path: root/shell/hush.c (plain)
blob: fecc8929446959d850c313327168c5ec731f6281

1	/* vi: set sw=4 ts=4: */
2	/*
3	* A prototype Bourne shell grammar parser.
4	* Intended to follow the original Thompson and Ritchie
5	* "small and simple is beautiful" philosophy, which
6	* incidentally is a good match to today's BusyBox.
7	*
8	* Copyright (C) 2000,2001 Larry Doolittle <larry@doolittle.boa.org>
9	* Copyright (C) 2008,2009 Denys Vlasenko <vda.linux@googlemail.com>
10	*
11	* Licensed under GPLv2 or later, see file LICENSE in this source tree.
12	*
13	* Credits:
14	* The parser routines proper are all original material, first
15	* written Dec 2000 and Jan 2001 by Larry Doolittle. The
16	* execution engine, the builtins, and much of the underlying
17	* support has been adapted from busybox-0.49pre's lash, which is
18	* Copyright (C) 1999-2004 by Erik Andersen <andersen@codepoet.org>
19	* written by Erik Andersen <andersen@codepoet.org>. That, in turn,
20	* is based in part on ladsh.c, by Michael K. Johnson and Erik W.
21	* Troan, which they placed in the public domain. I don't know
22	* how much of the Johnson/Troan code has survived the repeated
23	* rewrites.
24	*
25	* Other credits:
26	* o_addchr derived from similar w_addchar function in glibc-2.2.
27	* parse_redirect, redirect_opt_num, and big chunks of main
28	* and many builtins derived from contributions by Erik Andersen.
29	* Miscellaneous bugfixes from Matt Kraai.
30	*
31	* There are two big (and related) architecture differences between
32	* this parser and the lash parser. One is that this version is
33	* actually designed from the ground up to understand nearly all
34	* of the Bourne grammar. The second, consequential change is that
35	* the parser and input reader have been turned inside out. Now,
36	* the parser is in control, and asks for input as needed. The old
37	* way had the input reader in control, and it asked for parsing to
38	* take place as needed. The new way makes it much easier to properly
39	* handle the recursion implicit in the various substitutions, especially
40	* across continuation lines.
41	*
42	* TODOs:
43	* grep for "TODO" and fix (some of them are easy)
44	* special variables (done: PWD, PPID, RANDOM)
45	* tilde expansion
46	* aliases
47	* kill %jobspec
48	* follow IFS rules more precisely, including update semantics
49	* builtins mandated by standards we don't support:
50	* [un]alias, command, fc, getopts, newgrp, readonly, times
51	* make complex ${var%...} constructs support optional
52	* make here documents optional
53	*
54	* Bash compat TODO:
55	* redirection of stdout+stderr: &> and >&
56	* reserved words: function select
57	* advanced test: [[ ]]
58	* process substitution: <(list) and >(list)
59	* =~: regex operator
60	* let EXPR [EXPR...]
61	* Each EXPR is an arithmetic expression (ARITHMETIC EVALUATION)
62	* If the last arg evaluates to 0, let returns 1; 0 otherwise.
63	* NB: let `echo 'a=a + 1'` - error (IOW: multi-word expansion is used)
64	* ((EXPR))
65	* The EXPR is evaluated according to ARITHMETIC EVALUATION.
66	* This is exactly equivalent to let "EXPR".
67	* $[EXPR]: synonym for $((EXPR))
68	*
69	* Won't do:
70	* In bash, export builtin is special, its arguments are assignments
71	* and therefore expansion of them should be "one-word" expansion:
72	* $ export i=`echo 'a b'` # export has one arg: "i=a b"
73	* compare with:
74	* $ ls i=`echo 'a b'` # ls has two args: "i=a" and "b"
75	* ls: cannot access i=a: No such file or directory
76	* ls: cannot access b: No such file or directory
77	* Note1: same applies to local builtin.
78	* Note2: bash 3.2.33(1) does this only if export word itself
79	* is not quoted:
80	* $ export i=`echo 'aaa bbb'`; echo "$i"
81	* aaa bbb
82	* $ "export" i=`echo 'aaa bbb'`; echo "$i"
83	* aaa
84	*/
85	//config:config HUSH
86	//config: bool "hush"
87	//config: default y
88	//config: help
89	//config: hush is a small shell (25k). It handles the normal flow control
90	//config: constructs such as if/then/elif/else/fi, for/in/do/done, while loops,
91	//config: case/esac. Redirections, here documents, $((arithmetic))
92	//config: and functions are supported.
93	//config:
94	//config: It will compile and work on no-mmu systems.
95	//config:
96	//config: It does not handle select, aliases, tilde expansion,
97	//config: &>file and >&file redirection of stdout+stderr.
98	//config:
99	//config:config HUSH_BASH_COMPAT
100	//config: bool "bash-compatible extensions"
101	//config: default y
102	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
103	//config: help
104	//config: Enable bash-compatible extensions.
105	//config:
106	//config:config HUSH_BRACE_EXPANSION
107	//config: bool "Brace expansion"
108	//config: default y
109	//config: depends on HUSH_BASH_COMPAT
110	//config: help
111	//config: Enable {abc,def} extension.
112	//config:
113	//config:config HUSH_HELP
114	//config: bool "help builtin"
115	//config: default y
116	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
117	//config: help
118	//config: Enable help builtin in hush. Code size + ~1 kbyte.
119	//config:
120	//config:config HUSH_INTERACTIVE
121	//config: bool "Interactive mode"
122	//config: default y
123	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
124	//config: help
125	//config: Enable interactive mode (prompt and command editing).
126	//config: Without this, hush simply reads and executes commands
127	//config: from stdin just like a shell script from a file.
128	//config: No prompt, no PS1/PS2 magic shell variables.
129	//config:
130	//config:config HUSH_SAVEHISTORY
131	//config: bool "Save command history to .hush_history"
132	//config: default y
133	//config: depends on HUSH_INTERACTIVE && FEATURE_EDITING_SAVEHISTORY
134	//config: help
135	//config: Enable history saving in hush.
136	//config:
137	//config:config HUSH_JOB
138	//config: bool "Job control"
139	//config: default y
140	//config: depends on HUSH_INTERACTIVE
141	//config: help
142	//config: Enable job control: Ctrl-Z backgrounds, Ctrl-C interrupts current
143	//config: command (not entire shell), fg/bg builtins work. Without this option,
144	//config: "cmd &" still works by simply spawning a process and immediately
145	//config: prompting for next command (or executing next command in a script),
146	//config: but no separate process group is formed.
147	//config:
148	//config:config HUSH_TICK
149	//config: bool "Process substitution"
150	//config: default y
151	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
152	//config: help
153	//config: Enable process substitution `command` and $(command) in hush.
154	//config:
155	//config:config HUSH_IF
156	//config: bool "Support if/then/elif/else/fi"
157	//config: default y
158	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
159	//config: help
160	//config: Enable if/then/elif/else/fi in hush.
161	//config:
162	//config:config HUSH_LOOPS
163	//config: bool "Support for, while and until loops"
164	//config: default y
165	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
166	//config: help
167	//config: Enable for, while and until loops in hush.
168	//config:
169	//config:config HUSH_CASE
170	//config: bool "Support case ... esac statement"
171	//config: default y
172	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
173	//config: help
174	//config: Enable case ... esac statement in hush. +400 bytes.
175	//config:
176	//config:config HUSH_FUNCTIONS
177	//config: bool "Support funcname() { commands; } syntax"
178	//config: default y
179	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
180	//config: help
181	//config: Enable support for shell functions in hush. +800 bytes.
182	//config:
183	//config:config HUSH_LOCAL
184	//config: bool "Support local builtin"
185	//config: default y
186	//config: depends on HUSH_FUNCTIONS
187	//config: help
188	//config: Enable support for local variables in functions.
189	//config:
190	//config:config HUSH_RANDOM_SUPPORT
191	//config: bool "Pseudorandom generator and $RANDOM variable"
192	//config: default y
193	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
194	//config: help
195	//config: Enable pseudorandom generator and dynamic variable "$RANDOM".
196	//config: Each read of "$RANDOM" will generate a new pseudorandom value.
197	//config:
198	//config:config HUSH_EXPORT_N
199	//config: bool "Support 'export -n' option"
200	//config: default y
201	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
202	//config: help
203	//config: export -n unexports variables. It is a bash extension.
204	//config:
205	//config:config HUSH_MODE_X
206	//config: bool "Support 'hush -x' option and 'set -x' command"
207	//config: default y
208	//config: depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
209	//config: help
210	//config: This instructs hush to print commands before execution.
211	//config: Adds ~300 bytes.
212	//config:
213	//config:config MSH
214	//config: bool "msh (deprecated: aliased to hush)"
215	//config: default n
216	//config: select HUSH
217	//config: help
218	//config: msh is deprecated and will be removed, please migrate to hush.
219
220	//applet:IF_HUSH(APPLET(hush, BB_DIR_BIN, BB_SUID_DROP))
221	//applet:IF_MSH(APPLET_ODDNAME(msh, hush, BB_DIR_BIN, BB_SUID_DROP, hush))
222	//applet:IF_SH_IS_HUSH(APPLET_ODDNAME(sh, hush, BB_DIR_BIN, BB_SUID_DROP, hush))
223	//applet:IF_BASH_IS_HUSH(APPLET_ODDNAME(bash, hush, BB_DIR_BIN, BB_SUID_DROP, hush))
224
225	//kbuild:lib-$(CONFIG_HUSH) += hush.o match.o shell_common.o
226	//kbuild:lib-$(CONFIG_SH_IS_HUSH) += hush.o match.o shell_common.o
227	//kbuild:lib-$(CONFIG_BASH_IS_HUSH) += hush.o match.o shell_common.o
228	//kbuild:lib-$(CONFIG_HUSH_RANDOM_SUPPORT) += random.o
229
230	/* -i (interactive) and -s (read stdin) are also accepted,
231	* but currently do nothing, therefore aren't shown in help.
232	* NOMMU-specific options are not meant to be used by users,
233	* therefore we don't show them either.
234	*/
235	//usage:#define hush_trivial_usage
236	//usage: "[-nxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
237	//usage:#define hush_full_usage "\n\n"
238	//usage: "Unix shell interpreter"
239
240	#if !(defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) \
241	|| defined(__APPLE__) \
242	)
243	# include <malloc.h> /* for malloc_trim */
244	#endif
245	#include <glob.h>
246	/* #include <dmalloc.h> */
247	#if ENABLE_HUSH_CASE
248	# include <fnmatch.h>
249	#endif
250	#include <sys/utsname.h> /* for setting $HOSTNAME */
251
252	#include "busybox.h" /* for APPLET_IS_NOFORK/NOEXEC */
253	#include "unicode.h"
254	#include "shell_common.h"
255	#include "math.h"
256	#include "match.h"
257	#if ENABLE_HUSH_RANDOM_SUPPORT
258	# include "random.h"
259	#else
260	# define CLEAR_RANDOM_T(rnd) ((void)0)
261	#endif
262	#ifndef F_DUPFD_CLOEXEC
263	# define F_DUPFD_CLOEXEC F_DUPFD
264	#endif
265	#ifndef PIPE_BUF
266	# define PIPE_BUF 4096 /* amount of buffering in a pipe */
267	#endif
268
269
270	/* Build knobs */
271	#define LEAK_HUNTING 0
272	#define BUILD_AS_NOMMU 0
273	/* Enable/disable sanity checks. Ok to enable in production,
274	* only adds a bit of bloat. Set to >1 to get non-production level verbosity.
275	* Keeping 1 for now even in released versions.
276	*/
277	#define HUSH_DEBUG 1
278	/* Slightly bigger (+200 bytes), but faster hush.
279	* So far it only enables a trick with counting SIGCHLDs and forks,
280	* which allows us to do fewer waitpid's.
281	* (we can detect a case where neither forks were done nor SIGCHLDs happened
282	* and therefore waitpid will return the same result as last time)
283	*/
284	#define ENABLE_HUSH_FAST 0
285	/* TODO: implement simplified code for users which do not need ${var%...} ops
286	* So far ${var%...} ops are always enabled:
287	*/
288	#define ENABLE_HUSH_DOLLAR_OPS 1
289
290
291	#if BUILD_AS_NOMMU
292	# undef BB_MMU
293	# undef USE_FOR_NOMMU
294	# undef USE_FOR_MMU
295	# define BB_MMU 0
296	# define USE_FOR_NOMMU(...) __VA_ARGS__
297	# define USE_FOR_MMU(...)
298	#endif
299
300	#include "NUM_APPLETS.h"
301	#if NUM_APPLETS == 1
302	/* STANDALONE does not make sense, and won't compile */
303	# undef CONFIG_FEATURE_SH_STANDALONE
304	# undef ENABLE_FEATURE_SH_STANDALONE
305	# undef IF_FEATURE_SH_STANDALONE
306	# undef IF_NOT_FEATURE_SH_STANDALONE
307	# define ENABLE_FEATURE_SH_STANDALONE 0
308	# define IF_FEATURE_SH_STANDALONE(...)
309	# define IF_NOT_FEATURE_SH_STANDALONE(...) __VA_ARGS__
310	#endif
311
312	#if !ENABLE_HUSH_INTERACTIVE
313	# undef ENABLE_FEATURE_EDITING
314	# define ENABLE_FEATURE_EDITING 0
315	# undef ENABLE_FEATURE_EDITING_FANCY_PROMPT
316	# define ENABLE_FEATURE_EDITING_FANCY_PROMPT 0
317	# undef ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
318	# define ENABLE_FEATURE_EDITING_SAVE_ON_EXIT 0
319	#endif
320
321	/* Do we support ANY keywords? */
322	#if ENABLE_HUSH_IF || ENABLE_HUSH_LOOPS || ENABLE_HUSH_CASE
323	# define HAS_KEYWORDS 1
324	# define IF_HAS_KEYWORDS(...) __VA_ARGS__
325	# define IF_HAS_NO_KEYWORDS(...)
326	#else
327	# define HAS_KEYWORDS 0
328	# define IF_HAS_KEYWORDS(...)
329	# define IF_HAS_NO_KEYWORDS(...) __VA_ARGS__
330	#endif
331
332	/* If you comment out one of these below, it will be #defined later
333	* to perform debug printfs to stderr: */
334	#define debug_printf(...) do {} while (0)
335	/* Finer-grained debug switches */
336	#define debug_printf_parse(...) do {} while (0)
337	#define debug_print_tree(a, b) do {} while (0)
338	#define debug_printf_exec(...) do {} while (0)
339	#define debug_printf_env(...) do {} while (0)
340	#define debug_printf_jobs(...) do {} while (0)
341	#define debug_printf_expand(...) do {} while (0)
342	#define debug_printf_varexp(...) do {} while (0)
343	#define debug_printf_glob(...) do {} while (0)
344	#define debug_printf_list(...) do {} while (0)
345	#define debug_printf_subst(...) do {} while (0)
346	#define debug_printf_clean(...) do {} while (0)
347
348	#define ERR_PTR ((void*)(long)1)
349
350	#define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
351
352	#define _SPECIAL_VARS_STR "_*@$!?#"
353	#define SPECIAL_VARS_STR ("_*@$!?#" + 1)
354	#define NUMERIC_SPECVARS_STR ("_*@$!?#" + 3)
355	#if ENABLE_HUSH_BASH_COMPAT
356	/* Support / and // replace ops */
357	/* Note that // is stored as \ in "encoded" string representation */
358	# define VAR_ENCODED_SUBST_OPS "\\/%#:-=+?"
359	# define VAR_SUBST_OPS ("\\/%#:-=+?" + 1)
360	# define MINUS_PLUS_EQUAL_QUESTION ("\\/%#:-=+?" + 5)
361	#else
362	# define VAR_ENCODED_SUBST_OPS "%#:-=+?"
363	# define VAR_SUBST_OPS "%#:-=+?"
364	# define MINUS_PLUS_EQUAL_QUESTION ("%#:-=+?" + 3)
365	#endif
366
367	#define SPECIAL_VAR_SYMBOL 3
368
369	struct variable;
370
371	static const char hush_version_str[] ALIGN1 = "HUSH_VERSION="BB_VER;
372
373	/* This supports saving pointers malloced in vfork child,
374	* to be freed in the parent.
375	*/
376	#if !BB_MMU
377	typedef struct nommu_save_t {
378	char **new_env;
379	struct variable *old_vars;
380	char **argv;
381	char **argv_from_re_execing;
382	} nommu_save_t;
383	#endif
384
385	enum {
386	RES_NONE = 0,
387	#if ENABLE_HUSH_IF
388	RES_IF ,
389	RES_THEN ,
390	RES_ELIF ,
391	RES_ELSE ,
392	RES_FI ,
393	#endif
394	#if ENABLE_HUSH_LOOPS
395	RES_FOR ,
396	RES_WHILE ,
397	RES_UNTIL ,
398	RES_DO ,
399	RES_DONE ,
400	#endif
401	#if ENABLE_HUSH_LOOPS || ENABLE_HUSH_CASE
402	RES_IN ,
403	#endif
404	#if ENABLE_HUSH_CASE
405	RES_CASE ,
406	/* three pseudo-keywords support contrived "case" syntax: */
407	RES_CASE_IN, /* "case ... IN", turns into RES_MATCH when IN is observed */
408	RES_MATCH , /* "word)" */
409	RES_CASE_BODY, /* "this command is inside CASE" */
410	RES_ESAC ,
411	#endif
412	RES_XXXX ,
413	RES_SNTX
414	};
415
416	typedef struct o_string {
417	char *data;
418	int length; /* position where data is appended */
419	int maxlen;
420	int o_expflags;
421	/* At least some part of the string was inside '' or "",
422	* possibly empty one: word"", wo''rd etc. */
423	smallint has_quoted_part;
424	smallint has_empty_slot;
425	smallint o_assignment; /* 0:maybe, 1:yes, 2:no */
426	} o_string;
427	enum {
428	EXP_FLAG_SINGLEWORD = 0x80, /* must be 0x80 */
429	EXP_FLAG_GLOB = 0x2,
430	/* Protect newly added chars against globbing
431	* by prepending \ to *, ?, [, \ */
432	EXP_FLAG_ESC_GLOB_CHARS = 0x1,
433	};
434	enum {
435	MAYBE_ASSIGNMENT = 0,
436	DEFINITELY_ASSIGNMENT = 1,
437	NOT_ASSIGNMENT = 2,
438	/* Not an assignment, but next word may be: "if v=xyz cmd;" */
439	WORD_IS_KEYWORD = 3,
440	};
441	/* Used for initialization: o_string foo = NULL_O_STRING; */
442	#define NULL_O_STRING { NULL }
443
444	#ifndef debug_printf_parse
445	static const char *const assignment_flag[] = {
446	"MAYBE_ASSIGNMENT",
447	"DEFINITELY_ASSIGNMENT",
448	"NOT_ASSIGNMENT",
449	"WORD_IS_KEYWORD",
450	};
451	#endif
452
453	typedef struct in_str {
454	const char *p;
455	#if ENABLE_HUSH_INTERACTIVE
456	smallint promptmode; /* 0: PS1, 1: PS2 */
457	#endif
458	int peek_buf[2];
459	int last_char;
460	FILE *file;
461	} in_str;
462
463	/* The descrip member of this structure is only used to make
464	* debugging output pretty */
465	static const struct {
466	int mode;
467	signed char default_fd;
468	char descrip[3];
469	} redir_table[] = {
470	{ O_RDONLY, 0, "<" },
471	{ O_CREAT|O_TRUNC|O_WRONLY, 1, ">" },
472	{ O_CREAT|O_APPEND|O_WRONLY, 1, ">>" },
473	{ O_CREAT|O_RDWR, 1, "<>" },
474	{ O_RDONLY, 0, "<<" },
475	/* Should not be needed. Bogus default_fd helps in debugging */
476	/* { O_RDONLY, 77, "<<" }, */
477	};
478
479	struct redir_struct {
480	struct redir_struct *next;
481	char *rd_filename; /* filename */
482	int rd_fd; /* fd to redirect */
483	/* fd to redirect to, or -3 if rd_fd is to be closed (n>&-) */
484	int rd_dup;
485	smallint rd_type; /* (enum redir_type) */
486	/* note: for heredocs, rd_filename contains heredoc delimiter,
487	* and subsequently heredoc itself; and rd_dup is a bitmask:
488	* bit 0: do we need to trim leading tabs?
489	* bit 1: is heredoc quoted (<<'delim' syntax) ?
490	*/
491	};
492	typedef enum redir_type {
493	REDIRECT_INPUT = 0,
494	REDIRECT_OVERWRITE = 1,
495	REDIRECT_APPEND = 2,
496	REDIRECT_IO = 3,
497	REDIRECT_HEREDOC = 4,
498	REDIRECT_HEREDOC2 = 5, /* REDIRECT_HEREDOC after heredoc is loaded */
499
500	REDIRFD_CLOSE = -3,
501	REDIRFD_SYNTAX_ERR = -2,
502	REDIRFD_TO_FILE = -1,
503	/* otherwise, rd_fd is redirected to rd_dup */
504
505	HEREDOC_SKIPTABS = 1,
506	HEREDOC_QUOTED = 2,
507	} redir_type;
508
509
510	struct command {
511	pid_t pid; /* 0 if exited */
512	int assignment_cnt; /* how many argv[i] are assignments? */
513	smallint cmd_type; /* CMD_xxx */
514	#define CMD_NORMAL 0
515	#define CMD_SUBSHELL 1
516	#if ENABLE_HUSH_BASH_COMPAT
517	/* used for "[[ EXPR ]]" */
518	# define CMD_SINGLEWORD_NOGLOB 2
519	#endif
520	#if ENABLE_HUSH_FUNCTIONS
521	# define CMD_FUNCDEF 3
522	#endif
523
524	smalluint cmd_exitcode;
525	/* if non-NULL, this "command" is { list }, ( list ), or a compound statement */
526	struct pipe *group;
527	#if !BB_MMU
528	char *group_as_string;
529	#endif
530	#if ENABLE_HUSH_FUNCTIONS
531	struct function *child_func;
532	/* This field is used to prevent a bug here:
533	* while...do f1() {a;}; f1; f1() {b;}; f1; done
534	* When we execute "f1() {a;}" cmd, we create new function and clear
535	* cmd->group, cmd->group_as_string, cmd->argv[0].
536	* When we execute "f1() {b;}", we notice that f1 exists,
537	* and that its "parent cmd" struct is still "alive",
538	* we put those fields back into cmd->xxx
539	* (struct function has ->parent_cmd ptr to facilitate that).
540	* When we loop back, we can execute "f1() {a;}" again and set f1 correctly.
541	* Without this trick, loop would execute a;b;b;b;...
542	* instead of correct sequence a;b;a;b;...
543	* When command is freed, it severs the link
544	* (sets ->child_func->parent_cmd to NULL).
545	*/
546	#endif
547	char **argv; /* command name and arguments */
548	/* argv vector may contain variable references (^Cvar^C, ^C0^C etc)
549	* and on execution these are substituted with their values.
550	* Substitution can make _several_ words out of one argv[n]!
551	* Example: argv[0]=='.^C*^C.' here: echo .$*.
552	* References of the form ^C`cmd arg^C are `cmd arg` substitutions.
553	*/
554	struct redir_struct *redirects; /* I/O redirections */
555	};
556	/* Is there anything in this command at all? */
557	#define IS_NULL_CMD(cmd) \
558	(!(cmd)->group && !(cmd)->argv && !(cmd)->redirects)
559
560	struct pipe {
561	struct pipe *next;
562	int num_cmds; /* total number of commands in pipe */
563	int alive_cmds; /* number of commands running (not exited) */
564	int stopped_cmds; /* number of commands alive, but stopped */
565	#if ENABLE_HUSH_JOB
566	int jobid; /* job number */
567	pid_t pgrp; /* process group ID for the job */
568	char *cmdtext; /* name of job */
569	#endif
570	struct command *cmds; /* array of commands in pipe */
571	smallint followup; /* PIPE_BG, PIPE_SEQ, PIPE_OR, PIPE_AND */
572	IF_HAS_KEYWORDS(smallint pi_inverted;) /* "! cmd | cmd" */
573	IF_HAS_KEYWORDS(smallint res_word;) /* needed for if, for, while, until... */
574	};
575	typedef enum pipe_style {
576	PIPE_SEQ = 0,
577	PIPE_AND = 1,
578	PIPE_OR = 2,
579	PIPE_BG = 3,
580	} pipe_style;
581	/* Is there anything in this pipe at all? */
582	#define IS_NULL_PIPE(pi) \
583	((pi)->num_cmds == 0 IF_HAS_KEYWORDS( && (pi)->res_word == RES_NONE))
584
585	/* This holds pointers to the various results of parsing */
586	struct parse_context {
587	/* linked list of pipes */
588	struct pipe *list_head;
589	/* last pipe (being constructed right now) */
590	struct pipe *pipe;
591	/* last command in pipe (being constructed right now) */
592	struct command *command;
593	/* last redirect in command->redirects list */
594	struct redir_struct *pending_redirect;
595	#if !BB_MMU
596	o_string as_string;
597	#endif
598	#if HAS_KEYWORDS
599	smallint ctx_res_w;
600	smallint ctx_inverted; /* "! cmd | cmd" */
601	#if ENABLE_HUSH_CASE
602	smallint ctx_dsemicolon; /* ";;" seen */
603	#endif
604	/* bitmask of FLAG_xxx, for figuring out valid reserved words */
605	int old_flag;
606	/* group we are enclosed in:
607	* example: "if pipe1; pipe2; then pipe3; fi"
608	* when we see "if" or "then", we malloc and copy current context,
609	* and make ->stack point to it. then we parse pipeN.
610	* when closing "then" / fi" / whatever is found,
611	* we move list_head into ->stack->command->group,
612	* copy ->stack into current context, and delete ->stack.
613	* (parsing of { list } and ( list ) doesn't use this method)
614	*/
615	struct parse_context *stack;
616	#endif
617	};
618
619	/* On program start, environ points to initial environment.
620	* putenv adds new pointers into it, unsetenv removes them.
621	* Neither of these (de)allocates the strings.
622	* setenv allocates new strings in malloc space and does putenv,
623	* and thus setenv is unusable (leaky) for shell's purposes */
624	#define setenv(...) setenv_is_leaky_dont_use()
625	struct variable {
626	struct variable *next;
627	char *varstr; /* points to "name=" portion */
628	#if ENABLE_HUSH_LOCAL
629	unsigned func_nest_level;
630	#endif
631	int max_len; /* if > 0, name is part of initial env; else name is malloced */
632	smallint flg_export; /* putenv should be done on this var */
633	smallint flg_read_only;
634	};
635
636	enum {
637	BC_BREAK = 1,
638	BC_CONTINUE = 2,
639	};
640
641	#if ENABLE_HUSH_FUNCTIONS
642	struct function {
643	struct function *next;
644	char *name;
645	struct command *parent_cmd;
646	struct pipe *body;
647	# if !BB_MMU
648	char *body_as_string;
649	# endif
650	};
651	#endif
652
653
654	/* set -/+o OPT support. (TODO: make it optional)
655	* bash supports the following opts:
656	* allexport off
657	* braceexpand on
658	* emacs on
659	* errexit off
660	* errtrace off
661	* functrace off
662	* hashall on
663	* histexpand off
664	* history on
665	* ignoreeof off
666	* interactive-comments on
667	* keyword off
668	* monitor on
669	* noclobber off
670	* noexec off
671	* noglob off
672	* nolog off
673	* notify off
674	* nounset off
675	* onecmd off
676	* physical off
677	* pipefail off
678	* posix off
679	* privileged off
680	* verbose off
681	* vi off
682	* xtrace off
683	*/
684	static const char o_opt_strings[] ALIGN1 =
685	"pipefail\0"
686	"noexec\0"
687	#if ENABLE_HUSH_MODE_X
688	"xtrace\0"
689	#endif
690	;
691	enum {
692	OPT_O_PIPEFAIL,
693	OPT_O_NOEXEC,
694	#if ENABLE_HUSH_MODE_X
695	OPT_O_XTRACE,
696	#endif
697	NUM_OPT_O
698	};
699
700
701	struct FILE_list {
702	struct FILE_list *next;
703	FILE *fp;
704	int fd;
705	};
706
707
708	/* "Globals" within this file */
709	/* Sorted roughly by size (smaller offsets == smaller code) */
710	struct globals {
711	/* interactive_fd != 0 means we are an interactive shell.
712	* If we are, then saved_tty_pgrp can also be != 0, meaning
713	* that controlling tty is available. With saved_tty_pgrp == 0,
714	* job control still works, but terminal signals
715	* (^C, ^Z, ^Y, ^\) won't work at all, and background
716	* process groups can only be created with "cmd &".
717	* With saved_tty_pgrp != 0, hush will use tcsetpgrp()
718	* to give tty to the foreground process group,
719	* and will take it back when the group is stopped (^Z)
720	* or killed (^C).
721	*/
722	#if ENABLE_HUSH_INTERACTIVE
723	/* 'interactive_fd' is a fd# open to ctty, if we have one
724	* _AND_ if we decided to act interactively */
725	int interactive_fd;
726	const char *PS1;
727	const char *PS2;
728	# define G_interactive_fd (G.interactive_fd)
729	#else
730	# define G_interactive_fd 0
731	#endif
732	#if ENABLE_FEATURE_EDITING
733	line_input_t *line_input_state;
734	#endif
735	pid_t root_pid;
736	pid_t root_ppid;
737	pid_t last_bg_pid;
738	#if ENABLE_HUSH_RANDOM_SUPPORT
739	random_t random_gen;
740	#endif
741	#if ENABLE_HUSH_JOB
742	int run_list_level;
743	int last_jobid;
744	pid_t saved_tty_pgrp;
745	struct pipe *job_list;
746	# define G_saved_tty_pgrp (G.saved_tty_pgrp)
747	#else
748	# define G_saved_tty_pgrp 0
749	#endif
750	char o_opt[NUM_OPT_O];
751	#if ENABLE_HUSH_MODE_X
752	# define G_x_mode (G.o_opt[OPT_O_XTRACE])
753	#else
754	# define G_x_mode 0
755	#endif
756	smallint flag_SIGINT;
757	#if ENABLE_HUSH_LOOPS
758	smallint flag_break_continue;
759	#endif
760	#if ENABLE_HUSH_FUNCTIONS
761	/* 0: outside of a function (or sourced file)
762	* -1: inside of a function, ok to use return builtin
763	* 1: return is invoked, skip all till end of func
764	*/
765	smallint flag_return_in_progress;
766	# define G_flag_return_in_progress (G.flag_return_in_progress)
767	#else
768	# define G_flag_return_in_progress 0
769	#endif
770	smallint exiting; /* used to prevent EXIT trap recursion */
771	/* These four support $?, $#, and $1 */
772	smalluint last_exitcode;
773	/* are global_argv and global_argv[1..n] malloced? (note: not [0]) */
774	smalluint global_args_malloced;
775	/* how many non-NULL argv's we have. NB: $# + 1 */
776	int global_argc;
777	char **global_argv;
778	#if !BB_MMU
779	char *argv0_for_re_execing;
780	#endif
781	#if ENABLE_HUSH_LOOPS
782	unsigned depth_break_continue;
783	unsigned depth_of_loop;
784	#endif
785	const char *ifs;
786	const char *cwd;
787	struct variable *top_var;
788	char **expanded_assignments;
789	#if ENABLE_HUSH_FUNCTIONS
790	struct function *top_func;
791	# if ENABLE_HUSH_LOCAL
792	struct variable **shadowed_vars_pp;
793	unsigned func_nest_level;
794	# endif
795	#endif
796	/* Signal and trap handling */
797	#if ENABLE_HUSH_FAST
798	unsigned count_SIGCHLD;
799	unsigned handled_SIGCHLD;
800	smallint we_have_children;
801	#endif
802	struct FILE_list *FILE_list;
803	/* Which signals have non-DFL handler (even with no traps set)?
804	* Set at the start to:
805	* (SIGQUIT + maybe SPECIAL_INTERACTIVE_SIGS + maybe SPECIAL_JOBSTOP_SIGS)
806	* SPECIAL_INTERACTIVE_SIGS are cleared after fork.
807	* The rest is cleared right before execv syscalls.
808	* Other than these two times, never modified.
809	*/
810	unsigned special_sig_mask;
811	#if ENABLE_HUSH_JOB
812	unsigned fatal_sig_mask;
813	# define G_fatal_sig_mask G.fatal_sig_mask
814	#else
815	# define G_fatal_sig_mask 0
816	#endif
817	char **traps; /* char *traps[NSIG] */
818	sigset_t pending_set;
819	#if HUSH_DEBUG
820	unsigned long memleak_value;
821	int debug_indent;
822	#endif
823	struct sigaction sa;
824	#if ENABLE_FEATURE_EDITING
825	char user_input_buf[CONFIG_FEATURE_EDITING_MAX_LEN];
826	#endif
827	};
828	#define G (*ptr_to_globals)
829	/* Not #defining name to G.name - this quickly gets unwieldy
830	* (too many defines). Also, I actually prefer to see when a variable
831	* is global, thus "G." prefix is a useful hint */
832	#define INIT_G() do { \
833	SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
834	/* memset(&G.sa, 0, sizeof(G.sa)); */ \
835	sigfillset(&G.sa.sa_mask); \
836	G.sa.sa_flags = SA_RESTART; \
837	} while (0)
838
839
840	/* Function prototypes for builtins */
841	static int builtin_cd(char **argv) FAST_FUNC;
842	static int builtin_echo(char **argv) FAST_FUNC;
843	static int builtin_eval(char **argv) FAST_FUNC;
844	static int builtin_exec(char **argv) FAST_FUNC;
845	static int builtin_exit(char **argv) FAST_FUNC;
846	static int builtin_export(char **argv) FAST_FUNC;
847	#if ENABLE_HUSH_JOB
848	static int builtin_fg_bg(char **argv) FAST_FUNC;
849	static int builtin_jobs(char **argv) FAST_FUNC;
850	#endif
851	#if ENABLE_HUSH_HELP
852	static int builtin_help(char **argv) FAST_FUNC;
853	#endif
854	#if MAX_HISTORY && ENABLE_FEATURE_EDITING
855	static int builtin_history(char **argv) FAST_FUNC;
856	#endif
857	#if ENABLE_HUSH_LOCAL
858	static int builtin_local(char **argv) FAST_FUNC;
859	#endif
860	#if HUSH_DEBUG
861	static int builtin_memleak(char **argv) FAST_FUNC;
862	#endif
863	#if ENABLE_PRINTF
864	static int builtin_printf(char **argv) FAST_FUNC;
865	#endif
866	static int builtin_pwd(char **argv) FAST_FUNC;
867	static int builtin_read(char **argv) FAST_FUNC;
868	static int builtin_set(char **argv) FAST_FUNC;
869	static int builtin_shift(char **argv) FAST_FUNC;
870	static int builtin_source(char **argv) FAST_FUNC;
871	static int builtin_test(char **argv) FAST_FUNC;
872	static int builtin_trap(char **argv) FAST_FUNC;
873	static int builtin_type(char **argv) FAST_FUNC;
874	static int builtin_true(char **argv) FAST_FUNC;
875	static int builtin_umask(char **argv) FAST_FUNC;
876	static int builtin_unset(char **argv) FAST_FUNC;
877	static int builtin_wait(char **argv) FAST_FUNC;
878	#if ENABLE_HUSH_LOOPS
879	static int builtin_break(char **argv) FAST_FUNC;
880	static int builtin_continue(char **argv) FAST_FUNC;
881	#endif
882	#if ENABLE_HUSH_FUNCTIONS
883	static int builtin_return(char **argv) FAST_FUNC;
884	#endif
885
886	/* Table of built-in functions. They can be forked or not, depending on
887	* context: within pipes, they fork. As simple commands, they do not.
888	* When used in non-forking context, they can change global variables
889	* in the parent shell process. If forked, of course they cannot.
890	* For example, 'unset foo | whatever' will parse and run, but foo will
891	* still be set at the end. */
892	struct built_in_command {
893	const char *b_cmd;
894	int (*b_function)(char **argv) FAST_FUNC;
895	#if ENABLE_HUSH_HELP
896	const char *b_descr;
897	# define BLTIN(cmd, func, help) { cmd, func, help }
898	#else
899	# define BLTIN(cmd, func, help) { cmd, func }
900	#endif
901	};
902
903	static const struct built_in_command bltins1[] = {
904	BLTIN("." , builtin_source , "Run commands in a file"),
905	BLTIN(":" , builtin_true , NULL),
906	#if ENABLE_HUSH_JOB
907	BLTIN("bg" , builtin_fg_bg , "Resume a job in the background"),
908	#endif
909	#if ENABLE_HUSH_LOOPS
910	BLTIN("break" , builtin_break , "Exit from a loop"),
911	#endif
912	BLTIN("cd" , builtin_cd , "Change directory"),
913	#if ENABLE_HUSH_LOOPS
914	BLTIN("continue" , builtin_continue, "Start new loop iteration"),
915	#endif
916	BLTIN("eval" , builtin_eval , "Construct and run shell command"),
917	BLTIN("exec" , builtin_exec , "Execute command, don't return to shell"),
918	BLTIN("exit" , builtin_exit , "Exit"),
919	BLTIN("export" , builtin_export , "Set environment variables"),
920	#if ENABLE_HUSH_JOB
921	BLTIN("fg" , builtin_fg_bg , "Bring job into the foreground"),
922	#endif
923	#if ENABLE_HUSH_HELP
924	BLTIN("help" , builtin_help , NULL),
925	#endif
926	#if MAX_HISTORY && ENABLE_FEATURE_EDITING
927	BLTIN("history" , builtin_history , "Show command history"),
928	#endif
929	#if ENABLE_HUSH_JOB
930	BLTIN("jobs" , builtin_jobs , "List jobs"),
931	#endif
932	#if ENABLE_HUSH_LOCAL
933	BLTIN("local" , builtin_local , "Set local variables"),
934	#endif
935	#if HUSH_DEBUG
936	BLTIN("memleak" , builtin_memleak , NULL),
937	#endif
938	BLTIN("read" , builtin_read , "Input into variable"),
939	#if ENABLE_HUSH_FUNCTIONS
940	BLTIN("return" , builtin_return , "Return from a function"),
941	#endif
942	BLTIN("set" , builtin_set , "Set/unset positional parameters"),
943	BLTIN("shift" , builtin_shift , "Shift positional parameters"),
944	#if ENABLE_HUSH_BASH_COMPAT
945	BLTIN("source" , builtin_source , "Run commands in a file"),
946	#endif
947	BLTIN("trap" , builtin_trap , "Trap signals"),
948	BLTIN("true" , builtin_true , NULL),
949	BLTIN("type" , builtin_type , "Show command type"),
950	BLTIN("ulimit" , shell_builtin_ulimit , "Control resource limits"),
951	BLTIN("umask" , builtin_umask , "Set file creation mask"),
952	BLTIN("unset" , builtin_unset , "Unset variables"),
953	BLTIN("wait" , builtin_wait , "Wait for process"),
954	};
955	/* For now, echo and test are unconditionally enabled.
956	* Maybe make it configurable? */
957	static const struct built_in_command bltins2[] = {
958	BLTIN("[" , builtin_test , NULL),
959	BLTIN("echo" , builtin_echo , NULL),
960	#if ENABLE_PRINTF
961	BLTIN("printf" , builtin_printf , NULL),
962	#endif
963	BLTIN("pwd" , builtin_pwd , NULL),
964	BLTIN("test" , builtin_test , NULL),
965	};
966
967
968	/* Debug printouts.
969	*/
970	#if HUSH_DEBUG
971	/* prevent disasters with G.debug_indent < 0 */
972	# define indent() fdprintf(2, "%*s", (G.debug_indent * 2) & 0xff, "")
973	# define debug_enter() (G.debug_indent++)
974	# define debug_leave() (G.debug_indent--)
975	#else
976	# define indent() ((void)0)
977	# define debug_enter() ((void)0)
978	# define debug_leave() ((void)0)
979	#endif
980
981	#ifndef debug_printf
982	# define debug_printf(...) (indent(), fdprintf(2, __VA_ARGS__))
983	#endif
984
985	#ifndef debug_printf_parse
986	# define debug_printf_parse(...) (indent(), fdprintf(2, __VA_ARGS__))
987	#endif
988
989	#ifndef debug_printf_exec
990	#define debug_printf_exec(...) (indent(), fdprintf(2, __VA_ARGS__))
991	#endif
992
993	#ifndef debug_printf_env
994	# define debug_printf_env(...) (indent(), fdprintf(2, __VA_ARGS__))
995	#endif
996
997	#ifndef debug_printf_jobs
998	# define debug_printf_jobs(...) (indent(), fdprintf(2, __VA_ARGS__))
999	# define DEBUG_JOBS 1
1000	#else
1001	# define DEBUG_JOBS 0
1002	#endif
1003
1004	#ifndef debug_printf_expand
1005	# define debug_printf_expand(...) (indent(), fdprintf(2, __VA_ARGS__))
1006	# define DEBUG_EXPAND 1
1007	#else
1008	# define DEBUG_EXPAND 0
1009	#endif
1010
1011	#ifndef debug_printf_varexp
1012	# define debug_printf_varexp(...) (indent(), fdprintf(2, __VA_ARGS__))
1013	#endif
1014
1015	#ifndef debug_printf_glob
1016	# define debug_printf_glob(...) (indent(), fdprintf(2, __VA_ARGS__))
1017	# define DEBUG_GLOB 1
1018	#else
1019	# define DEBUG_GLOB 0
1020	#endif
1021
1022	#ifndef debug_printf_list
1023	# define debug_printf_list(...) (indent(), fdprintf(2, __VA_ARGS__))
1024	#endif
1025
1026	#ifndef debug_printf_subst
1027	# define debug_printf_subst(...) (indent(), fdprintf(2, __VA_ARGS__))
1028	#endif
1029
1030	#ifndef debug_printf_clean
1031	# define debug_printf_clean(...) (indent(), fdprintf(2, __VA_ARGS__))
1032	# define DEBUG_CLEAN 1
1033	#else
1034	# define DEBUG_CLEAN 0
1035	#endif
1036
1037	#if DEBUG_EXPAND
1038	static void debug_print_strings(const char *prefix, char **vv)
1039	{
1040	indent();
1041	fdprintf(2, "%s:\n", prefix);
1042	while (*vv)
1043	fdprintf(2, " '%s'\n", *vv++);
1044	}
1045	#else
1046	# define debug_print_strings(prefix, vv) ((void)0)
1047	#endif
1048
1049
1050	/* Leak hunting. Use hush_leaktool.sh for post-processing.
1051	*/
1052	#if LEAK_HUNTING
1053	static void *xxmalloc(int lineno, size_t size)
1054	{
1055	void *ptr = xmalloc((size + 0xff) & ~0xff);
1056	fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
1057	return ptr;
1058	}
1059	static void *xxrealloc(int lineno, void *ptr, size_t size)
1060	{
1061	ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
1062	fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
1063	return ptr;
1064	}
1065	static char *xxstrdup(int lineno, const char *str)
1066	{
1067	char *ptr = xstrdup(str);
1068	fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
1069	return ptr;
1070	}
1071	static void xxfree(void *ptr)
1072	{
1073	fdprintf(2, "free %p\n", ptr);
1074	free(ptr);
1075	}
1076	# define xmalloc(s) xxmalloc(__LINE__, s)
1077	# define xrealloc(p, s) xxrealloc(__LINE__, p, s)
1078	# define xstrdup(s) xxstrdup(__LINE__, s)
1079	# define free(p) xxfree(p)
1080	#endif
1081
1082
1083	/* Syntax and runtime errors. They always abort scripts.
1084	* In interactive use they usually discard unparsed and/or unexecuted commands
1085	* and return to the prompt.
1086	* HUSH_DEBUG >= 2 prints line number in this file where it was detected.
1087	*/
1088	#if HUSH_DEBUG < 2
1089	# define die_if_script(lineno, ...) die_if_script(__VA_ARGS__)
1090	# define syntax_error(lineno, msg) syntax_error(msg)
1091	# define syntax_error_at(lineno, msg) syntax_error_at(msg)
1092	# define syntax_error_unterm_ch(lineno, ch) syntax_error_unterm_ch(ch)
1093	# define syntax_error_unterm_str(lineno, s) syntax_error_unterm_str(s)
1094	# define syntax_error_unexpected_ch(lineno, ch) syntax_error_unexpected_ch(ch)
1095	#endif
1096
1097	static void die_if_script(unsigned lineno, const char *fmt, ...)
