hush: never glob result of dquoted "${v:+/bin/c*}"

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 13 insertions, 1 deletions

diff --git a/shell/hush.c b/shell/hush.c
index dddba5e30..4fdd15900 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -5994,7 +5994,19 @@ static int encode_then_append_var_plusminus(o_string *output, int n,
 			continue;
 		}
 #endif
-		o_addQchr(&dest, ch);
+		if (dquoted) {
+			/* Always glob-protect if in dquotes:
+			 * x=x; echo "${x:+/bin/c*}" - prints: /bin/c*
+			 * x=x; echo "${x:+"/bin/c*"}" - prints: /bin/c*
+			 */
+			o_addqchr(&dest, ch);
+		} else {
+			/* Glob-protect only if char is quoted:
+			 * x=x; echo ${x:+/bin/c*} - prints many filenames
+			 * x=x; echo ${x:+"/bin/c*"} - prints: /bin/c*
+			 */
+			o_addQchr(&dest, ch);
+		}
 	} /* for (;;) */
 
 	if (dest.data) {