]> CyberLeo.Net >> Repos - FreeBSD/releng/8.2.git/blob - bin/sh/expand.c
Fix named(8) DNSSEC validation Denial of Service.
[FreeBSD/releng/8.2.git] / bin / sh / expand.c
1 /*-
2  * Copyright (c) 1991, 1993
3  *      The Regents of the University of California.  All rights reserved.
4  * Copyright (c) 1997-2005
5  *      Herbert Xu <herbert@gondor.apana.org.au>.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Kenneth Almquist.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34
35 #ifndef lint
36 #if 0
37 static char sccsid[] = "@(#)expand.c    8.5 (Berkeley) 5/15/95";
38 #endif
39 #endif /* not lint */
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD$");
42
43 #include <sys/types.h>
44 #include <sys/time.h>
45 #include <sys/stat.h>
46 #include <dirent.h>
47 #include <errno.h>
48 #include <inttypes.h>
49 #include <limits.h>
50 #include <pwd.h>
51 #include <stdio.h>
52 #include <stdlib.h>
53 #include <string.h>
54 #include <unistd.h>
55
56 /*
57  * Routines to expand arguments to commands.  We have to deal with
58  * backquotes, shell variables, and file metacharacters.
59  */
60
61 #include "shell.h"
62 #include "main.h"
63 #include "nodes.h"
64 #include "eval.h"
65 #include "expand.h"
66 #include "syntax.h"
67 #include "parser.h"
68 #include "jobs.h"
69 #include "options.h"
70 #include "var.h"
71 #include "input.h"
72 #include "output.h"
73 #include "memalloc.h"
74 #include "error.h"
75 #include "mystring.h"
76 #include "arith.h"
77 #include "show.h"
78
79 /*
80  * Structure specifying which parts of the string should be searched
81  * for IFS characters.
82  */
83
84 struct ifsregion {
85         struct ifsregion *next; /* next region in list */
86         int begoff;             /* offset of start of region */
87         int endoff;             /* offset of end of region */
88         int inquotes;           /* search for nul bytes only */
89 };
90
91
92 static char *expdest;                   /* output of current string */
93 static struct nodelist *argbackq;       /* list of back quote expressions */
94 static struct ifsregion ifsfirst;       /* first struct in list of ifs regions */
95 static struct ifsregion *ifslastp;      /* last struct in list */
96 static struct arglist exparg;           /* holds expanded arg list */
97
98 static void argstr(char *, int);
99 static char *exptilde(char *, int);
100 static void expbackq(union node *, int, int);
101 static int subevalvar(char *, char *, int, int, int, int);
102 static char *evalvar(char *, int);
103 static int varisset(char *, int);
104 static void varvalue(char *, int, int, int);
105 static void recordregion(int, int, int);
106 static void removerecordregions(int);
107 static void ifsbreakup(char *, struct arglist *);
108 static void expandmeta(struct strlist *, int);
109 static void expmeta(char *, char *);
110 static void addfname(char *);
111 static struct strlist *expsort(struct strlist *);
112 static struct strlist *msort(struct strlist *, int);
113 static int pmatch(const char *, const char *, int);
114 static char *cvtnum(int, char *);
115 static int collate_range_cmp(int, int);
116
117 static int
118 collate_range_cmp(int c1, int c2)
119 {
120         static char s1[2], s2[2];
121
122         s1[0] = c1;
123         s2[0] = c2;
124         return (strcoll(s1, s2));
125 }
126
127 /*
128  * Expand shell variables and backquotes inside a here document.
129  *      union node *arg         the document
130  *      int fd;                 where to write the expanded version
131  */
132
133 void
134 expandhere(union node *arg, int fd)
135 {
136         herefd = fd;
137         expandarg(arg, (struct arglist *)NULL, 0);
138         xwrite(fd, stackblock(), expdest - stackblock());
139 }
140
141
142 /*
143  * Perform expansions on an argument, placing the resulting list of arguments
144  * in arglist.  Parameter expansion, command substitution and arithmetic
145  * expansion are always performed; additional expansions can be requested
146  * via flag (EXP_*).
147  * The result is left in the stack string.
148  * When arglist is NULL, perform here document expansion.  A partial result
149  * may be written to herefd, which is then not included in the stack string.
150  *
151  * Caution: this function uses global state and is not reentrant.
152  * However, a new invocation after an interrupted invocation is safe
153  * and will reset the global state for the new call.
154  */
155 void
156 expandarg(union node *arg, struct arglist *arglist, int flag)
157 {
158         struct strlist *sp;
159         char *p;
160
161         argbackq = arg->narg.backquote;
162         STARTSTACKSTR(expdest);
163         ifsfirst.next = NULL;
164         ifslastp = NULL;
165         argstr(arg->narg.text, flag);
166         if (arglist == NULL) {
167                 return;                 /* here document expanded */
168         }
169         STPUTC('\0', expdest);
170         p = grabstackstr(expdest);
171         exparg.lastp = &exparg.list;
172         /*
173          * TODO - EXP_REDIR
174          */
175         if (flag & EXP_FULL) {
176                 ifsbreakup(p, &exparg);
177                 *exparg.lastp = NULL;
178                 exparg.lastp = &exparg.list;
179                 expandmeta(exparg.list, flag);
180         } else {
181                 if (flag & EXP_REDIR) /*XXX - for now, just remove escapes */
182                         rmescapes(p);
183                 sp = (struct strlist *)stalloc(sizeof (struct strlist));
184                 sp->text = p;
185                 *exparg.lastp = sp;
186                 exparg.lastp = &sp->next;
187         }
188         while (ifsfirst.next != NULL) {
189                 struct ifsregion *ifsp;
190                 INTOFF;
191                 ifsp = ifsfirst.next->next;
192                 ckfree(ifsfirst.next);
193                 ifsfirst.next = ifsp;
194                 INTON;
195         }
196         *exparg.lastp = NULL;
197         if (exparg.list) {
198                 *arglist->lastp = exparg.list;
199                 arglist->lastp = exparg.lastp;
200         }
201 }
202
203
204
205 /*
206  * Perform parameter expansion, command substitution and arithmetic
207  * expansion, and tilde expansion if requested via EXP_TILDE/EXP_VARTILDE.
