
1050                                 fdo |= DOMAGIC;
1051                                 *dp++ = MAGIC;
1052                         }
1053                         /* save output char */
1054                         *dp++ = c;
1055                         word = IFS_WORD;
1056                 }
1057         }
1058 }
1059
1060 /*
1061  * Prepare to generate the string returned by ${} substitution.
1062  */
1063 static int
1064 varsub(Expand *xp, const char *sp, const char *word,
1065     int *stypep,        /* becomes qualifier type */
1066     int *slenp)         /* " " len (=, :=, etc.) valid iff *stypep != 0 */
1067 {
1068         int c;
1069         int state;      /* next state: XBASE, XARG, XSUB, XNULLSUB */
1070         int stype;      /* substitution type */
1071         int slen;
1072         const char *p;
1073         struct tbl *vp;
1074         bool zero_ok = false;
1075
1076         if ((stype = sp[0]) == '\0')
1077                 /* Bad variable name */
1078                 return (-1);
1079
1080         xp->var = NULL;
1081
1082         /*-
1083          * ${#var}, string length (-U: characters, +U: octets) or array size
1084          * ${%var}, string width (-U: screen columns, +U: octets)
1085          */
1086         c = sp[1];
1087         if (stype == '%' && c == '\0')
1088                 return (-1);
1089         if ((stype == '#' || stype == '%') && c != '\0') {
1090                 /* Can't have any modifiers for ${#...} or ${%...} */
1091                 if (*word != CSUBST)
1092                         return (-1);
1093                 sp++;
1094                 /* Check for size of array */
1095                 if ((p = cstrchr(sp, '[')) && (p[1] == '*' || p[1] == '@') &&
1096                     p[2] == ']') {
1097                         int n = 0;
1098
1099                         if (stype != '#')
1100                                 return (-1);
1101                         vp = global(arrayname(sp));
1102                         if (vp->flag & (ISSET|ARRAY))
1103                                 zero_ok = true;
1104                         for (; vp; vp = vp->u.array)
1105                                 if (vp->flag & ISSET)
1106                                         n++;
1107                         c = n;
1108                 } else if (c == '*' || c == '@') {
1109                         if (stype != '#')
1110                                 return (-1);
1111                         c = e->loc->argc;
1112                 } else {
1113                         p = str_val(global(sp));
1114                         zero_ok = p != null;
1115                         if (stype == '#')
1116                                 c = utflen(p);
1117                         else {
1118                                 /* partial utf_mbswidth reimplementation */
1119                                 const char *s = p;
1120                                 unsigned int wc;
1121                                 size_t len;
1122                                 int cw;
1123
1124                                 c = 0;
1125                                 while (*s) {
1126                                         if (!UTFMODE || (len = utf_mbtowc(&wc,
1127                                             s)) == (size_t)-1)
1128                                                 /* not UTFMODE or not UTF-8 */
1129                                                 wc = (unsigned char)(*s++);
1130                                         else
1131                                                 /* UTFMODE and UTF-8 */
1132                                                 s += len;
1133                                         /* wc == char or wchar at s++ */
1134                                         if ((cw = utf_wcwidth(wc)) == -1) {
1135                                                 /* 646, 8859-1, 10646 C0/C1 */
1136                                                 c = -1;
1137                                                 break;
1138                                         }
1139                                         c += cw;
1140                                 }
1141                         }
1142                 }
1143                 if (Flag(FNOUNSET) && c == 0 && !zero_ok)
1144                         errorf("%s: %s", sp, "parameter not set");
1145                 /* unqualified variable/string substitution */
1146                 *stypep = 0;
1147                 xp->str = shf_smprintf("%d", c);
1148                 return (XSUB);
1149         }
1150
1151         /* Check for qualifiers in word part */
1152         stype = 0;
1153         c = word[slen = 0] == CHAR ? word[1] : 0;
1154         if (c == ':') {
1155                 slen += 2;
1156                 stype = 0x80;
1157                 c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
1158         }
1159         if (!stype && c == '/') {
1160                 slen += 2;
1161                 stype = c;
1162                 if (word[slen] == ADELIM) {
1163                         slen += 2;
1164                         stype |= 0x80;
1165                 }
1166         } else if (stype == 0x80 && (c == ' ' || c == '0')) {
1167                 stype |= '0';
1168         } else if (ctype(c, C_SUBOP1)) {
1169                 slen += 2;
1170                 stype |= c;
1171         } else if (ctype(c, C_SUBOP2)) {
1172                 /* Note: ksh88 allows :%, :%%, etc */
1173                 slen += 2;
1174                 stype = c;
1175                 if (word[slen + 0] == CHAR && c == word[slen + 1]) {
1176                         stype |= 0x80;
1177                         slen += 2;
