hush: fix $ expansion in redirections, add testcase for that

1 files changed, 7 insertions, 4 deletions

diff --git a/shell/hush.c b/shell/hush.c
index 04afbfd9a..912cbb5d9 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -1361,8 +1361,11 @@ static int setup_redirects(struct child_prog *prog, int squirrel[])
 			continue;
 		}
 		if (redir->dup == -1) {
+			char *p;
 			mode = redir_table[redir->type].mode;
-			openfd = open_or_warn(redir->glob_word[0], mode);
+			p = expand_string_to_string(redir->glob_word[0]);
+			openfd = open_or_warn(p, mode);
+			free(p);
 			if (openfd < 0) {
 			/* this could get lost if stderr has been redirected, but
 			   bash and ash both lose it as well (though zsh doesn't!) */
@@ -2579,7 +2582,7 @@ static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char
 				}
 			} else
 			/* If or_mask is nonzero, we handle assignment 'a=....$@.....'
-			 * and in this case should theat it like '$*' */
+			 * and in this case should treat it like '$*' - see 'else...' below */
 			if (first_ch == ('@'|0x80) && !or_mask) { /* quoted $@ */
 				while (1) {
 					strcpy(pos, global_argv[i]);
@@ -2593,10 +2596,10 @@ static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char
 					list[n++] = pos;
 				}
 			} else { /* quoted $*: add as one word */
-				while (1) {
+				if (global_argv[i]) while (1) {
 					strcpy(pos, global_argv[i]);
 					pos += strlen(global_argv[i]);
-					if (++i >= global_argc)
+					if (!global_argv[++i])
 						break;
 					if (ifs[0])
 						*pos++ = ifs[0];