From cac925554ca41dbdf6842096465cf54e74c5409e Mon Sep 17 00:00:00 2001
From: jilles <jilles@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Fri, 30 Jun 2017 21:32:48 +0000
Subject: [PATCH] MFC r315005: sh: Fix executing wrong command with
 ${x#$(y)}$(z).

The parsed internal representation of words consists of a byte string with a
list of nodes (commands in command substitution). Each unescaped CTLBACKQ or
CTLBACKQ | CTLQUOTE byte corresponds to an entry in the list.

If param in ${param#%##%%word} is not set, the word is not expanded (in a
deviation of POSIX shared with other ash variants and ksh93). Erroneously,
the pointer in the list of commands (argbackq) was not advanced. This caused
the wrong command to be executed later if the outer word contained another
command substitution.

Example:
  echo "${unsetvar#$(echo a)}$(echo b)"
wrote "a" but should write "b".


git-svn-id: svn://svn.freebsd.org/base/stable/10@320510 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 bin/sh/expand.c                     | 4 +++-
 bin/sh/tests/expansion/Makefile     | 1 +
 bin/sh/tests/expansion/cmdsubst23.0 | 5 +++++
 3 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 bin/sh/tests/expansion/cmdsubst23.0

diff --git a/bin/sh/expand.c b/bin/sh/expand.c
index f61c10bd2..eb39dcb87 100644
--- a/bin/sh/expand.c
+++ b/bin/sh/expand.c
@@ -740,8 +740,10 @@ again: /* jump here after setting a variable with ${var=text} */
 	case VSTRIMLEFTMAX:
 	case VSTRIMRIGHT:
 	case VSTRIMRIGHTMAX:
-		if (!set)
+		if (!set) {
+			set = 1;
 			break;
+		}
 		/*
 		 * Terminate the string and start recording the pattern
 		 * right after it
diff --git a/bin/sh/tests/expansion/Makefile b/bin/sh/tests/expansion/Makefile
index ecf1084ed..e39355ea4 100644
--- a/bin/sh/tests/expansion/Makefile
+++ b/bin/sh/tests/expansion/Makefile
@@ -43,6 +43,7 @@ FILES+=		cmdsubst19.0
 FILES+=		cmdsubst20.0
 FILES+=		cmdsubst21.0
 FILES+=		cmdsubst22.0
+FILES+=		cmdsubst23.0
 FILES+=		export1.0
 FILES+=		export2.0
 FILES+=		export3.0
diff --git a/bin/sh/tests/expansion/cmdsubst23.0 b/bin/sh/tests/expansion/cmdsubst23.0
new file mode 100644
index 000000000..cde86981f
--- /dev/null
+++ b/bin/sh/tests/expansion/cmdsubst23.0
@@ -0,0 +1,5 @@
+# $FreeBSD$
+
+unset n
+x=abcd
+[ "X${n#$(echo a)}X${x#$(echo ab)}X$(echo abc)X" = XXcdXabcX ]
-- 
2.42.0