1178                 }
1179         } else if (c == '@') {
1180                 /* @x where x is command char */
1181                 slen += 2;
1182                 stype |= 0x100;
1183                 if (word[slen] == CHAR) {
1184                         stype |= word[slen + 1];
1185                         slen += 2;
1186                 }
1187         } else if (stype)
1188                 /* : is not ok */
1189                 return (-1);
1190         if (!stype && *word != CSUBST)
1191                 return (-1);
1192         *stypep = stype;
1193         *slenp = slen;
1194
1195         c = sp[0];
1196         if (c == '*' || c == '@') {
1197                 switch (stype & 0x17F) {
1198                 /* can't assign to a vector */
1199                 case '=':
1200                 /* can't trim a vector (yet) */
1201                 case '%':
1202                 case '#':
1203                 case '0':
1204                 case '/':
1205                 case 0x100 | '#':
1206                 case 0x100 | 'Q':
1207                         return (-1);
1208                 }
1209                 if (e->loc->argc == 0) {
1210                         xp->str = null;
1211                         xp->var = global(sp);
1212                         state = c == '@' ? XNULLSUB : XSUB;
1213                 } else {
1214                         xp->u.strv = (const char **)e->loc->argv + 1;
1215                         xp->str = *xp->u.strv++;
1216                         /* $@ */
1217                         xp->split = tobool(c == '@');
1218                         state = XARG;
1219                 }
1220                 /* POSIX 2009? */
1221                 zero_ok = true;
1222         } else {
1223                 if ((p = cstrchr(sp, '[')) && (p[1] == '*' || p[1] == '@') &&
1224                     p[2] == ']') {
1225                         XPtrV wv;
1226
1227                         switch (stype & 0x17F) {
1228                         /* can't assign to a vector */
1229                         case '=':
1230                         /* can't trim a vector (yet) */
1231                         case '%':
1232                         case '#':
1233                         case '?':
1234                         case '0':
1235                         case '/':
1236                         case 0x100 | '#':
1237                         case 0x100 | 'Q':
1238                                 return (-1);
1239                         }
1240                         XPinit(wv, 32);
1241                         if ((c = sp[0]) == '!')
1242                                 ++sp;
1243                         vp = global(arrayname(sp));
1244                         for (; vp; vp = vp->u.array) {
1245                                 if (!(vp->flag&ISSET))
1246                                         continue;
1247                                 XPput(wv, c == '!' ? shf_smprintf("%lu",
1248                                     arrayindex(vp)) :
1249                                     str_val(vp));
1250                         }
1251                         if (XPsize(wv) == 0) {
1252                                 xp->str = null;
1253                                 state = p[1] == '@' ? XNULLSUB : XSUB;
1254                                 XPfree(wv);
1255                         } else {
1256                                 XPput(wv, 0);
1257                                 xp->u.strv = (const char **)XPptrv(wv);
1258                                 xp->str = *xp->u.strv++;
1259                                 /* ${foo[@]} */
1260                                 xp->split = tobool(p[1] == '@');
1261                                 state = XARG;
1262                         }
1263                 } else {
1264                         /* Can't assign things like $! or $1 */
1265                         if ((stype & 0x17F) == '=' &&
1266                             ctype(*sp, C_VAR1 | C_DIGIT))
1267                                 return (-1);
1268                         if (*sp == '!' && sp[1]) {
1269                                 ++sp;
1270                                 xp->var = global(sp);
1271                                 if (vstrchr(sp, '['))
1272                                         xp->str = shf_smprintf("%s[%lu]",
1273                                             xp->var->name,
1274                                             arrayindex(xp->var));
1275                                 else
1276                                         xp->str = xp->var->name;
1277                         } else {
1278                                 xp->var = global(sp);
1279                                 xp->str = str_val(xp->var);
1280                         }
1281                         state = XSUB;
1282                 }
1283         }
1284
1285         c = stype & 0x7F;
1286         /* test the compiler's code generator */
1287         if (((stype < 0x100) && (ctype(c, C_SUBOP2) || c == '/' ||
1288             (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
1289             c == '=' || c == '-' || c == '?' : c == '+'))) ||
1290             stype == (0x80 | '0') || stype == (0x100 | '#') ||
1291             stype == (0x100 | 'Q'))
1292                 /* expand word instead of variable value */
1293                 state = XBASE;
1294         if (Flag(FNOUNSET) && xp->str == null && !zero_ok &&
1295             (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
1296                 errorf("%s: %s", sp, "parameter not set");
1297         return (state);
1298 }
1299
1300 /*
1301  * Run the command in $(...) and read its output.
