1/* POSIX.2 wordexp implementation.
2 Copyright (C) 1997-2018 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4 Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.
5
6 The GNU C Library is free software; you can redistribute it and/or
7 modify it under the terms of the GNU Lesser General Public
8 License as published by the Free Software Foundation; either
9 version 2.1 of the License, or (at your option) any later version.
10
11 The GNU C Library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public
17 License along with the GNU C Library; if not, see
18 <http://www.gnu.org/licenses/>. */
19
20#include <alloca.h>
21#include <ctype.h>
22#include <errno.h>
23#include <fcntl.h>
24#include <fnmatch.h>
25#include <glob.h>
26#include <libintl.h>
27#include <paths.h>
28#include <pwd.h>
29#include <signal.h>
30#include <stdbool.h>
31#include <stdio.h>
32#include <stdlib.h>
33#include <string.h>
34#include <sys/param.h>
35#include <sys/stat.h>
36#include <sys/time.h>
37#include <sys/types.h>
38#include <sys/types.h>
39#include <sys/wait.h>
40#include <unistd.h>
41#include <wchar.h>
42#include <wordexp.h>
43#include <kernel-features.h>
44
45#include <libc-lock.h>
46#include <_itoa.h>
47
48/* Undefine the following line for the production version. */
49/* #define NDEBUG 1 */
50#include <assert.h>
51
52/* Get some device information. */
53#include <device-nrs.h>
54
55/*
56 * This is a recursive-descent-style word expansion routine.
57 */
58
59/* These variables are defined and initialized in the startup code. */
60extern int __libc_argc attribute_hidden;
61extern char **__libc_argv attribute_hidden;
62
63/* Some forward declarations */
64static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
65 const char *words, size_t *offset, int flags,
66 wordexp_t *pwordexp, const char *ifs,
67 const char *ifs_white, int quoted);
68static int parse_backtick (char **word, size_t *word_length,
69 size_t *max_length, const char *words,
70 size_t *offset, int flags, wordexp_t *pwordexp,
71 const char *ifs, const char *ifs_white);
72static int parse_dquote (char **word, size_t *word_length, size_t *max_length,
73 const char *words, size_t *offset, int flags,
74 wordexp_t *pwordexp, const char *ifs,
75 const char *ifs_white);
76static int eval_expr (char *expr, long int *result);
77
78/* The w_*() functions manipulate word lists. */
79
80#define W_CHUNK (100)
81
82/* Result of w_newword will be ignored if it's the last word. */
83static inline char *
84w_newword (size_t *actlen, size_t *maxlen)
85{
86 *actlen = *maxlen = 0;
87 return NULL;
88}
89
90static char *
91w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
92 /* (lengths exclude trailing zero) */
93{
94 /* Add a character to the buffer, allocating room for it if needed. */
95
96 if (*actlen == *maxlen)
97 {
98 char *old_buffer = buffer;
99 assert (buffer == NULL || *maxlen != 0);
100 *maxlen += W_CHUNK;
101 buffer = (char *) realloc (buffer, 1 + *maxlen);
102
103 if (buffer == NULL)
104 free (old_buffer);
105 }
106
107 if (buffer != NULL)
108 {
109 buffer[*actlen] = ch;
110 buffer[++(*actlen)] = '\0';
111 }
112
113 return buffer;
114}
115
116static char *
117w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
118 size_t len)
119{
120 /* Add a string to the buffer, allocating room for it if needed.
121 */
122 if (*actlen + len > *maxlen)
123 {
124 char *old_buffer = buffer;
125 assert (buffer == NULL || *maxlen != 0);
126 *maxlen += MAX (2 * len, W_CHUNK);
127 buffer = realloc (old_buffer, 1 + *maxlen);
128
129 if (buffer == NULL)
130 free (old_buffer);
131 }
132
133 if (buffer != NULL)
134 {
135 *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
136 *actlen += len;
137 }
138
139 return buffer;
140}
141
142static char *
143w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
144 /* (lengths exclude trailing zero) */
145{
146 /* Add a string to the buffer, allocating room for it if needed.
147 */
148 size_t len;
149
150 assert (str != NULL); /* w_addstr only called from this file */
151 len = strlen (str);
152
153 return w_addmem (buffer, actlen, maxlen, str, len);
154}
155
156static int
157w_addword (wordexp_t *pwordexp, char *word)
158{
159 /* Add a word to the wordlist */
160 size_t num_p;
161 char **new_wordv;
162 bool allocated = false;
163
164 /* Internally, NULL acts like "". Convert NULLs to "" before
165 * the caller sees them.
166 */
167 if (word == NULL)
168 {
169 word = __strdup ("");
170 if (word == NULL)
171 goto no_space;
172 allocated = true;
173 }
174
175 num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
176 new_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
177 if (new_wordv != NULL)
178 {
179 pwordexp->we_wordv = new_wordv;
180 pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc++] = word;
181 pwordexp->we_wordv[pwordexp->we_offs + pwordexp->we_wordc] = NULL;
182 return 0;
183 }
184
185 if (allocated)
186 free (word);
187
188no_space:
189 return WRDE_NOSPACE;
190}
191
192/* The parse_*() functions should leave *offset being the offset in 'words'
193 * to the last character processed.
194 */
195
196static int
197parse_backslash (char **word, size_t *word_length, size_t *max_length,
198 const char *words, size_t *offset)
199{
200 /* We are poised _at_ a backslash, not in quotes */
201
202 switch (words[1 + *offset])
203 {
204 case 0:
205 /* Backslash is last character of input words */
206 return WRDE_SYNTAX;
207
208 case '\n':
209 ++(*offset);
210 break;
211
212 default:
213 *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
214 if (*word == NULL)
215 return WRDE_NOSPACE;
216
217 ++(*offset);
218 break;
219 }
220
221 return 0;
222}
223
224static int
225parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
226 const char *words, size_t *offset)
227{
228 /* We are poised _at_ a backslash, inside quotes */
229
230 switch (words[1 + *offset])
231 {
232 case 0:
233 /* Backslash is last character of input words */
234 return WRDE_SYNTAX;
235
236 case '\n':
237 ++(*offset);
238 break;
239
240 case '$':
241 case '`':
242 case '"':
243 case '\\':
244 *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
245 if (*word == NULL)
246 return WRDE_NOSPACE;
247
248 ++(*offset);
249 break;
250
251 default:
252 *word = w_addchar (*word, word_length, max_length, words[*offset]);
253 if (*word != NULL)
254 *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
255
256 if (*word == NULL)
257 return WRDE_NOSPACE;
258
259 ++(*offset);
260 break;
261 }
262
263 return 0;
264}
265
266static int
267parse_tilde (char **word, size_t *word_length, size_t *max_length,
268 const char *words, size_t *offset, size_t wordc)
269{
270 /* We are poised _at_ a tilde */
271 size_t i;
272
273 if (*word_length != 0)
274 {
275 if (!((*word)[*word_length - 1] == '=' && wordc == 0))
276 {
277 if (!((*word)[*word_length - 1] == ':'
278 && strchr (*word, '=') && wordc == 0))
279 {
280 *word = w_addchar (*word, word_length, max_length, '~');
281 return *word ? 0 : WRDE_NOSPACE;
282 }
283 }
284 }
285
286 for (i = 1 + *offset; words[i]; i++)
287 {
288 if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
289 words[i] == '\t' || words[i] == 0 )
290 break;
291
292 if (words[i] == '\\')
293 {
294 *word = w_addchar (*word, word_length, max_length, '~');
295 return *word ? 0 : WRDE_NOSPACE;
296 }
297 }
298
299 if (i == 1 + *offset)
300 {
301 /* Tilde appears on its own */
302 uid_t uid;
303 struct passwd pwd, *tpwd;
304 int buflen = 1000;
305 char* home;
306 char* buffer;
307 int result;
308
309 /* POSIX.2 says ~ expands to $HOME and if HOME is unset the
310 results are unspecified. We do a lookup on the uid if
311 HOME is unset. */
312
313 home = getenv ("HOME");
314 if (home != NULL)
315 {
316 *word = w_addstr (*word, word_length, max_length, home);
317 if (*word == NULL)
318 return WRDE_NOSPACE;
319 }
320 else
321 {
322 uid = __getuid ();
323 buffer = __alloca (buflen);
324
325 while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
326 && errno == ERANGE)
327 buffer = extend_alloca (buffer, buflen, buflen + 1000);
328