1098	{
1099	va_list p;
1100
1101	#if HUSH_DEBUG >= 2
1102	bb_error_msg("hush.c:%u", lineno);
1103	#endif
1104	va_start(p, fmt);
1105	bb_verror_msg(fmt, p, NULL);
1106	va_end(p);
1107	if (!G_interactive_fd)
1108	xfunc_die();
1109	}
1110
1111	static void syntax_error(unsigned lineno UNUSED_PARAM, const char *msg)
1112	{
1113	if (msg)
1114	bb_error_msg("syntax error: %s", msg);
1115	else
1116	bb_error_msg("syntax error");
1117	}
1118
1119	static void syntax_error_at(unsigned lineno UNUSED_PARAM, const char *msg)
1120	{
1121	bb_error_msg("syntax error at '%s'", msg);
1122	}
1123
1124	static void syntax_error_unterm_str(unsigned lineno UNUSED_PARAM, const char *s)
1125	{
1126	bb_error_msg("syntax error: unterminated %s", s);
1127	}
1128
1129	static void syntax_error_unterm_ch(unsigned lineno, char ch)
1130	{
1131	char msg[2] = { ch, '\0' };
1132	syntax_error_unterm_str(lineno, msg);
1133	}
1134
1135	static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
1136	{
1137	char msg[2];
1138	msg[0] = ch;
1139	msg[1] = '\0';
1140	bb_error_msg("syntax error: unexpected %s", ch == EOF ? "EOF" : msg);
1141	}
1142
1143	#if HUSH_DEBUG < 2
1144	# undef die_if_script
1145	# undef syntax_error
1146	# undef syntax_error_at
1147	# undef syntax_error_unterm_ch
1148	# undef syntax_error_unterm_str
1149	# undef syntax_error_unexpected_ch
1150	#else
1151	# define die_if_script(...) die_if_script(__LINE__, __VA_ARGS__)
1152	# define syntax_error(msg) syntax_error(__LINE__, msg)
1153	# define syntax_error_at(msg) syntax_error_at(__LINE__, msg)
1154	# define syntax_error_unterm_ch(ch) syntax_error_unterm_ch(__LINE__, ch)
1155	# define syntax_error_unterm_str(s) syntax_error_unterm_str(__LINE__, s)
1156	# define syntax_error_unexpected_ch(ch) syntax_error_unexpected_ch(__LINE__, ch)
1157	#endif
1158
1159
1160	#if ENABLE_HUSH_INTERACTIVE
1161	static void cmdedit_update_prompt(void);
1162	#else
1163	# define cmdedit_update_prompt() ((void)0)
1164	#endif
1165
1166
1167	/* Utility functions
1168	*/
1169	/* Replace each \x with x in place, return ptr past NUL. */
1170	static char *unbackslash(char *src)
1171	{
1172	char *dst = src = strchrnul(src, '\\');
1173	while (1) {
1174	if (*src == '\\')
1175	src++;
1176	if ((*dst++ = *src++) == '\0')
1177	break;
1178	}
1179	return dst;
1180	}
1181
1182	static char **add_strings_to_strings(char **strings, char **add, int need_to_dup)
1183	{
1184	int i;
1185	unsigned count1;
1186	unsigned count2;
1187	char **v;
1188
1189	v = strings;
1190	count1 = 0;
1191	if (v) {
1192	while (*v) {
1193	count1++;
1194	v++;
1195	}
1196	}
1197	count2 = 0;
1198	v = add;
1199	while (*v) {
1200	count2++;
1201	v++;
1202	}
1203	v = xrealloc(strings, (count1 + count2 + 1) * sizeof(char*));
1204	v[count1 + count2] = NULL;
1205	i = count2;
1206	while (--i >= 0)
1207	v[count1 + i] = (need_to_dup ? xstrdup(add[i]) : add[i]);
1208	return v;
1209	}
1210	#if LEAK_HUNTING
1211	static char **xx_add_strings_to_strings(int lineno, char **strings, char **add, int need_to_dup)
1212	{
1213	char **ptr = add_strings_to_strings(strings, add, need_to_dup);
1214	fdprintf(2, "line %d: add_strings_to_strings %p\n", lineno, ptr);
1215	return ptr;
1216	}
1217	#define add_strings_to_strings(strings, add, need_to_dup) \
1218	xx_add_strings_to_strings(__LINE__, strings, add, need_to_dup)
1219	#endif
1220
1221	/* Note: takes ownership of "add" ptr (it is not strdup'ed) */
1222	static char **add_string_to_strings(char **strings, char *add)
1223	{
1224	char *v[2];
1225	v[0] = add;
1226	v[1] = NULL;
1227	return add_strings_to_strings(strings, v, /*dup:*/ 0);
1228	}
1229	#if LEAK_HUNTING
1230	static char **xx_add_string_to_strings(int lineno, char **strings, char *add)
1231	{
1232	char **ptr = add_string_to_strings(strings, add);
1233	fdprintf(2, "line %d: add_string_to_strings %p\n", lineno, ptr);
1234	return ptr;
1235	}
1236	#define add_string_to_strings(strings, add) \
1237	xx_add_string_to_strings(__LINE__, strings, add)
1238	#endif
1239
1240	static void free_strings(char **strings)
1241	{
1242	char **v;
1243
1244	if (!strings)
1245	return;
1246	v = strings;
1247	while (*v) {
1248	free(*v);
1249	v++;
1250	}
1251	free(strings);
1252	}
1253
1254
1255	static int xdup_and_close(int fd, int F_DUPFD_maybe_CLOEXEC)
1256	{
1257	/* We avoid taking stdio fds. Mimicking ash: use fds above 9 */
1258	int newfd = fcntl(fd, F_DUPFD_maybe_CLOEXEC, 10);
1259	if (newfd < 0) {
1260	/* fd was not open? */
1261	if (errno == EBADF)
1262	return fd;
1263	xfunc_die();
1264	}
1265	close(fd);
1266	return newfd;
1267	}
1268
1269
1270	/* Manipulating the list of open FILEs */
1271	static FILE *remember_FILE(FILE *fp)
1272	{
1273	if (fp) {
1274	struct FILE_list *n = xmalloc(sizeof(*n));
1275	n->next = G.FILE_list;
1276	G.FILE_list = n;
1277	n->fp = fp;
1278	n->fd = fileno(fp);
1279	close_on_exec_on(n->fd);
1280	}
1281	return fp;
1282	}
1283	static void fclose_and_forget(FILE *fp)
1284	{
1285	struct FILE_list **pp = &G.FILE_list;
1286	while (*pp) {
1287	struct FILE_list *cur = *pp;
1288	if (cur->fp == fp) {
1289	*pp = cur->next;
1290	free(cur);
1291	break;
1292	}
1293	pp = &cur->next;
1294	}
1295	fclose(fp);
1296	}
1297	static int save_FILEs_on_redirect(int fd)
1298	{
1299	struct FILE_list *fl = G.FILE_list;
1300	while (fl) {
1301	if (fd == fl->fd) {
1302	/* We use it only on script files, they are all CLOEXEC */
1303	fl->fd = xdup_and_close(fd, F_DUPFD_CLOEXEC);
1304	return 1;
1305	}
1306	fl = fl->next;
1307	}
1308	return 0;
1309	}
1310	static void restore_redirected_FILEs(void)
1311	{
1312	struct FILE_list *fl = G.FILE_list;
1313	while (fl) {
1314	int should_be = fileno(fl->fp);
1315	if (fl->fd != should_be) {
1316	xmove_fd(fl->fd, should_be);
1317	fl->fd = should_be;
1318	}
1319	fl = fl->next;
1320	}
1321	}
1322	#if ENABLE_FEATURE_SH_STANDALONE
1323	static void close_all_FILE_list(void)
1324	{
1325	struct FILE_list *fl = G.FILE_list;
1326	while (fl) {
1327	/* fclose would also free FILE object.
1328	* It is disastrous if we share memory with a vforked parent.
1329	* I'm not sure we never come here after vfork.
1330	* Therefore just close fd, nothing more.
1331	*/
1332	/*fclose(fl->fp); - unsafe */
1333	close(fl->fd);
1334	fl = fl->next;
1335	}
1336	}
1337	#endif
1338
1339
1340	/* Helpers for setting new $n and restoring them back
1341	*/
1342	typedef struct save_arg_t {
1343	char *sv_argv0;
1344	char **sv_g_argv;
1345	int sv_g_argc;
1346	smallint sv_g_malloced;
1347	} save_arg_t;
1348
1349	static void save_and_replace_G_args(save_arg_t *sv, char **argv)
1350	{
1351	int n;
1352
1353	sv->sv_argv0 = argv[0];
1354	sv->sv_g_argv = G.global_argv;
1355	sv->sv_g_argc = G.global_argc;
1356	sv->sv_g_malloced = G.global_args_malloced;
1357
1358	argv[0] = G.global_argv[0]; /* retain $0 */
1359	G.global_argv = argv;
1360	G.global_args_malloced = 0;
1361
1362	n = 1;
1363	while (*++argv)
1364	n++;
1365	G.global_argc = n;
1366	}
1367
1368	static void restore_G_args(save_arg_t *sv, char **argv)
1369	{
1370	char **pp;
1371
1372	if (G.global_args_malloced) {
1373	/* someone ran "set -- arg1 arg2 ...", undo */
1374	pp = G.global_argv;
1375	while (*++pp) /* note: does not free $0 */
1376	free(*pp);
1377	free(G.global_argv);
1378	}
1379	argv[0] = sv->sv_argv0;
1380	G.global_argv = sv->sv_g_argv;
1381	G.global_argc = sv->sv_g_argc;
1382	G.global_args_malloced = sv->sv_g_malloced;
1383	}
1384
1385
1386	/* Basic theory of signal handling in shell
1387	* ========================================
1388	* This does not describe what hush does, rather, it is current understanding
1389	* what it _should_ do. If it doesn't, it's a bug.
1390	* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#trap
1391	*
1392	* Signals are handled only after each pipe ("cmd | cmd | cmd" thing)
1393	* is finished or backgrounded. It is the same in interactive and
1394	* non-interactive shells, and is the same regardless of whether
1395	* a user trap handler is installed or a shell special one is in effect.
1396	* ^C or ^Z from keyboard seems to execute "at once" because it usually
1397	* backgrounds (i.e. stops) or kills all members of currently running
1398	* pipe.
1399	*
1400	* Wait builtin is interruptible by signals for which user trap is set
1401	* or by SIGINT in interactive shell.
1402	*
1403	* Trap handlers will execute even within trap handlers. (right?)
1404	*
1405	* User trap handlers are forgotten when subshell ("(cmd)") is entered,
1406	* except for handlers set to '' (empty string).
1407	*
1408	* If job control is off, backgrounded commands ("cmd &")
1409	* have SIGINT, SIGQUIT set to SIG_IGN.
1410	*
1411	* Commands which are run in command substitution ("`cmd`")
1412	* have SIGTTIN, SIGTTOU, SIGTSTP set to SIG_IGN.
1413	*
1414	* Ordinary commands have signals set to SIG_IGN/DFL as inherited
1415	* by the shell from its parent.
1416	*
1417	* Signals which differ from SIG_DFL action
1418	* (note: child (i.e., [v]forked) shell is not an interactive shell):
1419	*
1420	* SIGQUIT: ignore
1421	* SIGTERM (interactive): ignore
1422	* SIGHUP (interactive):
1423	* send SIGCONT to stopped jobs, send SIGHUP to all jobs and exit
1424	* SIGTTIN, SIGTTOU, SIGTSTP (if job control is on): ignore
1425	* Note that ^Z is handled not by trapping SIGTSTP, but by seeing
1426	* that all pipe members are stopped. Try this in bash:
1427	* while :; do :; done - ^Z does not background it
1428	* (while :; do :; done) - ^Z backgrounds it
1429	* SIGINT (interactive): wait for last pipe, ignore the rest
1430	* of the command line, show prompt. NB: ^C does not send SIGINT
1431	* to interactive shell while shell is waiting for a pipe,
1432	* since shell is bg'ed (is not in foreground process group).
1433	* Example 1: this waits 5 sec, but does not execute ls:
1434	* "echo $$; sleep 5; ls -l" + "kill -INT <pid>"
1435	* Example 2: this does not wait and does not execute ls:
1436	* "echo $$; sleep 5 & wait; ls -l" + "kill -INT <pid>"
1437	* Example 3: this does not wait 5 sec, but executes ls:
1438	* "sleep 5; ls -l" + press ^C
1439	* Example 4: this does not wait and does not execute ls:
1440	* "sleep 5 & wait; ls -l" + press ^C
1441	*
1442	* (What happens to signals which are IGN on shell start?)
1443	* (What happens with signal mask on shell start?)
1444	*
1445	* Old implementation
1446	* ==================
1447	* We use in-kernel pending signal mask to determine which signals were sent.
1448	* We block all signals which we don't want to take action immediately,
1449	* i.e. we block all signals which need to have special handling as described
1450	* above, and all signals which have traps set.
1451	* After each pipe execution, we extract any pending signals via sigtimedwait()
1452	* and act on them.
1453	*
1454	* unsigned special_sig_mask: a mask of such "special" signals
1455	* sigset_t blocked_set: current blocked signal set
1456	*
1457	* "trap - SIGxxx":
1458	* clear bit in blocked_set unless it is also in special_sig_mask
1459	* "trap 'cmd' SIGxxx":
1460	* set bit in blocked_set (even if 'cmd' is '')
1461	* after [v]fork, if we plan to be a shell:
1462	* unblock signals with special interactive handling
1463	* (child shell is not interactive),
1464	* unset all traps except '' (note: regardless of child shell's type - {}, (), etc)
1465	* after [v]fork, if we plan to exec:
1466	* POSIX says fork clears pending signal mask in child - no need to clear it.
1467	* Restore blocked signal set to one inherited by shell just prior to exec.
1468	*
1469	* Note: as a result, we do not use signal handlers much. The only uses
1470	* are to count SIGCHLDs
1471	* and to restore tty pgrp on signal-induced exit.
1472	*
1473	* Note 2 (compat):
1474	* Standard says "When a subshell is entered, traps that are not being ignored
1475	* are set to the default actions". bash interprets it so that traps which
1476	* are set to '' (ignore) are NOT reset to defaults. We do the same.
1477	*
1478	* Problem: the above approach makes it unwieldy to catch signals while
1479	* we are in read builtin, or while we read commands from stdin:
1480	* masked signals are not visible!
1481	*
1482	* New implementation
1483	* ==================
1484	* We record each signal we are interested in by installing signal handler
1485	* for them - a bit like emulating kernel pending signal mask in userspace.
1486	* We are interested in: signals which need to have special handling
1487	* as described above, and all signals which have traps set.
1488	* Signals are recorded in pending_set.
1489	* After each pipe execution, we extract any pending signals
1490	* and act on them.
1491	*
1492	* unsigned special_sig_mask: a mask of shell-special signals.
1493	* unsigned fatal_sig_mask: a mask of signals on which we restore tty pgrp.
1494	* char *traps[sig] if trap for sig is set (even if it's '').
1495	* sigset_t pending_set: set of sigs we received.
1496	*
1497	* "trap - SIGxxx":
1498	* if sig is in special_sig_mask, set handler back to:
1499	* record_pending_signo, or to IGN if it's a tty stop signal
1500	* if sig is in fatal_sig_mask, set handler back to sigexit.
1501	* else: set handler back to SIG_DFL
1502	* "trap 'cmd' SIGxxx":
1503	* set handler to record_pending_signo.
1504	* "trap '' SIGxxx":
1505	* set handler to SIG_IGN.
1506	* after [v]fork, if we plan to be a shell:
1507	* set signals with special interactive handling to SIG_DFL
1508	* (because child shell is not interactive),
1509	* unset all traps except '' (note: regardless of child shell's type - {}, (), etc)
1510	* after [v]fork, if we plan to exec:
1511	* POSIX says fork clears pending signal mask in child - no need to clear it.
1512	*
1513	* To make wait builtin interruptible, we handle SIGCHLD as special signal,
1514	* otherwise (if we leave it SIG_DFL) sigsuspend in wait builtin will not wake up on it.
1515	*
1516	* Note (compat):
1517	* Standard says "When a subshell is entered, traps that are not being ignored
1518	* are set to the default actions". bash interprets it so that traps which
1519	* are set to '' (ignore) are NOT reset to defaults. We do the same.
1520	*/
1521	enum {
1522	SPECIAL_INTERACTIVE_SIGS = 0
1523	| (1 << SIGTERM)
1524	| (1 << SIGINT)
1525	| (1 << SIGHUP)
1526	,
1527	SPECIAL_JOBSTOP_SIGS = 0
1528	#if ENABLE_HUSH_JOB
1529	| (1 << SIGTTIN)
1530	| (1 << SIGTTOU)
1531	| (1 << SIGTSTP)
1532	#endif
1533	,
1534	};
1535
1536	static void record_pending_signo(int sig)
1537	{
1538	sigaddset(&G.pending_set, sig);
1539	#if ENABLE_HUSH_FAST
1540	if (sig == SIGCHLD) {
1541	G.count_SIGCHLD++;
1542	//bb_error_msg("[%d] SIGCHLD_handler: G.count_SIGCHLD:%d G.handled_SIGCHLD:%d", getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
1543	}
1544	#endif
1545	}
1546
1547	static sighandler_t install_sighandler(int sig, sighandler_t handler)
1548	{
1549	struct sigaction old_sa;
1550
1551	/* We could use signal() to install handlers... almost:
1552	* except that we need to mask ALL signals while handlers run.
1553	* I saw signal nesting in strace, race window isn't small.
1554	* SA_RESTART is also needed, but in Linux, signal()
1555	* sets SA_RESTART too.
1556	*/
1557	/* memset(&G.sa, 0, sizeof(G.sa)); - already done */
1558	/* sigfillset(&G.sa.sa_mask); - already done */
1559	/* G.sa.sa_flags = SA_RESTART; - already done */
1560	G.sa.sa_handler = handler;
1561	sigaction(sig, &G.sa, &old_sa);
1562	return old_sa.sa_handler;
1563	}
1564
1565	static void hush_exit(int exitcode) NORETURN;
1566
1567	static void restore_ttypgrp_and__exit(void) NORETURN;
1568	static void restore_ttypgrp_and__exit(void)
1569	{
1570	/* xfunc has failed! die die die */
1571	/* no EXIT traps, this is an escape hatch! */
1572	G.exiting = 1;
1573	hush_exit(xfunc_error_retval);
1574	}
1575
1576	#if ENABLE_HUSH_JOB
1577
1578	/* Needed only on some libc:
1579	* It was observed that on exit(), fgetc'ed buffered data
1580	* gets "unwound" via lseek(fd, -NUM, SEEK_CUR).
1581	* With the net effect that even after fork(), not vfork(),
1582	* exit() in NOEXECed applet in "sh SCRIPT":
1583	* noexec_applet_here
1584	* echo END_OF_SCRIPT
1585	* lseeks fd in input FILE object from EOF to "e" in "echo END_OF_SCRIPT".
1586	* This makes "echo END_OF_SCRIPT" executed twice.
1587	* Similar problems can be seen with die_if_script() -> xfunc_die()
1588	* and in `cmd` handling.
1589	* If set as die_func(), this makes xfunc_die() exit via _exit(), not exit():
1590	*/
1591	static void fflush_and__exit(void) NORETURN;
1592	static void fflush_and__exit(void)
1593	{
1594	fflush_all();
1595	_exit(xfunc_error_retval);
1596	}
1597
1598	/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
1599	# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
1600	/* After [v]fork, in parent: restore tty pgrp on xfunc death */
1601	# define enable_restore_tty_pgrp_on_exit() (die_func = restore_ttypgrp_and__exit)
1602
1603	/* Restores tty foreground process group, and exits.
1604	* May be called as signal handler for fatal signal
1605	* (will resend signal to itself, producing correct exit state)
1606	* or called directly with -EXITCODE.
1607	* We also call it if xfunc is exiting.
1608	*/
1609	static void sigexit(int sig) NORETURN;
1610	static void sigexit(int sig)
1611	{
1612	/* Careful: we can end up here after [v]fork. Do not restore
1613	* tty pgrp then, only top-level shell process does that */
1614	if (G_saved_tty_pgrp && getpid() == G.root_pid) {
1615	/* Disable all signals: job control, SIGPIPE, etc.
1616	* Mostly paranoid measure, to prevent infinite SIGTTOU.
1617	*/
1618	sigprocmask_allsigs(SIG_BLOCK);
1619	tcsetpgrp(G_interactive_fd, G_saved_tty_pgrp);
1620	}
1621
1622	/* Not a signal, just exit */
1623	if (sig <= 0)
1624	_exit(- sig);
1625
1626	kill_myself_with_sig(sig); /* does not return */
1627	}
1628	#else
1629
1630	# define disable_restore_tty_pgrp_on_exit() ((void)0)
1631	# define enable_restore_tty_pgrp_on_exit() ((void)0)
1632
1633	#endif
1634
1635	static sighandler_t pick_sighandler(unsigned sig)
1636	{
1637	sighandler_t handler = SIG_DFL;
1638	if (sig < sizeof(unsigned)*8) {
1639	unsigned sigmask = (1 << sig);
1640
1641	#if ENABLE_HUSH_JOB
1642	/* is sig fatal? */
1643	if (G_fatal_sig_mask & sigmask)
1644	handler = sigexit;
1645	else
1646	#endif
1647	/* sig has special handling? */
1648	if (G.special_sig_mask & sigmask) {
1649	handler = record_pending_signo;
1650	/* TTIN/TTOU/TSTP can't be set to record_pending_signo
1651	* in order to ignore them: they will be raised
1652	* in an endless loop when we try to do some
1653	* terminal ioctls! We do have to _ignore_ these.
1654	*/
1655	if (SPECIAL_JOBSTOP_SIGS & sigmask)
1656	handler = SIG_IGN;
1657	}
1658	}
1659	return handler;
1660	}
1661
1662	/* Restores tty foreground process group, and exits. */
1663	static void hush_exit(int exitcode)
1664	{
1665	#if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
1666	save_history(G.line_input_state);
1667	#endif
1668
1669	fflush_all();
1670	if (G.exiting <= 0 && G.traps && G.traps[0] && G.traps[0][0]) {
1671	char *argv[3];
1672	/* argv[0] is unused */
1673	argv[1] = G.traps[0];
1674	argv[2] = NULL;
1675	G.exiting = 1; /* prevent EXIT trap recursion */
1676	/* Note: G.traps[0] is not cleared!
1677	* "trap" will still show it, if executed
1678	* in the handler */
1679	builtin_eval(argv);
1680	}
1681
1682	#if ENABLE_FEATURE_CLEAN_UP
1683	{
1684	struct variable *cur_var;
1685	if (G.cwd != bb_msg_unknown)
1686	free((char*)G.cwd);
1687	cur_var = G.top_var;
1688	while (cur_var) {
1689	struct variable *tmp = cur_var;
1690	if (!cur_var->max_len)
1691	free(cur_var->varstr);
1692	cur_var = cur_var->next;
1693	free(tmp);
1694	}
1695	}
1696	#endif
1697
1698	fflush_all();
1699	#if ENABLE_HUSH_JOB
1700	sigexit(- (exitcode & 0xff));
1701	#else
1702	_exit(exitcode);
1703	#endif
1704	}
1705
1706
1707	//TODO: return a mask of ALL handled sigs?
1708	static int check_and_run_traps(void)
1709	{
1710	int last_sig = 0;
1711
1712	while (1) {
1713	int sig;
1714
1715	if (sigisemptyset(&G.pending_set))
1716	break;
1717	sig = 0;
1718	do {
1719	sig++;
1720	if (sigismember(&G.pending_set, sig)) {
1721	sigdelset(&G.pending_set, sig);
1722	goto got_sig;
1723	}
1724	} while (sig < NSIG);
1725	break;
1726	got_sig:
1727	if (G.traps && G.traps[sig]) {
1728	debug_printf_exec("%s: sig:%d handler:'%s'\n", __func__, sig, G.traps[sig]);
1729	if (G.traps[sig][0]) {
1730	/* We have user-defined handler */
1731	smalluint save_rcode;
1732	char *argv[3];
1733	/* argv[0] is unused */
1734	argv[1] = G.traps[sig];
1735	argv[2] = NULL;
1736	save_rcode = G.last_exitcode;
1737	builtin_eval(argv);
1738	//FIXME: shouldn't it be set to 128 + sig instead?
1739	G.last_exitcode = save_rcode;
1740	last_sig = sig;
1741	} /* else: "" trap, ignoring signal */
1742	continue;
1743	}
1744	/* not a trap: special action */
1745	switch (sig) {
1746	case SIGINT:
1747	debug_printf_exec("%s: sig:%d default SIGINT handler\n", __func__, sig);
1748	G.flag_SIGINT = 1;
1749	last_sig = sig;
1750	break;
1751	#if ENABLE_HUSH_JOB
1752	case SIGHUP: {
1753	struct pipe *job;
1754	debug_printf_exec("%s: sig:%d default SIGHUP handler\n", __func__, sig);
1755	/* bash is observed to signal whole process groups,
1756	* not individual processes */
1757	for (job = G.job_list; job; job = job->next) {
1758	if (job->pgrp <= 0)
1759	continue;
1760	debug_printf_exec("HUPing pgrp %d\n", job->pgrp);
1761	if (kill(- job->pgrp, SIGHUP) == 0)
1762	kill(- job->pgrp, SIGCONT);
1763	}
1764	sigexit(SIGHUP);
1765	}
1766	#endif
1767	#if ENABLE_HUSH_FAST
1768	case SIGCHLD:
1769	debug_printf_exec("%s: sig:%d default SIGCHLD handler\n", __func__, sig);
1770	G.count_SIGCHLD++;
1771	//bb_error_msg("[%d] check_and_run_traps: G.count_SIGCHLD:%d G.handled_SIGCHLD:%d", getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
1772	/* Note:
1773	* We dont do 'last_sig = sig' here -> NOT returning this sig.
1774	* This simplifies wait builtin a bit.
1775	*/
1776	break;
1777	#endif
1778	default: /* ignored: */
1779	debug_printf_exec("%s: sig:%d default handling is to ignore\n", __func__, sig);
1780	/* SIGTERM, SIGQUIT, SIGTTIN, SIGTTOU, SIGTSTP */
1781	/* Note:
1782	* We dont do 'last_sig = sig' here -> NOT returning this sig.
1783	* Example: wait is not interrupted by TERM
1784	* in interactive shell, because TERM is ignored.
1785	*/
1786	break;
1787	}
1788	}
1789	return last_sig;
1790	}
1791
1792
1793	static const char *get_cwd(int force)
1794	{
1795	if (force || G.cwd == NULL) {
1796	/* xrealloc_getcwd_or_warn(arg) calls free(arg),
1797	* we must not try to free(bb_msg_unknown) */
1798	if (G.cwd == bb_msg_unknown)
1799	G.cwd = NULL;
1800	G.cwd = xrealloc_getcwd_or_warn((char *)G.cwd);
1801	if (!G.cwd)
1802	G.cwd = bb_msg_unknown;
1803	}
1804	return G.cwd;
1805	}
1806
1807
1808	/*
1809	* Shell and environment variable support
1810	*/
1811	static struct variable **get_ptr_to_local_var(const char *name, unsigned len)
1812	{
1813	struct variable **pp;
1814	struct variable *cur;
1815
1816	pp = &G.top_var;
1817	while ((cur = *pp) != NULL) {
1818	if (strncmp(cur->varstr, name, len) == 0 && cur->varstr[len] == '=')
1819	return pp;
1820	pp = &cur->next;
1821	}
1822	return NULL;
1823	}
1824
1825	static const char* FAST_FUNC get_local_var_value(const char *name)
1826	{
1827	struct variable **vpp;
1828	unsigned len = strlen(name);
1829
1830	if (G.expanded_assignments) {
1831	char **cpp = G.expanded_assignments;
1832	while (*cpp) {
1833	char *cp = *cpp;
1834	if (strncmp(cp, name, len) == 0 && cp[len] == '=')
1835	return cp + len + 1;
1836	cpp++;
1837	}
1838	}
1839
1840	vpp = get_ptr_to_local_var(name, len);
1841	if (vpp)
1842	return (*vpp)->varstr + len + 1;
1843
1844	if (strcmp(name, "PPID") == 0)
1845	return utoa(G.root_ppid);
1846	// bash compat: UID? EUID?
1847	#if ENABLE_HUSH_RANDOM_SUPPORT
1848	if (strcmp(name, "RANDOM") == 0)
1849	return utoa(next_random(&G.random_gen));
1850	#endif
1851	return NULL;
1852	}
1853
1854	/* str holds "NAME=VAL" and is expected to be malloced.
1855	* We take ownership of it.
1856	* flg_export:
1857	* 0: do not change export flag
1858	* (if creating new variable, flag will be 0)
1859	* 1: set export flag and putenv the variable
1860	* -1: clear export flag and unsetenv the variable
1861	* flg_read_only is set only when we handle -R var=val
1862	*/
1863	#if !BB_MMU && ENABLE_HUSH_LOCAL
1864	/* all params are used */
1865	#elif BB_MMU && ENABLE_HUSH_LOCAL
1866	#define set_local_var(str, flg_export, local_lvl, flg_read_only) \
1867	set_local_var(str, flg_export, local_lvl)
1868	#elif BB_MMU && !ENABLE_HUSH_LOCAL
1869	#define set_local_var(str, flg_export, local_lvl, flg_read_only) \
1870	set_local_var(str, flg_export)
1871	#elif !BB_MMU && !ENABLE_HUSH_LOCAL
1872	#define set_local_var(str, flg_export, local_lvl, flg_read_only) \
1873	set_local_var(str, flg_export, flg_read_only)
1874	#endif
1875	static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_only)
1876	{
1877	struct variable **var_pp;
1878	struct variable *cur;
1879	char *free_me = NULL;
1880	char *eq_sign;
1881	int name_len;
1882
1883	eq_sign = strchr(str, '=');
1884	if (!eq_sign) { /* not expected to ever happen? */
1885	free(str);
1886	return -1;
1887	}
1888
1889	name_len = eq_sign - str + 1; /* including '=' */
1890	var_pp = &G.top_var;
1891	while ((cur = *var_pp) != NULL) {
1892	if (strncmp(cur->varstr, str, name_len) != 0) {
1893	var_pp = &cur->next;
1894	continue;
1895	}
1896
1897	/* We found an existing var with this name */
1898	if (cur->flg_read_only) {
1899	#if !BB_MMU
1900	if (!flg_read_only)
1901	#endif
1902	bb_error_msg("%s: readonly variable", str);
1903	free(str);
1904	return -1;
1905	}
1906	if (flg_export == -1) { // "&& cur->flg_export" ?
1907	debug_printf_env("%s: unsetenv '%s'\n", __func__, str);
1908	*eq_sign = '\0';
1909	unsetenv(str);
1910	*eq_sign = '=';
1911	}
1912	#if ENABLE_HUSH_LOCAL
1913	if (cur->func_nest_level < local_lvl) {
1914	/* New variable is declared as local,
1915	* and existing one is global, or local
1916	* from enclosing function.
1917	* Remove and save old one: */
1918	*var_pp = cur->next;
1919	cur->next = *G.shadowed_vars_pp;
1920	*G.shadowed_vars_pp = cur;
1921	/* bash 3.2.33(1) and exported vars:
1922	* # export z=z
1923	* # f() { local z=a; env | grep ^z; }
1924	* # f
1925	* z=a
1926	* # env | grep ^z
1927	* z=z
1928	*/
1929	if (cur->flg_export)
1930	flg_export = 1;
1931	break;
1932	}
1933	#endif
1934	if (strcmp(cur->varstr + name_len, eq_sign + 1) == 0) {
1935	free_and_exp:
1936	free(str);
1937	goto exp;
1938	}
1939	if (cur->max_len != 0) {
1940	if (cur->max_len >= strlen(str)) {
1941	/* This one is from startup env, reuse space */
1942	strcpy(cur->varstr, str);
1943	goto free_and_exp;
1944	}
1945	/* Can't reuse */
1946	cur->max_len = 0;
1947	goto set_str_and_exp;
1948	}
1949	/* max_len == 0 signifies "malloced" var, which we can
1950	* (and have to) free. But we can't free(cur->varstr) here:
1951	* if cur->flg_export is 1, it is in the environment.
1952	* We should either unsetenv+free, or wait until putenv,
1953	* then putenv(new)+free(old).
1954	*/
1955	free_me = cur->varstr;
1956	goto set_str_and_exp;
1957	}
1958
1959	/* Not found - create new variable struct */
1960	cur = xzalloc(sizeof(*cur));
1961	#if ENABLE_HUSH_LOCAL
1962	cur->func_nest_level = local_lvl;
1963	#endif
1964	cur->next = *var_pp;
1965	*var_pp = cur;
1966
1967	set_str_and_exp:
1968	cur->varstr = str;
1969	#if !BB_MMU
1970	cur->flg_read_only = flg_read_only;
1971	#endif
1972	exp:
1973	if (flg_export == 1)
1974	cur->flg_export = 1;
1975	if (name_len == 4 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
1976	cmdedit_update_prompt();
1977	if (cur->flg_export) {
1978	if (flg_export == -1) {
1979	cur->flg_export = 0;
1980	/* unsetenv was already done */
1981	} else {
1982	int i;
1983	debug_printf_env("%s: putenv '%s'\n", __func__, cur->varstr);
1984	i = putenv(cur->varstr);
1985	/* only now we can free old exported malloced string */
1986	free(free_me);
1987	return i;
1988	}
1989	}
1990	free(free_me);
1991	return 0;
1992	}
1993
1994	/* Used at startup and after each cd */
1995	static void set_pwd_var(int exp)
1996	{
1997	set_local_var(xasprintf("PWD=%s", get_cwd(/*force:*/ 1)),
1998	/*exp:*/ exp, /*lvl:*/ 0, /*ro:*/ 0);
1999	}
2000
2001	static int unset_local_var_len(const char *name, int name_len)
2002	{
2003	struct variable *cur;
2004	struct variable **var_pp;
2005
2006	if (!name)
2007	return EXIT_SUCCESS;
2008	var_pp = &G.top_var;
2009	while ((cur = *var_pp) != NULL) {
2010	if (strncmp(cur->varstr, name, name_len) == 0 && cur->varstr[name_len] == '=') {
2011	if (cur->flg_read_only) {
2012	bb_error_msg("%s: readonly variable", name);
2013	return EXIT_FAILURE;
2014	}
2015	*var_pp = cur->next;
2016	debug_printf_env("%s: unsetenv '%s'\n", __func__, cur->varstr);
2017	bb_unsetenv(cur->varstr);
2018	if (name_len == 3 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
2019	cmdedit_update_prompt();
2020	if (!cur->max_len)
2021	free(cur->varstr);
2022	free(cur);
2023	return EXIT_SUCCESS;
2024	}
2025	var_pp = &cur->next;
2026	}
2027	return EXIT_SUCCESS;
2028	}
2029
2030	static int unset_local_var(const char *name)
2031	{
2032	return unset_local_var_len(name, strlen(name));
2033	}
2034
2035	static void unset_vars(char **strings)
2036	{
2037	char **v;
2038
2039	if (!strings)
2040	return;
2041	v = strings;
2042	while (*v) {
2043	const char *eq = strchrnul(*v, '=');
2044	unset_local_var_len(*v, (int)(eq - *v));
2045	v++;
2046	}
2047	free(strings);
2048	}
2049
2050	static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
2051	{
2052	char *var = xasprintf("%s=%s", name, val);
2053	set_local_var(var, /*flags:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
2054	}
2055
2056
2057	/*
2058	* Helpers for "var1=val1 var2=val2 cmd" feature
2059	*/
2060	static void add_vars(struct variable *var)
2061	{
2062	struct variable *next;
2063
2064	while (var) {
2065	next = var->next;
2066	var->next = G.top_var;
2067	G.top_var = var;
2068	if (var->flg_export) {
2069	debug_printf_env("%s: restoring exported '%s'\n", __func__, var->varstr);
2070	putenv(var->varstr);
2071	} else {
2072	debug_printf_env("%s: restoring variable '%s'\n", __func__, var->varstr);
2073	}
2074	var = next;
2075	}
2076	}
2077
2078	static struct variable *set_vars_and_save_old(char **strings)
2079	{
2080	char **s;
2081	struct variable *old = NULL;
2082
2083	if (!strings)
2084	return old;
2085	s = strings;
2086	while (*s) {
2087	struct variable *var_p;
2088	struct variable **var_pp;
2089	char *eq;
2090
2091	eq = strchr(*s, '=');
2092	if (eq) {
2093	var_pp = get_ptr_to_local_var(*s, eq - *s);
2094	if (var_pp) {
2095	/* Remove variable from global linked list */
2096	var_p = *var_pp;
2097	debug_printf_env("%s: removing '%s'\n", __func__, var_p->varstr);
2098	*var_pp = var_p->next;
2099	/* Add it to returned list */
2100	var_p->next = old;
2101	old = var_p;
2102	}
2103	set_local_var(*s, /*exp:*/ 1, /*lvl:*/ 0, /*ro:*/ 0);
2104	}
2105	s++;
2106	}
2107	return old;
2108	}
2109
2110
2111	/*
2112	* Unicode helper
2113	*/
2114	static void reinit_unicode_for_hush(void)
2115	{
2116	/* Unicode support should be activated even if LANG is set
2117	* _during_ shell execution, not only if it was set when
2118	* shell was started. Therefore, re-check LANG every time:
2119	*/
2120	if (ENABLE_FEATURE_CHECK_UNICODE_IN_ENV
2121	|| ENABLE_UNICODE_USING_LOCALE
2122	) {
2123	const char *s = get_local_var_value("LC_ALL");
2124	if (!s) s = get_local_var_value("LC_CTYPE");
2125	if (!s) s = get_local_var_value("LANG");
2126	reinit_unicode(s);
2127	}
2128	}
2129
2130	/*
2131	* in_str support (strings, and "strings" read from files).
2132	*/
2133
2134	#if ENABLE_HUSH_INTERACTIVE
2135	/* To test correct lineedit/interactive behavior, type from command line:
2136	* echo $P\
2137	* \
2138	* AT\
2139	* H\
2140	* \
2141	* It excercises a lot of corner cases.
2142	*/
2143	static void cmdedit_update_prompt(void)
2144	{
2145	if (ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
2146	G.PS1 = get_local_var_value("PS1");
2147	if (G.PS1 == NULL)
2148	G.PS1 = "\\w \\$ ";
2149	G.PS2 = get_local_var_value("PS2");
2150	} else {
2151	G.PS1 = NULL;
2152	}
2153	if (G.PS2 == NULL)
2154	G.PS2 = "> ";
2155	}
2156	static const char *setup_prompt_string(int promptmode)
2157	{
2158	const char *prompt_str;
2159	debug_printf("setup_prompt_string %d ", promptmode);
2160	if (!ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
2161	/* Set up the prompt */
2162	if (promptmode == 0) { /* PS1 */
2163	free((char*)G.PS1);
2164	/* bash uses $PWD value, even if it is set by user.
2165	* It uses current dir only if PWD is unset.
2166	* We always use current dir. */
2167	G.PS1 = xasprintf("%s %c ", get_cwd(0), (geteuid() != 0) ? '$' : '#');
2168	prompt_str = G.PS1;
2169	} else
2170	prompt_str = G.PS2;
2171	} else
2172	prompt_str = (promptmode == 0) ? G.PS1 : G.PS2;
2173	debug_printf("prompt_str '%s'\n", prompt_str);
2174	return prompt_str;
2175	}
2176	static int get_user_input(struct in_str *i)
2177	{
2178	int r;
2179	const char *prompt_str;
2180
2181	prompt_str = setup_prompt_string(i->promptmode);
2182	# if ENABLE_FEATURE_EDITING
2183	for (;;) {
2184	reinit_unicode_for_hush();
2185	if (G.flag_SIGINT) {
2186	/* There was ^C'ed, make it look prettier: */
2187	bb_putchar('\n');
2188	G.flag_SIGINT = 0;
2189	}
2190	/* buglet: SIGINT will not make new prompt to appear _at once_,
2191	* only after <Enter>. (^C works immediately) */
2192	r = read_line_input(G.line_input_state, prompt_str,
2193	G.user_input_buf, CONFIG_FEATURE_EDITING_MAX_LEN-1,
2194	/*timeout*/ -1
2195	);
2196	/* read_line_input intercepts ^C, "convert" it to SIGINT */
2197	if (r == 0) {
2198	write(STDOUT_FILENO, "^C", 2);
2199	raise(SIGINT);
2200	}
2201	check_and_run_traps();
2202	if (r != 0 && !G.flag_SIGINT)
2203	break;
2204	/* ^C or SIGINT: repeat */
2205	G.last_exitcode = 128 + SIGINT;
2206	}
2207	if (r < 0) {
2208	/* EOF/error detected */
2209	i->p = NULL;
2210	i->peek_buf[0] = r = EOF;
2211	return r;
2212	}
2213	i->p = G.user_input_buf;
2214	return (unsigned char)*i->p++;
2215	# else
2216	for (;;) {
2217	G.flag_SIGINT = 0;
2218	if (i->last_char == '\0' || i->last_char == '\n') {
2219	/* Why check_and_run_traps here? Try this interactively:
2220	* $ trap 'echo INT' INT; (sleep 2; kill -INT $$) &
2221	* $ <[enter], repeatedly...>
2222	* Without check_and_run_traps, handler never runs.
2223	*/
2224	check_and_run_traps();
2225	fputs(prompt_str, stdout);
2226	}
2227	fflush_all();
2228	//FIXME: here ^C or SIGINT will have effect only after <Enter>
2229	r = fgetc(i->file);
2230	/* In !ENABLE_FEATURE_EDITING we don't use read_line_input,
2231	* no ^C masking happens during fgetc, no special code for ^C:
2232	* it generates SIGINT as usual.
2233	*/
2234	check_and_run_traps();
2235	if (G.flag_SIGINT)
2236	G.last_exitcode = 128 + SIGINT;
2237	if (r != '\0')
2238	break;
2239	}
2240	return r;
2241	# endif
2242	}
2243	/* This is the magic location that prints prompts
2244	* and gets data back from the user */
2245	static int fgetc_interactive(struct in_str *i)
2246	{
2247	int ch;
2248	/* If it's interactive stdin, get new line. */
2249	if (G_interactive_fd && i->file == stdin) {
2250	/* Returns first char (or EOF), the rest is in i->p[] */
2251	ch = get_user_input(i);
2252	i->promptmode = 1; /* PS2 */
2253	} else {
2254	/* Not stdin: script file, sourced file, etc */
2255	do ch = fgetc(i->file); while (ch == '\0');
2256	}
2257	return ch;
2258	}
2259	#else
2260	static inline int fgetc_interactive(struct in_str *i)
2261	{
2262	int ch;
2263	do ch = fgetc(i->file); while (ch == '\0');
2264	return ch;
2265	}
2266	#endif /* INTERACTIVE */
2267
2268	static int i_getch(struct in_str *i)
2269	{
2270	int ch;
2271
2272	if (!i->file) {
2273	/* string-based in_str */
2274	ch = (unsigned char)*i->p;
2275	if (ch != '\0') {
2276	i->p++;
2277	i->last_char = ch;
2278	return ch;
2279	}
2280	return EOF;
2281	}
2282
2283	/* FILE-based in_str */
2284
2285	#if ENABLE_FEATURE_EDITING
2286	/* This can be stdin, check line editing char[] buffer */
2287	if (i->p && *i->p != '\0') {
2288	ch = (unsigned char)*i->p++;
2289	goto out;
2290	}
2291	#endif
2292	/* peek_buf[] is an int array, not char. Can contain EOF. */
2293	ch = i->peek_buf[0];
2294	if (ch != 0) {
2295	int ch2 = i->peek_buf[1];
2296	i->peek_buf[0] = ch2;
2297	if (ch2 == 0) /* very likely, avoid redundant write */
2298	goto out;
2299	i->peek_buf[1] = 0;
2300	goto out;
2301	}
2302
2303	ch = fgetc_interactive(i);
2304	out:
2305	debug_printf("file_get: got '%c' %d\n", ch, ch);
2306	i->last_char = ch;
2307	return ch;
2308	}
2309
2310	static int i_peek(struct in_str *i)
2311	{
2312	int ch;
2313
2314	if (!i->file) {
2315	/* string-based in_str */
2316	/* Doesn't report EOF on NUL. None of the callers care. */
2317	return (unsigned char)*i->p;
2318	}
2319
2320	/* FILE-based in_str */
2321
2322	#if ENABLE_FEATURE_EDITING && ENABLE_HUSH_INTERACTIVE
2323	/* This can be stdin, check line editing char[] buffer */
2324	if (i->p && *i->p != '\0')
2325	return (unsigned char)*i->p;
2326	#endif
2327	/* peek_buf[] is an int array, not char. Can contain EOF. */
2328	ch = i->peek_buf[0];
2329	if (ch != 0)
2330	return ch;
2331
2332	/* Need to get a new char */
2333	ch = fgetc_interactive(i);
2334	debug_printf("file_peek: got '%c' %d\n", ch, ch);
2335
2336	/* Save it by either rolling back line editing buffer, or in i->peek_buf[0] */
2337	#if ENABLE_FEATURE_EDITING && ENABLE_HUSH_INTERACTIVE
2338	if (i->p) {
2339	i->p -= 1;
2340	return ch;
2341	}
2342	#endif
2343	i->peek_buf[0] = ch;
2344	/*i->peek_buf[1] = 0; - already is */
2345	return ch;
2346	}
2347
2348	/* Only ever called if i_peek() was called, and did not return EOF.
2349	* IOW: we know the previous peek saw an ordinary char, not EOF, not NUL,
2350	* not end-of-line. Therefore we never need to read a new editing line here.
2351	*/
2352	static int i_peek2(struct in_str *i)
2353	{
2354	int ch;
2355
2356	/* There are two cases when i->p[] buffer exists.
2357	* (1) it's a string in_str.
2358	* (2) It's a file, and we have a saved line editing buffer.
2359	* In both cases, we know that i->p[0] exists and not NUL, and
2360	* the peek2 result is in i->p[1].
