hush: replace flag bytes in struct o_string with bit flags
[oweals/busybox.git] / shell / hush.c
index 2a4e80b6ea26ad7584748e02b4ef18d70e0319ca..05ac4096fe9fd9bd90b065ac8c4f277aca4b91eb 100644 (file)
@@ -349,7 +349,7 @@ typedef struct nommu_save_t {
 } nommu_save_t;
 #endif
 
-typedef enum reserved_style {
+enum {
        RES_NONE  = 0,
 #if ENABLE_HUSH_IF
        RES_IF    ,
@@ -378,7 +378,13 @@ typedef enum reserved_style {
 #endif
        RES_XXXX  ,
        RES_SNTX
-} reserved_style;
+};
+
+enum {
+       EXP_FLAG_GLOB = 0x200,
+       EXP_FLAG_ESC_GLOB_CHARS = 0x100,
+       EXP_FLAG_SINGLEWORD = 0x80, /* must be 0x80 */
+};
 
 typedef struct o_string {
        char *data;
@@ -386,8 +392,7 @@ typedef struct o_string {
        int maxlen;
        /* Protect newly added chars against globbing
         * (by prepending \ to *, ?, [, \) */
-       smallint o_escape;
-       smallint o_glob;
+       int o_expflags;
        /* At least some part of the string was inside '' or "",
         * possibly empty one: word"", wo''rd etc. */
        smallint has_quoted_part;
@@ -1344,11 +1349,14 @@ static void hush_exit(int exitcode)
                /* Prevent recursion:
                 * trap "echo Hi; exit" EXIT; exit
                 */
-               char *argv[] = { NULL, G.traps[0], NULL };
+               char *argv[3];
+               /* argv[0] is unused */
+               argv[1] = G.traps[0];
+               argv[2] = NULL;
                G.traps[0] = NULL;
                G.exiting = 1;
                builtin_eval(argv);
-               free(argv[1]);
+               /* free(argv[1]); - why bother */
        }
 
 #if ENABLE_HUSH_JOB
@@ -1376,10 +1384,12 @@ static int check_and_run_traps(int sig)
                if (G.traps && G.traps[sig]) {
                        if (G.traps[sig][0]) {
                                /* We have user-defined handler */
-                               char *argv[] = { NULL, xstrdup(G.traps[sig]), NULL };
+                               char *argv[3];
+                               /* argv[0] is unused */
+                               argv[1] = G.traps[sig];
+                               argv[2] = NULL;
                                save_rcode = G.last_exitcode;
                                builtin_eval(argv);
-                               free(argv[1]);
                                G.last_exitcode = save_rcode;
                        } /* else: "" trap, ignoring signal */
                        continue;
@@ -1439,13 +1449,11 @@ static const char *get_cwd(int force)
 /*
  * Shell and environment variable support
  */
-static struct variable **get_ptr_to_local_var(const char *name)
+static struct variable **get_ptr_to_local_var(const char *name, unsigned len)
 {
        struct variable **pp;
        struct variable *cur;
-       int len;
 
-       len = strlen(name);
        pp = &G.top_var;
        while ((cur = *pp) != NULL) {
                if (strncmp(cur->varstr, name, len) == 0 && cur->varstr[len] == '=')
@@ -1455,21 +1463,13 @@ static struct variable **get_ptr_to_local_var(const char *name)
        return NULL;
 }
 
-static struct variable *get_local_var(const char *name)
-{
-       struct variable **pp = get_ptr_to_local_var(name);
-       if (pp)
-               return *pp;
-       return NULL;
-}
-
 static const char* FAST_FUNC get_local_var_value(const char *name)
 {
        struct variable **vpp;
+       unsigned len = strlen(name);
 
        if (G.expanded_assignments) {
                char **cpp = G.expanded_assignments;
-               int len = strlen(name);
                while (*cpp) {
                        char *cp = *cpp;
                        if (strncmp(cp, name, len) == 0 && cp[len] == '=')
@@ -1478,17 +1478,16 @@ static const char* FAST_FUNC get_local_var_value(const char *name)
                }
        }
 
-       vpp = get_ptr_to_local_var(name);
+       vpp = get_ptr_to_local_var(name, len);
        if (vpp)
-               return strchr((*vpp)->varstr, '=') + 1;
+               return (*vpp)->varstr + len + 1;
 
        if (strcmp(name, "PPID") == 0)
                return utoa(G.root_ppid);
        // bash compat: UID? EUID?
 #if ENABLE_HUSH_RANDOM_SUPPORT
-       if (strcmp(name, "RANDOM") == 0) {
+       if (strcmp(name, "RANDOM") == 0)
                return utoa(next_random(&G.random_gen));
-       }
 #endif
        return NULL;
 }
@@ -1677,24 +1676,6 @@ static void unset_vars(char **strings)
        free(strings);
 }
 
-#if ENABLE_SH_MATH_SUPPORT
-# define is_name(c)      ((c) == '_' || isalpha((unsigned char)(c)))
-# define is_in_name(c)   ((c) == '_' || isalnum((unsigned char)(c)))
-static char* FAST_FUNC endofname(const char *name)
-{
-       char *p;
-
-       p = (char *) name;
-       if (!is_name(*p))
-               return p;
-       while (*++p) {
-               if (!is_in_name(*p))
-                       break;
-       }
-       return p;
-}
-#endif
-
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
        char *var = xasprintf("%s=%s", name, val);
@@ -1738,9 +1719,7 @@ static struct variable *set_vars_and_save_old(char **strings)
 
                eq = strchr(*s, '=');
                if (eq) {
-                       *eq = '\0';
-                       var_pp = get_ptr_to_local_var(*s);
-                       *eq = '=';
+                       var_pp = get_ptr_to_local_var(*s, eq - *s);
                        if (var_pp) {
                                /* Remove variable from global linked list */
                                var_p = *var_pp;
@@ -1792,7 +1771,7 @@ static void cmdedit_update_prompt(void)
                G.PS2 = "> ";
 }
 
