hush: fix set -- q w e; (IFS='' echo "$*"; IFS=''; echo "$*"); echo "$*"

Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>

1 files changed, 39 insertions, 26 deletions

diff --git a/shell/hush.c b/shell/hush.c
index 3e8c387e7..57782f52b 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -3839,10 +3839,10 @@ static struct pipe *parse_stream(char **pstring,
 	o_addchr(&dest, '\0');
 	dest.length = 0;
 
-	G.ifs = get_local_var_value("IFS");
-	if (G.ifs == NULL)
-		G.ifs = defifs;
-
+	/* We used to separate words on $IFS here. This was wrong.
+	 * $IFS is used only for word splitting when $var is expanded,
+	 * here we should use blank chars as separators, not $iFS
+	 */
  reset:
 #if ENABLE_HUSH_INTERACTIVE
 	input->promptmode = 0; /* PS1 */
@@ -3852,7 +3852,7 @@ static struct pipe *parse_stream(char **pstring,
 	is_in_dquote = 0;
 	heredoc_cnt = 0;
 	while (1) {
-		const char *is_ifs;
+		const char *is_blank;
 		const char *is_special;
 		int ch;
 		int next;
@@ -3922,20 +3922,20 @@ static struct pipe *parse_stream(char **pstring,
 		if (ctx.command->argv /* word [word]{... - non-special */
 		 || dest.length       /* word{... - non-special */
 		 || dest.has_quoted_part     /* ""{... - non-special */
-		 || (next != ';'            /* }; - special */
-		    && next != ')'          /* }) - special */
-		    && next != '&'          /* }& and }&& ... - special */
-		    && next != '|'          /* }|| ... - special */
-		    && !strchr(G.ifs, next) /* {word - non-special */
+		 || (next != ';'             /* }; - special */
+		    && next != ')'           /* }) - special */
+		    && next != '&'           /* }& and }&& ... - special */
+		    && next != '|'           /* }|| ... - special */
+		    && !strchr(defifs, next) /* {word - non-special */
 		    )
 		) {
 			/* They are not special, skip "{}" */
 			is_special += 2;
 		}
 		is_special = strchr(is_special, ch);
-		is_ifs = strchr(G.ifs, ch);
+		is_blank = strchr(defifs, ch);
 
-		if (!is_special && !is_ifs) { /* ordinary char */
+		if (!is_special && !is_blank) { /* ordinary char */
  ordinary_char:
 			o_addQchr(&dest, ch);
 			if ((dest.o_assignment == MAYBE_ASSIGNMENT
@@ -3948,7 +3948,7 @@ static struct pipe *parse_stream(char **pstring,
 			continue;
 		}
 
-		if (is_ifs) {
+		if (is_blank) {
 			if (done_word(&dest, &ctx)) {
 				goto parse_error;
 			}
@@ -3973,7 +3973,7 @@ static struct pipe *parse_stream(char **pstring,
 				}
 				dest.o_assignment = MAYBE_ASSIGNMENT;
 				ch = ';';
-				/* note: if (is_ifs) continue;
+				/* note: if (is_blank) continue;
 				 * will still trigger for us */
 			}
 		}
@@ -4041,7 +4041,7 @@ static struct pipe *parse_stream(char **pstring,
 			}
 		}
  skip_end_trigger:
-		if (is_ifs)
+		if (is_blank)
 			continue;
 
 		/* Catch <, > before deciding whether this word is
@@ -4348,7 +4348,7 @@ static int process_command_subs(o_string *dest, const char *s);
  * of strings. (Think VAR="a b"; echo $VAR).
  * This new list is allocated as a single malloc block.
  * NULL-terminated list of char* pointers is at the beginning of it,
- * followed by strings themself.
+ * followed by strings themselves.
  * Caller can deallocate entire list by single free(list). */
 
 /* Store given string, finalizing the word and starting new one whenever
@@ -4505,18 +4505,20 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
 	char *exp_saveptr; /* points to expansion operator */
 	char *exp_word = exp_word; /* for compiler */
 
+	*p = '\0'; /* replace trailing SPECIAL_VAR_SYMBOL */
 	var = arg;
-	*p = '\0';
 	exp_saveptr = arg[1] ? strchr(VAR_ENCODED_SUBST_OPS, arg[1]) : NULL;
 	first_char = arg[0] = first_ch & 0x7f;
 	exp_op = 0;
 
-	if (first_char == '#' && arg[1] && !exp_saveptr) {
-		/* handle length expansion ${#var} */
+	if (first_char == '#'      /* ${#... */
+	 && arg[1] && !exp_saveptr /* not ${#} and not ${#<op_char>...} */
+	) {
+		/* It must be length operator: ${#var} */
 		var++;
 		exp_op = 'L';
 	} else {
-		/* maybe handle parameter expansion */
+		/* Maybe handle parameter expansion */
 		if (exp_saveptr /* if 2nd char is one of expansion operators */
 		 && strchr(NUMERIC_SPECVARS_STR, first_char) /* 1st char is special variable */
 		) {
@@ -4531,8 +4533,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
 			exp_word = exp_saveptr + 1;
 			if (exp_op == ':') {
 				exp_op = *exp_word++;
+//TODO: try ${var:} and ${var:bogus} in non-bash config
 				if (ENABLE_HUSH_BASH_COMPAT
-				 && (exp_op == '\0' || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
+				 && (!exp_op || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
 				) {
 					/* oops... it's ${var:N[:M]}, not ${var:?xxx} or some such */
 					exp_op = ':';
@@ -4543,7 +4546,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
 		} /* else: it's not an expansion op, but bare ${var} */
 	}
 
-	/* lookup the variable in question */
+	/* Look up the variable in question */
 	if (isdigit(var[0])) {
 		/* parse_dollar() should have vetted var for us */
 		int n = xatoi_positive(var);
@@ -4622,7 +4625,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
 				/* It's ${var/[/]pattern[/repl]} thing */
 				/*
 				 * Pattern is taken literally, while
-				 * repl should be de-backslased and globbed
+				 * repl should be unbackslashed and globbed
 				 * by the usual expansion rules:
 				 * >az; >bz;
 				 * v='a bz'; echo "${v/a*z/a*z}" prints "a*z"
@@ -4998,9 +5001,12 @@ static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 }
 #endif
 
-/* Used for expansion of right hand of assignments */
-/* NB: should NOT do globbing!
- * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*" */
+/* Used for expansion of right hand of assignments,
+ * $((...)), heredocs, variable espansion parts.
+ *
+ * NB: should NOT do globbing!
+ * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*"
+ */
 static char *expand_string_to_string(const char *str)
 {
 	char *argv[2], **list;
@@ -6413,6 +6419,13 @@ static NOINLINE int run_pipe(struct pipe *pi)
 	debug_printf_exec("run_pipe start: members:%d\n", pi->num_cmds);
 	debug_enter();
 
+	/* Testcase: set -- q w e; (IFS='' echo "$*"; IFS=''; echo "$*"); echo "$*"
+	 * Result should be 3 lines: q w e, qwe, q w e
+	 */
+	G.ifs = get_local_var_value("IFS");
+	if (!G.ifs)
+		G.ifs = defifs;
+
 	IF_HUSH_JOB(pi->pgrp = -1;)
 	pi->stopped_cmds = 0;
 	command = &pi->cmds[0];