Home | History | Annotate | Line # | Download | only in ksh
eval.c revision 1.4
      1 /*	$NetBSD: eval.c,v 1.4 2003/06/23 11:38:55 agc Exp $	*/
      2 
      3 /*
      4  * Expansion - quoting, separation, substitution, globbing
      5  */
      6 #include <sys/cdefs.h>
      7 
      8 #ifndef lint
      9 __RCSID("$NetBSD: eval.c,v 1.4 2003/06/23 11:38:55 agc Exp $");
     10 #endif
     11 
     12 
     13 #include "sh.h"
     14 #include <pwd.h>
     15 #include "ksh_dir.h"
     16 #include "ksh_stat.h"
     17 
     18 /*
     19  * string expansion
     20  *
     21  * first pass: quoting, IFS separation, ~, ${}, $() and $(()) substitution.
     22  * second pass: alternation ({,}), filename expansion (*?[]).
     23  */
     24 
     25 /* expansion generator state */
     26 typedef struct Expand {
     27 	/* int  type; */	/* see expand() */
     28 	const char *str;	/* string */
     29 	union {
     30 		const char **strv;/* string[] */
     31 		struct shf *shf;/* file */
     32 	} u;			/* source */
     33 	struct tbl *var;	/* variable in ${var..} */
     34 	short	split;		/* split "$@" / call waitlast $() */
     35 } Expand;
     36 
     37 #define	XBASE		0	/* scanning original */
     38 #define	XSUB		1	/* expanding ${} string */
     39 #define	XARGSEP		2	/* ifs0 between "$*" */
     40 #define	XARG		3	/* expanding $*, $@ */
     41 #define	XCOM		4	/* expanding $() */
     42 #define XNULLSUB	5	/* "$@" when $# is 0 (don't generate word) */
     43 
     44 /* States used for field splitting */
     45 #define IFS_WORD	0	/* word has chars (or quotes) */
     46 #define IFS_WS		1	/* have seen IFS white-space */
     47 #define IFS_NWS		2	/* have seen IFS non-white-space */
     48 
     49 static	int	varsub ARGS((Expand *xp, char *sp, char *word, int *stypep, int *slenp));
     50 static	int	comsub ARGS((Expand *xp, char *cp));
     51 static	char   *trimsub ARGS((char *str, char *pat, int how));
     52 static	void	glob ARGS((char *cp, XPtrV *wp, int markdirs));
     53 static	void	globit ARGS((XString *xs, char **xpp, char *sp, XPtrV *wp,
     54 			     int check));
     55 static char	*maybe_expand_tilde ARGS((char *p, XString *dsp, char **dpp,
     56 					  int isassign));
     57 static	char   *tilde ARGS((char *acp));
     58 static	char   *homedir ARGS((char *name));
     59 #ifdef BRACE_EXPAND
     60 static void	alt_expand ARGS((XPtrV *wp, char *start, char *exp_start,
     61 				 char *end, int fdo));
     62 #endif
     63 
     64 /* compile and expand word */
     65 char *
     66 substitute(cp, f)
     67 	const char *cp;
     68 	int f;
     69 {
     70 	struct source *s, *sold;
     71 
     72 	sold = source;
     73 	s = pushs(SWSTR, ATEMP);
     74 	s->start = s->str = cp;
     75 	source = s;
     76 	if (yylex(ONEWORD) != LWORD)
     77 		internal_errorf(1, "substitute");
     78 	source = sold;
     79 	afree(s, ATEMP);
     80 	return evalstr(yylval.cp, f);
     81 }
     82 
     83 /*
     84  * expand arg-list
     85  */
     86 char **
     87 eval(ap, f)
     88 	register char **ap;
     89 	int f;
     90 {
     91 	XPtrV w;
     92 
     93 	if (*ap == NULL)
     94 		return ap;
     95 	XPinit(w, 32);
     96 	XPput(w, NULL);		/* space for shell name */
     97 #ifdef	SHARPBANG
     98 	XPput(w, NULL);		/* and space for one arg */
     99 #endif
    100 	while (*ap != NULL)
    101 		expand(*ap++, &w, f);
    102 	XPput(w, NULL);
    103 #ifdef	SHARPBANG
    104 	return (char **) XPclose(w) + 2;
    105 #else
    106 	return (char **) XPclose(w) + 1;
    107 #endif
    108 }
    109 
    110 /*
    111  * expand string
    112  */
    113 char *
    114 evalstr(cp, f)
    115 	char *cp;
    116 	int f;
    117 {
    118 	XPtrV w;
    119 
    120 	XPinit(w, 1);
    121 	expand(cp, &w, f);
    122 	cp = (XPsize(w) == 0) ? null : (char*) *XPptrv(w);
    123 	XPfree(w);
    124 	return cp;
    125 }
    126 
    127 /*
    128  * expand string - return only one component
    129  * used from iosetup to expand redirection files
    130  */
    131 char *
    132 evalonestr(cp, f)
    133 	register char *cp;
    134 	int f;
    135 {
    136 	XPtrV w;
    137 
    138 	XPinit(w, 1);
    139 	expand(cp, &w, f);
    140 	switch (XPsize(w)) {
    141 	case 0:
    142 		cp = null;
    143 		break;
    144 	case 1:
    145 		cp = (char*) *XPptrv(w);
    146 		break;
    147 	default:
    148 		cp = evalstr(cp, f&~DOGLOB);
    149 		break;
    150 	}
    151 	XPfree(w);
    152 	return cp;
    153 }
    154 
    155 /* for nested substitution: ${var:=$var2} */
    156 typedef struct SubType {
    157 	short	stype;		/* [=+-?%#] action after expanded word */
    158 	short	base;		/* begin position of expanded word */
    159 	short	f;		/* saved value of f (DOPAT, etc) */
    160 	struct tbl *var;	/* variable for ${var..} */
    161 	short	quote;		/* saved value of quote (for ${..[%#]..}) */
    162 	struct SubType *prev;	/* old type */
    163 	struct SubType *next;	/* poped type (to avoid re-allocating) */
    164 } SubType;
    165 
    166 void
    167 expand(cp, wp, f)
    168 	char *cp;		/* input word */
    169 	register XPtrV *wp;	/* output words */
    170 	int f;			/* DO* flags */
    171 {
    172 	register int UNINITIALIZED(c);
    173 	register int type;	/* expansion type */
    174 	register int quote = 0;	/* quoted */
    175 	XString ds;		/* destination string */
    176 	register char *dp, *sp;	/* dest., source */