-static const charsetup_prompt_string(int promptmode)
+static const char *setup_prompt_string(int promptmode)
 {
        const char *prompt_str;
        debug_printf("setup_prompt_string %d ", promptmode);
@@ -2007,12 +1986,17 @@ static void o_addstr_with_NUL(o_string *o, const char *str)
 static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len)
 {
        while (len) {
+               len--;
                o_addchr(o, *str);
-               if (*str == '\\') {
+               if (*str++ == '\\') {
+                       /* \z -> \\\z; \<eol> -> \\<eol> */
                        o_addchr(o, '\\');
+                       if (len) {
+                               len--;
+                               o_addchr(o, '\\');
+                               o_addchr(o, *str++);
+                       }
                }
-               str++;
-               len--;
        }
 }
 
@@ -2056,7 +2040,9 @@ static void o_addqchr(o_string *o, int ch)
 static void o_addQchr(o_string *o, int ch)
 {
        int sz = 1;
-       if (o->o_escape && strchr("*?[\\" MAYBE_BRACES, ch)) {
+       if ((o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)
+        && strchr("*?[\\" MAYBE_BRACES, ch)
+       ) {
                sz++;
                o->data[o->length] = '\\';
                o->length++;
@@ -2067,12 +2053,8 @@ static void o_addQchr(o_string *o, int ch)
        o->data[o->length] = '\0';
 }
 
-static void o_addQblock(o_string *o, const char *str, int len)
+static void o_addqblock(o_string *o, const char *str, int len)
 {
-       if (!o->o_escape) {
-               o_addblock(o, str, len);
-               return;
-       }
        while (len) {
                char ch;
                int sz;
@@ -2099,6 +2081,15 @@ static void o_addQblock(o_string *o, const char *str, int len)
        }
 }
 
+static void o_addQblock(o_string *o, const char *str, int len)
+{
+       if (!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)) {
+               o_addblock(o, str, len);
+               return;
+       }
+       o_addqblock(o, str, len);
+}
+
 static void o_addQstr(o_string *o, const char *str)
 {
        o_addQblock(o, str, strlen(str));
@@ -2123,7 +2114,10 @@ static void debug_print_list(const char *prefix, o_string *o, int n)
 
        indent();
        fprintf(stderr, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
-                       prefix, list, n, string_start, o->length, o->maxlen, o->o_glob, o->has_quoted_part, o->o_escape);
+                       prefix, list, n, string_start, o->length, o->maxlen,
+                       !!(o->o_expflags & EXP_FLAG_GLOB),
+                       o->has_quoted_part,
+                       !!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
        while (i < n) {
                indent();
                fprintf(stderr, " list[%d]=%d '%s' %p\n", i, (int)list[i],
@@ -2173,7 +2167,7 @@ static int o_save_ptr_helper(o_string *o, int n)
                                n, string_len, string_start);
                o->has_empty_slot = 0;
        }
-       list[n] = (char*)(ptrdiff_t)string_len;
+       list[n] = (char*)(uintptr_t)string_len;
        return n + 1;
 }
 
@@ -2183,7 +2177,7 @@ static int o_get_last_ptr(o_string *o, int n)
        char **list = (char**)o->data;
        int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
 
-       return ((int)(ptrdiff_t)list[n-1]) + string_start;
+       return ((int)(uintptr_t)list[n-1]) + string_start;
 }
 
 #ifdef HUSH_BRACE_EXP
@@ -2221,9 +2215,9 @@ static const char *next_brace_sub(const char *cp)
                        cp++;
                        continue;
                }
-                /*{*/ if ((*cp == '}' && depth-- == 0) || (*cp == ',' && depth == 0))
+               if ((*cp == '}' && depth-- == 0) || (*cp == ',' && depth == 0))
                        break;
-               if (*cp++ == '{') /*}*/
+               if (*cp++ == '{')
                        depth++;
        }
 
@@ -2245,7 +2239,7 @@ static int glob_brace(char *pattern, o_string *o, int n)
        while (1) {
                if (*begin == '\0')
                        goto simple_glob;
-               if (*begin == '{') /*}*/ {
+               if (*begin == '{') {
                        /* Find the first sub-pattern and at the same time
                         * find the rest after the closing brace */
                        next = next_brace_sub(begin);
@@ -2253,7 +2247,7 @@ static int glob_brace(char *pattern, o_string *o, int n)
                                /* An illegal expression */
                                goto simple_glob;
                        }
-                       /*{*/ if (*next == '}') {
+                       if (*next == '}') {
                                /* "{abc}" with no commas - illegal
                                 * brace expr, disregard and skip it */
                                begin = next + 1;
@@ -2270,7 +2264,7 @@ static int glob_brace(char *pattern, o_string *o, int n)
 
        /* Now find the end of the whole brace expression */
        rest = next;
-       /*{*/ while (*rest != '}') {
+       while (*rest != '}') {
                rest = next_brace_sub(rest);
                if (rest == NULL) {
                        /* An illegal expression */
@@ -2306,7 +2300,7 @@ static int glob_brace(char *pattern, o_string *o, int n)
                 * That's why we re-copy prefix every time (1st memcpy above).
                 */
                n = glob_brace(new_pattern_buf, o, n);
-               /*{*/ if (*next == '}') {
+               if (*next == '}') {
                        /* We saw the last entry */
                        break;
                }
@@ -2356,11 +2350,11 @@ static int glob_brace(char *pattern, o_string *o, int n)
 /* Performs globbing on last list[],
  * saving each result as a new list[].
  */
-static int o_glob(o_string *o, int n)
+static int perform_glob(o_string *o, int n)
 {
        char *pattern, *copy;
 