2361	*/
2362	if (i->p)
2363	return (unsigned char)i->p[1];
2364
2365	/* Now we know it is a file-based in_str. */
2366
2367	/* peek_buf[] is an int array, not char. Can contain EOF. */
2368	/* Is there 2nd char? */
2369	ch = i->peek_buf[1];
2370	if (ch == 0) {
2371	/* We did not read it yet, get it now */
2372	do ch = fgetc(i->file); while (ch == '\0');
2373	i->peek_buf[1] = ch;
2374	}
2375
2376	debug_printf("file_peek2: got '%c' %d\n", ch, ch);
2377	return ch;
2378	}
2379
2380	static void setup_file_in_str(struct in_str *i, FILE *f)
2381	{
2382	memset(i, 0, sizeof(*i));
2383	/* i->promptmode = 0; - PS1 (memset did it) */
2384	i->file = f;
2385	/* i->p = NULL; */
2386	}
2387
2388	static void setup_string_in_str(struct in_str *i, const char *s)
2389	{
2390	memset(i, 0, sizeof(*i));
2391	/* i->promptmode = 0; - PS1 (memset did it) */
2392	/*i->file = NULL */;
2393	i->p = s;
2394	}
2395
2396
2397	/*
2398	* o_string support
2399	*/
2400	#define B_CHUNK (32 * sizeof(char*))
2401
2402	static void o_reset_to_empty_unquoted(o_string *o)
2403	{
2404	o->length = 0;
2405	o->has_quoted_part = 0;
2406	if (o->data)
2407	o->data[0] = '\0';
2408	}
2409
2410	static void o_free(o_string *o)
2411	{
2412	free(o->data);
2413	memset(o, 0, sizeof(*o));
2414	}
2415
2416	static ALWAYS_INLINE void o_free_unsafe(o_string *o)
2417	{
2418	free(o->data);
2419	}
2420
2421	static void o_grow_by(o_string *o, int len)
2422	{
2423	if (o->length + len > o->maxlen) {
2424	o->maxlen += (2 * len) | (B_CHUNK-1);
2425	o->data = xrealloc(o->data, 1 + o->maxlen);
2426	}
2427	}
2428
2429	static void o_addchr(o_string *o, int ch)
2430	{
2431	debug_printf("o_addchr: '%c' o->length=%d o=%p\n", ch, o->length, o);
2432	if (o->length < o->maxlen) {
2433	/* likely. avoid o_grow_by() call */
2434	add:
2435	o->data[o->length] = ch;
2436	o->length++;
2437	o->data[o->length] = '\0';
2438	return;
2439	}
2440	o_grow_by(o, 1);
2441	goto add;
2442	}
2443
2444	#if 0
2445	/* Valid only if we know o_string is not empty */
2446	static void o_delchr(o_string *o)
2447	{
2448	o->length--;
2449	o->data[o->length] = '\0';
2450	}
2451	#endif
2452
2453	static void o_addblock(o_string *o, const char *str, int len)
2454	{
2455	o_grow_by(o, len);
2456	memcpy(&o->data[o->length], str, len);
2457	o->length += len;
2458	o->data[o->length] = '\0';
2459	}
2460
2461	static void o_addstr(o_string *o, const char *str)
2462	{
2463	o_addblock(o, str, strlen(str));
2464	}
2465
2466	#if !BB_MMU
2467	static void nommu_addchr(o_string *o, int ch)
2468	{
2469	if (o)
2470	o_addchr(o, ch);
2471	}
2472	#else
2473	# define nommu_addchr(o, str) ((void)0)
2474	#endif
2475
2476	static void o_addstr_with_NUL(o_string *o, const char *str)
2477	{
2478	o_addblock(o, str, strlen(str) + 1);
2479	}
2480
2481	/*
2482	* HUSH_BRACE_EXPANSION code needs corresponding quoting on variable expansion side.
2483	* Currently, "v='{q,w}'; echo $v" erroneously expands braces in $v.
2484	* Apparently, on unquoted $v bash still does globbing
2485	* ("v='*.txt'; echo $v" prints all .txt files),
2486	* but NOT brace expansion! Thus, there should be TWO independent
2487	* quoting mechanisms on $v expansion side: one protects
2488	* $v from brace expansion, and other additionally protects "$v" against globbing.
2489	* We have only second one.
2490	*/
2491
2492	#if ENABLE_HUSH_BRACE_EXPANSION
2493	# define MAYBE_BRACES "{}"
2494	#else
2495	# define MAYBE_BRACES ""
2496	#endif
2497
2498	/* My analysis of quoting semantics tells me that state information
2499	* is associated with a destination, not a source.
2500	*/
2501	static void o_addqchr(o_string *o, int ch)
2502	{
2503	int sz = 1;
2504	char *found = strchr("*?[\\" MAYBE_BRACES, ch);
2505	if (found)
2506	sz++;
2507	o_grow_by(o, sz);
2508	if (found) {
2509	o->data[o->length] = '\\';
2510	o->length++;
2511	}
2512	o->data[o->length] = ch;
2513	o->length++;
2514	o->data[o->length] = '\0';
2515	}
2516
2517	static void o_addQchr(o_string *o, int ch)
2518	{
2519	int sz = 1;
2520	if ((o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)
2521	&& strchr("*?[\\" MAYBE_BRACES, ch)
2522	) {
2523	sz++;
2524	o->data[o->length] = '\\';
2525	o->length++;
2526	}
2527	o_grow_by(o, sz);
2528	o->data[o->length] = ch;
2529	o->length++;
2530	o->data[o->length] = '\0';
2531	}
2532
2533	static void o_addqblock(o_string *o, const char *str, int len)
2534	{
2535	while (len) {
2536	char ch;
2537	int sz;
2538	int ordinary_cnt = strcspn(str, "*?[\\" MAYBE_BRACES);
2539	if (ordinary_cnt > len) /* paranoia */
2540	ordinary_cnt = len;
2541	o_addblock(o, str, ordinary_cnt);
2542	if (ordinary_cnt == len)
2543	return; /* NUL is already added by o_addblock */
2544	str += ordinary_cnt;
2545	len -= ordinary_cnt + 1; /* we are processing + 1 char below */
2546
2547	ch = *str++;
2548	sz = 1;
2549	if (ch) { /* it is necessarily one of "*?[\\" MAYBE_BRACES */
2550	sz++;
2551	o->data[o->length] = '\\';
2552	o->length++;
2553	}
2554	o_grow_by(o, sz);
2555	o->data[o->length] = ch;
2556	o->length++;
2557	}
2558	o->data[o->length] = '\0';
2559	}
2560
2561	static void o_addQblock(o_string *o, const char *str, int len)
2562	{
2563	if (!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)) {
2564	o_addblock(o, str, len);
2565	return;
2566	}
2567	o_addqblock(o, str, len);
2568	}
2569
2570	static void o_addQstr(o_string *o, const char *str)
2571	{
2572	o_addQblock(o, str, strlen(str));
2573	}
2574
2575	/* A special kind of o_string for $VAR and `cmd` expansion.
2576	* It contains char* list[] at the beginning, which is grown in 16 element
2577	* increments. Actual string data starts at the next multiple of 16 * (char*).
2578	* list[i] contains an INDEX (int!) into this string data.
2579	* It means that if list[] needs to grow, data needs to be moved higher up
2580	* but list[i]'s need not be modified.
2581	* NB: remembering how many list[i]'s you have there is crucial.
2582	* o_finalize_list() operation post-processes this structure - calculates
2583	* and stores actual char* ptrs in list[]. Oh, it NULL terminates it as well.
2584	*/
2585	#if DEBUG_EXPAND || DEBUG_GLOB
2586	static void debug_print_list(const char *prefix, o_string *o, int n)
2587	{
2588	char **list = (char**)o->data;
2589	int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
2590	int i = 0;
2591
2592	indent();
2593	fdprintf(2, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
2594	prefix, list, n, string_start, o->length, o->maxlen,
2595	!!(o->o_expflags & EXP_FLAG_GLOB),
2596	o->has_quoted_part,
2597	!!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
2598	while (i < n) {
2599	indent();
2600	fdprintf(2, " list[%d]=%d '%s' %p\n", i, (int)(uintptr_t)list[i],
2601	o->data + (int)(uintptr_t)list[i] + string_start,
2602	o->data + (int)(uintptr_t)list[i] + string_start);
2603	i++;
2604	}
2605	if (n) {
2606	const char *p = o->data + (int)(uintptr_t)list[n - 1] + string_start;
2607	indent();
2608	fdprintf(2, " total_sz:%ld\n", (long)((p + strlen(p) + 1) - o->data));
2609	}
2610	}
2611	#else
2612	# define debug_print_list(prefix, o, n) ((void)0)
2613	#endif
2614
2615	/* n = o_save_ptr_helper(str, n) "starts new string" by storing an index value
2616	* in list[n] so that it points past last stored byte so far.
2617	* It returns n+1. */
2618	static int o_save_ptr_helper(o_string *o, int n)
2619	{
2620	char **list = (char**)o->data;
2621	int string_start;
2622	int string_len;
2623
2624	if (!o->has_empty_slot) {
2625	string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
2626	string_len = o->length - string_start;
2627	if (!(n & 0xf)) { /* 0, 0x10, 0x20...? */
2628	debug_printf_list("list[%d]=%d string_start=%d (growing)\n", n, string_len, string_start);
2629	/* list[n] points to string_start, make space for 16 more pointers */
2630	o->maxlen += 0x10 * sizeof(list[0]);
2631	o->data = xrealloc(o->data, o->maxlen + 1);
2632	list = (char**)o->data;
2633	memmove(list + n + 0x10, list + n, string_len);
2634	o->length += 0x10 * sizeof(list[0]);
2635	} else {
2636	debug_printf_list("list[%d]=%d string_start=%d\n",
2637	n, string_len, string_start);
2638	}
2639	} else {
2640	/* We have empty slot at list[n], reuse without growth */
2641	string_start = ((n+1 + 0xf) & ~0xf) * sizeof(list[0]); /* NB: n+1! */
2642	string_len = o->length - string_start;
2643	debug_printf_list("list[%d]=%d string_start=%d (empty slot)\n",
2644	n, string_len, string_start);
2645	o->has_empty_slot = 0;
2646	}
2647	o->has_quoted_part = 0;
2648	list[n] = (char*)(uintptr_t)string_len;
2649	return n + 1;
2650	}
2651
2652	/* "What was our last o_save_ptr'ed position (byte offset relative o->data)?" */
2653	static int o_get_last_ptr(o_string *o, int n)
2654	{
2655	char **list = (char**)o->data;
2656	int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
2657
2658	return ((int)(uintptr_t)list[n-1]) + string_start;
2659	}
2660
2661	#if ENABLE_HUSH_BRACE_EXPANSION
2662	/* There in a GNU extension, GLOB_BRACE, but it is not usable:
2663	* first, it processes even {a} (no commas), second,
2664	* I didn't manage to make it return strings when they don't match
2665	* existing files. Need to re-implement it.
2666	*/
2667
2668	/* Helper */
2669	static int glob_needed(const char *s)
2670	{
2671	while (*s) {
2672	if (*s == '\\') {
2673	if (!s[1])
2674	return 0;
2675	s += 2;
2676	continue;
2677	}
2678	if (*s == '*' || *s == '[' || *s == '?' || *s == '{')
2679	return 1;
2680	s++;
2681	}
2682	return 0;
2683	}
2684	/* Return pointer to next closing brace or to comma */
2685	static const char *next_brace_sub(const char *cp)
2686	{
2687	unsigned depth = 0;
2688	cp++;
2689	while (*cp != '\0') {
2690	if (*cp == '\\') {
2691	if (*++cp == '\0')
2692	break;
2693	cp++;
2694	continue;
2695	}
2696	if ((*cp == '}' && depth-- == 0) || (*cp == ',' && depth == 0))
2697	break;
2698	if (*cp++ == '{')
2699	depth++;
2700	}
2701
2702	return *cp != '\0' ? cp : NULL;
2703	}
2704	/* Recursive brace globber. Note: may garble pattern[]. */
2705	static int glob_brace(char *pattern, o_string *o, int n)
2706	{
2707	char *new_pattern_buf;
2708	const char *begin;
2709	const char *next;
2710	const char *rest;
2711	const char *p;
2712	size_t rest_len;
2713
2714	debug_printf_glob("glob_brace('%s')\n", pattern);
2715
2716	begin = pattern;
2717	while (1) {
2718	if (*begin == '\0')
2719	goto simple_glob;
2720	if (*begin == '{') {
2721	/* Find the first sub-pattern and at the same time
2722	* find the rest after the closing brace */
2723	next = next_brace_sub(begin);
2724	if (next == NULL) {
2725	/* An illegal expression */
2726	goto simple_glob;
2727	}
2728	if (*next == '}') {
2729	/* "{abc}" with no commas - illegal
2730	* brace expr, disregard and skip it */
2731	begin = next + 1;
2732	continue;
2733	}
2734	break;
2735	}
2736	if (*begin == '\\' && begin[1] != '\0')
2737	begin++;
2738	begin++;
2739	}
2740	debug_printf_glob("begin:%s\n", begin);
2741	debug_printf_glob("next:%s\n", next);
2742
2743	/* Now find the end of the whole brace expression */
2744	rest = next;
2745	while (*rest != '}') {
2746	rest = next_brace_sub(rest);
2747	if (rest == NULL) {
2748	/* An illegal expression */
2749	goto simple_glob;
2750	}
2751	debug_printf_glob("rest:%s\n", rest);
2752	}
2753	rest_len = strlen(++rest) + 1;
2754
2755	/* We are sure the brace expression is well-formed */
2756
2757	/* Allocate working buffer large enough for our work */
2758	new_pattern_buf = xmalloc(strlen(pattern));
2759
2760	/* We have a brace expression. BEGIN points to the opening {,
2761	* NEXT points past the terminator of the first element, and REST
2762	* points past the final }. We will accumulate result names from
2763	* recursive runs for each brace alternative in the buffer using
2764	* GLOB_APPEND. */
2765
2766	p = begin + 1;
2767	while (1) {
2768	/* Construct the new glob expression */
2769	memcpy(
2770	mempcpy(
2771	mempcpy(new_pattern_buf,
2772	/* We know the prefix for all sub-patterns */
2773	pattern, begin - pattern),
2774	p, next - p),
2775	rest, rest_len);
2776
2777	/* Note: glob_brace() may garble new_pattern_buf[].
2778	* That's why we re-copy prefix every time (1st memcpy above).
2779	*/
2780	n = glob_brace(new_pattern_buf, o, n);
2781	if (*next == '}') {
2782	/* We saw the last entry */
2783	break;
2784	}
2785	p = next + 1;
2786	next = next_brace_sub(next);
2787	}
2788	free(new_pattern_buf);
2789	return n;
2790
2791	simple_glob:
2792	{
2793	int gr;
2794	glob_t globdata;
2795
2796	memset(&globdata, 0, sizeof(globdata));
2797	gr = glob(pattern, 0, NULL, &globdata);
2798	debug_printf_glob("glob('%s'):%d\n", pattern, gr);
2799	if (gr != 0) {
2800	if (gr == GLOB_NOMATCH) {
2801	globfree(&globdata);
2802	/* NB: garbles parameter */
2803	unbackslash(pattern);
2804	o_addstr_with_NUL(o, pattern);
2805	debug_printf_glob("glob pattern '%s' is literal\n", pattern);
2806	return o_save_ptr_helper(o, n);
2807	}
2808	if (gr == GLOB_NOSPACE)
2809	bb_error_msg_and_die(bb_msg_memory_exhausted);
2810	/* GLOB_ABORTED? Only happens with GLOB_ERR flag,
2811	* but we didn't specify it. Paranoia again. */
2812	bb_error_msg_and_die("glob error %d on '%s'", gr, pattern);
2813	}
2814	if (globdata.gl_pathv && globdata.gl_pathv[0]) {
2815	char **argv = globdata.gl_pathv;
2816	while (1) {
2817	o_addstr_with_NUL(o, *argv);
2818	n = o_save_ptr_helper(o, n);
2819	argv++;
2820	if (!*argv)
2821	break;
2822	}
2823	}
2824	globfree(&globdata);
2825	}
2826	return n;
2827	}
2828	/* Performs globbing on last list[],
2829	* saving each result as a new list[].
2830	*/
2831	static int perform_glob(o_string *o, int n)
2832	{
2833	char *pattern, *copy;
2834
2835	debug_printf_glob("start perform_glob: n:%d o->data:%p\n", n, o->data);
2836	if (!o->data)
2837	return o_save_ptr_helper(o, n);
2838	pattern = o->data + o_get_last_ptr(o, n);
2839	debug_printf_glob("glob pattern '%s'\n", pattern);
2840	if (!glob_needed(pattern)) {
2841	/* unbackslash last string in o in place, fix length */
2842	o->length = unbackslash(pattern) - o->data;
2843	debug_printf_glob("glob pattern '%s' is literal\n", pattern);
2844	return o_save_ptr_helper(o, n);
2845	}
2846
2847	copy = xstrdup(pattern);
2848	/* "forget" pattern in o */
2849	o->length = pattern - o->data;
2850	n = glob_brace(copy, o, n);
2851	free(copy);
2852	if (DEBUG_GLOB)
2853	debug_print_list("perform_glob returning", o, n);
2854	return n;
2855	}
2856
2857	#else /* !HUSH_BRACE_EXPANSION */
2858
2859	/* Helper */
2860	static int glob_needed(const char *s)
2861	{
2862	while (*s) {
2863	if (*s == '\\') {
2864	if (!s[1])
2865	return 0;
2866	s += 2;
2867	continue;
2868	}
2869	if (*s == '*' || *s == '[' || *s == '?')
2870	return 1;
2871	s++;
2872	}
2873	return 0;
2874	}
2875	/* Performs globbing on last list[],
2876	* saving each result as a new list[].
2877	*/
2878	static int perform_glob(o_string *o, int n)
2879	{
2880	glob_t globdata;
2881	int gr;
2882	char *pattern;
2883
2884	debug_printf_glob("start perform_glob: n:%d o->data:%p\n", n, o->data);
2885	if (!o->data)
2886	return o_save_ptr_helper(o, n);
2887	pattern = o->data + o_get_last_ptr(o, n);
2888	debug_printf_glob("glob pattern '%s'\n", pattern);
2889	if (!glob_needed(pattern)) {
2890	literal:
2891	/* unbackslash last string in o in place, fix length */
2892	o->length = unbackslash(pattern) - o->data;
2893	debug_printf_glob("glob pattern '%s' is literal\n", pattern);
2894	return o_save_ptr_helper(o, n);
2895	}
2896
2897	memset(&globdata, 0, sizeof(globdata));
2898	/* Can't use GLOB_NOCHECK: it does not unescape the string.
2899	* If we glob "*.\*" and don't find anything, we need
2900	* to fall back to using literal "*.*", but GLOB_NOCHECK
2901	* will return "*.\*"!
2902	*/
2903	gr = glob(pattern, 0, NULL, &globdata);
2904	debug_printf_glob("glob('%s'):%d\n", pattern, gr);
2905	if (gr != 0) {
2906	if (gr == GLOB_NOMATCH) {
2907	globfree(&globdata);
2908	goto literal;
2909	}
2910	if (gr == GLOB_NOSPACE)
2911	bb_error_msg_and_die(bb_msg_memory_exhausted);
2912	/* GLOB_ABORTED? Only happens with GLOB_ERR flag,
2913	* but we didn't specify it. Paranoia again. */
2914	bb_error_msg_and_die("glob error %d on '%s'", gr, pattern);
2915	}
2916	if (globdata.gl_pathv && globdata.gl_pathv[0]) {
2917	char **argv = globdata.gl_pathv;
2918	/* "forget" pattern in o */
2919	o->length = pattern - o->data;
2920	while (1) {
2921	o_addstr_with_NUL(o, *argv);
2922	n = o_save_ptr_helper(o, n);
2923	argv++;
2924	if (!*argv)
2925	break;
2926	}
2927	}
2928	globfree(&globdata);
2929	if (DEBUG_GLOB)
2930	debug_print_list("perform_glob returning", o, n);
2931	return n;
2932	}
2933
2934	#endif /* !HUSH_BRACE_EXPANSION */
2935
2936	/* If o->o_expflags & EXP_FLAG_GLOB, glob the string so far remembered.
2937	* Otherwise, just finish current list[] and start new */
2938	static int o_save_ptr(o_string *o, int n)
2939	{
2940	if (o->o_expflags & EXP_FLAG_GLOB) {
2941	/* If o->has_empty_slot, list[n] was already globbed
2942	* (if it was requested back then when it was filled)
2943	* so don't do that again! */
2944	if (!o->has_empty_slot)
2945	return perform_glob(o, n); /* o_save_ptr_helper is inside */
2946	}
2947	return o_save_ptr_helper(o, n);
2948	}
2949
2950	/* "Please convert list[n] to real char* ptrs, and NULL terminate it." */
2951	static char **o_finalize_list(o_string *o, int n)
2952	{
2953	char **list;
2954	int string_start;
2955
2956	n = o_save_ptr(o, n); /* force growth for list[n] if necessary */
2957	if (DEBUG_EXPAND)
2958	debug_print_list("finalized", o, n);
2959	debug_printf_expand("finalized n:%d\n", n);
2960	list = (char**)o->data;
2961	string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
2962	list[--n] = NULL;
2963	while (n) {
2964	n--;
2965	list[n] = o->data + (int)(uintptr_t)list[n] + string_start;
2966	}
2967	return list;
2968	}
2969
2970	static void free_pipe_list(struct pipe *pi);
2971
2972	/* Returns pi->next - next pipe in the list */
2973	static struct pipe *free_pipe(struct pipe *pi)
2974	{
2975	struct pipe *next;
2976	int i;
2977
2978	debug_printf_clean("free_pipe (pid %d)\n", getpid());
2979	for (i = 0; i < pi->num_cmds; i++) {
2980	struct command *command;
2981	struct redir_struct *r, *rnext;
2982
2983	command = &pi->cmds[i];
2984	debug_printf_clean(" command %d:\n", i);
2985	if (command->argv) {
2986	if (DEBUG_CLEAN) {
2987	int a;
2988	char **p;
2989	for (a = 0, p = command->argv; *p; a++, p++) {
2990	debug_printf_clean(" argv[%d] = %s\n", a, *p);
2991	}
2992	}
2993	free_strings(command->argv);
2994	//command->argv = NULL;
2995	}
2996	/* not "else if": on syntax error, we may have both! */
2997	if (command->group) {
2998	debug_printf_clean(" begin group (cmd_type:%d)\n",
2999	command->cmd_type);
3000	free_pipe_list(command->group);
3001	debug_printf_clean(" end group\n");
3002	//command->group = NULL;
3003	}
3004	/* else is crucial here.
3005	* If group != NULL, child_func is meaningless */
3006	#if ENABLE_HUSH_FUNCTIONS
3007	else if (command->child_func) {
3008	debug_printf_exec("cmd %p releases child func at %p\n", command, command->child_func);
3009	command->child_func->parent_cmd = NULL;
3010	}
3011	#endif
3012	#if !BB_MMU
3013	free(command->group_as_string);
3014	//command->group_as_string = NULL;
3015	#endif
3016	for (r = command->redirects; r; r = rnext) {
3017	debug_printf_clean(" redirect %d%s",
3018	r->rd_fd, redir_table[r->rd_type].descrip);
3019	/* guard against the case >$FOO, where foo is unset or blank */
3020	if (r->rd_filename) {
3021	debug_printf_clean(" fname:'%s'\n", r->rd_filename);
3022	free(r->rd_filename);
3023	//r->rd_filename = NULL;
3024	}
3025	debug_printf_clean(" rd_dup:%d\n", r->rd_dup);
3026	rnext = r->next;
3027	free(r);
3028	}
3029	//command->redirects = NULL;
3030	}
3031	free(pi->cmds); /* children are an array, they get freed all at once */
3032	//pi->cmds = NULL;
3033	#if ENABLE_HUSH_JOB
3034	free(pi->cmdtext);
3035	//pi->cmdtext = NULL;
3036	#endif
3037
3038	next = pi->next;
3039	free(pi);
3040	return next;
3041	}
3042
3043	static void free_pipe_list(struct pipe *pi)
3044	{
3045	while (pi) {
3046	#if HAS_KEYWORDS
3047	debug_printf_clean("pipe reserved word %d\n", pi->res_word);
3048	#endif
3049	debug_printf_clean("pipe followup code %d\n", pi->followup);
3050	pi = free_pipe(pi);
3051	}
3052	}
3053
3054
3055	/*** Parsing routines ***/
3056
3057	#ifndef debug_print_tree
3058	static void debug_print_tree(struct pipe *pi, int lvl)
3059	{
3060	static const char *const PIPE[] = {
3061	[PIPE_SEQ] = "SEQ",
3062	[PIPE_AND] = "AND",
3063	[PIPE_OR ] = "OR" ,
3064	[PIPE_BG ] = "BG" ,
3065	};
3066	static const char *RES[] = {
3067	[RES_NONE ] = "NONE" ,
3068	# if ENABLE_HUSH_IF
3069	[RES_IF ] = "IF" ,
3070	[RES_THEN ] = "THEN" ,
3071	[RES_ELIF ] = "ELIF" ,
3072	[RES_ELSE ] = "ELSE" ,
3073	[RES_FI ] = "FI" ,
3074	# endif
3075	# if ENABLE_HUSH_LOOPS
3076	[RES_FOR ] = "FOR" ,
3077	[RES_WHILE] = "WHILE",
3078	[RES_UNTIL] = "UNTIL",
3079	[RES_DO ] = "DO" ,
3080	[RES_DONE ] = "DONE" ,
3081	# endif
3082	# if ENABLE_HUSH_LOOPS || ENABLE_HUSH_CASE
3083	[RES_IN ] = "IN" ,
3084	# endif
3085	# if ENABLE_HUSH_CASE
3086	[RES_CASE ] = "CASE" ,
3087	[RES_CASE_IN ] = "CASE_IN" ,
3088	[RES_MATCH] = "MATCH",
3089	[RES_CASE_BODY] = "CASE_BODY",
3090	[RES_ESAC ] = "ESAC" ,
3091	# endif
3092	[RES_XXXX ] = "XXXX" ,
3093	[RES_SNTX ] = "SNTX" ,
3094	};
3095	static const char *const CMDTYPE[] = {
3096	"{}",
3097	"()",
3098	"[noglob]",
3099	# if ENABLE_HUSH_FUNCTIONS
3100	"func()",
3101	# endif
3102	};
3103
3104	int pin, prn;
3105
3106	pin = 0;
3107	while (pi) {
3108	fdprintf(2, "%*spipe %d res_word=%s followup=%d %s\n", lvl*2, "",
3109	pin, RES[pi->res_word], pi->followup, PIPE[pi->followup]);
3110	prn = 0;
3111	while (prn < pi->num_cmds) {
3112	struct command *command = &pi->cmds[prn];
3113	char **argv = command->argv;
3114
3115	fdprintf(2, "%*s cmd %d assignment_cnt:%d",
3116	lvl*2, "", prn,
3117	command->assignment_cnt);
3118	if (command->group) {
3119	fdprintf(2, " group %s: (argv=%p)%s%s\n",
3120	CMDTYPE[command->cmd_type],
3121	argv
3122	# if !BB_MMU
3123	, " group_as_string:", command->group_as_string
3124	# else
3125	, "", ""
3126	# endif
3127	);
3128	debug_print_tree(command->group, lvl+1);
3129	prn++;
3130	continue;
3131	}
3132	if (argv) while (*argv) {
3133	fdprintf(2, " '%s'", *argv);
3134	argv++;
3135	}
3136	fdprintf(2, "\n");
3137	prn++;
3138	}
3139	pi = pi->next;
3140	pin++;
3141	}
3142	}
3143	#endif /* debug_print_tree */
3144
3145	static struct pipe *new_pipe(void)
3146	{
3147	struct pipe *pi;
3148	pi = xzalloc(sizeof(struct pipe));
3149	/*pi->res_word = RES_NONE; - RES_NONE is 0 anyway */
3150	return pi;
3151	}
3152
3153	/* Command (member of a pipe) is complete, or we start a new pipe
3154	* if ctx->command is NULL.
3155	* No errors possible here.
3156	*/
3157	static int done_command(struct parse_context *ctx)
3158	{
3159	/* The command is really already in the pipe structure, so
3160	* advance the pipe counter and make a new, null command. */
3161	struct pipe *pi = ctx->pipe;
3162	struct command *command = ctx->command;
3163
3164	#if 0 /* Instead we emit error message at run time */
3165	if (ctx->pending_redirect) {
3166	/* For example, "cmd >" (no filename to redirect to) */
3167	die_if_script("syntax error: %s", "invalid redirect");
3168	ctx->pending_redirect = NULL;
3169	}
3170	#endif
3171
3172	if (command) {
3173	if (IS_NULL_CMD(command)) {
3174	debug_printf_parse("done_command: skipping null cmd, num_cmds=%d\n", pi->num_cmds);
3175	goto clear_and_ret;
3176	}
3177	pi->num_cmds++;
3178	debug_printf_parse("done_command: ++num_cmds=%d\n", pi->num_cmds);
3179	//debug_print_tree(ctx->list_head, 20);
3180	} else {
3181	debug_printf_parse("done_command: initializing, num_cmds=%d\n", pi->num_cmds);
3182	}
3183
3184	/* Only real trickiness here is that the uncommitted
3185	* command structure is not counted in pi->num_cmds. */
3186	pi->cmds = xrealloc(pi->cmds, sizeof(*pi->cmds) * (pi->num_cmds+1));
3187	ctx->command = command = &pi->cmds[pi->num_cmds];
3188	clear_and_ret:
3189	memset(command, 0, sizeof(*command));
3190	return pi->num_cmds; /* used only for 0/nonzero check */
3191	}
3192
3193	static void done_pipe(struct parse_context *ctx, pipe_style type)
3194	{
3195	int not_null;
3196
3197	debug_printf_parse("done_pipe entered, followup %d\n", type);
3198	/* Close previous command */
3199	not_null = done_command(ctx);
3200	ctx->pipe->followup = type;
3201	#if HAS_KEYWORDS
3202	ctx->pipe->pi_inverted = ctx->ctx_inverted;
3203	ctx->ctx_inverted = 0;
3204	ctx->pipe->res_word = ctx->ctx_res_w;
3205	#endif
3206
3207	/* Without this check, even just <enter> on command line generates
3208	* tree of three NOPs (!). Which is harmless but annoying.
3209	* IOW: it is safe to do it unconditionally. */
3210	if (not_null
3211	#if ENABLE_HUSH_IF
3212	|| ctx->ctx_res_w == RES_FI
3213	#endif
3214	#if ENABLE_HUSH_LOOPS
3215	|| ctx->ctx_res_w == RES_DONE
3216	|| ctx->ctx_res_w == RES_FOR
3217	|| ctx->ctx_res_w == RES_IN
3218	#endif
3219	#if ENABLE_HUSH_CASE
3220	|| ctx->ctx_res_w == RES_ESAC
3221	#endif
3222	) {
3223	struct pipe *new_p;
3224	debug_printf_parse("done_pipe: adding new pipe: "
3225	"not_null:%d ctx->ctx_res_w:%d\n",
3226	not_null, ctx->ctx_res_w);
3227	new_p = new_pipe();
3228	ctx->pipe->next = new_p;
3229	ctx->pipe = new_p;
3230	/* RES_THEN, RES_DO etc are "sticky" -
3231	* they remain set for pipes inside if/while.
3232	* This is used to control execution.
3233	* RES_FOR and RES_IN are NOT sticky (needed to support
3234	* cases where variable or value happens to match a keyword):
3235	*/
3236	#if ENABLE_HUSH_LOOPS
3237	if (ctx->ctx_res_w == RES_FOR
3238	|| ctx->ctx_res_w == RES_IN)
3239	ctx->ctx_res_w = RES_NONE;
3240	#endif
3241	#if ENABLE_HUSH_CASE
3242	if (ctx->ctx_res_w == RES_MATCH)
3243	ctx->ctx_res_w = RES_CASE_BODY;
3244	if (ctx->ctx_res_w == RES_CASE)
3245	ctx->ctx_res_w = RES_CASE_IN;
3246	#endif
3247	ctx->command = NULL; /* trick done_command below */
3248	/* Create the memory for command, roughly:
3249	* ctx->pipe->cmds = new struct command;
3250	* ctx->command = &ctx->pipe->cmds[0];
3251	*/
3252	done_command(ctx);
3253	//debug_print_tree(ctx->list_head, 10);
3254	}
3255	debug_printf_parse("done_pipe return\n");
3256	}
3257
3258	static void initialize_context(struct parse_context *ctx)
3259	{
3260	memset(ctx, 0, sizeof(*ctx));
3261	ctx->pipe = ctx->list_head = new_pipe();
3262	/* Create the memory for command, roughly:
3263	* ctx->pipe->cmds = new struct command;
3264	* ctx->command = &ctx->pipe->cmds[0];
3265	*/
3266	done_command(ctx);
3267	}
3268
3269	/* If a reserved word is found and processed, parse context is modified
3270	* and 1 is returned.
3271	*/
3272	#if HAS_KEYWORDS
3273	struct reserved_combo {
3274	char literal[6];
3275	unsigned char res;
3276	unsigned char assignment_flag;
3277	int flag;
3278	};
3279	enum {
3280	FLAG_END = (1 << RES_NONE ),
3281	# if ENABLE_HUSH_IF
3282	FLAG_IF = (1 << RES_IF ),
3283	FLAG_THEN = (1 << RES_THEN ),
3284	FLAG_ELIF = (1 << RES_ELIF ),
3285	FLAG_ELSE = (1 << RES_ELSE ),
3286	FLAG_FI = (1 << RES_FI ),
3287	# endif
3288	# if ENABLE_HUSH_LOOPS
3289	FLAG_FOR = (1 << RES_FOR ),
3290	FLAG_WHILE = (1 << RES_WHILE),
3291	FLAG_UNTIL = (1 << RES_UNTIL),
3292	FLAG_DO = (1 << RES_DO ),
3293	FLAG_DONE = (1 << RES_DONE ),
3294	FLAG_IN = (1 << RES_IN ),
3295	# endif
3296	# if ENABLE_HUSH_CASE
3297	FLAG_MATCH = (1 << RES_MATCH),
3298	FLAG_ESAC = (1 << RES_ESAC ),
3299	# endif
3300	FLAG_START = (1 << RES_XXXX ),
3301	};
3302
3303	static const struct reserved_combo* match_reserved_word(o_string *word)
3304	{
3305	/* Mostly a list of accepted follow-up reserved words.
3306	* FLAG_END means we are done with the sequence, and are ready
3307	* to turn the compound list into a command.
3308	* FLAG_START means the word must start a new compound list.
3309	*/
3310	static const struct reserved_combo reserved_list[] = {
3311	# if ENABLE_HUSH_IF
3312	{ "!", RES_NONE, NOT_ASSIGNMENT , 0 },
3313	{ "if", RES_IF, MAYBE_ASSIGNMENT, FLAG_THEN | FLAG_START },
3314	{ "then", RES_THEN, MAYBE_ASSIGNMENT, FLAG_ELIF | FLAG_ELSE | FLAG_FI },
3315	{ "elif", RES_ELIF, MAYBE_ASSIGNMENT, FLAG_THEN },
3316	{ "else", RES_ELSE, MAYBE_ASSIGNMENT, FLAG_FI },
3317	{ "fi", RES_FI, NOT_ASSIGNMENT , FLAG_END },
3318	# endif
3319	# if ENABLE_HUSH_LOOPS
3320	{ "for", RES_FOR, NOT_ASSIGNMENT , FLAG_IN | FLAG_DO | FLAG_START },
3321	{ "while", RES_WHILE, MAYBE_ASSIGNMENT, FLAG_DO | FLAG_START },
3322	{ "until", RES_UNTIL, MAYBE_ASSIGNMENT, FLAG_DO | FLAG_START },
3323	{ "in", RES_IN, NOT_ASSIGNMENT , FLAG_DO },
3324	{ "do", RES_DO, MAYBE_ASSIGNMENT, FLAG_DONE },
3325	{ "done", RES_DONE, NOT_ASSIGNMENT , FLAG_END },
3326	# endif
3327	# if ENABLE_HUSH_CASE
3328	{ "case", RES_CASE, NOT_ASSIGNMENT , FLAG_MATCH | FLAG_START },
3329	{ "esac", RES_ESAC, NOT_ASSIGNMENT , FLAG_END },
3330	# endif
3331	};
3332	const struct reserved_combo *r;
3333
3334	for (r = reserved_list; r < reserved_list + ARRAY_SIZE(reserved_list); r++) {
3335	if (strcmp(word->data, r->literal) == 0)
3336	return r;
3337	}
3338	return NULL;
3339	}
3340	/* Return 0: not a keyword, 1: keyword
3341	*/
3342	static int reserved_word(o_string *word, struct parse_context *ctx)
3343	{
3344	# if ENABLE_HUSH_CASE
3345	static const struct reserved_combo reserved_match = {
3346	"", RES_MATCH, NOT_ASSIGNMENT , FLAG_MATCH | FLAG_ESAC
3347	};
3348	# endif
3349	const struct reserved_combo *r;
3350
3351	if (word->has_quoted_part)
3352	return 0;
3353	r = match_reserved_word(word);
3354	if (!r)
3355	return 0;
3356
3357	debug_printf("found reserved word %s, res %d\n", r->literal, r->res);
3358	# if ENABLE_HUSH_CASE
3359	if (r->res == RES_IN && ctx->ctx_res_w == RES_CASE_IN) {
3360	/* "case word IN ..." - IN part starts first MATCH part */
3361	r = &reserved_match;
3362	} else
3363	# endif
3364	if (r->flag == 0) { /* '!' */
3365	if (ctx->ctx_inverted) { /* bash doesn't accept '! ! true' */
3366	syntax_error("! ! command");
3367	ctx->ctx_res_w = RES_SNTX;
3368	}
3369	ctx->ctx_inverted = 1;
3370	return 1;
3371	}
3372	if (r->flag & FLAG_START) {
3373	struct parse_context *old;
3374
3375	old = xmalloc(sizeof(*old));
3376	debug_printf_parse("push stack %p\n", old);
3377	*old = *ctx; /* physical copy */
3378	initialize_context(ctx);
3379	ctx->stack = old;
3380	} else if (/*ctx->ctx_res_w == RES_NONE ||*/ !(ctx->old_flag & (1 << r->res))) {
3381	syntax_error_at(word->data);
3382	ctx->ctx_res_w = RES_SNTX;
3383	return 1;
3384	} else {
3385	/* "{...} fi" is ok. "{...} if" is not
3386	* Example:
3387	* if { echo foo; } then { echo bar; } fi */
3388	if (ctx->command->group)
3389	done_pipe(ctx, PIPE_SEQ);
3390	}
3391
3392	ctx->ctx_res_w = r->res;
3393	ctx->old_flag = r->flag;
3394	word->o_assignment = r->assignment_flag;
3395	debug_printf_parse("word->o_assignment='%s'\n", assignment_flag[word->o_assignment]);
3396
3397	if (ctx->old_flag & FLAG_END) {
3398	struct parse_context *old;
3399
3400	done_pipe(ctx, PIPE_SEQ);
3401	debug_printf_parse("pop stack %p\n", ctx->stack);
3402	old = ctx->stack;
3403	old->command->group = ctx->list_head;
3404	old->command->cmd_type = CMD_NORMAL;
3405	# if !BB_MMU
3406	/* At this point, the compound command's string is in
3407	* ctx->as_string... except for the leading keyword!
3408	* Consider this example: "echo a | if true; then echo a; fi"
3409	* ctx->as_string will contain "true; then echo a; fi",
3410	* with "if " remaining in old->as_string!
3411	*/
3412	{
3413	char *str;
3414	int len = old->as_string.length;
3415	/* Concatenate halves */
3416	o_addstr(&old->as_string, ctx->as_string.data);
3417	o_free_unsafe(&ctx->as_string);
3418	/* Find where leading keyword starts in first half */
3419	str = old->as_string.data + len;
3420	if (str > old->as_string.data)
3421	str--; /* skip whitespace after keyword */
3422	while (str > old->as_string.data && isalpha(str[-1]))
3423	str--;
3424	/* Ugh, we're done with this horrid hack */
3425	old->command->group_as_string = xstrdup(str);
3426	debug_printf_parse("pop, remembering as:'%s'\n",
3427	old->command->group_as_string);
3428	}
3429	# endif
3430	*ctx = *old; /* physical copy */
3431	free(old);
3432	}
3433	return 1;
3434	}
3435	#endif /* HAS_KEYWORDS */
3436
3437	/* Word is complete, look at it and update parsing context.
3438	* Normal return is 0. Syntax errors return 1.
3439	* Note: on return, word is reset, but not o_free'd!
3440	*/
3441	static int done_word(o_string *word, struct parse_context *ctx)
3442	{
3443	struct command *command = ctx->command;
3444
3445	debug_printf_parse("done_word entered: '%s' %p\n", word->data, command);
3446	if (word->length == 0 && !word->has_quoted_part) {
3447	debug_printf_parse("done_word return 0: true null, ignored\n");
3448	return 0;
3449	}
3450
3451	if (ctx->pending_redirect) {
3452	/* We do not glob in e.g. >*.tmp case. bash seems to glob here
3453	* only if run as "bash", not "sh" */
3454	/* http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
3455	* "2.7 Redirection
3456	* ...the word that follows the redirection operator
3457	* shall be subjected to tilde expansion, parameter expansion,
3458	* command substitution, arithmetic expansion, and quote
3459	* removal. Pathname expansion shall not be performed
3460	* on the word by a non-interactive shell; an interactive
3461	* shell may perform it, but shall do so only when
3462	* the expansion would result in one word."
3463	*/
3464	ctx->pending_redirect->rd_filename = xstrdup(word->data);
3465	/* Cater for >\file case:
3466	* >\a creates file a; >\\a, >"\a", >"\\a" create file \a
3467	* Same with heredocs:
3468	* for <<\H delim is H; <<\\H, <<"\H", <<"\\H" - \H
3469	*/
3470	if (ctx->pending_redirect->rd_type == REDIRECT_HEREDOC) {
3471	unbackslash(ctx->pending_redirect->rd_filename);
3472	/* Is it <<"HEREDOC"? */
3473	if (word->has_quoted_part) {
3474	ctx->pending_redirect->rd_dup |= HEREDOC_QUOTED;
3475	}
3476	}
3477	debug_printf_parse("word stored in rd_filename: '%s'\n", word->data);
3478	ctx->pending_redirect = NULL;
3479	} else {
3480	#if HAS_KEYWORDS
3481	# if ENABLE_HUSH_CASE
3482	if (ctx->ctx_dsemicolon
3483	&& strcmp(word->data, "esac") != 0 /* not "... pattern) cmd;; esac" */
3484	) {
3485	/* already done when ctx_dsemicolon was set to 1: */
3486	/* ctx->ctx_res_w = RES_MATCH; */
3487	ctx->ctx_dsemicolon = 0;
3488	} else
3489	# endif
3490	if (!command->argv /* if it's the first word... */
3491	# if ENABLE_HUSH_LOOPS
3492	&& ctx->ctx_res_w != RES_FOR /* ...not after FOR or IN */
3493	&& ctx->ctx_res_w != RES_IN
3494	# endif
3495	# if ENABLE_HUSH_CASE
3496	&& ctx->ctx_res_w != RES_CASE
3497	# endif
3498	) {
3499	int reserved = reserved_word(word, ctx);
3500	debug_printf_parse("checking for reserved-ness: %d\n", reserved);
3501	if (reserved) {
3502	o_reset_to_empty_unquoted(word);
3503	debug_printf_parse("done_word return %d\n",
3504	(ctx->ctx_res_w == RES_SNTX));
3505	return (ctx->ctx_res_w == RES_SNTX);
3506	}
3507	# if ENABLE_HUSH_BASH_COMPAT
3508	if (strcmp(word->data, "[[") == 0) {
3509	command->cmd_type = CMD_SINGLEWORD_NOGLOB;
3510	}
3511	/* fall through */
3512	# endif
3513	}
3514	#endif
3515	if (command->group) {
3516	/* "{ echo foo; } echo bar" - bad */
3517	syntax_error_at(word->data);
3518	debug_printf_parse("done_word return 1: syntax error, "
3519	"groups and arglists don't mix\n");
3520	return 1;
3521	}
3522
3523	/* If this word wasn't an assignment, next ones definitely
3524	* can't be assignments. Even if they look like ones. */
3525	if (word->o_assignment != DEFINITELY_ASSIGNMENT
3526	&& word->o_assignment != WORD_IS_KEYWORD
3527	) {
3528	word->o_assignment = NOT_ASSIGNMENT;
3529	} else {
3530	if (word->o_assignment == DEFINITELY_ASSIGNMENT) {
3531	command->assignment_cnt++;
3532	debug_printf_parse("++assignment_cnt=%d\n", command->assignment_cnt);
3533	}
3534	debug_printf_parse("word->o_assignment was:'%s'\n", assignment_flag[word->o_assignment]);
3535	word->o_assignment = MAYBE_ASSIGNMENT;
3536	}
3537	debug_printf_parse("word->o_assignment='%s'\n", assignment_flag[word->o_assignment]);
3538
3539	if (word->has_quoted_part
3540	/* optimization: and if it's ("" or '') or ($v... or `cmd`...): */
3541	&& (word->data[0] == '\0' || word->data[0] == SPECIAL_VAR_SYMBOL)
3542	/* (otherwise it's known to be not empty and is already safe) */
3543	) {
3544	/* exclude "$@" - it can expand to no word despite "" */
3545	char *p = word->data;
3546	while (p[0] == SPECIAL_VAR_SYMBOL
3547	&& (p[1] & 0x7f) == '@'
3548	&& p[2] == SPECIAL_VAR_SYMBOL
3549	) {
3550	p += 3;
3551	}
3552	}
3553	command->argv = add_string_to_strings(command->argv, xstrdup(word->data));
3554	debug_print_strings("word appended to argv", command->argv);
3555	}
3556
3557	#if ENABLE_HUSH_LOOPS
3558	if (ctx->ctx_res_w == RES_FOR) {
3559	if (word->has_quoted_part
3560	|| !is_well_formed_var_name(command->argv[0], '\0')
3561	) {
3562	/* bash says just "not a valid identifier" */
3563	syntax_error("not a valid identifier in for");
3564	return 1;
3565	}
3566	/* Force FOR to have just one word (variable name) */
3567	/* NB: basically, this makes hush see "for v in ..."
3568	* syntax as if it is "for v; in ...". FOR and IN become
3569	* two pipe structs in parse tree. */
3570	done_pipe(ctx, PIPE_SEQ);
3571	}
3572	#endif
3573	#if ENABLE_HUSH_CASE
3574	/* Force CASE to have just one word */
3575	if (ctx->ctx_res_w == RES_CASE) {
3576	done_pipe(ctx, PIPE_SEQ);
3577	}
3578	#endif
3579
3580	o_reset_to_empty_unquoted(word);
3581
3582	debug_printf_parse("done_word return 0\n");
3583	return 0;
3584	}
3585
3586
3587	/* Peek ahead in the input to find out if we have a "&n" construct,
3588	* as in "2>&1", that represents duplicating a file descriptor.
3589	* Return:
3590	* REDIRFD_CLOSE if >&- "close fd" construct is seen,
3591	* REDIRFD_SYNTAX_ERR if syntax error,
3592	* REDIRFD_TO_FILE if no & was seen,
3593	* or the number found.