208  * Processing ends at a CTLENDVAR character as well as '\0'.
209  * This is used to expand word in ${var+word} etc.
210  * If EXP_FULL, EXP_CASE or EXP_REDIR are set, keep and/or generate CTLESC
211  * characters to allow for further processing.
212  * If EXP_FULL is set, also preserve CTLQUOTEMARK characters.
213  */
214 static void
215 argstr(char *p, int flag)
216 {
217         char c;
218         int quotes = flag & (EXP_FULL | EXP_CASE | EXP_REDIR);  /* do CTLESC */
219         int firsteq = 1;
220
221         if (*p == '~' && (flag & (EXP_TILDE | EXP_VARTILDE)))
222                 p = exptilde(p, flag);
223         for (;;) {
224                 switch (c = *p++) {
225                 case '\0':
226                 case CTLENDVAR:
227                         goto breakloop;
228                 case CTLQUOTEMARK:
229                         /* "$@" syntax adherence hack */
230                         if (p[0] == CTLVAR && p[2] == '@' && p[3] == '=')
231                                 break;
232                         if ((flag & EXP_FULL) != 0)
233                                 STPUTC(c, expdest);
234                         break;
235                 case CTLESC:
236                         if (quotes)
237                                 STPUTC(c, expdest);
238                         c = *p++;
239                         STPUTC(c, expdest);
240                         break;
241                 case CTLVAR:
242                         p = evalvar(p, flag);
243                         break;
244                 case CTLBACKQ:
245                 case CTLBACKQ|CTLQUOTE:
246                         expbackq(argbackq->n, c & CTLQUOTE, flag);
247                         argbackq = argbackq->next;
248                         break;
249                 case CTLENDARI:
250                         expari(flag);
251                         break;
252                 case ':':
253                 case '=':
254                         /*
255                          * sort of a hack - expand tildes in variable
256                          * assignments (after the first '=' and after ':'s).
257                          */
258                         STPUTC(c, expdest);
259                         if (flag & EXP_VARTILDE && *p == '~') {
260                                 if (c == '=') {
261                                         if (firsteq)
262                                                 firsteq = 0;
263                                         else
264                                                 break;
265                                 }
266                                 p = exptilde(p, flag);
267                         }
268                         break;
269                 default:
270                         STPUTC(c, expdest);
271                 }
272         }
273 breakloop:;
274 }
275
276 /*
277  * Perform tilde expansion, placing the result in the stack string and
278  * returning the next position in the input string to process.
279  */
280 static char *
281 exptilde(char *p, int flag)
282 {
283         char c, *startp = p;
284         struct passwd *pw;
285         char *home;
286         int quotes = flag & (EXP_FULL | EXP_CASE | EXP_REDIR);
287
288         while ((c = *p) != '\0') {
289                 switch(c) {
290                 case CTLESC:
291                         return (startp);
292                 case CTLQUOTEMARK:
293                         return (startp);
294                 case ':':
295                         if (flag & EXP_VARTILDE)
296                                 goto done;
297                         break;
298                 case '/':
299                         goto done;
300                 }
301                 p++;
302         }
303 done:
304         *p = '\0';
305         if (*(startp+1) == '\0') {
306                 if ((home = lookupvar("HOME")) == NULL)
307                         goto lose;
308         } else {
309                 if ((pw = getpwnam(startp+1)) == NULL)
310                         goto lose;
311                 home = pw->pw_dir;
312         }
313         if (*home == '\0')
314                 goto lose;
315         *p = c;
316         while ((c = *home++) != '\0') {
317                 if (quotes && SQSYNTAX[(int)c] == CCTL)
318                         STPUTC(CTLESC, expdest);
319                 STPUTC(c, expdest);
320         }
321         return (p);
322 lose:
323         *p = c;
324         return (startp);
325 }
326
327
328 static void
329 removerecordregions(int endoff)
330 {
331         if (ifslastp == NULL)
332                 return;
333
334         if (ifsfirst.endoff > endoff) {
335                 while (ifsfirst.next != NULL) {
336                         struct ifsregion *ifsp;
337                         INTOFF;
338                         ifsp = ifsfirst.next->next;
339                         ckfree(ifsfirst.next);
340                         ifsfirst.next = ifsp;
341                         INTON;
342                 }
343                 if (ifsfirst.begoff > endoff)
344                         ifslastp = NULL;
345                 else {
346                         ifslastp = &ifsfirst;
347                         ifsfirst.endoff = endoff;
348                 }
349                 return;
350         }
351
352         ifslastp = &ifsfirst;
353         while (ifslastp->next && ifslastp->next->begoff < endoff)
354                 ifslastp=ifslastp->next;
355         while (ifslastp->next != NULL) {
356                 struct ifsregion *ifsp;
357                 INTOFF;
358                 ifsp = ifslastp->next->next;
359                 ckfree(ifslastp->next);
360                 ifslastp->next = ifsp;
361                 INTON;
362         }
363         if (ifslastp->endoff > endoff)
364                 ifslastp->endoff = endoff;
365 }
366
367 /*
368  * Expand arithmetic expression.  Backup to start of expression,
369  * evaluate, place result in (backed up) result, adjust string position.
370  */
371 void
372 expari(int flag)
373 {
374         char *p, *start;
375         arith_t result;
376         int begoff;
377         int quotes = flag & (EXP_FULL | EXP_CASE | EXP_REDIR);
378         int quoted;
379
380         /*
381          * This routine is slightly over-complicated for
382          * efficiency.  First we make sure there is
383          * enough space for the result, which may be bigger
384          * than the expression.  Next we
385          * scan backwards looking for the start of arithmetic.  If the
386          * next previous character is a CTLESC character, then we
387          * have to rescan starting from the beginning since CTLESC
388          * characters have to be processed left to right.
