2 files changed, 135 insertions, 118 deletions

diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index a9b790cf7..453e873ad 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -156,7 +156,6 @@ struct lineedit_statics {
 
         /* Formerly these were big buffers on stack: */
 #if ENABLE_FEATURE_TAB_COMPLETION
-        char exe_n_cwd_tab_completion__dirbuf[MAX_LINELEN];
         char input_tab__matchBuf[MAX_LINELEN];
         int16_t find_match__int_buf[MAX_LINELEN + 1]; /* need to have 9 bits at least */
         int16_t find_match__pos_buf[MAX_LINELEN + 1];
@@ -235,6 +234,8 @@ static unsigned save_string(char *dst, unsigned maxsize)
         while (dstpos < maxsize) {
                 wchar_t wc;
                 int n = srcpos;
+
+                /* Convert up to 1st invalid byte (or up to end) */
                 while ((wc = command_ps[srcpos]) != 0
                     && !unicode_is_raw_byte(wc)
                 ) {
@@ -247,6 +248,7 @@ static unsigned save_string(char *dst, unsigned maxsize)
                 dstpos += n;
                 if (wc == 0) /* usually is */
                         break;
+
                 /* We do have invalid byte here! */
                 command_ps[srcpos] = wc; /* restore it */
                 srcpos++;
@@ -608,53 +610,56 @@ static void add_match(char *matched)
 }
 
 #if ENABLE_FEATURE_USERNAME_COMPLETION
-static void username_tab_completion(char *ud, char *with_shash_flg)
+/* Replace "~user/..." with "/homedir/...".
+ * The parameter is malloced, free it or return it
+ * unchanged if no user is matched.
+ */
+static char *username_path_completion(char *ud)
 {
         struct passwd *entry;
+        char *tilde_name = ud;
+        char *home = NULL;
+
+        ud++; /* skip ~ */
+        if (*ud == '/') {       /* "~/..." */
+                home = home_pwd_buf;
+        } else {
+                /* "~user/..." */
+                ud = strchr(ud, '/');
+                *ud = '\0';           /* "~user" */
+                entry = getpwnam(tilde_name + 1);
+                *ud = '/';            /* restore "~user/..." */
+                if (entry)
+                        home = entry->pw_dir;
+        }
+        if (home) {
+                ud = concat_path_file(home, ud);
+                free(tilde_name);
+                tilde_name = ud;
+        }
+        return tilde_name;
+}
+
+/* ~use<tab> - find all users with this prefix */
+static NOINLINE void username_completion(const char *ud)
+{
+        /* Using _r function to avoid pulling in static buffers */
+        char line_buff[256];
+        struct passwd pwd;
+        struct passwd *result;
         int userlen;
 
-        ud++;                           /* ~user/... to user/... */
+        ud++; /* skip ~ */
         userlen = strlen(ud);
 
-        if (with_shash_flg) {           /* "~/..." or "~user/..." */
-                char *sav_ud = ud - 1;
-                char *home = NULL;
-
-                if (*ud == '/') {       /* "~/..."     */
-                        home = home_pwd_buf;
-                } else {
-                        /* "~user/..." */
-                        char *temp;
-                        temp = strchr(ud, '/');
-                        *temp = '\0';           /* ~user\0 */
-                        entry = getpwnam(ud);
-                        *temp = '/';            /* restore ~user/... */
-                        ud = temp;
-                        if (entry)
-                                home = entry->pw_dir;
-                }
-                if (home) {
-                        if ((userlen + strlen(home) + 1) < MAX_LINELEN) {
-                                /* /home/user/... */
-                                sprintf(sav_ud, "%s%s", home, ud);
-                        }
-                }
-        } else {
-                /* "~[^/]*" */
-                /* Using _r function to avoid pulling in static buffers */
-                char line_buff[256];
-                struct passwd pwd;
-                struct passwd *result;
-
-                setpwent();
-                while (!getpwent_r(&pwd, line_buff, sizeof(line_buff), &result)) {
-                        /* Null usernames should result in all users as possible completions. */
-                        if (/*!userlen || */ strncmp(ud, pwd.pw_name, userlen) == 0) {
-                                add_match(xasprintf("~%s/", pwd.pw_name));
-                        }
+        setpwent();
+        while (!getpwent_r(&pwd, line_buff, sizeof(line_buff), &result)) {
+                /* Null usernames should result in all users as possible completions. */
+                if (/*!userlen || */ strncmp(ud, pwd.pw_name, userlen) == 0) {
+                        add_match(xasprintf("~%s/", pwd.pw_name));
                 }
-                endpwent();
         }
+        endpwent();
 }
 #endif  /* FEATURE_COMMAND_USERNAME_COMPLETION */
 
