posix/wordexp.c

   1 /* POSIX.2 wordexp implementation.
   2    Copyright (C) 1997, 1998 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Library General Public License as
   8    published by the Free Software Foundation; either version 2 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Library General Public License for more details.
  15
  16    You should have received a copy of the GNU Library General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 #include <wordexp.h>
  22 #include <signal.h>
  23 #include <stdlib.h>
  24 #include <pwd.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <glob.h>
  28 #include <ctype.h>
  29 #include <sys/time.h>
  30 #include <sys/types.h>
  31 #include <sys/wait.h>
  32 #include <unistd.h>
  33 #include <fcntl.h>
  34 #include <sys/stat.h>
  35 #include <paths.h>
  36 #include <errno.h>
  37 #include <sys/param.h>
  38 #include <stdio.h>
  39 #include <fnmatch.h>
  40
  41 #include <stdio-common/_itoa.h>
  42
  43 /* Undefine the following line for the production version.  */
  44 /* #define NDEBUG 1 */
  45 #include <assert.h>
  46
  47 /*
  48  * This is a recursive-descent-style word expansion routine.
  49  */
  50
  51 /* These variables are defined and initialized in the startup code.  */
  52 extern int __libc_argc;
  53 extern char **__libc_argv;
  54
  55 /* Some forward declarations */
  56 static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
  57                           const char *words, size_t *offset, int flags,
  58                           wordexp_t *pwordexp, const char *ifs,
  59                           const char *ifs_white, int quoted)
  60      internal_function;
  61 static int parse_backtick (char **word, size_t *word_length,
  62                            size_t *max_length, const char *words,
  63                            size_t *offset, int flags, wordexp_t *pwordexp,
  64                            const char *ifs, const char *ifs_white)
  65      internal_function;
  66 static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
  67                          const char *words, size_t *offset, int flags,
  68                          wordexp_t *pwordexp, const char *ifs,
  69                          const char *ifs_white)
  70      internal_function;
  71 static int eval_expr (char *expr, long int *result) internal_function;
  72
  73 /* The w_*() functions manipulate word lists. */
  74
  75 #define W_CHUNK (100)
  76
  77 static inline char *
  78 w_newword (size_t *actlen, size_t *maxlen)
  79 {
  80   *actlen = *maxlen = 0;
  81   return NULL;
  82 }
  83
  84 static inline char *
  85 w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
  86      /* (lengths exclude trailing zero) */
  87 {
  88   /* Add a character to the buffer, allocating room for it if needed.
  89    */
  90
  91   if (*actlen == *maxlen)
  92     {
  93       char *old_buffer = buffer;
  94       assert (buffer == NULL || *maxlen != 0);
  95       *maxlen += W_CHUNK;
  96       buffer = realloc (buffer, 1 + *maxlen);
  97
  98       if (buffer == NULL)
  99         free (old_buffer);
 100     }
 101
 102   if (buffer != NULL)
 103     {
 104       buffer[*actlen] = ch;
 105       buffer[++(*actlen)] = '\0';
 106     }
 107
 108   return buffer;
 109 }
 110
 111 static char *
 112 internal_function
 113 w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
 114           size_t len)
 115 {
 116   /* Add a string to the buffer, allocating room for it if needed.
 117    */
 118   if (*actlen + len > *maxlen)
 119     {
 120       char *old_buffer = buffer;
 121       assert (buffer == NULL || *maxlen != 0);
 122       *maxlen += MAX (2 * len, W_CHUNK);
 123       buffer = realloc (old_buffer, 1 + *maxlen);
 124
 125       if (buffer == NULL)
 126         free (old_buffer);
 127     }
 128
 129   if (buffer != NULL)
 130     {
 131       *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
 132       *actlen += len;
 133     }
 134
 135   return buffer;
 136 }
 137
 138
 139 static char *
 140 internal_function
 141 w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
 142      /* (lengths exclude trailing zero) */
 143 {
 144   /* Add a string to the buffer, allocating room for it if needed.
 145    */
 146   size_t len;
 147
 148   assert (str != NULL); /* w_addstr only called from this file */
 149   len = strlen (str);
 150
 151   return w_addmem (buffer, actlen, maxlen, str, len);
 152 }
 153
 154 static int
 155 internal_function
 156 w_addword (wordexp_t *pwordexp, char *word)
 157 {
 158   /* Add a word to the wordlist */
 159   size_t num_p;
 160   char **new_wordv;
 161
 162   num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
 163   new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
 164   if (new_wordv != NULL)
 165     {
 166       pwordexp->we_wordv = new_wordv;
 167       pwordexp->we_wordv[pwordexp->we_wordc++] = word;
 168       pwordexp->we_wordv[pwordexp->we_wordc] = NULL;
 169       return 0;
 170     }
 171
 172   return WRDE_NOSPACE;
 173 }
 174
 175 /* The parse_*() functions should leave *offset being the offset in 'words'
 176  * to the last character processed.
 177  */
 178
 179 static int
 180 internal_function
 181 parse_backslash (char **word, size_t *word_length, size_t *max_length,
 182                  const char *words, size_t *offset)
 183 {
 184   /* We are poised _at_ a backslash, not in quotes */
 185
 186   switch (words[1 + *offset])
 187     {
 188     case 0:
 189       /* Backslash is last character of input words */
 190       return WRDE_SYNTAX;
 191
 192     case '\n':
 193       ++(*offset);
 194       break;
 195
 196     default:
 197       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 198       if (*word == NULL)
 199         return WRDE_NOSPACE;
 200
 201       ++(*offset);
 202       break;
 203     }
 204
 205   return 0;
 206 }
 207
 208 static int
 209 internal_function
 210 parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
 211                      const char *words, size_t *offset)
 212 {
 213   /* We are poised _at_ a backslash, inside quotes */
 214
 215   switch (words[1 + *offset])
 216     {
 217     case 0:
 218       /* Backslash is last character of input words */
 219       return WRDE_SYNTAX;
 220
 221     case '\n':
 222       ++(*offset);
 223       break;
 224
 225     case '$':
 226     case '`':
 227     case '"':
 228     case '\\':
 229       *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 230       if (*word == NULL)
 231         return WRDE_NOSPACE;
 232
 233       ++(*offset);
 234       break;
 235
 236     default:
 237       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 238       if (*word != NULL)
 239         *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
 240
 241       if (*word == NULL)
 242         return WRDE_NOSPACE;
 243
 244       ++(*offset);
 245       break;
 246     }
 247
 248   return 0;
 249 }
 250
 251 static int
 252 internal_function
 253 parse_tilde (char **word, size_t *word_length, size_t *max_length,
 254              const char *words, size_t *offset, size_t wordc)
 255 {
 256   /* We are poised _at_ a tilde */
 257   size_t i;
 258
 259   if (*word_length != 0)
 260     {
 261       if (!((*word)[*word_length - 1] == '=' && wordc == 0))
 262         {
 263           if (!((*word)[*word_length - 1] == ':'
 264                 && strchr (*word, '=') && wordc == 0))
 265             {
 266               *word = w_addchar (*word, word_length, max_length, '~');
 267               return *word ? 0 : WRDE_NOSPACE;
 268             }
 269         }
 270     }
 271
 272   for (i = 1 + *offset; words[i]; i++)
 273     {
 274       if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
 275           words[i] == '\t' || words[i] == 0 )
 276         break;
 277
 278       if (words[i] == '\\')
 279         {
 280           *word = w_addchar (*word, word_length, max_length, '~');
 281           return *word ? 0 : WRDE_NOSPACE;
 282         }
 283     }
 284
 285   if (i == 1 + *offset)
 286     {
 287       /* Tilde appears on its own */
 288       uid_t uid;
 289       struct passwd pwd, *tpwd;
 290       int buflen = 1000;
 291       char* buffer = __alloca (buflen);
 292       int result;
 293
 294       uid = __getuid ();
 295
 296       while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
 297              && errno == ERANGE)
 298         {
 299           buflen += 1000;
 300           buffer = __alloca (buflen);
 301         }
 302
 303       if (result == 0 && pwd.pw_dir != NULL)
 304         {
 305           *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 306           if (*word == NULL)