389          */
390         CHECKSTRSPACE(DIGITS(result) - 2, expdest);
391         USTPUTC('\0', expdest);
392         start = stackblock();
393         p = expdest - 2;
394         while (p >= start && *p != CTLARI)
395                 --p;
396         if (p < start || *p != CTLARI)
397                 error("missing CTLARI (shouldn't happen)");
398         if (p > start && *(p - 1) == CTLESC)
399                 for (p = start; *p != CTLARI; p++)
400                         if (*p == CTLESC)
401                                 p++;
402
403         if (p[1] == '"')
404                 quoted=1;
405         else
406                 quoted=0;
407         begoff = p - start;
408         removerecordregions(begoff);
409         if (quotes)
410                 rmescapes(p+2);
411         result = arith(p+2);
412         fmtstr(p, DIGITS(result), ARITH_FORMAT_STR, result);
413         while (*p++)
414                 ;
415         if (quoted == 0)
416                 recordregion(begoff, p - 1 - start, 0);
417         result = expdest - p + 1;
418         STADJUST(-result, expdest);
419 }
420
421
422 /*
423  * Perform command substitution.
424  */
425 static void
426 expbackq(union node *cmd, int quoted, int flag)
427 {
428         struct backcmd in;
429         int i;
430         char buf[128];
431         char *p;
432         char *dest = expdest;
433         struct ifsregion saveifs, *savelastp;
434         struct nodelist *saveargbackq;
435         char lastc;
436         int startloc = dest - stackblock();
437         char const *syntax = quoted? DQSYNTAX : BASESYNTAX;
438         int saveherefd;
439         int quotes = flag & (EXP_FULL | EXP_CASE | EXP_REDIR);
440         int nnl;
441
442         INTOFF;
443         saveifs = ifsfirst;
444         savelastp = ifslastp;
445         saveargbackq = argbackq;
446         saveherefd = herefd;
447         herefd = -1;
448         p = grabstackstr(dest);
449         evalbackcmd(cmd, &in);
450         ungrabstackstr(p, dest);
451         ifsfirst = saveifs;
452         ifslastp = savelastp;
453         argbackq = saveargbackq;
454         herefd = saveherefd;
455
456         p = in.buf;
457         lastc = '\0';
458         nnl = 0;
459         /* Don't copy trailing newlines */
460         for (;;) {
461                 if (--in.nleft < 0) {
462                         if (in.fd < 0)
463                                 break;
464                         while ((i = read(in.fd, buf, sizeof buf)) < 0 && errno == EINTR);
465                         TRACE(("expbackq: read returns %d\n", i));
466                         if (i <= 0)
467                                 break;
468                         p = buf;
469                         in.nleft = i - 1;
470                 }
471                 lastc = *p++;
472                 if (lastc != '\0') {
473                         if (quotes && syntax[(int)lastc] == CCTL)
474                                 STPUTC(CTLESC, dest);
475                         if (lastc == '\n') {
476                                 nnl++;
477                         } else {
478                                 while (nnl > 0) {
479                                         nnl--;
480                                         STPUTC('\n', dest);
481                                 }
482                                 STPUTC(lastc, dest);
483                         }
484                 }
485         }
486
487         if (in.fd >= 0)
488                 close(in.fd);
489         if (in.buf)
490                 ckfree(in.buf);
491         if (in.jp)
492                 exitstatus = waitforjob(in.jp, (int *)NULL);
493         if (quoted == 0)
494                 recordregion(startloc, dest - stackblock(), 0);
495         TRACE(("expbackq: size=%td: \"%.*s\"\n",
496                 ((dest - stackblock()) - startloc),
497                 (int)((dest - stackblock()) - startloc),
498                 stackblock() + startloc));
499         expdest = dest;
500         INTON;
501 }
502
503
504
505 static int
506 subevalvar(char *p, char *str, int strloc, int subtype, int startloc,
507   int varflags)
508 {
509         char *startp;
510         char *loc = NULL;
511         char *q;
512         int c = 0;
513         int saveherefd = herefd;
514         struct nodelist *saveargbackq = argbackq;
515         int amount;
516
517         herefd = -1;
518         argstr(p, 0);
519         STACKSTRNUL(expdest);
520         herefd = saveherefd;
521         argbackq = saveargbackq;
522         startp = stackblock() + startloc;
523         if (str == NULL)
524             str = stackblock() + strloc;
525
526         switch (subtype) {
527         case VSASSIGN:
528                 setvar(str, startp, 0);
529                 amount = startp - expdest;
530                 STADJUST(amount, expdest);
531                 varflags &= ~VSNUL;
532                 if (c != 0)
533                         *loc = c;
534                 return 1;
535
536         case VSQUESTION:
537                 if (*p != CTLENDVAR) {
538                         outfmt(&errout, "%s\n", startp);
539                         error((char *)NULL);
540                 }
541                 error("%.*s: parameter %snot set", (int)(p - str - 1),
542                       str, (varflags & VSNUL) ? "null or "
543                                               : nullstr);
544                 return 0;
545
546         case VSTRIMLEFT:
547                 for (loc = startp; loc < str; loc++) {
548                         c = *loc;
549                         *loc = '\0';
550                         if (patmatch(str, startp, varflags & VSQUOTE)) {
551                                 *loc = c;
552                                 goto recordleft;
553                         }
554                         *loc = c;
555                         if ((varflags & VSQUOTE) && *loc == CTLESC)
556                                 loc++;
557                 }
558                 return 0;
559
560         case VSTRIMLEFTMAX:
561                 for (loc = str - 1; loc >= startp;) {
562                         c = *loc;
563                         *loc = '\0';
564                         if (patmatch(str, startp, varflags & VSQUOTE)) {
565                                 *loc = c;
566                                 goto recordleft;
567                         }
568                         *loc = c;
569                         loc--;
570                         if ((varflags & VSQUOTE) && loc > startp &&
571                             *(loc - 1) == CTLESC) {
572                                 for (q = startp; q < loc; q++)
573                                         if (*q == CTLESC)
574                                                 q++;
575                                 if (q > loc)
576                                         loc--;
577                         }
578                 }
579                 return 0;
580
581         case VSTRIMRIGHT:
582                 for (loc = str - 1; loc >= startp;) {
583                         if (patmatch(str, loc, varflags & VSQUOTE)) {
584                                 amount = loc - expdest;
585                                 STADJUST(amount, expdest);
586                                 return 1;
587                         }
588                         loc--;
589                         if ((varflags & VSQUOTE) && loc > startp &&
590                             *(loc - 1) == CTLESC) {
591                                 for (q = startp; q < loc; q++)
592                                         if (*q == CTLESC)
593                                                 q++;
594                                 if (q > loc)
595                                         loc--;
596                         }
597                 }
598                 return 0;
599
600         case VSTRIMRIGHTMAX:
601                 for (loc = startp; loc < str - 1; loc++) {
602                         if (patmatch(str, loc, varflags & VSQUOTE)) {
603                                 amount = loc - expdest;
604                                 STADJUST(amount, expdest);
605                                 return 1;
606                         }
607                         if ((varflags & VSQUOTE) && *loc == CTLESC)
608                                 loc++;
609                 }
610                 return 0;
611
612
613         default:
614                 abort();
615         }
616
617 recordleft:
618         amount = ((str - 1) - (loc - startp)) - expdest;
619         STADJUST(amount, expdest);
620         while (loc != str - 1)
621                 *startp++ = *loc++;
622         return 1;
623 }
624
625
626 /*
627  * Expand a variable, and return a pointer to the next character in the
628  * input string.