-       debug_printf_glob("start o_glob: n:%d o->data:%p\n", n, o->data);
+       debug_printf_glob("start perform_glob: n:%d o->data:%p\n", n, o->data);
        if (!o->data)
                return o_save_ptr_helper(o, n);
        pattern = o->data + o_get_last_ptr(o, n);
@@ -2378,7 +2372,7 @@ static int o_glob(o_string *o, int n)
        n = glob_brace(copy, o, n);
        free(copy);
        if (DEBUG_GLOB)
-               debug_print_list("o_glob returning", o, n);
+               debug_print_list("perform_glob returning", o, n);
        return n;
 }
 
@@ -2403,13 +2397,13 @@ static int glob_needed(const char *s)
 /* Performs globbing on last list[],
  * saving each result as a new list[].
  */
-static int o_glob(o_string *o, int n)
+static int perform_glob(o_string *o, int n)
 {
        glob_t globdata;
        int gr;
        char *pattern;
 
-       debug_printf_glob("start o_glob: n:%d o->data:%p\n", n, o->data);
+       debug_printf_glob("start perform_glob: n:%d o->data:%p\n", n, o->data);
        if (!o->data)
                return o_save_ptr_helper(o, n);
        pattern = o->data + o_get_last_ptr(o, n);
@@ -2455,22 +2449,22 @@ static int o_glob(o_string *o, int n)
        }
        globfree(&globdata);
        if (DEBUG_GLOB)
-               debug_print_list("o_glob returning", o, n);
+               debug_print_list("perform_glob returning", o, n);
        return n;
 }
 
 #endif /* !HUSH_BRACE_EXP */
 
-/* If o->o_glob == 1, glob the string so far remembered.
+/* If o->o_expflags & EXP_FLAG_GLOB, glob the string so far remembered.
  * Otherwise, just finish current list[] and start new */
 static int o_save_ptr(o_string *o, int n)
 {
-       if (o->o_glob) { /* if globbing is requested */
+       if (o->o_expflags & EXP_FLAG_GLOB) {
                /* If o->has_empty_slot, list[n] was already globbed
                 * (if it was requested back then when it was filled)
                 * so don't do that again! */
                if (!o->has_empty_slot)
-                       return o_glob(o, n); /* o_save_ptr_helper is inside */
+                       return perform_glob(o, n); /* o_save_ptr_helper is inside */
        }
        return o_save_ptr_helper(o, n);
 }
@@ -2490,33 +2484,36 @@ static char **o_finalize_list(o_string *o, int n)
        list[--n] = NULL;
        while (n) {
                n--;
-               list[n] = o->data + (int)(ptrdiff_t)list[n] + string_start;
+               list[n] = o->data + (int)(uintptr_t)list[n] + string_start;
        }
        return list;
 }
 
-static void free_pipe_list(struct pipe *head);
+static void free_pipe_list(struct pipe *pi);
 
-/* Return code is the exit status of the pipe */
-static void free_pipe(struct pipe *pi)
+/* Returns pi->next - next pipe in the list */
+static struct pipe *free_pipe(struct pipe *pi)
 {
-       char **p;
-       struct command *command;
-       struct redir_struct *r, *rnext;
-       int a, i;
+       struct pipe *next;
+       int i;
 
-       if (pi->stopped_cmds > 0) /* why? */
-               return;
-       debug_printf_clean("run pipe: (pid %d)\n", getpid());
+       debug_printf_clean("free_pipe (pid %d)\n", getpid());
        for (i = 0; i < pi->num_cmds; i++) {
+               struct command *command;
+               struct redir_struct *r, *rnext;
+
                command = &pi->cmds[i];
                debug_printf_clean("  command %d:\n", i);
                if (command->argv) {
-                       for (a = 0, p = command->argv; *p; a++, p++) {
-                               debug_printf_clean("   argv[%d] = %s\n", a, *p);
+                       if (DEBUG_CLEAN) {
+                               int a;
+                               char **p;
+                               for (a = 0, p = command->argv; *p; a++, p++) {
+                                       debug_printf_clean("   argv[%d] = %s\n", a, *p);
+                               }
                        }
                        free_strings(command->argv);
-                       command->argv = NULL;
+                       //command->argv = NULL;
                }
                /* not "else if": on syntax error, we may have both! */
                if (command->group) {
@@ -2524,7 +2521,7 @@ static void free_pipe(struct pipe *pi)
                                        command->cmd_type);
                        free_pipe_list(command->group);
                        debug_printf_clean("   end group\n");
-                       command->group = NULL;
+                       //command->group = NULL;
                }
                /* else is crucial here.
                 * If group != NULL, child_func is meaningless */
@@ -2536,7 +2533,7 @@ static void free_pipe(struct pipe *pi)
 #endif
 #if !BB_MMU
                free(command->group_as_string);
-               command->group_as_string = NULL;
+               //command->group_as_string = NULL;
 #endif
                for (r = command->redirects; r; r = rnext) {
                        debug_printf_clean("   redirect %d%s",
@@ -2545,35 +2542,34 @@ static void free_pipe(struct pipe *pi)
                        if (r->rd_filename) {
                                debug_printf_clean(" fname:'%s'\n", r->rd_filename);
                                free(r->rd_filename);
-                               r->rd_filename = NULL;
+                               //r->rd_filename = NULL;
                        }
                        debug_printf_clean(" rd_dup:%d\n", r->rd_dup);
                        rnext = r->next;
                        free(r);
                }
-               command->redirects = NULL;
+               //command->redirects = NULL;
        }
        free(pi->cmds);   /* children are an array, they get freed all at once */
-       pi->cmds = NULL;
+       //pi->cmds = NULL;
 #if ENABLE_HUSH_JOB
        free(pi->cmdtext);
-       pi->cmdtext = NULL;
+       //pi->cmdtext = NULL;
 #endif
+
+       next = pi->next;
+       free(pi);
+       return next;
 }
 
