/usr/src/bin/ksh/eval.c

Bug Summary

File:	src/bin/ksh/eval.c
Warning:	line 393, column 13 Access to field 'quote' results in a dereference of a null pointer (loaded from variable 'st')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name eval.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/bin/ksh/obj -resource-dir /usr/local/lib/clang/13.0.0 -D EMACS -D VI -I . -I /usr/src/bin/ksh -I /usr/src/bin/ksh/../../lib/libc/gen -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/bin/ksh/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/bin/ksh/eval.c
1/*	$OpenBSD: eval.c,v 1.66 2020/09/13 15:39:09 tb Exp $	*/

3/*
* Expansion - quoting, separation, substitution, globbing
*/

7#include <sys/stat.h>

9#include <ctype.h>
10#include <dirent.h>
11#include <fcntl.h>
12#include <pwd.h>
13#include <stdio.h>
14#include <string.h>
15#include <unistd.h>

17#include "sh.h"

19/*
* string expansion
*
* first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
* second pass: alternation ({,}), filename expansion (*?[]).
*/

26/* expansion generator state */
27typedef struct Expand {
/* int  type; */	/* see expand() */
const char *str;	/* string */
union {
const char **strv;/* string[] */
struct shf *shf;/* file */
} u;			/* source */
struct tbl *var;	/* variable in ${var..} */
short	split;		/* split "$@" / call waitlast $() */
36} Expand;

38#define	XBASE0		0	/* scanning original */
39#define	XSUB1		1	/* expanding ${} string */
40#define	XARGSEP2		2	/* ifs0 between "$*" */
41#define	XARG3		3	/* expanding $*, $@ */
42#define	XCOM4		4	/* expanding $() */
43#define XNULLSUB5	5	/* "$@" when $# is 0 (don't generate word) */
44#define XSUBMID6		6	/* middle of expanding ${} */

46/* States used for field splitting */
47#define IFS_WORD0	0	/* word has chars (or quotes) */
48#define IFS_WS1		1	/* have seen IFS white-space */
49#define IFS_NWS2		2	/* have seen IFS non-white-space */
50#define IFS_IWS3		3	/* beginning of word, ignore IFS white-space */
51#define IFS_QUOTE4	4	/* beg.w/quote, becomes IFS_WORD unless "$@" */

53static	int	varsub(Expand *, char *, char *, int *, int *);
54static	int	comsub(Expand *, char *);
55static	char   *trimsub(char *, char *, int);
56static	void	glob(char *, XPtrV *, int);
57static	void	globit(XString *, char **, char *, XPtrV *, int);
58static char	*maybe_expand_tilde(char *, XString *, char **, int);
59static	char   *tilde(char *);
60static	char   *homedir(char *);
61static void	alt_expand(XPtrV *, char *, char *, char *, int);

63static struct tbl *varcpy(struct tbl *);

65/* compile and expand word */
66char *
67substitute(const char *cp, int f)
68{
struct source *s, *sold;

if (disable_subst)
return str_save(cp, ATEMP&genv->area);

sold = source;
s = pushs(SWSTR4, ATEMP&genv->area);
s->start = s->str = cp;
source = s;
if (yylex(ONEWORD(1<<(1))) != LWORD256)
internal_errorf("substitute");
source = sold;
afree(s, ATEMP&genv->area);
return evalstr(yylval.cp, f);
83}

85/*
* expand arg-list
*/
88char **
89eval(char **ap, int f)
90{
XPtrV w;

if (*ap == NULL((void*)0))
return ap;
XPinit(w, 32)do { void **vp__; vp__ = areallocarray(((void*)0), 32, sizeof
(void *), &genv->area); (w).cur = (w).beg = vp__; (w).
end = vp__ + 32; } while (0);
XPput(w, NULL)do { if ((w).cur >= (w).end) { int n = ((w).cur - (w).beg)
; (w).beg = areallocarray((w).beg, n, 2 * sizeof(void *), &
genv->area); (w).cur = (w).beg + n; (w).end = (w).cur + n;
 } *(w).cur++ = (((void*)0)); } while (0);		/* space for shell name */
while (*ap != NULL((void*)0))
expand(*ap++, &w, f);
XPput(w, NULL)do { if ((w).cur >= (w).end) { int n = ((w).cur - (w).beg)
; (w).beg = areallocarray((w).beg, n, 2 * sizeof(void *), &
genv->area); (w).cur = (w).beg + n; (w).end = (w).cur + n;
 } *(w).cur++ = (((void*)0)); } while (0);
return (char **) XPclose(w)areallocarray((w).beg, ((w).cur - (w).beg), sizeof(void *), &
genv->area) + 1;
101}

103/*
* expand string
*/
106char *
107evalstr(char *cp, int f)
108{
XPtrV w;

XPinit(w, 1)do { void **vp__; vp__ = areallocarray(((void*)0), 1, sizeof(
void *), &genv->area); (w).cur = (w).beg = vp__; (w).end
 = vp__ + 1; } while (0);
expand(cp, &w, f);
cp = (XPsize(w)((w).cur - (w).beg) == 0) ? null : (char*) *XPptrv(w)((w).beg);
XPfree(w)afree((w).beg, &genv->area);
return cp;
116}

118/*
* expand string - return only one component
* used from iosetup to expand redirection files
*/
122char *
123evalonestr(char *cp, int f)
124{
XPtrV w;

XPinit(w, 1)do { void **vp__; vp__ = areallocarray(((void*)0), 1, sizeof(
void *), &genv->area); (w).cur = (w).beg = vp__; (w).end
 = vp__ + 1; } while (0);
expand(cp, &w, f);
switch (XPsize(w)((w).cur - (w).beg)) {
case 0:
cp = null;
break;
case 1:
cp = (char*) *XPptrv(w)((w).beg);
break;
default:
cp = evalstr(cp, f&~DOGLOB(1<<(1)));
break;
}
XPfree(w)afree((w).beg, &genv->area);
return cp;
142}

144/* for nested substitution: ${var:=$var2} */
145typedef struct SubType {
short	stype;		/* [=+-?%#] action after expanded word */
short	base;		/* begin position of expanded word */
short	f;		/* saved value of f (DOPAT, etc) */
struct tbl *var;	/* variable for ${var..} */
short	quote;		/* saved value of quote (for ${..[%#]..}) */
struct SubType *prev;	/* old type */
struct SubType *next;	/* poped type (to avoid re-allocating) */
153} SubType;