629  */
630
631 static char *
632 evalvar(char *p, int flag)
633 {
634         int subtype;
635         int varflags;
636         char *var;
637         char *val;
638         int patloc;
639         int c;
640         int set;
641         int special;
642         int startloc;
643         int varlen;
644         int easy;
645         int quotes = flag & (EXP_FULL | EXP_CASE | EXP_REDIR);
646
647         varflags = (unsigned char)*p++;
648         subtype = varflags & VSTYPE;
649         var = p;
650         special = 0;
651         if (! is_name(*p))
652                 special = 1;
653         p = strchr(p, '=') + 1;
654 again: /* jump here after setting a variable with ${var=text} */
655         if (varflags & VSLINENO) {
656                 set = 1;
657                 special = 0;
658                 val = var;
659                 p[-1] = '\0';   /* temporarily overwrite '=' to have \0
660                                    terminated string */
661         } else if (special) {
662                 set = varisset(var, varflags & VSNUL);
663                 val = NULL;
664         } else {
665                 val = bltinlookup(var, 1);
666                 if (val == NULL || ((varflags & VSNUL) && val[0] == '\0')) {
667                         val = NULL;
668                         set = 0;
669                 } else
670                         set = 1;
671         }
672         varlen = 0;
673         startloc = expdest - stackblock();
674         if (!set && uflag && *var != '@' && *var != '*') {
675                 switch (subtype) {
676                 case VSNORMAL:
677                 case VSTRIMLEFT:
678                 case VSTRIMLEFTMAX:
679                 case VSTRIMRIGHT:
680                 case VSTRIMRIGHTMAX:
681                 case VSLENGTH:
682                         error("%.*s: parameter not set", (int)(p - var - 1),
683                             var);
684                 }
685         }
686         if (set && subtype != VSPLUS) {
687                 /* insert the value of the variable */
688                 if (special) {
689                         varvalue(var, varflags & VSQUOTE, subtype, flag);
690                         if (subtype == VSLENGTH) {
691                                 varlen = expdest - stackblock() - startloc;
692                                 STADJUST(-varlen, expdest);
693                         }
694                 } else {
695                         char const *syntax = (varflags & VSQUOTE) ? DQSYNTAX
696                                                                   : BASESYNTAX;
697
698                         if (subtype == VSLENGTH) {
699                                 for (;*val; val++)
700                                         varlen++;
701                         }
702                         else {
703                                 while (*val) {
704                                         if (quotes &&
705                                             syntax[(int)*val] == CCTL)
706                                                 STPUTC(CTLESC, expdest);
707                                         STPUTC(*val++, expdest);
708                                 }
709
710                         }
711                 }
712         }
713
714         if (subtype == VSPLUS)
715                 set = ! set;
716
717         easy = ((varflags & VSQUOTE) == 0 ||
718                 (*var == '@' && shellparam.nparam != 1));
719
720
721         switch (subtype) {
722         case VSLENGTH:
723                 expdest = cvtnum(varlen, expdest);
724                 goto record;
725
726         case VSNORMAL:
727                 if (!easy)
728                         break;
729 record:
730                 recordregion(startloc, expdest - stackblock(),
731                              varflags & VSQUOTE);
732                 break;
733
734         case VSPLUS:
735         case VSMINUS:
736                 if (!set) {
737                         argstr(p, flag);
738                         break;
739                 }
740                 if (easy)
741                         goto record;
742                 break;
743
744         case VSTRIMLEFT:
745         case VSTRIMLEFTMAX:
746         case VSTRIMRIGHT:
747         case VSTRIMRIGHTMAX:
748                 if (!set)
749                         break;
750                 /*
751                  * Terminate the string and start recording the pattern
752                  * right after it
753                  */
754                 STPUTC('\0', expdest);
755                 patloc = expdest - stackblock();
756                 if (subevalvar(p, NULL, patloc, subtype,
757                                startloc, varflags) == 0) {
758                         int amount = (expdest - stackblock() - patloc) + 1;
759                         STADJUST(-amount, expdest);
760                 }
761                 /* Remove any recorded regions beyond start of variable */
762                 removerecordregions(startloc);
763                 goto record;
764
765         case VSASSIGN:
766         case VSQUESTION:
767                 if (!set) {
768                         if (subevalvar(p, var, 0, subtype, startloc, varflags)) {
769                                 varflags &= ~VSNUL;
770                                 /*
771                                  * Remove any recorded regions beyond
772                                  * start of variable
773                                  */
774                                 removerecordregions(startloc);
775                                 goto again;
776                         }
777                         break;
778                 }
779                 if (easy)
780                         goto record;
781                 break;
782
783         case VSERROR:
784                 c = p - var - 1;
785                 error("${%.*s%s}: Bad substitution", c, var,
786                     (c > 0 && *p != CTLENDVAR) ? "..." : "");
787
788         default:
789                 abort();
790         }
791         p[-1] = '=';    /* recover overwritten '=' */
792
793         if (subtype != VSNORMAL) {      /* skip to end of alternative */
794                 int nesting = 1;
795                 for (;;) {
796                         if ((c = *p++) == CTLESC)
797                                 p++;
798                         else if (c == CTLBACKQ || c == (CTLBACKQ|CTLQUOTE)) {
799                                 if (set)
800                                         argbackq = argbackq->next;
801                         } else if (c == CTLVAR) {
802                                 if ((*p++ & VSTYPE) != VSNORMAL)
803                                         nesting++;
804                         } else if (c == CTLENDVAR) {
805                                 if (--nesting == 0)
806                                         break;
807                         }
808                 }
809         }
810         return p;
811 }
812
813
814
815 /*
816  * Test whether a specialized variable is set.
