ash: parser: Fix VSLENGTH parsing with trailing garbage

Let's adopt Herbert Xu's patch, not waiting for it to reach dash git:
hush already has a similar fix.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
(cherry picked from commit 53a7a9cd8c15d64fcc2278cf8981ba526dfbe0d2)

1 files changed, 3 insertions, 6 deletions

diff --git a/shell/ash.c b/shell/ash.c
index a33ab0626..1ca45f9c1 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -12635,7 +12635,7 @@ parsesub: {
                         do {
                                 STPUTC(c, out);
                                 c = pgetc_eatbnl();
-                        } while (!subtype && isdigit(c));
+                        } while ((subtype == 0 || subtype == VSLENGTH) && isdigit(c));
                 } else if (c != '}') {
                         /* $[{[#]]<specialchar>[}] */
                         int cc = c;
@@ -12665,11 +12665,6 @@ parsesub: {
                 } else
                         goto badsub;
 
-                if (c != '}' && subtype == VSLENGTH) {
-                        /* ${#VAR didn't end with } */
-                        goto badsub;
-                }
-
                 if (subtype == 0) {
                         static const char types[] ALIGN1 = "}-+?=";
                         /* ${VAR...} but not $VAR or ${#VAR} */
@@ -12726,6 +12721,8 @@ parsesub: {
 #endif
                         }
                 } else {
+                        if (subtype == VSLENGTH && c != '}')
+                                subtype = 0;
  badsub:
                         pungetc();
                 }