do not let handle_dollar() accept vars that start with a digit

1 files changed, 18 insertions, 4 deletions

diff --git a/shell/hush.c b/shell/hush.c
index 498b14e72..96c949115 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -1647,6 +1647,7 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
 
                         /* lookup the variable in question */
                         if (isdigit(var[0])) {
+                                /* handle_dollar() should have vetted var for us */
                                 i = xatoi_u(var);
                                 if (i < G.global_argc)
                                         val = G.global_argv[i];
@@ -3726,22 +3727,33 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                 case '@': /* args */
                         goto make_one_char_var;
                 case '{': {
-                        bool first_char;
+                        bool first_char, all_digits;
 
                         o_addchr(dest, SPECIAL_VAR_SYMBOL);
                         i_getch(input);
                         /* XXX maybe someone will try to escape the '}' */
                         expansion = 0;
                         first_char = true;
+                        all_digits = false;
                         while (1) {
                                 ch = i_getch(input);
                                 if (ch == '}')
                                         break;
 
-                                if (ch == '#' && first_char)
-                                        /* ${#var}: length of var contents */;
+                                if (first_char) {
+                                        if (ch == '#')
+                                                /* ${#var}: length of var contents */
+                                                goto char_ok;
+                                        else if (isdigit(ch)) {
+                                                all_digits = true;
+                                                goto char_ok;
+                                        }
+                                }
 
-                                else if (expansion < 2 && !isalnum(ch) && ch != '_') {
+                                if (expansion < 2 &&
+                                    ((all_digits && !isdigit(ch)) ||
+                                     (!all_digits && !isalnum(ch) && ch != '_')))
+                                {
                                         /* handle parameter expansions
                                          * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_06_02
                                          */
@@ -3782,6 +3794,8 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                                                         return 1;
                                                 }
                                 }
+
+ char_ok:
                                 debug_printf_parse(": '%c'\n", ch);
                                 o_addchr(dest, ch | quote_mask);
                                 quote_mask = 0;