817  */
818
819 static int
820 varisset(char *name, int nulok)
821 {
822
823         if (*name == '!')
824                 return backgndpid != -1;
825         else if (*name == '@' || *name == '*') {
826                 if (*shellparam.p == NULL)
827                         return 0;
828
829                 if (nulok) {
830                         char **av;
831
832                         for (av = shellparam.p; *av; av++)
833                                 if (**av != '\0')
834                                         return 1;
835                         return 0;
836                 }
837         } else if (is_digit(*name)) {
838                 char *ap;
839                 int num = atoi(name);
840
841                 if (num > shellparam.nparam)
842                         return 0;
843
844                 if (num == 0)
845                         ap = arg0;
846                 else
847                         ap = shellparam.p[num - 1];
848
849                 if (nulok && (ap == NULL || *ap == '\0'))
850                         return 0;
851         }
852         return 1;
853 }
854
855
856
857 /*
858  * Add the value of a specialized variable to the stack string.
859  */
860
861 static void
862 varvalue(char *name, int quoted, int subtype, int flag)
863 {
864         int num;
865         char *p;
866         int i;
867         char sep;
868         char **ap;
869         char const *syntax;
870
871 #define STRTODEST(p) \
872         do {\
873         if (flag & (EXP_FULL | EXP_CASE) && subtype != VSLENGTH) { \
874                 syntax = quoted? DQSYNTAX : BASESYNTAX; \
875                 while (*p) { \
876                         if (syntax[(int)*p] == CCTL) \
877                                 STPUTC(CTLESC, expdest); \
878                         STPUTC(*p++, expdest); \
879                 } \
880         } else \
881                 while (*p) \
882                         STPUTC(*p++, expdest); \
883         } while (0)
884
885
886         switch (*name) {
887         case '$':
888                 num = rootpid;
889                 goto numvar;
890         case '?':
891                 num = oexitstatus;
892                 goto numvar;
893         case '#':
894                 num = shellparam.nparam;
895                 goto numvar;
896         case '!':
897                 num = backgndpid;
898 numvar:
899                 expdest = cvtnum(num, expdest);
900                 break;
901         case '-':
902                 for (i = 0 ; i < NOPTS ; i++) {
903                         if (optlist[i].val)
904                                 STPUTC(optlist[i].letter, expdest);
905                 }
906                 break;
907         case '@':
908                 if (flag & EXP_FULL && quoted) {
909                         for (ap = shellparam.p ; (p = *ap++) != NULL ; ) {
910                                 STRTODEST(p);
911                                 if (*ap)
912                                         STPUTC('\0', expdest);
913                         }
914                         break;
915                 }
916                 /* FALLTHROUGH */
917         case '*':
918                 if (ifsset())
919                         sep = ifsval()[0];
920                 else
921                         sep = ' ';
922                 for (ap = shellparam.p ; (p = *ap++) != NULL ; ) {
923                         STRTODEST(p);
924                         if (*ap && sep)
925                                 STPUTC(sep, expdest);
926                 }
927                 break;
928         case '0':
929                 p = arg0;
930                 STRTODEST(p);
931                 break;
932         default:
933                 if (is_digit(*name)) {
934                         num = atoi(name);
935                         if (num > 0 && num <= shellparam.nparam) {
936                                 p = shellparam.p[num - 1];
937                                 STRTODEST(p);
938                         }
939                 }
940                 break;
941         }
942 }
943
944
945
946 /*
947  * Record the the fact that we have to scan this region of the
948  * string for IFS characters.
949  */
950
951 static void
952 recordregion(int start, int end, int inquotes)
953 {
954         struct ifsregion *ifsp;
955
956         if (ifslastp == NULL) {
957                 ifsp = &ifsfirst;
958         } else {
959                 if (ifslastp->endoff == start
960                     && ifslastp->inquotes == inquotes) {
961                         /* extend previous area */
962                         ifslastp->endoff = end;
963                         return;
964                 }
965                 ifsp = (struct ifsregion *)ckmalloc(sizeof (struct ifsregion));
966                 ifslastp->next = ifsp;
967         }
968         ifslastp = ifsp;
969         ifslastp->next = NULL;
970         ifslastp->begoff = start;
971         ifslastp->endoff = end;
972         ifslastp->inquotes = inquotes;
973 }
974
975
976
977 /*
978  * Break the argument string into pieces based upon IFS and add the
979  * strings to the argument list.  The regions of the string to be
980  * searched for IFS characters have been stored by recordregion.
981  * CTLESC characters are preserved but have little effect in this pass
982  * other than escaping CTL* characters.  In particular, they do not escape
983  * IFS characters: that should be done with the ifsregion mechanism.
984  * CTLQUOTEMARK characters are used to preserve empty quoted strings.
985  * This pass treats them as a regular character, making the string non-empty.
986  * Later, they are removed along with the other CTL* characters.
