ash: [PARSER] Fix parsing of ${##1}

Upstream commit:

    Date: Thu, 4 Oct 2007 22:15:10 +0800
    [PARSER] Fix parsing of ${##1}

    Previously dash treated ${##1} as a length operation.  This patch fixes that.

    Test case:

        set -- a
        echo ${##1}OK

    Old result:

        1OK

    New result:

        OK

This was a real bug in ash (but not in hush).

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 18 insertions, 10 deletions

diff --git a/shell/ash.c b/shell/ash.c
index b404449d0..2cebfe2c0 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -11728,16 +11728,9 @@ parsesub: {
                 subtype = VSNORMAL;
                 if (c == '{') {
                         c = pgetc_eatbnl();
-                        if (c == '#') {
-                                c = pgetc_eatbnl();
-                                if (c == '}')
-                                        c = '#'; /* ${#} - same as $# */
-                                else
-                                        subtype = VSLENGTH; /* ${#VAR} */
-                        } else {
-                                subtype = 0;
-                        }
+                        subtype = 0;
                 }
+ varname:
                 if (c <= 255 /* not PEOA or PEOF */ && is_name(c)) {
                         /* $[{[#]]NAME[}] */
                         do {
@@ -11752,8 +11745,23 @@ parsesub: {
                         } while (isdigit(c));
                 } else if (is_special(c)) {
                         /* $[{[#]]<specialchar>[}] */
-                        USTPUTC(c, out);
+                        int cc = c;
+
                         c = pgetc_eatbnl();
+                        if (!subtype && cc == '#') {
+                                subtype = VSLENGTH;
+                                if (c == '_' || isalnum(c))
+                                        goto varname;
+                                cc = c;
+                                c = pgetc_eatbnl();
+                                if (cc == '}' || c != '}') {
+                                        pungetc();
+                                        subtype = 0;
+                                        c = cc;
+                                        cc = '#';
+                                }
+                        }
+                        USTPUTC(cc, out);
                 } else {
                         goto badsub;
                 }