    177 	int fdo, word;		/* second pass flags; have word */
    178 	int doblank;		/* field spliting of parameter/command subst */
    179 	Expand x;		/* expansion variables */
    180 	SubType st_head, *st;
    181 	int UNINITIALIZED(newlines); /* For trailing newlines in COMSUB */
    182 	int saw_eq, tilde_ok;
    183 	int make_magic;
    184 
    185 	if (cp == NULL)
    186 		internal_errorf(1, "expand(NULL)");
    187 	/* for alias, readonly, set, typeset commands */
    188 	if ((f & DOVACHECK) && is_wdvarassign(cp)) {
    189 		f &= ~(DOVACHECK|DOBLANK|DOGLOB|DOTILDE);
    190 		f |= DOASNTILDE;
    191 	}
    192 	if (Flag(FNOGLOB))
    193 		f &= ~DOGLOB;
    194 	if (Flag(FMARKDIRS))
    195 		f |= DOMARKDIRS;
    196 #ifdef BRACE_EXPAND
    197 	if (Flag(FBRACEEXPAND) && (f & DOGLOB))
    198 		f |= DOBRACE_;
    199 #endif /* BRACE_EXPAND */
    200 
    201 	Xinit(ds, dp, 128, ATEMP);	/* init dest. string */
    202 	type = XBASE;
    203 	sp = cp;
    204 	fdo = 0;
    205 	saw_eq = 0;
    206 	tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0; /* must be 1/0 */
    207 	doblank = 0;
    208 	make_magic = 0;
    209 	word = (f&DOBLANK) ? IFS_WS : IFS_WORD;
    210 	st_head.next = (SubType *) 0;
    211 	st = &st_head;
    212 
    213 	while (1) {
    214 		Xcheck(ds, dp);
    215 
    216 		switch (type) {
    217 		  case XBASE:	/* original prefixed string */
    218 			c = *sp++;
    219 			switch (c) {
    220 			  case EOS:
    221 				c = 0;
    222 				break;
    223 			  case CHAR:
    224 				c = *sp++;
    225 				break;
    226 			  case QCHAR:
    227 				quote |= 2; /* temporary quote */
    228 				c = *sp++;
    229 				break;
    230 			  case OQUOTE:
    231 				word = IFS_WORD;
    232 				tilde_ok = 0;
    233 				quote = 1;
    234 				continue;
    235 			  case CQUOTE:
    236 				quote = 0;
    237 				continue;
    238 			  case COMSUB:
    239 				tilde_ok = 0;
    240 				if (f & DONTRUNCOMMAND) {
    241 					word = IFS_WORD;
    242 					*dp++ = '$'; *dp++ = '(';
    243 					while (*sp != '\0') {
    244 						Xcheck(ds, dp);
    245 						*dp++ = *sp++;
    246 					}
    247 					*dp++ = ')';
    248 				} else {
    249 					type = comsub(&x, sp);
    250 					if (type == XCOM && (f&DOBLANK))
    251 						doblank++;
    252 					sp = strchr(sp, 0) + 1;
    253 					newlines = 0;
    254 				}
    255 				continue;
    256 			  case EXPRSUB:
    257 				word = IFS_WORD;
    258 				tilde_ok = 0;
    259 				if (f & DONTRUNCOMMAND) {
    260 					*dp++ = '$'; *dp++ = '('; *dp++ = '(';
    261 					while (*sp != '\0') {
    262 						Xcheck(ds, dp);
    263 						*dp++ = *sp++;
    264 					}
    265 					*dp++ = ')'; *dp++ = ')';
    266 				} else {
    267 					struct tbl v;
    268 					char *p;
    269 
    270 					v.flag = DEFINED|ISSET|INTEGER;
    271 					v.type = 10; /* not default */
    272 					v.name[0] = '\0';
    273 					v_evaluate(&v, substitute(sp, 0),
    274 						KSH_UNWIND_ERROR);
    275 					sp = strchr(sp, 0) + 1;
    276 					for (p = str_val(&v); *p; ) {
    277 						Xcheck(ds, dp);
    278 						*dp++ = *p++;
    279 					}
    280 				}
    281 				continue;
    282 			  case OSUBST: /* ${{#}var{:}[=+-?#%]word} */
    283 			  /* format is:
    284 			   *   OSUBST [{x] plain-variable-part \0
    285 			   *     compiled-word-part CSUBST [}x]
    286 			   * This is were all syntax checking gets done...
    287 			   */
    288 			  {
    289 				char *varname = ++sp; /* skip the { or x (}) */
    290 				int stype;
    291 				int slen;
    292 
    293 				sp = strchr(sp, '\0') + 1; /* skip variable */
    294 				type = varsub(&x, varname, sp, &stype, &slen);
    295 				if (type < 0) {
    296 					char endc;
    297 					char *str, *end;
    298 
    299 					end = (char *) wdscan(sp, CSUBST);
    300 					/* ({) the } or x is already skipped */
    301 					endc = *end;
    302 					*end = EOS;
    303 					str = snptreef((char *) 0, 64, "%S",
    304 							varname - 1);
    305 					*end = endc;
    306 					errorf("%s: bad substitution", str);
    307 				}
    308 				if (f&DOBLANK)
    309 					doblank++;
    310 				tilde_ok = 0;
    311 				if (type == XBASE) {	/* expand? */
    312 					if (!st->next) {
    313 						SubType *newst;
    314 
    315 						newst = (SubType *) alloc(
    316 							sizeof(SubType), ATEMP);
    317 						newst->next = (SubType *) 0;
    318 						newst->prev = st;
    319 						st->next = newst;
    320 					}
    321 					st = st->next;
    322 					st->stype = stype;
    323 					st->base = Xsavepos(ds, dp);
    324 					st->f = f;
    325 					st->var = x.var;
    326 					st->quote = quote;
    327 					/* skip qualifier(s) */
    328 					if (stype)
    329 						sp += slen;
    330 					switch (stype & 0x7f) {
    331 					  case '#':
    332 					  case '%':
    333 						/* ! DOBLANK,DOBRACE_,DOTILDE */
    334 						f = DOPAT | (f&DONTRUNCOMMAND)
    335 						    | DOTEMP_;
    336 						quote = 0;
    337 						/* Prepend open pattern (so |
    338 						 * in a trim will work as
    339 						 * expected)
    340 						 */
    341 						*dp++ = MAGIC;
    342 						*dp++ = '@' + 0x80;
    343 						break;
    344 					  case '=':
    345 						/* Enabling tilde expansion
    346 						 * after :'s here is
    347 						 * non-standard ksh, but is
    348 						 * consistent with rules for
    349 						 * other assignments.  Not
    350 						 * sure what POSIX thinks of
    351 						 * this.
