From 53a7a9cd8c15d64fcc2278cf8981ba526dfbe0d2 Mon Sep 17 00:00:00 2001
From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Fri, 25 Jun 2021 02:09:41 +0200
Subject: [PATCH] ash: parser: Fix VSLENGTH parsing with trailing garbage

Let's adopt Herbert Xu's patch, not waiting for it to reach dash git:
hush already has a similar fix.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
 shell/ash.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/shell/ash.c b/shell/ash.c
index bee81920a..2eac6e113 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -12751,7 +12751,7 @@ parsesub: {
 			do {
 				STPUTC(c, out);
 				c = pgetc_eatbnl();
-			} while (!subtype && isdigit(c));
+			} while ((subtype == 0 || subtype == VSLENGTH) && isdigit(c));
 		} else if (c != '}') {
 			/* $[{[#]]<specialchar>[}] */
 			int cc = c;
@@ -12781,11 +12781,6 @@ parsesub: {
 		} else
 			goto badsub;
 
-		if (c != '}' && subtype == VSLENGTH) {
-			/* ${#VAR didn't end with } */
-			goto badsub;
-		}
-
 		if (subtype == 0) {
 			static const char types[] ALIGN1 = "}-+?=";
 			/* ${VAR...} but not $VAR or ${#VAR} */
@@ -12842,6 +12837,8 @@ parsesub: {
 #endif
 			}
 		} else {
+			if (subtype == VSLENGTH && c != '}')
+				subtype = 0;
  badsub:
 			pungetc();
 		}