1 files changed, 27 insertions, 3 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 2eac6e113..092f3bcc7 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -6970,7 +6970,8 @@ scanright(char *startp, char *rmesc, char *rmescend,
          * Logic:
          * loc starts at NUL at the end of startp, loc2 starts at the end of rmesc,
          * and on each iteration they go back two/one char until they reach the beginning.
-         * We try to find a match in "raw_value_of_v", "raw_value_of_", "raw_value_of" etc.
+         * We try to match "raw_value_of_v", "raw_value_of_", "raw_value_of" etc.
+         * If one of these matches, return pointer past last matched char in startp.
          */
         /* TODO: document in what other circumstances we are called. */
 
@@ -7258,6 +7259,7 @@ subevalvar(char *start, char *str, int strloc,
 #if BASH_PATTERN_SUBST
         workloc = expdest - (char *)stackblock();
         if (subtype == VSREPLACE || subtype == VSREPLACEALL) {
+                size_t no_meta_len;
                 int len;
                 char *idx, *end;
 
@@ -7275,16 +7277,38 @@ subevalvar(char *start, char *str, int strloc,
                 if (str[0] == '\0')
                         goto out1;
 
+                no_meta_len = (ENABLE_ASH_OPTIMIZE_FOR_SIZE || strpbrk(str, "*?[\\")) ? 0 : strlen(str);
                 len = 0;
                 idx = startp;
                 end = str - 1;
                 while (idx <= end) {
  try_to_match:
-                        loc = scanright(idx, rmesc, rmescend, str, quotes, 1);
+                        if (no_meta_len == 0) {
+                                /* pattern has meta chars, have to glob; or ENABLE_ASH_OPTIMIZE_FOR_SIZE  */
+                                loc = scanright(idx, rmesc, rmescend, str, quotes, /*match_at_start:*/ 1);
+                        } else {
+                                /* Testcase for very slow replace (performs about 22k replaces):
+                                 * x=::::::::::::::::::::::
+                                 * x=$x$x;x=$x$x;x=$x$x;x=$x$x;x=$x$x;x=$x$x;x=$x$x;x=$x$x;x=$x$x;x=$x$x;echo ${#x}
+                                 * echo "${x//:/|}"
+                                 */
+                                size_t n;
+                                if (strncmp(rmesc, str, no_meta_len) != 0)
+                                        goto no_match;
+                                n = no_meta_len;
+                                loc = idx;
+                                do {
+                                        if (quotes && (unsigned char)*loc == CTLESC)
+                                                loc++;
+                                        loc++;
+                                } while (--n != 0);
+                        }
                         //bb_error_msg("scanright('%s'):'%s'", str, loc);
                         if (!loc) {
+                                char *restart_detect;
+ no_match:
                                 /* No match, advance */
-                                char *restart_detect = stackblock();
+                                restart_detect = stackblock();
  skip_matching:
                                 if (idx >= end)
                                         break;