 307             return WRDE_NOSPACE;
 308         }
 309       else
 310         {
 311           *word = w_addchar (*word, word_length, max_length, '~');
 312           if (*word == NULL)
 313             return WRDE_NOSPACE;
 314         }
 315     }
 316   else
 317     {
 318       /* Look up user name in database to get home directory */
 319       char *user = __strndup (&words[1 + *offset], i - *offset);
 320       struct passwd pwd, *tpwd;
 321       int buflen = 1000;
 322       char* buffer = __alloca (buflen);
 323       int result;
 324
 325       while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
 326              && errno == ERANGE)
 327         {
 328           buflen += 1000;
 329           buffer = __alloca (buflen);
 330         }
 331
 332       if (result == 0 && pwd.pw_dir)
 333         *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
 334       else
 335         {
 336           /* (invalid login name) */
 337           *word = w_addchar (*word, word_length, max_length, '~');
 338           if (*word != NULL)
 339             *word = w_addstr (*word, word_length, max_length, user);
 340         }
 341
 342       *offset = i - 1;
 343     }
 344   return *word ? 0 : WRDE_NOSPACE;
 345 }
 346
 347
 348 static int
 349 internal_function
 350 do_parse_glob (const char *glob_word, char **word, size_t *word_length,
 351                size_t *max_length, wordexp_t *pwordexp, const char *ifs,
 352                const char *ifs_white)
 353 {
 354   int error;
 355   int match;
 356   glob_t globbuf;
 357
 358   error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
 359
 360   if (error != 0)
 361     {
 362       /* We can only run into memory problems.  */
 363       assert (error == GLOB_NOSPACE);
 364       return WRDE_NOSPACE;
 365     }
 366
 367   if (ifs && !*ifs)
 368     {
 369       /* No field splitting allowed. */
 370       assert (globbuf.gl_pathv[0] != NULL);
 371       *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
 372       for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
 373         {
 374           *word = w_addchar (*word, word_length, max_length, ' ');
 375           if (*word != NULL)
 376             *word = w_addstr (*word, word_length, max_length,
 377                               globbuf.gl_pathv[match]);
 378         }
 379
 380       globfree (&globbuf);
 381       return *word ? 0 : WRDE_NOSPACE;
 382     }
 383
 384   assert (ifs == NULL || *ifs != '\0');
 385   if (*word != NULL)
 386     {
 387       free (*word);
 388       *word = w_newword (word_length, max_length);
 389     }
 390
 391   for (match = 0; match < globbuf.gl_pathc; ++match)
 392     {
 393       char *matching_word = __strdup (globbuf.gl_pathv[match]);
 394       if (matching_word == NULL || w_addword (pwordexp, matching_word))
 395         {
 396           globfree (&globbuf);
 397           return WRDE_NOSPACE;
 398         }
 399     }
 400
 401   globfree (&globbuf);
 402   return 0;
 403 }
 404
 405 static int
 406 internal_function
 407 parse_glob (char **word, size_t *word_length, size_t *max_length,
 408             const char *words, size_t *offset, int flags,
 409             wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
 410 {
 411   /* We are poised just after a '*', a '[' or a '?'. */
 412   int error = WRDE_NOSPACE;
 413   int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
 414   int i;
 415   wordexp_t glob_list; /* List of words to glob */
 416
 417   glob_list.we_wordc = 0;
 418   glob_list.we_wordv = NULL;
 419   glob_list.we_offs = 0;
 420   for (; words[*offset] != '\0'; ++*offset)
 421     {
 422       if ((ifs && strchr (ifs, words[*offset])) ||
 423           (!ifs && strchr (" \t\n", words[*offset])))
 424         /* Reached IFS */
 425         break;
 426
 427       /* Sort out quoting */
 428       if (words[*offset] == '\'')
 429         {
 430           if (quoted == 0)
 431             {
 432               quoted = 1;
 433               continue;
 434             }
 435           else if (quoted == 1)
 436             {
 437               quoted = 0;
 438               continue;
 439             }
 440         }
 441       else if (words[*offset] == '"')
 442         {
 443           if (quoted == 0)
 444             {
 445               quoted = 2;
 446               continue;
 447             }
 448           else if (quoted == 2)
 449             {
 450               quoted = 0;
 451               continue;
 452             }
 453         }
 454
 455       /* Sort out other special characters */
 456       if (quoted != 1 && words[*offset] == '$')
 457         {
 458           error = parse_dollars (word, word_length, max_length, words,
 459                                  offset, flags, &glob_list, ifs, ifs_white,
 460                                  quoted == 2);
 461           if (error)
 462             goto tidy_up;
 463
 464           continue;
 465         }
 466       else if (words[*offset] == '\\')
 467         {
 468           if (quoted)
 469             error = parse_qtd_backslash (word, word_length, max_length,
 470                                          words, offset);
 471           else
 472             error = parse_backslash (word, word_length, max_length,
 473                                      words, offset);
 474
 475           if (error)
 476             goto tidy_up;
 477
 478           continue;
 479         }
 480
 481       *word = w_addchar (*word, word_length, max_length, words[*offset]);
 482       if (*word == NULL)
 483         goto tidy_up;
 484     }
 485
 486   /* Don't forget to re-parse the character we stopped at. */
 487   --*offset;
 488
 489   /* Glob the words */
 490   error = w_addword (&glob_list, *word);
 491   *word = w_newword (word_length, max_length);
 492   for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
 493     error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
 494                            max_length, pwordexp, ifs, ifs_white);
 495
 496   /* Now tidy up */
 497 tidy_up:
 498   wordfree (&glob_list);
 499   return error;
 500 }
 501
 502 static int
 503 internal_function
 504 parse_squote (char **word, size_t *word_length, size_t *max_length,
 505               const char *words, size_t *offset)
 506 {
 507   /* We are poised just after a single quote */
 508   for (; words[*offset]; ++(*offset))
 509     {
 510       if (words[*offset] != '\'')
 511         {
 512           *word = w_addchar (*word, word_length, max_length, words[*offset]);
 513           if (*word == NULL)
 514             return WRDE_NOSPACE;
 515         }
 516       else return 0;
 517     }
 518
 519   /* Unterminated string */
 520   return WRDE_SYNTAX;
 521 }
 522
 523 /* Functions to evaluate an arithmetic expression */
 524 static int
 525 internal_function
 526 eval_expr_val (char **expr, long int *result)
 527 {
 528   int sgn = +1;
 529   char *digit;
 530
 531   /* Skip white space */
 532   for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
 533
 534   switch (*digit)
 535     {
 536     case '(':
 537
 538       /* Scan for closing paren */
 539       for (++digit; **expr && **expr != ')'; ++(*expr));
 540
 541       /* Is there one? */
 542       if (!**expr)
 543         return WRDE_SYNTAX;
 544
 545       *(*expr)++ = 0;
 546
 547       if (eval_expr (digit, result))
 548         return WRDE_SYNTAX;
 549
 550       return 0;
 551
 552     case '+':   /* Positive value */
 553       ++digit;
 554       break;
 555
 556     case '-':   /* Negative value */
 557       ++digit;
 558       sgn = -1;
 559       break;
 560
 561     default:
 562       if (!isdigit (*digit))
 563         return WRDE_SYNTAX;
 564     }
 565
 566   *result = 0;
 567   for (; *digit && isdigit (*digit); ++digit)
 568     *result = (*result * 10) + (*digit - '0');
 569
 570   *expr = digit;
 571   *result *= sgn;
 572   return 0;
 573 }
 574
 575 static int
 576 internal_function
 577 eval_expr_multdiv (char **expr, long int *result)
 578 {
 579   long int arg;
 580
 581   /* Read a Value */
 582   if (eval_expr_val (expr, result) != 0)
 583     return WRDE_SYNTAX;
 584
 585   while (**expr)
 586     {
 587       /* Skip white space */
 588       for (; *expr && **expr && isspace (**expr); ++(*expr));
 589
 590       if (**expr == '*')
 591         {
 592           ++(*expr);
 593           if (eval_expr_val (expr, &arg) != 0)
 594             return WRDE_SYNTAX;
 595
 596           *result *= arg;
 597         }
 598       else if (**expr == '/')
 599         {
 600           ++(*expr);
 601           if (eval_expr_val (expr, &arg) != 0)
 602             return WRDE_SYNTAX;
