Ok, sh.c should be working now. Many thanks to Larry Doolittle

for his timely help -- nearly all of the work in this patch is
his.
 -Erik

lash.c

@@ -916,6 +916,7 @@ static int expand_arguments(char *command)
 	expand_t expand_result;
 	char *src, *dst, *var;
 	int i=0, length, total_length=0, retval;
+	const char *out_of_space = "out of space during expansion"; 
 #endif
 
 	/* get rid of the terminating \n */
@@ -931,7 +932,7 @@ static int expand_arguments(char *command)
 	if (retval == WRDE_NOSPACE) {
 		/* Mem may have been allocated... */
 		wordfree (&expand_result);
-		error_msg("out of space during expansion");
+		error_msg(out_of_space);
 		return FALSE;
 	}
 	if (retval < 0) {
@@ -946,7 +947,7 @@ static int expand_arguments(char *command)
 	while (i < expand_result.we_wordc && total_length < BUFSIZ) {
 		length=strlen(expand_result.we_wordv[i])+1;
 		if (BUFSIZ-total_length-length <= 0) {
-			error_msg("out of space during expansion");
+			error_msg(out_of_space);
 			return FALSE;
 		}
 		strcat(command+total_length, expand_result.we_wordv[i++]);
@@ -956,76 +957,65 @@ static int expand_arguments(char *command)
 	wordfree (&expand_result);
 #else
 
-	/* Ok.  They don't have glibc and they don't have uClibc.  Chances are
+	/* Ok.  They don't have a recent glibc and they don't have uClibc.  Chances
-	 * about 100% they don't have wordexp(), so instead, the best we can do is
+	 * are about 100% they don't have wordexp(). So instead the best we can do
-	 * use glob, which is better then nothing, but certainly not perfect */
+	 * is use glob and then fixup environment variables and such ourselves.
+	 * This is better then nothing, but certainly not perfect */
 
-	/* It turns out that glob is very stupid.  We have to feed it
+	/* It turns out that glob is very stupid.  We have to feed it one word at a
-	 * one word at a time since it can't cope with a full string. 
+	 * time since it can't cope with a full string.  Here we convert command
-	 * Here we convert command (char*) into cmd (char**, one word 
+	 * (char*) into cmd (char**, one word per string) */
-	 * per string) */
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
 		char * tmpcmd;
 		/* We need a clean copy, so strsep can mess up the copy while
-		 * we write stuff into the original in a minute */
+		 * we write stuff into the original (in a minute) */
 		char * cmd = strdup(command);
+		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
 				break;
 			retval = glob(tmpcmd, flags, NULL, &expand_result);
-			/* We can't haveGLOB_APPEND on the first glob call,  
-			 * so put it there now */
-			if (! (flags & GLOB_APPEND) ) 
-				flags |= GLOB_APPEND;
-
 			if (retval == GLOB_NOSPACE) {
 				/* Mem may have been allocated... */
 				globfree (&expand_result);
-				error_msg("out of space during expansion");
+				error_msg(out_of_space);
 				return FALSE;
-			}
+			} else if (retval != 0) {
-			if (retval != 0 && retval != GLOB_NOMATCH) {
+				/* Some other error.  GLOB_NOMATCH shouldn't
-				/* Some other error.  */
+				 * happen because of the GLOB_NOCHECK flag in 
+				 * the glob call. */
 				error_msg("syntax error");
 				return FALSE;
-			}
+			} else {
-
 			/* Convert from char** (one word per string) to a simple char*,
 			 * but don't overflow command which is BUFSIZ in length */
-			if ( expand_result.gl_pathc > 1) {
+				for (i=0; i < expand_result.gl_pathc; i++) {
-				*command = '\0';
-				while (i < expand_result.gl_pathc && total_length < BUFSIZ) {
 					length=strlen(expand_result.gl_pathv[i])+1;
 					if (BUFSIZ-total_length-length <= 0) {
-						error_msg("out of space during expansion");
+						error_msg(out_of_space);
 						return FALSE;
 					}
-					strcat(command+total_length, expand_result.gl_pathv[i++]);
+					strcat(command+total_length, expand_result.gl_pathv[i]);
 					strcat(command+total_length, " ");
 					total_length+=length;
 				}
-			}
-		}
-
-		free(cmd);
 				globfree (&expand_result);
 			}
+		}
+		free(cmd);
+		trim(command);
+	}
 	