3594	*/
3595	#if BB_MMU
3596	#define parse_redir_right_fd(as_string, input) \
3597	parse_redir_right_fd(input)
3598	#endif
3599	static int parse_redir_right_fd(o_string *as_string, struct in_str *input)
3600	{
3601	int ch, d, ok;
3602
3603	ch = i_peek(input);
3604	if (ch != '&')
3605	return REDIRFD_TO_FILE;
3606
3607	ch = i_getch(input); /* get the & */
3608	nommu_addchr(as_string, ch);
3609	ch = i_peek(input);
3610	if (ch == '-') {
3611	ch = i_getch(input);
3612	nommu_addchr(as_string, ch);
3613	return REDIRFD_CLOSE;
3614	}
3615	d = 0;
3616	ok = 0;
3617	while (ch != EOF && isdigit(ch)) {
3618	d = d*10 + (ch-'0');
3619	ok = 1;
3620	ch = i_getch(input);
3621	nommu_addchr(as_string, ch);
3622	ch = i_peek(input);
3623	}
3624	if (ok) return d;
3625
3626	//TODO: this is the place to catch ">&file" bashism (redirect both fd 1 and 2)
3627
3628	bb_error_msg("ambiguous redirect");
3629	return REDIRFD_SYNTAX_ERR;
3630	}
3631
3632	/* Return code is 0 normal, 1 if a syntax error is detected
3633	*/
3634	static int parse_redirect(struct parse_context *ctx,
3635	int fd,
3636	redir_type style,
3637	struct in_str *input)
3638	{
3639	struct command *command = ctx->command;
3640	struct redir_struct *redir;
3641	struct redir_struct **redirp;
3642	int dup_num;
3643
3644	dup_num = REDIRFD_TO_FILE;
3645	if (style != REDIRECT_HEREDOC) {
3646	/* Check for a '>&1' type redirect */
3647	dup_num = parse_redir_right_fd(&ctx->as_string, input);
3648	if (dup_num == REDIRFD_SYNTAX_ERR)
3649	return 1;
3650	} else {
3651	int ch = i_peek(input);
3652	dup_num = (ch == '-'); /* HEREDOC_SKIPTABS bit is 1 */
3653	if (dup_num) { /* <<-... */
3654	ch = i_getch(input);
3655	nommu_addchr(&ctx->as_string, ch);
3656	ch = i_peek(input);
3657	}
3658	}
3659
3660	if (style == REDIRECT_OVERWRITE && dup_num == REDIRFD_TO_FILE) {
3661	int ch = i_peek(input);
3662	if (ch == '|') {
3663	/* >|FILE redirect ("clobbering" >).
3664	* Since we do not support "set -o noclobber" yet,
3665	* >| and > are the same for now. Just eat |.
3666	*/
3667	ch = i_getch(input);
3668	nommu_addchr(&ctx->as_string, ch);
3669	}
3670	}
3671
3672	/* Create a new redir_struct and append it to the linked list */
3673	redirp = &command->redirects;
3674	while ((redir = *redirp) != NULL) {
3675	redirp = &(redir->next);
3676	}
3677	*redirp = redir = xzalloc(sizeof(*redir));
3678	/* redir->next = NULL; */
3679	/* redir->rd_filename = NULL; */
3680	redir->rd_type = style;
3681	redir->rd_fd = (fd == -1) ? redir_table[style].default_fd : fd;
3682
3683	debug_printf_parse("redirect type %d %s\n", redir->rd_fd,
3684	redir_table[style].descrip);
3685
3686	redir->rd_dup = dup_num;
3687	if (style != REDIRECT_HEREDOC && dup_num != REDIRFD_TO_FILE) {
3688	/* Erik had a check here that the file descriptor in question
3689	* is legit; I postpone that to "run time"
3690	* A "-" representation of "close me" shows up as a -3 here */
3691	debug_printf_parse("duplicating redirect '%d>&%d'\n",
3692	redir->rd_fd, redir->rd_dup);
3693	} else {
3694	#if 0 /* Instead we emit error message at run time */
3695	if (ctx->pending_redirect) {
3696	/* For example, "cmd > <file" */
3697	die_if_script("syntax error: %s", "invalid redirect");
3698	}
3699	#endif
3700	/* Set ctx->pending_redirect, so we know what to do at the
3701	* end of the next parsed word. */
3702	ctx->pending_redirect = redir;
3703	}
3704	return 0;
3705	}
3706
3707	/* If a redirect is immediately preceded by a number, that number is
3708	* supposed to tell which file descriptor to redirect. This routine
3709	* looks for such preceding numbers. In an ideal world this routine
3710	* needs to handle all the following classes of redirects...
3711	* echo 2>foo # redirects fd 2 to file "foo", nothing passed to echo
3712	* echo 49>foo # redirects fd 49 to file "foo", nothing passed to echo
3713	* echo -2>foo # redirects fd 1 to file "foo", "-2" passed to echo
3714	* echo 49x>foo # redirects fd 1 to file "foo", "49x" passed to echo
3715	*
3716	* http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
3717	* "2.7 Redirection
3718	* ... If n is quoted, the number shall not be recognized as part of
3719	* the redirection expression. For example:
3720	* echo \2>a
3721	* writes the character 2 into file a"
3722	* We are getting it right by setting ->has_quoted_part on any \<char>
3723	*
3724	* A -1 return means no valid number was found,
3725	* the caller should use the appropriate default for this redirection.
3726	*/
3727	static int redirect_opt_num(o_string *o)
3728	{
3729	int num;
3730
3731	if (o->data == NULL)
3732	return -1;
3733	num = bb_strtou(o->data, NULL, 10);
3734	if (errno || num < 0)
3735	return -1;
3736	o_reset_to_empty_unquoted(o);
3737	return num;
3738	}
3739
3740	#if BB_MMU
3741	#define fetch_till_str(as_string, input, word, skip_tabs) \
3742	fetch_till_str(input, word, skip_tabs)
3743	#endif
3744	static char *fetch_till_str(o_string *as_string,
3745	struct in_str *input,
3746	const char *word,
3747	int heredoc_flags)
3748	{
3749	o_string heredoc = NULL_O_STRING;
3750	unsigned past_EOL;
3751	int prev = 0; /* not \ */
3752	int ch;
3753
3754	goto jump_in;
3755
3756	while (1) {
3757	ch = i_getch(input);
3758	if (ch != EOF)
3759	nommu_addchr(as_string, ch);
3760	if ((ch == '\n' || ch == EOF)
3761	&& ((heredoc_flags & HEREDOC_QUOTED) || prev != '\\')
3762	) {
3763	if (strcmp(heredoc.data + past_EOL, word) == 0) {
3764	heredoc.data[past_EOL] = '\0';
3765	debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
3766	return heredoc.data;
3767	}
3768	while (ch == '\n') {
3769	o_addchr(&heredoc, ch);
3770	prev = ch;
3771	jump_in:
3772	past_EOL = heredoc.length;
3773	do {
3774	ch = i_getch(input);
3775	if (ch != EOF)
3776	nommu_addchr(as_string, ch);
3777	} while ((heredoc_flags & HEREDOC_SKIPTABS) && ch == '\t');
3778	}
3779	}
3780	if (ch == EOF) {
3781	o_free_unsafe(&heredoc);
3782	return NULL;
3783	}
3784	o_addchr(&heredoc, ch);
3785	nommu_addchr(as_string, ch);
3786	if (prev == '\\' && ch == '\\')
3787	/* Correctly handle foo\\<eol> (not a line cont.) */
3788	prev = 0; /* not \ */
3789	else
3790	prev = ch;
3791	}
3792	}
3793
3794	/* Look at entire parse tree for not-yet-loaded REDIRECT_HEREDOCs
3795	* and load them all. There should be exactly heredoc_cnt of them.
3796	*/
3797	static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_str *input)
3798	{
3799	struct pipe *pi = ctx->list_head;
3800
3801	while (pi && heredoc_cnt) {
3802	int i;
3803	struct command *cmd = pi->cmds;
3804
3805	debug_printf_parse("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
3806	pi->num_cmds,
3807	cmd->argv ? cmd->argv[0] : "NONE");
3808	for (i = 0; i < pi->num_cmds; i++) {
3809	struct redir_struct *redir = cmd->redirects;
3810
3811	debug_printf_parse("fetch_heredocs: %d cmd argv0:'%s'\n",
3812	i, cmd->argv ? cmd->argv[0] : "NONE");
3813	while (redir) {
3814	if (redir->rd_type == REDIRECT_HEREDOC) {
3815	char *p;
3816
3817	redir->rd_type = REDIRECT_HEREDOC2;
3818	/* redir->rd_dup is (ab)used to indicate <<- */
3819	p = fetch_till_str(&ctx->as_string, input,
3820	redir->rd_filename, redir->rd_dup);
3821	if (!p) {
3822	syntax_error("unexpected EOF in here document");
3823	return 1;
3824	}
3825	free(redir->rd_filename);
3826	redir->rd_filename = p;
3827	heredoc_cnt--;
3828	}
3829	redir = redir->next;
3830	}
3831	cmd++;
3832	}
3833	pi = pi->next;
3834	}
3835	#if 0
3836	/* Should be 0. If it isn't, it's a parse error */
3837	if (heredoc_cnt)
3838	bb_error_msg_and_die("heredoc BUG 2");
3839	#endif
3840	return 0;
3841	}
3842
3843
3844	static int run_list(struct pipe *pi);
3845	#if BB_MMU
3846	#define parse_stream(pstring, input, end_trigger) \
3847	parse_stream(input, end_trigger)
3848	#endif
3849	static struct pipe *parse_stream(char **pstring,
3850	struct in_str *input,
3851	int end_trigger);
3852
3853
3854	#if !ENABLE_HUSH_FUNCTIONS
3855	#define parse_group(dest, ctx, input, ch) \
3856	parse_group(ctx, input, ch)
3857	#endif
3858	static int parse_group(o_string *dest, struct parse_context *ctx,
3859	struct in_str *input, int ch)
3860	{
3861	/* dest contains characters seen prior to ( or {.
3862	* Typically it's empty, but for function defs,
3863	* it contains function name (without '()'). */
3864	struct pipe *pipe_list;
3865	int endch;
3866	struct command *command = ctx->command;
3867
3868	debug_printf_parse("parse_group entered\n");
3869	#if ENABLE_HUSH_FUNCTIONS
3870	if (ch == '(' && !dest->has_quoted_part) {
3871	if (dest->length)
3872	if (done_word(dest, ctx))
3873	return 1;
3874	if (!command->argv)
3875	goto skip; /* (... */
3876	if (command->argv[1]) { /* word word ... (... */
3877	syntax_error_unexpected_ch('(');
3878	return 1;
3879	}
3880	/* it is "word(..." or "word (..." */
3881	do
3882	ch = i_getch(input);
3883	while (ch == ' ' || ch == '\t');
3884	if (ch != ')') {
3885	syntax_error_unexpected_ch(ch);
3886	return 1;
3887	}
3888	nommu_addchr(&ctx->as_string, ch);
3889	do
3890	ch = i_getch(input);
3891	while (ch == ' ' || ch == '\t' || ch == '\n');
3892	if (ch != '{') {
3893	syntax_error_unexpected_ch(ch);
3894	return 1;
3895	}
3896	nommu_addchr(&ctx->as_string, ch);
3897	command->cmd_type = CMD_FUNCDEF;
3898	goto skip;
3899	}
3900	#endif
3901
3902	#if 0 /* Prevented by caller */
3903	if (command->argv /* word [word]{... */
3904	|| dest->length /* word{... */
3905	|| dest->has_quoted_part /* ""{... */
3906	) {
3907	syntax_error(NULL);
3908	debug_printf_parse("parse_group return 1: "
3909	"syntax error, groups and arglists don't mix\n");
3910	return 1;
3911	}
3912	#endif
3913
3914	#if ENABLE_HUSH_FUNCTIONS
3915	skip:
3916	#endif
3917	endch = '}';
3918	if (ch == '(') {
3919	endch = ')';
3920	command->cmd_type = CMD_SUBSHELL;
3921	} else {
3922	/* bash does not allow "{echo...", requires whitespace */
3923	ch = i_peek(input);
3924	if (ch != ' ' && ch != '\t' && ch != '\n'
3925	&& ch != '(' /* but "{(..." is allowed (without whitespace) */
3926	) {
3927	syntax_error_unexpected_ch(ch);
3928	return 1;
3929	}
3930	if (ch != '(') {
3931	ch = i_getch(input);
3932	nommu_addchr(&ctx->as_string, ch);
3933	}
3934	}
3935
3936	{
3937	#if BB_MMU
3938	# define as_string NULL
3939	#else
3940	char *as_string = NULL;
3941	#endif
3942	pipe_list = parse_stream(&as_string, input, endch);
3943	#if !BB_MMU
3944	if (as_string)
3945	o_addstr(&ctx->as_string, as_string);
3946	#endif
3947	/* empty ()/{} or parse error? */
3948	if (!pipe_list || pipe_list == ERR_PTR) {
3949	/* parse_stream already emitted error msg */
3950	if (!BB_MMU)
3951	free(as_string);
3952	debug_printf_parse("parse_group return 1: "
3953	"parse_stream returned %p\n", pipe_list);
3954	return 1;
3955	}
3956	command->group = pipe_list;
3957	#if !BB_MMU
3958	as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
3959	command->group_as_string = as_string;
3960	debug_printf_parse("end of group, remembering as:'%s'\n",
3961	command->group_as_string);
3962	#endif
3963	#undef as_string
3964	}
3965	debug_printf_parse("parse_group return 0\n");
3966	return 0;
3967	/* command remains "open", available for possible redirects */
3968	}
3969
3970	static int i_getch_and_eat_bkslash_nl(struct in_str *input)
3971	{
3972	for (;;) {
3973	int ch, ch2;
3974
3975	ch = i_getch(input);
3976	if (ch != '\\')
3977	return ch;
3978	ch2 = i_peek(input);
3979	if (ch2 != '\n')
3980	return ch;
3981	/* backslash+newline, skip it */
3982	i_getch(input);
3983	}
3984	}
3985
3986	static int i_peek_and_eat_bkslash_nl(struct in_str *input)
3987	{
3988	for (;;) {
3989	int ch, ch2;
3990
3991	ch = i_peek(input);
3992	if (ch != '\\')
3993	return ch;
3994	ch2 = i_peek2(input);
3995	if (ch2 != '\n')
3996	return ch;
3997	/* backslash+newline, skip it */
3998	i_getch(input);
3999	i_getch(input);
4000	}
4001	}
4002
4003	#if ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS
4004	/* Subroutines for copying $(...) and `...` things */
4005	static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote);
4006	/* '...' */
4007	static int add_till_single_quote(o_string *dest, struct in_str *input)
4008	{
4009	while (1) {
4010	int ch = i_getch(input);
4011	if (ch == EOF) {
4012	syntax_error_unterm_ch('\'');
4013	return 0;
4014	}
4015	if (ch == '\'')
4016	return 1;
4017	o_addchr(dest, ch);
4018	}
4019	}
4020	/* "...\"...`..`...." - do we need to handle "...$(..)..." too? */
4021	static int add_till_double_quote(o_string *dest, struct in_str *input)
4022	{
4023	while (1) {
4024	int ch = i_getch(input);
4025	if (ch == EOF) {
4026	syntax_error_unterm_ch('"');
4027	return 0;
4028	}
4029	if (ch == '"')
4030	return 1;
4031	if (ch == '\\') { /* \x. Copy both chars. */
4032	o_addchr(dest, ch);
4033	ch = i_getch(input);
4034	}
4035	o_addchr(dest, ch);
4036	if (ch == '`') {
4037	if (!add_till_backquote(dest, input, /*in_dquote:*/ 1))
4038	return 0;
4039	o_addchr(dest, ch);
4040	continue;
4041	}
4042	//if (ch == '$') ...
4043	}
4044	}
4045	/* Process `cmd` - copy contents until "`" is seen. Complicated by
4046	* \` quoting.
4047	* "Within the backquoted style of command substitution, backslash
4048	* shall retain its literal meaning, except when followed by: '$', '`', or '\'.
4049	* The search for the matching backquote shall be satisfied by the first
4050	* backquote found without a preceding backslash; during this search,
4051	* if a non-escaped backquote is encountered within a shell comment,
4052	* a here-document, an embedded command substitution of the $(command)
4053	* form, or a quoted string, undefined results occur. A single-quoted
4054	* or double-quoted string that begins, but does not end, within the
4055	* "`...`" sequence produces undefined results."
4056	* Example Output
4057	* echo `echo '\'TEST\`echo ZZ\`BEST` \TESTZZBEST
4058	*/
4059	static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote)
4060	{
4061	while (1) {
4062	int ch = i_getch(input);
4063	if (ch == '`')
4064	return 1;
4065	if (ch == '\\') {
4066	/* \x. Copy both unless it is \`, \$, \\ and maybe \" */
4067	ch = i_getch(input);
4068	if (ch != '`'
4069	&& ch != '$'
4070	&& ch != '\\'
4071	&& (!in_dquote || ch != '"')
4072	) {
4073	o_addchr(dest, '\\');
4074	}
4075	}
4076	if (ch == EOF) {
4077	syntax_error_unterm_ch('`');
4078	return 0;
4079	}
4080	o_addchr(dest, ch);
4081	}
4082	}
4083	/* Process $(cmd) - copy contents until ")" is seen. Complicated by
4084	* quoting and nested ()s.
4085	* "With the $(command) style of command substitution, all characters
4086	* following the open parenthesis to the matching closing parenthesis
4087	* constitute the command. Any valid shell script can be used for command,
4088	* except a script consisting solely of redirections which produces
4089	* unspecified results."
4090	* Example Output
4091	* echo $(echo '(TEST)' BEST) (TEST) BEST
4092	* echo $(echo 'TEST)' BEST) TEST) BEST
4093	* echo $(echo \(\(TEST\) BEST) ((TEST) BEST
4094	*
4095	* Also adapted to eat ${var%...} and $((...)) constructs, since ... part
4096	* can contain arbitrary constructs, just like $(cmd).
4097	* In bash compat mode, it needs to also be able to stop on ':' or '/'
4098	* for ${var:N[:M]} and ${var/P[/R]} parsing.
4099	*/
4100	#define DOUBLE_CLOSE_CHAR_FLAG 0x80
4101	static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsigned end_ch)
4102	{
4103	int ch;
4104	char dbl = end_ch & DOUBLE_CLOSE_CHAR_FLAG;
4105	# if ENABLE_HUSH_BASH_COMPAT
4106	char end_char2 = end_ch >> 8;
4107	# endif
4108	end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
4109
4110	while (1) {
4111	ch = i_getch(input);
4112	if (ch == EOF) {
4113	syntax_error_unterm_ch(end_ch);
4114	return 0;
4115	}
4116	if (ch == end_ch IF_HUSH_BASH_COMPAT( || ch == end_char2)) {
4117	if (!dbl)
4118	break;
4119	/* we look for closing )) of $((EXPR)) */
4120	if (i_peek_and_eat_bkslash_nl(input) == end_ch) {
4121	i_getch(input); /* eat second ')' */
4122	break;
4123	}
4124	}
4125	o_addchr(dest, ch);
4126	if (ch == '(' || ch == '{') {
4127	ch = (ch == '(' ? ')' : '}');
4128	if (!add_till_closing_bracket(dest, input, ch))
4129	return 0;
4130	o_addchr(dest, ch);
4131	continue;
4132	}
4133	if (ch == '\'') {
4134	if (!add_till_single_quote(dest, input))
4135	return 0;
4136	o_addchr(dest, ch);
4137	continue;
4138	}
4139	if (ch == '"') {
4140	if (!add_till_double_quote(dest, input))
4141	return 0;
4142	o_addchr(dest, ch);
4143	continue;
4144	}
4145	if (ch == '`') {
4146	if (!add_till_backquote(dest, input, /*in_dquote:*/ 0))
4147	return 0;
4148	o_addchr(dest, ch);
4149	continue;
4150	}
4151	if (ch == '\\') {
4152	/* \x. Copy verbatim. Important for \(, \) */
4153	ch = i_getch(input);
4154	if (ch == EOF) {
4155	syntax_error_unterm_ch(')');
4156	return 0;
4157	}
4158	#if 0
4159	if (ch == '\n') {
4160	/* "backslash+newline", ignore both */
4161	o_delchr(dest); /* undo insertion of '\' */
4162	continue;
4163	}
4164	#endif
4165	o_addchr(dest, ch);
4166	continue;
4167	}
4168	}
4169	return ch;
4170	}
4171	#endif /* ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS */
4172
4173	/* Return code: 0 for OK, 1 for syntax error */
4174	#if BB_MMU
4175	#define parse_dollar(as_string, dest, input, quote_mask) \
4176	parse_dollar(dest, input, quote_mask)
4177	#define as_string NULL
4178	#endif
4179	static int parse_dollar(o_string *as_string,
4180	o_string *dest,
4181	struct in_str *input, unsigned char quote_mask)
4182	{
4183	int ch = i_peek_and_eat_bkslash_nl(input); /* first character after the $ */
4184
4185	debug_printf_parse("parse_dollar entered: ch='%c'\n", ch);
4186	if (isalpha(ch)) {
4187	ch = i_getch(input);
4188	nommu_addchr(as_string, ch);
4189	make_var:
4190	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4191	while (1) {
4192	debug_printf_parse(": '%c'\n", ch);
4193	o_addchr(dest, ch | quote_mask);
4194	quote_mask = 0;
4195	ch = i_peek_and_eat_bkslash_nl(input);
4196	if (!isalnum(ch) && ch != '_') {
4197	/* End of variable name reached */
4198	break;
4199	}
4200	ch = i_getch(input);
4201	nommu_addchr(as_string, ch);
4202	}
4203	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4204	} else if (isdigit(ch)) {
4205	make_one_char_var:
4206	ch = i_getch(input);
4207	nommu_addchr(as_string, ch);
4208	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4209	debug_printf_parse(": '%c'\n", ch);
4210	o_addchr(dest, ch | quote_mask);
4211	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4212	} else switch (ch) {
4213	case '$': /* pid */
4214	case '!': /* last bg pid */
4215	case '?': /* last exit code */
4216	case '#': /* number of args */
4217	case '*': /* args */
4218	case '@': /* args */
4219	goto make_one_char_var;
4220	case '{': {
4221	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4222
4223	ch = i_getch(input); /* eat '{' */
4224	nommu_addchr(as_string, ch);
4225
4226	ch = i_getch_and_eat_bkslash_nl(input); /* first char after '{' */
4227	/* It should be ${?}, or ${#var},
4228	* or even ${?+subst} - operator acting on a special variable,
4229	* or the beginning of variable name.
4230	*/
4231	if (ch == EOF
4232	|| (!strchr(_SPECIAL_VARS_STR, ch) && !isalnum(ch)) /* not one of those */
4233	) {
4234	bad_dollar_syntax:
4235	syntax_error_unterm_str("${name}");
4236	debug_printf_parse("parse_dollar return 0: unterminated ${name}\n");
4237	return 0;
4238	}
4239	nommu_addchr(as_string, ch);
4240	ch |= quote_mask;
4241
4242	/* It's possible to just call add_till_closing_bracket() at this point.
4243	* However, this regresses some of our testsuite cases
4244	* which check invalid constructs like ${%}.
4245	* Oh well... let's check that the var name part is fine... */
4246
4247	while (1) {
4248	unsigned pos;
4249
4250	o_addchr(dest, ch);
4251	debug_printf_parse(": '%c'\n", ch);
4252
4253	ch = i_getch(input);
4254	nommu_addchr(as_string, ch);
4255	if (ch == '}')
4256	break;
4257
4258	if (!isalnum(ch) && ch != '_') {
4259	unsigned end_ch;
4260	unsigned char last_ch;
4261	/* handle parameter expansions
4262	* http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_06_02
4263	*/
4264	if (!strchr(VAR_SUBST_OPS, ch)) /* ${var<bad_char>... */
4265	goto bad_dollar_syntax;
4266
4267	/* Eat everything until closing '}' (or ':') */
4268	end_ch = '}';
4269	if (ENABLE_HUSH_BASH_COMPAT
4270	&& ch == ':'
4271	&& !strchr(MINUS_PLUS_EQUAL_QUESTION, i_peek(input))
4272	) {
4273	/* It's ${var:N[:M]} thing */
4274	end_ch = '}' * 0x100 + ':';
4275	}
4276	if (ENABLE_HUSH_BASH_COMPAT
4277	&& ch == '/'
4278	) {
4279	/* It's ${var/[/]pattern[/repl]} thing */
4280	if (i_peek(input) == '/') { /* ${var//pattern[/repl]}? */
4281	i_getch(input);
4282	nommu_addchr(as_string, '/');
4283	ch = '\\';
4284	}
4285	end_ch = '}' * 0x100 + '/';
4286	}
4287	o_addchr(dest, ch);
4288	again:
4289	if (!BB_MMU)
4290	pos = dest->length;
4291	#if ENABLE_HUSH_DOLLAR_OPS
4292	last_ch = add_till_closing_bracket(dest, input, end_ch);
4293	if (last_ch == 0) /* error? */
4294	return 0;
4295	#else
4296	#error Simple code to only allow ${var} is not implemented
4297	#endif
4298	if (as_string) {
4299	o_addstr(as_string, dest->data + pos);
4300	o_addchr(as_string, last_ch);
4301	}
4302
4303	if (ENABLE_HUSH_BASH_COMPAT && (end_ch & 0xff00)) {
4304	/* close the first block: */
4305	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4306	/* while parsing N from ${var:N[:M]}
4307	* or pattern from ${var/[/]pattern[/repl]} */
4308	if ((end_ch & 0xff) == last_ch) {
4309	/* got ':' or '/'- parse the rest */
4310	end_ch = '}';
4311	goto again;
4312	}
4313	/* got '}' */
4314	if (end_ch == '}' * 0x100 + ':') {
4315	/* it's ${var:N} - emulate :999999999 */
4316	o_addstr(dest, "999999999");
4317	} /* else: it's ${var/[/]pattern} */
4318	}
4319	break;
4320	}
4321	}
4322	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4323	break;
4324	}
4325	#if ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_TICK
4326	case '(': {
4327	unsigned pos;
4328
4329	ch = i_getch(input);
4330	nommu_addchr(as_string, ch);
4331	# if ENABLE_FEATURE_SH_MATH
4332	if (i_peek_and_eat_bkslash_nl(input) == '(') {
4333	ch = i_getch(input);
4334	nommu_addchr(as_string, ch);
4335	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4336	o_addchr(dest, /*quote_mask |*/ '+');
4337	if (!BB_MMU)
4338	pos = dest->length;
4339	if (!add_till_closing_bracket(dest, input, ')' | DOUBLE_CLOSE_CHAR_FLAG))
4340	return 0; /* error */
4341	if (as_string) {
4342	o_addstr(as_string, dest->data + pos);
4343	o_addchr(as_string, ')');
4344	o_addchr(as_string, ')');
4345	}
4346	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4347	break;
4348	}
4349	# endif
4350	# if ENABLE_HUSH_TICK
4351	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4352	o_addchr(dest, quote_mask | '`');
4353	if (!BB_MMU)
4354	pos = dest->length;
4355	if (!add_till_closing_bracket(dest, input, ')'))
4356	return 0; /* error */
4357	if (as_string) {
4358	o_addstr(as_string, dest->data + pos);
4359	o_addchr(as_string, ')');
4360	}
4361	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4362	# endif
4363	break;
4364	}
4365	#endif
4366	case '_':
4367	ch = i_getch(input);
4368	nommu_addchr(as_string, ch);
4369	ch = i_peek_and_eat_bkslash_nl(input);
4370	if (isalnum(ch)) { /* it's $_name or $_123 */
4371	ch = '_';
4372	goto make_var;
4373	}
4374	/* else: it's $_ */
4375	/* TODO: $_ and $-: */
4376	/* $_ Shell or shell script name; or last argument of last command
4377	* (if last command wasn't a pipe; if it was, bash sets $_ to "");
4378	* but in command's env, set to full pathname used to invoke it */
4379	/* $- Option flags set by set builtin or shell options (-i etc) */
4380	default:
4381	o_addQchr(dest, '$');
4382	}
4383	debug_printf_parse("parse_dollar return 1 (ok)\n");
4384	return 1;
4385	#undef as_string
4386	}
4387
4388	#if BB_MMU
4389	# if ENABLE_HUSH_BASH_COMPAT
4390	#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
4391	encode_string(dest, input, dquote_end, process_bkslash)
4392	# else
4393	/* only ${var/pattern/repl} (its pattern part) needs additional mode */
4394	#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
4395	encode_string(dest, input, dquote_end)
4396	# endif
4397	#define as_string NULL
4398
4399	#else /* !MMU */
4400
4401	# if ENABLE_HUSH_BASH_COMPAT
4402	/* all parameters are needed, no macro tricks */
4403	# else
4404	#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
4405	encode_string(as_string, dest, input, dquote_end)
4406	# endif
4407	#endif
4408	static int encode_string(o_string *as_string,
4409	o_string *dest,
4410	struct in_str *input,
4411	int dquote_end,
4412	int process_bkslash)
4413	{
4414	#if !ENABLE_HUSH_BASH_COMPAT
4415	const int process_bkslash = 1;
4416	#endif
4417	int ch;
4418	int next;
4419
4420	again:
4421	ch = i_getch(input);
4422	if (ch != EOF)
4423	nommu_addchr(as_string, ch);
4424	if (ch == dquote_end) { /* may be only '"' or EOF */
4425	debug_printf_parse("encode_string return 1 (ok)\n");
4426	return 1;
4427	}
4428	/* note: can't move it above ch == dquote_end check! */
4429	if (ch == EOF) {
4430	syntax_error_unterm_ch('"');
4431	return 0; /* error */
4432	}
4433	next = '\0';
4434	if (ch != '\n') {
4435	next = i_peek(input);
4436	}
4437	debug_printf_parse("\" ch=%c (%d) escape=%d\n",
4438	ch, ch, !!(dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
4439	if (process_bkslash && ch == '\\') {
4440	if (next == EOF) {
4441	syntax_error("\\<eof>");
4442	xfunc_die();
4443	}
4444	/* bash:
4445	* "The backslash retains its special meaning [in "..."]
4446	* only when followed by one of the following characters:
4447	* $, `, ", \, or <newline>. A double quote may be quoted
4448	* within double quotes by preceding it with a backslash."
4449	* NB: in (unquoted) heredoc, above does not apply to ",
4450	* therefore we check for it by "next == dquote_end" cond.
4451	*/
4452	if (next == dquote_end || strchr("$`\\\n", next)) {
4453	ch = i_getch(input); /* eat next */
4454	if (ch == '\n')
4455	goto again; /* skip \<newline> */
4456	} /* else: ch remains == '\\', and we double it below: */
4457	o_addqchr(dest, ch); /* \c if c is a glob char, else just c */
4458	nommu_addchr(as_string, ch);
4459	goto again;
4460	}
4461	if (ch == '$') {
4462	if (!parse_dollar(as_string, dest, input, /*quote_mask:*/ 0x80)) {
4463	debug_printf_parse("encode_string return 0: "
4464	"parse_dollar returned 0 (error)\n");
4465	return 0;
4466	}
4467	goto again;
4468	}
4469	#if ENABLE_HUSH_TICK
4470	if (ch == '`') {
4471	//unsigned pos = dest->length;
4472	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4473	o_addchr(dest, 0x80 | '`');
4474	if (!add_till_backquote(dest, input, /*in_dquote:*/ dquote_end == '"'))
4475	return 0; /* error */
4476	o_addchr(dest, SPECIAL_VAR_SYMBOL);
4477	//debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
4478	goto again;
4479	}
4480	#endif
4481	o_addQchr(dest, ch);
4482	goto again;
4483	#undef as_string
4484	}
4485
4486	/*
4487	* Scan input until EOF or end_trigger char.
4488	* Return a list of pipes to execute, or NULL on EOF
4489	* or if end_trigger character is met.
4490	* On syntax error, exit if shell is not interactive,
4491	* reset parsing machinery and start parsing anew,
4492	* or return ERR_PTR.
4493	*/
4494	static struct pipe *parse_stream(char **pstring,
4495	struct in_str *input,
4496	int end_trigger)
4497	{
4498	struct parse_context ctx;
4499	o_string dest = NULL_O_STRING;
4500	int heredoc_cnt;
4501
4502	/* Single-quote triggers a bypass of the main loop until its mate is
4503	* found. When recursing, quote state is passed in via dest->o_expflags.
4504	*/
4505	debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
4506	end_trigger ? end_trigger : 'X');
4507	debug_enter();
4508
4509	/* If very first arg is "" or '', dest.data may end up NULL.
4510	* Preventing this: */
4511	o_addchr(&dest, '\0');
4512	dest.length = 0;
4513
4514	/* We used to separate words on $IFS here. This was wrong.
4515	* $IFS is used only for word splitting when $var is expanded,
4516	* here we should use blank chars as separators, not $IFS
4517	*/
4518
4519	if (MAYBE_ASSIGNMENT != 0)
4520	dest.o_assignment = MAYBE_ASSIGNMENT;
4521	initialize_context(&ctx);
4522	heredoc_cnt = 0;
4523	while (1) {
4524	const char *is_blank;
4525	const char *is_special;
4526	int ch;
4527	int next;
4528	int redir_fd;
4529	redir_type redir_style;
4530
4531	ch = i_getch(input);
4532	debug_printf_parse(": ch=%c (%d) escape=%d\n",
4533	ch, ch, !!(dest.o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
4534	if (ch == EOF) {
4535	struct pipe *pi;
4536
4537	if (heredoc_cnt) {
4538	syntax_error_unterm_str("here document");
4539	goto parse_error;
4540	}
4541	if (end_trigger == ')') {
4542	syntax_error_unterm_ch('(');
4543	goto parse_error;
4544	}
4545	if (end_trigger == '}') {
4546	syntax_error_unterm_ch('{');
4547	goto parse_error;
4548	}
4549
4550	if (done_word(&dest, &ctx)) {
4551	goto parse_error;
4552	}
4553	o_free(&dest);
4554	done_pipe(&ctx, PIPE_SEQ);
4555	pi = ctx.list_head;
4556	/* If we got nothing... */
4557	/* (this makes bare "&" cmd a no-op.
4558	* bash says: "syntax error near unexpected token '&'") */
4559	if (pi->num_cmds == 0
4560	IF_HAS_KEYWORDS(&& pi->res_word == RES_NONE)
4561	) {
4562	free_pipe_list(pi);
4563	pi = NULL;
4564	}
4565	#if !BB_MMU
4566	debug_printf_parse("as_string1 '%s'\n", ctx.as_string.data);
4567	if (pstring)
4568	*pstring = ctx.as_string.data;
4569	else
4570	o_free_unsafe(&ctx.as_string);
4571	#endif
4572	debug_leave();
4573	debug_printf_parse("parse_stream return %p\n", pi);
4574	return pi;
4575	}
4576	nommu_addchr(&ctx.as_string, ch);
4577
4578	next = '\0';
4579	if (ch != '\n')
4580	next = i_peek(input);
4581
4582	is_special = "{}<>;&|()#'" /* special outside of "str" */
4583	"\\$\"" IF_HUSH_TICK("`"); /* always special */
4584	/* Are { and } special here? */
4585	if (ctx.command->argv /* word [word]{... - non-special */
4586	|| dest.length /* word{... - non-special */
4587	|| dest.has_quoted_part /* ""{... - non-special */
4588	|| (next != ';' /* }; - special */
4589	&& next != ')' /* }) - special */
4590	&& next != '(' /* {( - special */
4591	&& next != '&' /* }& and }&& ... - special */
4592	&& next != '|' /* }|| ... - special */
4593	&& !strchr(defifs, next) /* {word - non-special */
4594	)
4595	) {
4596	/* They are not special, skip "{}" */
4597	is_special += 2;
4598	}
4599	is_special = strchr(is_special, ch);
4600	is_blank = strchr(defifs, ch);
4601
4602	if (!is_special && !is_blank) { /* ordinary char */
4603	ordinary_char:
4604	o_addQchr(&dest, ch);
4605	if ((dest.o_assignment == MAYBE_ASSIGNMENT
4606	|| dest.o_assignment == WORD_IS_KEYWORD)
4607	&& ch == '='
4608	&& is_well_formed_var_name(dest.data, '=')
4609	) {
4610	dest.o_assignment = DEFINITELY_ASSIGNMENT;
4611	debug_printf_parse("dest.o_assignment='%s'\n", assignment_flag[dest.o_assignment]);
4612	}
4613	continue;
4614	}
4615
4616	if (is_blank) {
4617	if (done_word(&dest, &ctx)) {
4618	goto parse_error;
4619	}
4620	if (ch == '\n') {
4621	/* Is this a case when newline is simply ignored?
4622	* Some examples:
4623	* "cmd | <newline> cmd ..."
4624	* "case ... in <newline> word) ..."
4625	*/
4626	if (IS_NULL_CMD(ctx.command)
4627	&& dest.length == 0 && !dest.has_quoted_part
4628	) {
4629	/* This newline can be ignored. But...
4630	* Without check #1, interactive shell
4631	* ignores even bare <newline>,
4632	* and shows the continuation prompt:
4633	* ps1_prompt$ <enter>
4634	* ps2> _ <=== wrong, should be ps1
4635	* Without check #2, "cmd & <newline>"
4636	* is similarly mistreated.
4637	* (BTW, this makes "cmd & cmd"
4638	* and "cmd && cmd" non-orthogonal.
4639	* Really, ask yourself, why
4640	* "cmd && <newline>" doesn't start
4641	* cmd but waits for more input?
4642	* No reason...)
4643	*/
4644	struct pipe *pi = ctx.list_head;
4645	if (pi->num_cmds != 0 /* check #1 */
4646	&& pi->followup != PIPE_BG /* check #2 */
4647	) {
4648	continue;
4649	}
4650	}
4651	/* Treat newline as a command separator. */
4652	done_pipe(&ctx, PIPE_SEQ);
4653	debug_printf_parse("heredoc_cnt:%d\n", heredoc_cnt);
4654	if (heredoc_cnt) {
4655	if (fetch_heredocs(heredoc_cnt, &ctx, input)) {
4656	goto parse_error;
4657	}
4658	heredoc_cnt = 0;
4659	}
4660	dest.o_assignment = MAYBE_ASSIGNMENT;
4661	debug_printf_parse("dest.o_assignment='%s'\n", assignment_flag[dest.o_assignment]);
4662	ch = ';';
4663	/* note: if (is_blank) continue;
4664	* will still trigger for us */
4665	}
4666	}
4667
4668	/* "cmd}" or "cmd }..." without semicolon or &:
4669	* } is an ordinary char in this case, even inside { cmd; }
4670	* Pathological example: { ""}; } should exec "}" cmd
4671	*/
4672	if (ch == '}') {
4673	if (dest.length != 0 /* word} */
4674	|| dest.has_quoted_part /* ""} */
4675	) {
4676	goto ordinary_char;
4677	}
4678	if (!IS_NULL_CMD(ctx.command)) { /* cmd } */
4679	/* Generally, there should be semicolon: "cmd; }"
4680	* However, bash allows to omit it if "cmd" is
4681	* a group. Examples:
4682	* { { echo 1; } }
4683	* {(echo 1)}
4684	* { echo 0 >&2 | { echo 1; } }
4685	* { while false; do :; done }
4686	* { case a in b) ;; esac }
4687	*/
4688	if (ctx.command->group)
4689	goto term_group;
4690	goto ordinary_char;
4691	}
4692	if (!IS_NULL_PIPE(ctx.pipe)) /* cmd | } */
4693	/* Can't be an end of {cmd}, skip the check */
4694	goto skip_end_trigger;
4695	/* else: } does terminate a group */
4696	}
4697	term_group:
4698	if (end_trigger && end_trigger == ch
4699	&& (ch != ';' || heredoc_cnt == 0)
4700	#if ENABLE_HUSH_CASE
4701	&& (ch != ')'
4702	|| ctx.ctx_res_w != RES_MATCH
4703	|| (!dest.has_quoted_part && strcmp(dest.data, "esac") == 0)
4704	)
4705	#endif
4706	) {
4707	if (heredoc_cnt) {
4708	/* This is technically valid:
4709	* { cat <<HERE; }; echo Ok
4710	* heredoc
4711	* heredoc
4712	* HERE
4713	* but we don't support this.
4714	* We require heredoc to be in enclosing {}/(),
4715	* if any.
4716	*/
4717	syntax_error_unterm_str("here document");
4718	goto parse_error;
4719	}
4720	if (done_word(&dest, &ctx)) {
4721	goto parse_error;
4722	}
4723	done_pipe(&ctx, PIPE_SEQ);
4724	dest.o_assignment = MAYBE_ASSIGNMENT;
4725	debug_printf_parse("dest.o_assignment='%s'\n", assignment_flag[dest.o_assignment]);
4726	/* Do we sit outside of any if's, loops or case's? */
4727	if (!HAS_KEYWORDS
4728	IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
4729	) {
4730	o_free(&dest);
4731	#if !BB_MMU
4732	debug_printf_parse("as_string2 '%s'\n", ctx.as_string.data);
4733	if (pstring)
4734	*pstring = ctx.as_string.data;
4735	else
4736	o_free_unsafe(&ctx.as_string);
4737	#endif
4738	debug_leave();
4739	debug_printf_parse("parse_stream return %p: "
4740	"end_trigger char found\n",
4741	ctx.list_head);
4742	return ctx.list_head;
4743	}
4744	}
4745	skip_end_trigger:
4746	if (is_blank)
4747	continue;
4748
4749	/* Catch <, > before deciding whether this word is
4750	* an assignment. a=1 2>z b=2: b=2 is still assignment */
4751	switch (ch) {
4752	case '>':
4753	redir_fd = redirect_opt_num(&dest);
4754	if (done_word(&dest, &ctx)) {
4755	goto parse_error;
4756	}
4757	redir_style = REDIRECT_OVERWRITE;
4758	if (next == '>') {
4759	redir_style = REDIRECT_APPEND;
4760	ch = i_getch(input);
4761	nommu_addchr(&ctx.as_string, ch);
4762	}
4763	#if 0
4764	else if (next == '(') {
4765	syntax_error(">(process) not supported");
4766	goto parse_error;
4767	}
4768	#endif
4769	if (parse_redirect(&ctx, redir_fd, redir_style, input))
4770	goto parse_error;
4771	continue; /* back to top of while (1) */
4772	case '<':
4773	redir_fd = redirect_opt_num(&dest);
4774	if (done_word(&dest, &ctx)) {
4775	goto parse_error;
4776	}
4777	redir_style = REDIRECT_INPUT;
4778	if (next == '<') {
4779	redir_style = REDIRECT_HEREDOC;
4780	heredoc_cnt++;
4781	debug_printf_parse("++heredoc_cnt=%d\n", heredoc_cnt);
4782	ch = i_getch(input);
4783	nommu_addchr(&ctx.as_string, ch);
4784	} else if (next == '>') {
4785	redir_style = REDIRECT_IO;
4786	ch = i_getch(input);
4787	nommu_addchr(&ctx.as_string, ch);
4788	}
4789	#if 0
4790	else if (next == '(') {
4791	syntax_error("<(process) not supported");
4792	goto parse_error;
4793	}
4794	#endif
4795	if (parse_redirect(&ctx, redir_fd, redir_style, input))
4796	goto parse_error;
4797	continue; /* back to top of while (1) */
4798	case '#':
4799	if (dest.length == 0 && !dest.has_quoted_part) {
4800	/* skip "#comment" */
4801	while (1) {
4802	ch = i_peek(input);
4803	if (ch == EOF || ch == '\n')
4804	break;
4805	i_getch(input);
4806	/* note: we do not add it to &ctx.as_string */
4807	}
4808	nommu_addchr(&ctx.as_string, '\n');
4809	continue; /* back to top of while (1) */
4810	}
4811	break;
4812	case '\\':
4813	if (next == '\n') {
4814	/* It's "\<newline>" */
4815	#if !BB_MMU
4816	/* Remove trailing '\' from ctx.as_string */
4817	ctx.as_string.data[--ctx.as_string.length] = '\0';
4818	#endif
4819	ch = i_getch(input); /* eat it */
4820	continue; /* back to top of while (1) */
4821	}
4822	break;
4823	}
4824
4825	if (dest.o_assignment == MAYBE_ASSIGNMENT
4826	/* check that we are not in word in "a=1 2>word b=1": */
4827	&& !ctx.pending_redirect
4828	) {
4829	/* ch is a special char and thus this word
4830	* cannot be an assignment */
4831	dest.o_assignment = NOT_ASSIGNMENT;
4832	debug_printf_parse("dest.o_assignment='%s'\n", assignment_flag[dest.o_assignment]);
4833	}
4834
4835	/* Note: nommu_addchr(&ctx.as_string, ch) is already done */
4836
4837	switch (ch) {
4838	case '#': /* non-comment #: "echo a#b" etc */
4839	o_addQchr(&dest, ch);
4840	break;
4841	case '\\':
4842	if (next == EOF) {
4843	syntax_error("\\<eof>");
4844	xfunc_die();
4845	}
4846	ch = i_getch(input);
4847	/* note: ch != '\n' (that case does not reach this place) */
4848	o_addchr(&dest, '\\');
4849	/*nommu_addchr(&ctx.as_string, '\\'); - already done */
4850	o_addchr(&dest, ch);
4851	nommu_addchr(&ctx.as_string, ch);
4852	/* Example: echo Hello \2>file
4853	* we need to know that word 2 is quoted */
4854	dest.has_quoted_part = 1;
4855	break;
4856	case '$':
4857	if (!parse_dollar(&ctx.as_string, &dest, input, /*quote_mask:*/ 0)) {
4858	debug_printf_parse("parse_stream parse error: "
4859	"parse_dollar returned 0 (error)\n");
4860	goto parse_error;
4861	}
4862	break;
4863	case '\'':
4864	dest.has_quoted_part = 1;
4865	if (next == '\'' && !ctx.pending_redirect) {
4866	insert_empty_quoted_str_marker:
4867	nommu_addchr(&ctx.as_string, next);
4868	i_getch(input); /* eat second ' */
4869	o_addchr(&dest, SPECIAL_VAR_SYMBOL);
4870	o_addchr(&dest, SPECIAL_VAR_SYMBOL);
4871	} else {
4872	while (1) {
4873	ch = i_getch(input);
4874	if (ch == EOF) {
4875	syntax_error_unterm_ch('\'');
4876	goto parse_error;
4877	}
4878	nommu_addchr(&ctx.as_string, ch);
4879	if (ch == '\'')
4880	break;
4881	o_addqchr(&dest, ch);
4882	}
4883	}
4884	break;
4885	case '"':
4886	dest.has_quoted_part = 1;
4887	if (next == '"' && !ctx.pending_redirect)
4888	goto insert_empty_quoted_str_marker;
4889	if (dest.o_assignment == NOT_ASSIGNMENT)
4890	dest.o_expflags |= EXP_FLAG_ESC_GLOB_CHARS;
4891	if (!encode_string(&ctx.as_string, &dest, input, '"', /*process_bkslash:*/ 1))
4892	goto parse_error;
4893	dest.o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
4894	break;
4895	#if ENABLE_HUSH_TICK
4896	case '`': {
4897	USE_FOR_NOMMU(unsigned pos;)
4898
4899	o_addchr(&dest, SPECIAL_VAR_SYMBOL);
4900	o_addchr(&dest, '`');
4901	USE_FOR_NOMMU(pos = dest.length;)
4902	if (!add_till_backquote(&dest, input, /*in_dquote:*/ 0))
4903	goto parse_error;
4904	# if !BB_MMU
4905	o_addstr(&ctx.as_string, dest.data + pos);
4906	o_addchr(&ctx.as_string, '`');
4907	# endif
4908	o_addchr(&dest, SPECIAL_VAR_SYMBOL);
4909	//debug_printf_subst("SUBST RES3 '%s'\n", dest.data + pos);
4910	break;
4911	}
4912	#endif
4913	case ';':
4914	#if ENABLE_HUSH_CASE
4915	case_semi:
4916	#endif
4917	if (done_word(&dest, &ctx)) {
4918	goto parse_error;
4919	}
4920	done_pipe(&ctx, PIPE_SEQ);
4921	#if ENABLE_HUSH_CASE
4922	/* Eat multiple semicolons, detect
4923	* whether it means something special */
4924	while (1) {
4925	ch = i_peek(input);
4926	if (ch != ';')
4927	break;
4928	ch = i_getch(input);
4929	nommu_addchr(&ctx.as_string, ch);
4930	if (ctx.ctx_res_w == RES_CASE_BODY) {
4931	ctx.ctx_dsemicolon = 1;
4932	ctx.ctx_res_w = RES_MATCH;
4933	break;
4934	}
4935	}
4936	#endif
4937	new_cmd:
4938	/* We just finished a cmd. New one may start
4939	* with an assignment */
4940	dest.o_assignment = MAYBE_ASSIGNMENT;
4941	debug_printf_parse("dest.o_assignment='%s'\n", assignment_flag[dest.o_assignment]);
4942	break;
4943	case '&':
4944	if (done_word(&dest, &ctx)) {
4945	goto parse_error;
4946	}
4947	if (next == '&') {
4948	ch = i_getch(input);
4949	nommu_addchr(&ctx.as_string, ch);
4950	done_pipe(&ctx, PIPE_AND);
4951	} else {
4952	done_pipe(&ctx, PIPE_BG);
4953	}
4954	goto new_cmd;
4955	case '|':
4956	if (done_word(&dest, &ctx)) {
4957	goto parse_error;
4958	}
4959	#if ENABLE_HUSH_CASE
4960	if (ctx.ctx_res_w == RES_MATCH)
4961	break; /* we are in case's "word | word)" */
4962	#endif
4963	if (next == '|') { /* || */
4964	ch = i_getch(input);
4965	nommu_addchr(&ctx.as_string, ch);
4966	done_pipe(&ctx, PIPE_OR);
4967	} else {
4968	/* we could pick up a file descriptor choice here
4969	* with redirect_opt_num(), but bash doesn't do it.