 603
 604           *result /= arg;
 605         }
 606       else break;
 607     }
 608
 609   return 0;
 610 }
 611
 612 static int
 613 internal_function
 614 eval_expr (char *expr, long int *result)
 615 {
 616   long int arg;
 617
 618   /* Read a Multdiv */
 619   if (eval_expr_multdiv (&expr, result) != 0)
 620     return WRDE_SYNTAX;
 621
 622   while (*expr)
 623     {
 624       /* Skip white space */
 625       for (; expr && *expr && isspace (*expr); ++expr);
 626
 627       if (*expr == '+')
 628         {
 629           ++expr;
 630           if (eval_expr_multdiv (&expr, &arg) != 0)
 631             return WRDE_SYNTAX;
 632
 633           *result += arg;
 634         }
 635       else if (*expr == '-')
 636         {
 637           ++expr;
 638           if (eval_expr_multdiv (&expr, &arg) != 0)
 639             return WRDE_SYNTAX;
 640
 641           *result -= arg;
 642         }
 643       else break;
 644     }
 645
 646   return 0;
 647 }
 648
 649 static int
 650 internal_function
 651 parse_arith (char **word, size_t *word_length, size_t *max_length,
 652              const char *words, size_t *offset, int flags, int bracket)
 653 {
 654   /* We are poised just after "$((" or "$[" */
 655   int error;
 656   int paren_depth = 1;
 657   size_t expr_length;
 658   size_t expr_maxlen;
 659   char *expr;
 660
 661   expr = w_newword (&expr_length, &expr_maxlen);
 662   for (; words[*offset]; ++(*offset))
 663     {
 664       switch (words[*offset])
 665         {
 666         case '$':
 667           error = parse_dollars (&expr, &expr_length, &expr_maxlen,
 668                                  words, offset, flags, NULL, NULL, NULL, 1);
 669           /* The ``1'' here is to tell parse_dollars not to
 670            * split the fields.
 671            */
 672           if (error)
 673             {
 674               free (expr);
 675               return error;
 676             }
 677           break;
 678
 679         case '`':
 680           (*offset)++;
 681           error = parse_backtick (&expr, &expr_length, &expr_maxlen,
 682                                   words, offset, flags, NULL, NULL, NULL);
 683           /* The first NULL here is to tell parse_backtick not to
 684            * split the fields.
 685            */
 686           if (error)
 687             {
 688               free (expr);
 689               return error;
 690             }
 691           break;
 692
 693         case '\\':
 694           error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
 695                                        words, offset);
 696           if (error)
 697             {
 698               free (expr);
 699               return error;
 700             }
 701           /* I think that a backslash within an
 702            * arithmetic expansion is bound to
 703            * cause an error sooner or later anyway though.
 704            */
 705           break;
 706
 707         case ')':
 708           if (--paren_depth == 0)
 709             {
 710               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 711               long int numresult = 0;
 712               long long int convertme;
 713
 714               if (bracket || words[1 + *offset] != ')')
 715                 return WRDE_SYNTAX;
 716
 717               ++(*offset);
 718
 719               /* Go - evaluate. */
 720               if (*expr && eval_expr (expr, &numresult) != 0)
 721                 return WRDE_SYNTAX;
 722
 723               if (numresult < 0)
 724                 {
 725                   convertme = -numresult;
 726                   *word = w_addchar (*word, word_length, max_length, '-');
 727                   if (!*word)
 728                     {
 729                       free (expr);
 730                       return WRDE_NOSPACE;
 731                     }
 732                 }
 733               else
 734                 convertme = numresult;
 735
 736               result[20] = '\0';
 737               *word = w_addstr (*word, word_length, max_length,
 738                                 _itoa (convertme, &result[20], 10, 0));
 739               free (expr);
 740               return *word ? 0 : WRDE_NOSPACE;
 741             }
 742           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 743           if (expr == NULL)
 744             return WRDE_NOSPACE;
 745
 746           break;
 747
 748         case ']':
 749           if (bracket && paren_depth == 1)
 750             {
 751               char result[21];  /* 21 = ceil(log10(2^64)) + 1 */
 752               long int numresult = 0;
 753
 754               /* Go - evaluate. */
 755               if (*expr && eval_expr (expr, &numresult) != 0)
 756                 return WRDE_SYNTAX;
 757
 758               result[20] = '\0';
 759               *word = w_addstr (*word, word_length, max_length,
 760                                 _itoa_word (numresult, &result[20], 10, 0));
 761               free (expr);
 762               return *word ? 0 : WRDE_NOSPACE;
 763             }
 764
 765           free (expr);
 766           return WRDE_SYNTAX;
 767
 768         case '\n':
 769         case ';':
 770         case '{':
 771         case '}':
 772           free (expr);
 773           return WRDE_BADCHAR;
 774
 775         case '(':
 776           ++paren_depth;
 777         default:
 778           expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
 779           if (expr == NULL)
 780             return WRDE_NOSPACE;
 781         }
 782     }
 783
 784   /* Premature end */
 785   free (expr);
 786   return WRDE_SYNTAX;
 787 }
 788
 789 /* Function to execute a command and retrieve the results */
 790 /* pwordexp contains NULL if field-splitting is forbidden */
 791 static int
 792 internal_function
 793 exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
 794            int flags, wordexp_t *pwordexp, const char *ifs,
 795            const char *ifs_white)
 796 {
 797   int fildes[2];
 798   int bufsize = 128;
 799   int buflen;
 800   int i;
 801   char *buffer;
 802   pid_t pid;
 803
 804   /* Don't fork() unless necessary */
 805   if (!comm || !*comm)
 806     return 0;
 807
 808   if (__pipe (fildes))
 809     /* Bad */
 810     return WRDE_NOSPACE;
 811
 812   if ((pid = __fork ()) < 0)
 813     {
 814       /* Bad */
 815       return WRDE_NOSPACE;
 816     }
 817
 818   if (pid == 0)
 819     {
 820       /* Child */
 821       const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
 822
 823       /* Redirect output.  */
 824       __dup2 (fildes[1], 1);
 825       __close (fildes[1]);
 826
 827       /* Redirect stderr to /dev/null if we have to.  */
 828       if ((flags & WRDE_SHOWERR) == 0)
 829         {
 830           int fd;
 831           __close (2);
 832           fd = __open (_PATH_DEVNULL, O_WRONLY);
 833           if (fd >= 0 && fd != 2)
 834             {
 835               __dup2 (fd, 2);
 836               __close (fd);
 837             }
 838         }
 839
 840       __close (fildes[0]);
 841       __execve (_PATH_BSHELL, (char *const *) args, __environ);
 842
 843       /* Bad.  What now?  */
 844       abort ();
 845     }
 846
 847   /* Parent */
 848
 849   __close (fildes[1]);
 850   buffer = __alloca (bufsize);
 851
 852   if (!pwordexp)
 853     { /* Quoted - no field splitting */
 854
 855       while (1)
 856         {
 857           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 858             {
 859               if (__waitpid (pid, NULL, WNOHANG) == 0)
 860                 continue;
 861               if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 862                 break;
 863             }
 864
 865           *word = w_addmem (*word, word_length, max_length, buffer, buflen);
 866           if (*word == NULL)
 867             {
 868               __kill (pid, SIGKILL);
 869               __waitpid (pid, NULL, 0);
 870               __close (fildes[0]);
 871               return WRDE_NOSPACE;
 872             }
 873         }
 874     }
 875   else
 876     /* Not quoted - split fields */
 877     {
 878       int copying = 0;
 879       /* 'copying' is:
 880        *  0 when searching for first character in a field not IFS white space
 881        *  1 when copying the text of a field
 882        *  2 when searching for possible non-whitespace IFS
 883        */
 884
 885       while (1)
 886         {
 887           if ((buflen = __read (fildes[0], buffer, bufsize)) < 1)
 888             {
 889               if (__waitpid (pid, NULL, WNOHANG) == 0)
 890                 continue;
 891               if ((__read (fildes[0], buffer, bufsize)) < 1)
