wordexp cannot use we_offs unless WRDE_DOOFFS flag is set

previously, a potentially-indeterminate value from we_offs was being
used, resulting in wrong we_wordc and subsequent crashes in the
caller.

diff --git a/src/misc/wordexp.c b/src/misc/wordexp.c
index 4609b99f624c0926d8ce054230562f8080863214..4a3efc7bc40a83d055bb1f4d952e6b70b2d4893c 100644 (file)
--- a/src/misc/wordexp.c
+++ b/src/misc/wordexp.c
@@ -136,7 +136,8 @@ static int do_wordexp(const char *s, wordexp_t *we, int flags)
        }
 
        we->we_wordv = wv;
-       we->we_wordc = i - we->we_offs;
+       we->we_wordc = i;
+       if (flags & WRDE_DOOFFS) we->we_wordc -= we->we_offs;
        return err;
 }