-static void free_pipe_list(struct pipe *head)
+static void free_pipe_list(struct pipe *pi)
 {
-       struct pipe *pi, *next;
-
-       for (pi = head; pi; pi = next) {
+       while (pi) {
 #if HAS_KEYWORDS
-               debug_printf_clean(" pipe reserved word %d\n", pi->res_word);
+               debug_printf_clean("pipe reserved word %d\n", pi->res_word);
 #endif
-               free_pipe(pi);
                debug_printf_clean("pipe followup code %d\n", pi->followup);
-               next = pi->next;
-               /*pi->next = NULL;*/
-               free(pi);
+               pi = free_pipe(pi);
        }
 }
 
@@ -2927,15 +2923,6 @@ static int done_word(o_string *word, struct parse_context *ctx)
                                                (ctx->ctx_res_w == RES_SNTX));
                                return (ctx->ctx_res_w == RES_SNTX);
                        }
-# ifdef CMD_SINGLEWORD_NOGLOB_COND
-                       if (strcmp(word->data, "export") == 0
-#  if ENABLE_HUSH_LOCAL
-                        || strcmp(word->data, "local") == 0
-#  endif
-                       ) {
-                               command->cmd_type = CMD_SINGLEWORD_NOGLOB_COND;
-                       } else
-# endif
 # if ENABLE_HUSH_BASH_COMPAT
                        if (strcmp(word->data, "[[") == 0) {
                                command->cmd_type = CMD_SINGLEWORD_NOGLOB;
@@ -3161,30 +3148,35 @@ static int redirect_opt_num(o_string *o)
 static char *fetch_till_str(o_string *as_string,
                struct in_str *input,
                const char *word,
-               int skip_tabs)
+               int heredoc_flags)
 {
        o_string heredoc = NULL_O_STRING;
        int past_EOL = 0;
+       int prev = 0; /* not \ */
        int ch;
 
        goto jump_in;
        while (1) {
                ch = i_getch(input);
                nommu_addchr(as_string, ch);
-               if (ch == '\n') {
+               if (ch == '\n'
+               /* TODO: or EOF? (heredoc delimiter may end with <eof>, not only <eol>) */
+                && ((heredoc_flags & HEREDOC_QUOTED) || prev != '\\')
+               ) {
                        if (strcmp(heredoc.data + past_EOL, word) == 0) {
                                heredoc.data[past_EOL] = '\0';
                                debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
                                return heredoc.data;
                        }
                        do {
-                               o_addchr(&heredoc, ch);
+                               o_addchr(&heredoc, '\n');
+                               prev = 0; /* not \ */
                                past_EOL = heredoc.length;
  jump_in:
                                do {
                                        ch = i_getch(input);
                                        nommu_addchr(as_string, ch);
-                               } while (skip_tabs && ch == '\t');
+                               } while ((heredoc_flags & HEREDOC_SKIPTABS) && ch == '\t');
                        } while (ch == '\n');
                }
                if (ch == EOF) {
@@ -3192,6 +3184,11 @@ static char *fetch_till_str(o_string *as_string,
                        return NULL;
                }
                o_addchr(&heredoc, ch);
+               if (prev == '\\' && ch == '\\')
+                       /* Correctly handle foo\\<eol> (not a line cont.) */
+                       prev = 0; /* not \ */
+               else
+                       prev = ch;
                nommu_addchr(as_string, ch);
        }
 }
@@ -3222,7 +3219,7 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
                                        redir->rd_type = REDIRECT_HEREDOC2;
                                        /* redir->rd_dup is (ab)used to indicate <<- */
                                        p = fetch_till_str(&ctx->as_string, input,
-                                               redir->rd_filename, redir->rd_dup & HEREDOC_SKIPTABS);
+                                                       redir->rd_filename, redir->rd_dup);
                                        if (!p) {
                                                syntax_error("unexpected EOF in here document");
                                                return 1;
@@ -3536,7 +3533,7 @@ static int parse_dollar(o_string *as_string,
                struct in_str *input)
 {
        int ch = i_peek(input);  /* first character after the $ */
-       unsigned char quote_mask = dest->o_escape ? 0x80 : 0;
+       unsigned char quote_mask = (dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS) ? 0x80 : 0;
 
        debug_printf_parse("parse_dollar entered: ch='%c'\n", ch);
        if (isalpha(ch)) {
@@ -3752,7 +3749,7 @@ static int parse_stream_dquoted(o_string *as_string,
                nommu_addchr(as_string, ch);
        if (ch == dquote_end) { /* may be only '"' or EOF */
                if (dest->o_assignment == NOT_ASSIGNMENT)
-                       dest->o_escape ^= 1;
+                       dest->o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
                debug_printf_parse("parse_stream_dquoted return 0\n");
                return 0;
        }
@@ -3766,7 +3763,7 @@ static int parse_stream_dquoted(o_string *as_string,
                next = i_peek(input);
        }
        debug_printf_parse("\" ch=%c (%d) escape=%d\n",
-                                       ch, ch, dest->o_escape);
+                       ch, ch, !!(dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
        if (ch == '\\') {
                if (next == EOF) {
                        syntax_error("\\<eof>");
@@ -3777,8 +3774,9 @@ static int parse_stream_dquoted(o_string *as_string,
                 * only when followed by one of the following characters:
                 * $, `, ", \, or <newline>.  A double quote may be quoted
                 * within double quotes by preceding it with a backslash."
+                * NB: in (unquoted) heredoc, above does not apply to ".
                 */
-               if (strchr("$`\"\\\n", next) != NULL) {
+               if (next == dquote_end || strchr("$`\\\n", next) != NULL) {
                        ch = i_getch(input);
                        if (ch != '\n') {
                                o_addqchr(dest, ch);
@@ -3840,7 +3838,7 @@ static struct pipe *parse_stream(char **pstring,
 