 892                 break;
 893             }
 894
 895           for (i = 0; i < buflen; ++i)
 896             {
 897               if (strchr (ifs, buffer[i]) != NULL)
 898                 {
 899                   /* Current character is IFS */
 900                   if (strchr (ifs_white, buffer[i]) == NULL)
 901                     {
 902                       /* Current character is IFS but not whitespace */
 903                       if (copying == 2)
 904                         {
 905                           /*            current character
 906                            *                   |
 907                            *                   V
 908                            * eg: text<space><comma><space>moretext
 909                            *
 910                            * So, strip whitespace IFS (like at the start)
 911                            */
 912                           copying = 0;
 913                           continue;
 914                         }
 915
 916                       copying = 0;
 917                       /* fall through and delimit field.. */
 918                     }
 919                   else
 920                     {
 921                       /* Current character is IFS white space */
 922
 923                       /* If not copying a field, ignore it */
 924                       if (copying != 1)
 925                         continue;
 926
 927                       /* End of field (search for non-IFS afterwards) */
 928                       copying = 2;
 929                     }
 930
 931                   /* First IFS white space, or IFS non-whitespace.
 932                    * Delimit the field. */
 933                   if (!*word)
 934                     {
 935                       /* This field is null, so make it an empty string */
 936                       *word = w_addchar (*word, word_length, max_length, 0);
 937                       if (*word == NULL)
 938                         {
 939                           __kill (pid, SIGKILL);
 940                           __waitpid (pid, NULL, 0);
 941                           __close (fildes[0]);
 942                           return WRDE_NOSPACE;
 943                         }
 944                     }
 945
 946                   if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
 947                     {
 948                       __kill (pid, SIGKILL);
 949                       __waitpid (pid, NULL, 0);
 950                       __close (fildes[0]);
 951                       return WRDE_NOSPACE;
 952                     }
 953
 954                   *word = w_newword (word_length, max_length);
 955                   /* fall back round the loop.. */
 956                 }
 957               else
 958                 {
 959                   /* Not IFS character */
 960                   copying = 1;
 961                   *word = w_addchar (*word, word_length, max_length,
 962                                      buffer[i]);
 963                   if (*word == NULL)
 964                     {
 965                       __kill (pid, SIGKILL);
 966                       __waitpid (pid, NULL, 0);
 967                       __close (fildes[0]);
 968                       return WRDE_NOSPACE;
 969                     }
 970                 }
 971             }
 972         }
 973     }
 974
 975   /* Bash chops off trailing newlines, which seems sensible.  */
 976   while (*word_length > 0 && (*word)[*word_length - 1] == '\n')
 977     (*word)[--*word_length] = '\0';
 978
 979   __close (fildes[0]);
 980   return 0;
 981 }
 982
 983 static int
 984 internal_function
 985 parse_comm (char **word, size_t *word_length, size_t *max_length,
 986             const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
 987             const char *ifs, const char *ifs_white)
 988 {
 989   /* We are poised just after "$(" */
 990   int paren_depth = 1;
 991   int error = 0;
 992   int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
 993   size_t comm_length;
 994   size_t comm_maxlen;
 995   char *comm = w_newword (&comm_length, &comm_maxlen);
 996
 997   for (; words[*offset]; ++(*offset))
 998     {
 999       switch (words[*offset])
1000         {
1001         case '\'':
1002           if (quoted == 0)
1003             quoted = 1;
1004           else if (quoted == 1)
1005             quoted = 0;
1006
1007           break;
1008
1009         case '"':
1010           if (quoted == 0)
1011             quoted = 2;
1012           else if (quoted == 2)
1013             quoted = 0;
1014
1015           break;
1016
1017         case ')':
1018           if (!quoted && --paren_depth == 0)
1019             {
1020               /* Go -- give script to the shell */
1021               if (comm)
1022                 {
1023                   error = exec_comm (comm, word, word_length, max_length,
1024                                      flags, pwordexp, ifs, ifs_white);
1025                   free (comm);
1026                 }
1027
1028               return error;
1029             }
1030
1031           /* This is just part of the script */
1032           break;
1033
1034         case '(':
1035           if (!quoted)
1036             ++paren_depth;
1037         }
1038
1039       comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1040       if (comm == NULL)
1041         return WRDE_NOSPACE;
1042     }
1043
1044   /* Premature end */
1045   if (comm)
1046     free (comm);
1047
1048   return WRDE_SYNTAX;
1049 }
1050
1051 static int
1052 internal_function
1053 parse_param (char **word, size_t *word_length, size_t *max_length,
1054              const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1055              const char *ifs, const char *ifs_white, int quoted)
1056 {
1057   /* We are poised just after "$" */
1058   enum action
1059   {
1060     ACT_NONE,
1061     ACT_RP_SHORT_LEFT = '#',
1062     ACT_RP_LONG_LEFT = 'L',
1063     ACT_RP_SHORT_RIGHT = '%',
1064     ACT_RP_LONG_RIGHT = 'R',
1065     ACT_NULL_ERROR = '?',
1066     ACT_NULL_SUBST = '-',
1067     ACT_NONNULL_SUBST = '+',
1068     ACT_NULL_ASSIGN = '='
1069   };
1070   size_t env_length;
1071   size_t env_maxlen;
1072   size_t pat_length;
1073   size_t pat_maxlen;
1074   size_t start = *offset;
1075   char *env;
1076   char *pattern;
1077   char *value = NULL;
1078   enum action action = ACT_NONE;
1079   int depth = 0;
1080   int colon_seen = 0;
1081   int seen_hash = 0;
1082   int free_value = 0;
1083   int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1084   int error;
1085   int special = 0;
1086   char buffer[21];
1087   int brace = words[*offset] == '{';
1088
1089   env = w_newword (&env_length, &env_maxlen);
1090   pattern = w_newword (&pat_length, &pat_maxlen);
1091
1092   if (brace)
1093     ++*offset;
1094
1095   /* First collect the parameter name. */
1096
1097   if (words[*offset] == '#')
1098     {
1099       seen_hash = 1;
1100       if (!brace)
1101         goto envsubst;
1102       ++*offset;
1103     }
1104
1105   if (isalpha (words[*offset]) || words[*offset] == '_')
1106     {
1107       /* Normal parameter name. */
1108       do
1109         {
1110           env = w_addchar (env, &env_length, &env_maxlen,
1111                            words[*offset]);
1112           if (env == NULL)
1113             goto no_space;
1114         }
1115       while (isalnum (words[++*offset]) || words[*offset] == '_');
1116     }
1117   else if (isdigit (words[*offset]))
1118     {
1119       /* Numeric parameter name. */
1120       special = 1;
1121       do
1122         {
1123           env = w_addchar (env, &env_length, &env_maxlen,
1124                            words[*offset]);
1125           if (env == NULL)
1126             goto no_space;
1127           if (!brace)
1128             goto envsubst;
1129         }
1130       while (isdigit(words[++*offset]));
1131     }
1132   else if (strchr ("*@$", words[*offset]) != NULL)
1133     {
1134       /* Special parameter. */
1135       special = 1;
1136       env = w_addchar (env, &env_length, &env_maxlen,
1137                        words[*offset]);
1138       if (env == NULL)
1139         goto no_space;
1140       ++*offset;
1141     }
1142   else
1143     {
1144       if (brace)
1145         goto syntax;
1146     }
1147
1148   if (brace)
1149     {
1150       /* Check for special action to be applied to the value. */
1151       switch (words[*offset])
1152         {
1153         case '}':
1154           /* Evaluate. */
1155           goto envsubst;
1156
1157         case '#':
1158           action = ACT_RP_SHORT_LEFT;
1159           if (words[1 + *offset] == '#')