 #endif	
 
-	/* FIXME -- this routine (which is only used when folks
-	 * don't have a C library with wordexp) needs a bit of help
-	 * to handle things like 'echo $PATH$0' */
-	
 	/* Now do the shell variable substitutions which 
 	 * wordexp can't do for us, namely $? and $! */
 	src = command;
 	while((dst = strchr(src,'$')) != NULL){
-		/* Ok -- got a $ -- now clean up any trailing mess */
+		printf("dollar '%s'\n", dst);
-		trim(dst);
+		var = NULL;
-		if (!(var = getenv(dst + 1))) {
 		switch(*(dst+1)) {
 			case '?':
 				var = itoa(last_return_code);
@@ -1060,35 +1050,43 @@ static int expand_arguments(char *command)
 				break;
 
 		}
-		}
 		if (var) {
-			int subst_len = strlen(var);
+			/* a single character construction was found, and 
-			char *next_dst;
+			 * already handled in the case statement */
-			if ((next_dst=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.")) == NULL) {
+			src=dst+2;
-				next_dst = dst;
-			}
-			src = (char*)xrealloc(src, strlen(src) - strlen(next_dst)+strlen(var)+1);
-			/* Move stuff to the end of the string to accommodate filling 
-			 * the created gap with the new stuff */
-			memmove(dst+subst_len, next_dst+1, subst_len); 
-			/* Now copy in the new stuff */
-			strncpy(dst, var, subst_len+1);
-			src = dst;
-			src++;
 		} else {
+			/* Looks like an environment variable */
+			char delim_hold;
+			src=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.");
+			if (src == NULL) {
+				src = dst+strlen(dst);
+			}
+			delim_hold=*src;
+			*src='\0';  /* temporary */
+			var = getenv(dst + 1);
+			*src=delim_hold;
+		}
+		if (var == NULL) {
 			/* Seems we got an un-expandable variable.  So delete it. */
-			char *next_dst;
+			var = "";
-			if ((next_dst=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.")) == NULL) {
-				next_dst=dst+1+strlen(dst);
 		}
-			/* Move stuff to the end of the string to accommodate filling 
+		{
-			 * the created gap with the new stuff */
+			int subst_len = strlen(var);
-			memmove(dst, next_dst,  next_dst-dst); 
+			int trail_len = strlen(src);
+			if (dst+subst_len+trail_len >= command+BUFSIZ) {
+				error_msg(out_of_space);
+				return FALSE;
+			}
+			/* Move stuff to the end of the string to accommodate
+			 * filling the created gap with the new stuff */
+			memmove(dst+subst_len, src, trail_len);
+			*(dst+subst_len+trail_len)='\0';
+			/* Now copy in the new stuff */
+			memcpy(dst, var, subst_len);
+			src = dst+subst_len;
 		}
 	}
-
+	printf("expanded '%s'\n", command);
-
-
 
 #endif	
 	return TRUE;

sh.c

@@ -916,6 +916,7 @@ static int expand_arguments(char *command)
 	expand_t expand_result;
 	char *src, *dst, *var;
 	int i=0, length, total_length=0, retval;
+	const char *out_of_space = "out of space during expansion"; 
 #endif
 
 	/* get rid of the terminating \n */
@@ -931,7 +932,7 @@ static int expand_arguments(char *command)
 	if (retval == WRDE_NOSPACE) {
 		/* Mem may have been allocated... */
 		wordfree (&expand_result);
-		error_msg("out of space during expansion");
+		error_msg(out_of_space);
 		return FALSE;
 	}
 	if (retval < 0) {
@@ -946,7 +947,7 @@ static int expand_arguments(char *command)
 	while (i < expand_result.we_wordc && total_length < BUFSIZ) {
 		length=strlen(expand_result.we_wordv[i])+1;
 		if (BUFSIZ-total_length-length <= 0) {
-			error_msg("out of space during expansion");
+			error_msg(out_of_space);
 			return FALSE;
 		}
 		strcat(command+total_length, expand_result.we_wordv[i++]);
@@ -956,76 +957,65 @@ static int expand_arguments(char *command)
 	wordfree (&expand_result);
 #else
 