1302  */
1303 static int
1304 comsub(Expand *xp, const char *cp, int fn MKSH_A_UNUSED)
1305 {
1306         Source *s, *sold;
1307         struct op *t;
1308         struct shf *shf;
1309         uint8_t old_utfmode = UTFMODE;
1310
1311         s = pushs(SSTRING, ATEMP);
1312         s->start = s->str = cp;
1313         sold = source;
1314         t = compile(s, true);
1315         afree(s, ATEMP);
1316         source = sold;
1317
1318         UTFMODE = old_utfmode;
1319
1320         if (t == NULL)
1321                 return (XBASE);
1322
1323         /* no waitlast() unless specifically enabled later */
1324         xp->split = false;
1325
1326         if (t->type == TCOM &&
1327             *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
1328                 /* $(<file) */
1329                 struct ioword *io = *t->ioact;
1330                 char *name;
1331
1332                 if ((io->ioflag & IOTYPE) != IOREAD)
1333                         errorf("%s: %s", "funny $() command",
1334                             snptreef(NULL, 32, "%R", io));
1335                 shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
1336                         SHF_MAPHI|SHF_CLEXEC);
1337                 if (shf == NULL)
1338                         warningf(!Flag(FTALKING), "%s: %s %s: %s", name,
1339                             "can't open", "$(<...) input", cstrerror(errno));
1340         } else if (fn == FUNSUB) {
1341                 int ofd1;
1342                 struct temp *tf = NULL;
1343
1344                 /*
1345                  * create a temporary file, open for reading and writing,
1346                  * with an shf open for reading (buffered) but yet unused
1347                  */
1348                 maketemp(ATEMP, TT_FUNSUB, &tf);
1349                 if (!tf->shf) {
1350                         errorf("can't %s temporary file %s: %s",
1351                             "create", tf->tffn, cstrerror(errno));
1352                 }
1353                 /* extract shf from temporary file, unlink and free it */
1354                 shf = tf->shf;
1355                 unlink(tf->tffn);
1356                 afree(tf, ATEMP);
1357                 /* save stdout and let it point to the tempfile */
1358                 ofd1 = savefd(1);
1359                 ksh_dup2(shf_fileno(shf), 1, false);
1360                 /*
1361                  * run tree, with output thrown into the tempfile,
1362                  * in a new function block
1363                  */
1364                 valsub(t, NULL);
1365                 subst_exstat = exstat & 0xFF;
1366                 /* rewind the tempfile and restore regular stdout */
1367                 lseek(shf_fileno(shf), (off_t)0, SEEK_SET);
1368                 restfd(1, ofd1);
1369         } else if (fn == VALSUB) {
1370                 xp->str = valsub(t, ATEMP);
1371                 subst_exstat = exstat & 0xFF;
1372                 return (XSUB);
1373         } else {
1374                 int ofd1, pv[2];
1375
1376                 openpipe(pv);
1377                 shf = shf_fdopen(pv[0], SHF_RD, NULL);
1378                 ofd1 = savefd(1);
1379                 if (pv[1] != 1) {
1380                         ksh_dup2(pv[1], 1, false);
1381                         close(pv[1]);
1382                 }
1383                 execute(t, XXCOM | XPIPEO | XFORK, NULL);
1384                 restfd(1, ofd1);
1385                 startlast();
1386                 /* waitlast() */
1387                 xp->split = true;
1388         }
1389
1390         xp->u.shf = shf;
1391         return (XCOM);
1392 }
1393
1394 /*
1395  * perform #pattern and %pattern substitution in ${}
1396  */
1397 static char *
1398 trimsub(char *str, char *pat, int how)
1399 {
1400         char *end = strnul(str);
1401         char *p, c;
1402
1403         switch (how & 0xFF) {
1404         case '#':
1405                 /* shortest match at beginning */
1406                 for (p = str; p <= end; p += utf_ptradj(p)) {
1407                         c = *p; *p = '\0';
1408                         if (gmatchx(str, pat, false)) {
1409                                 *p = c;