1160             {
1161               ++*offset;
1162               action = ACT_RP_LONG_LEFT;
1163             }
1164           break;
1165
1166         case '%':
1167           action = ACT_RP_SHORT_RIGHT;
1168           if (words[1 + *offset] == '%')
1169             {
1170               ++*offset;
1171               action = ACT_RP_LONG_RIGHT;
1172             }
1173           break;
1174
1175         case ':':
1176           if (strchr ("-=?+", words[1 + *offset]) == NULL)
1177             goto syntax;
1178
1179           colon_seen = 1;
1180           action = words[++*offset];
1181           break;
1182
1183         case '-':
1184         case '=':
1185         case '?':
1186         case '+':
1187           action = words[*offset];
1188           break;
1189
1190         default:
1191           goto syntax;
1192         }
1193
1194       /* Now collect the pattern. */
1195       ++*offset;
1196       for (; words[*offset]; ++(*offset))
1197         {
1198           switch (words[*offset])
1199             {
1200             case '{':
1201               if (!pattern_is_quoted)
1202                 ++depth;
1203               break;
1204
1205             case '}':
1206               if (!pattern_is_quoted)
1207                 {
1208                   if (depth == 0)
1209                     goto envsubst;
1210                   --depth;
1211                 }
1212               break;
1213
1214             case '\\':
1215               if (!pattern_is_quoted && words[++*offset] == '\0')
1216                 goto syntax;
1217               break;
1218
1219             case '\'':
1220               if (pattern_is_quoted == 0)
1221                 pattern_is_quoted = 1;
1222               else if (pattern_is_quoted == 1)
1223                 pattern_is_quoted = 0;
1224
1225               break;
1226
1227             case '"':
1228               if (pattern_is_quoted == 0)
1229                 pattern_is_quoted = 2;
1230               else if (pattern_is_quoted == 2)
1231                 pattern_is_quoted = 0;
1232
1233               break;
1234             }
1235
1236           pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1237                                words[*offset]);
1238           if (pattern == NULL)
1239             goto no_space;
1240         }
1241     }
1242
1243   /* End of input string -- remember to reparse the character that we
1244    * stopped at.  */
1245   --(*offset);
1246
1247 envsubst:
1248   if (words[start] == '{' && words[*offset] != '}')
1249     goto syntax;
1250
1251   if (env == NULL)
1252     {
1253       if (seen_hash)
1254         {
1255           /* $# expands to the number of positional parameters */
1256           buffer[20] = '\0';
1257           value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1258           seen_hash = 0;
1259         }
1260       else
1261         {
1262           /* Just $ on its own */
1263           *offset = start - 1;
1264           *word = w_addchar (*word, word_length, max_length, '$');
1265           return *word ? 0 : WRDE_NOSPACE;
1266         }
1267     }
1268   /* Is it a numeric parameter? */
1269   else if (isdigit (env[0]))
1270     {
1271       int n = atoi (env);
1272
1273       if (n >= __libc_argc)
1274         /* Substitute NULL. */
1275         value = NULL;
1276       else
1277         /* Replace with appropriate positional parameter. */
1278         value = __libc_argv[n];
1279     }
1280   /* Is it a special parameter? */
1281   else if (special)
1282     {
1283       /* Is it `$$'? */
1284       if (*env == '$')
1285         {
1286           buffer[20] = '\0';
1287           value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1288         }
1289       /* Is it `${#*}' or `${#@}'? */
1290       else if ((*env == '*' || *env == '@') && seen_hash)
1291         {
1292           buffer[20] = '\0';
1293           value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1294                               &buffer[20], 10, 0);
1295           *word = w_addstr (*word, word_length, max_length, value);
1296           free (env);
1297           return *word ? 0 : WRDE_NOSPACE;
1298         }
1299       /* Is it `$*' or `$@' (unquoted) ? */
1300       else if (*env == '*' || (*env == '@' && !quoted))
1301         {
1302           size_t plist_len = 0;
1303           int p;
1304           char *end;
1305
1306           /* Build up value parameter by parameter (copy them) */
1307           for (p = 1; __libc_argv[p]; ++p)
1308             plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1309           value = malloc (plist_len);
1310           if (value == NULL)
1311             goto no_space;
1312           end = value;
1313           *end = 0;
1314           for (p = 1; __libc_argv[p]; ++p)
1315             {
1316               if (p > 1)
1317                 *end++ = ' ';
1318               end = __stpcpy (end, __libc_argv[p]);
1319             }
1320
1321           free_value = 1;
1322         }
1323       else
1324         {
1325           /* Must be a quoted `$@' */
1326           assert (*env == '@' && quoted);
1327
1328           /* Each parameter is a separate word ("$@") */
1329           if (__libc_argc == 2)
1330             value = __libc_argv[1];
1331           else if (__libc_argc > 2)
1332             {
1333               int p;
1334
1335               /* Append first parameter to current word. */
1336               value = w_addstr (*word, word_length, max_length,
1337                                 __libc_argv[1]);
1338               if (value == NULL || w_addword (pwordexp, value))
1339                 goto no_space;
1340
1341               for (p = 2; __libc_argv[p + 1]; p++)
1342                 {
1343                   char *newword = __strdup (__libc_argv[p]);
1344                   if (newword == NULL || w_addword (pwordexp, newword))
1345                     goto no_space;
1346                 }
1347
1348               /* Start a new word with the last parameter. */
1349               *word = w_newword (word_length, max_length);
1350               value = __libc_argv[p];
1351             }
1352           else
1353             {
1354               free (env);
1355               free (pattern);
1356               return 0;
1357             }
1358         }
1359     }
1360   else
1361     value = getenv (env);
1362
1363   if (value == NULL && (flags & WRDE_UNDEF))
1364     {
1365       /* Variable not defined. */
1366       if (pattern)
1367         free (pattern);
1368       if (env)
1369         free (env);
1370       return WRDE_BADVAL;
1371     }
1372
1373   if (action != ACT_NONE)
1374     {
1375       switch (action)
1376         {
1377         case ACT_RP_SHORT_LEFT:
1378         case ACT_RP_LONG_LEFT:
1379         case ACT_RP_SHORT_RIGHT:
1380         case ACT_RP_LONG_RIGHT:
1381           {
1382             char *p;
1383             char c;
1384             char *end;
1385
1386             if (value == NULL || pattern == NULL || *pattern == '\0')
1387               break;
1388
1389             end = value + strlen (value);
1390
1391             switch (action)
1392               {
1393               case ACT_RP_SHORT_LEFT:
1394                 for (p = value; p <= end; ++p)
1395                   {
1396                     c = *p;
1397                     *p = '\0';
1398                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1399                       {
1400                         *p = c;
1401                         if (free_value)
1402                           {
1403                             char *newval = __strdup (p);
1404                             if (newval == NULL)
1405                               {
1406                                 free (value);
1407                                 goto no_space;
1408                               }
1409                             free (value);
1410                             value = newval;
1411                           }
1412                         else
1413                           value = p;
1414                         break;
1415                       }
1416                     *p = c;
1417                   }
1418
1419                 break;
1420
1421               case ACT_RP_LONG_LEFT:
1422                 for (p = end; p >= value; --p)
1423                   {
1424                     c = *p;
1425                     *p = '\0';
1426                     if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1427                       {
1428                         *p = c;
1429                         if (free_value)
1430                           {
1431                             char *newval = __strdup (p);