329 if (result == 0 && tpwd != NULL && pwd.pw_dir != NULL)
330 {
331 *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
332 if (*word == NULL)
333 return WRDE_NOSPACE;
334 }
335 else
336 {
337 *word = w_addchar (*word, word_length, max_length, '~');
338 if (*word == NULL)
339 return WRDE_NOSPACE;
340 }
341 }
342 }
343 else
344 {
345 /* Look up user name in database to get home directory */
346 char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
347 struct passwd pwd, *tpwd;
348 int buflen = 1000;
349 char* buffer = __alloca (buflen);
350 int result;
351
352 while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
353 && errno == ERANGE)
354 buffer = extend_alloca (buffer, buflen, buflen + 1000);
355
356 if (result == 0 && tpwd != NULL && pwd.pw_dir)
357 *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
358 else
359 {
360 /* (invalid login name) */
361 *word = w_addchar (*word, word_length, max_length, '~');
362 if (*word != NULL)
363 *word = w_addstr (*word, word_length, max_length, user);
364 }
365
366 *offset = i - 1;
367 }
368 return *word ? 0 : WRDE_NOSPACE;
369}
370
371
372static int
373do_parse_glob (const char *glob_word, char **word, size_t *word_length,
374 size_t *max_length, wordexp_t *pwordexp, const char *ifs,
375 const char *ifs_white)
376{
377 int error;
378 unsigned int match;
379 glob_t globbuf;
380
381 error = glob (glob_word, GLOB_NOCHECK, NULL, &globbuf);
382
383 if (error != 0)
384 {
385 /* We can only run into memory problems. */
386 assert (error == GLOB_NOSPACE);
387 return WRDE_NOSPACE;
388 }
389
390 if (ifs && !*ifs)
391 {
392 /* No field splitting allowed. */
393 assert (globbuf.gl_pathv[0] != NULL);
394 *word = w_addstr (*word, word_length, max_length, globbuf.gl_pathv[0]);
395 for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
396 {
397 *word = w_addchar (*word, word_length, max_length, ' ');
398 if (*word != NULL)
399 *word = w_addstr (*word, word_length, max_length,
400 globbuf.gl_pathv[match]);
401 }
402
403 globfree (&globbuf);
404 return *word ? 0 : WRDE_NOSPACE;
405 }
406
407 assert (ifs == NULL || *ifs != '\0');
408 if (*word != NULL)
409 {
410 free (*word);
411 *word = w_newword (word_length, max_length);
412 }
413
414 for (match = 0; match < globbuf.gl_pathc; ++match)
415 {
416 char *matching_word = __strdup (globbuf.gl_pathv[match]);
417 if (matching_word == NULL || w_addword (pwordexp, matching_word))
418 {
419 globfree (&globbuf);
420 return WRDE_NOSPACE;
421 }
422 }
423
424 globfree (&globbuf);
425 return 0;
426}
427
428static int
429parse_glob (char **word, size_t *word_length, size_t *max_length,
430 const char *words, size_t *offset, int flags,
431 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
432{
433 /* We are poised just after a '*', a '[' or a '?'. */
434 int error = WRDE_NOSPACE;
435 int quoted = 0; /* 1 if singly-quoted, 2 if doubly */
436 size_t i;
437 wordexp_t glob_list; /* List of words to glob */
438
439 glob_list.we_wordc = 0;
440 glob_list.we_wordv = NULL;
441 glob_list.we_offs = 0;
442 for (; words[*offset] != '\0'; ++*offset)
443 {
444 if (strchr (ifs, words[*offset]) != NULL)
445 /* Reached IFS */
446 break;
447
448 /* Sort out quoting */
449 if (words[*offset] == '\'')
450 {
451 if (quoted == 0)
452 {
453 quoted = 1;
454 continue;
455 }
456 else if (quoted == 1)
457 {
458 quoted = 0;
459 continue;
460 }
461 }
462 else if (words[*offset] == '"')
463 {
464 if (quoted == 0)
465 {
466 quoted = 2;
467 continue;
468 }
469 else if (quoted == 2)
470 {
471 quoted = 0;
472 continue;
473 }
474 }
475
476 /* Sort out other special characters */
477 if (quoted != 1 && words[*offset] == '$')
478 {
479 error = parse_dollars (word, word_length, max_length, words,
480 offset, flags, &glob_list, ifs, ifs_white,
481 quoted == 2);
482 if (error)
483 goto tidy_up;
484
485 continue;
486 }
487 else if (words[*offset] == '\\')
488 {
489 if (quoted)
490 error = parse_qtd_backslash (word, word_length, max_length,
491 words, offset);
492 else
493 error = parse_backslash (word, word_length, max_length,
494 words, offset);
495
496 if (error)
497 goto tidy_up;
498
499 continue;
500 }
501
502 *word = w_addchar (*word, word_length, max_length, words[*offset]);
503 if (*word == NULL)
504 goto tidy_up;
505 }
506
507 /* Don't forget to re-parse the character we stopped at. */
508 --*offset;
509
510 /* Glob the words */
511 error = w_addword (&glob_list, *word);
512 *word = w_newword (word_length, max_length);
513 for (i = 0; error == 0 && i < glob_list.we_wordc; i++)
514 error = do_parse_glob (glob_list.we_wordv[i], word, word_length,
515 max_length, pwordexp, ifs, ifs_white);
516
517 /* Now tidy up */
518tidy_up:
519 wordfree (&glob_list);
520 return error;
521}
522
523static int
524parse_squote (char **word, size_t *word_length, size_t *max_length,
525 const char *words, size_t *offset)
526{
527 /* We are poised just after a single quote */
528 for (; words[*offset]; ++(*offset))
529 {
530 if (words[*offset] != '\'')
531 {
532 *word = w_addchar (*word, word_length, max_length, words[*offset]);
533 if (*word == NULL)
534 return WRDE_NOSPACE;
535 }
536 else return 0;
537 }
538
539 /* Unterminated string */
540 return WRDE_SYNTAX;
541}
542
543/* Functions to evaluate an arithmetic expression */
544static int
545eval_expr_val (char **expr, long int *result)
546{
547 char *digit;
548
549 /* Skip white space */
550 for (digit = *expr; digit && *digit && isspace (*digit); ++digit);
551
552 if (*digit == '(')
553 {
554 /* Scan for closing paren */
555 for (++digit; **expr && **expr != ')'; ++(*expr));
556
557 /* Is there one? */
558 if (!**expr)
559 return WRDE_SYNTAX;
560
561 *(*expr)++ = 0;
562
563 if (eval_expr (digit, result))
564 return WRDE_SYNTAX;
565
566 return 0;
567 }
568
569 /* POSIX requires that decimal, octal, and hexadecimal constants are
570 recognized. Therefore we pass 0 as the third parameter to strtol. */
571 *result = strtol (digit, expr, 0);
572 if (digit == *expr)
573 return WRDE_SYNTAX;
574
575 return 0;
576}
577
578static int
579eval_expr_multdiv (char **expr, long int *result)
580{
581 long int arg;
582
583 /* Read a Value */
584 if (eval_expr_val (expr, result) != 0)
585 return WRDE_SYNTAX;
586
587 while (**expr)
588 {
589 /* Skip white space */
590 for (; *expr && **expr && isspace (**expr); ++(*expr));
591
592 if (**expr == '*')
593 {
594 ++(*expr);
595 if (eval_expr_val (expr, &arg) != 0)
596 return WRDE_SYNTAX;
597
598 *result *= arg;
599 }
600 else if (**expr == '/')
601 {
602 ++(*expr);
603 if (eval_expr_val (expr, &arg) != 0)
604 return WRDE_SYNTAX;
605
606 /* Division by zero or integer overflow. */
607 if (arg == 0 || (arg == -1 && *result == LONG_MIN))
608 return WRDE_SYNTAX;
609
610 *result /= arg;
611 }
612 else break;
613 }
614
615 return 0;
616}
617
618static int
619eval_expr (char *expr, long int *result)
620{
621 long int arg;
622
623 /* Read a Multdiv */
624 if (eval_expr_multdiv (&expr, result) != 0)
625 return WRDE_SYNTAX;
626
627 while (*expr)
628 {
629 /* Skip white space */
630 for (; expr && *expr && isspace (*expr); ++expr);
631
632 if (*expr == '+')
633 {
634 ++expr;
635 if (eval_expr_multdiv (&expr, &arg) != 0)
636 return WRDE_SYNTAX;
637
638 *result += arg;
639 }
640 else if (*expr == '-')
641 {
642 ++expr;
643 if (eval_expr_multdiv (&expr, &arg) != 0)
644 return WRDE_SYNTAX;
645
646 *result -= arg;
647 }
648 else break;
649 }
650
651 return 0;
652}
653
654static int
655parse_arith (char **word, size_t *word_length, size_t *max_length,
656 const char *words, size_t *offset, int flags, int bracket)
657{
658 /* We are poised just after "$((" or "$[" */
659 int error;
660 int paren_depth = 1;
661 size_t expr_length;
662 size_t expr_maxlen;
663 char *expr;
664
665 expr = w_newword (&expr_length, &expr_maxlen);
666 for (; words[*offset]; ++(*offset))
667 {
668 switch (words[*offset])
669 {
670 case '$':
671 error = parse_dollars (&expr, &expr_length, &expr_maxlen,
672 words, offset, flags, NULL, NULL, NULL, 1);
673 /* The ``1'' here is to tell parse_dollars not to
674 * split the fields.