1410                                 return (p);
1411                         }
1412                         *p = c;
1413                 }
1414                 break;
1415         case '#'|0x80:
1416                 /* longest match at beginning */
1417                 for (p = end; p >= str; p--) {
1418                         c = *p; *p = '\0';
1419                         if (gmatchx(str, pat, false)) {
1420                                 *p = c;
1421                                 return (p);
1422                         }
1423                         *p = c;
1424                 }
1425                 break;
1426         case '%':
1427                 /* shortest match at end */
1428                 p = end;
1429                 while (p >= str) {
1430                         if (gmatchx(p, pat, false))
1431                                 goto trimsub_match;
1432                         if (UTFMODE) {
1433                                 char *op = p;
1434                                 while ((p-- > str) && ((*p & 0xC0) == 0x80))
1435                                         ;
1436                                 if ((p < str) || (p + utf_ptradj(p) != op))
1437                                         p = op - 1;
1438                         } else
1439                                 --p;
1440                 }
1441                 break;
1442         case '%'|0x80:
1443                 /* longest match at end */
1444                 for (p = str; p <= end; p++)
1445                         if (gmatchx(p, pat, false)) {
1446  trimsub_match:
1447                                 strndupx(end, str, p - str, ATEMP);
1448                                 return (end);
1449                         }
1450                 break;
1451         }
1452
1453         /* no match, return string */
1454         return (str);
1455 }
1456
1457 /*
1458  * glob
1459  * Name derived from V6's /etc/glob, the program that expanded filenames.
1460  */
1461
1462 /* XXX cp not const 'cause slashes are temporarily replaced with NULs... */
1463 static void
1464 glob(char *cp, XPtrV *wp, bool markdirs)
1465 {
1466         int oldsize = XPsize(*wp);
1467
1468         if (glob_str(cp, wp, markdirs) == 0)
1469                 XPput(*wp, debunk(cp, cp, strlen(cp) + 1));
1470         else
1471                 qsort(XPptrv(*wp) + oldsize, XPsize(*wp) - oldsize,
1472                     sizeof(void *), xstrcmp);
1473 }
1474
1475 #define GF_NONE         0
1476 #define GF_EXCHECK      BIT(0)          /* do existence check on file */
1477 #define GF_GLOBBED      BIT(1)          /* some globbing has been done */
1478 #define GF_MARKDIR      BIT(2)          /* add trailing / to directories */
1479
1480 /*
1481  * Apply file globbing to cp and store the matching files in wp. Returns
1482  * the number of matches found.
1483  */
1484 int
1485 glob_str(char *cp, XPtrV *wp, bool markdirs)
1486 {
1487         int oldsize = XPsize(*wp);
1488         XString xs;
1489         char *xp;
1490
1491         Xinit(xs, xp, 256, ATEMP);
1492         globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
1493         Xfree(xs, xp);
1494
1495         return (XPsize(*wp) - oldsize);
1496 }
1497
1498 static void
1499 globit(XString *xs,     /* dest string */
1500     char **xpp,         /* ptr to dest end */
1501     char *sp,           /* source path */
1502     XPtrV *wp,          /* output list */
1503     int check)          /* GF_* flags */
1504 {
1505         char *np;               /* next source component */
1506         char *xp = *xpp;
1507         char *se;
1508         char odirsep;
1509
1510         /* This to allow long expansions to be interrupted */
1511         intrcheck();
1512
1513         if (sp == NULL) {
1514                 /* end of source path */
1515                 /*
1516                  * We only need to check if the file exists if a pattern
1517                  * is followed by a non-pattern (eg, foo*x/bar; no check
1518                  * is needed for foo* since the match must exist) or if
1519                  * any patterns were expanded and the markdirs option is set.