        /* Double-quote state is handled in the state variable is_in_dquote.
         * A single-quote triggers a bypass of the main loop until its mate is
-        * found.  When recursing, quote state is passed in via dest->o_escape.
+        * found.  When recursing, quote state is passed in via dest->o_expflags.
         */
        debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
                        end_trigger ? end_trigger : 'X');
@@ -3851,10 +3849,10 @@ static struct pipe *parse_stream(char **pstring,
        o_addchr(&dest, '\0');
        dest.length = 0;
 
-       G.ifs = get_local_var_value("IFS");
-       if (G.ifs == NULL)
-               G.ifs = defifs;
-
+       /* We used to separate words on $IFS here. This was wrong.
+        * $IFS is used only for word splitting when $var is expanded,
+        * here we should use blank chars as separators, not $iFS
+        */
  reset:
 #if ENABLE_HUSH_INTERACTIVE
        input->promptmode = 0; /* PS1 */
@@ -3864,7 +3862,7 @@ static struct pipe *parse_stream(char **pstring,
        is_in_dquote = 0;
        heredoc_cnt = 0;
        while (1) {
-               const char *is_ifs;
+               const char *is_blank;
                const char *is_special;
                int ch;
                int next;
@@ -3881,7 +3879,7 @@ static struct pipe *parse_stream(char **pstring,
                }
                ch = i_getch(input);
                debug_printf_parse(": ch=%c (%d) escape=%d\n",
-                                               ch, ch, dest.o_escape);
+                               ch, ch, !!(dest.o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                if (ch == EOF) {
                        struct pipe *pi;
 
@@ -3934,20 +3932,20 @@ static struct pipe *parse_stream(char **pstring,
                if (ctx.command->argv /* word [word]{... - non-special */
                 || dest.length       /* word{... - non-special */
                 || dest.has_quoted_part     /* ""{... - non-special */
-                || (next != ';'            /* }; - special */
-                   && next != ')'          /* }) - special */
-                   && next != '&'          /* }& and }&& ... - special */
-                   && next != '|'          /* }|| ... - special */
-                   && !strchr(G.ifs, next) /* {word - non-special */
+                || (next != ';'             /* }; - special */
+                   && next != ')'           /* }) - special */
+                   && next != '&'           /* }& and }&& ... - special */
+                   && next != '|'           /* }|| ... - special */
+                   && !strchr(defifs, next) /* {word - non-special */
                    )
                ) {
                        /* They are not special, skip "{}" */
                        is_special += 2;
                }
                is_special = strchr(is_special, ch);
-               is_ifs = strchr(G.ifs, ch);
+               is_blank = strchr(defifs, ch);
 
-               if (!is_special && !is_ifs) { /* ordinary char */
+               if (!is_special && !is_blank) { /* ordinary char */
  ordinary_char:
                        o_addQchr(&dest, ch);
                        if ((dest.o_assignment == MAYBE_ASSIGNMENT
@@ -3960,7 +3958,7 @@ static struct pipe *parse_stream(char **pstring,
                        continue;
                }
 
-               if (is_ifs) {
+               if (is_blank) {
                        if (done_word(&dest, &ctx)) {
                                goto parse_error;
                        }
@@ -3985,7 +3983,7 @@ static struct pipe *parse_stream(char **pstring,
                                }
                                dest.o_assignment = MAYBE_ASSIGNMENT;
                                ch = ';';
-                               /* note: if (is_ifs) continue;
+                               /* note: if (is_blank) continue;
                                 * will still trigger for us */
                        }
                }
@@ -4053,7 +4051,7 @@ static struct pipe *parse_stream(char **pstring,
                        }
                }
  skip_end_trigger:
-               if (is_ifs)
+               if (is_blank)
                        continue;
 
                /* Catch <, > before deciding whether this word is
@@ -4180,7 +4178,7 @@ static struct pipe *parse_stream(char **pstring,
                        dest.has_quoted_part = 1;
                        is_in_dquote ^= 1; /* invert */
                        if (dest.o_assignment == NOT_ASSIGNMENT)
-                               dest.o_escape ^= 1;
+                               dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
                        break;
 #if ENABLE_HUSH_TICK
                case '`': {
@@ -4360,7 +4358,7 @@ static int process_command_subs(o_string *dest, const char *s);
  * of strings. (Think VAR="a b"; echo $VAR).
  * This new list is allocated as a single malloc block.
  * NULL-terminated list of char* pointers is at the beginning of it,
- * followed by strings themself.
+ * followed by strings themselves.
  * Caller can deallocate entire list by single free(list). */
 
 /* Store given string, finalizing the word and starting new one whenever
@@ -4371,10 +4369,19 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
        while (1) {
                int word_len = strcspn(str, G.ifs);
                if (word_len) {
-                       if (output->o_escape || !output->o_glob)
-                               o_addQblock(output, str, word_len);
-                       else /* protect backslashes against globbing up :) */
+                       if (output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)
+                               o_addqblock(output, str, word_len);
+                       else if (!(output->o_expflags & EXP_FLAG_GLOB))
+                               o_addblock(output, str, word_len);
+                       else /* if (!escape && glob) */ {
+                               /* Protect backslashes against globbing up :)
+                                * Example: "v='\*'; echo b$v"
+                                */
                                o_addblock_duplicate_backslash(output, str, word_len);
+                               /*/ Why can't we do it easier? */
+                               /*o_addblock(output, str, word_len); - WRONG: "v='\*'; echo Z$v" prints "Z*" instead of "Z\*" */
+                               /*o_addqblock(output, str, word_len); - WRONG: "v='*'; echo Z$v" prints "Z*" instead of Z* files */
+                       }
                        str += word_len;
                }
                if (!*str)  /* EOL - do not finalize word */
@@ -4402,6 +4409,7 @@ static char *expand_pseudo_dquoted(const char *str)
        o_string dest = NULL_O_STRING;
 