-	/* Ok.  They don't have glibc and they don't have uClibc.  Chances are
+	/* Ok.  They don't have a recent glibc and they don't have uClibc.  Chances
-	 * about 100% they don't have wordexp(), so instead, the best we can do is
+	 * are about 100% they don't have wordexp(). So instead the best we can do
-	 * use glob, which is better then nothing, but certainly not perfect */
+	 * is use glob and then fixup environment variables and such ourselves.
+	 * This is better then nothing, but certainly not perfect */
 
-	/* It turns out that glob is very stupid.  We have to feed it
+	/* It turns out that glob is very stupid.  We have to feed it one word at a
-	 * one word at a time since it can't cope with a full string. 
+	 * time since it can't cope with a full string.  Here we convert command
-	 * Here we convert command (char*) into cmd (char**, one word 
+	 * (char*) into cmd (char**, one word per string) */
-	 * per string) */
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
 		char * tmpcmd;
 		/* We need a clean copy, so strsep can mess up the copy while
-		 * we write stuff into the original in a minute */
+		 * we write stuff into the original (in a minute) */
 		char * cmd = strdup(command);
+		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
 				break;
 			retval = glob(tmpcmd, flags, NULL, &expand_result);
-			/* We can't haveGLOB_APPEND on the first glob call,  
-			 * so put it there now */
-			if (! (flags & GLOB_APPEND) ) 
-				flags |= GLOB_APPEND;
-
 			if (retval == GLOB_NOSPACE) {
 				/* Mem may have been allocated... */
 				globfree (&expand_result);
-				error_msg("out of space during expansion");
+				error_msg(out_of_space);
 				return FALSE;
-			}
+			} else if (retval != 0) {
-			if (retval != 0 && retval != GLOB_NOMATCH) {
+				/* Some other error.  GLOB_NOMATCH shouldn't
-				/* Some other error.  */
+				 * happen because of the GLOB_NOCHECK flag in 
+				 * the glob call. */
 				error_msg("syntax error");
 				return FALSE;
-			}
+			} else {
-
 			/* Convert from char** (one word per string) to a simple char*,
 			 * but don't overflow command which is BUFSIZ in length */
-			if ( expand_result.gl_pathc > 1) {
+				for (i=0; i < expand_result.gl_pathc; i++) {
-				*command = '\0';
-				while (i < expand_result.gl_pathc && total_length < BUFSIZ) {
 					length=strlen(expand_result.gl_pathv[i])+1;
 					if (BUFSIZ-total_length-length <= 0) {
-						error_msg("out of space during expansion");
+						error_msg(out_of_space);
 						return FALSE;
 					}
-					strcat(command+total_length, expand_result.gl_pathv[i++]);
+					strcat(command+total_length, expand_result.gl_pathv[i]);
 					strcat(command+total_length, " ");
 					total_length+=length;
 				}
-			}
-		}
-
-		free(cmd);
 				globfree (&expand_result);
 			}
+		}
+		free(cmd);
+		trim(command);
+	}
 	
 #endif	
 
-	/* FIXME -- this routine (which is only used when folks
-	 * don't have a C library with wordexp) needs a bit of help
-	 * to handle things like 'echo $PATH$0' */
-	
 	/* Now do the shell variable substitutions which 
 	 * wordexp can't do for us, namely $? and $! */
 	src = command;
 	while((dst = strchr(src,'$')) != NULL){
-		/* Ok -- got a $ -- now clean up any trailing mess */
+		printf("dollar '%s'\n", dst);
-		trim(dst);
+		var = NULL;
-		if (!(var = getenv(dst + 1))) {
 		switch(*(dst+1)) {
 			case '?':
 				var = itoa(last_return_code);
@@ -1060,35 +1050,43 @@ static int expand_arguments(char *command)
 				break;
 