1432                             if (newval == NULL)
1433                               {
1434                                 free (value);
1435                                 goto no_space;
1436                               }
1437                             free (value);
1438                             value = newval;
1439                           }
1440                         else
1441                           value = p;
1442                         break;
1443                       }
1444                     *p = c;
1445                   }
1446
1447                 break;
1448
1449               case ACT_RP_SHORT_RIGHT:
1450                 for (p = end; p >= value; --p)
1451                   {
1452                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1453                       {
1454                         char *newval;
1455                         newval = malloc (p - value + 1);
1456                         if (newval == NULL)
1457                           goto no_space;
1458                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1459                         if (free_value)
1460                           free (value);
1461                         value = newval;
1462                         free_value = 1;
1463                         break;
1464                       }
1465                   }
1466
1467                 break;
1468
1469               case ACT_RP_LONG_RIGHT:
1470                 for (p = value; p <= end; ++p)
1471                   {
1472                     if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1473                       {
1474                         char *newval;
1475                         newval = malloc (p - value + 1);
1476                         if (newval == NULL)
1477                           goto no_space;
1478                         *(char *) __mempcpy (newval, value, p - value) = '\0';
1479                         if (free_value)
1480                           free (value);
1481                         value = newval;
1482                         free_value = 1;
1483                         break;
1484                       }
1485                   }
1486
1487                 break;
1488
1489               default:
1490                 break;
1491               }
1492
1493             break;
1494           }
1495
1496         case ACT_NULL_ERROR:
1497           if (value && *value)
1498             /* Substitute parameter */
1499             break;
1500
1501           if (!colon_seen && value)
1502             /* Substitute NULL */
1503             error = 0;
1504           else if (*pattern)
1505             {
1506               /* Expand 'pattern' and write it to stderr */
1507               wordexp_t we;
1508
1509               error = wordexp (pattern, &we, flags);
1510
1511               if (error == 0)
1512                 {
1513                   int i;
1514
1515                   fprintf (stderr, "%s:", env);
1516
1517                   for (i = 0; i < we.we_wordc; ++i)
1518                     {
1519                       fprintf (stderr, " %s", we.we_wordv[i]);
1520                     }
1521
1522                   fprintf (stderr, "\n");
1523                   error = WRDE_BADVAL;
1524                 }
1525
1526               wordfree (&we);
1527             }
1528           else
1529             {
1530               fprintf (stderr, "%s: parameter null or not set\n", env);
1531               error = WRDE_BADVAL;
1532             }
1533
1534           free (env);
1535           free (pattern);
1536           if (free_value)
1537             free (value);
1538           return error;
1539
1540         case ACT_NULL_SUBST:
1541           if (value && *value)
1542             /* Substitute parameter */
1543             break;
1544
1545           if (!colon_seen && value)
1546             {
1547               /* Substitute NULL */
1548               free (env);
1549               free (pattern);
1550               if (free_value)
1551                 free (value);
1552               return 0;
1553             }
1554
1555         subst_word:
1556           {
1557             /* Substitute word */
1558             wordexp_t we;
1559             int i;
1560
1561             if (free_value)
1562               free (value);
1563
1564             if (quoted)
1565               {
1566                 /* No field-splitting is allowed, so imagine
1567                    quotes around the word.  */
1568                 char *qtd_pattern = malloc (3 + strlen (pattern));
1569                 if (qtd_pattern)
1570                   sprintf (qtd_pattern, "\"%s\"", pattern);
1571                 free (pattern);
1572                 pattern = qtd_pattern;
1573               }
1574
1575             if (pattern == NULL && (pattern = __strdup ("")) == NULL)
1576               goto no_space;
1577
1578             error = wordexp (pattern, &we, flags);
1579             if (error)
1580               {
1581                 free (env);
1582                 free (pattern);
1583                 return error;
1584               }
1585
1586             /* Fingers crossed that the quotes worked.. */
1587             assert (!quoted || we.we_wordc == 1);
1588
1589             /* Substitute */
1590             for (i = 0; i < we.we_wordc; ++i)
1591               if (w_addword (pwordexp, __strdup (we.we_wordv[i]))
1592                   == WRDE_NOSPACE)
1593                 break;
1594
1595             if (i < we.we_wordc)
1596               {
1597                 /* Ran out of space */
1598                 wordfree (&we);
1599                 goto no_space;
1600               }
1601
1602             if (action == ACT_NULL_ASSIGN)
1603               {
1604                 char *words;
1605                 char *cp;
1606                 size_t words_size = 0;
1607
1608                 if (special)
1609                   /* Cannot assign special parameters. */
1610                   goto syntax;
1611
1612                 for (i = 0; i < we.we_wordc; i++)
1613                   words_size += strlen (we.we_wordv[i]) + 1; /* for <space> */
1614                 words_size++;
1615
1616                 cp = words = __alloca (words_size);
1617                 *words = 0;
1618                 for (i = 0; i < we.we_wordc - 1; i++)
1619                   {
1620                     cp = __stpcpy (cp, we.we_wordv[i]);
1621                     *cp++ = ' ';
1622                   }
1623
1624                 strcpy (cp, we.we_wordv[i]);
1625
1626                 /* Also assign */
1627                 setenv (env, words, 1);
1628               }
1629
1630             wordfree (&we);
1631             free (env);
1632             free (pattern);
1633             return 0;
1634           }
1635
1636         case ACT_NONNULL_SUBST:
1637           if (value && *value)
1638             goto subst_word;
1639
1640           if (!colon_seen && value)
1641             goto subst_word;
1642
1643           /* Substitute NULL */
1644           free (env);
1645           free (pattern);
1646           if (free_value)
1647             free (value);
1648           return 0;
1649
1650         case ACT_NULL_ASSIGN:
1651           if (value && *value)
1652             /* Substitute parameter */
1653             break;
1654
1655           if (!colon_seen && value)
1656             {
1657               /* Substitute NULL */
1658               free (env);
1659               free (pattern);
1660               if (free_value)
1661                 free (value);
1662               return 0;
1663             }
1664
1665           /* This checks for '=' so it knows to assign */
1666           goto subst_word;
1667
1668         default:
1669           assert (! "Unrecognised action!");
1670         }
1671     }
1672
1673   free (env);
1674   free (pattern);
1675
1676   if (seen_hash)
1677     {
1678       char param_length[21];
1679       param_length[20] = '\0';
1680       *word = w_addstr (*word, word_length, max_length,
1681                         _itoa_word (value ? strlen (value) : 0,
1682                                     &param_length[20], 10, 0));
1683       if (free_value)
1684         {
1685           assert (value != NULL);
1686           free (value);
1687         }
1688
1689       return *word ? 0 : WRDE_NOSPACE;
1690     }
1691
1692   if (value == NULL)
1693     return 0;
1694
1695   if (quoted || !pwordexp)
1696     {
1697       /* Quoted - no field split */
1698       *word = w_addstr (*word, word_length, max_length, value);
1699       if (free_value)
1700         free (value);
1701
1702       return *word ? 0 : WRDE_NOSPACE;
1703     }
1704   else
1705     {