        if (!strchr(str, '$')
+        && !strchr(str, '\\')
 #if ENABLE_HUSH_TICK
         && !strchr(str, '`')
 #endif
@@ -4430,7 +4438,7 @@ static arith_t expand_and_evaluate_arith(const char *arg, int *errcode_p)
 
        hooks.lookupvar = get_local_var_value;
        hooks.setvar = set_local_var_from_halves;
-       hooks.endofname = endofname;
+       //hooks.endofname = endofname;
        exp_str = expand_pseudo_dquoted(arg);
        res = arith(exp_str ? exp_str : arg, errcode_p, &hooks);
        free(exp_str);
@@ -4507,18 +4515,20 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
        char *exp_saveptr; /* points to expansion operator */
        char *exp_word = exp_word; /* for compiler */
 
+       *p = '\0'; /* replace trailing SPECIAL_VAR_SYMBOL */
        var = arg;
-       *p = '\0';
        exp_saveptr = arg[1] ? strchr(VAR_ENCODED_SUBST_OPS, arg[1]) : NULL;
        first_char = arg[0] = first_ch & 0x7f;
        exp_op = 0;
 
-       if (first_char == '#' && arg[1] && !exp_saveptr) {
-               /* handle length expansion ${#var} */
+       if (first_char == '#'      /* ${#... */
+        && arg[1] && !exp_saveptr /* not ${#} and not ${#<op_char>...} */
+       ) {
+               /* It must be length operator: ${#var} */
                var++;
                exp_op = 'L';
        } else {
-               /* maybe handle parameter expansion */
+               /* Maybe handle parameter expansion */
                if (exp_saveptr /* if 2nd char is one of expansion operators */
                 && strchr(NUMERIC_SPECVARS_STR, first_char) /* 1st char is special variable */
                ) {
@@ -4533,8 +4543,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                        exp_word = exp_saveptr + 1;
                        if (exp_op == ':') {
                                exp_op = *exp_word++;
+//TODO: try ${var:} and ${var:bogus} in non-bash config
                                if (ENABLE_HUSH_BASH_COMPAT
-                                && (exp_op == '\0' || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
+                                && (!exp_op || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
                                ) {
                                        /* oops... it's ${var:N[:M]}, not ${var:?xxx} or some such */
                                        exp_op = ':';
@@ -4545,7 +4556,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                } /* else: it's not an expansion op, but bare ${var} */
        }
 
-       /* lookup the variable in question */
+       /* Look up the variable in question */
        if (isdigit(var[0])) {
                /* parse_dollar() should have vetted var for us */
                int n = xatoi_positive(var);
@@ -4594,8 +4605,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                if (exp_op == *exp_word)        /* ## or %% */
                                        exp_word++;
 //TODO: avoid xstrdup unless needed
-// (see HACK ALERT below)
+// (see HACK ALERT below for an example)
                                val = to_be_freed = xstrdup(val);
+//TODO: fix expansion rules:
                                exp_exp_word = expand_pseudo_dquoted(exp_word);
                                if (exp_exp_word)
                                        exp_word = exp_exp_word;
@@ -4613,10 +4625,26 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                }
 #if ENABLE_HUSH_BASH_COMPAT
                else if (exp_op == '/' || exp_op == '\\') {
+                       /* It's ${var/[/]pattern[/repl]} thing.
+                        * Note that in encoded form it has TWO parts:
+                        * var/pattern<SPECIAL_VAR_SYMBOL>repl<SPECIAL_VAR_SYMBOL>
+                        */
                        /* Empty variable always gives nothing: */
-                       // "v=''; echo ${v/*/w}" prints ""
+                       // "v=''; echo ${v/*/w}" prints "", not "w"
                        if (val && val[0]) {
                                /* It's ${var/[/]pattern[/repl]} thing */
+                               /*
+                                * Pattern is taken literally, while
+                                * repl should be unbackslashed and globbed
+                                * by the usual expansion rules:
+                                * >az; >bz;
+                                * v='a bz'; echo "${v/a*z/a*z}" prints "a*z"
+                                * v='a bz'; echo "${v/a*z/\z}"  prints "\z"
+                                * v='a bz'; echo ${v/a*z/a*z}   prints "az"
+                                * v='a bz'; echo ${v/a*z/\z}    prints "z"
+                                * (note that a*z _pattern_ is never globbed!)
+                                */
+//TODO: fix expansion rules:
                                char *pattern, *repl, *t;
                                pattern = expand_pseudo_dquoted(exp_word);
                                if (!pattern)
@@ -4772,7 +4800,6 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
 