675 */
676 if (error)
677 {
678 free (expr);
679 return error;
680 }
681 break;
682
683 case '`':
684 (*offset)++;
685 error = parse_backtick (&expr, &expr_length, &expr_maxlen,
686 words, offset, flags, NULL, NULL, NULL);
687 /* The first NULL here is to tell parse_backtick not to
688 * split the fields.
689 */
690 if (error)
691 {
692 free (expr);
693 return error;
694 }
695 break;
696
697 case '\\':
698 error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
699 words, offset);
700 if (error)
701 {
702 free (expr);
703 return error;
704 }
705 /* I think that a backslash within an
706 * arithmetic expansion is bound to
707 * cause an error sooner or later anyway though.
708 */
709 break;
710
711 case ')':
712 if (--paren_depth == 0)
713 {
714 char result[21]; /* 21 = ceil(log10(2^64)) + 1 */
715 long int numresult = 0;
716 long long int convertme;
717
718 if (bracket || words[1 + *offset] != ')')
719 {
720 free (expr);
721 return WRDE_SYNTAX;
722 }
723
724 ++(*offset);
725
726 /* Go - evaluate. */
727 if (*expr && eval_expr (expr, &numresult) != 0)
728 {
729 free (expr);
730 return WRDE_SYNTAX;
731 }
732
733 if (numresult < 0)
734 {
735 convertme = -numresult;
736 *word = w_addchar (*word, word_length, max_length, '-');
737 if (!*word)
738 {
739 free (expr);
740 return WRDE_NOSPACE;
741 }
742 }
743 else
744 convertme = numresult;
745
746 result[20] = '\0';
747 *word = w_addstr (*word, word_length, max_length,
748 _itoa (convertme, &result[20], 10, 0));
749 free (expr);
750 return *word ? 0 : WRDE_NOSPACE;
751 }
752 expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
753 if (expr == NULL)
754 return WRDE_NOSPACE;
755
756 break;
757
758 case ']':
759 if (bracket && paren_depth == 1)
760 {
761 char result[21]; /* 21 = ceil(log10(2^64)) + 1 */
762 long int numresult = 0;
763
764 /* Go - evaluate. */
765 if (*expr && eval_expr (expr, &numresult) != 0)
766 {
767 free (expr);
768 return WRDE_SYNTAX;
769 }
770
771 result[20] = '\0';
772 *word = w_addstr (*word, word_length, max_length,
773 _itoa_word (numresult, &result[20], 10, 0));
774 free (expr);
775 return *word ? 0 : WRDE_NOSPACE;
776 }
777
778 free (expr);
779 return WRDE_SYNTAX;
780
781 case '\n':
782 case ';':
783 case '{':
784 case '}':
785 free (expr);
786 return WRDE_BADCHAR;
787
788 case '(':
789 ++paren_depth;
790 default:
791 expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
792 if (expr == NULL)
793 return WRDE_NOSPACE;
794 }
795 }
796
797 /* Premature end */
798 free (expr);
799 return WRDE_SYNTAX;
800}
801
802/* Function called by child process in exec_comm() */
803static inline void
804__attribute__ ((always_inline))
805exec_comm_child (char *comm, int *fildes, int showerr, int noexec)
806{
807 const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };
808
809 /* Execute the command, or just check syntax? */
810 if (noexec)
811 args[1] = "-nc";
812
813 /* Redirect output. */
814 if (__glibc_likely (fildes[1] != STDOUT_FILENO))
815 {
816 __dup2 (fildes[1], STDOUT_FILENO);
817 __close (fildes[1]);
818 }
819 else
820 /* Reset the close-on-exec flag (if necessary). */
821 __fcntl (fildes[1], F_SETFD, 0);
822
823 /* Redirect stderr to /dev/null if we have to. */
824 if (showerr == 0)
825 {
826 struct stat64 st;
827 int fd;
828 __close (STDERR_FILENO);
829 fd = __open (_PATH_DEVNULL, O_WRONLY);
830 if (fd >= 0 && fd != STDERR_FILENO)
831 {
832 __dup2 (fd, STDERR_FILENO);
833 __close (fd);
834 }
835 /* Be paranoid. Check that we actually opened the /dev/null
836 device. */
837 if (__builtin_expect (__fxstat64 (_STAT_VER, STDERR_FILENO, &st), 0) != 0
838 || __builtin_expect (S_ISCHR (st.st_mode), 1) == 0
839#if defined DEV_NULL_MAJOR && defined DEV_NULL_MINOR
840 || st.st_rdev != makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR)
841#endif
842 )
843 /* It's not the /dev/null device. Stop right here. The
844 problem is: how do we stop? We use _exit() with an
845 hopefully unusual exit code. */
846 _exit (90);
847 }
848
849 /* Make sure the subshell doesn't field-split on our behalf. */
850 __unsetenv ("IFS");
851
852 __close (fildes[0]);
853 __execve (_PATH_BSHELL, (char *const *) args, __environ);
854
855 /* Bad. What now? */
856 abort ();
857}
858
859/* Function to execute a command and retrieve the results */
860/* pwordexp contains NULL if field-splitting is forbidden */
861static int
862exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
863 int flags, wordexp_t *pwordexp, const char *ifs,
864 const char *ifs_white)
865{
866 int fildes[2];
867#define bufsize 128
868 int buflen;
869 int i;
870 int status = 0;
871 size_t maxnewlines = 0;
872 char buffer[bufsize];
873 pid_t pid;
874 int noexec = 0;
875
876 /* Do nothing if command substitution should not succeed. */
877 if (flags & WRDE_NOCMD)
878 return WRDE_CMDSUB;
879
880 /* Don't fork() unless necessary */
881 if (!comm || !*comm)
882 return 0;
883
884 if (__pipe2 (fildes, O_CLOEXEC) < 0)
885 return WRDE_NOSPACE;
886
887 again:
888 if ((pid = __fork ()) < 0)
889 {
890 /* Bad */
891 __close (fildes[0]);
892 __close (fildes[1]);
893 return WRDE_NOSPACE;
894 }
895
896 if (pid == 0)
897 exec_comm_child (comm, fildes, noexec ? 0 : flags & WRDE_SHOWERR, noexec);
898
899 /* Parent */
900
901 /* If we are just testing the syntax, only wait. */
902 if (noexec)
903 return (TEMP_FAILURE_RETRY (__waitpid (pid, &status, 0)) == pid
904 && status != 0) ? WRDE_SYNTAX : 0;
905
906 __close (fildes[1]);
907 fildes[1] = -1;
908
909 if (!pwordexp)
910 /* Quoted - no field splitting */
911 {
912 while (1)
913 {
914 if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
915 bufsize))) < 1)
916 {
917 /* If read returned 0 then the process has closed its
918 stdout. Don't use WNOHANG in that case to avoid busy
919 looping until the process eventually exits. */
920 if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
921 buflen == 0 ? 0 : WNOHANG))
922 == 0)
923 continue;
924 if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
925 bufsize))) < 1)
926 break;
927 }
928
929 maxnewlines += buflen;
930
931 *word = w_addmem (*word, word_length, max_length, buffer, buflen);
932 if (*word == NULL)
933 goto no_space;
934 }
935 }
936 else
937 /* Not quoted - split fields */
938 {
939 int copying = 0;
940 /* 'copying' is:
941 * 0 when searching for first character in a field not IFS white space
942 * 1 when copying the text of a field
943 * 2 when searching for possible non-whitespace IFS
944 * 3 when searching for non-newline after copying field
945 */
946
947 while (1)
948 {
949 if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
950 bufsize))) < 1)
951 {
952 /* If read returned 0 then the process has closed its
953 stdout. Don't use WNOHANG in that case to avoid busy
954 looping until the process eventually exits. */
955 if (TEMP_FAILURE_RETRY (__waitpid (pid, &status,
956 buflen == 0 ? 0 : WNOHANG))
957 == 0)
958 continue;
959 if ((buflen = TEMP_FAILURE_RETRY (__read (fildes[0], buffer,
960 bufsize))) < 1)
961 break;
962 }
963
964 for (i = 0; i < buflen; ++i)
965 {
966 if (strchr (ifs, buffer[i]) != NULL)
967 {
968 /* Current character is IFS */
969 if (strchr (ifs_white, buffer[i]) == NULL)
970 {
971 /* Current character is IFS but not whitespace */
972 if (copying == 2)
973 {
974 /* current character
975 * |
976 * V
977 * eg: text<space><comma><space>moretext
978 *
979 * So, strip whitespace IFS (like at the start)
980 */
981 copying = 0;
982 continue;
983 }
984
985 copying = 0;
986 /* fall through and delimit field.. */
987 }
988 else
989 {
990 if (buffer[i] == '\n')
991 {
992 /* Current character is (IFS) newline */
993
994 /* If copying a field, this is the end of it,
995 but maybe all that's left is trailing newlines.