987  */
988 static void
989 ifsbreakup(char *string, struct arglist *arglist)
990 {
991         struct ifsregion *ifsp;
992         struct strlist *sp;
993         char *start;
994         char *p;
995         char *q;
996         const char *ifs;
997         const char *ifsspc;
998         int had_param_ch = 0;
999
1000         start = string;
1001
1002         if (ifslastp == NULL) {
1003                 /* Return entire argument, IFS doesn't apply to any of it */
1004                 sp = (struct strlist *)stalloc(sizeof *sp);
1005                 sp->text = start;
1006                 *arglist->lastp = sp;
1007                 arglist->lastp = &sp->next;
1008                 return;
1009         }
1010
1011         ifs = ifsset() ? ifsval() : " \t\n";
1012
1013         for (ifsp = &ifsfirst; ifsp != NULL; ifsp = ifsp->next) {
1014                 p = string + ifsp->begoff;
1015                 while (p < string + ifsp->endoff) {
1016                         q = p;
1017                         if (*p == CTLESC)
1018                                 p++;
1019                         if (ifsp->inquotes) {
1020                                 /* Only NULs (should be from "$@") end args */
1021                                 had_param_ch = 1;
1022                                 if (*p != 0) {
1023                                         p++;
1024                                         continue;
1025                                 }
1026                                 ifsspc = NULL;
1027                         } else {
1028                                 if (!strchr(ifs, *p)) {
1029                                         had_param_ch = 1;
1030                                         p++;
1031                                         continue;
1032                                 }
1033                                 ifsspc = strchr(" \t\n", *p);
1034
1035                                 /* Ignore IFS whitespace at start */
1036                                 if (q == start && ifsspc != NULL) {
1037                                         p++;
1038                                         start = p;
1039                                         continue;
1040                                 }
1041                                 had_param_ch = 0;
1042                         }
1043
1044                         /* Save this argument... */
1045                         *q = '\0';
1046                         sp = (struct strlist *)stalloc(sizeof *sp);
1047                         sp->text = start;
1048                         *arglist->lastp = sp;
1049                         arglist->lastp = &sp->next;
1050                         p++;
1051
1052                         if (ifsspc != NULL) {
1053                                 /* Ignore further trailing IFS whitespace */
1054                                 for (; p < string + ifsp->endoff; p++) {
1055                                         q = p;
1056                                         if (*p == CTLESC)
1057                                                 p++;
1058                                         if (strchr(ifs, *p) == NULL) {
1059                                                 p = q;
1060                                                 break;
1061                                         }
1062                                         if (strchr(" \t\n", *p) == NULL) {
1063                                                 p++;
1064                                                 break;
1065                                         }
1066                                 }
1067                         }
1068                         start = p;
1069                 }
1070         }
1071
1072         /*
1073          * Save anything left as an argument.
1074          * Traditionally we have treated 'IFS=':'; set -- x$IFS' as
1075          * generating 2 arguments, the second of which is empty.
1076          * Some recent clarification of the Posix spec say that it
1077          * should only generate one....
1078          */
1079         if (had_param_ch || *start != 0) {
1080                 sp = (struct strlist *)stalloc(sizeof *sp);
1081                 sp->text = start;
1082                 *arglist->lastp = sp;
1083                 arglist->lastp = &sp->next;
1084         }
1085 }
1086
1087
1088 static char expdir[PATH_MAX];
1089 #define expdir_end (expdir + sizeof(expdir))
1090
1091 /*
1092  * Perform pathname generation and remove control characters.
1093  * At this point, the only control characters should be CTLESC and CTLQUOTEMARK.
1094  * The results are stored in the list exparg.
1095  */
1096 static void
1097 expandmeta(struct strlist *str, int flag __unused)
1098 {
1099         char *p;
1100         struct strlist **savelastp;
1101         struct strlist *sp;
1102         char c;
1103         /* TODO - EXP_REDIR */
1104
1105         while (str) {
1106                 if (fflag)
1107                         goto nometa;
1108                 p = str->text;
1109                 for (;;) {                      /* fast check for meta chars */
1110                         if ((c = *p++) == '\0')
1111                                 goto nometa;
1112                         if (c == '*' || c == '?' || c == '[' || c == '!')
1113                                 break;
1114                 }
1115                 savelastp = exparg.lastp;
1116                 INTOFF;
1117                 expmeta(expdir, str->text);
1118                 INTON;
1119                 if (exparg.lastp == savelastp) {
1120                         /*
1121                          * no matches
1122                          */
1123 nometa:
1124                         *exparg.lastp = str;
1125                         rmescapes(str->text);
1126                         exparg.lastp = &str->next;
1127                 } else {
1128                         *exparg.lastp = NULL;
1129                         *savelastp = sp = expsort(*savelastp);
1130                         while (sp->next != NULL)
1131                                 sp = sp->next;
1132                         exparg.lastp = &sp->next;
1133                 }
1134                 str = str->next;
1135         }
1136 }
1137
1138
1139 /*
1140  * Do metacharacter (i.e. *, ?, [...]) expansion.
1141  */
1142
1143 static void
1144 expmeta(char *enddir, char *name)
1145 {
1146         char *p;
1147         char *q;
1148         char *start;
1149         char *endname;
1150         int metaflag;
1151         struct stat statb;
1152         DIR *dirp;
1153         struct dirent *dp;
1154         int atend;
1155         int matchdot;
1156         int esc;
1157
1158         metaflag = 0;
1159         start = name;
1160         for (p = name; esc = 0, *p; p += esc + 1) {
1161                 if (*p == '*' || *p == '?')
