1 files changed, 83 insertions, 34 deletions

diff --git a/shell/hush.c b/shell/hush.c
index 1082738a2..e4138adf7 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -2281,7 +2281,7 @@ static void o_addqblock(o_string *o, const char *str, int len)
                         ordinary_cnt = len;
                 o_addblock(o, str, ordinary_cnt);
                 if (ordinary_cnt == len)
-                        return;
+                        return; /* NUL is already added by o_addblock */
                 str += ordinary_cnt;
                 len -= ordinary_cnt + 1; /* we are processing + 1 char below */
 
@@ -2295,8 +2295,8 @@ static void o_addqblock(o_string *o, const char *str, int len)
                 o_grow_by(o, sz);
                 o->data[o->length] = ch;
                 o->length++;
-                o->data[o->length] = '\0';
         }
+        o->data[o->length] = '\0';
 }
 
 static void o_addQblock(o_string *o, const char *str, int len)
@@ -2385,6 +2385,7 @@ static int o_save_ptr_helper(o_string *o, int n)
                                 n, string_len, string_start);
                 o->has_empty_slot = 0;
         }
+        o->has_quoted_part = 0;
         list[n] = (char*)(uintptr_t)string_len;
         return n + 1;
 }
@@ -3264,14 +3265,6 @@ static int done_word(o_string *word, struct parse_context *ctx)
                         ) {
                                 p += 3;
                         }
-                        if (p == word->data || p[0] != '\0') {
-                                /* saw no "$@", or not only "$@" but some
-                                 * real text is there too */
-                                /* insert "empty variable" reference, this makes
-                                 * e.g. "", $empty"" etc to not disappear */
-                                o_addchr(word, SPECIAL_VAR_SYMBOL);
-                                o_addchr(word, SPECIAL_VAR_SYMBOL);
-                        }
                 }
                 command->argv = add_string_to_strings(command->argv, xstrdup(word->data));
                 debug_print_strings("word appended to argv", command->argv);
@@ -4515,20 +4508,30 @@ static struct pipe *parse_stream(char **pstring,
                         break;
                 case '\'':
                         dest.has_quoted_part = 1;
-                        while (1) {
-                                ch = i_getch(input);
-                                if (ch == EOF) {
-                                        syntax_error_unterm_ch('\'');
-                                        goto parse_error;
+                        if (next == '\'' && !ctx.pending_redirect) {
+ insert_empty_quoted_str_marker:
+                                nommu_addchr(&ctx.as_string, next);
+                                i_getch(input); /* eat second ' */
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        } else {
+                                while (1) {
+                                        ch = i_getch(input);
+                                        if (ch == EOF) {
+                                                syntax_error_unterm_ch('\'');
+                                                goto parse_error;
+                                        }
+                                        nommu_addchr(&ctx.as_string, ch);
+                                        if (ch == '\'')
+                                                break;
+                                        o_addqchr(&dest, ch);
                                 }
-                                nommu_addchr(&ctx.as_string, ch);
-                                if (ch == '\'')
-                                        break;
-                                o_addqchr(&dest, ch);
                         }
                         break;
                 case '"':
                         dest.has_quoted_part = 1;
+                        if (next == '"' && !ctx.pending_redirect)
+                                goto insert_empty_quoted_str_marker;
                         if (dest.o_assignment == NOT_ASSIGNMENT)
                                 dest.o_expflags |= EXP_FLAG_ESC_GLOB_CHARS;
                         if (!encode_string(&ctx.as_string, &dest, input, '"', /*process_bkslash:*/ 1))
@@ -4750,12 +4753,22 @@ static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len
 