996 So start searching for a non-newline. */
997 if (copying == 1)
998 copying = 3;
999
1000 continue;
1001 }
1002 else
1003 {
1004 /* Current character is IFS white space, but
1005 not a newline */
1006
1007 /* If not either copying a field or searching
1008 for non-newline after a field, ignore it */
1009 if (copying != 1 && copying != 3)
1010 continue;
1011
1012 /* End of field (search for non-ws IFS afterwards) */
1013 copying = 2;
1014 }
1015 }
1016
1017 /* First IFS white space (non-newline), or IFS non-whitespace.
1018 * Delimit the field. Nulls are converted by w_addword. */
1019 if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1020 goto no_space;
1021
1022 *word = w_newword (word_length, max_length);
1023
1024 maxnewlines = 0;
1025 /* fall back round the loop.. */
1026 }
1027 else
1028 {
1029 /* Not IFS character */
1030
1031 if (copying == 3)
1032 {
1033 /* Nothing but (IFS) newlines since the last field,
1034 so delimit it here before starting new word */
1035 if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1036 goto no_space;
1037
1038 *word = w_newword (word_length, max_length);
1039 }
1040
1041 copying = 1;
1042
1043 if (buffer[i] == '\n') /* happens if newline not in IFS */
1044 maxnewlines++;
1045 else
1046 maxnewlines = 0;
1047
1048 *word = w_addchar (*word, word_length, max_length,
1049 buffer[i]);
1050 if (*word == NULL)
1051 goto no_space;
1052 }
1053 }
1054 }
1055 }
1056
1057 /* Chop off trailing newlines (required by POSIX.2) */
1058 /* Ensure we don't go back further than the beginning of the
1059 substitution (i.e. remove maxnewlines bytes at most) */
1060 while (maxnewlines-- != 0 &&
1061 *word_length > 0 && (*word)[*word_length - 1] == '\n')
1062 {
1063 (*word)[--*word_length] = '\0';
1064
1065 /* If the last word was entirely newlines, turn it into a new word
1066 * which can be ignored if there's nothing following it. */
1067 if (*word_length == 0)
1068 {
1069 free (*word);
1070 *word = w_newword (word_length, max_length);
1071 break;
1072 }
1073 }
1074
1075 __close (fildes[0]);
1076 fildes[0] = -1;
1077
1078 /* Check for syntax error (re-execute but with "-n" flag) */
1079 if (buflen < 1 && status != 0)
1080 {
1081 noexec = 1;
1082 goto again;
1083 }
1084
1085 return 0;
1086
1087no_space:
1088 __kill (pid, SIGKILL);
1089 TEMP_FAILURE_RETRY (__waitpid (pid, NULL, 0));
1090 __close (fildes[0]);
1091 return WRDE_NOSPACE;
1092}
1093
1094static int
1095parse_comm (char **word, size_t *word_length, size_t *max_length,
1096 const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1097 const char *ifs, const char *ifs_white)
1098{
1099 /* We are poised just after "$(" */
1100 int paren_depth = 1;
1101 int error = 0;
1102 int quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1103 size_t comm_length;
1104 size_t comm_maxlen;
1105 char *comm = w_newword (&comm_length, &comm_maxlen);
1106
1107 for (; words[*offset]; ++(*offset))
1108 {
1109 switch (words[*offset])
1110 {
1111 case '\'':
1112 if (quoted == 0)
1113 quoted = 1;
1114 else if (quoted == 1)
1115 quoted = 0;
1116
1117 break;
1118
1119 case '"':
1120 if (quoted == 0)
1121 quoted = 2;
1122 else if (quoted == 2)
1123 quoted = 0;
1124
1125 break;
1126
1127 case ')':
1128 if (!quoted && --paren_depth == 0)
1129 {
1130 /* Go -- give script to the shell */
1131 if (comm)
1132 {
1133#ifdef __libc_ptf_call
1134 /* We do not want the exec_comm call to be cut short
1135 by a thread cancellation since cleanup is very
1136 ugly. Therefore disable cancellation for
1137 now. */
1138 // XXX Ideally we do want the thread being cancelable.
1139 // XXX If demand is there we'll change it.
