ash: error out on ${#1#}, ${#$11}, ${#11#}

Signed-off-by: Cristian Ionescu-Idbohrn <cristian.ionescu-idbohrn@axis.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 9f1f8a4de..44d3a99a7 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -11291,6 +11291,8 @@ parsesub: {
  badsub:
                         raise_error_syntax("bad substitution");
                 }
+                if (c != '}' && subtype == VSLENGTH)
+                        goto badsub;
 
                 STPUTC('=', out);
                 flags = 0;