1162                         metaflag = 1;
1163                 else if (*p == '[') {
1164                         q = p + 1;
1165                         if (*q == '!' || *q == '^')
1166                                 q++;
1167                         for (;;) {
1168                                 while (*q == CTLQUOTEMARK)
1169                                         q++;
1170                                 if (*q == CTLESC)
1171                                         q++;
1172                                 if (*q == '/' || *q == '\0')
1173                                         break;
1174                                 if (*++q == ']') {
1175                                         metaflag = 1;
1176                                         break;
1177                                 }
1178                         }
1179                 } else if (*p == '!' && p[1] == '!'     && (p == name || p[-1] == '/')) {
1180                         metaflag = 1;
1181                 } else if (*p == '\0')
1182                         break;
1183                 else if (*p == CTLQUOTEMARK)
1184                         continue;
1185                 else {
1186                         if (*p == CTLESC)
1187                                 esc++;
1188                         if (p[esc] == '/') {
1189                                 if (metaflag)
1190                                         break;
1191                                 start = p + esc + 1;
1192                         }
1193                 }
1194         }
1195         if (metaflag == 0) {    /* we've reached the end of the file name */
1196                 if (enddir != expdir)
1197                         metaflag++;
1198                 for (p = name ; ; p++) {
1199                         if (*p == CTLQUOTEMARK)
1200                                 continue;
1201                         if (*p == CTLESC)
1202                                 p++;
1203                         *enddir++ = *p;
1204                         if (*p == '\0')
1205                                 break;
1206                         if (enddir == expdir_end)
1207                                 return;
1208                 }
1209                 if (metaflag == 0 || lstat(expdir, &statb) >= 0)
1210                         addfname(expdir);
1211                 return;
1212         }
1213         endname = p;
1214         if (start != name) {
1215                 p = name;
1216                 while (p < start) {
1217                         while (*p == CTLQUOTEMARK)
1218                                 p++;
1219                         if (*p == CTLESC)
1220                                 p++;
1221                         *enddir++ = *p++;
1222                         if (enddir == expdir_end)
1223                                 return;
1224                 }
1225         }
1226         if (enddir == expdir) {
1227                 p = ".";
1228         } else if (enddir == expdir + 1 && *expdir == '/') {
1229                 p = "/";
1230         } else {
1231                 p = expdir;
1232                 enddir[-1] = '\0';
1233         }
1234         if ((dirp = opendir(p)) == NULL)
1235                 return;
1236         if (enddir != expdir)
1237                 enddir[-1] = '/';
1238         if (*endname == 0) {
1239                 atend = 1;
1240         } else {
1241                 atend = 0;
1242                 *endname = '\0';
1243                 endname += esc + 1;
1244         }
1245         matchdot = 0;
1246         p = start;
1247         while (*p == CTLQUOTEMARK)
1248                 p++;
1249         if (*p == CTLESC)
1250                 p++;
1251         if (*p == '.')
1252                 matchdot++;
1253         while (! int_pending() && (dp = readdir(dirp)) != NULL) {
1254                 if (dp->d_name[0] == '.' && ! matchdot)
1255                         continue;
1256                 if (patmatch(start, dp->d_name, 0)) {
1257                         if (enddir + dp->d_namlen + 1 > expdir_end)
1258                                 continue;
1259                         memcpy(enddir, dp->d_name, dp->d_namlen + 1);
1260                         if (atend)
1261                                 addfname(expdir);
1262                         else {
1263                                 if (enddir + dp->d_namlen + 2 > expdir_end)
1264                                         continue;
1265                                 enddir[dp->d_namlen] = '/';
1266                                 enddir[dp->d_namlen + 1] = '\0';
1267                                 expmeta(enddir + dp->d_namlen + 1, endname);
1268                         }
1269                 }
1270         }
1271         closedir(dirp);
1272         if (! atend)
1273                 endname[-esc - 1] = esc ? CTLESC : '/';
1274 }
1275
1276
1277 /*
1278  * Add a file name to the list.
1279  */
1280
1281 static void
1282 addfname(char *name)
1283 {
1284         char *p;
1285         struct strlist *sp;
1286
1287         p = stalloc(strlen(name) + 1);
1288         scopy(name, p);
1289         sp = (struct strlist *)stalloc(sizeof *sp);
1290         sp->text = p;
1291         *exparg.lastp = sp;
1292         exparg.lastp = &sp->next;
1293 }
1294
1295
1296 /*
1297  * Sort the results of file name expansion.  It calculates the number of
1298  * strings to sort and then calls msort (short for merge sort) to do the
1299  * work.
1300  */
1301
1302 static struct strlist *
1303 expsort(struct strlist *str)
1304 {
1305         int len;
1306         struct strlist *sp;
1307
1308         len = 0;
1309         for (sp = str ; sp ; sp = sp->next)
1310                 len++;
1311         return msort(str, len);
1312 }
1313
1314
1315 static struct strlist *
1316 msort(struct strlist *list, int len)
1317 {
1318         struct strlist *p, *q = NULL;
1319         struct strlist **lpp;
1320         int half;
1321         int n;
1322
1323         if (len <= 1)
1324                 return list;
1325         half = len >> 1;
1326         p = list;
1327         for (n = half ; --n >= 0 ; ) {
1328                 q = p;
1329                 p = p->next;
1330         }
1331         q->next = NULL;                 /* terminate first half of list */
1332         q = msort(list, half);          /* sort first half of list */
1333         p = msort(p, len - half);               /* sort second half */
1334         lpp = &list;
1335         for (;;) {
1336                 if (strcmp(p->text, q->text) < 0) {
1337                         *lpp = p;
1338                         lpp = &p->next;
1339                         if ((p = *lpp) == NULL) {
1340                                 *lpp = q;
1341                                 break;
1342                         }
1343                 } else {
1344                         *lpp = q;
1345                         lpp = &q->next;
1346                         if ((q = *lpp) == NULL) {
1347                                 *lpp = p;
1348                                 break;
1349                         }
1350                 }
1351         }
1352         return list;
1353 }
1354
1355
1356
1357 /*
1358  * Returns true if the pattern matches the string.
1359  */
1360
1361 int
1362 patmatch(const char *pattern, const char *string, int squoted)
1363 {
1364 #ifdef notdef
1365         if (pattern[0] == '!' && pattern[1] == '!')