1706       /* Need to field-split */
1707       char *value_copy = __strdup (value); /* Don't modify value */
1708       char *field_begin = value_copy;
1709       int seen_nonws_ifs = 0;
1710
1711       if (free_value)
1712         free (value);
1713
1714       if (value_copy == NULL)
1715         return WRDE_NOSPACE;
1716
1717       do
1718         {
1719           char *field_end = field_begin;
1720           char *next_field;
1721
1722           /* If this isn't the first field, start a new word */
1723           if (field_begin != value_copy)
1724             {
1725               if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1726                 {
1727                   free (value_copy);
1728                   return WRDE_NOSPACE;
1729                 }
1730
1731               *word = w_newword (word_length, max_length);
1732             }
1733
1734           /* Skip IFS whitespace before the field */
1735           field_begin += strspn (field_begin, ifs_white);
1736
1737           if (!seen_nonws_ifs && *field_begin == 0)
1738             /* Nothing but whitespace */
1739             break;
1740
1741           /* Search for the end of the field */
1742           field_end = field_begin + strcspn (field_begin, ifs);
1743
1744           /* Set up pointer to the character after end of field and
1745              skip whitespace IFS after it. */
1746           next_field = field_end + strspn (field_end, ifs_white);
1747
1748           /* Skip at most one non-whitespace IFS character after the field */
1749           seen_nonws_ifs = 0;
1750           if (*next_field && strchr (ifs, *next_field))
1751             {
1752               seen_nonws_ifs = 1;
1753               next_field++;
1754             }
1755
1756           /* Null-terminate it */
1757           *field_end = 0;
1758
1759           /* Tag a copy onto the current word */
1760           *word = w_addstr (*word, word_length, max_length, field_begin);
1761
1762           if (*word == NULL)
1763             {
1764               free (value_copy);
1765               return WRDE_NOSPACE;
1766             }
1767
1768           field_begin = next_field;
1769         }
1770       while (seen_nonws_ifs || *field_begin);
1771
1772       free (value_copy);
1773     }
1774
1775   return 0;
1776
1777 no_space:
1778   if (env)
1779     free (env);
1780
1781   if (pattern)
1782     free (pattern);
1783
1784   return WRDE_NOSPACE;
1785
1786 syntax:
1787   if (env)
1788     free (env);
1789
1790   if (pattern)
1791     free (pattern);
1792
1793   return WRDE_SYNTAX;
1794 }
1795
1796 static int
1797 internal_function
1798 parse_dollars (char **word, size_t *word_length, size_t *max_length,
1799                const char *words, size_t *offset, int flags,
1800                wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
1801                int quoted)
1802 {
1803   /* We are poised _at_ "$" */
1804   switch (words[1 + *offset])
1805     {
1806     case '"':
1807     case '\'':
1808     case 0:
1809       *word = w_addchar (*word, word_length, max_length, '$');
1810       return *word ? 0 : WRDE_NOSPACE;
1811
1812     case '(':
1813       if (words[2 + *offset] == '(')
1814         {
1815           /* Differentiate between $((1+3)) and $((echo);(ls)) */
1816           int i = 3 + *offset;
1817           int depth = 0;
1818           while (words[i] && !(depth == 0 && words[i] == ')'))
1819             {
1820               if (words[i] == '(')
1821                 ++depth;
1822               else if (words[i] == ')')
1823                 --depth;
1824
1825               ++i;
1826             }
1827
1828           if (words[i] == ')' && words[i + 1] == ')')
1829             {
1830               (*offset) += 3;
1831               /* Call parse_arith -- 0 is for "no brackets" */
1832               return parse_arith (word, word_length, max_length, words, offset,
1833                                   flags, 0);
1834             }
1835         }
1836
1837       if (flags & WRDE_NOCMD)
1838         return WRDE_CMDSUB;
1839
1840       (*offset) += 2;
1841       return parse_comm (word, word_length, max_length, words, offset, flags,
1842                          quoted? NULL : pwordexp, ifs, ifs_white);
1843
1844     case '[':
1845       (*offset) += 2;
1846       /* Call parse_arith -- 1 is for "brackets" */
1847       return parse_arith (word, word_length, max_length, words, offset, flags,
1848                           1);
1849
1850     case '{':
1851     default:
1852       ++(*offset);      /* parse_param needs to know if "{" is there */
1853       return parse_param (word, word_length, max_length, words, offset, flags,
1854                            pwordexp, ifs, ifs_white, quoted);
1855     }
1856 }
1857
1858 static int
1859 parse_backtick (char **word, size_t *word_length, size_t *max_length,
1860                 const char *words, size_t *offset, int flags,
1861                 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
1862 {
1863   /* We are poised just after "`" */
1864   int error;
1865   int squoting = 0;
1866   size_t comm_length;
1867   size_t comm_maxlen;
1868   char *comm = w_newword (&comm_length, &comm_maxlen);
1869
1870   for (; words[*offset]; ++(*offset))
1871     {
1872       switch (words[*offset])
1873         {
1874         case '`':
1875           /* Go -- give the script to the shell */
1876           error = exec_comm (comm, word, word_length, max_length, flags,
1877                              pwordexp, ifs, ifs_white);
1878           free (comm);
1879           return error;
1880
1881         case '\\':
1882           if (squoting)
1883             {
1884               error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
1885                                            words, offset);
1886
1887               if (error)
1888                 {
1889                   free (comm);
1890                   return error;
1891                 }
1892
1893               break;
1894             }
1895
1896           ++(*offset);
1897           error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
1898                                    offset);
1899
1900           if (error)
1901             {
1902               free (comm);
1903               return error;
1904             }
1905
1906           break;
1907
1908         case '\'':
1909           squoting = 1 - squoting;
1910         default:
1911           comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1912           if (comm == NULL)
1913             return WRDE_NOSPACE;
1914         }
1915     }
1916
1917   /* Premature end */
1918   free (comm);
1919   return WRDE_SYNTAX;
1920 }
1921
1922 static int
1923 internal_function
1924 parse_dquote (char **word, size_t *word_length, size_t *max_length,
1925               const char *words, size_t *offset, int flags,
1926               wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
1927 {
1928   /* We are poised just after a double-quote */
1929   int error;
1930
1931   for (; words[*offset]; ++(*offset))
1932     {
1933       switch (words[*offset])
1934         {
1935         case '"':
1936           return 0;
1937
1938         case '$':
1939           error = parse_dollars (word, word_length, max_length, words, offset,
1940                                  flags, pwordexp, ifs, ifs_white, 1);
1941           /* The ``1'' here is to tell parse_dollars not to
1942            * split the fields.  It may need to, however ("$@").
1943            */
1944           if (error)
1945             return error;
1946
1947           break;
1948
1949         case '`':
1950           if (flags & WRDE_NOCMD)
1951             return WRDE_CMDSUB;
1952
1953           ++(*offset);
1954           error = parse_backtick (word, word_length, max_length, words,
1955                                   offset, flags, NULL, NULL, NULL);
1956           /* The first NULL here is to tell parse_backtick not to
1957            * split the fields.
1958            */
1959           if (error)
1960             return error;
1961
1962           break;
1963
1964         case '\\':
1965           error = parse_qtd_backslash (word, word_length, max_length, words,
1966                                        offset);
1967
1968           if (error)
1969             return error;
1970
1971           break;
1972
1973         default:
1974           *word = w_addchar (*word, word_length, max_length, words[*offset]);
1975           if (*word == NULL)
1976             return WRDE_NOSPACE;
1977         }
1978     }
1979
1980   /* Unterminated string */
1981   return WRDE_SYNTAX;
1982 }
1983
1984 /*
1985  * wordfree() is to be called after pwordexp is finished with.