1140 int state = PTHREAD_CANCEL_ENABLE;
1141 __libc_ptf_call (__pthread_setcancelstate,
1142 (PTHREAD_CANCEL_DISABLE, &state), 0);
1143#endif
1144
1145 error = exec_comm (comm, word, word_length, max_length,
1146 flags, pwordexp, ifs, ifs_white);
1147
1148#ifdef __libc_ptf_call
1149 __libc_ptf_call (__pthread_setcancelstate,
1150 (state, NULL), 0);
1151#endif
1152
1153 free (comm);
1154 }
1155
1156 return error;
1157 }
1158
1159 /* This is just part of the script */
1160 break;
1161
1162 case '(':
1163 if (!quoted)
1164 ++paren_depth;
1165 }
1166
1167 comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
1168 if (comm == NULL)
1169 return WRDE_NOSPACE;
1170 }
1171
1172 /* Premature end. */
1173 free (comm);
1174
1175 return WRDE_SYNTAX;
1176}
1177
1178#define CHAR_IN_SET(ch, char_set) \
1179 (memchr (char_set "", ch, sizeof (char_set) - 1) != NULL)
1180
1181static int
1182parse_param (char **word, size_t *word_length, size_t *max_length,
1183 const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
1184 const char *ifs, const char *ifs_white, int quoted)
1185{
1186 /* We are poised just after "$" */
1187 enum action
1188 {
1189 ACT_NONE,
1190 ACT_RP_SHORT_LEFT = '#',
1191 ACT_RP_LONG_LEFT = 'L',
1192 ACT_RP_SHORT_RIGHT = '%',
1193 ACT_RP_LONG_RIGHT = 'R',
1194 ACT_NULL_ERROR = '?',
1195 ACT_NULL_SUBST = '-',
1196 ACT_NONNULL_SUBST = '+',
1197 ACT_NULL_ASSIGN = '='
1198 };
1199 size_t env_length;
1200 size_t env_maxlen;
1201 size_t pat_length;
1202 size_t pat_maxlen;
1203 size_t start = *offset;
1204 char *env;
1205 char *pattern;
1206 char *value = NULL;
1207 enum action action = ACT_NONE;
1208 int depth = 0;
1209 int colon_seen = 0;
1210 int seen_hash = 0;
1211 int free_value = 0;
1212 int pattern_is_quoted = 0; /* 1 for singly-quoted, 2 for doubly-quoted */
1213 int error;
1214 int special = 0;
1215 char buffer[21];
1216 int brace = words[*offset] == '{';
1217
1218 env = w_newword (&env_length, &env_maxlen);
1219 pattern = w_newword (&pat_length, &pat_maxlen);
1220
1221 if (brace)
1222 ++*offset;
1223
1224 /* First collect the parameter name. */
1225
1226 if (words[*offset] == '#')
1227 {
1228 seen_hash = 1;
1229 if (!brace)
1230 goto envsubst;
1231 ++*offset;
1232 }
1233
1234 if (isalpha (words[*offset]) || words[*offset] == '_')
1235 {
1236 /* Normal parameter name. */
1237 do
1238 {
1239 env = w_addchar (env, &env_length, &env_maxlen,
1240 words[*offset]);
1241 if (env == NULL)
1242 goto no_space;
1243 }
1244 while (isalnum (words[++*offset]) || words[*offset] == '_');
1245 }
1246 else if (isdigit (words[*offset]))
1247 {
1248 /* Numeric parameter name. */
1249 special = 1;
1250 do
1251 {
1252 env = w_addchar (env, &env_length, &env_maxlen,
1253 words[*offset]);
1254 if (env == NULL)
1255 goto no_space;
1256 if (!brace)
1257 goto envsubst;
1258 }
1259 while (isdigit(words[++*offset]));
1260 }
1261 else if (CHAR_IN_SET (words[*offset], "*@$"))
1262 {
1263 /* Special parameter. */
1264 special = 1;
1265 env = w_addchar (env, &env_length, &env_maxlen,
1266 words[*offset]);
1267 if (env == NULL)
1268 goto no_space;
1269 ++*offset;
1270 }
1271 else
1272 {
1273 if (brace)
1274 goto syntax;
1275 }
1276
1277 if (brace)
1278 {
1279 /* Check for special action to be applied to the value. */
1280 switch (words[*offset])
1281 {
1282 case '}':
1283 /* Evaluate. */
1284 goto envsubst;
1285
1286 case '#':
1287 action = ACT_RP_SHORT_LEFT;
1288 if (words[1 + *offset] == '#')
1289 {
1290 ++*offset;
1291 action = ACT_RP_LONG_LEFT;
1292 }
1293 break;
1294
1295 case '%':
1296 action = ACT_RP_SHORT_RIGHT;
1297 if (words[1 + *offset] == '%')
1298 {
1299 ++*offset;
1300 action = ACT_RP_LONG_RIGHT;
1301 }
1302 break;
1303
1304 case ':':
1305 if (!CHAR_IN_SET (words[1 + *offset], "-=?+"))
1306 goto syntax;
1307
1308 colon_seen = 1;
1309 action = words[++*offset];
1310 break;
1311
1312 case '-':
1313 case '=':
1314 case '?':
1315 case '+':
1316 action = words[*offset];
1317 break;
1318
1319 default:
1320 goto syntax;
1321 }
1322
1323 /* Now collect the pattern, but don't expand it yet. */
1324 ++*offset;
1325 for (; words[*offset]; ++(*offset))
1326 {
1327 switch (words[*offset])
1328 {
1329 case '{':
1330 if (!pattern_is_quoted)
1331 ++depth;
1332 break;
1333
1334 case '}':
1335 if (!pattern_is_quoted)
1336 {
1337 if (depth == 0)
1338 goto envsubst;
1339 --depth;
1340 }
1341 break;
1342
1343 case '\\':
1344 if (pattern_is_quoted)
1345 /* Quoted; treat as normal character. */
1346 break;
1347
1348 /* Otherwise, it's an escape: next character is literal. */
1349 if (words[++*offset] == '\0')
1350 goto syntax;
1351
1352 pattern = w_addchar (pattern, &pat_length, &pat_maxlen, '\\');
1353 if (pattern == NULL)
1354 goto no_space;
1355
1356 break;
1357
1358 case '\'':
1359 if (pattern_is_quoted == 0)
1360 pattern_is_quoted = 1;
1361 else if (pattern_is_quoted == 1)
1362 pattern_is_quoted = 0;
1363
1364 break;
1365
1366 case '"':
1367 if (pattern_is_quoted == 0)
1368 pattern_is_quoted = 2;
1369 else if (pattern_is_quoted == 2)
1370 pattern_is_quoted = 0;
1371
1372 break;
1373 }
1374
1375 pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
1376 words[*offset]);
1377 if (pattern == NULL)
1378 goto no_space;
1379 }
1380 }
1381
1382 /* End of input string -- remember to reparse the character that we
1383 * stopped at. */
1384 --(*offset);
1385
1386envsubst:
1387 if (words[start] == '{' && words[*offset] != '}')
1388 goto syntax;
1389
1390 if (env == NULL)
1391 {
1392 if (seen_hash)
1393 {
1394 /* $# expands to the number of positional parameters */
1395 buffer[20] = '\0';
1396 value = _itoa_word (__libc_argc - 1, &buffer[20], 10, 0);
1397 seen_hash = 0;
1398 }
1399 else
1400 {
1401 /* Just $ on its own */
1402 *offset = start - 1;
1403 *word = w_addchar (*word, word_length, max_length, '$');
1404 return *word ? 0 : WRDE_NOSPACE;
1405 }
1406 }
1407 /* Is it a numeric parameter? */
1408 else if (isdigit (env[0]))
1409 {
1410 int n = atoi (env);
1411
1412 if (n >= __libc_argc)
1413 /* Substitute NULL. */
1414 value = NULL;
1415 else
1416 /* Replace with appropriate positional parameter. */
1417 value = __libc_argv[n];
1418 }
1419 /* Is it a special parameter? */
1420 else if (special)
1421 {
1422 /* Is it `$$'? */
1423 if (*env == '$')
1424 {
1425 buffer[20] = '\0';
1426 value = _itoa_word (__getpid (), &buffer[20], 10, 0);
1427 }
1428 /* Is it `${#*}' or `${#@}'? */
1429 else if ((*env == '*' || *env == '@') && seen_hash)
1430 {
1431 buffer[20] = '\0';
1432 value = _itoa_word (__libc_argc > 0 ? __libc_argc - 1 : 0,
1433 &buffer[20], 10, 0);
1434 *word = w_addstr (*word, word_length, max_length, value);
1435 free (env);
1436 free (pattern);
1437 return *word ? 0 : WRDE_NOSPACE;
1438 }
1439 /* Is it `$*' or `$@' (unquoted) ? */
1440 else if (*env == '*' || (*env == '@' && !quoted))
1441 {
1442 size_t plist_len = 0;
1443 int p;
1444 char *end;
1445
1446 /* Build up value parameter by parameter (copy them) */
1447 for (p = 1; __libc_argv[p]; ++p)
1448 plist_len += strlen (__libc_argv[p]) + 1; /* for space */
1449 value = malloc (plist_len);
1450 if (value == NULL)
1451 goto no_space;
1452 end = value;
1453 *end = 0;
1454 for (p = 1; __libc_argv[p]; ++p)
1455 {
1456 if (p > 1)
1457 *end++ = ' ';
1458 end = __stpcpy (end, __libc_argv[p]);
1459 }
1460
1461 free_value = 1;
1462 }