    352 						 * Not doing tilde expansion
    353 						 * for integer variables is a
    354 						 * non-POSIX thing - makes
    355 						 * sense though, since ~ is
    356 						 * a arithmetic operator.
    357 						 */
    358 						if (!(x.var->flag & INTEGER))
    359 							f |= DOASNTILDE|DOTILDE;
    360 						f |= DOTEMP_;
    361 						/* These will be done after the
    362 						 * value has been assigned.
    363 						 */
    364 						f &= ~(DOBLANK|DOGLOB|DOBRACE_);
    365 						tilde_ok = 1;
    366 						break;
    367 					  case '?':
    368 						f &= ~DOBLANK;
    369 						f |= DOTEMP_;
    370 						/* fall through */
    371 					  default:
    372 						/* Enable tilde expansion */
    373 						tilde_ok = 1;
    374 						f |= DOTILDE;
    375 					}
    376 				} else
    377 					/* skip word */
    378 					sp = (char *) wdscan(sp, CSUBST);
    379 				continue;
    380 			  }
    381 			  case CSUBST: /* only get here if expanding word */
    382 				sp++; /* ({) skip the } or x */
    383 				tilde_ok = 0;	/* in case of ${unset:-} */
    384 				*dp = '\0';
    385 				quote = st->quote;
    386 				f = st->f;
    387 				if (f&DOBLANK)
    388 					doblank--;
    389 				switch (st->stype&0x7f) {
    390 				  case '#':
    391 				  case '%':
    392 					/* Append end-pattern */
    393 					*dp++ = MAGIC; *dp++ = ')'; *dp = '\0';
    394 					dp = Xrestpos(ds, dp, st->base);
    395 					/* Must use st->var since calling
    396 					 * global would break things
    397 					 * like x[i+=1].
    398 					 */
    399 					x.str = trimsub(str_val(st->var),
    400 						dp, st->stype);
    401 					type = XSUB;
    402 					if (f&DOBLANK)
    403 						doblank++;
    404 					st = st->prev;
    405 					continue;
    406 				  case '=':
    407 					/* Restore our position and substitute
    408 					 * the value of st->var (may not be
    409 					 * the assigned value in the presence
    410 					 * of integer/right-adj/etc attributes).
    411 					 */
    412 					dp = Xrestpos(ds, dp, st->base);
    413 					/* Must use st->var since calling
    414 					 * global would cause with things
    415 					 * like x[i+=1] to be evaluated twice.
    416 					 */
    417 					/* Note: not exported by FEXPORT
    418 					 * in at&t ksh.
    419 					 */
    420 					/* XXX POSIX says readonly is only
    421 					 * fatal for special builtins (setstr
    422 					 * does readonly check).
    423 					 */
    424 					setstr(st->var, debunk(
    425 						(char *) alloc(strlen(dp) + 1,
    426 							ATEMP), dp),
    427 						KSH_UNWIND_ERROR);
    428 					x.str = str_val(st->var);
    429 					type = XSUB;
    430 					if (f&DOBLANK)
    431 						doblank++;
    432 					st = st->prev;
    433 					continue;
    434 				  case '?':
    435 				    {
    436 					char *s = Xrestpos(ds, dp, st->base);
    437 
    438 					errorf("%s: %s", st->var->name,
    439 					    dp == s ?
    440 					      "parameter null or not set"
    441 					    : (debunk(s, s), s));
    442 				    }
    443 				}
    444 				st = st->prev;
    445 				type = XBASE;
    446 				continue;
    447 
    448 			  case OPAT: /* open pattern: *(foo|bar) */
    449 				/* Next char is the type of pattern */
    450 				make_magic = 1;
    451 				c = *sp++ + 0x80;
    452 				break;
    453 
    454 			  case SPAT: /* pattern seperator (|) */
    455 				make_magic = 1;
    456 				c = '|';
    457 				break;
    458 
    459 			  case CPAT: /* close pattern */
    460 				make_magic = 1;
    461 				c = /*(*/ ')';
    462 				break;
    463 			}
    464 			break;
    465 
    466 		  case XNULLSUB:
    467 			/* Special case for "$@" (and "${foo[@]}") - no
    468 			 * word is generated if $# is 0 (unless there is
    469 			 * other stuff inside the quotes).
    470 			 */
    471 			type = XBASE;
    472 			if (f&DOBLANK) {
    473 				doblank--;
    474 				/* not really correct: x=; "$x$@" should
    475 				 * generate a null argument and
    476 				 * set A; "${@:+}" shouldn't.
    477 				 */
    478 				if (dp == Xstring(ds, dp))
    479 					word = IFS_WS;
    480 			}
    481 			continue;
    482 
    483 		  case XSUB:
    484 			if ((c = *x.str++) == 0) {
    485 				type = XBASE;
    486 				if (f&DOBLANK)
    487 					doblank--;
    488 				continue;
    489 			}
    490 			break;
    491 
    492 		  case XARGSEP:
    493 			type = XARG;
    494 			quote = 1;
    495 		  case XARG:
    496 			if ((c = *x.str++) == '\0') {
    497 				/* force null words to be created so
    498 				 * set -- '' 2 ''; foo "$@" will do
    499 				 * the right thing
    500 				 */
    501 				if (quote && x.split)
    502 					word = IFS_WORD;
    503 				if ((x.str = *x.u.strv++) == NULL) {
    504 					type = XBASE;
    505 					if (f&DOBLANK)
    506 						doblank--;
    507 					continue;
    508 				}
    509 				c = ifs0;
    510 				if (c == 0) {
    511 					if (quote && !x.split)
    512 						continue;
    513 					c = ' ';
    514 				}
    515 				if (quote && x.split) {
    516 					/* terminate word for "$@" */
    517 					type = XARGSEP;
    518 					quote = 0;
    519 				}
    520 			}
    521 			break;
    522 
    523 		  case XCOM:
    524 			if (newlines) {		/* Spit out saved nl's */
    525 				c = '\n';
    526 				--newlines;
    527 			} else {
    528 				while ((c = shf_getc(x.u.shf)) == 0 || c == '\n')
    529 				    if (c == '\n')
    530 					    newlines++;	/* Save newlines */
    531 				if (newlines && c != EOF) {
    532 					shf_ungetc(c, x.u.shf);
    533 					c = '\n';
    534 					--newlines;
    535 				}
    536 			}
    537 			if (c == EOF) {
    538 				newlines = 0;
    539 				shf_close(x.u.shf);
    540 				if (x.split)
    541 					subst_exstat = waitlast();
    542 				type = XBASE;
    543 				if (f&DOBLANK)
    544 					doblank--;
    545 				continue;
    546 			}
    547 			break;
    548 		}
    549 
    550 		/* check for end of word or IFS separation */
    551 		if (c == 0 || (!quote && (f & DOBLANK) && doblank && !make_magic
    552 			       && ctype(c, C_IFS)))
    553 		{
    554 			/* How words are broken up:
    555 			 *		   |       value of c
    556 			 *	  word	   |	ws	nws	0
    557 			 *	-----------------------------------
    558 			 *	IFS_WORD	w/WS	w/NWS	w
    559 			 *	IFS_WS		-/WS	w/NWS	-
    560 			 *	IFS_NWS		-/NWS	w/NWS	w
    561 			 *   (w means generate a word)
    562 			 * Note that IFS_NWS/0 generates a word (at&t ksh
    563 			 * doesn't do this, but POSIX does).
