From f50e14632f7be56da7a38937c887f77812803f70 Mon Sep 17 00:00:00 2001
From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Mon, 2 Apr 2018 21:00:59 +0200
Subject: [PATCH] ash: parser: Fix parameter expansion inside inner double
 quotes

Upstream email:

    parser: Fix parameter expansion inside inner double quotes

    The parsing of parameter expansion inside inner double quotes
    breaks because we never look for ENDVAR while innerdq is true.

            echo "${x#"${x+''}"''}

    This patch fixes it by pushing the syntax stack if innerdq is
    true and we enter a new parameter expansion.

    This patch also fixes a corner case where a bad substitution error
    occurs within arithmetic expansion.

    Reported-by: Denys Vlasenko <vda.linux@googlemail.com>
    Fixes: ab1cecb40478 (" parser: Add syntax stack for recursive...")
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

function                                             old     new   delta
readtoken1                                          2880    2898     +18

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
 shell/ash.c                                       | 6 ++++--
 shell/ash_test/ash-quoting/quote_in_varexp1.right | 2 ++
 shell/ash_test/ash-quoting/quote_in_varexp1.tests | 2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 shell/ash_test/ash-quoting/quote_in_varexp1.right
 create mode 100755 shell/ash_test/ash-quoting/quote_in_varexp1.tests

diff --git a/shell/ash.c b/shell/ash.c
index d82eba15f..ed1a4416c 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -12467,10 +12467,12 @@ parsesub: {
 			pungetc();
 		}
 
-		if (newsyn == ARISYNTAX && subtype > VSNORMAL)
+		if (newsyn == ARISYNTAX)
 			newsyn = DQSYNTAX;
 
-		if (newsyn != synstack->syntax) {
+		if ((newsyn != synstack->syntax || synstack->innerdq)
+		 && subtype != VSNORMAL
+		) {
 			synstack_push(&synstack,
 				synstack->prev ?: alloca(sizeof(*synstack)),
 				newsyn);
diff --git a/shell/ash_test/ash-quoting/quote_in_varexp1.right b/shell/ash_test/ash-quoting/quote_in_varexp1.right
new file mode 100644
index 000000000..99a0aea7c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quote_in_varexp1.right
@@ -0,0 +1,2 @@
+''
+Ok:0
diff --git a/shell/ash_test/ash-quoting/quote_in_varexp1.tests b/shell/ash_test/ash-quoting/quote_in_varexp1.tests
new file mode 100755
index 000000000..1b97b0556
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quote_in_varexp1.tests
@@ -0,0 +1,2 @@
+x="''''"; echo "${x#"${x+''}"''}"
+echo Ok:$?