4970	* "echo foo 2| cat" yields "foo 2". */
4971	done_command(&ctx);
4972	}
4973	goto new_cmd;
4974	case '(':
4975	#if ENABLE_HUSH_CASE
4976	/* "case... in [(]word)..." - skip '(' */
4977	if (ctx.ctx_res_w == RES_MATCH
4978	&& ctx.command->argv == NULL /* not (word|(... */
4979	&& dest.length == 0 /* not word(... */
4980	&& dest.has_quoted_part == 0 /* not ""(... */
4981	) {
4982	continue;
4983	}
4984	#endif
4985	case '{':
4986	if (parse_group(&dest, &ctx, input, ch) != 0) {
4987	goto parse_error;
4988	}
4989	goto new_cmd;
4990	case ')':
4991	#if ENABLE_HUSH_CASE
4992	if (ctx.ctx_res_w == RES_MATCH)
4993	goto case_semi;
4994	#endif
4995	case '}':
4996	/* proper use of this character is caught by end_trigger:
4997	* if we see {, we call parse_group(..., end_trigger='}')
4998	* and it will match } earlier (not here). */
4999	syntax_error_unexpected_ch(ch);
5000	goto parse_error;
5001	default:
5002	if (HUSH_DEBUG)
5003	bb_error_msg_and_die("BUG: unexpected %c\n", ch);
5004	}
5005	} /* while (1) */
5006
5007	parse_error:
5008	{
5009	struct parse_context *pctx;
5010	IF_HAS_KEYWORDS(struct parse_context *p2;)
5011
5012	/* Clean up allocated tree.
5013	* Sample for finding leaks on syntax error recovery path.
5014	* Run it from interactive shell, watch pmap `pidof hush`.
5015	* while if false; then false; fi; do break; fi
5016	* Samples to catch leaks at execution:
5017	* while if (true | { true;}); then echo ok; fi; do break; done
5018	* while if (true | { true;}); then echo ok; fi; do (if echo ok; break; then :; fi) | cat; break; done
5019	*/
5020	pctx = &ctx;
5021	do {
5022	/* Update pipe/command counts,
5023	* otherwise freeing may miss some */
5024	done_pipe(pctx, PIPE_SEQ);
5025	debug_printf_clean("freeing list %p from ctx %p\n",
5026	pctx->list_head, pctx);
5027	debug_print_tree(pctx->list_head, 0);
5028	free_pipe_list(pctx->list_head);
5029	debug_printf_clean("freed list %p\n", pctx->list_head);
5030	#if !BB_MMU
5031	o_free_unsafe(&pctx->as_string);
5032	#endif
5033	IF_HAS_KEYWORDS(p2 = pctx->stack;)
5034	if (pctx != &ctx) {
5035	free(pctx);
5036	}
5037	IF_HAS_KEYWORDS(pctx = p2;)
5038	} while (HAS_KEYWORDS && pctx);
5039
5040	o_free(&dest);
5041	G.last_exitcode = 1;
5042	#if !BB_MMU
5043	if (pstring)
5044	*pstring = NULL;
5045	#endif
5046	debug_leave();
5047	return ERR_PTR;
5048	}
5049	}
5050
5051
5052	/*** Execution routines ***/
5053
5054	/* Expansion can recurse, need forward decls: */
5055	#if !ENABLE_HUSH_BASH_COMPAT
5056	/* only ${var/pattern/repl} (its pattern part) needs additional mode */
5057	#define expand_string_to_string(str, do_unbackslash) \
5058	expand_string_to_string(str)
5059	#endif
5060	static char *expand_string_to_string(const char *str, int do_unbackslash);
5061	#if ENABLE_HUSH_TICK
5062	static int process_command_subs(o_string *dest, const char *s);
5063	#endif
5064
5065	/* expand_strvec_to_strvec() takes a list of strings, expands
5066	* all variable references within and returns a pointer to
5067	* a list of expanded strings, possibly with larger number
5068	* of strings. (Think VAR="a b"; echo $VAR).
5069	* This new list is allocated as a single malloc block.
5070	* NULL-terminated list of char* pointers is at the beginning of it,
5071	* followed by strings themselves.
5072	* Caller can deallocate entire list by single free(list). */
5073
5074	/* A horde of its helpers come first: */
5075
5076	static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len)
5077	{
5078	while (--len >= 0) {
5079	char c = *str++;
5080
5081	#if ENABLE_HUSH_BRACE_EXPANSION
5082	if (c == '{' || c == '}') {
5083	/* { -> \{, } -> \} */
5084	o_addchr(o, '\\');
5085	/* And now we want to add { or } and continue:
5086	* o_addchr(o, c);
5087	* continue;
5088	* luckily, just falling throught achieves this.
5089	*/
5090	}
5091	#endif
5092	o_addchr(o, c);
5093	if (c == '\\') {
5094	/* \z -> \\\z; \<eol> -> \\<eol> */
5095	o_addchr(o, '\\');
5096	if (len) {
5097	len--;
5098	o_addchr(o, '\\');
5099	o_addchr(o, *str++);
5100	}
5101	}
5102	}
5103	}
5104
5105	/* Store given string, finalizing the word and starting new one whenever
5106	* we encounter IFS char(s). This is used for expanding variable values.
5107	* End-of-string does NOT finalize word: think about 'echo -$VAR-'.
5108	* Return in *ended_with_ifs:
5109	* 1 - ended with IFS char, else 0 (this includes case of empty str).
5110	*/
5111	static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const char *str)
5112	{
5113	int last_is_ifs = 0;
5114
5115	while (1) {
5116	int word_len;
5117
5118	if (!*str) /* EOL - do not finalize word */
5119	break;
5120	word_len = strcspn(str, G.ifs);
5121	if (word_len) {
5122	/* We have WORD_LEN leading non-IFS chars */
5123	if (!(output->o_expflags & EXP_FLAG_GLOB)) {
5124	o_addblock(output, str, word_len);
5125	} else {
5126	/* Protect backslashes against globbing up :)
5127	* Example: "v='\*'; echo b$v" prints "b\*"
5128	* (and does not try to glob on "*")
5129	*/
5130	o_addblock_duplicate_backslash(output, str, word_len);
5131	/*/ Why can't we do it easier? */
5132	/*o_addblock(output, str, word_len); - WRONG: "v='\*'; echo Z$v" prints "Z*" instead of "Z\*" */
5133	/*o_addqblock(output, str, word_len); - WRONG: "v='*'; echo Z$v" prints "Z*" instead of Z* files */
5134	}
5135	last_is_ifs = 0;
5136	str += word_len;
5137	if (!*str) /* EOL - do not finalize word */
5138	break;
5139	}
5140
5141	/* We know str here points to at least one IFS char */
5142	last_is_ifs = 1;
5143	str += strspn(str, G.ifs); /* skip IFS chars */
5144	if (!*str) /* EOL - do not finalize word */
5145	break;
5146
5147	/* Start new word... but not always! */
5148	/* Case "v=' a'; echo ''$v": we do need to finalize empty word: */
5149	if (output->has_quoted_part
5150	/* Case "v=' a'; echo $v":
5151	* here nothing precedes the space in $v expansion,
5152	* therefore we should not finish the word
5153	* (IOW: if there *is* word to finalize, only then do it):
5154	*/
5155	|| (n > 0 && output->data[output->length - 1])
5156	) {
5157	o_addchr(output, '\0');
5158	debug_print_list("expand_on_ifs", output, n);
5159	n = o_save_ptr(output, n);
5160	}
5161	}
5162
5163	if (ended_with_ifs)
5164	*ended_with_ifs = last_is_ifs;
5165	debug_print_list("expand_on_ifs[1]", output, n);
5166	return n;
5167	}
5168
5169	/* Helper to expand $((...)) and heredoc body. These act as if
5170	* they are in double quotes, with the exception that they are not :).
5171	* Just the rules are similar: "expand only $var and `cmd`"
5172	*
5173	* Returns malloced string.
5174	* As an optimization, we return NULL if expansion is not needed.
5175	*/
5176	#if !ENABLE_HUSH_BASH_COMPAT
5177	/* only ${var/pattern/repl} (its pattern part) needs additional mode */
5178	#define encode_then_expand_string(str, process_bkslash, do_unbackslash) \
5179	encode_then_expand_string(str)
5180	#endif
5181	static char *encode_then_expand_string(const char *str, int process_bkslash, int do_unbackslash)
5182	{
5183	char *exp_str;
5184	struct in_str input;
5185	o_string dest = NULL_O_STRING;
5186
5187	if (!strchr(str, '$')
5188	&& !strchr(str, '\\')
5189	#if ENABLE_HUSH_TICK
5190	&& !strchr(str, '`')
5191	#endif
5192	) {
5193	return NULL;
5194	}
5195
5196	/* We need to expand. Example:
5197	* echo $(($a + `echo 1`)) $((1 + $((2)) ))
5198	*/
5199	setup_string_in_str(&input, str);
5200	encode_string(NULL, &dest, &input, EOF, process_bkslash);
5201	//TODO: error check (encode_string returns 0 on error)?
5202	//bb_error_msg("'%s' -> '%s'", str, dest.data);
5203	exp_str = expand_string_to_string(dest.data, /*unbackslash:*/ do_unbackslash);
5204	//bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
5205	o_free_unsafe(&dest);
5206	return exp_str;
5207	}
5208
5209	#if ENABLE_FEATURE_SH_MATH
5210	static arith_t expand_and_evaluate_arith(const char *arg, const char **errmsg_p)
5211	{
5212	arith_state_t math_state;
5213	arith_t res;
5214	char *exp_str;
5215
5216	math_state.lookupvar = get_local_var_value;
5217	math_state.setvar = set_local_var_from_halves;
5218	//math_state.endofname = endofname;
5219	exp_str = encode_then_expand_string(arg, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
5220	res = arith(&math_state, exp_str ? exp_str : arg);
5221	free(exp_str);
5222	if (errmsg_p)
5223	*errmsg_p = math_state.errmsg;
5224	if (math_state.errmsg)
5225	die_if_script(math_state.errmsg);
5226	return res;
5227	}
5228	#endif
5229
5230	#if ENABLE_HUSH_BASH_COMPAT
5231	/* ${var/[/]pattern[/repl]} helpers */
5232	static char *strstr_pattern(char *val, const char *pattern, int *size)
5233	{
5234	while (1) {
5235	char *end = scan_and_match(val, pattern, SCAN_MOVE_FROM_RIGHT + SCAN_MATCH_LEFT_HALF);
5236	debug_printf_varexp("val:'%s' pattern:'%s' end:'%s'\n", val, pattern, end);
5237	if (end) {
5238	*size = end - val;
5239	return val;
5240	}
5241	if (*val == '\0')
5242	return NULL;
5243	/* Optimization: if "*pat" did not match the start of "string",
5244	* we know that "tring", "ring" etc will not match too:
5245	*/
5246	if (pattern[0] == '*')
5247	return NULL;
5248	val++;
5249	}
5250	}
5251	static char *replace_pattern(char *val, const char *pattern, const char *repl, char exp_op)
5252	{
5253	char *result = NULL;
5254	unsigned res_len = 0;
5255	unsigned repl_len = strlen(repl);
5256
5257	while (1) {
5258	int size;
5259	char *s = strstr_pattern(val, pattern, &size);
5260	if (!s)
5261	break;
5262
5263	result = xrealloc(result, res_len + (s - val) + repl_len + 1);
5264	memcpy(result + res_len, val, s - val);
5265	res_len += s - val;
5266	strcpy(result + res_len, repl);
5267	res_len += repl_len;
5268	debug_printf_varexp("val:'%s' s:'%s' result:'%s'\n", val, s, result);
5269
5270	val = s + size;
5271	if (exp_op == '/')
5272	break;
5273	}
5274	if (val[0] && result) {
5275	result = xrealloc(result, res_len + strlen(val) + 1);
5276	strcpy(result + res_len, val);
5277	debug_printf_varexp("val:'%s' result:'%s'\n", val, result);
5278	}
5279	debug_printf_varexp("result:'%s'\n", result);
5280	return result;
5281	}
5282	#endif
5283
5284	/* Helper:
5285	* Handles <SPECIAL_VAR_SYMBOL>varname...<SPECIAL_VAR_SYMBOL> construct.
5286	*/
5287	static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, char **pp)
5288	{
5289	const char *val = NULL;
5290	char *to_be_freed = NULL;
5291	char *p = *pp;
5292	char *var;
5293	char first_char;
5294	char exp_op;
5295	char exp_save = exp_save; /* for compiler */
5296	char *exp_saveptr; /* points to expansion operator */
5297	char *exp_word = exp_word; /* for compiler */
5298	char arg0;
5299
5300	*p = '\0'; /* replace trailing SPECIAL_VAR_SYMBOL */
5301	var = arg;
5302	exp_saveptr = arg[1] ? strchr(VAR_ENCODED_SUBST_OPS, arg[1]) : NULL;
5303	arg0 = arg[0];
5304	first_char = arg[0] = arg0 & 0x7f;
5305	exp_op = 0;
5306
5307	if (first_char == '#' /* ${#... */
5308	&& arg[1] && !exp_saveptr /* not ${#} and not ${#<op_char>...} */
5309	) {
5310	/* It must be length operator: ${#var} */
5311	var++;
5312	exp_op = 'L';
5313	} else {
5314	/* Maybe handle parameter expansion */
5315	if (exp_saveptr /* if 2nd char is one of expansion operators */
5316	&& strchr(NUMERIC_SPECVARS_STR, first_char) /* 1st char is special variable */
5317	) {
5318	/* ${?:0}, ${#[:]%0} etc */
5319	exp_saveptr = var + 1;
5320	} else {
5321	/* ${?}, ${var}, ${var:0}, ${var[:]%0} etc */
5322	exp_saveptr = var+1 + strcspn(var+1, VAR_ENCODED_SUBST_OPS);
5323	}
5324	exp_op = exp_save = *exp_saveptr;
5325	if (exp_op) {
5326	exp_word = exp_saveptr + 1;
5327	if (exp_op == ':') {
5328	exp_op = *exp_word++;
5329	//TODO: try ${var:} and ${var:bogus} in non-bash config
5330	if (ENABLE_HUSH_BASH_COMPAT
5331	&& (!exp_op || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
5332	) {
5333	/* oops... it's ${var:N[:M]}, not ${var:?xxx} or some such */
5334	exp_op = ':';
5335	exp_word--;
5336	}
5337	}
5338	*exp_saveptr = '\0';
5339	} /* else: it's not an expansion op, but bare ${var} */
5340	}
5341
5342	/* Look up the variable in question */
5343	if (isdigit(var[0])) {
5344	/* parse_dollar should have vetted var for us */
5345	int n = xatoi_positive(var);
5346	if (n < G.global_argc)
5347	val = G.global_argv[n];
5348	/* else val remains NULL: $N with too big N */
5349	} else {
5350	switch (var[0]) {
5351	case '$': /* pid */
5352	val = utoa(G.root_pid);
5353	break;
5354	case '!': /* bg pid */
5355	val = G.last_bg_pid ? utoa(G.last_bg_pid) : "";
5356	break;
5357	case '?': /* exitcode */
5358	val = utoa(G.last_exitcode);
5359	break;
5360	case '#': /* argc */
5361	val = utoa(G.global_argc ? G.global_argc-1 : 0);
5362	break;
5363	default:
5364	val = get_local_var_value(var);
5365	}
5366	}
5367
5368	/* Handle any expansions */
5369	if (exp_op == 'L') {
5370	reinit_unicode_for_hush();
5371	debug_printf_expand("expand: length(%s)=", val);
5372	val = utoa(val ? unicode_strlen(val) : 0);
5373	debug_printf_expand("%s\n", val);
5374	} else if (exp_op) {
5375	if (exp_op == '%' || exp_op == '#') {
5376	/* Standard-mandated substring removal ops:
5377	* ${parameter%word} - remove smallest suffix pattern
5378	* ${parameter%%word} - remove largest suffix pattern
5379	* ${parameter#word} - remove smallest prefix pattern
5380	* ${parameter##word} - remove largest prefix pattern
5381	*
5382	* Word is expanded to produce a glob pattern.
5383	* Then var's value is matched to it and matching part removed.
5384	*/
5385	if (val && val[0]) {
5386	char *t;
5387	char *exp_exp_word;
5388	char *loc;
5389	unsigned scan_flags = pick_scan(exp_op, *exp_word);
5390	if (exp_op == *exp_word) /* ## or %% */
5391	exp_word++;
5392	exp_exp_word = encode_then_expand_string(exp_word, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
5393	if (exp_exp_word)
5394	exp_word = exp_exp_word;
5395	/* HACK ALERT. We depend here on the fact that
5396	* G.global_argv and results of utoa and get_local_var_value
5397	* are actually in writable memory:
5398	* scan_and_match momentarily stores NULs there. */
5399	t = (char*)val;
5400	loc = scan_and_match(t, exp_word, scan_flags);
5401	//bb_error_msg("op:%c str:'%s' pat:'%s' res:'%s'",
5402	// exp_op, t, exp_word, loc);
5403	free(exp_exp_word);
5404	if (loc) { /* match was found */
5405	if (scan_flags & SCAN_MATCH_LEFT_HALF) /* #[#] */
5406	val = loc; /* take right part */
5407	else /* %[%] */
5408	val = to_be_freed = xstrndup(val, loc - val); /* left */
5409	}
5410	}
5411	}
5412	#if ENABLE_HUSH_BASH_COMPAT
5413	else if (exp_op == '/' || exp_op == '\\') {
5414	/* It's ${var/[/]pattern[/repl]} thing.
5415	* Note that in encoded form it has TWO parts:
5416	* var/pattern<SPECIAL_VAR_SYMBOL>repl<SPECIAL_VAR_SYMBOL>
5417	* and if // is used, it is encoded as \:
5418	* var\pattern<SPECIAL_VAR_SYMBOL>repl<SPECIAL_VAR_SYMBOL>
5419	*/
5420	/* Empty variable always gives nothing: */
5421	// "v=''; echo ${v/*/w}" prints "", not "w"
5422	if (val && val[0]) {
5423	/* pattern uses non-standard expansion.
5424	* repl should be unbackslashed and globbed
5425	* by the usual expansion rules:
5426	* >az; >bz;
5427	* v='a bz'; echo "${v/a*z/a*z}" prints "a*z"
5428	* v='a bz'; echo "${v/a*z/\z}" prints "\z"
5429	* v='a bz'; echo ${v/a*z/a*z} prints "az"
5430	* v='a bz'; echo ${v/a*z/\z} prints "z"
5431	* (note that a*z _pattern_ is never globbed!)
5432	*/
5433	char *pattern, *repl, *t;
5434	pattern = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 0);
5435	if (!pattern)
5436	pattern = xstrdup(exp_word);
5437	debug_printf_varexp("pattern:'%s'->'%s'\n", exp_word, pattern);
5438	*p++ = SPECIAL_VAR_SYMBOL;
5439	exp_word = p;
5440	p = strchr(p, SPECIAL_VAR_SYMBOL);
5441	*p = '\0';
5442	repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ arg0 & 0x80, /*unbackslash:*/ 1);
5443	debug_printf_varexp("repl:'%s'->'%s'\n", exp_word, repl);
5444	/* HACK ALERT. We depend here on the fact that
5445	* G.global_argv and results of utoa and get_local_var_value
5446	* are actually in writable memory:
5447	* replace_pattern momentarily stores NULs there. */
5448	t = (char*)val;
5449	to_be_freed = replace_pattern(t,
5450	pattern,
5451	(repl ? repl : exp_word),
5452	exp_op);
5453	if (to_be_freed) /* at least one replace happened */
5454	val = to_be_freed;
5455	free(pattern);
5456	free(repl);
5457	}
5458	}
5459	#endif
5460	else if (exp_op == ':') {
5461	#if ENABLE_HUSH_BASH_COMPAT && ENABLE_FEATURE_SH_MATH
5462	/* It's ${var:N[:M]} bashism.
5463	* Note that in encoded form it has TWO parts:
5464	* var:N<SPECIAL_VAR_SYMBOL>M<SPECIAL_VAR_SYMBOL>
5465	*/
5466	arith_t beg, len;
5467	const char *errmsg;
5468
5469	beg = expand_and_evaluate_arith(exp_word, &errmsg);
5470	if (errmsg)
5471	goto arith_err;
5472	debug_printf_varexp("beg:'%s'=%lld\n", exp_word, (long long)beg);
5473	*p++ = SPECIAL_VAR_SYMBOL;
5474	exp_word = p;
5475	p = strchr(p, SPECIAL_VAR_SYMBOL);
5476	*p = '\0';
5477	len = expand_and_evaluate_arith(exp_word, &errmsg);
5478	if (errmsg)
5479	goto arith_err;
5480	debug_printf_varexp("len:'%s'=%lld\n", exp_word, (long long)len);
5481	if (len >= 0) { /* bash compat: len < 0 is illegal */
5482	if (beg < 0) /* bash compat */
5483	beg = 0;
5484	debug_printf_varexp("from val:'%s'\n", val);
5485	if (len == 0 || !val || beg >= strlen(val)) {
5486	arith_err:
5487	val = NULL;
5488	} else {
5489	/* Paranoia. What if user entered 9999999999999
5490	* which fits in arith_t but not int? */
5491	if (len >= INT_MAX)
5492	len = INT_MAX;
5493	val = to_be_freed = xstrndup(val + beg, len);
5494	}
5495	debug_printf_varexp("val:'%s'\n", val);
5496	} else
5497	#endif
5498	{
5499	die_if_script("malformed ${%s:...}", var);
5500	val = NULL;
5501	}
5502	} else { /* one of "-=+?" */
5503	/* Standard-mandated substitution ops:
5504	* ${var?word} - indicate error if unset
5505	* If var is unset, word (or a message indicating it is unset
5506	* if word is null) is written to standard error
5507	* and the shell exits with a non-zero exit status.
5508	* Otherwise, the value of var is substituted.
5509	* ${var-word} - use default value
5510	* If var is unset, word is substituted.
5511	* ${var=word} - assign and use default value
5512	* If var is unset, word is assigned to var.
5513	* In all cases, final value of var is substituted.
5514	* ${var+word} - use alternative value
5515	* If var is unset, null is substituted.
5516	* Otherwise, word is substituted.
5517	*
5518	* Word is subjected to tilde expansion, parameter expansion,
5519	* command substitution, and arithmetic expansion.
5520	* If word is not needed, it is not expanded.
5521	*
5522	* Colon forms (${var:-word}, ${var:=word} etc) do the same,
5523	* but also treat null var as if it is unset.
5524	*/
5525	int use_word = (!val || ((exp_save == ':') && !val[0]));
5526	if (exp_op == '+')
5527	use_word = !use_word;
5528	debug_printf_expand("expand: op:%c (null:%s) test:%i\n", exp_op,
5529	(exp_save == ':') ? "true" : "false", use_word);
5530	if (use_word) {
5531	to_be_freed = encode_then_expand_string(exp_word, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
5532	if (to_be_freed)
5533	exp_word = to_be_freed;
5534	if (exp_op == '?') {
5535	/* mimic bash message */
5536	die_if_script("%s: %s",
5537	var,
5538	exp_word[0] ? exp_word : "parameter null or not set"
5539	);
5540	//TODO: how interactive bash aborts expansion mid-command?
5541	} else {
5542	val = exp_word;
5543	}
5544
5545	if (exp_op == '=') {
5546	/* ${var=[word]} or ${var:=[word]} */
5547	if (isdigit(var[0]) || var[0] == '#') {
5548	/* mimic bash message */
5549	die_if_script("$%s: cannot assign in this way", var);
5550	val = NULL;
5551	} else {
5552	char *new_var = xasprintf("%s=%s", var, val);
5553	set_local_var(new_var, /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
5554	}
5555	}
5556	}
5557	} /* one of "-=+?" */
5558
5559	*exp_saveptr = exp_save;
5560	} /* if (exp_op) */
5561
5562	arg[0] = arg0;
5563
5564	*pp = p;
5565	*to_be_freed_pp = to_be_freed;
5566	return val;
5567	}
5568
5569	/* Expand all variable references in given string, adding words to list[]
5570	* at n, n+1,... positions. Return updated n (so that list[n] is next one
5571	* to be filled). This routine is extremely tricky: has to deal with
5572	* variables/parameters with whitespace, $* and $@, and constructs like
5573	* 'echo -$*-'. If you play here, you must run testsuite afterwards! */
5574	static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
5575	{
5576	/* output->o_expflags & EXP_FLAG_SINGLEWORD (0x80) if we are in
5577	* expansion of right-hand side of assignment == 1-element expand.
5578	*/
5579	char cant_be_null = 0; /* only bit 0x80 matters */
5580	int ended_in_ifs = 0; /* did last unquoted expansion end with IFS chars? */
5581	char *p;
5582
5583	debug_printf_expand("expand_vars_to_list: arg:'%s' singleword:%x\n", arg,
5584	!!(output->o_expflags & EXP_FLAG_SINGLEWORD));
5585	debug_print_list("expand_vars_to_list", output, n);
5586	n = o_save_ptr(output, n);
5587	debug_print_list("expand_vars_to_list[0]", output, n);
5588
5589	while ((p = strchr(arg, SPECIAL_VAR_SYMBOL)) != NULL) {
5590	char first_ch;
5591	char *to_be_freed = NULL;
5592	const char *val = NULL;
5593	#if ENABLE_HUSH_TICK
5594	o_string subst_result = NULL_O_STRING;
5595	#endif
5596	#if ENABLE_FEATURE_SH_MATH
5597	char arith_buf[sizeof(arith_t)*3 + 2];
5598	#endif
5599
5600	if (ended_in_ifs) {
5601	o_addchr(output, '\0');
5602	n = o_save_ptr(output, n);
5603	ended_in_ifs = 0;
5604	}
5605
5606	o_addblock(output, arg, p - arg);
5607	debug_print_list("expand_vars_to_list[1]", output, n);
5608	arg = ++p;
5609	p = strchr(p, SPECIAL_VAR_SYMBOL);
5610
5611	/* Fetch special var name (if it is indeed one of them)
5612	* and quote bit, force the bit on if singleword expansion -
5613	* important for not getting v=$@ expand to many words. */
5614	first_ch = arg[0] | (output->o_expflags & EXP_FLAG_SINGLEWORD);
5615
5616	/* Is this variable quoted and thus expansion can't be null?
5617	* "$@" is special. Even if quoted, it can still
5618	* expand to nothing (not even an empty string),
5619	* thus it is excluded. */
5620	if ((first_ch & 0x7f) != '@')
5621	cant_be_null |= first_ch;
5622
5623	switch (first_ch & 0x7f) {
5624	/* Highest bit in first_ch indicates that var is double-quoted */
5625	case '*':
5626	case '@': {
5627	int i;
5628	if (!G.global_argv[1])
5629	break;
5630	i = 1;
5631	cant_be_null |= first_ch; /* do it for "$@" _now_, when we know it's not empty */
5632	if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
5633	while (G.global_argv[i]) {
5634	n = expand_on_ifs(NULL, output, n, G.global_argv[i]);
5635	debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, G.global_argc - 1);
5636	if (G.global_argv[i++][0] && G.global_argv[i]) {
5637	/* this argv[] is not empty and not last:
5638	* put terminating NUL, start new word */
5639	o_addchr(output, '\0');
5640	debug_print_list("expand_vars_to_list[2]", output, n);
5641	n = o_save_ptr(output, n);
5642	debug_print_list("expand_vars_to_list[3]", output, n);
5643	}
5644	}
5645	} else
5646	/* If EXP_FLAG_SINGLEWORD, we handle assignment 'a=....$@.....'
5647	* and in this case should treat it like '$*' - see 'else...' below */
5648	if (first_ch == ('@'|0x80) /* quoted $@ */
5649	&& !(output->o_expflags & EXP_FLAG_SINGLEWORD) /* not v="$@" case */
5650	) {
5651	while (1) {
5652	o_addQstr(output, G.global_argv[i]);
5653	if (++i >= G.global_argc)
5654	break;
5655	o_addchr(output, '\0');
5656	debug_print_list("expand_vars_to_list[4]", output, n);
5657	n = o_save_ptr(output, n);
5658	}
5659	} else { /* quoted $* (or v="$@" case): add as one word */
5660	while (1) {
5661	o_addQstr(output, G.global_argv[i]);
5662	if (!G.global_argv[++i])
5663	break;
5664	if (G.ifs[0])
5665	o_addchr(output, G.ifs[0]);
5666	}
5667	output->has_quoted_part = 1;
5668	}
5669	break;
5670	}
5671	case SPECIAL_VAR_SYMBOL: /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
5672	/* "Empty variable", used to make "" etc to not disappear */
5673	output->has_quoted_part = 1;
5674	arg++;
5675	cant_be_null = 0x80;
5676	break;
5677	#if ENABLE_HUSH_TICK
5678	case '`': /* <SPECIAL_VAR_SYMBOL>`cmd<SPECIAL_VAR_SYMBOL> */
5679	*p = '\0'; /* replace trailing <SPECIAL_VAR_SYMBOL> */
5680	arg++;
5681	/* Can't just stuff it into output o_string,
5682	* expanded result may need to be globbed
5683	* and $IFS-splitted */
5684	debug_printf_subst("SUBST '%s' first_ch %x\n", arg, first_ch);
5685	G.last_exitcode = process_command_subs(&subst_result, arg);
5686	debug_printf_subst("SUBST RES:%d '%s'\n", G.last_exitcode, subst_result.data);
5687	val = subst_result.data;
5688	goto store_val;
5689	#endif
5690	#if ENABLE_FEATURE_SH_MATH
5691	case '+': { /* <SPECIAL_VAR_SYMBOL>+cmd<SPECIAL_VAR_SYMBOL> */
5692	arith_t res;
5693
5694	arg++; /* skip '+' */
5695	*p = '\0'; /* replace trailing <SPECIAL_VAR_SYMBOL> */
5696	debug_printf_subst("ARITH '%s' first_ch %x\n", arg, first_ch);
5697	res = expand_and_evaluate_arith(arg, NULL);
5698	debug_printf_subst("ARITH RES '"ARITH_FMT"'\n", res);
5699	sprintf(arith_buf, ARITH_FMT, res);
5700	val = arith_buf;
5701	break;
5702	}
5703	#endif
5704	default:
5705	val = expand_one_var(&to_be_freed, arg, &p);
5706	IF_HUSH_TICK(store_val:)
5707	if (!(first_ch & 0x80)) { /* unquoted $VAR */
5708	debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
5709	!!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
5710	if (val && val[0]) {
5711	n = expand_on_ifs(&ended_in_ifs, output, n, val);
5712	val = NULL;
5713	}
5714	} else { /* quoted $VAR, val will be appended below */
5715	output->has_quoted_part = 1;
5716	debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
5717	!!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
5718	}
5719	break;
5720	} /* switch (char after <SPECIAL_VAR_SYMBOL>) */
5721
5722	if (val && val[0]) {
5723	o_addQstr(output, val);
5724	}
5725	free(to_be_freed);
5726
5727	/* Restore NULL'ed SPECIAL_VAR_SYMBOL.
5728	* Do the check to avoid writing to a const string. */
5729	if (*p != SPECIAL_VAR_SYMBOL)
5730	*p = SPECIAL_VAR_SYMBOL;
5731
5732	#if ENABLE_HUSH_TICK
5733	o_free(&subst_result);
5734	#endif
5735	arg = ++p;
5736	} /* end of "while (SPECIAL_VAR_SYMBOL is found) ..." */
5737
5738	if (arg[0]) {
5739	if (ended_in_ifs) {
5740	o_addchr(output, '\0');
5741	n = o_save_ptr(output, n);
5742	}
5743	debug_print_list("expand_vars_to_list[a]", output, n);
5744	/* this part is literal, and it was already pre-quoted
5745	* if needed (much earlier), do not use o_addQstr here! */
5746	o_addstr_with_NUL(output, arg);
5747	debug_print_list("expand_vars_to_list[b]", output, n);
5748	} else if (output->length == o_get_last_ptr(output, n) /* expansion is empty */
5749	&& !(cant_be_null & 0x80) /* and all vars were not quoted. */
5750	) {
5751	n--;
5752	/* allow to reuse list[n] later without re-growth */
5753	output->has_empty_slot = 1;
5754	} else {
5755	o_addchr(output, '\0');
5756	}
5757
5758	return n;
5759	}
5760
5761	static char **expand_variables(char **argv, unsigned expflags)
5762	{
5763	int n;
5764	char **list;
5765	o_string output = NULL_O_STRING;
5766
5767	output.o_expflags = expflags;
5768
5769	n = 0;
5770	while (*argv) {
5771	n = expand_vars_to_list(&output, n, *argv);
5772	argv++;
5773	}
5774	debug_print_list("expand_variables", &output, n);
5775
5776	/* output.data (malloced in one block) gets returned in "list" */
5777	list = o_finalize_list(&output, n);
5778	debug_print_strings("expand_variables[1]", list);
5779	return list;
5780	}
5781
5782	static char **expand_strvec_to_strvec(char **argv)
5783	{
5784	return expand_variables(argv, EXP_FLAG_GLOB | EXP_FLAG_ESC_GLOB_CHARS);
5785	}
5786
5787	#if ENABLE_HUSH_BASH_COMPAT
5788	static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
5789	{
5790	return expand_variables(argv, EXP_FLAG_SINGLEWORD);
5791	}
5792	#endif
5793
5794	/* Used for expansion of right hand of assignments,
5795	* $((...)), heredocs, variable espansion parts.
5796	*
5797	* NB: should NOT do globbing!
5798	* "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*"
5799	*/
5800	static char *expand_string_to_string(const char *str, int do_unbackslash)
5801	{
5802	#if !ENABLE_HUSH_BASH_COMPAT
5803	const int do_unbackslash = 1;
5804	#endif
5805	char *argv[2], **list;
5806
5807	debug_printf_expand("string_to_string<='%s'\n", str);
5808	/* This is generally an optimization, but it also
5809	* handles "", which otherwise trips over !list[0] check below.
5810	* (is this ever happens that we actually get str="" here?)
5811	*/
5812	if (!strchr(str, SPECIAL_VAR_SYMBOL) && !strchr(str, '\\')) {
5813	//TODO: Can use on strings with \ too, just unbackslash() them?
5814	debug_printf_expand("string_to_string(fast)=>'%s'\n", str);
5815	return xstrdup(str);
5816	}
5817
5818	argv[0] = (char*)str;
5819	argv[1] = NULL;
5820	list = expand_variables(argv, do_unbackslash
5821	? EXP_FLAG_ESC_GLOB_CHARS | EXP_FLAG_SINGLEWORD
5822	: EXP_FLAG_SINGLEWORD
5823	);
5824	if (HUSH_DEBUG)
5825	if (!list[0] || list[1])
5826	bb_error_msg_and_die("BUG in varexp2");
5827	/* actually, just move string 2*sizeof(char*) bytes back */
5828	overlapping_strcpy((char*)list, list[0]);
5829	if (do_unbackslash)
5830	unbackslash((char*)list);
5831	debug_printf_expand("string_to_string=>'%s'\n", (char*)list);
5832	return (char*)list;
5833	}
5834
5835	/* Used for "eval" builtin */
5836	static char* expand_strvec_to_string(char **argv)
5837	{
5838	char **list;
5839
5840	list = expand_variables(argv, EXP_FLAG_SINGLEWORD);
5841	/* Convert all NULs to spaces */
5842	if (list[0]) {
5843	int n = 1;
5844	while (list[n]) {
5845	if (HUSH_DEBUG)
5846	if (list[n-1] + strlen(list[n-1]) + 1 != list[n])
5847	bb_error_msg_and_die("BUG in varexp3");
5848	/* bash uses ' ' regardless of $IFS contents */
5849	list[n][-1] = ' ';
5850	n++;
5851	}
5852	}
5853	overlapping_strcpy((char*)list, list[0] ? list[0] : "");
5854	debug_printf_expand("strvec_to_string='%s'\n", (char*)list);
5855	return (char*)list;
5856	}
5857
5858	static char **expand_assignments(char **argv, int count)
5859	{
5860	int i;
5861	char **p;
5862
5863	G.expanded_assignments = p = NULL;
5864	/* Expand assignments into one string each */
5865	for (i = 0; i < count; i++) {
5866	G.expanded_assignments = p = add_string_to_strings(p, expand_string_to_string(argv[i], /*unbackslash:*/ 1));
5867	}
5868	G.expanded_assignments = NULL;
5869	return p;
5870	}
5871
5872
5873	static void switch_off_special_sigs(unsigned mask)
5874	{
5875	unsigned sig = 0;
5876	while ((mask >>= 1) != 0) {
5877	sig++;
5878	if (!(mask & 1))
5879	continue;
5880	if (G.traps) {
5881	if (G.traps[sig] && !G.traps[sig][0])
5882	/* trap is '', has to remain SIG_IGN */
5883	continue;
5884	free(G.traps[sig]);
5885	G.traps[sig] = NULL;
5886	}
5887	/* We are here only if no trap or trap was not '' */
5888	install_sighandler(sig, SIG_DFL);
5889	}
5890	}
5891
5892	#if BB_MMU
5893	/* never called */
5894	void re_execute_shell(char ***to_free, const char *s,
5895	char *g_argv0, char **g_argv,
5896	char **builtin_argv) NORETURN;
5897
5898	static void reset_traps_to_defaults(void)
5899	{
5900	/* This function is always called in a child shell
5901	* after fork (not vfork, NOMMU doesn't use this function).
5902	*/
5903	unsigned sig;
5904	unsigned mask;
5905
5906	/* Child shells are not interactive.
5907	* SIGTTIN/SIGTTOU/SIGTSTP should not have special handling.
5908	* Testcase: (while :; do :; done) + ^Z should background.
5909	* Same goes for SIGTERM, SIGHUP, SIGINT.
5910	*/
5911	mask = (G.special_sig_mask & SPECIAL_INTERACTIVE_SIGS) | G_fatal_sig_mask;
5912	if (!G.traps && !mask)
5913	return; /* already no traps and no special sigs */
5914
5915	/* Switch off special sigs */
5916	switch_off_special_sigs(mask);
5917	#if ENABLE_HUSH_JOB
5918	G_fatal_sig_mask = 0;
5919	#endif
5920	G.special_sig_mask &= ~SPECIAL_INTERACTIVE_SIGS;
5921	/* SIGQUIT,SIGCHLD and maybe SPECIAL_JOBSTOP_SIGS
5922	* remain set in G.special_sig_mask */
5923
5924	if (!G.traps)
5925	return;
5926
5927	/* Reset all sigs to default except ones with empty traps */
5928	for (sig = 0; sig < NSIG; sig++) {
5929	if (!G.traps[sig])
5930	continue; /* no trap: nothing to do */
5931	if (!G.traps[sig][0])
5932	continue; /* empty trap: has to remain SIG_IGN */
5933	/* sig has non-empty trap, reset it: */
5934	free(G.traps[sig]);
5935	G.traps[sig] = NULL;
5936	/* There is no signal for trap 0 (EXIT) */
5937	if (sig == 0)
5938	continue;
5939	install_sighandler(sig, pick_sighandler(sig));
5940	}
5941	}
5942
5943	#else /* !BB_MMU */
5944
5945	static void re_execute_shell(char ***to_free, const char *s,
5946	char *g_argv0, char **g_argv,
5947	char **builtin_argv) NORETURN;
5948	static void re_execute_shell(char ***to_free, const char *s,
5949	char *g_argv0, char **g_argv,
5950	char **builtin_argv)
5951	{
5952	# define NOMMU_HACK_FMT ("-$%x:%x:%x:%x:%x:%llx" IF_HUSH_LOOPS(":%x"))
5953	/* delims + 2 * (number of bytes in printed hex numbers) */
5954	char param_buf[sizeof(NOMMU_HACK_FMT) + 2 * (sizeof(int)*6 + sizeof(long long)*1)];
5955	char *heredoc_argv[4];
5956	struct variable *cur;
5957	# if ENABLE_HUSH_FUNCTIONS
5958	struct function *funcp;
5959	# endif
5960	char **argv, **pp;
5961	unsigned cnt;
5962	unsigned long long empty_trap_mask;
5963
5964	if (!g_argv0) { /* heredoc */
5965	argv = heredoc_argv;
5966	argv[0] = (char *) G.argv0_for_re_execing;
5967	argv[1] = (char *) "-<";
5968	argv[2] = (char *) s;
5969	argv[3] = NULL;
5970	pp = &argv[3]; /* used as pointer to empty environment */
5971	goto do_exec;
5972	}
5973
5974	cnt = 0;
5975	pp = builtin_argv;
5976	if (pp) while (*pp++)
5977	cnt++;
5978
5979	empty_trap_mask = 0;
5980	if (G.traps) {
5981	int sig;
5982	for (sig = 1; sig < NSIG; sig++) {
5983	if (G.traps[sig] && !G.traps[sig][0])
5984	empty_trap_mask |= 1LL << sig;
5985	}
5986	}
5987
5988	sprintf(param_buf, NOMMU_HACK_FMT
5989	, (unsigned) G.root_pid
5990	, (unsigned) G.root_ppid
5991	, (unsigned) G.last_bg_pid
5992	, (unsigned) G.last_exitcode
5993	, cnt
5994	, empty_trap_mask
5995	IF_HUSH_LOOPS(, G.depth_of_loop)
5996	);
5997	# undef NOMMU_HACK_FMT
5998	/* 1:hush 2:-$<pid>:<pid>:<exitcode>:<etc...> <vars...> <funcs...>
5999	* 3:-c 4:<cmd> 5:<arg0> <argN...> 6:NULL
6000	*/
6001	cnt += 6;
6002	for (cur = G.top_var; cur; cur = cur->next) {
6003	if (!cur->flg_export || cur->flg_read_only)
6004	cnt += 2;
6005	}
6006	# if ENABLE_HUSH_FUNCTIONS
6007	for (funcp = G.top_func; funcp; funcp = funcp->next)
6008	cnt += 3;
6009	# endif
6010	pp = g_argv;
6011	while (*pp++)
6012	cnt++;
6013	*to_free = argv = pp = xzalloc(sizeof(argv[0]) * cnt);
6014	*pp++ = (char *) G.argv0_for_re_execing;
6015	*pp++ = param_buf;
6016	for (cur = G.top_var; cur; cur = cur->next) {
6017	if (strcmp(cur->varstr, hush_version_str) == 0)
6018	continue;
6019	if (cur->flg_read_only) {
6020	*pp++ = (char *) "-R";
6021	*pp++ = cur->varstr;
6022	} else if (!cur->flg_export) {
6023	*pp++ = (char *) "-V";
6024	*pp++ = cur->varstr;
6025	}
6026	}
6027	# if ENABLE_HUSH_FUNCTIONS
6028	for (funcp = G.top_func; funcp; funcp = funcp->next) {
6029	*pp++ = (char *) "-F";
6030	*pp++ = funcp->name;
6031	*pp++ = funcp->body_as_string;
6032	}
6033	# endif
6034	/* We can pass activated traps here. Say, -Tnn:trap_string
6035	*
6036	* However, POSIX says that subshells reset signals with traps
6037	* to SIG_DFL.