1463 else
1464 {
1465 /* Must be a quoted `$@' */
1466 assert (*env == '@' && quoted);
1467
1468 /* Each parameter is a separate word ("$@") */
1469 if (__libc_argc == 2)
1470 value = __libc_argv[1];
1471 else if (__libc_argc > 2)
1472 {
1473 int p;
1474
1475 /* Append first parameter to current word. */
1476 value = w_addstr (*word, word_length, max_length,
1477 __libc_argv[1]);
1478 if (value == NULL || w_addword (pwordexp, value))
1479 goto no_space;
1480
1481 for (p = 2; __libc_argv[p + 1]; p++)
1482 {
1483 char *newword = __strdup (__libc_argv[p]);
1484 if (newword == NULL || w_addword (pwordexp, newword))
1485 goto no_space;
1486 }
1487
1488 /* Start a new word with the last parameter. */
1489 *word = w_newword (word_length, max_length);
1490 value = __libc_argv[p];
1491 }
1492 else
1493 {
1494 free (env);
1495 free (pattern);
1496 return 0;
1497 }
1498 }
1499 }
1500 else
1501 value = getenv (env);
1502
1503 if (value == NULL && (flags & WRDE_UNDEF))
1504 {
1505 /* Variable not defined. */
1506 error = WRDE_BADVAL;
1507 goto do_error;
1508 }
1509
1510 if (action != ACT_NONE)
1511 {
1512 int expand_pattern = 0;
1513
1514 /* First, find out if we need to expand pattern (i.e. if we will
1515 * use it). */
1516 switch (action)
1517 {
1518 case ACT_RP_SHORT_LEFT:
1519 case ACT_RP_LONG_LEFT:
1520 case ACT_RP_SHORT_RIGHT:
1521 case ACT_RP_LONG_RIGHT:
1522 /* Always expand for these. */
1523 expand_pattern = 1;
1524 break;
1525
1526 case ACT_NULL_ERROR:
1527 case ACT_NULL_SUBST:
1528 case ACT_NULL_ASSIGN:
1529 if (!value || (!*value && colon_seen))
1530 /* If param is unset, or set but null and a colon has been seen,
1531 the expansion of the pattern will be needed. */
1532 expand_pattern = 1;
1533
1534 break;
1535
1536 case ACT_NONNULL_SUBST:
1537 /* Expansion of word will be needed if parameter is set and not null,
1538 or set null but no colon has been seen. */
1539 if (value && (*value || !colon_seen))
1540 expand_pattern = 1;
1541
1542 break;
1543
1544 default:
1545 assert (! "Unrecognised action!");
1546 }
1547
1548 if (expand_pattern)
1549 {
1550 /* We need to perform tilde expansion, parameter expansion,
1551 command substitution, and arithmetic expansion. We also
1552 have to be a bit careful with wildcard characters, as
1553 pattern might be given to fnmatch soon. To do this, we
1554 convert quotes to escapes. */
1555
1556 char *expanded;
1557 size_t exp_len;
1558 size_t exp_maxl;
1559 char *p;
1560 int quoted = 0; /* 1: single quotes; 2: double */
1561
1562 expanded = w_newword (&exp_len, &exp_maxl);
1563 for (p = pattern; p && *p; p++)
1564 {
1565 size_t offset;
1566
1567 switch (*p)
1568 {
1569 case '"':
1570 if (quoted == 2)
1571 quoted = 0;
1572 else if (quoted == 0)
1573 quoted = 2;
1574 else break;
1575
1576 continue;
1577
1578 case '\'':
1579 if (quoted == 1)
1580 quoted = 0;
1581 else if (quoted == 0)
1582 quoted = 1;
1583 else break;
1584
1585 continue;
1586
1587 case '*':
1588 case '?':
1589 if (quoted)
1590 {
1591 /* Convert quoted wildchar to escaped wildchar. */
1592 expanded = w_addchar (expanded, &exp_len,
1593 &exp_maxl, '\\');
1594
1595 if (expanded == NULL)
1596 goto no_space;
1597 }
1598 break;
1599
1600 case '$':
1601 offset = 0;
1602 error = parse_dollars (&expanded, &exp_len, &exp_maxl, p,
1603 &offset, flags, NULL, NULL, NULL, 1);
1604 if (error)
1605 {
1606 if (free_value)
1607 free (value);
1608
1609 free (expanded);
1610
1611 goto do_error;
1612 }
1613
1614 p += offset;
1615 continue;
1616
1617 case '~':
1618 if (quoted || exp_len)
1619 break;
1620
1621 offset = 0;
1622 error = parse_tilde (&expanded, &exp_len, &exp_maxl, p,
1623 &offset, 0);
1624 if (error)
1625 {
1626 if (free_value)
1627 free (value);
1628
1629 free (expanded);
1630
1631 goto do_error;
1632 }
1633
1634 p += offset;
1635 continue;
1636
1637 case '\\':
1638 expanded = w_addchar (expanded, &exp_len, &exp_maxl, '\\');
1639 ++p;
1640 assert (*p); /* checked when extracted initially */
1641 if (expanded == NULL)
1642 goto no_space;
1643 }
1644
1645 expanded = w_addchar (expanded, &exp_len, &exp_maxl, *p);
1646
1647 if (expanded == NULL)
1648 goto no_space;
1649 }
1650
1651 free (pattern);
1652
1653 pattern = expanded;
1654 }
1655
1656 switch (action)
1657 {
1658 case ACT_RP_SHORT_LEFT:
1659 case ACT_RP_LONG_LEFT:
1660 case ACT_RP_SHORT_RIGHT:
1661 case ACT_RP_LONG_RIGHT:
1662 {
1663 char *p;
1664 char c;
1665 char *end;
1666
1667 if (value == NULL || pattern == NULL || *pattern == '\0')
1668 break;
1669
1670 end = value + strlen (value);
1671
1672 switch (action)
1673 {
1674 case ACT_RP_SHORT_LEFT:
1675 for (p = value; p <= end; ++p)
1676 {
1677 c = *p;
1678 *p = '\0';
1679 if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1680 {
1681 *p = c;
1682 if (free_value)
1683 {
1684 char *newval = __strdup (p);
1685 if (newval == NULL)
1686 {
1687 free (value);
1688 goto no_space;
1689 }
1690 free (value);
1691 value = newval;
1692 }
1693 else
1694 value = p;
1695 break;
1696 }
1697 *p = c;
1698 }
1699
1700 break;
1701
1702 case ACT_RP_LONG_LEFT:
1703 for (p = end; p >= value; --p)
1704 {
1705 c = *p;
1706 *p = '\0';
1707 if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
1708 {
1709 *p = c;
1710 if (free_value)
1711 {
1712 char *newval = __strdup (p);
1713 if (newval == NULL)
1714 {
1715 free (value);
1716 goto no_space;
1717 }
1718 free (value);
1719 value = newval;
1720 }
1721 else
1722 value = p;
1723 break;
1724 }
1725 *p = c;
1726 }
1727
1728 break;
1729
1730 case ACT_RP_SHORT_RIGHT:
1731 for (p = end; p >= value; --p)
1732 {
1733 if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1734 {
1735 char *newval;
1736 newval = malloc (p - value + 1);
1737
1738 if (newval == NULL)
1739 {
1740 if (free_value)
1741 free (value);
1742 goto no_space;
1743 }
1744
1745 *(char *) __mempcpy (newval, value, p - value) = '\0';
1746 if (free_value)
1747 free (value);
1748 value = newval;
1749 free_value = 1;
1750 break;
1751 }
1752 }
1753
1754 break;
1755
1756 case ACT_RP_LONG_RIGHT:
1757 for (p = value; p <= end; ++p)
1758 {
1759 if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
1760 {
1761 char *newval;
1762 newval = malloc (p - value + 1);
1763
1764 if (newval == NULL)
1765 {
1766 if (free_value)
1767 free (value);
1768 goto no_space;
1769 }
1770
1771 *(char *) __mempcpy (newval, value, p - value) = '\0';
1772 if (free_value)
1773 free (value);
1774 value = newval;
1775 free_value = 1;
1776 break;
1777 }
1778 }
1779
1780 break;
1781
1782 default:
1783 break;
1784 }
1785
1786 break;
1787 }
1788
1789 case ACT_NULL_ERROR:
1790 if (value && *value)
1791 /* Substitute parameter */
1792 break;
1793
1794 error = 0;
1795 if (!colon_seen && value)
1796 /* Substitute NULL */
1797 ;
1798 else
1799 {
1800 const char *str = pattern;
1801
1802 if (str[0] == '\0')
1803 str = _("parameter null or not set");
1804
1805 __fxprintf (NULL, "%s: %s\n", env, str);
1806 }
1807
1808 if (free_value)
1809 free (value);
1810 goto do_error;
1811
1812 case ACT_NULL_SUBST:
1813 if (value && *value)
1814 /* Substitute parameter */
1815 break;
1816
1817 if (free_value)
1818 free (value);
1819
1820 if (!colon_seen && value)
1821 /* Substitute NULL */
1822 goto success;
1823
1824 value = pattern ? __strdup (pattern) : pattern;
1825 free_value = 1;
1826
1827 if (pattern && !value)