    564 			 */
    565 			if (word == IFS_WORD
    566 			    || (!ctype(c, C_IFSWS) && (c || word == IFS_NWS)))
    567 			{
    568 				char *p;
    569 
    570 				*dp++ = '\0';
    571 				p = Xclose(ds, dp);
    572 #ifdef BRACE_EXPAND
    573 				if (fdo & DOBRACE_)
    574 					/* also does globbing */
    575 					alt_expand(wp, p, p,
    576 						   p + Xlength(ds, (dp - 1)),
    577 						   fdo | (f & DOMARKDIRS));
    578 				else
    579 #endif /* BRACE_EXPAND */
    580 				if (fdo & DOGLOB)
    581 					glob(p, wp, f & DOMARKDIRS);
    582 				else if ((f & DOPAT) || !(fdo & DOMAGIC_))
    583 					XPput(*wp, p);
    584 				else
    585 					XPput(*wp, debunk(p, p));
    586 				fdo = 0;
    587 				saw_eq = 0;
    588 				tilde_ok = (f & (DOTILDE|DOASNTILDE)) ? 1 : 0;
    589 				if (c != 0)
    590 					Xinit(ds, dp, 128, ATEMP);
    591 			}
    592 			if (c == 0)
    593 				return;
    594 			if (word != IFS_NWS)
    595 				word = ctype(c, C_IFSWS) ? IFS_WS : IFS_NWS;
    596 		} else {
    597 			/* age tilde_ok info - ~ code tests second bit */
    598 			tilde_ok <<= 1;
    599 			/* mark any special second pass chars */
    600 			if (!quote)
    601 				switch (c) {
    602 				  case '[':
    603 				  case NOT:
    604 				  case '-':
    605 				  case ']':
    606 					/* For character classes - doesn't hurt
    607 					 * to have magic !,-,]'s outside of
    608 					 * [...] expressions.
    609 					 */
    610 					if (f & (DOPAT | DOGLOB)) {
    611 						fdo |= DOMAGIC_;
    612 						if (c == '[')
    613 							fdo |= f & DOGLOB;
    614 						*dp++ = MAGIC;
    615 					}
    616 					break;
    617 				  case '*':
    618 				  case '?':
    619 					if (f & (DOPAT | DOGLOB)) {
    620 						fdo |= DOMAGIC_ | (f & DOGLOB);
    621 						*dp++ = MAGIC;
    622 					}
    623 					break;
    624 #ifdef BRACE_EXPAND
    625 				  case OBRACE:
    626 				  case ',':
    627 				  case CBRACE:
    628 					if ((f & DOBRACE_) && (c == OBRACE
    629 						|| (fdo & DOBRACE_)))
    630 					{
    631 						fdo |= DOBRACE_|DOMAGIC_;
    632 						*dp++ = MAGIC;
    633 					}
    634 					break;
    635 #endif /* BRACE_EXPAND */
    636 				  case '=':
    637 					/* Note first unquoted = for ~ */
    638 					if (!(f & DOTEMP_) && !saw_eq) {
    639 						saw_eq = 1;
    640 						tilde_ok = 1;
    641 					}
    642 					break;
    643 				  case PATHSEP: /* : */
    644 					/* Note unquoted : for ~ */
    645 					if (!(f & DOTEMP_) && (f & DOASNTILDE))
    646 						tilde_ok = 1;
    647 					break;
    648 				  case '~':
    649 					/* tilde_ok is reset whenever
    650 					 * any of ' " $( $(( ${ } are seen.
    651 					 * Note that tilde_ok must be preserved
    652 					 * through the sequence ${A=a=}~
    653 					 */
    654 					if (type == XBASE
    655 					    && (f & (DOTILDE|DOASNTILDE))
    656 					    && (tilde_ok & 2))
    657 					{
    658 						char *p, *dp_x;
    659 
    660 						dp_x = dp;
    661 						p = maybe_expand_tilde(sp,
    662 							&ds, &dp_x,
    663 							f & DOASNTILDE);
    664 						if (p) {
    665 							if (dp != dp_x)
    666 								word = IFS_WORD;
    667 							dp = dp_x;
    668 							sp = p;
    669 							continue;
    670 						}
    671 					}
    672 					break;
    673 				}
    674 			else
    675 				quote &= ~2; /* undo temporary */
    676 
    677 			if (make_magic) {
    678 				make_magic = 0;
    679 				fdo |= DOMAGIC_ | (f & DOGLOB);
    680 				*dp++ = MAGIC;
    681 			} else if (ISMAGIC(c)) {
    682 				fdo |= DOMAGIC_;
    683 				*dp++ = MAGIC;
    684 			}
    685 			*dp++ = c; /* save output char */
    686 			word = IFS_WORD;
    687 		}
    688 	}
    689 }
    690 
    691 /*
    692  * Prepare to generate the string returned by ${} substitution.