1986  */
1987
1988 void
1989 wordfree (wordexp_t *pwordexp)
1990 {
1991
1992   /* wordexp can set pwordexp to NULL */
1993   if (pwordexp && pwordexp->we_wordv)
1994     {
1995       char **wordv = pwordexp->we_wordv;
1996
1997       for (wordv += pwordexp->we_offs; *wordv; ++wordv)
1998         free (*wordv);
1999
2000       free (pwordexp->we_wordv);
2001       pwordexp->we_wordv = NULL;
2002     }
2003 }
2004
2005 /*
2006  * wordexp()
2007  */
2008
2009 int
2010 wordexp (const char *words, wordexp_t *pwordexp, int flags)
2011 {
2012   size_t wordv_offset;
2013   size_t words_offset;
2014   size_t word_length;
2015   size_t max_length;
2016   char *word = w_newword (&word_length, &max_length);
2017   int error;
2018   char *ifs;
2019   char ifs_white[4];
2020   char **old_wordv = pwordexp->we_wordv;
2021   size_t old_wordc = (flags & WRDE_REUSE) ? pwordexp->we_wordc : 0;
2022
2023   if (flags & WRDE_REUSE)
2024     {
2025       /* Minimal implementation of WRDE_REUSE for now */
2026       wordfree (pwordexp);
2027       old_wordv = NULL;
2028     }
2029
2030   if (flags & WRDE_DOOFFS)
2031     {
2032       pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2033       if (pwordexp->we_wordv == NULL)
2034         return WRDE_NOSPACE;
2035     }
2036   else
2037     {
2038       pwordexp->we_wordv = calloc (1, sizeof (char *));
2039       if (pwordexp->we_wordv == NULL)
2040         return WRDE_NOSPACE;
2041
2042       pwordexp->we_offs = 0;
2043     }
2044
2045   if ((flags & WRDE_APPEND) == 0)
2046     pwordexp->we_wordc = 0;
2047
2048   wordv_offset = pwordexp->we_offs + pwordexp->we_wordc;
2049
2050   /* Find out what the field separators are.
2051    * There are two types: whitespace and non-whitespace.
2052    */
2053   ifs = getenv ("IFS");
2054
2055   if (!ifs)
2056     /* IFS unset - use <space><tab><newline>. */
2057     ifs = strcpy (ifs_white, " \t\n");
2058   else
2059     {
2060       char *ifsch = ifs;
2061       char *whch = ifs_white;
2062
2063       /* Start off with no whitespace IFS characters */
2064       ifs_white[0] = '\0';
2065
2066       while (*ifsch != '\0')
2067         {
2068           if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
2069             {
2070               /* Whitespace IFS.  See first whether it is already in our
2071                  collection.  */
2072               char *runp = ifs_white;
2073
2074               while (runp < whch && *runp != '\0' && *runp != *ifsch)
2075                 ++runp;
2076
2077               if (runp == whch)
2078                 *whch++ = *ifsch;
2079             }
2080
2081           ++ifsch;
2082         }
2083       *whch = '\0';
2084     }
2085
2086   for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2087     switch (words[words_offset])
2088       {
2089       case '\\':
2090         error = parse_backslash (&word, &word_length, &max_length, words,
2091                                  &words_offset);
2092
2093         if (error)
2094           goto do_error;
2095
2096         break;
2097
2098       case '$':
2099         error = parse_dollars (&word, &word_length, &max_length, words,
2100                                &words_offset, flags, pwordexp, ifs, ifs_white,
2101                                0);
2102
2103         if (error)
2104           goto do_error;
2105
2106         break;
2107
2108       case '`':
2109         if (flags & WRDE_NOCMD)
2110           return WRDE_CMDSUB;
2111
2112         ++words_offset;
2113         error = parse_backtick (&word, &word_length, &max_length, words,
2114                                 &words_offset, flags, pwordexp, ifs,
2115                                 ifs_white);
2116
2117         if (error)
2118           goto do_error;
2119
2120         break;
2121
2122       case '"':
2123         ++words_offset;
2124         error = parse_dquote (&word, &word_length, &max_length, words,
2125                               &words_offset, flags, pwordexp, ifs, ifs_white);
2126
2127         if (error)
2128           goto do_error;
2129
2130         break;
2131
2132       case '\'':
2133         ++words_offset;
2134         error = parse_squote (&word, &word_length, &max_length, words,
2135                               &words_offset);
2136
2137         if (error)
2138           goto do_error;
2139
2140         break;
2141
2142       case '~':
2143         error = parse_tilde (&word, &word_length, &max_length, words,
2144                              &words_offset, pwordexp->we_wordc);
2145
2146         if (error)
2147           goto do_error;
2148
2149         break;
2150
2151       case '*':
2152       case '[':
2153       case '?':
2154         error = parse_glob (&word, &word_length, &max_length, words,
2155                             &words_offset, flags, pwordexp, ifs, ifs_white);
2156
2157         if (error)
2158           goto do_error;
2159
2160         break;
2161
2162       default:
2163         /* Is it a field separator? */
2164         if (strchr (ifs, words[words_offset]) == NULL)
2165           {
2166             /* Not a field separator -- but is it a valid word char? */
2167             if (strchr ("\n|&;<>(){}", words[words_offset]))
2168               {
2169                 /* Fail */
2170                 wordfree (pwordexp);
2171                 pwordexp->we_wordc = 0;
2172                 pwordexp->we_wordv = old_wordv;
2173                 return WRDE_BADCHAR;
2174               }
2175
2176             /* "Ordinary" character -- add it to word */
2177
2178             word = w_addchar (word, &word_length, &max_length,
2179                               words[words_offset]);
2180             if (word == NULL)
2181               {
2182                 error = WRDE_NOSPACE;
2183                 goto do_error;
2184               }
2185
2186             break;
2187           }
2188
2189         /* Field separator */
2190         if (strchr (ifs_white, words[words_offset]))
2191           {
2192             /* It's a whitespace IFS char.  Ignore it at the beginning
2193                of a line and ignore multiple instances.  */
2194             if (!word || !*word)
2195               break;
2196
2197             if (w_addword (pwordexp, word) == WRDE_NOSPACE)
2198               {
2199                 error = WRDE_NOSPACE;
2200                 goto do_error;
2201               }
2202
2203             word = w_newword (&word_length, &max_length);
2204             break;
2205           }
2206
2207         /* It's a non-whitespace IFS char */
2208
2209         /* Multiple non-whitespace IFS chars are treated as one.  */
2210         if (word != NULL)
2211           {
2212             if (w_addword (pwordexp, word) == WRDE_NOSPACE)
2213               {
2214                 error = WRDE_NOSPACE;
2215                 goto do_error;
2216               }
2217           }
2218
2219         word = w_newword (&word_length, &max_length);
2220       }
2221
2222   /* End of string */
2223
2224   /* There was a field separator at the end */
2225   if (word == NULL)
2226     return 0;
2227
2228   /* There was no field separator at the end */
2229   return w_addword (pwordexp, word);
2230
2231 do_error:
2232   /* Error:
2233    *    free memory used (unless error is WRDE_NOSPACE), and
2234    *    set we_wordc and wd_wordv back to what they were.
2235    */
2236
2237   if (error == WRDE_NOSPACE)
2238     return WRDE_NOSPACE;
2239
2240   if (word != NULL)
2241     free (word);
2242
2243   wordfree (pwordexp);
2244   pwordexp->we_wordv = old_wordv;
2245   pwordexp->we_wordc = old_wordc;
2246   return error;
2247 }