hush: never glob result of dquoted "${v:+/bin/c*}"

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 13 insertions, 1 deletions

diff --git a/shell/hush.c b/shell/hush.c
index dddba5e30..4fdd15900 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -5994,7 +5994,19 @@ static int encode_then_append_var_plusminus(o_string *output, int n,
                         continue;
                 }
 #endif
-                o_addQchr(&dest, ch);
+                if (dquoted) {
+                        /* Always glob-protect if in dquotes:
+                         * x=x; echo "${x:+/bin/c*}" - prints: /bin/c*
+                         * x=x; echo "${x:+"/bin/c*"}" - prints: /bin/c*
+                         */
+                        o_addqchr(&dest, ch);
+                } else {
+                        /* Glob-protect only if char is quoted:
+                         * x=x; echo ${x:+/bin/c*} - prints many filenames
+                         * x=x; echo ${x:+"/bin/c*"} - prints: /bin/c*
+                         */
+                        o_addQchr(&dest, ch);
+                }
         } /* for (;;) */
 
         if (dest.data) {