From f36caa4071bbb5bb6d098ced8116accc65370dd8 Mon Sep 17 00:00:00 2001
From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Fri, 20 Jul 2018 19:29:41 +0200
Subject: [PATCH] hush: never glob result of dquoted "${v:+/bin/c*}"

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
 shell/ash_test/ash-glob/glob_altvalue1.right   |  7 +++++++
 shell/ash_test/ash-glob/glob_altvalue1.tests   | 13 +++++++++++++
 shell/hush.c                                   | 14 +++++++++++++-
 shell/hush_test/hush-glob/glob_altvalue1.right |  7 +++++++
 shell/hush_test/hush-glob/glob_altvalue1.tests | 13 +++++++++++++
 5 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 shell/ash_test/ash-glob/glob_altvalue1.right
 create mode 100755 shell/ash_test/ash-glob/glob_altvalue1.tests
 create mode 100644 shell/hush_test/hush-glob/glob_altvalue1.right
 create mode 100755 shell/hush_test/hush-glob/glob_altvalue1.tests

diff --git a/shell/ash_test/ash-glob/glob_altvalue1.right b/shell/ash_test/ash-glob/glob_altvalue1.right
new file mode 100644
index 000000000..bd3592229
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_altvalue1.right
@@ -0,0 +1,7 @@
+1u: glob_altvalue1.tests
+2u: glob_altvalue1.t*
+3u: glob_altvalue1.t*
+4u: glob_altvalue1.t*
+1q: glob_altvalue1.t*
+2q: 'glob_altvalue1.t*'
+3q: glob_altvalue1.t*
diff --git a/shell/ash_test/ash-glob/glob_altvalue1.tests b/shell/ash_test/ash-glob/glob_altvalue1.tests
new file mode 100755
index 000000000..5483d63e6
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_altvalue1.tests
@@ -0,0 +1,13 @@
+x=x
+
+echo 1u: ${x:+glob_altvalue1.t*}
+echo 2u: ${x:+'glob_altvalue1.t*'}
+echo 3u: ${x:+"glob_altvalue1.t*"}
+echo 4u: ${x:+glob_altvalue1.t\*}
+##echo 5u: ${x:+"glob_altvalue1.t\*"}
+
+echo 1q: "${x:+glob_altvalue1.t*}"
+echo 2q: "${x:+'glob_altvalue1.t*'}"
+echo 3q: "${x:+"glob_altvalue1.t*"}"
+##echo 4q: "${x:+glob_altvalue1.t\*}"
+##echo 5q: "${x:+"glob_altvalue1.t\*"}"
diff --git a/shell/hush.c b/shell/hush.c
index dddba5e30..4fdd15900 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -5994,7 +5994,19 @@ static int encode_then_append_var_plusminus(o_string *output, int n,
 			continue;
 		}
 #endif
-		o_addQchr(&dest, ch);
+		if (dquoted) {
+			/* Always glob-protect if in dquotes:
+			 * x=x; echo "${x:+/bin/c*}" - prints: /bin/c*
+			 * x=x; echo "${x:+"/bin/c*"}" - prints: /bin/c*
+			 */
+			o_addqchr(&dest, ch);
+		} else {
+			/* Glob-protect only if char is quoted:
+			 * x=x; echo ${x:+/bin/c*} - prints many filenames
+			 * x=x; echo ${x:+"/bin/c*"} - prints: /bin/c*
+			 */
+			o_addQchr(&dest, ch);
+		}
 	} /* for (;;) */
 
 	if (dest.data) {
diff --git a/shell/hush_test/hush-glob/glob_altvalue1.right b/shell/hush_test/hush-glob/glob_altvalue1.right
new file mode 100644
index 000000000..bd3592229
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_altvalue1.right
@@ -0,0 +1,7 @@
+1u: glob_altvalue1.tests
+2u: glob_altvalue1.t*
+3u: glob_altvalue1.t*
+4u: glob_altvalue1.t*
+1q: glob_altvalue1.t*
+2q: 'glob_altvalue1.t*'
+3q: glob_altvalue1.t*
diff --git a/shell/hush_test/hush-glob/glob_altvalue1.tests b/shell/hush_test/hush-glob/glob_altvalue1.tests
new file mode 100755
index 000000000..5483d63e6
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_altvalue1.tests
@@ -0,0 +1,13 @@
+x=x
+
+echo 1u: ${x:+glob_altvalue1.t*}
+echo 2u: ${x:+'glob_altvalue1.t*'}
+echo 3u: ${x:+"glob_altvalue1.t*"}
+echo 4u: ${x:+glob_altvalue1.t\*}
+##echo 5u: ${x:+"glob_altvalue1.t\*"}
+
+echo 1q: "${x:+glob_altvalue1.t*}"
+echo 2q: "${x:+'glob_altvalue1.t*'}"
+echo 3q: "${x:+"glob_altvalue1.t*"}"
+##echo 4q: "${x:+glob_altvalue1.t\*}"
+##echo 5q: "${x:+"glob_altvalue1.t\*"}"