 		}
-		}
 		if (var) {
-			int subst_len = strlen(var);
+			/* a single character construction was found, and 
-			char *next_dst;
+			 * already handled in the case statement */
-			if ((next_dst=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.")) == NULL) {
+			src=dst+2;
-				next_dst = dst;
-			}
-			src = (char*)xrealloc(src, strlen(src) - strlen(next_dst)+strlen(var)+1);
-			/* Move stuff to the end of the string to accommodate filling 
-			 * the created gap with the new stuff */
-			memmove(dst+subst_len, next_dst+1, subst_len); 
-			/* Now copy in the new stuff */
-			strncpy(dst, var, subst_len+1);
-			src = dst;
-			src++;
 		} else {
+			/* Looks like an environment variable */
+			char delim_hold;
+			src=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.");
+			if (src == NULL) {
+				src = dst+strlen(dst);
+			}
+			delim_hold=*src;
+			*src='\0';  /* temporary */
+			var = getenv(dst + 1);
+			*src=delim_hold;
+		}
+		if (var == NULL) {
 			/* Seems we got an un-expandable variable.  So delete it. */
-			char *next_dst;
+			var = "";
-			if ((next_dst=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.")) == NULL) {
-				next_dst=dst+1+strlen(dst);
 		}
-			/* Move stuff to the end of the string to accommodate filling 
+		{
-			 * the created gap with the new stuff */
+			int subst_len = strlen(var);
-			memmove(dst, next_dst,  next_dst-dst); 
+			int trail_len = strlen(src);
+			if (dst+subst_len+trail_len >= command+BUFSIZ) {
+				error_msg(out_of_space);
+				return FALSE;
+			}
+			/* Move stuff to the end of the string to accommodate
+			 * filling the created gap with the new stuff */
+			memmove(dst+subst_len, src, trail_len);
+			*(dst+subst_len+trail_len)='\0';
+			/* Now copy in the new stuff */
+			memcpy(dst, var, subst_len);
+			src = dst+subst_len;
 		}
 	}
-
+	printf("expanded '%s'\n", command);
-
-
 
 #endif	
 	return TRUE;

shell/lash.c

@@ -916,6 +916,7 @@ static int expand_arguments(char *command)
 	expand_t expand_result;
 	char *src, *dst, *var;
 	int i=0, length, total_length=0, retval;
+	const char *out_of_space = "out of space during expansion"; 
 #endif
 
 	/* get rid of the terminating \n */
@@ -931,7 +932,7 @@ static int expand_arguments(char *command)
 	if (retval == WRDE_NOSPACE) {
 		/* Mem may have been allocated... */
 		wordfree (&expand_result);
-		error_msg("out of space during expansion");
+		error_msg(out_of_space);
 		return FALSE;
 	}
 	if (retval < 0) {
@@ -946,7 +947,7 @@ static int expand_arguments(char *command)
 	while (i < expand_result.we_wordc && total_length < BUFSIZ) {
 		length=strlen(expand_result.we_wordv[i])+1;
 		if (BUFSIZ-total_length-length <= 0) {
-			error_msg("out of space during expansion");
+			error_msg(out_of_space);
 			return FALSE;
 		}
 		strcat(command+total_length, expand_result.we_wordv[i++]);
@@ -956,76 +957,65 @@ static int expand_arguments(char *command)
 	wordfree (&expand_result);
 #else
 
-	/* Ok.  They don't have glibc and they don't have uClibc.  Chances are
+	/* Ok.  They don't have a recent glibc and they don't have uClibc.  Chances
-	 * about 100% they don't have wordexp(), so instead, the best we can do is
+	 * are about 100% they don't have wordexp(). So instead the best we can do
-	 * use glob, which is better then nothing, but certainly not perfect */
+	 * is use glob and then fixup environment variables and such ourselves.
+	 * This is better then nothing, but certainly not perfect */
 