1366                 return 1 - pmatch(pattern + 2, string);
1367         else
1368 #endif
1369                 return pmatch(pattern, string, squoted);
1370 }
1371
1372
1373 static int
1374 pmatch(const char *pattern, const char *string, int squoted)
1375 {
1376         const char *p, *q;
1377         char c;
1378
1379         p = pattern;
1380         q = string;
1381         for (;;) {
1382                 switch (c = *p++) {
1383                 case '\0':
1384                         goto breakloop;
1385                 case CTLESC:
1386                         if (squoted && *q == CTLESC)
1387                                 q++;
1388                         if (*q++ != *p++)
1389                                 return 0;
1390                         break;
1391                 case CTLQUOTEMARK:
1392                         continue;
1393                 case '?':
1394                         if (squoted && *q == CTLESC)
1395                                 q++;
1396                         if (*q++ == '\0')
1397                                 return 0;
1398                         break;
1399                 case '*':
1400                         c = *p;
1401                         while (c == CTLQUOTEMARK || c == '*')
1402                                 c = *++p;
1403                         if (c != CTLESC &&  c != CTLQUOTEMARK &&
1404                             c != '?' && c != '*' && c != '[') {
1405                                 while (*q != c) {
1406                                         if (squoted && *q == CTLESC &&
1407                                             q[1] == c)
1408                                                 break;
1409                                         if (*q == '\0')
1410                                                 return 0;
1411                                         if (squoted && *q == CTLESC)
1412                                                 q++;
1413                                         q++;
1414                                 }
1415                         }
1416                         do {
1417                                 if (pmatch(p, q, squoted))
1418                                         return 1;
1419                                 if (squoted && *q == CTLESC)
1420                                         q++;
1421                         } while (*q++ != '\0');
1422                         return 0;
1423                 case '[': {
1424                         const char *endp;
1425                         int invert, found;
1426                         char chr;
1427
1428                         endp = p;
1429                         if (*endp == '!' || *endp == '^')
1430                                 endp++;
1431                         for (;;) {
1432                                 while (*endp == CTLQUOTEMARK)
1433                                         endp++;
1434                                 if (*endp == '\0')
1435                                         goto dft;               /* no matching ] */
1436                                 if (*endp == CTLESC)
1437                                         endp++;
1438                                 if (*++endp == ']')
1439                                         break;
1440                         }
1441                         invert = 0;
1442                         if (*p == '!' || *p == '^') {
1443                                 invert++;
1444                                 p++;
1445                         }
1446                         found = 0;
1447                         chr = *q++;
1448                         if (squoted && chr == CTLESC)
1449                                 chr = *q++;
1450                         if (chr == '\0')
1451                                 return 0;
1452                         c = *p++;
1453                         do {
1454                                 if (c == CTLQUOTEMARK)
1455                                         continue;
1456                                 if (c == CTLESC)
1457                                         c = *p++;
1458                                 if (*p == '-' && p[1] != ']') {
1459                                         p++;
1460                                         while (*p == CTLQUOTEMARK)
1461                                                 p++;
1462                                         if (*p == CTLESC)
1463                                                 p++;
1464                                         if (   collate_range_cmp(chr, c) >= 0
1465                                             && collate_range_cmp(chr, *p) <= 0
1466                                            )
1467                                                 found = 1;
1468                                         p++;
1469                                 } else {
1470                                         if (chr == c)
1471                                                 found = 1;
1472                                 }
1473                         } while ((c = *p++) != ']');
1474                         if (found == invert)
1475                                 return 0;
1476                         break;
1477                 }
1478 dft:            default:
1479                         if (squoted && *q == CTLESC)
1480                                 q++;
1481                         if (*q++ != c)
1482                                 return 0;
1483                         break;
1484                 }
1485         }
1486 breakloop:
1487         if (*q != '\0')
1488                 return 0;
1489         return 1;
1490 }
1491
1492
1493
1494 /*
1495  * Remove any CTLESC and CTLQUOTEMARK characters from a string.
1496  */
1497
1498 void
1499 rmescapes(char *str)
1500 {
1501         char *p, *q;
1502
1503         p = str;
1504         while (*p != CTLESC && *p != CTLQUOTEMARK) {
1505                 if (*p++ == '\0')
1506                         return;
1507         }
1508         q = p;
1509         while (*p) {
1510                 if (*p == CTLQUOTEMARK) {
1511                         p++;
1512                         continue;
1513                 }
1514                 if (*p == CTLESC)
1515                         p++;
1516                 *q++ = *p++;
1517         }
1518         *q = '\0';
1519 }
1520
1521
1522
1523 /*
1524  * See if a pattern matches in a case statement.
1525  */
1526
1527 int
1528 casematch(union node *pattern, const char *val)
1529 {
1530         struct stackmark smark;
1531         int result;
1532         char *p;
1533
1534         setstackmark(&smark);
1535         argbackq = pattern->narg.backquote;
1536         STARTSTACKSTR(expdest);
1537         ifslastp = NULL;
1538         argstr(pattern->narg.text, EXP_TILDE | EXP_CASE);
1539         STPUTC('\0', expdest);
1540         p = grabstackstr(expdest);
1541         result = patmatch(p, val, 0);
1542         popstackmark(&smark);
1543         return result;
1544 }
1545
1546 /*
1547  * Our own itoa().
1548  */
1549
1550 static char *
1551 cvtnum(int num, char *buf)
1552 {
1553         char temp[32];
1554         int neg = num < 0;
1555         char *p = temp + 31;
1556
1557         temp[31] = '\0';
1558
1559         do {
1560                 *--p = num % 10 + '0';
1561         } while ((num /= 10) != 0);
1562
1563         if (neg)
1564                 *--p = '-';
1565
1566         while (*p)
1567                 STPUTC(*p++, buf);
1568         return buf;
1569 }
1570
1571 /*
1572  * Do most of the work for wordexp(3).
1573  */
1574
1575 int
1576 wordexpcmd(int argc, char **argv)
1577 {
1578         size_t len;
1579         int i;
1580
1581         out1fmt("%08x", argc - 1);
1582         for (i = 1, len = 0; i < argc; i++)
1583                 len += strlen(argv[i]);
1584         out1fmt("%08x", (int)len);
1585         for (i = 1; i < argc; i++) {
1586                 out1str(argv[i]);
1587                 out1c('\0');
1588         }
1589         return (0);
1590 }