1828 goto no_space;
1829
1830 break;
1831
1832 case ACT_NONNULL_SUBST:
1833 if (value && (*value || !colon_seen))
1834 {
1835 if (free_value)
1836 free (value);
1837
1838 value = pattern ? __strdup (pattern) : pattern;
1839 free_value = 1;
1840
1841 if (pattern && !value)
1842 goto no_space;
1843
1844 break;
1845 }
1846
1847 /* Substitute NULL */
1848 if (free_value)
1849 free (value);
1850 goto success;
1851
1852 case ACT_NULL_ASSIGN:
1853 if (value && *value)
1854 /* Substitute parameter */
1855 break;
1856
1857 if (!colon_seen && value)
1858 {
1859 /* Substitute NULL */
1860 if (free_value)
1861 free (value);
1862 goto success;
1863 }
1864
1865 if (free_value)
1866 free (value);
1867
1868 value = pattern ? __strdup (pattern) : pattern;
1869 free_value = 1;
1870
1871 if (pattern && !value)
1872 goto no_space;
1873
1874 __setenv (env, value ?: "", 1);
1875 break;
1876
1877 default:
1878 assert (! "Unrecognised action!");
1879 }
1880 }
1881
1882 free (env);
1883 env = NULL;
1884 free (pattern);
1885 pattern = NULL;
1886
1887 if (seen_hash)
1888 {
1889 char param_length[21];
1890 param_length[20] = '\0';
1891 *word = w_addstr (*word, word_length, max_length,
1892 _itoa_word (value ? strlen (value) : 0,
1893 &param_length[20], 10, 0));
1894 if (free_value)
1895 {
1896 assert (value != NULL);
1897 free (value);
1898 }
1899
1900 return *word ? 0 : WRDE_NOSPACE;
1901 }
1902
1903 if (value == NULL)
1904 return 0;
1905
1906 if (quoted || !pwordexp)
1907 {
1908 /* Quoted - no field split */
1909 *word = w_addstr (*word, word_length, max_length, value);
1910 if (free_value)
1911 free (value);
1912
1913 return *word ? 0 : WRDE_NOSPACE;
1914 }
1915 else
1916 {
1917 /* Need to field-split */
1918 char *value_copy = __strdup (value); /* Don't modify value */
1919 char *field_begin = value_copy;
1920 int seen_nonws_ifs = 0;
1921
1922 if (free_value)
1923 free (value);
1924
1925 if (value_copy == NULL)
1926 goto no_space;
1927
1928 do
1929 {
1930 char *field_end = field_begin;
1931 char *next_field;
1932
1933 /* If this isn't the first field, start a new word */
1934 if (field_begin != value_copy)
1935 {
1936 if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
1937 {
1938 free (value_copy);
1939 goto no_space;
1940 }
1941
1942 *word = w_newword (word_length, max_length);
1943 }
1944
1945 /* Skip IFS whitespace before the field */
1946 field_begin += strspn (field_begin, ifs_white);
1947
1948 if (!seen_nonws_ifs && *field_begin == 0)
1949 /* Nothing but whitespace */
1950 break;
1951
1952 /* Search for the end of the field */
1953 field_end = field_begin + strcspn (field_begin, ifs);
1954
1955 /* Set up pointer to the character after end of field and
1956 skip whitespace IFS after it. */
1957 next_field = field_end + strspn (field_end, ifs_white);
1958
1959 /* Skip at most one non-whitespace IFS character after the field */
1960 seen_nonws_ifs = 0;
1961 if (*next_field && strchr (ifs, *next_field))
1962 {
1963 seen_nonws_ifs = 1;
1964 next_field++;
1965 }
1966
1967 /* Null-terminate it */
1968 *field_end = 0;
1969
1970 /* Tag a copy onto the current word */
1971 *word = w_addstr (*word, word_length, max_length, field_begin);
1972
1973 if (*word == NULL && *field_begin != '\0')
1974 {
1975 free (value_copy);
1976 goto no_space;
1977 }
1978
1979 field_begin = next_field;
1980 }
1981 while (seen_nonws_ifs || *field_begin);
1982
1983 free (value_copy);
1984 }
1985
1986 return 0;
1987
1988success:
1989 error = 0;
1990 goto do_error;
1991
1992no_space:
1993 error = WRDE_NOSPACE;
1994 goto do_error;
1995
1996syntax:
1997 error = WRDE_SYNTAX;
1998
1999do_error:
2000 free (env);
2001
2002 free (pattern);
2003
2004 return error;
2005}
2006
2007#undef CHAR_IN_SET
2008
2009static int
2010parse_dollars (char **word, size_t *word_length, size_t *max_length,
2011 const char *words, size_t *offset, int flags,
2012 wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
2013 int quoted)
2014{
2015 /* We are poised _at_ "$" */
2016 switch (words[1 + *offset])
2017 {
2018 case '"':
2019 case '\'':
2020 case 0:
2021 *word = w_addchar (*word, word_length, max_length, '$');
2022 return *word ? 0 : WRDE_NOSPACE;
2023
2024 case '(':
2025 if (words[2 + *offset] == '(')
2026 {
2027 /* Differentiate between $((1+3)) and $((echo);(ls)) */
2028 int i = 3 + *offset;
2029 int depth = 0;
2030 while (words[i] && !(depth == 0 && words[i] == ')'))
2031 {
2032 if (words[i] == '(')
2033 ++depth;
2034 else if (words[i] == ')')
2035 --depth;
2036
2037 ++i;
2038 }
2039
2040 if (words[i] == ')' && words[i + 1] == ')')
2041 {
2042 (*offset) += 3;
2043 /* Call parse_arith -- 0 is for "no brackets" */
2044 return parse_arith (word, word_length, max_length, words, offset,
2045 flags, 0);
2046 }
2047 }
2048
2049 (*offset) += 2;
2050 return parse_comm (word, word_length, max_length, words, offset, flags,
2051 quoted? NULL : pwordexp, ifs, ifs_white);
2052
2053 case '[':
2054 (*offset) += 2;
2055 /* Call parse_arith -- 1 is for "brackets" */
2056 return parse_arith (word, word_length, max_length, words, offset, flags,
2057 1);
2058
2059 case '{':
2060 default:
2061 ++(*offset); /* parse_param needs to know if "{" is there */
2062 return parse_param (word, word_length, max_length, words, offset, flags,
2063 pwordexp, ifs, ifs_white, quoted);
2064 }
2065}
2066
2067static int
2068parse_backtick (char **word, size_t *word_length, size_t *max_length,
2069 const char *words, size_t *offset, int flags,
2070 wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
2071{
2072 /* We are poised just after "`" */
2073 int error;
2074 int squoting = 0;
2075 size_t comm_length;
2076 size_t comm_maxlen;
2077 char *comm = w_newword (&comm_length, &comm_maxlen);
2078
2079 for (; words[*offset]; ++(*offset))
2080 {
2081 switch (words[*offset])
2082 {
2083 case '`':
2084 /* Go -- give the script to the shell */
2085 error = exec_comm (comm, word, word_length, max_length, flags,
2086 pwordexp, ifs, ifs_white);
2087 free (comm);
2088 return error;
2089
2090 case '\\':
2091 if (squoting)
2092 {
2093 error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
2094 words, offset);
2095
2096 if (error)
2097 {
2098 free (comm);
2099 return error;
2100 }
2101
2102 break;
2103 }
2104
2105 error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
2106 offset);
2107
2108 if (error)
2109 {
2110 free (comm);
2111 return error;
2112 }
2113
2114 break;
2115
2116 case '\'':
2117 squoting = 1 - squoting;
2118 default:
2119 comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
2120 if (comm == NULL)
2121 return WRDE_NOSPACE;
2122 }
2123 }
2124
2125 /* Premature end */
2126 free (comm);
2127 return WRDE_SYNTAX;
2128}
2129
2130static int
2131parse_dquote (char **word, size_t *word_length, size_t *max_length,
2132 const char *words, size_t *offset, int flags,
2133 wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
2134{
2135 /* We are poised just after a double-quote */
2136 int error;
2137
2138 for (; words[*offset]; ++(*offset))
2139 {
2140 switch (words[*offset])
2141 {
2142 case '"':
2143 return 0;
2144
2145 case '$':
2146 error = parse_dollars (word, word_length, max_length, words, offset,
2147 flags, pwordexp, ifs, ifs_white, 1);
2148 /* The ``1'' here is to tell parse_dollars not to
2149 * split the fields. It may need to, however ("$@").