    693  */
    694 static int
    695 varsub(xp, sp, word, stypep, slenp)
    696 	Expand *xp;
    697 	char *sp;
    698 	char *word;
    699 	int *stypep;	/* becomes qualifier type */
    700 	int *slenp;	/* " " len (=, :=, etc.) valid iff *stypep != 0 */
    701 {
    702 	int c;
    703 	int state;	/* next state: XBASE, XARG, XSUB, XNULLSUB */
    704 	int stype;	/* substitution type */
    705 	int slen;
    706 	char *p;
    707 	struct tbl *vp;
    708 
    709 	if (sp[0] == '\0')	/* Bad variable name */
    710 		return -1;
    711 
    712 	xp->var = (struct tbl *) 0;
    713 
    714 	/* ${#var}, string length or array size */
    715 	if (sp[0] == '#' && (c = sp[1]) != '\0') {
    716 		int zero_ok = 0;
    717 
    718 		/* Can't have any modifiers for ${#...} */
    719 		if (*word != CSUBST)
    720 			return -1;
    721 		sp++;
    722 		/* Check for size of array */
    723 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
    724 			int n = 0;
    725 			int max = 0;
    726 			vp = global(arrayname(sp));
    727 			if (vp->flag & (ISSET|ARRAY))
    728 				zero_ok = 1;
    729 			for (; vp; vp = vp->u.array)
    730 				if (vp->flag & ISSET) {
    731 					max = vp->index + 1;
    732 					n++;
    733 				}
    734 			c = n; /* ksh88/ksh93 go for number, not max index */
    735 		} else if (c == '*' || c == '@')
    736 			c = e->loc->argc;
    737 		else {
    738 			p = str_val(global(sp));
    739 			zero_ok = p != null;
    740 			c = strlen(p);
    741 		}
    742 		if (Flag(FNOUNSET) && c == 0 && !zero_ok)
    743 			errorf("%s: parameter not set", sp);
    744 		*stypep = 0; /* unqualified variable/string substitution */
    745 		xp->str = str_save(ulton((unsigned long)c, 10), ATEMP);
    746 		return XSUB;
    747 	}
    748 
    749 	/* Check for qualifiers in word part */
    750 	stype = 0;
    751 	c = word[slen = 0] == CHAR ? word[1] : 0;
    752 	if (c == ':') {
    753 		slen += 2;
    754 		stype = 0x80;
    755 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
    756 	}
    757 	if (ctype(c, C_SUBOP1)) {
    758 		slen += 2;
    759 		stype |= c;
    760 	} else if (ctype(c, C_SUBOP2)) { /* Note: ksh88 allows :%, :%%, etc */
    761 		slen += 2;
    762 		stype = c;
    763 		if (word[slen + 0] == CHAR && c == word[slen + 1]) {
    764 			stype |= 0x80;
    765 			slen += 2;
    766 		}
    767 	} else if (stype)	/* : is not ok */
    768 		return -1;
    769 	if (!stype && *word != CSUBST)
    770 		return -1;
    771 	*stypep = stype;
    772 	*slenp = slen;
    773 
    774 	c = sp[0];
    775 	if (c == '*' || c == '@') {
    776 		switch (stype & 0x7f) {
    777 		  case '=':	/* can't assign to a vector */
    778 		  case '%':	/* can't trim a vector (yet) */
    779 		  case '#':
    780 			return -1;
    781 		}
    782 		if (e->loc->argc == 0) {
    783 			xp->str = null;
    784 			state = c == '@' ? XNULLSUB : XSUB;
    785 		} else {
    786 			xp->u.strv = (const char **) e->loc->argv + 1;
    787 			xp->str = *xp->u.strv++;
    788 			xp->split = c == '@'; /* $@ */
    789 			state = XARG;
    790 		}
    791 	} else {
    792 		if ((p=strchr(sp,'[')) && (p[1]=='*'||p[1]=='@') && p[2]==']') {
    793 			XPtrV wv;
    794 
    795 			switch (stype & 0x7f) {
    796 			  case '=':	/* can't assign to a vector */
    797 			  case '%':	/* can't trim a vector (yet) */
    798 			  case '#':
    799 				return -1;
    800 			}
    801 			XPinit(wv, 32);
    802 			vp = global(arrayname(sp));
    803 			for (; vp; vp = vp->u.array) {
    804 				if (!(vp->flag&ISSET))
    805 					continue;
    806 				XPput(wv, str_val(vp));
    807 			}
    808 			if (XPsize(wv) == 0) {
    809 				xp->str = null;
    810 				state = p[1] == '@' ? XNULLSUB : XSUB;
    811 				XPfree(wv);
    812 			} else {
    813 				XPput(wv, 0);
    814 				xp->u.strv = (const char **) XPptrv(wv);
    815 				xp->str = *xp->u.strv++;
    816 				xp->split = p[1] == '@'; /* ${foo[@]} */
    817 				state = XARG;
    818 			}
    819 		} else {
    820 			/* Can't assign things like $! or $1 */
    821 			if ((stype & 0x7f) == '='
    822 			    && (ctype(*sp, C_VAR1) || digit(*sp)))
    823 				return -1;
    824 			xp->var = global(sp);
    825 			xp->str = str_val(xp->var);
    826 			state = XSUB;
    827 		}
    828 	}
    829 
    830 	c = stype&0x7f;
    831 	/* test the compiler's code generator */
    832 	if (ctype(c, C_SUBOP2) ||
    833 	    (((stype&0x80) ? *xp->str=='\0' : xp->str==null) ? /* undef? */
    834 	     c == '=' || c == '-' || c == '?' : c == '+'))
    835 		state = XBASE;	/* expand word instead of variable value */
    836 	if (Flag(FNOUNSET) && xp->str == null
    837 	    && (ctype(c, C_SUBOP2) || (state != XBASE && c != '+')))
    838 		errorf("%s: parameter not set", sp);
    839 	return state;
    840 }
    841 
    842 /*
    843  * Run the command in $(...) and read its output.