1520                  * Symlinks make things a bit tricky...
1521                  */
1522                 if ((check & GF_EXCHECK) ||
1523                     ((check & GF_MARKDIR) && (check & GF_GLOBBED))) {
1524 #define stat_check()    (stat_done ? stat_done : (stat_done = \
1525                             stat(Xstring(*xs, xp), &statb) < 0 ? -1 : 1))
1526                         struct stat lstatb, statb;
1527                         /* -1: failed, 1 ok, 0 not yet done */
1528                         int stat_done = 0;
1529
1530                         if (mksh_lstat(Xstring(*xs, xp), &lstatb) < 0)
1531                                 return;
1532                         /*
1533                          * special case for systems which strip trailing
1534                          * slashes from regular files (eg, /etc/passwd/).
1535                          * SunOS 4.1.3 does this...
1536                          */
1537                         if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp) &&
1538                             xp[-1] == '/' && !S_ISDIR(lstatb.st_mode) &&
1539                             (!S_ISLNK(lstatb.st_mode) ||
1540                             stat_check() < 0 || !S_ISDIR(statb.st_mode)))
1541                                 return;
1542                         /*
1543                          * Possibly tack on a trailing / if there isn't already
1544                          * one and if the file is a directory or a symlink to a
1545                          * directory
1546                          */
1547                         if (((check & GF_MARKDIR) && (check & GF_GLOBBED)) &&
1548                             xp > Xstring(*xs, xp) && xp[-1] != '/' &&
1549                             (S_ISDIR(lstatb.st_mode) ||
1550                             (S_ISLNK(lstatb.st_mode) && stat_check() > 0 &&
1551                             S_ISDIR(statb.st_mode)))) {
1552                                 *xp++ = '/';
1553                                 *xp = '\0';
1554                         }
1555                 }
1556                 strndupx(np, Xstring(*xs, xp), Xlength(*xs, xp), ATEMP);
1557                 XPput(*wp, np);
1558                 return;
1559         }
1560
1561         if (xp > Xstring(*xs, xp))
1562                 *xp++ = '/';
1563         while (*sp == '/') {
1564                 Xcheck(*xs, xp);
1565                 *xp++ = *sp++;
1566         }
1567         np = strchr(sp, '/');
1568         if (np != NULL) {
1569                 se = np;
1570                 /* don't assume '/', can be multiple kinds */
1571                 odirsep = *np;
1572                 *np++ = '\0';
1573         } else {
1574                 odirsep = '\0'; /* keep gcc quiet */
1575                 se = sp + strlen(sp);
1576         }
1577
1578
1579         /*
1580          * Check if sp needs globbing - done to avoid pattern checks for strings
1581          * containing MAGIC characters, open [s without the matching close ],
1582          * etc. (otherwise opendir() will be called which may fail because the
1583          * directory isn't readable - if no globbing is needed, only execute
1584          * permission should be required (as per POSIX)).