6038	* I tested bash-3.2 and it not only does that with true subshells
6039	* of the form ( list ), but with any forked children shells.
6040	* I set trap "echo W" WINCH; and then tried:
6041	*
6042	* { echo 1; sleep 20; echo 2; } &
6043	* while true; do echo 1; sleep 20; echo 2; break; done &
6044	* true | { echo 1; sleep 20; echo 2; } | cat
6045	*
6046	* In all these cases sending SIGWINCH to the child shell
6047	* did not run the trap. If I add trap "echo V" WINCH;
6048	* _inside_ group (just before echo 1), it works.
6049	*
6050	* I conclude it means we don't need to pass active traps here.
6051	*/
6052	*pp++ = (char *) "-c";
6053	*pp++ = (char *) s;
6054	if (builtin_argv) {
6055	while (*++builtin_argv)
6056	*pp++ = *builtin_argv;
6057	*pp++ = (char *) "";
6058	}
6059	*pp++ = g_argv0;
6060	while (*g_argv)
6061	*pp++ = *g_argv++;
6062	/* *pp = NULL; - is already there */
6063	pp = environ;
6064
6065	do_exec:
6066	debug_printf_exec("re_execute_shell pid:%d cmd:'%s'\n", getpid(), s);
6067	/* Don't propagate SIG_IGN to the child */
6068	if (SPECIAL_JOBSTOP_SIGS != 0)
6069	switch_off_special_sigs(G.special_sig_mask & SPECIAL_JOBSTOP_SIGS);
6070	execve(bb_busybox_exec_path, argv, pp);
6071	/* Fallback. Useful for init=/bin/hush usage etc */
6072	if (argv[0][0] == '/')
6073	execve(argv[0], argv, pp);
6074	xfunc_error_retval = 127;
6075	bb_error_msg_and_die("can't re-execute the shell");
6076	}
6077	#endif /* !BB_MMU */
6078
6079
6080	static int run_and_free_list(struct pipe *pi);
6081
6082	/* Executing from string: eval, sh -c '...'
6083	* or from file: /etc/profile, . file, sh <script>, sh (intereactive)
6084	* end_trigger controls how often we stop parsing
6085	* NUL: parse all, execute, return
6086	* ';': parse till ';' or newline, execute, repeat till EOF
6087	*/
6088	static void parse_and_run_stream(struct in_str *inp, int end_trigger)
6089	{
6090	/* Why we need empty flag?
6091	* An obscure corner case "false; ``; echo $?":
6092	* empty command in `` should still set $? to 0.
6093	* But we can't just set $? to 0 at the start,
6094	* this breaks "false; echo `echo $?`" case.
6095	*/
6096	bool empty = 1;
6097	while (1) {
6098	struct pipe *pipe_list;
6099
6100	#if ENABLE_HUSH_INTERACTIVE
6101	if (end_trigger == ';')
6102	inp->promptmode = 0; /* PS1 */
6103	#endif
6104	pipe_list = parse_stream(NULL, inp, end_trigger);
6105	if (!pipe_list || pipe_list == ERR_PTR) { /* EOF/error */
6106	/* If we are in "big" script
6107	* (not in `cmd` or something similar)...
6108	*/
6109	if (pipe_list == ERR_PTR && end_trigger == ';') {
6110	/* Discard cached input (rest of line) */
6111	int ch = inp->last_char;
6112	while (ch != EOF && ch != '\n') {
6113	//bb_error_msg("Discarded:'%c'", ch);
6114	ch = i_getch(inp);
6115	}
6116	/* Force prompt */
6117	inp->p = NULL;
6118	/* This stream isn't empty */
6119	empty = 0;
6120	continue;
6121	}
6122	if (!pipe_list && empty)
6123	G.last_exitcode = 0;
6124	break;
6125	}
6126	debug_print_tree(pipe_list, 0);
6127	debug_printf_exec("parse_and_run_stream: run_and_free_list\n");
6128	run_and_free_list(pipe_list);
6129	empty = 0;
6130	if (G_flag_return_in_progress == 1)
6131	break;
6132	}
6133	}
6134
6135	static void parse_and_run_string(const char *s)
6136	{
6137	struct in_str input;
6138	setup_string_in_str(&input, s);
6139	parse_and_run_stream(&input, '\0');
6140	}
6141
6142	static void parse_and_run_file(FILE *f)
6143	{
6144	struct in_str input;
6145	setup_file_in_str(&input, f);
6146	parse_and_run_stream(&input, ';');
6147	}
6148
6149	#if ENABLE_HUSH_TICK
6150	static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
6151	{
6152	pid_t pid;
6153	int channel[2];
6154	# if !BB_MMU
6155	char **to_free = NULL;
6156	# endif
6157
6158	xpipe(channel);
6159	pid = BB_MMU ? xfork() : xvfork();
6160	if (pid == 0) { /* child */
6161	disable_restore_tty_pgrp_on_exit();
6162	/* Process substitution is not considered to be usual
6163	* 'command execution'.
6164	* SUSv3 says ctrl-Z should be ignored, ctrl-C should not.
6165	*/
6166	bb_signals(0
6167	+ (1 << SIGTSTP)
6168	+ (1 << SIGTTIN)
6169	+ (1 << SIGTTOU)
6170	, SIG_IGN);
6171	CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
6172	close(channel[0]); /* NB: close _first_, then move fd! */
6173	xmove_fd(channel[1], 1);
6174	/* Prevent it from trying to handle ctrl-z etc */
6175	IF_HUSH_JOB(G.run_list_level = 1;)
6176	/* Awful hack for `trap` or $(trap).
6177	*
6178	* http://www.opengroup.org/onlinepubs/009695399/utilities/trap.html
6179	* contains an example where "trap" is executed in a subshell:
6180	*
6181	* save_traps=$(trap)
6182	* ...
6183	* eval "$save_traps"
6184	*
6185	* Standard does not say that "trap" in subshell shall print
6186	* parent shell's traps. It only says that its output
6187	* must have suitable form, but then, in the above example
6188	* (which is not supposed to be normative), it implies that.
6189	*
6190	* bash (and probably other shell) does implement it
6191	* (traps are reset to defaults, but "trap" still shows them),
6192	* but as a result, "trap" logic is hopelessly messed up:
6193	*
6194	* # trap
6195	* trap -- 'echo Ho' SIGWINCH <--- we have a handler
6196	* # (trap) <--- trap is in subshell - no output (correct, traps are reset)
6197	* # true | trap <--- trap is in subshell - no output (ditto)
6198	* # echo `true | trap` <--- in subshell - output (but traps are reset!)
6199	* trap -- 'echo Ho' SIGWINCH
6200	* # echo `(trap)` <--- in subshell in subshell - output
6201	* trap -- 'echo Ho' SIGWINCH
6202	* # echo `true | (trap)` <--- in subshell in subshell in subshell - output!
6203	* trap -- 'echo Ho' SIGWINCH
6204	*
6205	* The rules when to forget and when to not forget traps
6206	* get really complex and nonsensical.
6207	*
6208	* Our solution: ONLY bare $(trap) or `trap` is special.
6209	*/
6210	s = skip_whitespace(s);
6211	if (is_prefixed_with(s, "trap")
6212	&& skip_whitespace(s + 4)[0] == '\0'
6213	) {
6214	static const char *const argv[] = { NULL, NULL };
6215	builtin_trap((char**)argv);
6216	fflush_all(); /* important */
6217	_exit(0);
6218	}
6219	# if BB_MMU
6220	reset_traps_to_defaults();
6221	parse_and_run_string(s);
6222	_exit(G.last_exitcode);
6223	# else
6224	/* We re-execute after vfork on NOMMU. This makes this script safe:
6225	* yes "0123456789012345678901234567890" | dd bs=32 count=64k >BIG
6226	* huge=`cat BIG` # was blocking here forever
6227	* echo OK
6228	*/
6229	re_execute_shell(&to_free,
6230	s,
6231	G.global_argv[0],
6232	G.global_argv + 1,
6233	NULL);
6234	# endif
6235	}
6236
6237	/* parent */
6238	*pid_p = pid;
6239	# if ENABLE_HUSH_FAST
6240	G.count_SIGCHLD++;
6241	//bb_error_msg("[%d] fork in generate_stream_from_string:"
6242	// " G.count_SIGCHLD:%d G.handled_SIGCHLD:%d",
6243	// getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
6244	# endif
6245	enable_restore_tty_pgrp_on_exit();
6246	# if !BB_MMU
6247	free(to_free);
6248	# endif
6249	close(channel[1]);
6250	return remember_FILE(xfdopen_for_read(channel[0]));
6251	}
6252
6253	/* Return code is exit status of the process that is run. */
6254	static int process_command_subs(o_string *dest, const char *s)
6255	{
6256	FILE *fp;
6257	struct in_str pipe_str;
6258	pid_t pid;
6259	int status, ch, eol_cnt;
6260
6261	fp = generate_stream_from_string(s, &pid);
6262
6263	/* Now send results of command back into original context */
6264	setup_file_in_str(&pipe_str, fp);
6265	eol_cnt = 0;
6266	while ((ch = i_getch(&pipe_str)) != EOF) {
6267	if (ch == '\n') {
6268	eol_cnt++;
6269	continue;
6270	}
6271	while (eol_cnt) {
6272	o_addchr(dest, '\n');
6273	eol_cnt--;
6274	}
6275	o_addQchr(dest, ch);
6276	}
6277
6278	debug_printf("done reading from `cmd` pipe, closing it\n");
6279	fclose_and_forget(fp);
6280	/* We need to extract exitcode. Test case
6281	* "true; echo `sleep 1; false` $?"
6282	* should print 1 */
6283	safe_waitpid(pid, &status, 0);
6284	debug_printf("child exited. returning its exitcode:%d\n", WEXITSTATUS(status));
6285	return WEXITSTATUS(status);
6286	}
6287	#endif /* ENABLE_HUSH_TICK */
6288
6289
6290	static void setup_heredoc(struct redir_struct *redir)
6291	{
6292	struct fd_pair pair;
6293	pid_t pid;
6294	int len, written;
6295	/* the _body_ of heredoc (misleading field name) */
6296	const char *heredoc = redir->rd_filename;
6297	char *expanded;
6298	#if !BB_MMU
6299	char **to_free;
6300	#endif
6301
6302	expanded = NULL;
6303	if (!(redir->rd_dup & HEREDOC_QUOTED)) {
6304	expanded = encode_then_expand_string(heredoc, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
6305	if (expanded)
6306	heredoc = expanded;
6307	}
6308	len = strlen(heredoc);
6309
6310	close(redir->rd_fd); /* often saves dup2+close in xmove_fd */
6311	xpiped_pair(pair);
6312	xmove_fd(pair.rd, redir->rd_fd);
6313
6314	/* Try writing without forking. Newer kernels have
6315	* dynamically growing pipes. Must use non-blocking write! */
6316	ndelay_on(pair.wr);
6317	while (1) {
6318	written = write(pair.wr, heredoc, len);
6319	if (written <= 0)
6320	break;
6321	len -= written;
6322	if (len == 0) {
6323	close(pair.wr);
6324	free(expanded);
6325	return;
6326	}
6327	heredoc += written;
6328	}
6329	ndelay_off(pair.wr);
6330
6331	/* Okay, pipe buffer was not big enough */
6332	/* Note: we must not create a stray child (bastard? :)
6333	* for the unsuspecting parent process. Child creates a grandchild
6334	* and exits before parent execs the process which consumes heredoc
6335	* (that exec happens after we return from this function) */
6336	#if !BB_MMU
6337	to_free = NULL;
6338	#endif
6339	pid = xvfork();
6340	if (pid == 0) {
6341	/* child */
6342	disable_restore_tty_pgrp_on_exit();
6343	pid = BB_MMU ? xfork() : xvfork();
6344	if (pid != 0)
6345	_exit(0);
6346	/* grandchild */
6347	close(redir->rd_fd); /* read side of the pipe */
6348	#if BB_MMU
6349	full_write(pair.wr, heredoc, len); /* may loop or block */
6350	_exit(0);
6351	#else
6352	/* Delegate blocking writes to another process */
6353	xmove_fd(pair.wr, STDOUT_FILENO);
6354	re_execute_shell(&to_free, heredoc, NULL, NULL, NULL);
6355	#endif
6356	}
6357	/* parent */
6358	#if ENABLE_HUSH_FAST
6359	G.count_SIGCHLD++;
6360	//bb_error_msg("[%d] fork in setup_heredoc: G.count_SIGCHLD:%d G.handled_SIGCHLD:%d", getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
6361	#endif
6362	enable_restore_tty_pgrp_on_exit();
6363	#if !BB_MMU
6364	free(to_free);
6365	#endif
6366	close(pair.wr);
6367	free(expanded);
6368	wait(NULL); /* wait till child has died */
6369	}
6370
6371	/* fd: redirect wants this fd to be used (e.g. 3>file).
6372	* Move all conflicting internally used fds,
6373	* and remember them so that we can restore them later.
6374	*/
6375	static int save_fds_on_redirect(int fd, int squirrel[3])
6376	{
6377	if (squirrel) {
6378	/* Handle redirects of fds 0,1,2 */
6379
6380	/* If we collide with an already moved stdio fd... */
6381	if (fd == squirrel[0]) {
6382	squirrel[0] = xdup_and_close(squirrel[0], F_DUPFD);
6383	return 1;
6384	}
6385	if (fd == squirrel[1]) {
6386	squirrel[1] = xdup_and_close(squirrel[1], F_DUPFD);
6387	return 1;
6388	}
6389	if (fd == squirrel[2]) {
6390	squirrel[2] = xdup_and_close(squirrel[2], F_DUPFD);
6391	return 1;
6392	}
6393	/* If we are about to redirect stdio fd, and did not yet move it... */
6394	if (fd <= 2 && squirrel[fd] < 0) {
6395	/* We avoid taking stdio fds */
6396	squirrel[fd] = fcntl(fd, F_DUPFD, 10);
6397	if (squirrel[fd] < 0 && errno != EBADF)
6398	xfunc_die();
6399	return 0; /* "we did not close fd" */
6400	}
6401	}
6402
6403	#if ENABLE_HUSH_INTERACTIVE
6404	if (fd != 0 && fd == G.interactive_fd) {
6405	G.interactive_fd = xdup_and_close(G.interactive_fd, F_DUPFD_CLOEXEC);
6406	return 1;
6407	}
6408	#endif
6409
6410	/* Are we called from setup_redirects(squirrel==NULL)? Two cases:
6411	* (1) Redirect in a forked child. No need to save FILEs' fds,
6412	* we aren't going to use them anymore, ok to trash.
6413	* (2) "exec 3>FILE". Bummer. We can save FILEs' fds,
6414	* but how are we doing to use them?
6415	* "fileno(fd) = new_fd" can't be done.
6416	*/
6417	if (!squirrel)
6418	return 0;
6419
6420	return save_FILEs_on_redirect(fd);
6421	}
6422
6423	static void restore_redirects(int squirrel[3])
6424	{
6425	int i, fd;
6426	for (i = 0; i <= 2; i++) {
6427	fd = squirrel[i];
6428	if (fd != -1) {
6429	/* We simply die on error */
6430	xmove_fd(fd, i);
6431	}
6432	}
6433
6434	/* Moved G.interactive_fd stays on new fd, not doing anything for it */
6435
6436	restore_redirected_FILEs();
6437	}
6438
6439	/* squirrel != NULL means we squirrel away copies of stdin, stdout,
6440	* and stderr if they are redirected. */
6441	static int setup_redirects(struct command *prog, int squirrel[])
6442	{
6443	int openfd, mode;
6444	struct redir_struct *redir;
6445
6446	for (redir = prog->redirects; redir; redir = redir->next) {
6447	if (redir->rd_type == REDIRECT_HEREDOC2) {
6448	/* "rd_fd<<HERE" case */
6449	save_fds_on_redirect(redir->rd_fd, squirrel);
6450	/* for REDIRECT_HEREDOC2, rd_filename holds _contents_
6451	* of the heredoc */
6452	debug_printf_parse("set heredoc '%s'\n",
6453	redir->rd_filename);
6454	setup_heredoc(redir);
6455	continue;
6456	}
6457
6458	if (redir->rd_dup == REDIRFD_TO_FILE) {
6459	/* "rd_fd<*>file" case (<*> is <,>,>>,<>) */
6460	char *p;
6461	if (redir->rd_filename == NULL) {
6462	/*
6463	* Examples:
6464	* "cmd >" (no filename)
6465	* "cmd > <file" (2nd redirect starts too early)
6466	*/
6467	die_if_script("syntax error: %s", "invalid redirect");
6468	continue;
6469	}
6470	mode = redir_table[redir->rd_type].mode;
6471	p = expand_string_to_string(redir->rd_filename, /*unbackslash:*/ 1);
6472	openfd = open_or_warn(p, mode);
6473	free(p);
6474	if (openfd < 0) {
6475	/* Error message from open_or_warn can be lost
6476	* if stderr has been redirected, but bash
6477	* and ash both lose it as well
6478	* (though zsh doesn't!)
6479	*/
6480	return 1;
6481	}
6482	} else {
6483	/* "rd_fd<*>rd_dup" or "rd_fd<*>-" cases */
6484	openfd = redir->rd_dup;
6485	}
6486
6487	if (openfd != redir->rd_fd) {
6488	int closed = save_fds_on_redirect(redir->rd_fd, squirrel);
6489	if (openfd == REDIRFD_CLOSE) {
6490	/* "rd_fd >&-" means "close me" */
6491	if (!closed) {
6492	/* ^^^ optimization: saving may already
6493	* have closed it. If not... */
6494	close(redir->rd_fd);
6495	}
6496	} else {
6497	xdup2(openfd, redir->rd_fd);
6498	if (redir->rd_dup == REDIRFD_TO_FILE)
6499	/* "rd_fd > FILE" */
6500	close(openfd);
6501	/* else: "rd_fd > rd_dup" */
6502	}
6503	}
6504	}
6505	return 0;
6506	}
6507
6508	static char *find_in_path(const char *arg)
6509	{
6510	char *ret = NULL;
6511	const char *PATH = get_local_var_value("PATH");
6512
6513	if (!PATH)
6514	return NULL;
6515
6516	while (1) {
6517	const char *end = strchrnul(PATH, ':');
6518	int sz = end - PATH; /* must be int! */
6519
6520	free(ret);
6521	if (sz != 0) {
6522	ret = xasprintf("%.*s/%s", sz, PATH, arg);
6523	} else {
6524	/* We have xxx::yyyy in $PATH,
6525	* it means "use current dir" */
6526	ret = xstrdup(arg);
6527	}
6528	if (access(ret, F_OK) == 0)
6529	break;
6530
6531	if (*end == '\0') {
6532	free(ret);
6533	return NULL;
6534	}
6535	PATH = end + 1;
6536	}
6537
6538	return ret;
6539	}
6540
6541	static const struct built_in_command *find_builtin_helper(const char *name,
6542	const struct built_in_command *x,
6543	const struct built_in_command *end)
6544	{
6545	while (x != end) {
6546	if (strcmp(name, x->b_cmd) != 0) {
6547	x++;
6548	continue;
6549	}
6550	debug_printf_exec("found builtin '%s'\n", name);
6551	return x;
6552	}
6553	return NULL;
6554	}
6555	static const struct built_in_command *find_builtin1(const char *name)
6556	{
6557	return find_builtin_helper(name, bltins1, &bltins1[ARRAY_SIZE(bltins1)]);
6558	}
6559	static const struct built_in_command *find_builtin(const char *name)
6560	{
6561	const struct built_in_command *x = find_builtin1(name);
6562	if (x)
6563	return x;
6564	return find_builtin_helper(name, bltins2, &bltins2[ARRAY_SIZE(bltins2)]);
6565	}
6566
6567	#if ENABLE_HUSH_FUNCTIONS
6568	static struct function **find_function_slot(const char *name)
6569	{
6570	struct function **funcpp = &G.top_func;
6571	while (*funcpp) {
6572	if (strcmp(name, (*funcpp)->name) == 0) {
6573	break;
6574	}
6575	funcpp = &(*funcpp)->next;
6576	}
6577	return funcpp;
6578	}
6579
6580	static const struct function *find_function(const char *name)
6581	{
6582	const struct function *funcp = *find_function_slot(name);
6583	if (funcp)
6584	debug_printf_exec("found function '%s'\n", name);
6585	return funcp;
6586	}
6587
6588	/* Note: takes ownership on name ptr */
6589	static struct function *new_function(char *name)
6590	{
6591	struct function **funcpp = find_function_slot(name);
6592	struct function *funcp = *funcpp;
6593
6594	if (funcp != NULL) {
6595	struct command *cmd = funcp->parent_cmd;
6596	debug_printf_exec("func %p parent_cmd %p\n", funcp, cmd);
6597	if (!cmd) {
6598	debug_printf_exec("freeing & replacing function '%s'\n", funcp->name);
6599	free(funcp->name);
6600	/* Note: if !funcp->body, do not free body_as_string!
6601	* This is a special case of "-F name body" function:
6602	* body_as_string was not malloced! */
6603	if (funcp->body) {
6604	free_pipe_list(funcp->body);
6605	# if !BB_MMU
6606	free(funcp->body_as_string);
6607	# endif
6608	}
6609	} else {
6610	debug_printf_exec("reinserting in tree & replacing function '%s'\n", funcp->name);
6611	cmd->argv[0] = funcp->name;
6612	cmd->group = funcp->body;
6613	# if !BB_MMU
6614	cmd->group_as_string = funcp->body_as_string;
6615	# endif
6616	}
6617	} else {
6618	debug_printf_exec("remembering new function '%s'\n", name);
6619	funcp = *funcpp = xzalloc(sizeof(*funcp));
6620	/*funcp->next = NULL;*/
6621	}
6622
6623	funcp->name = name;
6624	return funcp;
6625	}
6626
6627	static void unset_func(const char *name)
6628	{
6629	struct function **funcpp = find_function_slot(name);
6630	struct function *funcp = *funcpp;
6631
6632	if (funcp != NULL) {
6633	debug_printf_exec("freeing function '%s'\n", funcp->name);
6634	*funcpp = funcp->next;
6635	/* funcp is unlinked now, deleting it.
6636	* Note: if !funcp->body, the function was created by
6637	* "-F name body", do not free ->body_as_string
6638	* and ->name as they were not malloced. */
6639	if (funcp->body) {
6640	free_pipe_list(funcp->body);
6641	free(funcp->name);
6642	# if !BB_MMU
6643	free(funcp->body_as_string);
6644	# endif
6645	}
6646	free(funcp);
6647	}
6648	}
6649
6650	# if BB_MMU
6651	#define exec_function(to_free, funcp, argv) \
6652	exec_function(funcp, argv)
6653	# endif
6654	static void exec_function(char ***to_free,
6655	const struct function *funcp,
6656	char **argv) NORETURN;
6657	static void exec_function(char ***to_free,
6658	const struct function *funcp,
6659	char **argv)
6660	{
6661	# if BB_MMU
6662	int n = 1;
6663
6664	argv[0] = G.global_argv[0];
6665	G.global_argv = argv;
6666	while (*++argv)
6667	n++;
6668	G.global_argc = n;
6669	/* On MMU, funcp->body is always non-NULL */
6670	n = run_list(funcp->body);
6671	fflush_all();
6672	_exit(n);
6673	# else
6674	re_execute_shell(to_free,
6675	funcp->body_as_string,
6676	G.global_argv[0],
6677	argv + 1,
6678	NULL);
6679	# endif
6680	}
6681
6682	static int run_function(const struct function *funcp, char **argv)
6683	{
6684	int rc;
6685	save_arg_t sv;
6686	smallint sv_flg;
6687
6688	save_and_replace_G_args(&sv, argv);
6689
6690	/* "we are in function, ok to use return" */
6691	sv_flg = G_flag_return_in_progress;
6692	G_flag_return_in_progress = -1;
6693	# if ENABLE_HUSH_LOCAL
6694	G.func_nest_level++;
6695	# endif
6696
6697	/* On MMU, funcp->body is always non-NULL */
6698	# if !BB_MMU
6699	if (!funcp->body) {
6700	/* Function defined by -F */
6701	parse_and_run_string(funcp->body_as_string);
6702	rc = G.last_exitcode;
6703	} else
6704	# endif
6705	{
6706	rc = run_list(funcp->body);
6707	}
6708
6709	# if ENABLE_HUSH_LOCAL
6710	{
6711	struct variable *var;
6712	struct variable **var_pp;
6713
6714	var_pp = &G.top_var;
6715	while ((var = *var_pp) != NULL) {
6716	if (var->func_nest_level < G.func_nest_level) {
6717	var_pp = &var->next;
6718	continue;
6719	}
6720	/* Unexport */
6721	if (var->flg_export)
6722	bb_unsetenv(var->varstr);
6723	/* Remove from global list */
6724	*var_pp = var->next;
6725	/* Free */
6726	if (!var->max_len)
6727	free(var->varstr);
6728	free(var);
6729	}
6730	G.func_nest_level--;
6731	}
6732	# endif
6733	G_flag_return_in_progress = sv_flg;
6734
6735	restore_G_args(&sv, argv);
6736
6737	return rc;
6738	}
6739	#endif /* ENABLE_HUSH_FUNCTIONS */
6740
6741
6742	#if BB_MMU
6743	#define exec_builtin(to_free, x, argv) \
6744	exec_builtin(x, argv)
6745	#else
6746	#define exec_builtin(to_free, x, argv) \
6747	exec_builtin(to_free, argv)
6748	#endif
6749	static void exec_builtin(char ***to_free,
6750	const struct built_in_command *x,
6751	char **argv) NORETURN;
6752	static void exec_builtin(char ***to_free,
6753	const struct built_in_command *x,
6754	char **argv)
6755	{
6756	#if BB_MMU
6757	int rcode;
6758	fflush_all();
6759	rcode = x->b_function(argv);
6760	fflush_all();
6761	_exit(rcode);
6762	#else
6763	fflush_all();
6764	/* On NOMMU, we must never block!
6765	* Example: { sleep 99 | read line; } & echo Ok
6766	*/
6767	re_execute_shell(to_free,
6768	argv[0],
6769	G.global_argv[0],
6770	G.global_argv + 1,
6771	argv);
6772	#endif
6773	}
6774
6775
6776	static void execvp_or_die(char **argv) NORETURN;
6777	static void execvp_or_die(char **argv)
6778	{
6779	int e;
6780	debug_printf_exec("execing '%s'\n", argv[0]);
6781	/* Don't propagate SIG_IGN to the child */
6782	if (SPECIAL_JOBSTOP_SIGS != 0)
6783	switch_off_special_sigs(G.special_sig_mask & SPECIAL_JOBSTOP_SIGS);
6784	execvp(argv[0], argv);
6785	e = 2;
6786	if (errno == EACCES) e = 126;
6787	if (errno == ENOENT) e = 127;
6788	bb_perror_msg("can't execute '%s'", argv[0]);
6789	_exit(e);
6790	}
6791
6792	#if ENABLE_HUSH_MODE_X
6793	static void dump_cmd_in_x_mode(char **argv)
6794	{
6795	if (G_x_mode && argv) {
6796	/* We want to output the line in one write op */
6797	char *buf, *p;
6798	int len;
6799	int n;
6800
6801	len = 3;
6802	n = 0;
6803	while (argv[n])
6804	len += strlen(argv[n++]) + 1;
6805	buf = xmalloc(len);
6806	buf[0] = '+';
6807	p = buf + 1;
6808	n = 0;
6809	while (argv[n])
6810	p += sprintf(p, " %s", argv[n++]);
6811	*p++ = '\n';
6812	*p = '\0';
6813	fputs(buf, stderr);
6814	free(buf);
6815	}
6816	}
6817	#else
6818	# define dump_cmd_in_x_mode(argv) ((void)0)
6819	#endif
6820
6821	#if BB_MMU
6822	#define pseudo_exec_argv(nommu_save, argv, assignment_cnt, argv_expanded) \
6823	pseudo_exec_argv(argv, assignment_cnt, argv_expanded)
6824	#define pseudo_exec(nommu_save, command, argv_expanded) \
6825	pseudo_exec(command, argv_expanded)
6826	#endif
6827
6828	/* Called after [v]fork() in run_pipe, or from builtin_exec.
6829	* Never returns.
6830	* Don't exit() here. If you don't exec, use _exit instead.
6831	* The at_exit handlers apparently confuse the calling process,
6832	* in particular stdin handling. Not sure why? -- because of vfork! (vda)
6833	*/
6834	static void pseudo_exec_argv(nommu_save_t *nommu_save,
6835	char **argv, int assignment_cnt,
6836	char **argv_expanded) NORETURN;
6837	static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
6838	char **argv, int assignment_cnt,
6839	char **argv_expanded)
6840	{
6841	char **new_env;
6842
6843	new_env = expand_assignments(argv, assignment_cnt);
6844	dump_cmd_in_x_mode(new_env);
6845
6846	if (!argv[assignment_cnt]) {
6847	/* Case when we are here: ... | var=val | ...
6848	* (note that we do not exit early, i.e., do not optimize out
6849	* expand_assignments(): think about ... | var=`sleep 1` | ...
6850	*/
6851	free_strings(new_env);
6852	_exit(EXIT_SUCCESS);
6853	}
6854
6855	#if BB_MMU
6856	set_vars_and_save_old(new_env);
6857	free(new_env); /* optional */
6858	/* we can also destroy set_vars_and_save_old's return value,
6859	* to save memory */
6860	#else
6861	nommu_save->new_env = new_env;
6862	nommu_save->old_vars = set_vars_and_save_old(new_env);
6863	#endif
6864
6865	if (argv_expanded) {
6866	argv = argv_expanded;
6867	} else {
6868	argv = expand_strvec_to_strvec(argv + assignment_cnt);
6869	#if !BB_MMU
6870	nommu_save->argv = argv;
6871	#endif
6872	}
6873	dump_cmd_in_x_mode(argv);
6874
6875	#if ENABLE_FEATURE_SH_STANDALONE || BB_MMU
6876	if (strchr(argv[0], '/') != NULL)
6877	goto skip;
6878	#endif
6879
6880	/* Check if the command matches any of the builtins.
6881	* Depending on context, this might be redundant. But it's
6882	* easier to waste a few CPU cycles than it is to figure out
6883	* if this is one of those cases.
6884	*/
6885	{
6886	/* On NOMMU, it is more expensive to re-execute shell
6887	* just in order to run echo or test builtin.
6888	* It's better to skip it here and run corresponding
6889	* non-builtin later. */
6890	const struct built_in_command *x;
6891	x = BB_MMU ? find_builtin(argv[0]) : find_builtin1(argv[0]);
6892	if (x) {
6893	exec_builtin(&nommu_save->argv_from_re_execing, x, argv);
6894	}
6895	}
6896	#if ENABLE_HUSH_FUNCTIONS
6897	/* Check if the command matches any functions */
6898	{
6899	const struct function *funcp = find_function(argv[0]);
6900	if (funcp) {
6901	exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
6902	}
6903	}
6904	#endif
6905
6906	#if ENABLE_FEATURE_SH_STANDALONE
6907	/* Check if the command matches any busybox applets */
6908	{
6909	int a = find_applet_by_name(argv[0]);
6910	if (a >= 0) {
6911	# if BB_MMU /* see above why on NOMMU it is not allowed */
6912	if (APPLET_IS_NOEXEC(a)) {
6913	/* Do not leak open fds from opened script files etc */
6914	close_all_FILE_list();
6915	debug_printf_exec("running applet '%s'\n", argv[0]);
6916	run_applet_no_and_exit(a, argv);
6917	}
6918	# endif
6919	/* Re-exec ourselves */
6920	debug_printf_exec("re-execing applet '%s'\n", argv[0]);
6921	/* Don't propagate SIG_IGN to the child */
6922	if (SPECIAL_JOBSTOP_SIGS != 0)
6923	switch_off_special_sigs(G.special_sig_mask & SPECIAL_JOBSTOP_SIGS);
6924	execv(bb_busybox_exec_path, argv);
6925	/* If they called chroot or otherwise made the binary no longer
6926	* executable, fall through */
6927	}
6928	}
6929	#endif
6930
6931	#if ENABLE_FEATURE_SH_STANDALONE || BB_MMU
6932	skip:
6933	#endif
6934	execvp_or_die(argv);
6935	}
6936
6937	/* Called after [v]fork() in run_pipe
6938	*/
6939	static void pseudo_exec(nommu_save_t *nommu_save,
6940	struct command *command,
6941	char **argv_expanded) NORETURN;
6942	static void pseudo_exec(nommu_save_t *nommu_save,
6943	struct command *command,
6944	char **argv_expanded)
6945	{
6946	if (command->argv) {
6947	pseudo_exec_argv(nommu_save, command->argv,
6948	command->assignment_cnt, argv_expanded);
6949	}
6950
6951	if (command->group) {
6952	/* Cases when we are here:
6953	* ( list )
6954	* { list } &
6955	* ... | ( list ) | ...
6956	* ... | { list } | ...
6957	*/
6958	#if BB_MMU
6959	int rcode;
6960	debug_printf_exec("pseudo_exec: run_list\n");
6961	reset_traps_to_defaults();
6962	rcode = run_list(command->group);
6963	/* OK to leak memory by not calling free_pipe_list,
6964	* since this process is about to exit */
6965	_exit(rcode);
6966	#else
6967	re_execute_shell(&nommu_save->argv_from_re_execing,
6968	command->group_as_string,
6969	G.global_argv[0],
6970	G.global_argv + 1,
6971	NULL);
6972	#endif
6973	}
6974
6975	/* Case when we are here: ... | >file */
6976	debug_printf_exec("pseudo_exec'ed null command\n");
6977	_exit(EXIT_SUCCESS);
6978	}
6979
6980	#if ENABLE_HUSH_JOB
6981	static const char *get_cmdtext(struct pipe *pi)
6982	{
6983	char **argv;
6984	char *p;
6985	int len;
6986
6987	/* This is subtle. ->cmdtext is created only on first backgrounding.
6988	* (Think "cat, <ctrl-z>, fg, <ctrl-z>, fg, <ctrl-z>...." here...)
6989	* On subsequent bg argv is trashed, but we won't use it */
6990	if (pi->cmdtext)
6991	return pi->cmdtext;
6992
6993	argv = pi->cmds[0].argv;
6994	if (!argv) {
6995	pi->cmdtext = xzalloc(1);
6996	return pi->cmdtext;
6997	}
6998	len = 0;
6999	do {
7000	len += strlen(*argv) + 1;
7001	} while (*++argv);
7002	p = xmalloc(len);
7003	pi->cmdtext = p;
7004	argv = pi->cmds[0].argv;
7005	do {
7006	p = stpcpy(p, *argv);
7007	*p++ = ' ';
7008	} while (*++argv);
7009	p[-1] = '\0';
7010	return pi->cmdtext;
7011	}
7012
7013	static void insert_bg_job(struct pipe *pi)
7014	{
7015	struct pipe *job, **jobp;
7016	int i;
7017
7018	/* Linear search for the ID of the job to use */
7019	pi->jobid = 1;
7020	for (job = G.job_list; job; job = job->next)
7021	if (job->jobid >= pi->jobid)
7022	pi->jobid = job->jobid + 1;
7023
7024	/* Add job to the list of running jobs */
7025	jobp = &G.job_list;
7026	while ((job = *jobp) != NULL)
7027	jobp = &job->next;
7028	job = *jobp = xmalloc(sizeof(*job));
7029
7030	*job = *pi; /* physical copy */
7031	job->next = NULL;
7032	job->cmds = xzalloc(sizeof(pi->cmds[0]) * pi->num_cmds);
7033	/* Cannot copy entire pi->cmds[] vector! This causes double frees */
7034	for (i = 0; i < pi->num_cmds; i++) {
7035	job->cmds[i].pid = pi->cmds[i].pid;
7036	/* all other fields are not used and stay zero */
7037	}
7038	job->cmdtext = xstrdup(get_cmdtext(pi));
7039
7040	if (G_interactive_fd)
7041	printf("[%d] %d %s\n", job->jobid, job->cmds[0].pid, job->cmdtext);
7042	G.last_jobid = job->jobid;
7043	}
7044
7045	static void remove_bg_job(struct pipe *pi)
7046	{
7047	struct pipe *prev_pipe;
7048
7049	if (pi == G.job_list) {
7050	G.job_list = pi->next;
7051	} else {
7052	prev_pipe = G.job_list;
7053	while (prev_pipe->next != pi)
7054	prev_pipe = prev_pipe->next;
7055	prev_pipe->next = pi->next;
7056	}
7057	if (G.job_list)
7058	G.last_jobid = G.job_list->jobid;
7059	else
7060	G.last_jobid = 0;
7061	}
7062
7063	/* Remove a backgrounded job */
7064	static void delete_finished_bg_job(struct pipe *pi)
7065	{
7066	remove_bg_job(pi);
7067	free_pipe(pi);
7068	}
7069	#endif /* JOB */
7070
7071	static int job_exited_or_stopped(struct pipe *pi)
7072	{
7073	int rcode, i;
7074
7075	if (pi->alive_cmds != pi->stopped_cmds)
7076	return -1;
7077
7078	/* All processes in fg pipe have exited or stopped */
7079	rcode = 0;
7080	i = pi->num_cmds;
7081	while (--i >= 0) {
7082	rcode = pi->cmds[i].cmd_exitcode;
7083	/* usually last process gives overall exitstatus,
7084	* but with "set -o pipefail", last *failed* process does */
7085	if (G.o_opt[OPT_O_PIPEFAIL] == 0 || rcode != 0)
7086	break;
7087	}
7088	IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
7089	return rcode;
7090	}
7091
7092	static int process_wait_result(struct pipe *fg_pipe, pid_t childpid, int status)
7093	{
7094	#if ENABLE_HUSH_JOB
7095	struct pipe *pi;
7096	#endif
7097	int i, dead;
7098
7099	dead = WIFEXITED(status) || WIFSIGNALED(status);
7100
7101	#if DEBUG_JOBS
7102	if (WIFSTOPPED(status))
7103	debug_printf_jobs("pid %d stopped by sig %d (exitcode %d)\n",
7104	childpid, WSTOPSIG(status), WEXITSTATUS(status));
7105	if (WIFSIGNALED(status))
7106	debug_printf_jobs("pid %d killed by sig %d (exitcode %d)\n",
7107	childpid, WTERMSIG(status), WEXITSTATUS(status));
7108	if (WIFEXITED(status))
7109	debug_printf_jobs("pid %d exited, exitcode %d\n",
7110	childpid, WEXITSTATUS(status));
7111	#endif
7112	/* Were we asked to wait for a fg pipe? */
7113	if (fg_pipe) {
7114	i = fg_pipe->num_cmds;
7115
7116	while (--i >= 0) {
7117	int rcode;
7118
7119	debug_printf_jobs("check pid %d\n", fg_pipe->cmds[i].pid);
7120	if (fg_pipe->cmds[i].pid != childpid)
7121	continue;
7122	if (dead) {
7123	int ex;
7124	fg_pipe->cmds[i].pid = 0;
7125	fg_pipe->alive_cmds--;
7126	ex = WEXITSTATUS(status);
7127	/* bash prints killer signal's name for *last*
7128	* process in pipe (prints just newline for SIGINT/SIGPIPE).
7129	* Mimic this. Example: "sleep 5" + (^\ or kill -QUIT)
7130	*/
7131	if (WIFSIGNALED(status)) {
7132	int sig = WTERMSIG(status);
7133	if (i == fg_pipe->num_cmds-1)
7134	/* TODO: use strsignal() instead for bash compat? but that's bloat... */
7135	puts(sig == SIGINT || sig == SIGPIPE ? "" : get_signame(sig));
7136	/* TODO: if (WCOREDUMP(status)) + " (core dumped)"; */
7137	/* TODO: MIPS has 128 sigs (1..128), what if sig==128 here?
7138	* Maybe we need to use sig | 128? */
7139	ex = sig + 128;
7140	}
7141	fg_pipe->cmds[i].cmd_exitcode = ex;
7142	} else {
7143	fg_pipe->stopped_cmds++;
7144	}
7145	debug_printf_jobs("fg_pipe: alive_cmds %d stopped_cmds %d\n",
7146	fg_pipe->alive_cmds, fg_pipe->stopped_cmds);
7147	rcode = job_exited_or_stopped(fg_pipe);
7148	if (rcode >= 0) {
7149	/* Note: *non-interactive* bash does not continue if all processes in fg pipe
7150	* are stopped. Testcase: "cat | cat" in a script (not on command line!)
7151	* and "killall -STOP cat" */
7152	if (G_interactive_fd) {
7153	#if ENABLE_HUSH_JOB
7154	if (fg_pipe->alive_cmds != 0)
7155	insert_bg_job(fg_pipe);
7156	#endif
7157	return rcode;
7158	}
7159	if (fg_pipe->alive_cmds == 0)
7160	return rcode;
7161	}
7162	/* There are still running processes in the fg_pipe */
7163	return -1;
7164	}
7165	/* It wasnt in fg_pipe, look for process in bg pipes */
7166	}
7167
7168	#if ENABLE_HUSH_JOB
7169	/* We were asked to wait for bg or orphaned children */
7170	/* No need to remember exitcode in this case */
7171	for (pi = G.job_list; pi; pi = pi->next) {
7172	for (i = 0; i < pi->num_cmds; i++) {
7173	if (pi->cmds[i].pid == childpid)
7174	goto found_pi_and_prognum;
7175	}
7176	}
7177	/* Happens when shell is used as init process (init=/bin/sh) */
7178	debug_printf("checkjobs: pid %d was not in our list!\n", childpid);
7179	return -1; /* this wasn't a process from fg_pipe */
7180
7181	found_pi_and_prognum:
7182	if (dead) {
7183	/* child exited */
7184	pi->cmds[i].pid = 0;
7185	pi->cmds[i].cmd_exitcode = WEXITSTATUS(status);
7186	if (WIFSIGNALED(status))
7187	pi->cmds[i].cmd_exitcode = 128 + WTERMSIG(status);
7188	pi->alive_cmds--;
7189	if (!pi->alive_cmds) {
7190	if (G_interactive_fd)
7191	printf(JOB_STATUS_FORMAT, pi->jobid,
7192	"Done", pi->cmdtext);
7193	delete_finished_bg_job(pi);
7194	}
7195	} else {
7196	/* child stopped */
7197	pi->stopped_cmds++;
7198	}
7199	#endif
7200	return -1; /* this wasn't a process from fg_pipe */
7201	}
7202
7203	/* Check to see if any processes have exited -- if they have,
7204	* figure out why and see if a job has completed.
7205	*
7206	* If non-NULL fg_pipe: wait for its completion or stop.
7207	* Return its exitcode or zero if stopped.
7208	*
7209	* Alternatively (fg_pipe == NULL, waitfor_pid != 0):
7210	* waitpid(WNOHANG), if waitfor_pid exits or stops, return exitcode+1,
7211	* else return <0 if waitpid errors out (e.g. ECHILD: nothing to wait for)
7212	* or 0 if no children changed status.
7213	*
7214	* Alternatively (fg_pipe == NULL, waitfor_pid == 0),
7215	* return <0 if waitpid errors out (e.g. ECHILD: nothing to wait for)
7216	* or 0 if no children changed status.
7217	*/
7218	static int checkjobs(struct pipe *fg_pipe, pid_t waitfor_pid)
7219	{
7220	int attributes;
7221	int status;
7222	int rcode = 0;
7223
7224	debug_printf_jobs("checkjobs %p\n", fg_pipe);
7225
7226	attributes = WUNTRACED;
7227	if (fg_pipe == NULL)
7228	attributes |= WNOHANG;
7229
7230	errno = 0;
7231	#if ENABLE_HUSH_FAST
7232	if (G.handled_SIGCHLD == G.count_SIGCHLD) {
7233	//bb_error_msg("[%d] checkjobs: G.count_SIGCHLD:%d G.handled_SIGCHLD:%d children?:%d fg_pipe:%p",
7234	//getpid(), G.count_SIGCHLD, G.handled_SIGCHLD, G.we_have_children, fg_pipe);
7235	/* There was neither fork nor SIGCHLD since last waitpid */
7236	/* Avoid doing waitpid syscall if possible */
7237	if (!G.we_have_children) {
7238	errno = ECHILD;
7239	return -1;
7240	}
7241	if (fg_pipe == NULL) { /* is WNOHANG set? */
7242	/* We have children, but they did not exit
7243	* or stop yet (we saw no SIGCHLD) */
7244	return 0;
7245	}
7246	/* else: !WNOHANG, waitpid will block, can't short-circuit */
7247	}
7248	#endif
7249
7250	/* Do we do this right?
7251	* bash-3.00# sleep 20 | false
7252	* <ctrl-Z pressed>
7253	* [3]+ Stopped sleep 20 | false
7254	* bash-3.00# echo $?
7255	* 1 <========== bg pipe is not fully done, but exitcode is already known!