    844  */
    845 static int
    846 comsub(xp, cp)
    847 	register Expand *xp;
    848 	char *cp;
    849 {
    850 	Source *s, *sold;
    851 	register struct op *t;
    852 	struct shf *shf;
    853 
    854 	s = pushs(SSTRING, ATEMP);
    855 	s->start = s->str = cp;
    856 	sold = source;
    857 	t = compile(s);
    858 	source = sold;
    859 
    860 	if (t == NULL)
    861 		return XBASE;
    862 
    863 	if (t != NULL && t->type == TCOM && /* $(<file) */
    864 	    *t->args == NULL && *t->vars == NULL && t->ioact != NULL) {
    865 		register struct ioword *io = *t->ioact;
    866 		char *name;
    867 
    868 		if ((io->flag&IOTYPE) != IOREAD)
    869 			errorf("funny $() command: %s",
    870 				snptreef((char *) 0, 32, "%R", io));
    871 		shf = shf_open(name = evalstr(io->name, DOTILDE), O_RDONLY, 0,
    872 			SHF_MAPHI|SHF_CLEXEC);
    873 		if (shf == NULL)
    874 			errorf("%s: cannot open $() input", name);
    875 		xp->split = 0;	/* no waitlast() */
    876 	} else {
    877 		int ofd1, pv[2];
    878 		openpipe(pv);
    879 		shf = shf_fdopen(pv[0], SHF_RD, (struct shf *) 0);
    880 		ofd1 = savefd(1, 0);	/* fd 1 may be closed... */
    881 		ksh_dup2(pv[1], 1, FALSE);
    882 		close(pv[1]);
    883 		execute(t, XFORK|XXCOM|XPIPEO);
    884 		restfd(1, ofd1);
    885 		startlast();
    886 		xp->split = 1;	/* waitlast() */
    887 	}
    888 
    889 	xp->u.shf = shf;
    890 	return XCOM;
    891 }
    892 
    893 /*
    894  * perform #pattern and %pattern substitution in ${}
    895  */
    896 
    897 static char *
    898 trimsub(str, pat, how)
    899 	register char *str;
    900 	char *pat;
    901 	int how;
    902 {
    903 	register char *end = strchr(str, 0);
    904 	register char *p, c;
    905 
    906 	switch (how&0xff) {	/* UCHAR_MAX maybe? */
    907 	  case '#':		/* shortest at begining */
    908 		for (p = str; p <= end; p++) {
    909 			c = *p; *p = '\0';
    910 			if (gmatch(str, pat, FALSE)) {
    911 				*p = c;
    912 				return p;
    913 			}
    914 			*p = c;
    915 		}
    916 		break;
    917 	  case '#'|0x80:	/* longest match at begining */
    918 		for (p = end; p >= str; p--) {
    919 			c = *p; *p = '\0';
    920 			if (gmatch(str, pat, FALSE)) {
    921 				*p = c;
    922 				return p;
    923 			}
    924 			*p = c;
    925 		}
    926 		break;
    927 	  case '%':		/* shortest match at end */
    928 		for (p = end; p >= str; p--) {
    929 			if (gmatch(p, pat, FALSE))
    930 				return str_nsave(str, p - str, ATEMP);
    931 		}
    932 		break;
    933 	  case '%'|0x80:	/* longest match at end */
    934 		for (p = str; p <= end; p++) {
    935 			if (gmatch(p, pat, FALSE))
    936 				return str_nsave(str, p - str, ATEMP);
    937 		}
    938 		break;
    939 	}
    940 
    941 	return str;		/* no match, return string */
    942 }
    943 
    944 /*
    945  * glob
    946  * Name derived from V6's /etc/glob, the program that expanded filenames.
    947  */
    948 
    949 /* XXX cp not const 'cause slashes are temporarily replaced with nulls... */
    950 static void
    951 glob(cp, wp, markdirs)
    952 	char *cp;
    953 	register XPtrV *wp;
    954 	int markdirs;
    955 {
    956 	int oldsize = XPsize(*wp);
    957 
    958 	if (glob_str(cp, wp, markdirs) == 0)
    959 		XPput(*wp, debunk(cp, cp));
    960 	else
    961 		qsortp(XPptrv(*wp) + oldsize, (size_t)(XPsize(*wp) - oldsize),
    962 			xstrcmp);
    963 }
    964 
    965 #define GF_NONE		0
    966 #define GF_EXCHECK	BIT(0)		/* do existance check on file */
    967 #define GF_GLOBBED	BIT(1)		/* some globbing has been done */
    968 #define GF_MARKDIR	BIT(2)		/* add trailing / to directories */
    969 
    970 /* Apply file globbing to cp and store the matching files in wp.  Returns
    971  * the number of matches found.
    972  */
    973 int
    974 glob_str(cp, wp, markdirs)
    975 	char *cp;
    976 	XPtrV *wp;
    977 	int markdirs;
    978 {
    979 	int oldsize = XPsize(*wp);
    980 	XString xs;
    981 	char *xp;
    982 
    983 	Xinit(xs, xp, 256, ATEMP);
    984 	globit(&xs, &xp, cp, wp, markdirs ? GF_MARKDIR : GF_NONE);
    985 	Xfree(xs, xp);
    986 
    987 	return XPsize(*wp) - oldsize;
    988 }
    989 
    990 static void
    991 globit(xs, xpp, sp, wp, check)
    992 	XString *xs;		/* dest string */
    993 	char **xpp;		/* ptr to dest end */
    994 	char *sp;		/* source path */
    995 	register XPtrV *wp;	/* output list */
    996 	int check;		/* GF_* flags */
    997 {
    998 	register char *np;	/* next source component */
    999 	char *xp = *xpp;
   1000 	char *se;
   1001 	char odirsep;
   1002 
   1003 	/* This to allow long expansions to be interrupted */
   1004 	intrcheck();
   1005 
   1006 	if (sp == NULL) {	/* end of source path */
   1007 		/* We only need to check if the file exists if a pattern
   1008 		 * is followed by a non-pattern (eg, foo*x/bar; no check
   1009 		 * is needed for foo* since the match must exist) or if
   1010 		 * any patterns were expanded and the markdirs option is set.
   1011 		 * Symlinks make things a bit tricky...
   1012 		 */
   1013 		if ((check & GF_EXCHECK)
   1014 		    || ((check & GF_MARKDIR) && (check & GF_GLOBBED)))
   1015 		{
   1016 #define stat_check()	(stat_done ? stat_done : \
   1017 			    (stat_done = stat(Xstring(*xs, xp), &statb) < 0 \
   1018 				? -1 : 1))
   1019 			struct stat lstatb, statb;
   1020 			int stat_done = 0;	 /* -1: failed, 1 ok */
   1021 
   1022 			if (lstat(Xstring(*xs, xp), &lstatb) < 0)
   1023 				return;
   1024 			/* special case for systems which strip trailing
   1025 			 * slashes from regular files (eg, /etc/passwd/).
   1026 			 * SunOS 4.1.3 does this...
   1027 			 */
   1028 			if ((check & GF_EXCHECK) && xp > Xstring(*xs, xp)
   1029 			    && ISDIRSEP(xp[-1]) && !S_ISDIR(lstatb.st_mode)
   1030 #ifdef S_ISLNK
   1031 			    && (!S_ISLNK(lstatb.st_mode)
   1032 				|| stat_check() < 0
   1033 				|| !S_ISDIR(statb.st_mode))
   1034 #endif /* S_ISLNK */
   1035 				)
   1036 				return;
   1037 			/* Possibly tack on a trailing / if there isn't already
   1038 			 * one and if the file is a directory or a symlink to a
   1039 			 * directory
   1040 			 */
   1041 			if (((check & GF_MARKDIR) && (check & GF_GLOBBED))
   1042 			    && xp > Xstring(*xs, xp) && !ISDIRSEP(xp[-1])
   1043 			    && (S_ISDIR(lstatb.st_mode)
   1044 #ifdef S_ISLNK
   1045 				|| (S_ISLNK(lstatb.st_mode)
   1046 				    && stat_check() > 0
   1047 				    && S_ISDIR(statb.st_mode))
   1048 #endif /* S_ISLNK */
   1049 				    ))
   1050 			{
   1051 				*xp++ = DIRSEP;
   1052 				*xp = '\0';
   1053 			}
   1054 		}
   1055 #ifdef OS2 /* Done this way to avoid bug in gcc 2.7.2... */
   1056     /* Ugly kludge required for command
   1057      * completion - see how search_access()
   1058      * is implemented for OS/2...