155void
156expand(char *cp,	/* input word */
  XPtrV *wp,		/* output words */
  int f)		/* DO* flags */
159{
int c = 0;
int type;		/* expansion type */
int quote = 0;		/* quoted */
XString ds;		/* destination string */
char *dp, *sp;		/* dest., source */
int fdo, word;		/* second pass flags; have word */
int doblank;		/* field splitting of parameter/command subst */
Expand x = {
/* expansion variables */
NULL((void*)0), { NULL((void*)0) }, NULL((void*)0), 0
};
SubType st_head, *st;
int newlines = 0; /* For trailing newlines in COMSUB */
int saw_eq, tilde_ok;
int make_magic;
size_t len;

if (cp == NULL((void*)0))
1
Assuming 'cp' is not equal to NULL→
2
←
Taking false branch→
internal_errorf("expand(NULL)");
/* for alias, readonly, set, typeset commands */
if ((f & DOVACHECK(1<<(9))) && is_wdvarassign(cp)) {
3
←
Assuming the condition is false→
f &= ~(DOVACHECK(1<<(9))|DOBLANK(1<<(0))|DOGLOB(1<<(1))|DOTILDE(1<<(3)));
f |= DOASNTILDE(1<<(5));
}
if (Flag(FNOGLOB)(shell_flags[(int) (FNOGLOB)]))
4
←
Assuming the condition is false→
5
←
Taking false branch→
f &= ~DOGLOB(1<<(1));
if (Flag(FMARKDIRS)(shell_flags[(int) (FMARKDIRS)]))
6
←
Assuming the condition is false→
7
←
Taking false branch→
f |= DOMARKDIRS(1<<(10));
if (Flag(FBRACEEXPAND)(shell_flags[(int) (FBRACEEXPAND)]) && (f & DOGLOB(1<<(1))))
8
←
Assuming the condition is false→
f |= DOBRACE_(1<<(6));

Xinit(ds, dp, 128, ATEMP)do { (ds).len = 128; (ds).areap = (&genv->area); (ds).
beg = alloc((ds).len + 8, (ds).areap); (ds).end = (ds).beg + (
ds).len; dp = (ds).beg; } while (0);	/* init dest. string */
9
←
Loop condition is false.  Exiting loop→
type = XBASE0;
sp = cp;
fdo = 0;
saw_eq = 0;
tilde_ok = (f & (DOTILDE(1<<(3))|DOASNTILDE(1<<(5)))) ? 1 : 0; /* must be 1/0 */
10
←
Assuming the condition is false→
11
←
'?' condition is false→
doblank = 0;
make_magic = 0;
word = (f&DOBLANK(1<<(0))) ? IFS_WS1 : IFS_WORD0;
12
←
Assuming the condition is false→
13
←
'?' condition is false→

memset(&st_head, 0, sizeof(st_head));
14
←
Null pointer value stored to 'st_head.prev'→
st = &st_head;

while (1) {
15
←
Loop condition is true.  Entering loop body→
24
←
Loop condition is true.  Entering loop body→
Xcheck(ds, dp)do { ptrdiff_t more = ((dp) + (1)) - (ds).end; if (more > 0
) dp = Xcheck_grow_(&ds, dp, more); } while (0);
16
←
Taking false branch→
17
←
Loop condition is false.  Exiting loop→
25
←
Taking false branch→
26
←
Loop condition is false.  Exiting loop→

switch (type) {
18
←
Control jumps to 'case 0:'  at line 208→
27
←
Control jumps to 'case 0:'  at line 208→
case XBASE0:	/* original prefixed string */
	c = *sp++;
	switch (c) {
19
←
Control jumps to 'case 8:'  at line 389→
28
←
Control jumps to 'case 8:'  at line 389→
	case EOS0:
		c = 0;
		break;
	case CHAR1:
		c = *sp++;
		break;
	case QCHAR2:
		quote |= 2; /* temporary quote */
		c = *sp++;
		break;
	case OQUOTE5:
		switch (word) {
		case IFS_QUOTE4:
			/* """something */
			word = IFS_WORD0;
			break;
		case IFS_WORD0:
			break;
		default:
			word = IFS_QUOTE4;
			break;
		}
		tilde_ok = 0;
		quote = 1;
		continue;
	case CQUOTE6:
		quote = 0;
		continue;
	case COMSUB3:
		tilde_ok = 0;
		if (f & DONTRUNCOMMAND(1<<(4))) {
			word = IFS_WORD0;
			*dp++ = '$'; *dp++ = '(';
			while (*sp != '\0') {
				Xcheck(ds, dp)do { ptrdiff_t more = ((dp) + (1)) - (ds).end; if (more > 0
) dp = Xcheck_grow_(&ds, dp, more); } while (0);
				*dp++ = *sp++;
			}
			*dp++ = ')';
		} else {
			type = comsub(&x, sp);
			if (type == XCOM4 && (f&DOBLANK(1<<(0))))
				doblank++;
			sp = strchr(sp, 0) + 1;
			newlines = 0;
		}
		continue;
	case EXPRSUB4:
		word = IFS_WORD0;
		tilde_ok = 0;
		if (f & DONTRUNCOMMAND(1<<(4))) {
			*dp++ = '$'; *dp++ = '('; *dp++ = '(';
			while (*sp != '\0') {
				Xcheck(ds, dp)do { ptrdiff_t more = ((dp) + (1)) - (ds).end; if (more > 0
) dp = Xcheck_grow_(&ds, dp, more); } while (0);
				*dp++ = *sp++;
			}
			*dp++ = ')'; *dp++ = ')';
		} else {
			struct tbl v;
			char *p;

			v.flag = DEFINED(1<<(1))|ISSET(1<<(2))|INTEGER(1<<(9));
			v.type = 10; /* not default */
			v.name[0] = '\0';
			v_evaluate(&v, substitute(sp, 0),
			    KSH_UNWIND_ERROR0x0, true1);
			sp = strchr(sp, 0) + 1;
			for (p = str_val(&v); *p; ) {
				Xcheck(ds, dp)do { ptrdiff_t more = ((dp) + (1)) - (ds).end; if (more > 0
) dp = Xcheck_grow_(&ds, dp, more); } while (0);
				*dp++ = *p++;
			}
		}
		continue;
	case OSUBST7: /* ${{#}var{:}[=+-?#%]word} */
	  /* format is:
	   *   OSUBST [{x] plain-variable-part \0
	   *     compiled-word-part CSUBST [}x]
	   * This is where all syntax checking gets done...
	   */
	    {
		char *varname = ++sp; /* skip the { or x (}) */
		int stype;
		int slen = 0;

		sp = strchr(sp, '\0') + 1; /* skip variable */
		type = varsub(&x, varname, sp, &stype, &slen);
		if (type < 0) {
			char endc;
			char *str, *end;