@@ -664,22 +669,19 @@ enum {
         FIND_FILE_ONLY = 2,
 };
 
-static int path_parse(char ***p, int flags)
+static int path_parse(char ***p)
 {
         int npth;
         const char *pth;
         char *tmp;
         char **res;
 
-        /* if not setenv PATH variable, to search cur dir "." */
-        if (flags != FIND_EXE_ONLY)
-                return 1;
-
         if (state->flags & WITH_PATH_LOOKUP)
                 pth = state->path_lookup;
         else
                 pth = getenv("PATH");
-        /* PATH=<empty> or PATH=:<empty> */
+
+        /* PATH="" or PATH=":"? */
         if (!pth || !pth[0] || LONE_CHAR(pth, ':'))
                 return 1;
 
@@ -689,12 +691,13 @@ static int path_parse(char ***p, int flags)
                 tmp = strchr(tmp, ':');
                 if (!tmp)
                         break;
-                if (*++tmp == '\0')
+                tmp++;
+                if (*tmp == '\0')
                         break;  /* :<empty> */
                 npth++;
         }
 
-        res = xmalloc(npth * sizeof(char*));
+        *p = res = xmalloc(npth * sizeof(res[0]));
         res[0] = tmp = xstrdup(pth);
         npth = 1;
         while (1) {
@@ -706,100 +709,96 @@ static int path_parse(char ***p, int flags)
                         break; /* :<empty> */
                 res[npth++] = tmp;
         }
-        *p = res;
         return npth;
 }
 
 static void exe_n_cwd_tab_completion(char *command, int type)
 {
-        DIR *dir;
-        struct dirent *next;
-        struct stat st;
         char *path1[1];
         char **paths = path1;
         int npaths;
         int i;
-        char *found;
-        char *pfind = strrchr(command, '/');
-/*      char dirbuf[MAX_LINELEN]; */
-#define dirbuf (S.exe_n_cwd_tab_completion__dirbuf)
+        char *pfind;
+        char *dirbuf = NULL;
 
         npaths = 1;
         path1[0] = (char*)".";
 
-        if (pfind == NULL) {
-                /* no dir, if flags==EXE_ONLY - get paths, else "." */
-                npaths = path_parse(&paths, type);
+        pfind = strrchr(command, '/');
+        if (!pfind) {
+                if (type == FIND_EXE_ONLY)
+                        npaths = path_parse(&paths);
                 pfind = command;
         } else {
+                /* point to 'l' in "..../last_component" */
+                pfind++;
                 /* dirbuf = ".../.../.../" */
-                safe_strncpy(dirbuf, command, (pfind - command) + 2);
+                dirbuf = xstrndup(command, pfind - command);
 #if ENABLE_FEATURE_USERNAME_COMPLETION
                 if (dirbuf[0] == '~')   /* ~/... or ~user/... */
-                        username_tab_completion(dirbuf, dirbuf);
+                        dirbuf = username_path_completion(dirbuf);
 #endif
-                paths[0] = dirbuf;
-                /* point to 'l' in "..../last_component" */
-                pfind++;
+                path1[0] = dirbuf;
         }
 
         for (i = 0; i < npaths; i++) {
+                DIR *dir;
+                struct dirent *next;
+                struct stat st;
+                char *found;
+
                 dir = opendir(paths[i]);
                 if (!dir)
                         continue; /* don't print an error */
 
                 while ((next = readdir(dir)) != NULL) {
-                        int len1;
-                        const char *str_found = next->d_name;
+                        const char *name_found = next->d_name;
 