        while ((p = strchr(arg, SPECIAL_VAR_SYMBOL)) != NULL) {
                char first_ch;
-               int i;
                char *to_be_freed = NULL;
                const char *val = NULL;
 #if ENABLE_HUSH_TICK
@@ -4795,15 +4822,16 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                switch (first_ch & 0x7f) {
                /* Highest bit in first_ch indicates that var is double-quoted */
                case '*':
-               case '@':
-                       i = 1;
-                       if (!G.global_argv[i])
+               case '@': {
+                       int i;
+                       if (!G.global_argv[1])
                                break;
+                       i = 1;
                        ored_ch |= first_ch; /* do it for "$@" _now_, when we know it's not empty */
                        if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
-                               smallint sv = output->o_escape;
+                               int sv = output->o_expflags;
                                /* unquoted var's contents should be globbed, so don't escape */
-                               output->o_escape = 0;
+                               output->o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
                                while (G.global_argv[i]) {
                                        n = expand_on_ifs(output, n, G.global_argv[i]);
                                        debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, G.global_argc - 1);
@@ -4816,7 +4844,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                                                debug_print_list("expand_vars_to_list[3]", output, n);
                                        }
                                }
-                               output->o_escape = sv;
+                               output->o_expflags = sv;
                        } else
                        /* If or_mask is nonzero, we handle assignment 'a=....$@.....'
                         * and in this case should treat it like '$*' - see 'else...' below */
@@ -4839,6 +4867,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                                }
                        }
                        break;
+               }
                case SPECIAL_VAR_SYMBOL: /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
                        /* "Empty variable", used to make "" etc to not disappear */
                        arg++;
@@ -4892,17 +4921,19 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                        val = expand_one_var(&to_be_freed, arg, &p, first_ch);
  IF_HUSH_TICK(store_val:)
                        if (!(first_ch & 0x80)) { /* unquoted $VAR */
-                               debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val, output->o_escape);
+                               debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
+                                               !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                                if (val && val[0]) {
                                        /* unquoted var's contents should be globbed, so don't escape */
-                                       smallint sv = output->o_escape;
-                                       output->o_escape = 0;
+                                       int sv = output->o_expflags;
+                                       output->o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
                                        n = expand_on_ifs(output, n, val);
                                        val = NULL;
-                                       output->o_escape = sv;
+                                       output->o_expflags = sv;
                                }
                        } else { /* quoted $VAR, val will be appended below */
-                               debug_printf_expand("quoted '%s', output->o_escape:%d\n", val, output->o_escape);
+                               debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
+                                               !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                        }
                        break;
 
@@ -4941,28 +4972,18 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
        return n;
 }
 
-enum {
-       EXPVAR_FLAG_GLOB = 0x200,
-       EXPVAR_FLAG_ESCAPE_VARS = 0x100,
-       EXPVAR_FLAG_SINGLEWORD = 0x80, /* must be 0x80 */
-};
 static char **expand_variables(char **argv, unsigned or_mask)
 {
        int n;
        char **list;
-       char **v;
        o_string output = NULL_O_STRING;
 
-       /* protect against globbing for "$var"? */
-       /* (unquoted $var will temporarily switch it off) */
-       output.o_escape = 1 & (or_mask / EXPVAR_FLAG_ESCAPE_VARS);
-       output.o_glob = 1 & (or_mask / EXPVAR_FLAG_GLOB);
+       output.o_expflags = or_mask;
 
        n = 0;
-       v = argv;
-       while (*v) {
-               n = expand_vars_to_list(&output, n, *v, (unsigned char)or_mask);
-               v++;
+       while (*argv) {
+               n = expand_vars_to_list(&output, n, *argv, (unsigned char)or_mask);
+               argv++;
        }
        debug_print_list("expand_variables", &output, n);
 
@@ -4974,54 +4995,22 @@ static char **expand_variables(char **argv, unsigned or_mask)
 
 static char **expand_strvec_to_strvec(char **argv)
 {
-       return expand_variables(argv, EXPVAR_FLAG_GLOB | EXPVAR_FLAG_ESCAPE_VARS);
+       return expand_variables(argv, EXP_FLAG_GLOB | EXP_FLAG_ESC_GLOB_CHARS);
 }
 
 #if ENABLE_HUSH_BASH_COMPAT
 static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 {
-       return expand_variables(argv, EXPVAR_FLAG_SINGLEWORD);
-}
-#endif
-
-#ifdef CMD_SINGLEWORD_NOGLOB_COND
-static char **expand_strvec_to_strvec_singleword_noglob_cond(char **argv)
-{
-       int n;
-       char **list;
-       char **v;
-       o_string output = NULL_O_STRING;
-
-       n = 0;
-       v = argv;
-       while (*v) {
-               int is_var = is_well_formed_var_name(*v, '=');
-               /* is_var * 0x80: singleword expansion for vars */
-               n = expand_vars_to_list(&output, n, *v, is_var * 0x80);
-
-               /* Subtle! expand_vars_to_list did not glob last word yet.
-                * It does this only when fed with further data.
-                * Therefore we set globbing flags AFTER it, not before:
-                */
-
-               /* if it is not recognizably abc=...; then: */
-               output.o_escape = !is_var; /* protect against globbing for "$var" */
-               /* (unquoted $var will temporarily switch it off) */
-               output.o_glob = !is_var; /* and indeed do globbing */
-               v++;
-       }
-       debug_print_list("expand_cond", &output, n);
-
-       /* output.data (malloced in one block) gets returned in "list" */
-       list = o_finalize_list(&output, n);
-       debug_print_strings("expand_cond[1]", list);
-       return list;
+       return expand_variables(argv, EXP_FLAG_SINGLEWORD);
 }
 #endif
 
-/* Used for expansion of right hand of assignments */
-/* NB: should NOT do globbing!
- * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*" */
+/* Used for expansion of right hand of assignments,
+ * $((...)), heredocs, variable espansion parts.
+ *
+ * NB: should NOT do globbing!
+ * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*"
+ */
 static char *expand_string_to_string(const char *str)
 {
        char *argv[2], **list;
@@ -5038,7 +5027,7 @@ static char *expand_string_to_string(const char *str)
 
        argv[0] = (char*)str;
        argv[1] = NULL;
-       list = expand_variables(argv, EXPVAR_FLAG_ESCAPE_VARS | EXPVAR_FLAG_SINGLEWORD);
+       list = expand_variables(argv, EXP_FLAG_ESC_GLOB_CHARS | EXP_FLAG_SINGLEWORD);
        if (HUSH_DEBUG)
                if (!list[0] || list[1])
                        bb_error_msg_and_die("BUG in varexp2");
@@ -5054,7 +5043,7 @@ static char* expand_strvec_to_string(char **argv)
 {
        char **list;
 