 /* Store given string, finalizing the word and starting new one whenever
  * we encounter IFS char(s). This is used for expanding variable values.
- * End-of-string does NOT finalize word: think about 'echo -$VAR-' */
-static int expand_on_ifs(o_string *output, int n, const char *str)
+ * End-of-string does NOT finalize word: think about 'echo -$VAR-'.
+ * Return in *ended_with_ifs:
+ * 1 - ended with IFS char, else 0 (this includes case of empty str).
+ */
+static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const char *str)
 {
+        int last_is_ifs = 0;
+
         while (1) {
-                int word_len = strcspn(str, G.ifs);
+                int word_len;
+
+                if (!*str)  /* EOL - do not finalize word */
+                        break;
+                word_len = strcspn(str, G.ifs);
                 if (word_len) {
+                        /* We have WORD_LEN leading non-IFS chars */
                         if (!(output->o_expflags & EXP_FLAG_GLOB)) {
                                 o_addblock(output, str, word_len);
                         } else {
@@ -4768,15 +4781,36 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
                                 /*o_addblock(output, str, word_len); - WRONG: "v='\*'; echo Z$v" prints "Z*" instead of "Z\*" */
                                 /*o_addqblock(output, str, word_len); - WRONG: "v='*'; echo Z$v" prints "Z*" instead of Z* files */
                         }
+                        last_is_ifs = 0;
                         str += word_len;
+                        if (!*str)  /* EOL - do not finalize word */
+                                break;
                 }
+
+                /* We know str here points to at least one IFS char */
+                last_is_ifs = 1;
+                str += strspn(str, G.ifs); /* skip IFS chars */
                 if (!*str)  /* EOL - do not finalize word */
                         break;
-                o_addchr(output, '\0');
-                debug_print_list("expand_on_ifs", output, n);
-                n = o_save_ptr(output, n);
-                str += strspn(str, G.ifs); /* skip ifs chars */
+
+                /* Start new word... but not always! */
+                /* Case "v=' a'; echo ''$v": we do need to finalize empty word: */
+                if (output->has_quoted_part
+                /* Case "v=' a'; echo $v":
+                 * here nothing precedes the space in $v expansion,
+                 * therefore we should not finish the word
+                 * (IOW: if there *is* word to finalize, only then do it):
+                 */
+                 || (n > 0 && output->data[output->length - 1])
+                ) {
+                        o_addchr(output, '\0');
+                        debug_print_list("expand_on_ifs", output, n);
+                        n = o_save_ptr(output, n);
+                }
         }
+
+        if (ended_with_ifs)
+                *ended_with_ifs = last_is_ifs;
         debug_print_list("expand_on_ifs[1]", output, n);
         return n;
 }
@@ -5191,6 +5225,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
          * expansion of right-hand side of assignment == 1-element expand.
          */
         char cant_be_null = 0; /* only bit 0x80 matters */
+        int ended_in_ifs = 0;  /* did last unquoted expansion end with IFS chars? */
         char *p;
 
         debug_printf_expand("expand_vars_to_list: arg:'%s' singleword:%x\n", arg,
@@ -5209,6 +5244,13 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
 #if ENABLE_SH_MATH_SUPPORT
                 char arith_buf[sizeof(arith_t)*3 + 2];
 #endif
+
+                if (ended_in_ifs) {
+                        o_addchr(output, '\0');
+                        n = o_save_ptr(output, n);
+                        ended_in_ifs = 0;
+                }
+
                 o_addblock(output, arg, p - arg);
                 debug_print_list("expand_vars_to_list[1]", output, n);
                 arg = ++p;
@@ -5237,7 +5279,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         cant_be_null |= first_ch; /* do it for "$@" _now_, when we know it's not empty */
                         if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
                                 while (G.global_argv[i]) {
-                                        n = expand_on_ifs(output, n, G.global_argv[i]);
+                                        n = expand_on_ifs(NULL, output, n, G.global_argv[i]);
                                         debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, G.global_argc - 1);
                                         if (G.global_argv[i++][0] && G.global_argv[i]) {
                                                 /* this argv[] is not empty and not last:
@@ -5270,11 +5312,13 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                                         if (G.ifs[0])
                                                 o_addchr(output, G.ifs[0]);
                                 }
+                                output->has_quoted_part = 1;
                         }
                         break;
                 }
                 case SPECIAL_VAR_SYMBOL: /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
                         /* "Empty variable", used to make "" etc to not disappear */
+                        output->has_quoted_part = 1;
                         arg++;
                         cant_be_null = 0x80;
                         break;
@@ -5312,10 +5356,11 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                                 debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
                                                 !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                                 if (val && val[0]) {
-                                        n = expand_on_ifs(output, n, val);
+                                        n = expand_on_ifs(&ended_in_ifs, output, n, val);
                                         val = NULL;
                                 }
                         } else { /* quoted $VAR, val will be appended below */
+                                output->has_quoted_part = 1;
                                 debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
                                                 !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                         }
@@ -5340,6 +5385,10 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
         } /* end of "while (SPECIAL_VAR_SYMBOL is found) ..." */
 
         if (arg[0]) {
+                if (ended_in_ifs) {
+                        o_addchr(output, '\0');
+                        n = o_save_ptr(output, n);
+                }
                 debug_print_list("expand_vars_to_list[a]", output, n);
                 /* this part is literal, and it was already pre-quoted
                  * if needed (much earlier), do not use o_addQstr here! */
@@ -5470,12 +5519,6 @@ static char **expand_assignments(char **argv, int count)
 }
 
 
-#if BB_MMU
-/* never called */
-void re_execute_shell(char ***to_free, const char *s,
-                char *g_argv0, char **g_argv,
-                char **builtin_argv) NORETURN;
-
 static void switch_off_special_sigs(unsigned mask)
 {
         unsigned sig = 0;
@@ -5495,6 +5538,12 @@ static void switch_off_special_sigs(unsigned mask)
         }
 }
 
+#if BB_MMU
+/* never called */
+void re_execute_shell(char ***to_free, const char *s,
+                char *g_argv0, char **g_argv,
+                char **builtin_argv) NORETURN;
+
 static void reset_traps_to_defaults(void)
 {
         /* This function is always called in a child shell