-                        /* matched? */
-                        if (strncmp(str_found, pfind, strlen(pfind)))
+                        /* .../<tab>: bash 3.2.0 shows dotfiles, but not . and .. */
+                        if (!pfind[0] && DOT_OR_DOTDOT(name_found))
                                 continue;
-                        /* not see .name without .match */
-                        if (*str_found == '.' && *pfind == '\0') {
-                                if (NOT_LONE_CHAR(paths[i], '/') || str_found[1])
-                                        continue;
-                                str_found = ""; /* only "/" */
-                        }
-                        found = concat_path_file(paths[i], str_found);
-                        /* hmm, remove in progress? */
+                        /* match? */
+                        if (strncmp(name_found, pfind, strlen(pfind)) != 0)
+                                continue; /* no */
+
+                        found = concat_path_file(paths[i], name_found);
                         /* NB: stat() first so that we see is it a directory;
                          * but if that fails, use lstat() so that
                          * we still match dangling links */
                         if (stat(found, &st) && lstat(found, &st))
-                                goto cont;
-                        /* find with dirs? */
-                        if (paths[i] != dirbuf)
-                                strcpy(found, next->d_name); /* only name */
+                                goto cont; /* hmm, remove in progress? */
 
-                        len1 = strlen(found);
-                        found = xrealloc(found, len1 + 2);
-                        found[len1] = '\0';
-                        found[len1+1] = '\0';
+                        /* save only name if we scan PATH */
+                        if (paths[i] != dirbuf)
+                                strcpy(found, name_found);
 
                         if (S_ISDIR(st.st_mode)) {
+                                unsigned len1 = strlen(found);
                                 /* name is a directory */
                                 if (found[len1-1] != '/') {
+                                        found = xrealloc(found, len1 + 2);
                                         found[len1] = '/';
+                                        found[len1 + 1] = '\0';
                                 }
                         } else {
-                                /* not put found file if search only dirs for cd */
+                                /* skip files if looking for dirs only (example: cd) */
                                 if (type == FIND_DIR_ONLY)
                                         goto cont;
                         }
-                        /* Add it to the list */
+                        /* add it to the list */
                         add_match(found);
                         continue;
  cont:
                         free(found);
                 }
                 closedir(dir);
-        }
+        } /* for every path */
+
         if (paths != path1) {
                 free(paths[0]); /* allocated memory is only in first member */
                 free(paths);
         }
-#undef dirbuf
+        free(dirbuf);
 }
 
 /* QUOT is used on elements of int_buf[], which are bytes,
@@ -812,15 +811,20 @@ static void exe_n_cwd_tab_completion(char *command, int type)
 /* is must be <= in */
 static void collapse_pos(int is, int in)
 {
-        memmove(int_buf+is, int_buf+in, (MAX_LINELEN+1-in)*sizeof(int_buf[0]));
-        memmove(pos_buf+is, pos_buf+in, (MAX_LINELEN+1-in)*sizeof(pos_buf[0]));
+        memmove(int_buf+is, int_buf+in, (MAX_LINELEN+1-in) * sizeof(int_buf[0]));
+        memmove(pos_buf+is, pos_buf+in, (MAX_LINELEN+1-in) * sizeof(pos_buf[0]));
 }
-static NOINLINE int find_match(char *matchBuf, int *len_with_quotes)
+/* On entry, matchBuf contains everything up to cursor at the moment <tab>
+ * was pressed. This function looks at it, figures out what part of it
+ * constitutes the command/file/directory prefix to use for completion,
+ * and rewrites matchBuf to contain only that part.
+ */
+static NOINLINE int build_match_prefix(char *matchBuf, int *len_with_quotes)
 {
         int i, j;
         int command_mode;
         int c, c2;
-/*      Were local, but it uses too much stack */
+/*      Were local, but it used too much stack */
 /*      int16_t int_buf[MAX_LINELEN + 1]; */
 /*      int16_t pos_buf[MAX_LINELEN + 1]; */
 