			sp = varname - 2; /* restore sp */
			end = (char *) wdscan(sp, CSUBST8);
			/* ({) the } or x is already skipped */
			endc = *end;
			*end = EOS0;
			str = snptreef(NULL((void*)0), 64, "%S", sp);
			*end = endc;
			errorf("%s: bad substitution", str);
		}
		if (f&DOBLANK(1<<(0)))
			doblank++;
		tilde_ok = 0;
		if (word == IFS_QUOTE4 && type != XNULLSUB5)
			word = IFS_WORD0;
		if (type == XBASE0) {	/* expand? */
			if (!st->next) {
				SubType *newst;

				newst = alloc(
				    sizeof(SubType), ATEMP&genv->area);
				newst->next = NULL((void*)0);
				newst->prev = st;
				st->next = newst;
			}
			st = st->next;
			st->stype = stype;
			st->base = Xsavepos(ds, dp)((dp) - (ds).beg);
			st->f = f;
			st->var = varcpy(x.var);
			st->quote = quote;
			/* skip qualifier(s) */
			if (stype)
				sp += slen;
			switch (stype & 0x7f) {
			case '#':
			case '%':
				/* ! DOBLANK,DOBRACE_,DOTILDE */
				f = DOPAT(1<<(2)) | (f&DONTRUNCOMMAND(1<<(4))) |
				    DOTEMP_(1<<(8));
				quote = 0;
				/* Prepend open pattern (so |
				 * in a trim will work as
				 * expected)
				 */
				*dp++ = MAGIC(7);
				*dp++ = '@' + 0x80U;
				break;
			case '=':
				/* Enabling tilde expansion
				 * after :'s here is
				 * non-standard ksh, but is
				 * consistent with rules for
				 * other assignments.  Not
				 * sure what POSIX thinks of
				 * this.
				 * Not doing tilde expansion
				 * for integer variables is a
				 * non-POSIX thing - makes
				 * sense though, since ~ is
				 * a arithmetic operator.
				 */
				if (!(x.var->flag & INTEGER(1<<(9))))
					f |= DOASNTILDE(1<<(5))|DOTILDE(1<<(3));
				f |= DOTEMP_(1<<(8));
				/* These will be done after the
				 * value has been assigned.
				 */
				f &= ~(DOBLANK(1<<(0))|DOGLOB(1<<(1))|DOBRACE_(1<<(6)));
				tilde_ok = 1;
				break;
			case '?':
				f &= ~DOBLANK(1<<(0));
				f |= DOTEMP_(1<<(8));
				/* FALLTHROUGH */
			default:
				/* '-' '+' '?' */
				if (quote)
					word = IFS_WORD0;
				else if (dp == Xstring(ds, dp)((ds).beg))
					word = IFS_IWS3;
				/* Enable tilde expansion */
				tilde_ok = 1;
				f |= DOTILDE(1<<(3));
			}
		} else
			/* skip word */
			sp = (char *) wdscan(sp, CSUBST8);
		continue;
	    }
	case CSUBST8: /* only get here if expanding word */
		sp++; /* ({) skip the } or x */
		tilde_ok = 0;	/* in case of ${unset:-} */
		*dp = '\0';
		quote = st->quote;
29
←
Access to field 'quote' results in a dereference of a null pointer (loaded from variable 'st')
		f = st->f;
		if (f&DOBLANK(1<<(0)))
20
←
Taking false branch→
			doblank--;
		switch (st->stype&0x7f) {
21
←
'Default' branch taken. Execution continues on line 466→
		case '#':
		case '%':
			/* Append end-pattern */
			*dp++ = MAGIC(7); *dp++ = ')'; *dp = '\0';
			dp = Xrestpos(ds, dp, st->base)((ds).beg + (st->base));
			/* Must use st->var since calling
			 * global would break things
			 * like x[i+=1].
			 */
			x.str = trimsub(str_val(st->var),
				dp, st->stype);
			if (x.str[0] != '\0') {
				word = IFS_IWS3;
				type = XSUB1;
			} else if (quote) {
				word = IFS_WORD0;
				type = XSUB1;
			} else {
				if (dp == Xstring(ds, dp)((ds).beg))
					word = IFS_IWS3;
				type = XNULLSUB5;
			}
			if (f&DOBLANK(1<<(0)))
				doblank++;
			st = st->prev;
			continue;
		case '=':
			/* Restore our position and substitute
			 * the value of st->var (may not be
			 * the assigned value in the presence
			 * of integer/right-adj/etc attributes).
			 */
			dp = Xrestpos(ds, dp, st->base)((ds).beg + (st->base));
			/* Must use st->var since calling
			 * global would cause with things
			 * like x[i+=1] to be evaluated twice.
			 */
			/* Note: not exported by FEXPORT
			 * in at&t ksh.
			 */
			/* XXX POSIX says readonly is only
			 * fatal for special builtins (setstr
			 * does readonly check).
			 */
			len = strlen(dp) + 1;
			setstr(st->var,
			    debunk(alloc(len, ATEMP&genv->area),
			    dp, len), KSH_UNWIND_ERROR0x0);
			x.str = str_val(st->var);
			type = XSUB1;
			if (f&DOBLANK(1<<(0)))
				doblank++;
			st = st->prev;
			if (quote || !*x.str)
				word = IFS_WORD0;
			else
				word = IFS_IWS3;
			continue;
		case '?':
		    {
			char *s = Xrestpos(ds, dp, st->base)((ds).beg + (st->base));

			errorf("%s: %s", st->var->name,
			    dp == s ?
			    "parameter null or not set" :
			    (debunk(s, s, strlen(s) + 1), s));
		    }
		}
		st = st->prev;
22
←
Null pointer value stored to 'st'→
		type = XBASE0;
		continue;
23
←
 Execution continues on line 204→

	case OPAT9: /* open pattern: *(foo|bar) */
		/* Next char is the type of pattern */
		make_magic = 1;
		c = *sp++ + 0x80;
		break;

	case SPAT10: /* pattern separator (|) */
		make_magic = 1;
		c = '|';
		break;

	case CPAT11: /* close pattern */
		make_magic = 1;
		c = /*(*/ ')';
		break;
	}
	break;

case XNULLSUB5:
	/* Special case for "$@" (and "${foo[@]}") - no
	 * word is generated if $# is 0 (unless there is
	 * other stuff inside the quotes).
	 */
	type = XBASE0;
	if (f&DOBLANK(1<<(0))) {
		doblank--;
		if (dp == Xstring(ds, dp)((ds).beg) && word != IFS_WORD0)
			word = IFS_IWS3;
	}
	continue;

case XSUB1:
case XSUBMID6:
	if ((c = *x.str++) == 0) {
		type = XBASE0;
		if (f&DOBLANK(1<<(0)))
			doblank--;
		continue;
	}
	break;