   1059      */
   1060 # define KLUDGE_VAL	4
   1061 #else /* OS2 */
   1062 # define KLUDGE_VAL	0
   1063 #endif /* OS2 */
   1064 		XPput(*wp, str_nsave(Xstring(*xs, xp), Xlength(*xs, xp)
   1065 			+ KLUDGE_VAL, ATEMP));
   1066 		return;
   1067 	}
   1068 
   1069 	if (xp > Xstring(*xs, xp))
   1070 		*xp++ = DIRSEP;
   1071 	while (ISDIRSEP(*sp)) {
   1072 		Xcheck(*xs, xp);
   1073 		*xp++ = *sp++;
   1074 	}
   1075 	np = ksh_strchr_dirsep(sp);
   1076 	if (np != NULL) {
   1077 		se = np;
   1078 		odirsep = *np;	/* don't assume DIRSEP, can be multiple kinds */
   1079 		*np++ = '\0';
   1080 	} else {
   1081 		odirsep = '\0'; /* keep gcc quiet */
   1082 		se = sp + strlen(sp);
   1083 	}
   1084 
   1085 
   1086 	/* Check if sp needs globbing - done to avoid pattern checks for strings
   1087 	 * containing MAGIC characters, open ['s without the matching close ],
   1088 	 * etc. (otherwise opendir() will be called which may fail because the
   1089 	 * directory isn't readable - if no globbing is needed, only execute
   1090 	 * permission should be required (as per POSIX)).
   1091 	 */
   1092 	if (!has_globbing(sp, se)) {
   1093 		XcheckN(*xs, xp, se - sp + 1);
   1094 		debunk(xp, sp);
   1095 		xp += strlen(xp);
   1096 		*xpp = xp;
   1097 		globit(xs, xpp, np, wp, check);
   1098 	} else {
   1099 		DIR *dirp;
   1100 		struct dirent *d;
   1101 		char *name;
   1102 		int len;
   1103 		int prefix_len;
   1104 
   1105 		/* xp = *xpp;	   copy_non_glob() may have re-alloc'd xs */
   1106 		*xp = '\0';
   1107 		prefix_len = Xlength(*xs, xp);
   1108 		dirp = ksh_opendir(prefix_len ? Xstring(*xs, xp) : ".");
   1109 		if (dirp == NULL)
   1110 			goto Nodir;
   1111 		while ((d = readdir(dirp)) != NULL) {
   1112 			name = d->d_name;
   1113 			if (name[0] == '.' &&
   1114 			    (name[1] == 0 || (name[1] == '.' && name[2] == 0)))
   1115 				continue; /* always ignore . and .. */
   1116 			if ((*name == '.' && *sp != '.')
   1117 			    || !gmatch(name, sp, TRUE))
   1118 				continue;
   1119 
   1120 			len = NLENGTH(d) + 1;
   1121 			XcheckN(*xs, xp, len);
   1122 			memcpy(xp, name, len);
   1123 			*xpp = xp + len - 1;
   1124 			globit(xs, xpp, np, wp,
   1125 				(check & GF_MARKDIR) | GF_GLOBBED
   1126 				| (np ? GF_EXCHECK : GF_NONE));
   1127 			xp = Xstring(*xs, xp) + prefix_len;
   1128 		}
   1129 		closedir(dirp);
   1130 	  Nodir:;
   1131 	}
   1132 
   1133 	if (np != NULL)
   1134 		*--np = odirsep;
   1135 }
   1136 
   1137 #if 0
   1138 /* Check if p contains something that needs globbing; if it does, 0 is
   1139  * returned; if not, p is copied into xs/xp after stripping any MAGICs
   1140  */
   1141 static int	copy_non_glob ARGS((XString *xs, char **xpp, char *p));
   1142 static int
   1143 copy_non_glob(xs, xpp, p)
   1144 	XString *xs;
   1145 	char **xpp;
   1146 	char *p;
   1147 {
   1148 	char *xp;
   1149 	int len = strlen(p);
   1150 
   1151 	XcheckN(*xs, *xpp, len);
   1152 	xp = *xpp;
   1153 	for (; *p; p++) {
   1154 		if (ISMAGIC(*p)) {
   1155 			int c = *++p;
   1156 
   1157 			if (c == '*' || c == '?')
   1158 				return 0;
   1159 			if (*p == '[') {
   1160 				char *q = p + 1;
   1161 
   1162 				if (ISMAGIC(*q) && q[1] == NOT)
   1163 					q += 2;
   1164 				if (ISMAGIC(*q) && q[1] == ']')
   1165 					q += 2;
   1166 				for (; *q; q++)
   1167 					if (ISMAGIC(*q) && *++q == ']')
   1168 						return 0;
   1169 				/* pass a literal [ through */
   1170 			}
   1171 			/* must be a MAGIC-MAGIC, or MAGIC-!, MAGIC--, etc. */
   1172 		}
   1173 		*xp++ = *p;
   1174 	}
   1175 	*xp = '\0';
   1176 	*xpp = xp;
   1177 	return 1;
   1178 }
   1179 #endif /* 0 */
   1180 
   1181 /* remove MAGIC from string */
   1182 char *
   1183 debunk(dp, sp)
   1184 	char *dp;
   1185 	const char *sp;
   1186 {
   1187 	char *d, *s;
   1188 
   1189 	if ((s = strchr(sp, MAGIC))) {
   1190 		memcpy(dp, sp, s - sp);
   1191 		for (d = dp + (s - sp); *s; s++)
   1192 			if (!ISMAGIC(*s) || !(*++s & 0x80)
   1193 			    || !strchr("*+?@! ", *s & 0x7f))
   1194 				*d++ = *s;
   1195 			else {
   1196 				/* extended pattern operators: *+?@! */
   1197 				if ((*s & 0x7f) != ' ')
   1198 					*d++ = *s & 0x7f;
   1199 				*d++ = '(';
   1200 			}
   1201 		*d = '\0';
   1202 	} else if (dp != sp)
   1203 		strcpy(dp, sp);
   1204 	return dp;
   1205 }
   1206 
   1207 /* Check if p is an unquoted name, possibly followed by a / or :.  If so
   1208  * puts the expanded version in *dcp,dp and returns a pointer in p just
   1209  * past the name, otherwise returns 0.