-       list = expand_variables(argv, EXPVAR_FLAG_SINGLEWORD);
+       list = expand_variables(argv, EXP_FLAG_SINGLEWORD);
        /* Convert all NULs to spaces */
        if (list[0]) {
                int n = 1;
@@ -5667,7 +5656,7 @@ static char *find_in_path(const char *arg)
        return ret;
 }
 
-static const struct built_in_commandfind_builtin_helper(const char *name,
+static const struct built_in_command *find_builtin_helper(const char *name,
                const struct built_in_command *x,
                const struct built_in_command *end)
 {
@@ -5681,11 +5670,11 @@ static const struct built_in_command* find_builtin_helper(const char *name,
        }
        return NULL;
 }
-static const struct built_in_commandfind_builtin1(const char *name)
+static const struct built_in_command *find_builtin1(const char *name)
 {
        return find_builtin_helper(name, bltins1, &bltins1[ARRAY_SIZE(bltins1)]);
 }
-static const struct built_in_commandfind_builtin(const char *name)
+static const struct built_in_command *find_builtin(const char *name)
 {
        const struct built_in_command *x = find_builtin1(name);
        if (x)
@@ -6181,15 +6170,13 @@ static void remove_bg_job(struct pipe *pi)
 static void delete_finished_bg_job(struct pipe *pi)
 {
        remove_bg_job(pi);
-       pi->stopped_cmds = 0;
        free_pipe(pi);
-       free(pi);
 }
 #endif /* JOB */
 
 /* Check to see if any processes have exited -- if they
  * have, figure out why and see if a job has completed */
-static int checkjobs(struct pipefg_pipe)
+static int checkjobs(struct pipe *fg_pipe)
 {
        int attributes;
        int status;
@@ -6355,7 +6342,7 @@ static int checkjobs(struct pipe* fg_pipe)
 }
 
 #if ENABLE_HUSH_JOB
-static int checkjobs_and_fg_shell(struct pipefg_pipe)
+static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
 {
        pid_t p;
        int rcode = checkjobs(fg_pipe);
@@ -6436,6 +6423,13 @@ static NOINLINE int run_pipe(struct pipe *pi)
        debug_printf_exec("run_pipe start: members:%d\n", pi->num_cmds);
        debug_enter();
 
+       /* Testcase: set -- q w e; (IFS='' echo "$*"; IFS=''; echo "$*"); echo "$*"
+        * Result should be 3 lines: q w e, qwe, q w e
+        */
+       G.ifs = get_local_var_value("IFS");
+       if (!G.ifs)
+               G.ifs = defifs;
+
        IF_HUSH_JOB(pi->pgrp = -1;)
        pi->stopped_cmds = 0;
        command = &pi->cmds[0];
@@ -6566,11 +6560,6 @@ static NOINLINE int run_pipe(struct pipe *pi)
                else if (command->cmd_type == CMD_SINGLEWORD_NOGLOB) {
                        argv_expanded = expand_strvec_to_strvec_singleword_noglob(argv + command->assignment_cnt);
                }
-#endif
-#ifdef CMD_SINGLEWORD_NOGLOB_COND
-               else if (command->cmd_type == CMD_SINGLEWORD_NOGLOB_COND) {
-                       argv_expanded = expand_strvec_to_strvec_singleword_noglob_cond(argv + command->assignment_cnt);
-               }
 #endif
                else {
                        argv_expanded = expand_strvec_to_strvec(argv + command->assignment_cnt);
@@ -6887,7 +6876,7 @@ static int run_list(struct pipe *pi)
        enum { cond_code = 0 };
 #endif
 #if HAS_KEYWORDS
-       smallint rword; /* enum reserved_style */
+       smallint rword;      /* RES_foo */
        smallint last_rword; /* ditto */
 #endif
 
@@ -7329,14 +7318,10 @@ int hush_main(int argc, char **argv)
         * therefore we xstrdup: */
        G.shell_ver.varstr = xstrdup(hush_version_str),
        G.top_var = &G.shell_ver;
+       /* Create shell local variables from the values
+        * currently living in the environment */
        debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
        unsetenv("HUSH_VERSION"); /* in case it exists in initial env */
-       /* reinstate HUSH_VERSION in environment */
-       debug_printf_env("putenv '%s'\n", G.shell_ver.varstr);
-       putenv(G.shell_ver.varstr);
-
-       /* Initialize our shell local variables with the values
-        * currently living in the environment */
        cur_var = G.top_var;
        e = environ;
        if (e) while (*e) {
@@ -7350,6 +7335,9 @@ int hush_main(int argc, char **argv)
                }
                e++;
        }
+       /* (Re)insert HUSH_VERSION into env (AFTER we scanned the env!) */
+       debug_printf_env("putenv '%s'\n", G.shell_ver.varstr);
+       putenv(G.shell_ver.varstr);
 
        /* Export PWD */
        set_pwd_var(/*exp:*/ 1);
@@ -7882,13 +7870,16 @@ static void helper_export_local(char **argv, int exp, int lvl)
 {
        do {
                char *name = *argv;
+               char *name_end = strchrnul(name, '=');
 
                /* So far we do not check that name is valid (TODO?) */
 
-               if (strchr(name, '=') == NULL) {
-                       struct variable *var;
+               if (*name_end == '\0') {
+                       struct variable *var, **vpp;
+
+                       vpp = get_ptr_to_local_var(name, name_end - name);
+                       var = vpp ? *vpp : NULL;
 
-                       var = get_local_var(name);
                        if (exp == -1) { /* unexporting? */
                                /* export -n NAME (without =VALUE) */
                                if (var) {