case XARGSEP2:
	type = XARG3;
	quote = 1;
case XARG3:
	if ((c = *x.str++) == '\0') {
		/* force null words to be created so
		 * set -- '' 2 ''; foo "$@" will do
		 * the right thing
		 */
		if (quote && x.split)
			word = IFS_WORD0;
		if ((x.str = *x.u.strv++) == NULL((void*)0)) {
			type = XBASE0;
			if (f&DOBLANK(1<<(0)))
				doblank--;
			continue;
		}
		c = ifs0;
		if (c == 0) {
			if (quote && !x.split)
				continue;
			if (!quote && word == IFS_WS1)
				continue;
			/* this is so we don't terminate */
			c = ' ';
			/* now force-emit a word */
			goto emit_word;
		}
		if (quote && x.split) {
			/* terminate word for "$@" */
			type = XARGSEP2;
			quote = 0;
		}
	}
	break;

case XCOM4:
	if (x.u.shf == NULL((void*)0))	/* $(< ...) failed, fake EOF */
		c = EOF(-1);
	else if (newlines) {		/* Spit out saved nl's */
		c = '\n';
		--newlines;
	} else {
		while ((c = shf_getc(x.u.shf)((x.u.shf)->rnleft > 0 ? (x.u.shf)->rnleft--, *(x.u.
shf)->rp++ : shf_getchar(x.u.shf))) == 0 || c == '\n')
		    if (c == '\n')
			    newlines++;	/* Save newlines */
		if (newlines && c != EOF(-1)) {
			shf_ungetc(c, x.u.shf);
			c = '\n';
			--newlines;
		}
	}
	if (c == EOF(-1)) {
		newlines = 0;
		if (x.u.shf != NULL((void*)0))
			shf_close(x.u.shf);
		if (x.split)
			subst_exstat = waitlast();
		else
			subst_exstat = (x.u.shf == NULL((void*)0));
		type = XBASE0;
		if (f&DOBLANK(1<<(0)))
			doblank--;
		continue;
	}
	break;
}

/* check for end of word or IFS separation */
if (c == 0 || (!quote && (f & DOBLANK(1<<(0))) && doblank &&
    !make_magic && ctype(c, C_IFS)!!(ctypes[(unsigned char)(c)]&((1<<(7)))))) {
	/* How words are broken up:
	 *		   |       value of c
	 *	  word	   |	ws	nws	0
	 *	-----------------------------------
	 *	IFS_WORD	w/WS	w/NWS	w
	 *	IFS_WS		-/WS	w/NWS	-
	 *	IFS_NWS		-/NWS	w/NWS	-
	 *	IFS_IWS		-/WS	w/NWS	-
	 *   (w means generate a word)
	 */
	if ((word == IFS_WORD0) || (word == IFS_QUOTE4) || (c &&
	    (word == IFS_IWS3 || word == IFS_NWS2) &&
	    !ctype(c, C_IFSWS)!!(ctypes[(unsigned char)(c)]&((1<<(4)))))) {
			char *p;
emit_word:
		*dp++ = '\0';
		p = Xclose(ds, dp)aresize((ds).beg, ((dp) - (ds).beg), (ds).areap);
		if (fdo & DOBRACE_(1<<(6)))
			/* also does globbing */
			alt_expand(wp, p, p,
			    p + Xlength(ds, (dp - 1))(((dp - 1)) - (ds).beg),
			    fdo | (f & DOMARKDIRS(1<<(10))));
		else if (fdo & DOGLOB(1<<(1)))
			glob(p, wp, f & DOMARKDIRS(1<<(10)));
		else if ((f & DOPAT(1<<(2))) || !(fdo & DOMAGIC_(1<<(7))))
			XPput(*wp, p)do { if ((*wp).cur >= (*wp).end) { int n = ((*wp).cur - (*
wp).beg); (*wp).beg = areallocarray((*wp).beg, n, 2 * sizeof(
void *), &genv->area); (*wp).cur = (*wp).beg + n; (*wp
).end = (*wp).cur + n; } *(*wp).cur++ = (p); } while (0);
		else
			XPput(*wp, debunk(p, p, strlen(p) + 1))do { if ((*wp).cur >= (*wp).end) { int n = ((*wp).cur - (*
wp).beg); (*wp).beg = areallocarray((*wp).beg, n, 2 * sizeof(
void *), &genv->area); (*wp).cur = (*wp).beg + n; (*wp
).end = (*wp).cur + n; } *(*wp).cur++ = (debunk(p, p, strlen(
p) + 1)); } while (0);
		fdo = 0;
		saw_eq = 0;
		tilde_ok = (f & (DOTILDE(1<<(3))|DOASNTILDE(1<<(5)))) ? 1 : 0;
		if (c != 0)
			Xinit(ds, dp, 128, ATEMP)do { (ds).len = 128; (ds).areap = (&genv->area); (ds).
beg = alloc((ds).len + 8, (ds).areap); (ds).end = (ds).beg + (
ds).len; dp = (ds).beg; } while (0);
	}
	if (c == 0)
		goto done;
	if (word != IFS_NWS2)
		word = ctype(c, C_IFSWS)!!(ctypes[(unsigned char)(c)]&((1<<(4)))) ? IFS_WS1 : IFS_NWS2;
} else {
	if (type == XSUB1) {
		if (word == IFS_NWS2 &&
		    Xlength(ds, dp)((dp) - (ds).beg) == 0) {
			char *p;

			if ((p = strdup("")) == NULL((void*)0))
				internal_errorf("unable "
				    "to allocate memory");
			XPput(*wp, p)do { if ((*wp).cur >= (*wp).end) { int n = ((*wp).cur - (*
wp).beg); (*wp).beg = areallocarray((*wp).beg, n, 2 * sizeof(
void *), &genv->area); (*wp).cur = (*wp).beg + n; (*wp
).end = (*wp).cur + n; } *(*wp).cur++ = (p); } while (0);
		}
		type = XSUBMID6;
	}