@@ -860,22 +864,23 @@ static NOINLINE int find_match(char *matchBuf, int *len_with_quotes)
         }
 
         /* skip commands with arguments if line has commands delimiters */
-        /* ';' ';;' '&' '|' '&&' '||' but `>&' `<&' `>|' */
+        /* ';' ';;' '&' '|' '&&' '||' but '>&' '<&' '>|' */
         for (i = 0; int_buf[i]; i++) {
+                int n;
                 c = int_buf[i];
                 c2 = int_buf[i + 1];
                 j = i ? int_buf[i - 1] : -1;
-                command_mode = 0;
+                n = 0;
                 if (c == ';' || c == '&' || c == '|') {
-                        command_mode = 1 + (c == c2);
+                        n = 1 + (c == c2);
                         if (c == '&') {
                                 if (j == '>' || j == '<')
-                                        command_mode = 0;
+                                        n = 0;
                         } else if (c == '|' && j == '>')
-                                command_mode = 0;
+                                n = 0;
                 }
-                if (command_mode) {
-                        collapse_pos(0, i + command_mode);
+                if (n) {
+                        collapse_pos(0, i + n);
                         i = -1;  /* hack incremet */
                 }
         }
@@ -943,8 +948,8 @@ static NOINLINE int find_match(char *matchBuf, int *len_with_quotes)
                         }
                 }
         }
-        for (i = 0; int_buf[i]; i++)
-                /* "strlen" */;
+        for (i = 0; int_buf[i]; i++) /* quasi-strlen(int_buf) */
+                continue;
         /* find last word */
         for (--i; i >= 0; i--) {
                 c = int_buf[i];
@@ -955,7 +960,7 @@ static NOINLINE int find_match(char *matchBuf, int *len_with_quotes)
         }
         /* skip first not quoted '\'' or '"' */
         for (i = 0; int_buf[i] == '\'' || int_buf[i] == '"'; i++)
-                /*skip*/;
+                continue;
         /* collapse quote or unquote // or /~ */
         while ((int_buf[i] & ~QUOT) == '/'
          && ((int_buf[i+1] & ~QUOT) == '/' || (int_buf[i+1] & ~QUOT) == '~')
@@ -1058,13 +1063,20 @@ static void input_tab(smallint *lastWasTab)
 
                 /* Make a local copy of the string --
                  * up to the position of the cursor */
+#if !ENABLE_UNICODE_SUPPORT
                 save_string(matchBuf, cursor + 1);
-#if ENABLE_UNICODE_SUPPORT
-                cursor_mb = strlen(matchBuf);
+#else
+                {
+                        CHAR_T wc = command_ps[cursor];
+                        command_ps[cursor] = 0;
+                        save_string(matchBuf, MAX_LINELEN);
+                        command_ps[cursor] = wc;
+                        cursor_mb = strlen(matchBuf);
+                }
 #endif
                 tmp = matchBuf;
 
-                find_type = find_match(matchBuf, &recalc_pos);
+                find_type = build_match_prefix(matchBuf, &recalc_pos);
 