7256	* [hush 1.14.0: yes we do it right]
7257	*/
7258	while (1) {
7259	pid_t childpid;
7260	#if ENABLE_HUSH_FAST
7261	int i;
7262	i = G.count_SIGCHLD;
7263	#endif
7264	childpid = waitpid(-1, &status, attributes);
7265	if (childpid <= 0) {
7266	if (childpid && errno != ECHILD)
7267	bb_perror_msg("waitpid");
7268	#if ENABLE_HUSH_FAST
7269	else { /* Until next SIGCHLD, waitpid's are useless */
7270	G.we_have_children = (childpid == 0);
7271	G.handled_SIGCHLD = i;
7272	//bb_error_msg("[%d] checkjobs: waitpid returned <= 0, G.count_SIGCHLD:%d G.handled_SIGCHLD:%d", getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
7273	}
7274	#endif
7275	/* ECHILD (no children), or 0 (no change in children status) */
7276	rcode = childpid;
7277	break;
7278	}
7279	rcode = process_wait_result(fg_pipe, childpid, status);
7280	if (rcode >= 0) {
7281	/* fg_pipe exited or stopped */
7282	break;
7283	}
7284	if (childpid == waitfor_pid) {
7285	debug_printf_exec("childpid==waitfor_pid:%d status:0x%08x\n", childpid, status);
7286	rcode = WEXITSTATUS(status);
7287	if (WIFSIGNALED(status))
7288	rcode = 128 + WTERMSIG(status);
7289	if (WIFSTOPPED(status))
7290	/* bash: "cmd & wait $!" and cmd stops: $? = 128 + stopsig */
7291	rcode = 128 + WSTOPSIG(status);
7292	rcode++;
7293	break; /* "wait PID" called us, give it exitcode+1 */
7294	}
7295	/* This wasn't one of our processes, or */
7296	/* fg_pipe still has running processes, do waitpid again */
7297	} /* while (waitpid succeeds)... */
7298
7299	return rcode;
7300	}
7301
7302	#if ENABLE_HUSH_JOB
7303	static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
7304	{
7305	pid_t p;
7306	int rcode = checkjobs(fg_pipe, 0 /*(no pid to wait for)*/);
7307	if (G_saved_tty_pgrp) {
7308	/* Job finished, move the shell to the foreground */
7309	p = getpgrp(); /* our process group id */
7310	debug_printf_jobs("fg'ing ourself: getpgrp()=%d\n", (int)p);
7311	tcsetpgrp(G_interactive_fd, p);
7312	}
7313	return rcode;
7314	}
7315	#endif
7316
7317	/* Start all the jobs, but don't wait for anything to finish.
7318	* See checkjobs().
7319	*
7320	* Return code is normally -1, when the caller has to wait for children
7321	* to finish to determine the exit status of the pipe. If the pipe
7322	* is a simple builtin command, however, the action is done by the
7323	* time run_pipe returns, and the exit code is provided as the
7324	* return value.
7325	*
7326	* Returns -1 only if started some children. IOW: we have to
7327	* mask out retvals of builtins etc with 0xff!
7328	*
7329	* The only case when we do not need to [v]fork is when the pipe
7330	* is single, non-backgrounded, non-subshell command. Examples:
7331	* cmd ; ... { list } ; ...
7332	* cmd && ... { list } && ...
7333	* cmd || ... { list } || ...
7334	* If it is, then we can run cmd as a builtin, NOFORK,
7335	* or (if SH_STANDALONE) an applet, and we can run the { list }
7336	* with run_list. If it isn't one of these, we fork and exec cmd.
7337	*
7338	* Cases when we must fork:
7339	* non-single: cmd | cmd
7340	* backgrounded: cmd & { list } &
7341	* subshell: ( list ) [&]
7342	*/
7343	#if !ENABLE_HUSH_MODE_X
7344	#define redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel, argv_expanded) \
7345	redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel)
7346	#endif
7347	static int redirect_and_varexp_helper(char ***new_env_p,
7348	struct variable **old_vars_p,
7349	struct command *command,
7350	int squirrel[3],
7351	char **argv_expanded)
7352	{
7353	/* setup_redirects acts on file descriptors, not FILEs.
7354	* This is perfect for work that comes after exec().
7355	* Is it really safe for inline use? Experimentally,
7356	* things seem to work. */
7357	int rcode = setup_redirects(command, squirrel);
7358	if (rcode == 0) {
7359	char **new_env = expand_assignments(command->argv, command->assignment_cnt);
7360	*new_env_p = new_env;
7361	dump_cmd_in_x_mode(new_env);
7362	dump_cmd_in_x_mode(argv_expanded);
7363	if (old_vars_p)
7364	*old_vars_p = set_vars_and_save_old(new_env);
7365	}
7366	return rcode;
7367	}
7368	static NOINLINE int run_pipe(struct pipe *pi)
7369	{
7370	static const char *const null_ptr = NULL;
7371
7372	int cmd_no;
7373	int next_infd;
7374	struct command *command;
7375	char **argv_expanded;
7376	char **argv;
7377	/* it is not always needed, but we aim to smaller code */
7378	int squirrel[] = { -1, -1, -1 };
7379	int rcode;
7380
7381	debug_printf_exec("run_pipe start: members:%d\n", pi->num_cmds);
7382	debug_enter();
7383
7384	/* Testcase: set -- q w e; (IFS='' echo "$*"; IFS=''; echo "$*"); echo "$*"
7385	* Result should be 3 lines: q w e, qwe, q w e
7386	*/
7387	G.ifs = get_local_var_value("IFS");
7388	if (!G.ifs)
7389	G.ifs = defifs;
7390
7391	IF_HUSH_JOB(pi->pgrp = -1;)
7392	pi->stopped_cmds = 0;
7393	command = &pi->cmds[0];
7394	argv_expanded = NULL;
7395
7396	if (pi->num_cmds != 1
7397	|| pi->followup == PIPE_BG
7398	|| command->cmd_type == CMD_SUBSHELL
7399	) {
7400	goto must_fork;
7401	}
7402
7403	pi->alive_cmds = 1;
7404
7405	debug_printf_exec(": group:%p argv:'%s'\n",
7406	command->group, command->argv ? command->argv[0] : "NONE");
7407
7408	if (command->group) {
7409	#if ENABLE_HUSH_FUNCTIONS
7410	if (command->cmd_type == CMD_FUNCDEF) {
7411	/* "executing" func () { list } */
7412	struct function *funcp;
7413
7414	funcp = new_function(command->argv[0]);
7415	/* funcp->name is already set to argv[0] */
7416	funcp->body = command->group;
7417	# if !BB_MMU
7418	funcp->body_as_string = command->group_as_string;
7419	command->group_as_string = NULL;
7420	# endif
7421	command->group = NULL;
7422	command->argv[0] = NULL;
7423	debug_printf_exec("cmd %p has child func at %p\n", command, funcp);
7424	funcp->parent_cmd = command;
7425	command->child_func = funcp;
7426
7427	debug_printf_exec("run_pipe: return EXIT_SUCCESS\n");
7428	debug_leave();
7429	return EXIT_SUCCESS;
7430	}
7431	#endif
7432	/* { list } */
7433	debug_printf("non-subshell group\n");
7434	rcode = 1; /* exitcode if redir failed */
7435	if (setup_redirects(command, squirrel) == 0) {
7436	debug_printf_exec(": run_list\n");
7437	rcode = run_list(command->group) & 0xff;
7438	}
7439	restore_redirects(squirrel);
7440	IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
7441	debug_leave();
7442	debug_printf_exec("run_pipe: return %d\n", rcode);
7443	return rcode;
7444	}
7445
7446	argv = command->argv ? command->argv : (char **) &null_ptr;
7447	{
7448	const struct built_in_command *x;
7449	#if ENABLE_HUSH_FUNCTIONS
7450	const struct function *funcp;
7451	#else
7452	enum { funcp = 0 };
7453	#endif
7454	char **new_env = NULL;
7455	struct variable *old_vars = NULL;
7456
7457	if (argv[command->assignment_cnt] == NULL) {
7458	/* Assignments, but no command */
7459	/* Ensure redirects take effect (that is, create files).
7460	* Try "a=t >file" */
7461	#if 0 /* A few cases in testsuite fail with this code. FIXME */
7462	rcode = redirect_and_varexp_helper(&new_env, /*old_vars:*/ NULL, command, squirrel, /*argv_expanded:*/ NULL);
7463	/* Set shell variables */
7464	if (new_env) {
7465	argv = new_env;
7466	while (*argv) {
7467	set_local_var(*argv, /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
7468	/* Do we need to flag set_local_var() errors?
7469	* "assignment to readonly var" and "putenv error"
7470	*/
7471	argv++;
7472	}
7473	}
7474	/* Redirect error sets $? to 1. Otherwise,
7475	* if evaluating assignment value set $?, retain it.
7476	* Try "false; q=`exit 2`; echo $?" - should print 2: */
7477	if (rcode == 0)
7478	rcode = G.last_exitcode;
7479	/* Exit, _skipping_ variable restoring code: */
7480	goto clean_up_and_ret0;
7481
7482	#else /* Older, bigger, but more correct code */
7483
7484	rcode = setup_redirects(command, squirrel);
7485	restore_redirects(squirrel);
7486	/* Set shell variables */
7487	if (G_x_mode)
7488	bb_putchar_stderr('+');
7489	while (*argv) {
7490	char *p = expand_string_to_string(*argv, /*unbackslash:*/ 1);
7491	if (G_x_mode)
7492	fprintf(stderr, " %s", p);
7493	debug_printf_exec("set shell var:'%s'->'%s'\n",
7494	*argv, p);
7495	set_local_var(p, /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
7496	/* Do we need to flag set_local_var() errors?
7497	* "assignment to readonly var" and "putenv error"
7498	*/
7499	argv++;
7500	}
7501	if (G_x_mode)
7502	bb_putchar_stderr('\n');
7503	/* Redirect error sets $? to 1. Otherwise,
7504	* if evaluating assignment value set $?, retain it.
7505	* Try "false; q=`exit 2`; echo $?" - should print 2: */
7506	if (rcode == 0)
7507	rcode = G.last_exitcode;
7508	IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
7509	debug_leave();
7510	debug_printf_exec("run_pipe: return %d\n", rcode);
7511	return rcode;
7512	#endif
7513	}
7514
7515	/* Expand the rest into (possibly) many strings each */
7516	#if ENABLE_HUSH_BASH_COMPAT
7517	if (command->cmd_type == CMD_SINGLEWORD_NOGLOB) {
7518	argv_expanded = expand_strvec_to_strvec_singleword_noglob(argv + command->assignment_cnt);
7519	} else
7520	#endif
7521	{
7522	argv_expanded = expand_strvec_to_strvec(argv + command->assignment_cnt);
7523	}
7524
7525	/* if someone gives us an empty string: `cmd with empty output` */
7526	if (!argv_expanded[0]) {
7527	free(argv_expanded);
7528	debug_leave();
7529	return G.last_exitcode;
7530	}
7531
7532	x = find_builtin(argv_expanded[0]);
7533	#if ENABLE_HUSH_FUNCTIONS
7534	funcp = NULL;
7535	if (!x)
7536	funcp = find_function(argv_expanded[0]);
7537	#endif
7538	if (x || funcp) {
7539	if (!funcp) {
7540	if (x->b_function == builtin_exec && argv_expanded[1] == NULL) {
7541	debug_printf("exec with redirects only\n");
7542	rcode = setup_redirects(command, NULL);
7543	/* rcode=1 can be if redir file can't be opened */
7544	goto clean_up_and_ret1;
7545	}
7546	}
7547	rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, squirrel, argv_expanded);
7548	if (rcode == 0) {
7549	if (!funcp) {
7550	debug_printf_exec(": builtin '%s' '%s'...\n",
7551	x->b_cmd, argv_expanded[1]);
7552	fflush_all();
7553	rcode = x->b_function(argv_expanded) & 0xff;
7554	fflush_all();
7555	}
7556	#if ENABLE_HUSH_FUNCTIONS
7557	else {
7558	# if ENABLE_HUSH_LOCAL
7559	struct variable **sv;
7560	sv = G.shadowed_vars_pp;
7561	G.shadowed_vars_pp = &old_vars;
7562	# endif
7563	debug_printf_exec(": function '%s' '%s'...\n",
7564	funcp->name, argv_expanded[1]);
7565	rcode = run_function(funcp, argv_expanded) & 0xff;
7566	# if ENABLE_HUSH_LOCAL
7567	G.shadowed_vars_pp = sv;
7568	# endif
7569	}
7570	#endif
7571	}
7572	clean_up_and_ret:
7573	unset_vars(new_env);
7574	add_vars(old_vars);
7575	/* clean_up_and_ret0: */
7576	restore_redirects(squirrel);
7577	clean_up_and_ret1:
7578	free(argv_expanded);
7579	IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
7580	debug_leave();
7581	debug_printf_exec("run_pipe return %d\n", rcode);
7582	return rcode;
7583	}
7584
7585	if (ENABLE_FEATURE_SH_NOFORK) {
7586	int n = find_applet_by_name(argv_expanded[0]);
7587	if (n >= 0 && APPLET_IS_NOFORK(n)) {
7588	rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, squirrel, argv_expanded);
7589	if (rcode == 0) {
7590	debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
7591	argv_expanded[0], argv_expanded[1]);
7592	rcode = run_nofork_applet(n, argv_expanded);
7593	}
7594	goto clean_up_and_ret;
7595	}
7596	}
7597	/* It is neither builtin nor applet. We must fork. */
7598	}
7599
7600	must_fork:
7601	/* NB: argv_expanded may already be created, and that
7602	* might include `cmd` runs! Do not rerun it! We *must*
7603	* use argv_expanded if it's non-NULL */
7604
7605	/* Going to fork a child per each pipe member */
7606	pi->alive_cmds = 0;
7607	next_infd = 0;
7608
7609	cmd_no = 0;
7610	while (cmd_no < pi->num_cmds) {
7611	struct fd_pair pipefds;
7612	#if !BB_MMU
7613	volatile nommu_save_t nommu_save;
7614	nommu_save.new_env = NULL;
7615	nommu_save.old_vars = NULL;
7616	nommu_save.argv = NULL;
7617	nommu_save.argv_from_re_execing = NULL;
7618	#endif
7619	command = &pi->cmds[cmd_no];
7620	cmd_no++;
7621	if (command->argv) {
7622	debug_printf_exec(": pipe member '%s' '%s'...\n",
7623	command->argv[0], command->argv[1]);
7624	} else {
7625	debug_printf_exec(": pipe member with no argv\n");
7626	}
7627
7628	/* pipes are inserted between pairs of commands */
7629	pipefds.rd = 0;
7630	pipefds.wr = 1;
7631	if (cmd_no < pi->num_cmds)
7632	xpiped_pair(pipefds);
7633
7634	command->pid = BB_MMU ? fork() : vfork();
7635	if (!command->pid) { /* child */
7636	#if ENABLE_HUSH_JOB
7637	disable_restore_tty_pgrp_on_exit();
7638	CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
7639
7640	/* Every child adds itself to new process group
7641	* with pgid == pid_of_first_child_in_pipe */
7642	if (G.run_list_level == 1 && G_interactive_fd) {
7643	pid_t pgrp;
7644	pgrp = pi->pgrp;
7645	if (pgrp < 0) /* true for 1st process only */
7646	pgrp = getpid();
7647	if (setpgid(0, pgrp) == 0
7648	&& pi->followup != PIPE_BG
7649	&& G_saved_tty_pgrp /* we have ctty */
7650	) {
7651	/* We do it in *every* child, not just first,
7652	* to avoid races */
7653	tcsetpgrp(G_interactive_fd, pgrp);
7654	}
7655	}
7656	#endif
7657	if (pi->alive_cmds == 0 && pi->followup == PIPE_BG) {
7658	/* 1st cmd in backgrounded pipe
7659	* should have its stdin /dev/null'ed */
7660	close(0);
7661	if (open(bb_dev_null, O_RDONLY))
7662	xopen("/", O_RDONLY);
7663	} else {
7664	xmove_fd(next_infd, 0);
7665	}
7666	xmove_fd(pipefds.wr, 1);
7667	if (pipefds.rd > 1)
7668	close(pipefds.rd);
7669	/* Like bash, explicit redirects override pipes,
7670	* and the pipe fd (fd#1) is available for dup'ing:
7671	* "cmd1 2>&1 | cmd2": fd#1 is duped to fd#2, thus stderr
7672	* of cmd1 goes into pipe.
7673	*/
7674	if (setup_redirects(command, NULL)) {
7675	/* Happens when redir file can't be opened:
7676	* $ hush -c 'echo FOO >&2 | echo BAR 3>/qwe/rty; echo BAZ'
7677	* FOO
7678	* hush: can't open '/qwe/rty': No such file or directory
7679	* BAZ
7680	* (echo BAR is not executed, it hits _exit(1) below)
7681	*/
7682	_exit(1);
7683	}
7684
7685	/* Stores to nommu_save list of env vars putenv'ed
7686	* (NOMMU, on MMU we don't need that) */
7687	/* cast away volatility... */
7688	pseudo_exec((nommu_save_t*) &nommu_save, command, argv_expanded);
7689	/* pseudo_exec() does not return */
7690	}
7691
7692	/* parent or error */
7693	#if ENABLE_HUSH_FAST
7694	G.count_SIGCHLD++;
7695	//bb_error_msg("[%d] fork in run_pipe: G.count_SIGCHLD:%d G.handled_SIGCHLD:%d", getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
7696	#endif
7697	enable_restore_tty_pgrp_on_exit();
7698	#if !BB_MMU
7699	/* Clean up after vforked child */
7700	free(nommu_save.argv);
7701	free(nommu_save.argv_from_re_execing);
7702	unset_vars(nommu_save.new_env);
7703	add_vars(nommu_save.old_vars);
7704	#endif
7705	free(argv_expanded);
7706	argv_expanded = NULL;
7707	if (command->pid < 0) { /* [v]fork failed */
7708	/* Clearly indicate, was it fork or vfork */
7709	bb_perror_msg(BB_MMU ? "vfork"+1 : "vfork");
7710	} else {
7711	pi->alive_cmds++;
7712	#if ENABLE_HUSH_JOB
7713	/* Second and next children need to know pid of first one */
7714	if (pi->pgrp < 0)
7715	pi->pgrp = command->pid;
7716	#endif
7717	}
7718
7719	if (cmd_no > 1)
7720	close(next_infd);
7721	if (cmd_no < pi->num_cmds)
7722	close(pipefds.wr);
7723	/* Pass read (output) pipe end to next iteration */
7724	next_infd = pipefds.rd;
7725	}
7726
7727	if (!pi->alive_cmds) {
7728	debug_leave();
7729	debug_printf_exec("run_pipe return 1 (all forks failed, no children)\n");
7730	return 1;
7731	}
7732
7733	debug_leave();
7734	debug_printf_exec("run_pipe return -1 (%u children started)\n", pi->alive_cmds);
7735	return -1;
7736	}
7737
7738	/* NB: called by pseudo_exec, and therefore must not modify any
7739	* global data until exec/_exit (we can be a child after vfork!) */
7740	static int run_list(struct pipe *pi)
7741	{
7742	#if ENABLE_HUSH_CASE
7743	char *case_word = NULL;
7744	#endif
7745	#if ENABLE_HUSH_LOOPS
7746	struct pipe *loop_top = NULL;
7747	char **for_lcur = NULL;
7748	char **for_list = NULL;
7749	#endif
7750	smallint last_followup;
7751	smalluint rcode;
7752	#if ENABLE_HUSH_IF || ENABLE_HUSH_CASE
7753	smalluint cond_code = 0;
7754	#else
7755	enum { cond_code = 0 };
7756	#endif
7757	#if HAS_KEYWORDS
7758	smallint rword; /* RES_foo */
7759	smallint last_rword; /* ditto */
7760	#endif
7761
7762	debug_printf_exec("run_list start lvl %d\n", G.run_list_level);
7763	debug_enter();
7764
7765	#if ENABLE_HUSH_LOOPS
7766	/* Check syntax for "for" */
7767	{
7768	struct pipe *cpipe;
7769	for (cpipe = pi; cpipe; cpipe = cpipe->next) {
7770	if (cpipe->res_word != RES_FOR && cpipe->res_word != RES_IN)
7771	continue;
7772	/* current word is FOR or IN (BOLD in comments below) */
7773	if (cpipe->next == NULL) {
7774	syntax_error("malformed for");
7775	debug_leave();
7776	debug_printf_exec("run_list lvl %d return 1\n", G.run_list_level);
7777	return 1;
7778	}
7779	/* "FOR v; do ..." and "for v IN a b; do..." are ok */
7780	if (cpipe->next->res_word == RES_DO)
7781	continue;
7782	/* next word is not "do". It must be "in" then ("FOR v in ...") */
7783	if (cpipe->res_word == RES_IN /* "for v IN a b; not_do..."? */
7784	|| cpipe->next->res_word != RES_IN /* FOR v not_do_and_not_in..."? */
7785	) {
7786	syntax_error("malformed for");
7787	debug_leave();
7788	debug_printf_exec("run_list lvl %d return 1\n", G.run_list_level);
7789	return 1;
7790	}
7791	}
7792	}
7793	#endif
7794
7795	/* Past this point, all code paths should jump to ret: label
7796	* in order to return, no direct "return" statements please.
7797	* This helps to ensure that no memory is leaked. */
7798
7799	#if ENABLE_HUSH_JOB
7800	G.run_list_level++;
7801	#endif
7802
7803	#if HAS_KEYWORDS
7804	rword = RES_NONE;
7805	last_rword = RES_XXXX;
7806	#endif
7807	last_followup = PIPE_SEQ;
7808	rcode = G.last_exitcode;
7809
7810	/* Go through list of pipes, (maybe) executing them. */
7811	for (; pi; pi = IF_HUSH_LOOPS(rword == RES_DONE ? loop_top : ) pi->next) {
7812	int r;
7813
7814	if (G.flag_SIGINT)
7815	break;
7816	if (G_flag_return_in_progress == 1)
7817	break;
7818
7819	IF_HAS_KEYWORDS(rword = pi->res_word;)
7820	debug_printf_exec(": rword=%d cond_code=%d last_rword=%d\n",
7821	rword, cond_code, last_rword);
7822	#if ENABLE_HUSH_LOOPS
7823	if ((rword == RES_WHILE || rword == RES_UNTIL || rword == RES_FOR)
7824	&& loop_top == NULL /* avoid bumping G.depth_of_loop twice */
7825	) {
7826	/* start of a loop: remember where loop starts */
7827	loop_top = pi;
7828	G.depth_of_loop++;
7829	}
7830	#endif
7831	/* Still in the same "if...", "then..." or "do..." branch? */
7832	if (IF_HAS_KEYWORDS(rword == last_rword &&) 1) {
7833	if ((rcode == 0 && last_followup == PIPE_OR)
7834	|| (rcode != 0 && last_followup == PIPE_AND)
7835	) {
7836	/* It is "<true> || CMD" or "<false> && CMD"
7837	* and we should not execute CMD */
7838	debug_printf_exec("skipped cmd because of || or &&\n");
7839	last_followup = pi->followup;
7840	goto dont_check_jobs_but_continue;
7841	}
7842	}
7843	last_followup = pi->followup;
7844	IF_HAS_KEYWORDS(last_rword = rword;)
7845	#if ENABLE_HUSH_IF
7846	if (cond_code) {
7847	if (rword == RES_THEN) {
7848	/* if false; then ... fi has exitcode 0! */
7849	G.last_exitcode = rcode = EXIT_SUCCESS;
7850	/* "if <false> THEN cmd": skip cmd */
7851	continue;
7852	}
7853	} else {
7854	if (rword == RES_ELSE || rword == RES_ELIF) {
7855	/* "if <true> then ... ELSE/ELIF cmd":
7856	* skip cmd and all following ones */
7857	break;
7858	}
7859	}
7860	#endif
7861	#if ENABLE_HUSH_LOOPS
7862	if (rword == RES_FOR) { /* && pi->num_cmds - always == 1 */
7863	if (!for_lcur) {
7864	/* first loop through for */
7865
7866	static const char encoded_dollar_at[] ALIGN1 = {
7867	SPECIAL_VAR_SYMBOL, '@' | 0x80, SPECIAL_VAR_SYMBOL, '\0'
7868	}; /* encoded representation of "$@" */
7869	static const char *const encoded_dollar_at_argv[] = {
7870	encoded_dollar_at, NULL
7871	}; /* argv list with one element: "$@" */
7872	char **vals;
7873
7874	vals = (char**)encoded_dollar_at_argv;
7875	if (pi->next->res_word == RES_IN) {
7876	/* if no variable values after "in" we skip "for" */
7877	if (!pi->next->cmds[0].argv) {
7878	G.last_exitcode = rcode = EXIT_SUCCESS;
7879	debug_printf_exec(": null FOR: exitcode EXIT_SUCCESS\n");
7880	break;
7881	}
7882	vals = pi->next->cmds[0].argv;
7883	} /* else: "for var; do..." -> assume "$@" list */
7884	/* create list of variable values */
7885	debug_print_strings("for_list made from", vals);
7886	for_list = expand_strvec_to_strvec(vals);
7887	for_lcur = for_list;
7888	debug_print_strings("for_list", for_list);
7889	}
7890	if (!*for_lcur) {
7891	/* "for" loop is over, clean up */
7892	free(for_list);
7893	for_list = NULL;
7894	for_lcur = NULL;
7895	break;
7896	}
7897	/* Insert next value from for_lcur */
7898	/* note: *for_lcur already has quotes removed, $var expanded, etc */
7899	set_local_var(xasprintf("%s=%s", pi->cmds[0].argv[0], *for_lcur++), /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
7900	continue;
7901	}
7902	if (rword == RES_IN) {
7903	continue; /* "for v IN list;..." - "in" has no cmds anyway */
7904	}
7905	if (rword == RES_DONE) {
7906	continue; /* "done" has no cmds too */
7907	}
7908	#endif
7909	#if ENABLE_HUSH_CASE
7910	if (rword == RES_CASE) {
7911	debug_printf_exec("CASE cond_code:%d\n", cond_code);
7912	case_word = expand_strvec_to_string(pi->cmds->argv);
7913	continue;
7914	}
7915	if (rword == RES_MATCH) {
7916	char **argv;
7917
7918	debug_printf_exec("MATCH cond_code:%d\n", cond_code);
7919	if (!case_word) /* "case ... matched_word) ... WORD)": we executed selected branch, stop */
7920	break;
7921	/* all prev words didn't match, does this one match? */
7922	argv = pi->cmds->argv;
7923	while (*argv) {
7924	char *pattern = expand_string_to_string(*argv, /*unbackslash:*/ 1);
7925	/* TODO: which FNM_xxx flags to use? */
7926	cond_code = (fnmatch(pattern, case_word, /*flags:*/ 0) != 0);
7927	free(pattern);
7928	if (cond_code == 0) { /* match! we will execute this branch */
7929	free(case_word);
7930	case_word = NULL; /* make future "word)" stop */
7931	break;
7932	}
7933	argv++;
7934	}
7935	continue;
7936	}
7937	if (rword == RES_CASE_BODY) { /* inside of a case branch */
7938	debug_printf_exec("CASE_BODY cond_code:%d\n", cond_code);
7939	if (cond_code != 0)
7940	continue; /* not matched yet, skip this pipe */
7941	}
7942	if (rword == RES_ESAC) {
7943	debug_printf_exec("ESAC cond_code:%d\n", cond_code);
7944	if (case_word) {
7945	/* "case" did not match anything: still set $? (to 0) */
7946	G.last_exitcode = rcode = EXIT_SUCCESS;
7947	}
7948	}
7949	#endif
7950	/* Just pressing <enter> in shell should check for jobs.
7951	* OTOH, in non-interactive shell this is useless
7952	* and only leads to extra job checks */
7953	if (pi->num_cmds == 0) {
7954	if (G_interactive_fd)
7955	goto check_jobs_and_continue;
7956	continue;
7957	}
7958
7959	/* After analyzing all keywords and conditions, we decided
7960	* to execute this pipe. NB: have to do checkjobs(NULL)
7961	* after run_pipe to collect any background children,
7962	* even if list execution is to be stopped. */
7963	debug_printf_exec(": run_pipe with %d members\n", pi->num_cmds);
7964	#if ENABLE_HUSH_LOOPS
7965	G.flag_break_continue = 0;
7966	#endif
7967	rcode = r = run_pipe(pi); /* NB: rcode is a smalluint, r is int */
7968	if (r != -1) {
7969	/* We ran a builtin, function, or group.
7970	* rcode is already known
7971	* and we don't need to wait for anything. */
7972	debug_printf_exec(": builtin/func exitcode %d\n", rcode);
7973	G.last_exitcode = rcode;
7974	check_and_run_traps();
7975	#if ENABLE_HUSH_LOOPS
7976	/* Was it "break" or "continue"? */
7977	if (G.flag_break_continue) {
7978	smallint fbc = G.flag_break_continue;
7979	/* We might fall into outer *loop*,
7980	* don't want to break it too */
7981	if (loop_top) {
7982	G.depth_break_continue--;
7983	if (G.depth_break_continue == 0)
7984	G.flag_break_continue = 0;
7985	/* else: e.g. "continue 2" should *break* once, *then* continue */
7986	} /* else: "while... do... { we are here (innermost list is not a loop!) };...done" */
7987	if (G.depth_break_continue != 0 || fbc == BC_BREAK) {
7988	checkjobs(NULL, 0 /*(no pid to wait for)*/);
7989	break;
7990	}
7991	/* "continue": simulate end of loop */
7992	rword = RES_DONE;
7993	continue;
7994	}
7995	#endif
7996	if (G_flag_return_in_progress == 1) {
7997	checkjobs(NULL, 0 /*(no pid to wait for)*/);
7998	break;
7999	}
8000	} else if (pi->followup == PIPE_BG) {
8001	/* What does bash do with attempts to background builtins? */
8002	/* even bash 3.2 doesn't do that well with nested bg:
8003	* try "{ { sleep 10; echo DEEP; } & echo HERE; } &".
8004	* I'm NOT treating inner &'s as jobs */
8005	#if ENABLE_HUSH_JOB
8006	if (G.run_list_level == 1)
8007	insert_bg_job(pi);
8008	#endif
8009	/* Last command's pid goes to $! */
8010	G.last_bg_pid = pi->cmds[pi->num_cmds - 1].pid;
8011	debug_printf_exec(": cmd&: exitcode EXIT_SUCCESS\n");
8012	/* Check pi->pi_inverted? "! sleep 1 & echo $?": bash says 1. dash and ash says 0 */
8013	rcode = EXIT_SUCCESS;
8014	goto check_traps;
8015	} else {
8016	#if ENABLE_HUSH_JOB
8017	if (G.run_list_level == 1 && G_interactive_fd) {
8018	/* Waits for completion, then fg's main shell */
8019	rcode = checkjobs_and_fg_shell(pi);
8020	debug_printf_exec(": checkjobs_and_fg_shell exitcode %d\n", rcode);
8021	goto check_traps;
8022	}
8023	#endif
8024	/* This one just waits for completion */
8025	rcode = checkjobs(pi, 0 /*(no pid to wait for)*/);
8026	debug_printf_exec(": checkjobs exitcode %d\n", rcode);
8027	check_traps:
8028	G.last_exitcode = rcode;
8029	check_and_run_traps();
8030	}
8031
8032	/* Analyze how result affects subsequent commands */
8033	#if ENABLE_HUSH_IF
8034	if (rword == RES_IF || rword == RES_ELIF)
8035	cond_code = rcode;
8036	#endif
8037	check_jobs_and_continue:
8038	checkjobs(NULL, 0 /*(no pid to wait for)*/);
8039	dont_check_jobs_but_continue: ;
8040	#if ENABLE_HUSH_LOOPS
8041	/* Beware of "while false; true; do ..."! */
8042	if (pi->next
8043	&& (pi->next->res_word == RES_DO || pi->next->res_word == RES_DONE)
8044	/* check for RES_DONE is needed for "while ...; do \n done" case */
8045	) {
8046	if (rword == RES_WHILE) {
8047	if (rcode) {
8048	/* "while false; do...done" - exitcode 0 */
8049	G.last_exitcode = rcode = EXIT_SUCCESS;
8050	debug_printf_exec(": while expr is false: breaking (exitcode:EXIT_SUCCESS)\n");
8051	break;
8052	}
8053	}
8054	if (rword == RES_UNTIL) {
8055	if (!rcode) {
8056	debug_printf_exec(": until expr is true: breaking\n");
8057	break;
8058	}
8059	}
8060	}
8061	#endif
8062	} /* for (pi) */
8063
8064	#if ENABLE_HUSH_JOB
8065	G.run_list_level--;
8066	#endif
8067	#if ENABLE_HUSH_LOOPS
8068	if (loop_top)
8069	G.depth_of_loop--;
8070	free(for_list);
8071	#endif
8072	#if ENABLE_HUSH_CASE
8073	free(case_word);
8074	#endif
8075	debug_leave();
8076	debug_printf_exec("run_list lvl %d return %d\n", G.run_list_level + 1, rcode);
8077	return rcode;
8078	}
8079
8080	/* Select which version we will use */
8081	static int run_and_free_list(struct pipe *pi)
8082	{
8083	int rcode = 0;
8084	debug_printf_exec("run_and_free_list entered\n");
8085	if (!G.o_opt[OPT_O_NOEXEC]) {
8086	debug_printf_exec(": run_list: 1st pipe with %d cmds\n", pi->num_cmds);
8087	rcode = run_list(pi);
8088	}
8089	/* free_pipe_list has the side effect of clearing memory.
8090	* In the long run that function can be merged with run_list,
8091	* but doing that now would hobble the debugging effort. */
8092	free_pipe_list(pi);
8093	debug_printf_exec("run_and_free_list return %d\n", rcode);
8094	return rcode;
8095	}
8096
8097
8098	static void install_sighandlers(unsigned mask)
8099	{
8100	sighandler_t old_handler;
8101	unsigned sig = 0;
8102	while ((mask >>= 1) != 0) {
8103	sig++;
8104	if (!(mask & 1))
8105	continue;
8106	old_handler = install_sighandler(sig, pick_sighandler(sig));
8107	/* POSIX allows shell to re-enable SIGCHLD
8108	* even if it was SIG_IGN on entry.
8109	* Therefore we skip IGN check for it:
8110	*/
8111	if (sig == SIGCHLD)
8112	continue;
8113	if (old_handler == SIG_IGN) {
8114	/* oops... restore back to IGN, and record this fact */
8115	install_sighandler(sig, old_handler);
8116	if (!G.traps)
8117	G.traps = xzalloc(sizeof(G.traps[0]) * NSIG);
8118	free(G.traps[sig]);
8119	G.traps[sig] = xzalloc(1); /* == xstrdup(""); */
8120	}
8121	}
8122	}
8123
8124	/* Called a few times only (or even once if "sh -c") */
8125	static void install_special_sighandlers(void)
8126	{
8127	unsigned mask;
8128
8129	/* Which signals are shell-special? */
8130	mask = (1 << SIGQUIT) | (1 << SIGCHLD);
8131	if (G_interactive_fd) {
8132	mask |= SPECIAL_INTERACTIVE_SIGS;
8133	if (G_saved_tty_pgrp) /* we have ctty, job control sigs work */
8134	mask |= SPECIAL_JOBSTOP_SIGS;
8135	}
8136	/* Careful, do not re-install handlers we already installed */
8137	if (G.special_sig_mask != mask) {
8138	unsigned diff = mask & ~G.special_sig_mask;
8139	G.special_sig_mask = mask;
8140	install_sighandlers(diff);
8141	}
8142	}
8143
8144	#if ENABLE_HUSH_JOB
8145	/* helper */
8146	/* Set handlers to restore tty pgrp and exit */
8147	static void install_fatal_sighandlers(void)
8148	{
8149	unsigned mask;
8150
8151	/* We will restore tty pgrp on these signals */
8152	mask = 0
8153	/*+ (1 << SIGILL ) * HUSH_DEBUG*/
8154	/*+ (1 << SIGFPE ) * HUSH_DEBUG*/
8155	+ (1 << SIGBUS ) * HUSH_DEBUG
8156	+ (1 << SIGSEGV) * HUSH_DEBUG
8157	/*+ (1 << SIGTRAP) * HUSH_DEBUG*/
8158	+ (1 << SIGABRT)
8159	/* bash 3.2 seems to handle these just like 'fatal' ones */
8160	+ (1 << SIGPIPE)
8161	+ (1 << SIGALRM)
8162	/* if we are interactive, SIGHUP, SIGTERM and SIGINT are special sigs.
8163	* if we aren't interactive... but in this case
8164	* we never want to restore pgrp on exit, and this fn is not called
8165	*/
8166	/*+ (1 << SIGHUP )*/
8167	/*+ (1 << SIGTERM)*/
8168	/*+ (1 << SIGINT )*/
8169	;
8170	G_fatal_sig_mask = mask;
8171
8172	install_sighandlers(mask);
8173	}
8174	#endif
8175
8176	static int set_mode(int state, char mode, const char *o_opt)
8177	{
8178	int idx;
8179	switch (mode) {
8180	case 'n':
8181	G.o_opt[OPT_O_NOEXEC] = state;
8182	break;
8183	case 'x':
8184	IF_HUSH_MODE_X(G_x_mode = state;)
8185	break;
8186	case 'o':
8187	if (!o_opt) {
8188	/* "set -+o" without parameter.
8189	* in bash, set -o produces this output:
8190	* pipefail off
8191	* and set +o:
8192	* set +o pipefail
8193	* We always use the second form.
8194	*/
8195	const char *p = o_opt_strings;
8196	idx = 0;
8197	while (*p) {
8198	printf("set %co %s\n", (G.o_opt[idx] ? '-' : '+'), p);
8199	idx++;
8200	p += strlen(p) + 1;
8201	}
8202	break;
8203	}
8204	idx = index_in_strings(o_opt_strings, o_opt);
8205	if (idx >= 0) {
8206	G.o_opt[idx] = state;
8207	break;
8208	}
8209	default:
8210	return EXIT_FAILURE;
8211	}
8212	return EXIT_SUCCESS;
8213	}
8214
8215	int hush_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
8216	int hush_main(int argc, char **argv)
8217	{
8218	enum {
8219	OPT_login = (1 << 0),
8220	};
8221	unsigned flags;
8222	int opt;
8223	unsigned builtin_argc;
8224	char **e;
8225	struct variable *cur_var;
8226	struct variable *shell_ver;
8227
8228	INIT_G();
8229	if (EXIT_SUCCESS != 0) /* if EXIT_SUCCESS == 0, it is already done */
8230	G.last_exitcode = EXIT_SUCCESS;
8231
8232	#if ENABLE_HUSH_FAST
8233	G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
8234	#endif
8235	#if !BB_MMU
8236	G.argv0_for_re_execing = argv[0];
8237	#endif
8238	/* Deal with HUSH_VERSION */
8239	shell_ver = xzalloc(sizeof(*shell_ver));
8240	shell_ver->flg_export = 1;
8241	shell_ver->flg_read_only = 1;
8242	/* Code which handles ${var<op>...} needs writable values for all variables,
8243	* therefore we xstrdup: */
8244	shell_ver->varstr = xstrdup(hush_version_str);
8245	/* Create shell local variables from the values
8246	* currently living in the environment */
8247	debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
8248	unsetenv("HUSH_VERSION"); /* in case it exists in initial env */
8249	G.top_var = shell_ver;
8250	cur_var = G.top_var;
8251	e = environ;
8252	if (e) while (*e) {
8253	char *value = strchr(*e, '=');
8254	if (value) { /* paranoia */
8255	cur_var->next = xzalloc(sizeof(*cur_var));
8256	cur_var = cur_var->next;
8257	cur_var->varstr = *e;
8258	cur_var->max_len = strlen(*e);
8259	cur_var->flg_export = 1;
8260	}
8261	e++;
8262	}
8263	/* (Re)insert HUSH_VERSION into env (AFTER we scanned the env!) */
8264	debug_printf_env("putenv '%s'\n", shell_ver->varstr);
8265	putenv(shell_ver->varstr);
8266
8267	/* Export PWD */
8268	set_pwd_var(/*exp:*/ 1);
8269
8270	#if ENABLE_HUSH_BASH_COMPAT
8271	/* Set (but not export) HOSTNAME unless already set */
8272	if (!get_local_var_value("HOSTNAME")) {
8273	struct utsname uts;
8274	uname(&uts);
8275	set_local_var_from_halves("HOSTNAME", uts.nodename);
8276	}
8277	/* bash also exports SHLVL and _,
8278	* and sets (but doesn't export) the following variables:
8279	* BASH=/bin/bash
8280	* BASH_VERSINFO=([0]="3" [1]="2" [2]="0" [3]="1" [4]="release" [5]="i386-pc-linux-gnu")
8281	* BASH_VERSION='3.2.0(1)-release'
8282	* HOSTTYPE=i386
8283	* MACHTYPE=i386-pc-linux-gnu
8284	* OSTYPE=linux-gnu
8285	* PPID=<NNNNN> - we also do it elsewhere
8286	* EUID=<NNNNN>
8287	* UID=<NNNNN>
8288	* GROUPS=()
8289	* LINES=<NNN>
8290	* COLUMNS=<NNN>
8291	* BASH_ARGC=()
8292	* BASH_ARGV=()
8293	* BASH_LINENO=()
8294	* BASH_SOURCE=()
8295	* DIRSTACK=()
8296	* PIPESTATUS=([0]="0")
8297	* HISTFILE=/<xxx>/.bash_history
8298	* HISTFILESIZE=500
8299	* HISTSIZE=500
8300	* MAILCHECK=60
8301	* PATH=/usr/gnu/bin:/usr/local/bin:/bin:/usr/bin:.
8302	* SHELL=/bin/bash
8303	* SHELLOPTS=braceexpand:emacs:hashall:histexpand:history:interactive-comments:monitor
8304	* TERM=dumb
8305	* OPTERR=1
8306	* OPTIND=1
8307	* IFS=$' \t\n'
8308	* PS1='\s-\v\$ '
8309	* PS2='> '
8310	* PS4='+ '
8311	*/
8312	#endif
8313
8314	#if ENABLE_FEATURE_EDITING
8315	G.line_input_state = new_line_input_t(FOR_SHELL);
8316	#endif
8317
8318	/* Initialize some more globals to non-zero values */
8319	cmdedit_update_prompt();
8320
8321	die_func = restore_ttypgrp_and__exit;
8322
8323	/* Shell is non-interactive at first. We need to call
8324	* install_special_sighandlers() if we are going to execute "sh <script>",
8325	* "sh -c <cmds>" or login shell's /etc/profile and friends.
8326	* If we later decide that we are interactive, we run install_special_sighandlers()
8327	* in order to intercept (more) signals.
8328	*/
8329
8330	/* Parse options */
8331	/* http://www.opengroup.org/onlinepubs/9699919799/utilities/sh.html */
8332	flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
8333	builtin_argc = 0;
8334	while (1) {
8335	opt = getopt(argc, argv, "+c:xinsl"
8336	#if !BB_MMU
8337	"<:$:R:V:"
8338	# if ENABLE_HUSH_FUNCTIONS
8339	"F:"
8340	# endif
8341	#endif
8342	);
8343	if (opt <= 0)
8344	break;
8345	switch (opt) {
8346	case 'c':
8347	/* Possibilities:
8348	* sh ... -c 'script'
8349	* sh ... -c 'script' ARG0 [ARG1...]
8350	* On NOMMU, if builtin_argc != 0,
8351	* sh ... -c 'builtin' BARGV... "" ARG0 [ARG1...]
8352	* "" needs to be replaced with NULL
8353	* and BARGV vector fed to builtin function.
8354	* Note: the form without ARG0 never happens:
8355	* sh ... -c 'builtin' BARGV... ""
8356	*/
8357	if (!G.root_pid) {
8358	G.root_pid = getpid();
8359	G.root_ppid = getppid();
8360	}
8361	G.global_argv = argv + optind;
8362	G.global_argc = argc - optind;
8363	if (builtin_argc) {
8364	/* -c 'builtin' [BARGV...] "" ARG0 [ARG1...] */
8365	const struct built_in_command *x;
8366
8367	install_special_sighandlers();
8368	x = find_builtin(optarg);
8369	if (x) { /* paranoia */
8370	G.global_argc -= builtin_argc; /* skip [BARGV...] "" */
8371	G.global_argv += builtin_argc;
8372	G.global_argv[-1] = NULL; /* replace "" */
8373	fflush_all();
8374	G.last_exitcode = x->b_function(argv + optind - 1);
8375	}
8376	goto final_return;
8377	}
8378	if (!G.global_argv[0]) {
8379	/* -c 'script' (no params): prevent empty $0 */
8380	G.global_argv--; /* points to argv[i] of 'script' */
8381	G.global_argv[0] = argv[0];
8382	G.global_argc++;
8383	} /* else -c 'script' ARG0 [ARG1...]: $0 is ARG0 */
8384	install_special_sighandlers();
8385	parse_and_run_string(optarg);
8386	goto final_return;
8387	case 'i':
8388	/* Well, we cannot just declare interactiveness,
8389	* we have to have some stuff (ctty, etc) */
8390	/* G_interactive_fd++; */
8391	break;
8392	case 's':
8393	/* "-s" means "read from stdin", but this is how we always
8394	* operate, so simply do nothing here. */
8395	break;
8396	case 'l':
8397	flags |= OPT_login;
8398	break;
8399	#if !BB_MMU
8400	case '<': /* "big heredoc" support */
8401	full_write1_str(optarg);
8402	_exit(0);
8403	case '$': {
8404	unsigned long long empty_trap_mask;
8405
8406	G.root_pid = bb_strtou(optarg, &optarg, 16);
8407	optarg++;
8408	G.root_ppid = bb_strtou(optarg, &optarg, 16);
8409	optarg++;
8410	G.last_bg_pid = bb_strtou(optarg, &optarg, 16);
8411	optarg++;
8412	G.last_exitcode = bb_strtou(optarg, &optarg, 16);
8413	optarg++;
8414	builtin_argc = bb_strtou(optarg, &optarg, 16);
8415	optarg++;
8416	empty_trap_mask = bb_strtoull(optarg, &optarg, 16);
8417	if (empty_trap_mask != 0) {
8418	int sig;
8419	install_special_sighandlers();
8420	G.traps = xzalloc(sizeof(G.traps[0]) * NSIG);
8421	for (sig = 1; sig < NSIG; sig++) {
8422	if (empty_trap_mask & (1LL << sig)) {
8423	G.traps[sig] = xzalloc(1); /* == xstrdup(""); */
8424	install_sighandler(sig, SIG_IGN);
8425	}
8426	}
8427	}
8428	# if ENABLE_HUSH_LOOPS
8429	optarg++;
8430	G.depth_of_loop = bb_strtou(optarg, &optarg, 16);
8431	# endif
8432	break;
8433	}
8434	case 'R':
8435	case 'V':
8436	set_local_var(xstrdup(optarg), /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ opt == 'R');
8437	break;
8438	# if ENABLE_HUSH_FUNCTIONS
8439	case 'F': {
8440	struct function *funcp = new_function(optarg);
8441	/* funcp->name is already set to optarg */
8442	/* funcp->body is set to NULL. It's a special case. */
8443	funcp->body_as_string = argv[optind];
8444	optind++;
8445	break;
8446	}
8447	# endif
8448	#endif
8449	case 'n':
8450	case 'x':
8451	if (set_mode(1, opt, NULL) == 0) /* no error */
8452	break;
8453	default:
8454	#ifndef BB_VER
8455	fprintf(stderr, "Usage: sh [FILE]...\n"
8456	" or: sh -c command [args]...\n\n");
8457	exit(EXIT_FAILURE);
8458	#else
8459	bb_show_usage();
8460	#endif
8461	}
8462	} /* option parsing loop */
8463
8464	/* Skip options. Try "hush -l": $1 should not be "-l"! */
8465	G.global_argc = argc - (optind - 1);
8466	G.global_argv = argv + (optind - 1);
8467	G.global_argv[0] = argv[0];
8468
8469	if (!G.root_pid) {
8470	G.root_pid = getpid();
8471	G.root_ppid = getppid();
8472	}
8473
8474	/* If we are login shell... */
8475	if (flags & OPT_login) {
8476	FILE *input;
8477	debug_printf("sourcing /etc/profile\n");
8478	input = fopen_for_read("/etc/profile");
8479	if (input != NULL) {
8480	remember_FILE(input);
8481	install_special_sighandlers();
8482	parse_and_run_file(input);
8483	fclose_and_forget(input);
8484	}
8485	/* bash: after sourcing /etc/profile,
8486	* tries to source (in the given order):
8487	* ~/.bash_profile, ~/.bash_login, ~/.profile,
8488	* stopping on first found. --noprofile turns this off.