	/* age tilde_ok info - ~ code tests second bit */
	tilde_ok <<= 1;
	/* mark any special second pass chars */
	if (!quote)
		switch (c) {
		case '[':
		case '!':
		case '-':
		case ']':
			/* For character classes - doesn't hurt
			 * to have magic !,-,]'s outside of
			 * [...] expressions.
			 */
			if (f & (DOPAT(1<<(2)) | DOGLOB(1<<(1)))) {
				fdo |= DOMAGIC_(1<<(7));
				if (c == '[')
					fdo |= f & DOGLOB(1<<(1));
				*dp++ = MAGIC(7);
			}
			break;
		case '*':
		case '?':
			if (f & (DOPAT(1<<(2)) | DOGLOB(1<<(1)))) {
				fdo |= DOMAGIC_(1<<(7)) | (f & DOGLOB(1<<(1)));
				*dp++ = MAGIC(7);
			}
			break;
		case OBRACE'{':
		case ',':
		case CBRACE'}':
			if ((f & DOBRACE_(1<<(6))) && (c == OBRACE'{' ||
			    (fdo & DOBRACE_(1<<(6))))) {
				fdo |= DOBRACE_(1<<(6))|DOMAGIC_(1<<(7));
				*dp++ = MAGIC(7);
			}
			break;
		case '=':
			/* Note first unquoted = for ~ */
			if (!(f & DOTEMP_(1<<(8))) && !saw_eq) {
				saw_eq = 1;
				tilde_ok = 1;
			}
			break;
		case ':': /* : */
			/* Note unquoted : for ~ */
			if (!(f & DOTEMP_(1<<(8))) && (f & DOASNTILDE(1<<(5))))
				tilde_ok = 1;
			break;
		case '~':
			/* tilde_ok is reset whenever
			 * any of ' " $( $(( ${ } are seen.
			 * Note that tilde_ok must be preserved
			 * through the sequence ${A=a=}~
			 */
			if (type == XBASE0 &&
			    (f & (DOTILDE(1<<(3))|DOASNTILDE(1<<(5)))) &&
			    (tilde_ok & 2)) {
				char *p, *dp_x;

				dp_x = dp;
				p = maybe_expand_tilde(sp,
				    &ds, &dp_x,
				    f & DOASNTILDE(1<<(5)));
				if (p) {
					if (dp != dp_x)
						word = IFS_WORD0;
					dp = dp_x;
					sp = p;
					continue;
				}
			}
			break;
		}
	else
		quote &= ~2; /* undo temporary */

	if (make_magic) {
		make_magic = 0;
		fdo |= DOMAGIC_(1<<(7)) | (f & DOGLOB(1<<(1)));
		*dp++ = MAGIC(7);
	} else if (ISMAGIC(c)((unsigned char)(c) == (7))) {
		fdo |= DOMAGIC_(1<<(7));
		*dp++ = MAGIC(7);
	}
	*dp++ = c; /* save output char */
	word = IFS_WORD0;
}
}

723done:
for (st = &st_head; st != NULL((void*)0); st = st->next) {
if (st->var == NULL((void*)0) || (st->var->flag & RDONLY(1<<(10))) == 0)
	continue;

afree(st->var, ATEMP&genv->area);
}
730}

732/*
* Prepare to generate the string returned by ${} substitution.
*/
735static int
736varsub(Expand *xp, char *sp, char *word,
  int *stypep,	/* becomes qualifier type */
  int *slenp)		/* " " len (=, :=, etc.) valid iff *stypep != 0 */
739{
int c;
int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
int stype;	/* substitution type */
int slen;
char *p;
struct tbl *vp;
int zero_ok = 0;

if (sp[0] == '\0')	/* Bad variable name */
return -1;

xp->var = NULL((void*)0);

/* ${#var}, string length or array size */
if (sp[0] == '#' && (c = sp[1]) != '\0') {
/* Can't have any modifiers for ${#...} */
if (*word != CSUBST8)
	return -1;
sp++;
/* Check for size of array */
if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
	int n = 0;

	vp = global(arrayname(sp));
	if (vp->flag & (ISSET(1<<(2))|ARRAY(1<<(13))))
		zero_ok = 1;
	for (; vp; vp = vp->u.array)
		if (vp->flag & ISSET(1<<(2)))
			n++;
	c = n; /* ksh88/ksh93 go for number, not max index */
} else if (c == '*' || c == '@')
	c = genv->loc->argc;
else {
	p = str_val(global(sp));
	zero_ok = p != null;
	c = strlen(p);
}
if (Flag(FNOUNSET)(shell_flags[(int) (FNOUNSET)]) && c == 0 && !zero_ok)
	errorf("%s: parameter not set", sp);
*stypep = 0; /* unqualified variable/string substitution */
xp->str = str_save(u64ton((uint64_t)c, 10), ATEMP&genv->area);
return XSUB1;
}

/* Check for qualifiers in word part */
stype = 0;
c = word[slen = 0] == CHAR1 ? word[1] : 0;
if (c == ':') {
slen += 2;
stype = 0x80;
c = word[slen + 0] == CHAR1 ? word[slen + 1] : 0;
}
if (ctype(c, C_SUBOP1)!!(ctypes[(unsigned char)(c)]&((1<<(5))))) {
slen += 2;
stype |= c;
} else if (ctype(c, C_SUBOP2)!!(ctypes[(unsigned char)(c)]&((1<<(6))))) { /* Note: ksh88 allows :%, :%%, etc */
slen += 2;
stype = c;
if (word[slen + 0] == CHAR1 && c == word[slen + 1]) {
	stype |= 0x80;
	slen += 2;
}
} else if (stype)	/* : is not ok */
return -1;
if (!stype && *word != CSUBST8)
return -1;
*stypep = stype;
*slenp = slen;

c = sp[0];
if (c == '*' || c == '@') {
switch (stype & 0x7f) {
case '=':	/* can't assign to a vector */
case '%':	/* can't trim a vector (yet) */
case '#':
	return -1;
}
if (genv->loc->argc == 0) {
	xp->str = null;
	xp->var = global(sp);
	state = c == '@' ? XNULLSUB5 : XSUB1;
} else {
	xp->u.strv = (const char **) genv->loc->argv + 1;
	xp->str = *xp->u.strv++;
	xp->split = c == '@'; /* $@ */
	state = XARG3;
}
zero_ok = 1;	/* exempt "$@" and "$*" from 'set -u' */
} else {
if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
	XPtrV wv;

	switch (stype & 0x7f) {
	case '=':	/* can't assign to a vector */
	case '%':	/* can't trim a vector (yet) */
	case '#':
	case '?':
		return -1;
	}
	XPinit(wv, 32)do { void **vp__; vp__ = areallocarray(((void*)0), 32, sizeof
(void *), &genv->area); (wv).cur = (wv).beg = vp__; (wv
).end = vp__ + 32; } while (0);
	vp = global(arrayname(sp));
	for (; vp; vp = vp->u.array) {
		if (!(vp->flag&ISSET(1<<(2))))
			continue;
		XPput(wv, str_val(vp))do { if ((wv).cur >= (wv).end) { int n = ((wv).cur - (wv).
beg); (wv).beg = areallocarray((wv).beg, n, 2 * sizeof(void *
), &genv->area); (wv).cur = (wv).beg + n; (wv).end = (
wv).cur + n; } *(wv).cur++ = (str_val(vp)); } while (0);
	}
	if (XPsize(wv)((wv).cur - (wv).beg) == 0) {
		xp->str = null;
		state = p[1] == '@' ? XNULLSUB5 : XSUB1;
		XPfree(wv)afree((wv).beg, &genv->area);
	} else {
		XPput(wv, 0)do { if ((wv).cur >= (wv).end) { int n = ((wv).cur - (wv).
beg); (wv).beg = areallocarray((wv).beg, n, 2 * sizeof(void *
), &genv->area); (wv).cur = (wv).beg + n; (wv).end = (
wv).cur + n; } *(wv).cur++ = (0); } while (0);
		xp->u.strv = (const char **) XPptrv(wv)((wv).beg);
		xp->str = *xp->u.strv++;
		xp->split = p[1] == '@'; /* ${foo[@]} */
		state = XARG3;
	}
} else {
	/* Can't assign things like $! or $1 */
	if ((stype & 0x7f) == '=' &&
	    (ctype(*sp, C_VAR1)!!(ctypes[(unsigned char)(*sp)]&((1<<(3)))) || digit(*sp)isdigit((unsigned char)(*sp))))
		return -1;
	xp->var = global(sp);
	xp->str = str_val(xp->var);
	state = XSUB1;
}
}