1585          */
1586         if (!has_globbing(sp, se)) {
1587                 XcheckN(*xs, xp, se - sp + 1);
1588                 debunk(xp, sp, Xnleft(*xs, xp));
1589                 xp += strlen(xp);
1590                 *xpp = xp;
1591                 globit(xs, xpp, np, wp, check);
1592         } else {
1593                 DIR *dirp;
1594                 struct dirent *d;
1595                 char *name;
1596                 size_t len, prefix_len;
1597
1598                 /* xp = *xpp;   copy_non_glob() may have re-alloc'd xs */
1599                 *xp = '\0';
1600                 prefix_len = Xlength(*xs, xp);
1601                 dirp = opendir(prefix_len ? Xstring(*xs, xp) : ".");
1602                 if (dirp == NULL)
1603                         goto Nodir;
1604                 while ((d = readdir(dirp)) != NULL) {
1605                         name = d->d_name;
1606                         if (name[0] == '.' &&
1607                             (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
1608                                 /* always ignore . and .. */
1609                                 continue;
1610                         if ((*name == '.' && *sp != '.') ||
1611                             !gmatchx(name, sp, true))
1612                                 continue;
1613
1614                         len = strlen(d->d_name) + 1;
1615                         XcheckN(*xs, xp, len);
1616                         memcpy(xp, name, len);
1617                         *xpp = xp + len - 1;
1618                         globit(xs, xpp, np, wp,
1619                                 (check & GF_MARKDIR) | GF_GLOBBED
1620                                 | (np ? GF_EXCHECK : GF_NONE));
1621                         xp = Xstring(*xs, xp) + prefix_len;
1622                 }
1623                 closedir(dirp);
1624  Nodir:
1625                 ;
1626         }
1627
1628         if (np != NULL)
1629                 *--np = odirsep;
1630 }
1631
1632 /* remove MAGIC from string */
1633 char *
1634 debunk(char *dp, const char *sp, size_t dlen)
1635 {
1636         char *d;
1637         const char *s;
1638
1639         if ((s = cstrchr(sp, MAGIC))) {
1640                 if (s - sp >= (ssize_t)dlen)
1641                         return (dp);
1642                 memmove(dp, sp, s - sp);
1643                 for (d = dp + (s - sp); *s && (d - dp < (ssize_t)dlen); s++)
1644                         if (!ISMAGIC(*s) || !(*++s & 0x80) ||
1645                             !vstrchr("*+?@! ", *s & 0x7f))
1646                                 *d++ = *s;
1647                         else {
1648                                 /* extended pattern operators: *+?@! */
1649                                 if ((*s & 0x7f) != ' ')
1650                                         *d++ = *s & 0x7f;
1651                                 if (d - dp < (ssize_t)dlen)
1652                                         *d++ = '(';
1653                         }
1654                 *d = '\0';
1655         } else if (dp != sp)
1656                 strlcpy(dp, sp, dlen);
1657         return (dp);
1658 }
1659
1660 /*
1661  * Check if p is an unquoted name, possibly followed by a / or :. If so
1662  * puts the expanded version in *dcp,dp and returns a pointer in p just
1663  * past the name, otherwise returns 0.
1664  */
1665 static const char *
1666 maybe_expand_tilde(const char *p, XString *dsp, char **dpp, bool isassign)
1667 {
1668         XString ts;
1669         char *dp = *dpp;
1670         char *tp;
1671         const char *r;
1672
1673         Xinit(ts, tp, 16, ATEMP);
1674         /* : only for DOASNTILDE form */
1675         while (p[0] == CHAR && p[1] != '/' && (!isassign || p[1] != ':'))
1676         {
1677                 Xcheck(ts, tp);
1678                 *tp++ = p[1];
1679                 p += 2;
1680         }
1681         *tp = '\0';
1682         r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ?
1683             do_tilde(Xstring(ts, tp)) : NULL;
1684         Xfree(ts, tp);
1685         if (r) {
1686                 while (*r) {
1687                         Xcheck(*dsp, dp);
1688                         if (ISMAGIC(*r))
1689                                 *dp++ = MAGIC;
1690                         *dp++ = *r++;
1691                 }
1692                 *dpp = dp;
1693                 r = p;
1694         }
1695         return (r);
1696 }
1697
1698 /*
1699  * tilde expansion
1700  *
1701  * based on a version by Arnold Robbins
1702  */
1703
1704 char *
1705 do_tilde(char *cp)
1706 {
1707         char *dp = null;
1708
1709         if (cp[0] == '\0')
1710                 dp = str_val(global("HOME"));
1711         else if (cp[0] == '+' && cp[1] == '\0')
1712                 dp = str_val(global("PWD"));
1713         else if (ksh_isdash(cp))
1714                 dp = str_val(global("OLDPWD"));
1715 #ifndef MKSH_NOPWNAM
1716         else
1717                 dp = homedir(cp);
1718 #endif
1719         /* If HOME, PWD or OLDPWD are not set, don't expand ~ */
1720         return (dp == null ? NULL : dp);
1721 }
1722
1723 #ifndef MKSH_NOPWNAM
1724 /*
1725  * map userid to user's home directory.
1726  * note that 4.3's getpw adds more than 6K to the shell,
1727  * and the YP version probably adds much more.
1728  * we might consider our own version of getpwnam() to keep the size down.