2150 */
2151 if (error)
2152 return error;
2153
2154 break;
2155
2156 case '`':
2157 ++(*offset);
2158 error = parse_backtick (word, word_length, max_length, words,
2159 offset, flags, NULL, NULL, NULL);
2160 /* The first NULL here is to tell parse_backtick not to
2161 * split the fields.
2162 */
2163 if (error)
2164 return error;
2165
2166 break;
2167
2168 case '\\':
2169 error = parse_qtd_backslash (word, word_length, max_length, words,
2170 offset);
2171
2172 if (error)
2173 return error;
2174
2175 break;
2176
2177 default:
2178 *word = w_addchar (*word, word_length, max_length, words[*offset]);
2179 if (*word == NULL)
2180 return WRDE_NOSPACE;
2181 }
2182 }
2183
2184 /* Unterminated string */
2185 return WRDE_SYNTAX;
2186}
2187
2188/*
2189 * wordfree() is to be called after pwordexp is finished with.
2190 */
2191
2192void
2193wordfree (wordexp_t *pwordexp)
2194{
2195
2196 /* wordexp can set pwordexp to NULL */
2197 if (pwordexp && pwordexp->we_wordv)
2198 {
2199 char **wordv = pwordexp->we_wordv;
2200
2201 for (wordv += pwordexp->we_offs; *wordv; ++wordv)
2202 free (*wordv);
2203
2204 free (pwordexp->we_wordv);
2205 pwordexp->we_wordv = NULL;
2206 }
2207}
2208libc_hidden_def (wordfree)
2209
2210/*
2211 * wordexp()
2212 */
2213
2214int
2215wordexp (const char *words, wordexp_t *pwordexp, int flags)
2216{
2217 size_t words_offset;
2218 size_t word_length;
2219 size_t max_length;
2220 char *word = w_newword (&word_length, &max_length);
2221 int error;
2222 char *ifs;
2223 char ifs_white[4];
2224 wordexp_t old_word = *pwordexp;
2225
2226 if (flags & WRDE_REUSE)
2227 {
2228 /* Minimal implementation of WRDE_REUSE for now */
2229 wordfree (pwordexp);
2230 old_word.we_wordv = NULL;
2231 }
2232
2233 if ((flags & WRDE_APPEND) == 0)
2234 {
2235 pwordexp->we_wordc = 0;
2236
2237 if (flags & WRDE_DOOFFS)
2238 {
2239 pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
2240 if (pwordexp->we_wordv == NULL)
2241 {
2242 error = WRDE_NOSPACE;
2243 goto do_error;
2244 }
2245 }
2246 else
2247 {
2248 pwordexp->we_wordv = calloc (1, sizeof (char *));
2249 if (pwordexp->we_wordv == NULL)
2250 {
2251 error = WRDE_NOSPACE;
2252 goto do_error;
2253 }
2254
2255 pwordexp->we_offs = 0;
2256 }
2257 }
2258
2259 /* Find out what the field separators are.
2260 * There are two types: whitespace and non-whitespace.
2261 */
2262 ifs = getenv ("IFS");
2263
2264 if (ifs == NULL)
2265 /* IFS unset - use <space><tab><newline>. */
2266 ifs = strcpy (ifs_white, " \t\n");
2267 else
2268 {
2269 char *ifsch = ifs;
2270 char *whch = ifs_white;
2271
2272 while (*ifsch != '\0')
2273 {
2274 if (*ifsch == ' ' || *ifsch == '\t' || *ifsch == '\n')
2275 {
2276 /* Whitespace IFS. See first whether it is already in our
2277 collection. */
2278 char *runp = ifs_white;
2279
2280 while (runp < whch && *runp != *ifsch)
2281 ++runp;
2282
2283 if (runp == whch)
2284 *whch++ = *ifsch;
2285 }
2286
2287 ++ifsch;
2288 }
2289 *whch = '\0';
2290 }
2291
2292 for (words_offset = 0 ; words[words_offset] ; ++words_offset)
2293 switch (words[words_offset])
2294 {
2295 case '\\':
2296 error = parse_backslash (&word, &word_length, &max_length, words,
2297 &words_offset);
2298
2299 if (error)
2300 goto do_error;
2301
2302 break;
2303
2304 case '$':
2305 error = parse_dollars (&word, &word_length, &max_length, words,
2306 &words_offset, flags, pwordexp, ifs, ifs_white,
2307 0);
2308
2309 if (error)
2310 goto do_error;
2311
2312 break;
2313
2314 case '`':
2315 ++words_offset;
2316 error = parse_backtick (&word, &word_length, &max_length, words,
2317 &words_offset, flags, pwordexp, ifs,
2318 ifs_white);
2319
2320 if (error)
2321 goto do_error;
2322
2323 break;
2324
2325 case '"':
2326 ++words_offset;
2327 error = parse_dquote (&word, &word_length, &max_length, words,
2328 &words_offset, flags, pwordexp, ifs, ifs_white);
2329
2330 if (error)
2331 goto do_error;
2332
2333 if (!word_length)
2334 {
2335 error = w_addword (pwordexp, NULL);
2336
2337 if (error)
2338 return error;
2339 }
2340
2341 break;
2342
2343 case '\'':
2344 ++words_offset;
2345 error = parse_squote (&word, &word_length, &max_length, words,
2346 &words_offset);
2347
2348 if (error)
2349 goto do_error;
2350
2351 if (!word_length)
2352 {
2353 error = w_addword (pwordexp, NULL);
2354
2355 if (error)
2356 return error;
2357 }
2358
2359 break;
2360
2361 case '~':
2362 error = parse_tilde (&word, &word_length, &max_length, words,
2363 &words_offset, pwordexp->we_wordc);
2364
2365 if (error)
2366 goto do_error;
2367
2368 break;
2369
2370 case '*':
2371 case '[':
2372 case '?':
2373 error = parse_glob (&word, &word_length, &max_length, words,
2374 &words_offset, flags, pwordexp, ifs, ifs_white);
2375
2376 if (error)
2377 goto do_error;
2378
2379 break;
2380
2381 default:
2382 /* Is it a word separator? */
2383 if (strchr (" \t", words[words_offset]) == NULL)
2384 {
2385 char ch = words[words_offset];
2386
2387 /* Not a word separator -- but is it a valid word char? */
2388 if (strchr ("\n|&;<>(){}", ch))
2389 {
2390 /* Fail */
2391 error = WRDE_BADCHAR;
2392 goto do_error;
2393 }
2394
2395 /* "Ordinary" character -- add it to word */
2396 word = w_addchar (word, &word_length, &max_length,
2397 ch);
2398 if (word == NULL)
2399 {
2400 error = WRDE_NOSPACE;
2401 goto do_error;
2402 }
2403
2404 break;
2405 }
2406
2407 /* If a word has been delimited, add it to the list. */
2408 if (word != NULL)
2409 {
2410 error = w_addword (pwordexp, word);
2411 if (error)
2412 goto do_error;
2413 }
2414
2415 word = w_newword (&word_length, &max_length);
2416 }
2417
2418 /* End of string */
2419
2420 /* There was a word separator at the end */
2421 if (word == NULL) /* i.e. w_newword */
2422 return 0;
2423
2424 /* There was no field separator at the end */
2425 return w_addword (pwordexp, word);
2426
2427do_error:
2428 /* Error:
2429 * free memory used (unless error is WRDE_NOSPACE), and
2430 * set pwordexp members back to what they were.
2431 */
2432
2433 free (word);
2434
2435 if (error == WRDE_NOSPACE)
2436 return WRDE_NOSPACE;
2437
2438 if ((flags & WRDE_APPEND) == 0)
2439 wordfree (pwordexp);
2440
2441 *pwordexp = old_word;
2442 return error;
2443}
2444