c = stype&0x7f;
/* test the compiler's code generator */
if (ctype(c, C_SUBOP2)!!(ctypes[(unsigned char)(c)]&((1<<(6)))) ||
   (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
   c == '=' || c == '-' || c == '?' : c == '+'))
state = XBASE0;	/* expand word instead of variable value */
if (Flag(FNOUNSET)(shell_flags[(int) (FNOUNSET)]) && xp->str == null && !zero_ok &&
   (ctype(c, C_SUBOP2)!!(ctypes[(unsigned char)(c)]&((1<<(6)))) || (state != XBASE0 && c != '+')))
errorf("%s: parameter not set", sp);
return state;
878}

880/*
* Run the command in $(...) and read its output.
*/
883static int
884comsub(Expand *xp, char *cp)
885{
Source *s, *sold;
struct op *t;
struct shf *shf;

s = pushs(SSTRING3, ATEMP&genv->area);
s->start = s->str = cp;
sold = source;
t = compile(s);
afree(s, ATEMP&genv->area);
source = sold;

if (t == NULL((void*)0))
return XBASE0;

if (t != NULL((void*)0) && t->type == TCOM1 && /* $(<file) */
   *t->args == NULL((void*)0) && *t->vars == NULL((void*)0) && t->ioact != NULL((void*)0)) {
struct ioword *io = *t->ioact;
char *name;

if ((io->flag&IOTYPE0xF) != IOREAD0x1)
	errorf("funny $() command: %s",
	    snptreef(NULL((void*)0), 32, "%R", io));
shf = shf_open(name = evalstr(io->name, DOTILDE(1<<(3))), O_RDONLY0x0000, 0,
	SHF_MAPHI0x0020|SHF_CLEXEC0x0010);
if (shf == NULL((void*)0))
	warningf(!Flag(FTALKING)(shell_flags[(int) (FTALKING)]),
	    "%s: cannot open $(<) input", name);
xp->split = 0;	/* no waitlast() */
} else {
int ofd1, pv[2];
openpipe(pv);
shf = shf_fdopen(pv[0], SHF_RD0x0001, NULL((void*)0));
ofd1 = savefd(1);
if (pv[1] != 1) {
	ksh_dup2(pv[1], 1, false0);
	close(pv[1]);
}
execute(t, XFORK(1<<(1))|XXCOM(1<<(5))|XPIPEO(1<<(4)), NULL((void*)0));
restfd(1, ofd1);
startlast();
xp->split = 1;	/* waitlast() */
}

xp->u.shf = shf;
return XCOM4;
931}

933/*
* perform #pattern and %pattern substitution in ${}
*/

937static char *
938trimsub(char *str, char *pat, int how)
939{
char *end = strchr(str, 0);
char *p, c;

switch (how&0xff) {	/* UCHAR_MAX maybe? */
case '#':		/* shortest at beginning */
for (p = str; p <= end; p++) {
	c = *p; *p = '\0';
	if (gmatch(str, pat, false0)) {
		*p = c;
		return p;
	}
	*p = c;
}
break;
case '#'|0x80:	/* longest match at beginning */
for (p = end; p >= str; p--) {
	c = *p; *p = '\0';
	if (gmatch(str, pat, false0)) {
		*p = c;
		return p;
	}
	*p = c;
}
break;
case '%':		/* shortest match at end */
for (p = end; p >= str; p--) {
	if (gmatch(p, pat, false0))
		return str_nsave(str, p - str, ATEMP&genv->area);
}
break;
case '%'|0x80:	/* longest match at end */
for (p = str; p <= end; p++) {
	if (gmatch(p, pat, false0))
		return str_nsave(str, p - str, ATEMP&genv->area);
}
break;
}

return str;		/* no match, return string */
979}

981/*
* glob
* Name derived from V6's /etc/glob, the program that expanded filenames.
*/

986/* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
987static void
988glob(char *cp, XPtrV *wp, int markdirs)
989{
int oldsize = XPsize(*wp)((*wp).cur - (*wp).beg);

if (glob_str(cp, wp, markdirs) == 0)
XPput(*wp, debunk(cp, cp, strlen(cp) + 1))do { if ((*wp).cur >= (*wp).end) { int n = ((*wp).cur - (*
wp).beg); (*wp).beg = areallocarray((*wp).beg, n, 2 * sizeof(
void *), &genv->area); (*wp).cur = (*wp).beg + n; (*wp
).end = (*wp).cur + n; } *(*wp).cur++ = (debunk(cp, cp, strlen
(cp) + 1)); } while (0);
else
qsortp(XPptrv(*wp)((*wp).beg) + oldsize, (size_t)(XPsize(*wp)((*wp).cur - (*wp).beg) - oldsize),
	xstrcmp);
997}

999#define GF_NONE0		0
1000#define GF_EXCHECK(1<<(0))	BIT(0)(1<<(0))		/* do existence check on file */
1001#define GF_GLOBBED(1<<(1))	BIT(1)(1<<(1))		/* some globbing has been done */
1002#define GF_MARKDIR(1<<(2))	BIT(2)(1<<(2))		/* add trailing / to directories */

1004/* Apply file globbing to cp and store the matching files in wp.  Returns
* the number of matches found.
*/
1007int
1008glob_str(char *cp, XPtrV *wp, int markdirs)
1009{
int oldsize = XPsize(*wp)((*wp).cur - (*wp).beg);
XString xs;
char *xp;

Xinit(xs, xp, 256, ATEMP)do { (xs).len = 256; (xs).areap = (&genv->area); (xs).
beg = alloc((xs).len + 8, (xs).areap); (xs).end = (xs).beg + (
xs).len; xp = (xs).beg; } while (0);
globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR(1<<(2)) : GF_NONE0);
Xfree(xs, xp)afree((xs).beg, (xs).areap);

return XPsize(*wp)((*wp).cur - (*wp).beg) - oldsize;
1019}

1021static void
1022globit(XString *xs,	/* dest string */
  char **xpp,		/* ptr to dest end */
  char *sp,		/* source path */
  XPtrV *wp,		/* output list */
  int check)		/* GF_* flags */
1027{
char *np;		/* next source component */
char *xp = *xpp;
char *se;
char odirsep;