   1210  */
   1211 static char *
   1212 maybe_expand_tilde(p, dsp, dpp, isassign)
   1213 	char *p;
   1214 	XString *dsp;
   1215 	char **dpp;
   1216 	int isassign;
   1217 {
   1218 	XString ts;
   1219 	char *dp = *dpp;
   1220 	char *tp, *r;
   1221 
   1222 	Xinit(ts, tp, 16, ATEMP);
   1223 	/* : only for DOASNTILDE form */
   1224 	while (p[0] == CHAR && !ISDIRSEP(p[1])
   1225 	       && (!isassign || p[1] != PATHSEP))
   1226 	{
   1227 		Xcheck(ts, tp);
   1228 		*tp++ = p[1];
   1229 		p += 2;
   1230 	}
   1231 	*tp = '\0';
   1232 	r = (p[0] == EOS || p[0] == CHAR || p[0] == CSUBST) ? tilde(Xstring(ts, tp)) : (char *) 0;
   1233 	Xfree(ts, tp);
   1234 	if (r) {
   1235 		while (*r) {
   1236 			Xcheck(*dsp, dp);
   1237 			if (ISMAGIC(*r))
   1238 				*dp++ = MAGIC;
   1239 			*dp++ = *r++;
   1240 		}
   1241 		*dpp = dp;
   1242 		r = p;
   1243 	}
   1244 	return r;
   1245 }
   1246 
   1247 /*
   1248  * tilde expansion
   1249  *
   1250  * based on a version by Arnold Robbins
   1251  */
   1252 
   1253 static char *
   1254 tilde(cp)
   1255 	char *cp;
   1256 {
   1257 	char *dp;
   1258 
   1259 	if (cp[0] == '\0')
   1260 		dp = str_val(global("HOME"));
   1261 	else if (cp[0] == '+' && cp[1] == '\0')
   1262 		dp = str_val(global("PWD"));
   1263 	else if (cp[0] == '-' && cp[1] == '\0')
   1264 		dp = str_val(global("OLDPWD"));
   1265 	else
   1266 		dp = homedir(cp);
   1267 	/* If HOME, PWD or OLDPWD are not set, don't expand ~ */
   1268 	if (dp == null)
   1269 		dp = (char *) 0;
   1270 	return dp;
   1271 }
   1272 
   1273 /*
   1274  * map userid to user's home directory.
   1275  * note that 4.3's getpw adds more than 6K to the shell,
   1276  * and the YP version probably adds much more.
   1277  * we might consider our own version of getpwnam() to keep the size down.
   1278  */
   1279 
   1280 static char *
   1281 homedir(name)
   1282 	char *name;
   1283 {
   1284 	register struct tbl *ap;
   1285 
   1286 	ap = tenter(&homedirs, name, hash(name));
   1287 	if (!(ap->flag & ISSET)) {
   1288 #ifdef OS2
   1289 		/* No usernames in OS2 - punt */
   1290 		return NULL;
   1291 #else /* OS2 */
   1292 		struct passwd *pw;
   1293 
   1294 		pw = getpwnam(name);
   1295 		if (pw == NULL)
   1296 			return NULL;
   1297 		ap->val.s = str_save(pw->pw_dir, APERM);
   1298 		ap->flag |= DEFINED|ISSET|ALLOC;
   1299 #endif /* OS2 */
   1300 	}
   1301 	return ap->val.s;
   1302 }
   1303 
   1304 #ifdef BRACE_EXPAND
   1305 static void
   1306 alt_expand(wp, start, exp_start, end, fdo)
   1307 	XPtrV *wp;
   1308 	char *start, *exp_start;
   1309 	char *end;
   1310 	int fdo;
   1311 {
   1312 	int UNINITIALIZED(count);
   1313 	char *brace_start, *brace_end, *UNINITIALIZED(comma);
   1314 	char *field_start;
   1315 	char *p;
   1316 
   1317 	/* search for open brace */
   1318 	for (p = exp_start; (p = strchr(p, MAGIC)) && p[1] != OBRACE; p += 2)
   1319 		;
   1320 	brace_start = p;
   1321 
   1322 	/* find matching close brace, if any */
   1323 	if (p) {
   1324 		comma = (char *) 0;
   1325 		count = 1;
   1326 		for (p += 2; *p && count; p++) {
   1327 			if (ISMAGIC(*p)) {
   1328 				if (*++p == OBRACE)
   1329 					count++;
   1330 				else if (*p == CBRACE)
   1331 					--count;
   1332 				else if (*p == ',' && count == 1)
   1333 					comma = p;
   1334 			}
   1335 		}
   1336 	}
   1337 	/* no valid expansions... */
   1338 	if (!p || count != 0) {
   1339 		/* Note that given a{{b,c} we do not expand anything (this is
   1340 		 * what at&t ksh does.  This may be changed to do the {b,c}
   1341 		 * expansion. }
   1342 		 */
   1343 		if (fdo & DOGLOB)
   1344 			glob(start, wp, fdo & DOMARKDIRS);
   1345 		else
   1346 			XPput(*wp, debunk(start, start));
   1347 		return;
   1348 	}
   1349 	brace_end = p;
   1350 	if (!comma) {
   1351 		alt_expand(wp, start, brace_end, end, fdo);
   1352 		return;
   1353 	}
   1354 
   1355 	/* expand expression */
   1356 	field_start = brace_start + 2;
   1357 	count = 1;
   1358 	for (p = brace_start + 2; p != brace_end; p++) {
   1359 		if (ISMAGIC(*p)) {
   1360 			if (*++p == OBRACE)
   1361 				count++;
   1362 			else if ((*p == CBRACE && --count == 0)
   1363 				 || (*p == ',' && count == 1))
   1364 			{
   1365 				char *new;
   1366 				int l1, l2, l3;
   1367 
   1368 				l1 = brace_start - start;
   1369 				l2 = (p - 1) - field_start;
   1370 				l3 = end - brace_end;
   1371 				new = (char *) alloc(l1 + l2 + l3 + 1, ATEMP);
   1372 				memcpy(new, start, l1);
   1373 				memcpy(new + l1, field_start, l2);
   1374 				memcpy(new + l1 + l2, brace_end, l3);
   1375 				new[l1 + l2 + l3] = '\0';
   1376 				alt_expand(wp, new, new + l1,
   1377 					   new + l1 + l2 + l3, fdo);
   1378 				field_start = p + 1;
   1379 			}
   1380 		}
   1381 	}
   1382 	return;
   1383 }
   1384 #endif /* BRACE_EXPAND */
   1385