8489	* bash also sources ~/.bash_logout on exit.
8490	* If called as sh, skips .bash_XXX files.
8491	*/
8492	}
8493
8494	if (G.global_argv[1]) {
8495	FILE *input;
8496	/*
8497	* "bash <script>" (which is never interactive (unless -i?))
8498	* sources $BASH_ENV here (without scanning $PATH).
8499	* If called as sh, does the same but with $ENV.
8500	* Also NB, per POSIX, $ENV should undergo parameter expansion.
8501	*/
8502	G.global_argc--;
8503	G.global_argv++;
8504	debug_printf("running script '%s'\n", G.global_argv[0]);
8505	xfunc_error_retval = 127; /* for "hush /does/not/exist" case */
8506	input = xfopen_for_read(G.global_argv[0]);
8507	xfunc_error_retval = 1;
8508	remember_FILE(input);
8509	install_special_sighandlers();
8510	parse_and_run_file(input);
8511	#if ENABLE_FEATURE_CLEAN_UP
8512	fclose_and_forget(input);
8513	#endif
8514	goto final_return;
8515	}
8516
8517	/* Up to here, shell was non-interactive. Now it may become one.
8518	* NB: don't forget to (re)run install_special_sighandlers() as needed.
8519	*/
8520
8521	/* A shell is interactive if the '-i' flag was given,
8522	* or if all of the following conditions are met:
8523	* no -c command
8524	* no arguments remaining or the -s flag given
8525	* standard input is a terminal
8526	* standard output is a terminal
8527	* Refer to Posix.2, the description of the 'sh' utility.
8528	*/
8529	#if ENABLE_HUSH_JOB
8530	if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
8531	G_saved_tty_pgrp = tcgetpgrp(STDIN_FILENO);
8532	debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
8533	if (G_saved_tty_pgrp < 0)
8534	G_saved_tty_pgrp = 0;
8535
8536	/* try to dup stdin to high fd#, >= 255 */
8537	G_interactive_fd = fcntl(STDIN_FILENO, F_DUPFD, 255);
8538	if (G_interactive_fd < 0) {
8539	/* try to dup to any fd */
8540	G_interactive_fd = dup(STDIN_FILENO);
8541	if (G_interactive_fd < 0) {
8542	/* give up */
8543	G_interactive_fd = 0;
8544	G_saved_tty_pgrp = 0;
8545	}
8546	}
8547	// TODO: track & disallow any attempts of user
8548	// to (inadvertently) close/redirect G_interactive_fd
8549	}
8550	debug_printf("interactive_fd:%d\n", G_interactive_fd);
8551	if (G_interactive_fd) {
8552	close_on_exec_on(G_interactive_fd);
8553
8554	if (G_saved_tty_pgrp) {
8555	/* If we were run as 'hush &', sleep until we are
8556	* in the foreground (tty pgrp == our pgrp).
8557	* If we get started under a job aware app (like bash),
8558	* make sure we are now in charge so we don't fight over
8559	* who gets the foreground */
8560	while (1) {
8561	pid_t shell_pgrp = getpgrp();
8562	G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
8563	if (G_saved_tty_pgrp == shell_pgrp)
8564	break;
8565	/* send TTIN to ourself (should stop us) */
8566	kill(- shell_pgrp, SIGTTIN);
8567	}
8568	}
8569
8570	/* Install more signal handlers */
8571	install_special_sighandlers();
8572
8573	if (G_saved_tty_pgrp) {
8574	/* Set other signals to restore saved_tty_pgrp */
8575	install_fatal_sighandlers();
8576	/* Put ourselves in our own process group
8577	* (bash, too, does this only if ctty is available) */
8578	bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
8579	/* Grab control of the terminal */
8580	tcsetpgrp(G_interactive_fd, getpid());
8581	}
8582	enable_restore_tty_pgrp_on_exit();
8583
8584	# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
8585	{
8586	const char *hp = get_local_var_value("HISTFILE");
8587	if (!hp) {
8588	hp = get_local_var_value("HOME");
8589	if (hp)
8590	hp = concat_path_file(hp, ".hush_history");
8591	} else {
8592	hp = xstrdup(hp);
8593	}
8594	if (hp) {
8595	G.line_input_state->hist_file = hp;
8596	//set_local_var(xasprintf("HISTFILE=%s", ...));
8597	}
8598	# if ENABLE_FEATURE_SH_HISTFILESIZE
8599	hp = get_local_var_value("HISTFILESIZE");
8600	G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
8601	# endif
8602	}
8603	# endif
8604	} else {
8605	install_special_sighandlers();
8606	}
8607	#elif ENABLE_HUSH_INTERACTIVE
8608	/* No job control compiled in, only prompt/line editing */
8609	if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
8610	G_interactive_fd = fcntl(STDIN_FILENO, F_DUPFD, 255);
8611	if (G_interactive_fd < 0) {
8612	/* try to dup to any fd */
8613	G_interactive_fd = dup(STDIN_FILENO);
8614	if (G_interactive_fd < 0)
8615	/* give up */
8616	G_interactive_fd = 0;
8617	}
8618	}
8619	if (G_interactive_fd) {
8620	close_on_exec_on(G_interactive_fd);
8621	}
8622	install_special_sighandlers();
8623	#else
8624	/* We have interactiveness code disabled */
8625	install_special_sighandlers();
8626	#endif
8627	/* bash:
8628	* if interactive but not a login shell, sources ~/.bashrc
8629	* (--norc turns this off, --rcfile <file> overrides)
8630	*/
8631
8632	if (!ENABLE_FEATURE_SH_EXTRA_QUIET && G_interactive_fd) {
8633	/* note: ash and hush share this string */
8634	printf("\n\n%s %s\n"
8635	IF_HUSH_HELP("Enter 'help' for a list of built-in commands.\n")
8636	"\n",
8637	bb_banner,
8638	"hush - the humble shell"
8639	);
8640	}
8641
8642	parse_and_run_file(stdin);
8643
8644	final_return:
8645	hush_exit(G.last_exitcode);
8646	}
8647
8648
8649	#if ENABLE_MSH
8650	int msh_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
8651	int msh_main(int argc, char **argv)
8652	{
8653	bb_error_msg("msh is deprecated, please use hush instead");
8654	return hush_main(argc, argv);
8655	}
8656	#endif
8657
8658
8659	/*
8660	* Built-ins
8661	*/
8662	static int FAST_FUNC builtin_true(char **argv UNUSED_PARAM)
8663	{
8664	return 0;
8665	}
8666
8667	static int run_applet_main(char **argv, int (*applet_main_func)(int argc, char **argv))
8668	{
8669	int argc = 0;
8670	while (*argv) {
8671	argc++;
8672	argv++;
8673	}
8674	return applet_main_func(argc, argv - argc);
8675	}
8676
8677	static int FAST_FUNC builtin_test(char **argv)
8678	{
8679	return run_applet_main(argv, test_main);
8680	}
8681
8682	static int FAST_FUNC builtin_echo(char **argv)
8683	{
8684	return run_applet_main(argv, echo_main);
8685	}
8686
8687	#if ENABLE_PRINTF
8688	static int FAST_FUNC builtin_printf(char **argv)
8689	{
8690	return run_applet_main(argv, printf_main);
8691	}
8692	#endif
8693
8694	static char **skip_dash_dash(char **argv)
8695	{
8696	argv++;
8697	if (argv[0] && argv[0][0] == '-' && argv[0][1] == '-' && argv[0][2] == '\0')
8698	argv++;
8699	return argv;
8700	}
8701
8702	static int FAST_FUNC builtin_eval(char **argv)
8703	{
8704	int rcode = EXIT_SUCCESS;
8705
8706	argv = skip_dash_dash(argv);
8707	if (*argv) {
8708	char *str = expand_strvec_to_string(argv);
8709	/* bash:
8710	* eval "echo Hi; done" ("done" is syntax error):
8711	* "echo Hi" will not execute too.
8712	*/
8713	parse_and_run_string(str);
8714	free(str);
8715	rcode = G.last_exitcode;
8716	}
8717	return rcode;
8718	}
8719
8720	static int FAST_FUNC builtin_cd(char **argv)
8721	{
8722	const char *newdir;
8723
8724	argv = skip_dash_dash(argv);
8725	newdir = argv[0];
8726	if (newdir == NULL) {
8727	/* bash does nothing (exitcode 0) if HOME is ""; if it's unset,
8728	* bash says "bash: cd: HOME not set" and does nothing
8729	* (exitcode 1)
8730	*/
8731	const char *home = get_local_var_value("HOME");
8732	newdir = home ? home : "/";
8733	}
8734	if (chdir(newdir)) {
8735	/* Mimic bash message exactly */
8736	bb_perror_msg("cd: %s", newdir);
8737	return EXIT_FAILURE;
8738	}
8739	/* Read current dir (get_cwd(1) is inside) and set PWD.
8740	* Note: do not enforce exporting. If PWD was unset or unexported,
8741	* set it again, but do not export. bash does the same.
8742	*/
8743	set_pwd_var(/*exp:*/ 0);
8744	return EXIT_SUCCESS;
8745	}
8746
8747	static int FAST_FUNC builtin_exec(char **argv)
8748	{
8749	argv = skip_dash_dash(argv);
8750	if (argv[0] == NULL)
8751	return EXIT_SUCCESS; /* bash does this */
8752
8753	/* Careful: we can end up here after [v]fork. Do not restore
8754	* tty pgrp then, only top-level shell process does that */
8755	if (G_saved_tty_pgrp && getpid() == G.root_pid)
8756	tcsetpgrp(G_interactive_fd, G_saved_tty_pgrp);
8757
8758	/* TODO: if exec fails, bash does NOT exit! We do.
8759	* We'll need to undo trap cleanup (it's inside execvp_or_die)
8760	* and tcsetpgrp, and this is inherently racy.
8761	*/
8762	execvp_or_die(argv);
8763	}
8764
8765	static int FAST_FUNC builtin_exit(char **argv)
8766	{
8767	debug_printf_exec("%s()\n", __func__);
8768
8769	/* interactive bash:
8770	* # trap "echo EEE" EXIT
8771	* # exit
8772	* exit
8773	* There are stopped jobs.
8774	* (if there are _stopped_ jobs, running ones don't count)
8775	* # exit
8776	* exit
8777	* EEE (then bash exits)
8778	*
8779	* TODO: we can use G.exiting = -1 as indicator "last cmd was exit"
8780	*/
8781
8782	/* note: EXIT trap is run by hush_exit */
8783	argv = skip_dash_dash(argv);
8784	if (argv[0] == NULL)
8785	hush_exit(G.last_exitcode);
8786	/* mimic bash: exit 123abc == exit 255 + error msg */
8787	xfunc_error_retval = 255;
8788	/* bash: exit -2 == exit 254, no error msg */
8789	hush_exit(xatoi(argv[0]) & 0xff);
8790	}
8791
8792	static void print_escaped(const char *s)
8793	{
8794	if (*s == '\'')
8795	goto squote;
8796	do {
8797	const char *p = strchrnul(s, '\'');
8798	/* print 'xxxx', possibly just '' */
8799	printf("'%.*s'", (int)(p - s), s);
8800	if (*p == '\0')
8801	break;
8802	s = p;
8803	squote:
8804	/* s points to '; print "'''...'''" */
8805	putchar('"');
8806	do putchar('\''); while (*++s == '\'');
8807	putchar('"');
8808	} while (*s);
8809	}
8810
8811	#if !ENABLE_HUSH_LOCAL
8812	#define helper_export_local(argv, exp, lvl) \
8813	helper_export_local(argv, exp)
8814	#endif
8815	static void helper_export_local(char **argv, int exp, int lvl)
8816	{
8817	do {
8818	char *name = *argv;
8819	char *name_end = strchrnul(name, '=');
8820
8821	/* So far we do not check that name is valid (TODO?) */
8822
8823	if (*name_end == '\0') {
8824	struct variable *var, **vpp;
8825
8826	vpp = get_ptr_to_local_var(name, name_end - name);
8827	var = vpp ? *vpp : NULL;
8828
8829	if (exp == -1) { /* unexporting? */
8830	/* export -n NAME (without =VALUE) */
8831	if (var) {
8832	var->flg_export = 0;
8833	debug_printf_env("%s: unsetenv '%s'\n", __func__, name);
8834	unsetenv(name);
8835	} /* else: export -n NOT_EXISTING_VAR: no-op */
8836	continue;
8837	}
8838	if (exp == 1) { /* exporting? */
8839	/* export NAME (without =VALUE) */
8840	if (var) {
8841	var->flg_export = 1;
8842	debug_printf_env("%s: putenv '%s'\n", __func__, var->varstr);
8843	putenv(var->varstr);
8844	continue;
8845	}
8846	}
8847	#if ENABLE_HUSH_LOCAL
8848	if (exp == 0 /* local? */
8849	&& var && var->func_nest_level == lvl
8850	) {
8851	/* "local x=abc; ...; local x" - ignore second local decl */
8852	continue;
8853	}
8854	#endif
8855	/* Exporting non-existing variable.
8856	* bash does not put it in environment,
8857	* but remembers that it is exported,
8858	* and does put it in env when it is set later.
8859	* We just set it to "" and export. */
8860	/* Or, it's "local NAME" (without =VALUE).
8861	* bash sets the value to "". */
8862	name = xasprintf("%s=", name);
8863	} else {
8864	/* (Un)exporting/making local NAME=VALUE */
8865	name = xstrdup(name);
8866	}
8867	set_local_var(name, /*exp:*/ exp, /*lvl:*/ lvl, /*ro:*/ 0);
8868	} while (*++argv);
8869	}
8870
8871	static int FAST_FUNC builtin_export(char **argv)
8872	{
8873	unsigned opt_unexport;
8874
8875	#if ENABLE_HUSH_EXPORT_N
8876	/* "!": do not abort on errors */
8877	opt_unexport = getopt32(argv, "!n");
8878	if (opt_unexport == (uint32_t)-1)
8879	return EXIT_FAILURE;
8880	argv += optind;
8881	#else
8882	opt_unexport = 0;
8883	argv++;
8884	#endif
8885
8886	if (argv[0] == NULL) {
8887	char **e = environ;
8888	if (e) {
8889	while (*e) {
8890	#if 0
8891	puts(*e++);
8892	#else
8893	/* ash emits: export VAR='VAL'
8894	* bash: declare -x VAR="VAL"
8895	* we follow ash example */
8896	const char *s = *e++;
8897	const char *p = strchr(s, '=');
8898
8899	if (!p) /* wtf? take next variable */
8900	continue;
8901	/* export var= */
8902	printf("export %.*s", (int)(p - s) + 1, s);
8903	print_escaped(p + 1);
8904	putchar('\n');
8905	#endif
8906	}
8907	/*fflush_all(); - done after each builtin anyway */
8908	}
8909	return EXIT_SUCCESS;
8910	}
8911
8912	helper_export_local(argv, (opt_unexport ? -1 : 1), 0);
8913
8914	return EXIT_SUCCESS;
8915	}
8916
8917	#if ENABLE_HUSH_LOCAL
8918	static int FAST_FUNC builtin_local(char **argv)
8919	{
8920	if (G.func_nest_level == 0) {
8921	bb_error_msg("%s: not in a function", argv[0]);
8922	return EXIT_FAILURE; /* bash compat */
8923	}
8924	helper_export_local(argv, 0, G.func_nest_level);
8925	return EXIT_SUCCESS;
8926	}
8927	#endif
8928
8929	/* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#unset */
8930	static int FAST_FUNC builtin_unset(char **argv)
8931	{
8932	int ret;
8933	unsigned opts;
8934
8935	/* "!": do not abort on errors */
8936	/* "+": stop at 1st non-option */
8937	opts = getopt32(argv, "!+vf");
8938	if (opts == (unsigned)-1)
8939	return EXIT_FAILURE;
8940	if (opts == 3) {
8941	bb_error_msg("unset: -v and -f are exclusive");
8942	return EXIT_FAILURE;
8943	}
8944	argv += optind;
8945
8946	ret = EXIT_SUCCESS;
8947	while (*argv) {
8948	if (!(opts & 2)) { /* not -f */
8949	if (unset_local_var(*argv)) {
8950	/* unset <nonexistent_var> doesn't fail.
8951	* Error is when one tries to unset RO var.
8952	* Message was printed by unset_local_var. */
8953	ret = EXIT_FAILURE;
8954	}
8955	}
8956	#if ENABLE_HUSH_FUNCTIONS
8957	else {
8958	unset_func(*argv);
8959	}
8960	#endif
8961	argv++;
8962	}
8963	return ret;
8964	}
8965
8966	/* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#set
8967	* built-in 'set' handler
8968	* SUSv3 says:
8969	* set [-abCefhmnuvx] [-o option] [argument...]
8970	* set [+abCefhmnuvx] [+o option] [argument...]
8971	* set -- [argument...]
8972	* set -o
8973	* set +o
8974	* Implementations shall support the options in both their hyphen and
8975	* plus-sign forms. These options can also be specified as options to sh.
8976	* Examples:
8977	* Write out all variables and their values: set
8978	* Set $1, $2, and $3 and set "$#" to 3: set c a b
8979	* Turn on the -x and -v options: set -xv
8980	* Unset all positional parameters: set --
8981	* Set $1 to the value of x, even if it begins with '-' or '+': set -- "$x"
8982	* Set the positional parameters to the expansion of x, even if x expands
8983	* with a leading '-' or '+': set -- $x
8984	*
8985	* So far, we only support "set -- [argument...]" and some of the short names.
8986	*/
8987	static int FAST_FUNC builtin_set(char **argv)
8988	{
8989	int n;
8990	char **pp, **g_argv;
8991	char *arg = *++argv;
8992
8993	if (arg == NULL) {
8994	struct variable *e;
8995	for (e = G.top_var; e; e = e->next)
8996	puts(e->varstr);
8997	return EXIT_SUCCESS;
8998	}
8999
9000	do {
9001	if (strcmp(arg, "--") == 0) {
9002	++argv;
9003	goto set_argv;
9004	}
9005	if (arg[0] != '+' && arg[0] != '-')
9006	break;
9007	for (n = 1; arg[n]; ++n) {
9008	if (set_mode((arg[0] == '-'), arg[n], argv[1]))
9009	goto error;
9010	if (arg[n] == 'o' && argv[1])
9011	argv++;
9012	}
9013	} while ((arg = *++argv) != NULL);
9014	/* Now argv[0] is 1st argument */
9015
9016	if (arg == NULL)
9017	return EXIT_SUCCESS;
9018	set_argv:
9019
9020	/* NB: G.global_argv[0] ($0) is never freed/changed */
9021	g_argv = G.global_argv;
9022	if (G.global_args_malloced) {
9023	pp = g_argv;
9024	while (*++pp)
9025	free(*pp);
9026	g_argv[1] = NULL;
9027	} else {
9028	G.global_args_malloced = 1;
9029	pp = xzalloc(sizeof(pp[0]) * 2);
9030	pp[0] = g_argv[0]; /* retain $0 */
9031	g_argv = pp;
9032	}
9033	/* This realloc's G.global_argv */
9034	G.global_argv = pp = add_strings_to_strings(g_argv, argv, /*dup:*/ 1);
9035
9036	n = 1;
9037	while (*++pp)
9038	n++;
9039	G.global_argc = n;
9040
9041	return EXIT_SUCCESS;
9042
9043	/* Nothing known, so abort */
9044	error:
9045	bb_error_msg("set: %s: invalid option", arg);
9046	return EXIT_FAILURE;
9047	}
9048
9049	static int FAST_FUNC builtin_shift(char **argv)
9050	{
9051	int n = 1;
9052	argv = skip_dash_dash(argv);
9053	if (argv[0]) {
9054	n = atoi(argv[0]);
9055	}
9056	if (n >= 0 && n < G.global_argc) {
9057	if (G.global_args_malloced) {
9058	int m = 1;
9059	while (m <= n)
9060	free(G.global_argv[m++]);
9061	}
9062	G.global_argc -= n;
9063	memmove(&G.global_argv[1], &G.global_argv[n+1],
9064	G.global_argc * sizeof(G.global_argv[0]));
9065	return EXIT_SUCCESS;
9066	}
9067	return EXIT_FAILURE;
9068	}
9069
9070	/* Interruptibility of read builtin in bash
9071	* (tested on bash-4.2.8 by sending signals (not by ^C)):
9072	*
9073	* Empty trap makes read ignore corresponding signal, for any signal.
9074	*
9075	* SIGINT:
9076	* - terminates non-interactive shell;
9077	* - interrupts read in interactive shell;
9078	* if it has non-empty trap:
9079	* - executes trap and returns to command prompt in interactive shell;
9080	* - executes trap and returns to read in non-interactive shell;
9081	* SIGTERM:
9082	* - is ignored (does not interrupt) read in interactive shell;
9083	* - terminates non-interactive shell;
9084	* if it has non-empty trap:
9085	* - executes trap and returns to read;
9086	* SIGHUP:
9087	* - terminates shell (regardless of interactivity);
9088	* if it has non-empty trap:
9089	* - executes trap and returns to read;
9090	*/
9091	static int FAST_FUNC builtin_read(char **argv)
9092	{
9093	const char *r;
9094	char *opt_n = NULL;
9095	char *opt_p = NULL;
9096	char *opt_t = NULL;
9097	char *opt_u = NULL;
9098	const char *ifs;
9099	int read_flags;
9100
9101	/* "!": do not abort on errors.
9102	* Option string must start with "sr" to match BUILTIN_READ_xxx
9103	*/
9104	read_flags = getopt32(argv, "!srn:p:t:u:", &opt_n, &opt_p, &opt_t, &opt_u);
9105	if (read_flags == (uint32_t)-1)
9106	return EXIT_FAILURE;
9107	argv += optind;
9108	ifs = get_local_var_value("IFS"); /* can be NULL */
9109
9110	again:
9111	r = shell_builtin_read(set_local_var_from_halves,
9112	argv,
9113	ifs,
9114	read_flags,
9115	opt_n,
9116	opt_p,
9117	opt_t,
9118	opt_u
9119	);
9120
9121	if ((uintptr_t)r == 1 && errno == EINTR) {
9122	unsigned sig = check_and_run_traps();
9123	if (sig && sig != SIGINT)
9124	goto again;
9125	}
9126
9127	if ((uintptr_t)r > 1) {
9128	bb_error_msg("%s", r);
9129	r = (char*)(uintptr_t)1;
9130	}
9131
9132	return (uintptr_t)r;
9133	}
9134
9135	static int FAST_FUNC builtin_trap(char **argv)
9136	{
9137	int sig;
9138	char *new_cmd;
9139
9140	if (!G.traps)
9141	G.traps = xzalloc(sizeof(G.traps[0]) * NSIG);
9142
9143	argv++;
9144	if (!*argv) {
9145	int i;
9146	/* No args: print all trapped */
9147	for (i = 0; i < NSIG; ++i) {
9148	if (G.traps[i]) {
9149	printf("trap -- ");
9150	print_escaped(G.traps[i]);
9151	/* note: bash adds "SIG", but only if invoked
9152	* as "bash". If called as "sh", or if set -o posix,
9153	* then it prints short signal names.
9154	* We are printing short names: */
9155	printf(" %s\n", get_signame(i));
9156	}
9157	}
9158	/*fflush_all(); - done after each builtin anyway */
9159	return EXIT_SUCCESS;
9160	}
9161
9162	new_cmd = NULL;
9163	/* If first arg is a number: reset all specified signals */
9164	sig = bb_strtou(*argv, NULL, 10);
9165	if (errno == 0) {
9166	int ret;
9167	process_sig_list:
9168	ret = EXIT_SUCCESS;
9169	while (*argv) {
9170	sighandler_t handler;
9171
9172	sig = get_signum(*argv++);
9173	if (sig < 0 || sig >= NSIG) {
9174	ret = EXIT_FAILURE;
9175	/* Mimic bash message exactly */
9176	bb_perror_msg("trap: %s: invalid signal specification", argv[-1]);
9177	continue;
9178	}
9179
9180	free(G.traps[sig]);
9181	G.traps[sig] = xstrdup(new_cmd);
9182
9183	debug_printf("trap: setting SIG%s (%i) to '%s'\n",
9184	get_signame(sig), sig, G.traps[sig]);
9185
9186	/* There is no signal for 0 (EXIT) */
9187	if (sig == 0)
9188	continue;
9189
9190	if (new_cmd)
9191	handler = (new_cmd[0] ? record_pending_signo : SIG_IGN);
9192	else
9193	/* We are removing trap handler */
9194	handler = pick_sighandler(sig);
9195	install_sighandler(sig, handler);
9196	}
9197	return ret;
9198	}
9199
9200	if (!argv[1]) { /* no second arg */
9201	bb_error_msg("trap: invalid arguments");
9202	return EXIT_FAILURE;
9203	}
9204
9205	/* First arg is "-": reset all specified to default */
9206	/* First arg is "--": skip it, the rest is "handler SIGs..." */
9207	/* Everything else: set arg as signal handler
9208	* (includes "" case, which ignores signal) */
9209	if (argv[0][0] == '-') {
9210	if (argv[0][1] == '\0') { /* "-" */
9211	/* new_cmd remains NULL: "reset these sigs" */
9212	goto reset_traps;
9213	}
9214	if (argv[0][1] == '-' && argv[0][2] == '\0') { /* "--" */
9215	argv++;
9216	}
9217	/* else: "-something", no special meaning */
9218	}
9219	new_cmd = *argv;
9220	reset_traps:
9221	argv++;
9222	goto process_sig_list;
9223	}
9224
9225	/* http://www.opengroup.org/onlinepubs/9699919799/utilities/type.html */
9226	static int FAST_FUNC builtin_type(char **argv)
9227	{
9228	int ret = EXIT_SUCCESS;
9229
9230	while (*++argv) {
9231	const char *type;
9232	char *path = NULL;
9233
9234	if (0) {} /* make conditional compile easier below */
9235	/*else if (find_alias(*argv))
9236	type = "an alias";*/
9237	#if ENABLE_HUSH_FUNCTIONS
9238	else if (find_function(*argv))
9239	type = "a function";
9240	#endif
9241	else if (find_builtin(*argv))
9242	type = "a shell builtin";
9243	else if ((path = find_in_path(*argv)) != NULL)
9244	type = path;
9245	else {
9246	bb_error_msg("type: %s: not found", *argv);
9247	ret = EXIT_FAILURE;
9248	continue;
9249	}
9250
9251	printf("%s is %s\n", *argv, type);
9252	free(path);
9253	}
9254
9255	return ret;
9256	}
9257
9258	#if ENABLE_HUSH_JOB
9259	static struct pipe *parse_jobspec(const char *str)
9260	{
9261	struct pipe *pi;
9262	int jobnum;
9263
9264	if (sscanf(str, "%%%d", &jobnum) != 1) {
9265	bb_error_msg("bad argument '%s'", str);
9266	return NULL;
9267	}
9268	for (pi = G.job_list; pi; pi = pi->next) {
9269	if (pi->jobid == jobnum) {
9270	return pi;
9271	}
9272	}
9273	bb_error_msg("%d: no such job", jobnum);
9274	return NULL;
9275	}
9276
9277	/* built-in 'fg' and 'bg' handler */
9278	static int FAST_FUNC builtin_fg_bg(char **argv)
9279	{
9280	int i;
9281	struct pipe *pi;
9282
9283	if (!G_interactive_fd)
9284	return EXIT_FAILURE;
9285
9286	/* If they gave us no args, assume they want the last backgrounded task */
9287	if (!argv[1]) {
9288	for (pi = G.job_list; pi; pi = pi->next) {
9289	if (pi->jobid == G.last_jobid) {
9290	goto found;
9291	}
9292	}
9293	bb_error_msg("%s: no current job", argv[0]);
9294	return EXIT_FAILURE;
9295	}
9296
9297	pi = parse_jobspec(argv[1]);
9298	if (!pi)
9299	return EXIT_FAILURE;
9300	found:
9301	/* TODO: bash prints a string representation
9302	* of job being foregrounded (like "sleep 1 | cat") */
9303	if (argv[0][0] == 'f' && G_saved_tty_pgrp) {
9304	/* Put the job into the foreground. */
9305	tcsetpgrp(G_interactive_fd, pi->pgrp);
9306	}
9307
9308	/* Restart the processes in the job */
9309	debug_printf_jobs("reviving %d procs, pgrp %d\n", pi->num_cmds, pi->pgrp);
9310	for (i = 0; i < pi->num_cmds; i++) {
9311	debug_printf_jobs("reviving pid %d\n", pi->cmds[i].pid);
9312	}
9313	pi->stopped_cmds = 0;
9314
9315	i = kill(- pi->pgrp, SIGCONT);
9316	if (i < 0) {
9317	if (errno == ESRCH) {
9318	delete_finished_bg_job(pi);
9319	return EXIT_SUCCESS;
9320	}
9321	bb_perror_msg("kill (SIGCONT)");
9322	}
9323
9324	if (argv[0][0] == 'f') {
9325	remove_bg_job(pi);
9326	return checkjobs_and_fg_shell(pi);
9327	}
9328	return EXIT_SUCCESS;
9329	}
9330	#endif
9331
9332	#if ENABLE_HUSH_HELP
9333	static int FAST_FUNC builtin_help(char **argv UNUSED_PARAM)
9334	{
9335	const struct built_in_command *x;
9336
9337	printf(
9338	"Built-in commands:\n"
9339	"------------------\n");
9340	for (x = bltins1; x != &bltins1[ARRAY_SIZE(bltins1)]; x++) {
9341	if (x->b_descr)
9342	printf("%-10s%s\n", x->b_cmd, x->b_descr);
9343	}
9344	return EXIT_SUCCESS;
9345	}
9346	#endif
9347
9348	#if MAX_HISTORY && ENABLE_FEATURE_EDITING
9349	static int FAST_FUNC builtin_history(char **argv UNUSED_PARAM)
9350	{
9351	show_history(G.line_input_state);
9352	return EXIT_SUCCESS;
9353	}
9354	#endif
9355
9356	#if ENABLE_HUSH_JOB
9357	static int FAST_FUNC builtin_jobs(char **argv UNUSED_PARAM)
9358	{
9359	struct pipe *job;
9360	const char *status_string;
9361
9362	checkjobs(NULL, 0 /*(no pid to wait for)*/);
9363	for (job = G.job_list; job; job = job->next) {
9364	if (job->alive_cmds == job->stopped_cmds)
9365	status_string = "Stopped";
9366	else
9367	status_string = "Running";
9368
9369	printf(JOB_STATUS_FORMAT, job->jobid, status_string, job->cmdtext);
9370	}
9371	return EXIT_SUCCESS;
9372	}
9373	#endif
9374
9375	#if HUSH_DEBUG
9376	static int FAST_FUNC builtin_memleak(char **argv UNUSED_PARAM)
9377	{
9378	void *p;
9379	unsigned long l;
9380
9381	# ifdef M_TRIM_THRESHOLD
9382	/* Optional. Reduces probability of false positives */
9383	malloc_trim(0);
9384	# endif
9385	/* Crude attempt to find where "free memory" starts,
9386	* sans fragmentation. */
9387	p = malloc(240);
9388	l = (unsigned long)p;
9389	free(p);
9390	p = malloc(3400);
9391	if (l < (unsigned long)p) l = (unsigned long)p;
9392	free(p);
9393
9394
9395	# if 0 /* debug */
9396	{
9397	struct mallinfo mi = mallinfo();
9398	printf("top alloc:0x%lx malloced:%d+%d=%d\n", l,
9399	mi.arena, mi.hblkhd, mi.arena + mi.hblkhd);
9400	}
9401	# endif
9402
9403	if (!G.memleak_value)
9404	G.memleak_value = l;
9405
9406	l -= G.memleak_value;
9407	if ((long)l < 0)
9408	l = 0;
9409	l /= 1024;
9410	if (l > 127)
9411	l = 127;
9412
9413	/* Exitcode is "how many kilobytes we leaked since 1st call" */
9414	return l;
9415	}
9416	#endif
9417
9418	static int FAST_FUNC builtin_pwd(char **argv UNUSED_PARAM)
9419	{
9420	puts(get_cwd(0));
9421	return EXIT_SUCCESS;
9422	}
9423
9424	static int FAST_FUNC builtin_source(char **argv)
9425	{
9426	char *arg_path, *filename;
9427	FILE *input;
9428	save_arg_t sv;
9429	#if ENABLE_HUSH_FUNCTIONS
9430	smallint sv_flg;
9431	#endif
9432
9433	argv = skip_dash_dash(argv);
9434	filename = argv[0];
9435	if (!filename) {
9436	/* bash says: "bash: .: filename argument required" */
9437	return 2; /* bash compat */
9438	}
9439	arg_path = NULL;
9440	if (!strchr(filename, '/')) {
9441	arg_path = find_in_path(filename);
9442	if (arg_path)
9443	filename = arg_path;
9444	}
9445	input = remember_FILE(fopen_or_warn(filename, "r"));
9446	free(arg_path);
9447	if (!input) {
9448	/* bb_perror_msg("%s", *argv); - done by fopen_or_warn */
9449	/* POSIX: non-interactive shell should abort here,
9450	* not merely fail. So far no one complained :)
9451	*/
9452	return EXIT_FAILURE;
9453	}
9454
9455	#if ENABLE_HUSH_FUNCTIONS
9456	sv_flg = G_flag_return_in_progress;
9457	/* "we are inside sourced file, ok to use return" */
9458	G_flag_return_in_progress = -1;
9459	#endif
9460	if (argv[1])
9461	save_and_replace_G_args(&sv, argv);
9462
9463	/* "false; . ./empty_line; echo Zero:$?" should print 0 */
9464	G.last_exitcode = 0;
9465	parse_and_run_file(input);
9466	fclose_and_forget(input);
9467
9468	if (argv[1])
9469	restore_G_args(&sv, argv);
9470	#if ENABLE_HUSH_FUNCTIONS
9471	G_flag_return_in_progress = sv_flg;
9472	#endif
9473
9474	return G.last_exitcode;
9475	}
9476
9477	static int FAST_FUNC builtin_umask(char **argv)
9478	{
9479	int rc;
9480	mode_t mask;
9481
9482	rc = 1;
9483	mask = umask(0);
9484	argv = skip_dash_dash(argv);
9485	if (argv[0]) {
9486	mode_t old_mask = mask;
9487
9488	/* numeric umasks are taken as-is */
9489	/* symbolic umasks are inverted: "umask a=rx" calls umask(222) */
9490	if (!isdigit(argv[0][0]))
9491	mask ^= 0777;
9492	mask = bb_parse_mode(argv[0], mask);
9493	if (!isdigit(argv[0][0]))
9494	mask ^= 0777;
9495	if ((unsigned)mask > 0777) {
9496	mask = old_mask;
9497	/* bash messages:
9498	* bash: umask: 'q': invalid symbolic mode operator
9499	* bash: umask: 999: octal number out of range
9500	*/
9501	bb_error_msg("%s: invalid mode '%s'", "umask", argv[0]);
9502	rc = 0;
9503	}
9504	} else {
9505	/* Mimic bash */
9506	printf("%04o\n", (unsigned) mask);
9507	/* fall through and restore mask which we set to 0 */
9508	}
9509	umask(mask);
9510
9511	return !rc; /* rc != 0 - success */
9512	}
9513
9514	/* http://www.opengroup.org/onlinepubs/9699919799/utilities/wait.html */
9515	#if !ENABLE_HUSH_JOB
9516	# define wait_for_child_or_signal(pipe,pid) wait_for_child_or_signal(pid)
9517	#endif
9518	static int wait_for_child_or_signal(struct pipe *waitfor_pipe, pid_t waitfor_pid)
9519	{
9520	int ret = 0;
9521	for (;;) {
9522	int sig;
9523	sigset_t oldset;
9524
9525	if (!sigisemptyset(&G.pending_set))
9526	goto check_sig;
9527
9528	/* waitpid is not interruptible by SA_RESTARTed
9529	* signals which we use. Thus, this ugly dance:
9530	*/
9531
9532	/* Make sure possible SIGCHLD is stored in kernel's
9533	* pending signal mask before we call waitpid.
9534	* Or else we may race with SIGCHLD, lose it,
9535	* and get stuck in sigsuspend...
9536	*/
9537	sigfillset(&oldset); /* block all signals, remember old set */
9538	sigprocmask(SIG_SETMASK, &oldset, &oldset);
9539
9540	if (!sigisemptyset(&G.pending_set)) {
9541	/* Crap! we raced with some signal! */
9542	goto restore;
9543	}
9544
9545	/*errno = 0; - checkjobs does this */
9546	/* Can't pass waitfor_pipe into checkjobs(): it won't be interruptible */
9547	ret = checkjobs(NULL, waitfor_pid); /* waitpid(WNOHANG) inside */
9548	debug_printf_exec("checkjobs:%d\n", ret);
9549	#if ENABLE_HUSH_JOB
9550	if (waitfor_pipe) {
9551	int rcode = job_exited_or_stopped(waitfor_pipe);
9552	debug_printf_exec("job_exited_or_stopped:%d\n", rcode);
9553	if (rcode >= 0) {
9554	ret = rcode;
9555	sigprocmask(SIG_SETMASK, &oldset, NULL);
9556	break;
9557	}
9558	}
9559	#endif
9560	/* if ECHILD, there are no children (ret is -1 or 0) */
9561	/* if ret == 0, no children changed state */
9562	/* if ret != 0, it's exitcode+1 of exited waitfor_pid child */
9563	if (errno == ECHILD || ret) {
9564	ret--;
9565	if (ret < 0) /* if ECHILD, may need to fix "ret" */
9566	ret = 0;
9567	sigprocmask(SIG_SETMASK, &oldset, NULL);
9568	break;
9569	}
9570	/* Wait for SIGCHLD or any other signal */
9571	/* It is vitally important for sigsuspend that SIGCHLD has non-DFL handler! */
9572	/* Note: sigsuspend invokes signal handler */
9573	sigsuspend(&oldset);
9574	restore:
9575	sigprocmask(SIG_SETMASK, &oldset, NULL);
9576	check_sig:
9577	/* So, did we get a signal? */
9578	sig = check_and_run_traps();
9579	if (sig /*&& sig != SIGCHLD - always true */) {
9580	ret = 128 + sig;
9581	break;
9582	}
9583	/* SIGCHLD, or no signal, or ignored one, such as SIGQUIT. Repeat */
9584	}
9585	return ret;
9586	}
9587
9588	static int FAST_FUNC builtin_wait(char **argv)
9589	{
9590	int ret;
9591	int status;
9592
9593	argv = skip_dash_dash(argv);
9594	if (argv[0] == NULL) {
9595	/* Don't care about wait results */
9596	/* Note 1: must wait until there are no more children */
9597	/* Note 2: must be interruptible */
9598	/* Examples:
9599	* $ sleep 3 & sleep 6 & wait
9600	* [1] 30934 sleep 3
9601	* [2] 30935 sleep 6
9602	* [1] Done sleep 3
9603	* [2] Done sleep 6
9604	* $ sleep 3 & sleep 6 & wait
9605	* [1] 30936 sleep 3
9606	* [2] 30937 sleep 6
9607	* [1] Done sleep 3
9608	* ^C <-- after ~4 sec from keyboard
9609	* $
9610	*/
9611	return wait_for_child_or_signal(NULL, 0 /*(no job and no pid to wait for)*/);
9612	}
9613
9614	do {
9615	pid_t pid = bb_strtou(*argv, NULL, 10);
9616	if (errno || pid <= 0) {
9617	#if ENABLE_HUSH_JOB
9618	if (argv[0][0] == '%') {
9619	struct pipe *wait_pipe;
9620	wait_pipe = parse_jobspec(*argv);
9621	if (wait_pipe) {
9622	ret = job_exited_or_stopped(wait_pipe);
9623	if (ret < 0)
9624	ret = wait_for_child_or_signal(wait_pipe, 0);
9625	continue;
9626	}
9627	}
9628	#endif
9629	/* mimic bash message */
9630	bb_error_msg("wait: '%s': not a pid or valid job spec", *argv);
9631	ret = EXIT_FAILURE;
9632	continue; /* bash checks all argv[] */
9633	}
9634
9635	/* Do we have such child? */
9636	ret = waitpid(pid, &status, WNOHANG);
9637	if (ret < 0) {
9638	/* No */
9639	if (errno == ECHILD) {
9640	if (G.last_bg_pid > 0 && pid == G.last_bg_pid) {
9641	/* "wait $!" but last bg task has already exited. Try:
9642	* (sleep 1; exit 3) & sleep 2; echo $?; wait $!; echo $?
9643	* In bash it prints exitcode 0, then 3.
9644	* In dash, it is 127.
9645	*/
9646	/* ret = G.last_bg_pid_exitstatus - FIXME */
9647	} else {
9648	/* Example: "wait 1". mimic bash message */
9649	bb_error_msg("wait: pid %d is not a child of this shell", (int)pid);
9650	}
9651	} else {
9652	/* ??? */
9653	bb_perror_msg("wait %s", *argv);
9654	}
9655	ret = 127;
9656	continue; /* bash checks all argv[] */
9657	}
9658	if (ret == 0) {
9659	/* Yes, and it still runs */
9660	ret = wait_for_child_or_signal(NULL, pid);
9661	} else {
9662	/* Yes, and it just exited */
9663	process_wait_result(NULL, pid, status);
9664	ret = WEXITSTATUS(status);
9665	if (WIFSIGNALED(status))
9666	ret = 128 + WTERMSIG(status);
9667	}
9668	} while (*++argv);
9669
9670	return ret;
9671	}
9672
9673	#if ENABLE_HUSH_LOOPS || ENABLE_HUSH_FUNCTIONS
9674	static unsigned parse_numeric_argv1(char **argv, unsigned def, unsigned def_min)
9675	{
9676	if (argv[1]) {
9677	def = bb_strtou(argv[1], NULL, 10);
9678	if (errno || def < def_min || argv[2]) {
9679	bb_error_msg("%s: bad arguments", argv[0]);
9680	def = UINT_MAX;
9681	}
9682	}
9683	return def;
9684	}
9685	#endif
9686
9687	#if ENABLE_HUSH_LOOPS
9688	static int FAST_FUNC builtin_break(char **argv)
9689	{
9690	unsigned depth;
9691	if (G.depth_of_loop == 0) {
9692	bb_error_msg("%s: only meaningful in a loop", argv[0]);
9693	/* if we came from builtin_continue(), need to undo "= 1" */
9694	G.flag_break_continue = 0;
9695	return EXIT_SUCCESS; /* bash compat */
9696	}
9697	G.flag_break_continue++; /* BC_BREAK = 1, or BC_CONTINUE = 2 */
9698
9699	G.depth_break_continue = depth = parse_numeric_argv1(argv, 1, 1);
9700	if (depth == UINT_MAX)
9701	G.flag_break_continue = BC_BREAK;
9702	if (G.depth_of_loop < depth)
9703	G.depth_break_continue = G.depth_of_loop;
9704
9705	return EXIT_SUCCESS;
9706	}
9707
9708	static int FAST_FUNC builtin_continue(char **argv)
9709	{
9710	G.flag_break_continue = 1; /* BC_CONTINUE = 2 = 1+1 */
9711	return builtin_break(argv);
9712	}
9713	#endif
9714
9715	#if ENABLE_HUSH_FUNCTIONS
9716	static int FAST_FUNC builtin_return(char **argv)
9717	{
9718	int rc;
9719
9720	if (G_flag_return_in_progress != -1) {
9721	bb_error_msg("%s: not in a function or sourced script", argv[0]);
9722	return EXIT_FAILURE; /* bash compat */
9723	}
9724
9725	G_flag_return_in_progress = 1;
9726
9727	/* bash:
9728	* out of range: wraps around at 256, does not error out
9729	* non-numeric param:
9730	* f() { false; return qwe; }; f; echo $?
9731	* bash: return: qwe: numeric argument required <== we do this
9732	* 255 <== we also do this
9733	*/
9734	rc = parse_numeric_argv1(argv, G.last_exitcode, 0);
9735	return rc;
9736	}
9737	#endif
9738