                 /* Free up any memory already allocated */
                 free_tab_completion_data();
@@ -1074,7 +1086,7 @@ static void input_tab(smallint *lastWasTab)
                  * then try completing this word as a username. */
                 if (state->flags & USERNAME_COMPLETION)
                         if (matchBuf[0] == '~' && strchr(matchBuf, '/') == NULL)
-                                username_tab_completion(matchBuf, NULL);
+                                username_completion(matchBuf);
 #endif
                 /* Try to match any executable in our path and everything
                  * in the current working directory */
@@ -1083,7 +1095,7 @@ static void input_tab(smallint *lastWasTab)
                 /* Sort, then remove any duplicates found */
                 if (matches) {
                         unsigned i;
-                        int n = 0;
+                        unsigned n = 0;
                         qsort_string_vector(matches, num_matches);
                         for (i = 0; i < num_matches - 1; ++i) {
                                 if (matches[i] && matches[i+1]) { /* paranoia */
@@ -1095,14 +1107,14 @@ static void input_tab(smallint *lastWasTab)
                                         }
                                 }
                         }
-                        matches[n] = matches[i];
-                        num_matches = n + 1;
+                        matches[n++] = matches[i];
+                        num_matches = n;
                 }
                 /* Did we find exactly one match? */
-                if (!matches || num_matches > 1) { /* no */
+                if (num_matches != 1) { /* no */
                         beep();
                         if (!matches)
-                                return;         /* not found */
+                                return; /* no matches at all */
                         /* find minimal match */
                         tmp1 = xstrdup(matches[0]);
                         for (tmp = tmp1; *tmp; tmp++) {
@@ -1113,13 +1125,14 @@ static void input_tab(smallint *lastWasTab)
                                         }
                                 }
                         }
-                        if (*tmp1 == '\0') {        /* have unique */
-                                free(tmp1);
+                        if (*tmp1 == '\0') { /* have unique pfx? */
+                                free(tmp1); /* no */
                                 return;
                         }
                         tmp = add_quote_for_spec_chars(tmp1);
                         free(tmp1);
-                } else {                        /* one match */
+                        len_found = strlen(tmp);
+                } else {                        /* exactly one match */
                         tmp = add_quote_for_spec_chars(matches[0]);
                         /* for next completion current found */
                         *lastWasTab = FALSE;
@@ -1127,11 +1140,10 @@ static void input_tab(smallint *lastWasTab)
                         len_found = strlen(tmp);
                         if (tmp[len_found-1] != '/') {
                                 tmp[len_found] = ' ';
-                                tmp[len_found+1] = '\0';
+                                tmp[++len_found] = '\0';
                         }
                 }
 
-                len_found = strlen(tmp);
 #if !ENABLE_UNICODE_SUPPORT
                 /* have space to place the match? */
                 /* The result consists of three parts with these lengths: */
@@ -1164,7 +1176,10 @@ static void input_tab(smallint *lastWasTab)
                                 sprintf(&command[cursor_mb - recalc_pos], "%s%s", tmp, matchBuf);
                                 command_len = load_string(command, S.maxsize);
                                 /* write out the matched command */
-                                redraw(cmdedit_y, command_len - len);
+                                /* paranoia: load_string can return 0 on conv error,
+                                 * prevent passing len = (0 - 12) to redraw */
+                                len = command_len - len;
+                                redraw(cmdedit_y, len >= 0 ? len : 0);
                         }
                 }
 #endif
@@ -2297,6 +2312,8 @@ int FAST_FUNC read_line_input(const char *prompt, char *command, int maxsize, li
                                  * or exit if len=0 and no chars to delete */
                                 if (command_len == 0) {
                                         errno = 0;
+
+                case -1:  /* error (e.g. EIO when tty is destroyed) */
 #if ENABLE_FEATURE_EDITING_VI
  prepare_to_die:
 #endif
diff --git a/libbb/unicode.c b/libbb/unicode.c
index d6fcf7a43..5a657b2d7 100644
--- a/libbb/unicode.c
+++ b/libbb/unicode.c
@@ -131,7 +131,7 @@ size_t FAST_FUNC wcstombs(char *dest, const wchar_t *src, size_t n)
                 size_t len = wcrtomb_internal(tbuf, wc);
 
                 if (len > n)
-                        len = n;
+                        break;
                 memcpy(dest, tbuf, len);
                 if (wc == L'\0')
                         return org_n - n;