/* This to allow long expansions to be interrupted */
intrcheck();

if (sp == NULL((void*)0)) {	/* end of source path */
/* We only need to check if the file exists if a pattern
 * is followed by a non-pattern (eg, foo*x/bar; no check
 * is needed for foo* since the match must exist) or if
 * any patterns were expanded and the markdirs option is set.
 * Symlinks make things a bit tricky...
 */
if ((check & GF_EXCHECK(1<<(0))) ||
    ((check & GF_MARKDIR(1<<(2))) && (check & GF_GLOBBED(1<<(1))))) {
1045#define stat_check()(stat_done ? stat_done : (stat_done = stat(((*xs).beg), &
statb) == -1 ? -1 : 1))	(stat_done ? stat_done : \
	    (stat_done = stat(Xstring(*xs, xp)((*xs).beg), &statb) == -1 \
		? -1 : 1))
	struct stat lstatb, statb;
	int stat_done = 0;	 /* -1: failed, 1 ok */

	if (lstat(Xstring(*xs, xp)((*xs).beg), &lstatb) == -1)
		return;
	/* special case for systems which strip trailing
	 * slashes from regular files (eg, /etc/passwd/).
	 * SunOS 4.1.3 does this...
	 */
	if ((check & GF_EXCHECK(1<<(0))) && xp > Xstring(*xs, xp)((*xs).beg) &&
	    xp[-1] == '/' && !S_ISDIR(lstatb.st_mode)((lstatb.st_mode & 0170000) == 0040000) &&
	    (!S_ISLNK(lstatb.st_mode)((lstatb.st_mode & 0170000) == 0120000) ||
	    stat_check()(stat_done ? stat_done : (stat_done = stat(((*xs).beg), &
statb) == -1 ? -1 : 1)) < 0 || !S_ISDIR(statb.st_mode)((statb.st_mode & 0170000) == 0040000)))
		return;
	/* Possibly tack on a trailing / if there isn't already
	 * one and if the file is a directory or a symlink to a
	 * directory
	 */
	if (((check & GF_MARKDIR(1<<(2))) && (check & GF_GLOBBED(1<<(1)))) &&
	    xp > Xstring(*xs, xp)((*xs).beg) && xp[-1] != '/' &&
	    (S_ISDIR(lstatb.st_mode)((lstatb.st_mode & 0170000) == 0040000) ||
	    (S_ISLNK(lstatb.st_mode)((lstatb.st_mode & 0170000) == 0120000) && stat_check()(stat_done ? stat_done : (stat_done = stat(((*xs).beg), &
statb) == -1 ? -1 : 1)) > 0 &&
	    S_ISDIR(statb.st_mode)((statb.st_mode & 0170000) == 0040000)))) {
		*xp++ = '/';
		*xp = '\0';
	}
}
XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp), ATEMP))do { if ((*wp).cur >= (*wp).end) { int n = ((*wp).cur - (*
wp).beg); (*wp).beg = areallocarray((*wp).beg, n, 2 * sizeof(
void *), &genv->area); (*wp).cur = (*wp).beg + n; (*wp
).end = (*wp).cur + n; } *(*wp).cur++ = (str_nsave(((*xs).beg
), ((xp) - (*xs).beg), &genv->area)); } while (0);
return;
}

if (xp > Xstring(*xs, xp)((*xs).beg))
*xp++ = '/';
while (*sp == '/') {
Xcheck(*xs, xp)do { ptrdiff_t more = ((xp) + (1)) - (*xs).end; if (more >
 0) xp = Xcheck_grow_(&*xs, xp, more); } while (0);
*xp++ = *sp++;
}
np = strchr(sp, '/');
if (np != NULL((void*)0)) {
se = np;
odirsep = *np;	/* don't assume '/', can be multiple kinds */
*np++ = '\0';
} else {
odirsep = '\0'; /* keep gcc quiet */
se = sp + strlen(sp);
}


/* Check if sp needs globbing - done to avoid pattern checks for strings
* containing MAGIC characters, open ['s without the matching close ],
* etc. (otherwise opendir() will be called which may fail because the
* directory isn't readable - if no globbing is needed, only execute
* permission should be required (as per POSIX)).
*/
if (!has_globbing(sp, se)) {
XcheckN(*xs, xp, se - sp + 1)do { ptrdiff_t more = ((xp) + (se - sp + 1)) - (*xs).end; if (
more > 0) xp = Xcheck_grow_(&*xs, xp, more); } while (
0);
debunk(xp, sp, Xnleft(*xs, xp)((*xs).end - (xp)));
xp += strlen(xp);
*xpp = xp;
globit(xs, xpp, np, wp, check);
} else {
DIR *dirp;
struct dirent *d;
char *name;
int len;
int prefix_len;

*xp = '\0';
prefix_len = Xlength(*xs, xp)((xp) - (*xs).beg);
dirp = opendir(prefix_len ? Xstring(*xs, xp)((*xs).beg) : ".");
if (dirp == NULL((void*)0))
	goto Nodir;
while ((d = readdir(dirp)) != NULL((void*)0)) {
	name = d->d_name;
	if (name[0] == '.' &&
	    (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
		continue; /* always ignore . and .. */
	if ((*name == '.' && *sp != '.') ||
	    !gmatch(name, sp, true1))
		continue;

	len = strlen(d->d_name) + 1;
	XcheckN(*xs, xp, len)do { ptrdiff_t more = ((xp) + (len)) - (*xs).end; if (more >
 0) xp = Xcheck_grow_(&*xs, xp, more); } while (0);
	memcpy(xp, name, len);
	*xpp = xp + len - 1;
	globit(xs, xpp, np, wp,
		(check & GF_MARKDIR(1<<(2))) | GF_GLOBBED(1<<(1))
		| (np ? GF_EXCHECK(1<<(0)) : GF_NONE0));
	xp = Xstring(*xs, xp)((*xs).beg) + prefix_len;
}
closedir(dirp);
 Nodir:;
}

if (np != NULL((void*)0))
*--np = odirsep;
1144}

1146/* remove MAGIC from string */
1147char *
1148debunk(char *dp, const char *sp, size_t dlen)
1149{
char *d, *s;

if ((s = strchr(sp, MAGIC(7)))) {
size_t slen = s - sp;
if (slen >= dlen)
	return dp;
memcpy(dp, sp, slen);
for (d = dp + slen; *s && (d < dp + dlen); s++)
	if (!ISMAGIC(*s)((unsigned char)(*s) == (7)) || !(*++s & 0x80) ||
	    !strchr("*+?@! ", *s & 0x7f))
		*d++ = *s;
	else {
		/* extended pattern operators: *+?@! */
		if ((*s & 0x7f) != ' ')
			*d++ = *s & 0x7f;
		if (d < dp + dlen)
			*d++ = '(';
	}
*d = '\0';
} else if (dp != sp)
strlcpy(dp, sp, dlen);
return dp;
1172}