-	/* It turns out that glob is very stupid.  We have to feed it
+	/* It turns out that glob is very stupid.  We have to feed it one word at a
-	 * one word at a time since it can't cope with a full string. 
+	 * time since it can't cope with a full string.  Here we convert command
-	 * Here we convert command (char*) into cmd (char**, one word 
+	 * (char*) into cmd (char**, one word per string) */
-	 * per string) */
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
 		char * tmpcmd;
 		/* We need a clean copy, so strsep can mess up the copy while
-		 * we write stuff into the original in a minute */
+		 * we write stuff into the original (in a minute) */
 		char * cmd = strdup(command);
+		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
 				break;
 			retval = glob(tmpcmd, flags, NULL, &expand_result);
-			/* We can't haveGLOB_APPEND on the first glob call,  
-			 * so put it there now */
-			if (! (flags & GLOB_APPEND) ) 
-				flags |= GLOB_APPEND;
-
 			if (retval == GLOB_NOSPACE) {
 				/* Mem may have been allocated... */
 				globfree (&expand_result);
-				error_msg("out of space during expansion");
+				error_msg(out_of_space);
 				return FALSE;
-			}
+			} else if (retval != 0) {
-			if (retval != 0 && retval != GLOB_NOMATCH) {
+				/* Some other error.  GLOB_NOMATCH shouldn't
-				/* Some other error.  */
+				 * happen because of the GLOB_NOCHECK flag in 
+				 * the glob call. */
 				error_msg("syntax error");
 				return FALSE;
-			}
+			} else {
-
 			/* Convert from char** (one word per string) to a simple char*,
 			 * but don't overflow command which is BUFSIZ in length */
-			if ( expand_result.gl_pathc > 1) {
+				for (i=0; i < expand_result.gl_pathc; i++) {
-				*command = '\0';
-				while (i < expand_result.gl_pathc && total_length < BUFSIZ) {
 					length=strlen(expand_result.gl_pathv[i])+1;
 					if (BUFSIZ-total_length-length <= 0) {
-						error_msg("out of space during expansion");
+						error_msg(out_of_space);
 						return FALSE;
 					}
-					strcat(command+total_length, expand_result.gl_pathv[i++]);
+					strcat(command+total_length, expand_result.gl_pathv[i]);
 					strcat(command+total_length, " ");
 					total_length+=length;
 				}
-			}
-		}
-
-		free(cmd);
 				globfree (&expand_result);
 			}
+		}
+		free(cmd);
+		trim(command);
+	}
 	
 #endif	
 
-	/* FIXME -- this routine (which is only used when folks
-	 * don't have a C library with wordexp) needs a bit of help
-	 * to handle things like 'echo $PATH$0' */
-	
 	/* Now do the shell variable substitutions which 
 	 * wordexp can't do for us, namely $? and $! */
 	src = command;
 	while((dst = strchr(src,'$')) != NULL){
-		/* Ok -- got a $ -- now clean up any trailing mess */
+		printf("dollar '%s'\n", dst);
-		trim(dst);
+		var = NULL;
-		if (!(var = getenv(dst + 1))) {
 		switch(*(dst+1)) {
 			case '?':
 				var = itoa(last_return_code);
@@ -1060,35 +1050,43 @@ static int expand_arguments(char *command)
 				break;
 
 		}
-		}
 		if (var) {
-			int subst_len = strlen(var);
+			/* a single character construction was found, and 
-			char *next_dst;
+			 * already handled in the case statement */
-			if ((next_dst=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.")) == NULL) {
+			src=dst+2;
-				next_dst = dst;
-			}
-			src = (char*)xrealloc(src, strlen(src) - strlen(next_dst)+strlen(var)+1);
-			/* Move stuff to the end of the string to accommodate filling 
-			 * the created gap with the new stuff */
-			memmove(dst+subst_len, next_dst+1, subst_len); 
-			/* Now copy in the new stuff */
-			strncpy(dst, var, subst_len+1);
-			src = dst;
-			src++;
 		} else {
+			/* Looks like an environment variable */
+			char delim_hold;
+			src=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.");
+			if (src == NULL) {
+				src = dst+strlen(dst);
+			}
+			delim_hold=*src;
+			*src='\0';  /* temporary */
+			var = getenv(dst + 1);
+			*src=delim_hold;
+		}
+		if (var == NULL) {
 			/* Seems we got an un-expandable variable.  So delete it. */
-			char *next_dst;
+			var = "";
-			if ((next_dst=strpbrk(dst+1, " \t~`!$^&*()=|\\{}[];\"'<>?.")) == NULL) {
-				next_dst=dst+1+strlen(dst);
 		}
-			/* Move stuff to the end of the string to accommodate filling 
+		{
-			 * the created gap with the new stuff */
+			int subst_len = strlen(var);
-			memmove(dst, next_dst,  next_dst-dst); 
+			int trail_len = strlen(src);
+			if (dst+subst_len+trail_len >= command+BUFSIZ) {
+				error_msg(out_of_space);
+				return FALSE;
+			}
+			/* Move stuff to the end of the string to accommodate
+			 * filling the created gap with the new stuff */
+			memmove(dst+subst_len, src, trail_len);
+			*(dst+subst_len+trail_len)='\0';
+			/* Now copy in the new stuff */
+			memcpy(dst, var, subst_len);
+			src = dst+subst_len;
 		}
 	}
-
+	printf("expanded '%s'\n", command);
-
-
 
 #endif	
 	return TRUE;