1729  */
1730 static char *
1731 homedir(char *name)
1732 {
1733         struct tbl *ap;
1734
1735         ap = ktenter(&homedirs, name, hash(name));
1736         if (!(ap->flag & ISSET)) {
1737                 struct passwd *pw;
1738
1739                 pw = getpwnam(name);
1740                 if (pw == NULL)
1741                         return (NULL);
1742                 strdupx(ap->val.s, pw->pw_dir, APERM);
1743                 ap->flag |= DEFINED|ISSET|ALLOC;
1744         }
1745         return (ap->val.s);
1746 }
1747 #endif
1748
1749 static void
1750 alt_expand(XPtrV *wp, char *start, char *exp_start, char *end, int fdo)
1751 {
1752         unsigned int count = 0;
1753         char *brace_start, *brace_end, *comma = NULL;
1754         char *field_start;
1755         char *p = exp_start;
1756
1757         /* search for open brace */
1758         while ((p = strchr(p, MAGIC)) && p[1] != '{' /*}*/)
1759                 p += 2;
1760         brace_start = p;
1761
1762         /* find matching close brace, if any */
1763         if (p) {
1764                 comma = NULL;
1765                 count = 1;
1766                 p += 2;
1767                 while (*p && count) {
1768                         if (ISMAGIC(*p++)) {
1769                                 if (*p == '{' /*}*/)
1770                                         ++count;
1771                                 else if (*p == /*{*/ '}')
1772                                         --count;
1773                                 else if (*p == ',' && count == 1)
1774                                         comma = p;
1775                                 ++p;
1776                         }
1777                 }
1778         }
1779         /* no valid expansions... */
1780         if (!p || count != 0) {
1781                 /*
1782                  * Note that given a{{b,c} we do not expand anything (this is
1783                  * what AT&T ksh does. This may be changed to do the {b,c}
1784                  * expansion. }
1785                  */
1786                 if (fdo & DOGLOB)
1787                         glob(start, wp, tobool(fdo & DOMARKDIRS));
1788                 else
1789                         XPput(*wp, debunk(start, start, end - start));
1790                 return;
1791         }
1792         brace_end = p;
1793         if (!comma) {
1794                 alt_expand(wp, start, brace_end, end, fdo);
1795                 return;
1796         }
1797
1798         /* expand expression */
1799         field_start = brace_start + 2;
1800         count = 1;
1801         for (p = brace_start + 2; p != brace_end; p++) {
1802                 if (ISMAGIC(*p)) {
1803                         if (*++p == '{' /*}*/)
1804                                 ++count;
1805                         else if ((*p == /*{*/ '}' && --count == 0) ||
1806                             (*p == ',' && count == 1)) {
1807                                 char *news;
1808                                 int l1, l2, l3;
1809
1810                                 /*
1811                                  * addition safe since these operate on
1812                                  * one string (separate substrings)
1813                                  */
1814                                 l1 = brace_start - start;
1815                                 l2 = (p - 1) - field_start;
1816                                 l3 = end - brace_end;
1817                                 news = alloc(l1 + l2 + l3 + 1, ATEMP);
1818                                 memcpy(news, start, l1);
1819                                 memcpy(news + l1, field_start, l2);
1820                                 memcpy(news + l1 + l2, brace_end, l3);
1821                                 news[l1 + l2 + l3] = '\0';
1822                                 alt_expand(wp, news, news + l1,
1823                                     news + l1 + l2 + l3, fdo);
1824                                 field_start = p + 1;
1825                         }
1826                 }
1827         }
1828         return;
1829 }
1830
1831 /* helper function due to setjmp/longjmp woes */
1832 static char *
1833 valsub(struct op *t, Area *ap)
1834 {
1835         char * volatile cp = NULL;
1836         struct tbl * volatile vp = NULL;
1837
1838         newenv(E_FUNC);
1839         newblock();
1840         if (ap)
1841                 vp = local("REPLY", false);
1842         if (!kshsetjmp(e->jbuf))
1843                 execute(t, XXCOM | XERROK, NULL);
1844         if (vp)
1845                 strdupx(cp, str_val(vp), ap);
1846         quitenv(NULL);
1847
1848         return (cp);
1849 }