1174/* Check if p is an unquoted name, possibly followed by a / or :.  If so
* puts the expanded version in *dcp,dp and returns a pointer in p just
* past the name, otherwise returns 0.
*/
1178static char *
1179maybe_expand_tilde(char *p, XString *dsp, char **dpp, int isassign)
1180{
XString ts;
char *dp = *dpp;
char *tp, *r;

Xinit(ts, tp, 16, ATEMP)do { (ts).len = 16; (ts).areap = (&genv->area); (ts).beg
 = alloc((ts).len + 8, (ts).areap); (ts).end = (ts).beg + (ts
).len; tp = (ts).beg; } while (0);
/* : only for DOASNTILDE form */
while (p[0] == CHAR1 && p[1] != '/' && (!isassign || p[1] != ':'))
{
Xcheck(ts, tp)do { ptrdiff_t more = ((tp) + (1)) - (ts).end; if (more > 0
) tp = Xcheck_grow_(&ts, tp, more); } while (0);
*tp++ = p[1];
p += 2;
}
*tp = '\0';
r = (p[0] == EOS0 || p[0] == CHAR1 || p[0] == CSUBST8) ?
   tilde(Xstring(ts, tp)((ts).beg)) : NULL((void*)0);
Xfree(ts, tp)afree((ts).beg, (ts).areap);
if (r) {
while (*r) {
	Xcheck(*dsp, dp)do { ptrdiff_t more = ((dp) + (1)) - (*dsp).end; if (more >
 0) dp = Xcheck_grow_(&*dsp, dp, more); } while (0);
	if (ISMAGIC(*r)((unsigned char)(*r) == (7)))
		*dp++ = MAGIC(7);
	*dp++ = *r++;
}
*dpp = dp;
r = p;
}
return r;
1208}

1210/*
* tilde expansion
*
* based on a version by Arnold Robbins
*/

1216static char *
1217tilde(char *cp)
1218{
char *dp;

if (cp[0] == '\0')
dp = str_val(global("HOME"));
else if (cp[0] == '+' && cp[1] == '\0')
dp = str_val(global("PWD"));
else if (cp[0] == '-' && cp[1] == '\0')
dp = str_val(global("OLDPWD"));
else
dp = homedir(cp);
/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
if (dp == null)
dp = NULL((void*)0);
return dp;
1233}

1235/*
* map userid to user's home directory.
* note that 4.3's getpw adds more than 6K to the shell,
* and the YP version probably adds much more.
* we might consider our own version of getpwnam() to keep the size down.
*/

1242static char *
1243homedir(char *name)
1244{
struct tbl *ap;

ap = ktenter(&homedirs, name, hash(name));
if (!(ap->flag & ISSET(1<<(2)))) {
struct passwd *pw;

pw = getpwnam(name);
if (pw == NULL((void*)0))
	return NULL((void*)0);
ap->val.s = str_save(pw->pw_dir, APERM&aperm);
ap->flag |= DEFINED(1<<(1))|ISSET(1<<(2))|ALLOC(1<<(0));
}
return ap->val.s;
1258}

1260static void
1261alt_expand(XPtrV *wp, char *start, char *exp_start, char *end, int fdo)
1262{
int count = 0;
char *brace_start, *brace_end, *comma = NULL((void*)0);
char *field_start;
char *p;

/* search for open brace */
for (p = exp_start; (p = strchr(p, MAGIC(7))) && p[1] != OBRACE'{'; p += 2)
;
brace_start = p;

/* find matching close brace, if any */
if (p) {
comma = NULL((void*)0);
count = 1;
for (p += 2; *p && count; p++) {
	if (ISMAGIC(*p)((unsigned char)(*p) == (7))) {
		if (*++p == OBRACE'{')
			count++;
		else if (*p == CBRACE'}')
			--count;
		else if (*p == ',' && count == 1)
			comma = p;
	}
}
}
/* no valid expansions... */
if (!p || count != 0) {
/* Note that given a{{b,c} we do not expand anything (this is
 * what at&t ksh does.  This may be changed to do the {b,c}
 * expansion. }
 */
if (fdo & DOGLOB(1<<(1)))
	glob(start, wp, fdo & DOMARKDIRS(1<<(10)));
else
	XPput(*wp, debunk(start, start, end - start))do { if ((*wp).cur >= (*wp).end) { int n = ((*wp).cur - (*
wp).beg); (*wp).beg = areallocarray((*wp).beg, n, 2 * sizeof(
void *), &genv->area); (*wp).cur = (*wp).beg + n; (*wp
).end = (*wp).cur + n; } *(*wp).cur++ = (debunk(start, start,
 end - start)); } while (0);
return;
}
brace_end = p;
if (!comma) {
alt_expand(wp, start, brace_end, end, fdo);
return;
}

/* expand expression */
field_start = brace_start + 2;
count = 1;
for (p = brace_start + 2; p != brace_end; p++) {
if (ISMAGIC(*p)((unsigned char)(*p) == (7))) {
	if (*++p == OBRACE'{')
		count++;
	else if ((*p == CBRACE'}' && --count == 0) ||
	    (*p == ',' && count == 1)) {
		char *new;
		int l1, l2, l3;

		l1 = brace_start - start;
		l2 = (p - 1) - field_start;
		l3 = end - brace_end;
		new = alloc(l1 + l2 + l3 + 1, ATEMP&genv->area);
		memcpy(new, start, l1);
		memcpy(new + l1, field_start, l2);
		memcpy(new + l1 + l2, brace_end, l3);
		new[l1 + l2 + l3] = '\0';
		alt_expand(wp, new, new + l1,
		    new + l1 + l2 + l3, fdo);
		field_start = p + 1;
	}
}
}
return;
1333}

1335/*
* Copy the given variable if it's flagged as read-only.
* Such variables have static storage and only one can therefore be referenced
* at a time.
* This is necessary in order to allow variable expansion expressions to refer
* to multiple read-only variables.
*/
1342static struct tbl *
1343varcpy(struct tbl *vp)
1344{
struct tbl *cpy;

if (vp == NULL((void*)0) || (vp->flag & RDONLY(1<<(10))) == 0)
return vp;

cpy = alloc(sizeof(struct tbl), ATEMP&genv->area);
memcpy(cpy, vp, sizeof(struct tbl));
return cpy;
1353}