glibc/posix/wordexp.c

/* POSIX.2 wordexp implementation.
   Copyright (C) 1997, 1998 Free Software Foundation, Inc.
   This file is part of the GNU C Library.
   Contributed by Tim Waugh <tim@cyberelk.demon.co.uk>.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Library General Public License as
   published by the Free Software Foundation; either version 2 of the
   License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Library General Public License for more details.

   You should have received a copy of the GNU Library General Public
   License along with the GNU C Library; see the file COPYING.LIB.  If not,
   write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
   Boston, MA 02111-1307, USA.  */

#include <wordexp.h>
#include <signal.h>
#include <stdlib.h>
#include <pwd.h>
#include <sys/types.h>
#include <string.h>
#include <glob.h>
#include <ctype.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <paths.h>
#include <errno.h>
#include <sys/param.h>
#include <stdio.h>
#include <fnmatch.h>

#include <stdio-common/_itoa.h>

/* Undefine the following line for the production version.  */
/* #define NDEBUG 1 */
#include <assert.h>

/*
 * This is a recursive-descent-style word expansion routine.
 */

/* These variables are defined and initialized in the startup code.  */
extern int __libc_argc;
extern char **__libc_argv;

/* Some forward declarations */
static int parse_dollars (char **word, size_t *word_length, size_t *max_length,
			  const char *words, size_t *offset, int flags,
			  wordexp_t *pwordexp, const char *ifs,
			  const char *ifs_white, int quoted)
     internal_function;
static int parse_backtick (char **word, size_t *word_length,
			   size_t *max_length, const char *words,
			   size_t *offset, int flags, wordexp_t *pwordexp,
			   const char *ifs, const char *ifs_white)
     internal_function;
static int eval_expr (char *expr, long int *result) internal_function;

/* The w_*() functions manipulate word lists. */

#define W_CHUNK	(100)

static inline char *
w_addchar (char *buffer, size_t *actlen, size_t *maxlen, char ch)
     /* (lengths exclude trailing zero) */
{
  /* Add a character to the buffer, allocating room for it if needed.
   */

  if (*actlen == *maxlen)
    {
      char *old_buffer = buffer;
      assert (buffer == NULL || *maxlen != 0);
      *maxlen += W_CHUNK;
      buffer = realloc (buffer, 1 + *maxlen);

      if (buffer == NULL)
	free (old_buffer);
    }

  if (buffer != NULL)
    {
      buffer[*actlen] = ch;
      buffer[++(*actlen)] = '\0';
    }

  return buffer;
}

static char *
internal_function
w_addmem (char *buffer, size_t *actlen, size_t *maxlen, const char *str,
	  size_t len)
{
  /* Add a string to the buffer, allocating room for it if needed.
   */
  if (*actlen + len > *maxlen)
    {
      char *old_buffer = buffer;
      assert (buffer == NULL || *maxlen != 0);
      *maxlen += MAX (2 * len, W_CHUNK);
      buffer = realloc (old_buffer, 1 + *maxlen);

      if (buffer == NULL)
	free (old_buffer);
    }

  if (buffer != NULL)
    {
      *((char *) __mempcpy (&buffer[*actlen], str, len)) = '\0';
      *actlen += len;
    }

  return buffer;
}


static char *
internal_function
w_addstr (char *buffer, size_t *actlen, size_t *maxlen, const char *str)
     /* (lengths exclude trailing zero) */
{
  /* Add a string to the buffer, allocating room for it if needed.
   */
  size_t len;

  assert (str != NULL); /* w_addstr only called from this file */
  len = strlen (str);

  return w_addmem (buffer, actlen, maxlen, str, len);
}

static int
internal_function
w_addword (wordexp_t *pwordexp, char *word)
{
  /* Add a word to the wordlist */
  size_t num_p;

  num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs;
  pwordexp->we_wordv = realloc (pwordexp->we_wordv, sizeof (char *) * num_p);
  if (pwordexp->we_wordv != NULL)
    {
      pwordexp->we_wordv[pwordexp->we_wordc++] = word;
      pwordexp->we_wordv[pwordexp->we_wordc] = NULL;
      return 0;
    }

  return WRDE_NOSPACE;
}

/* The parse_*() functions should leave *offset being the offset in 'words'
 * to the last character processed.
 */

static int
internal_function
parse_backslash (char **word, size_t *word_length, size_t *max_length,
		 const char *words, size_t *offset)
{
  /* We are poised _at_ a backslash, not in quotes */

  switch (words[1 + *offset])
    {
    case 0:
      /* Backslash is last character of input words */
      return WRDE_SYNTAX;

    case '\n':
      ++(*offset);
      break;

    default:
      *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
      if (*word == NULL)
	return WRDE_NOSPACE;

      ++(*offset);
      break;
    }

  return 0;
}

static int
internal_function
parse_qtd_backslash (char **word, size_t *word_length, size_t *max_length,
		     const char *words, size_t *offset)
{
  /* We are poised _at_ a backslash, inside quotes */

  switch (words[1 + *offset])
    {
    case 0:
      /* Backslash is last character of input words */
      return WRDE_SYNTAX;

    case '\n':
      ++(*offset);
      break;

    case '$':
    case '`':
    case '"':
    case '\\':
      *word = w_addchar (*word, word_length, max_length, words[1 + *offset]);
      if (*word == NULL)
	return WRDE_NOSPACE;

      ++(*offset);
      break;

    default:
      *word = w_addchar (*word, word_length, max_length, words[*offset]);
      if (*word != NULL)
	*word = w_addchar (*word, word_length, max_length, words[1 + *offset]);

      if (*word == NULL)
	return WRDE_NOSPACE;

      ++(*offset);
      break;
    }

  return 0;
}

static int
internal_function
parse_tilde (char **word, size_t *word_length, size_t *max_length,
	     const char *words, size_t *offset, size_t wordc)
{
  /* We are poised _at_ a tilde */
  size_t i;

  if (*word_length != 0)
    {
      if (!((*word)[*word_length - 1] == '=' && wordc == 0))
	{
	  if (!((*word)[*word_length - 1] == ':'
		&& strchr (*word, '=') && wordc == 0))
	    {
	      *word = w_addchar (*word, word_length, max_length, '~');
	      return *word ? 0 : WRDE_NOSPACE;
	    }
	}
    }

  for (i = 1 + *offset; words[i]; i++)
    {
      if (words[i] == ':' || words[i] == '/' || words[i] == ' ' ||
	  words[i] == '\t' || words[i] == 0 )
	break;

      if (words[i] == '\\')
	{
	  *word = w_addchar (*word, word_length, max_length, '~');
	  return *word ? 0 : WRDE_NOSPACE;
	}
    }

  if (i == 1 + *offset)
    {
      /* Tilde appears on its own */
      uid_t uid;
      struct passwd pwd, *tpwd;
      int buflen = 1000;
      char* buffer = __alloca (buflen);
      int result;

      uid = getuid ();

      while ((result = __getpwuid_r (uid, &pwd, buffer, buflen, &tpwd)) != 0
	     && errno == ERANGE)
	{
	  buflen += 1000;
	  buffer = __alloca (buflen);
	}

      if (result == 0 && pwd.pw_dir != NULL)
	{
	  *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
	  if (*word == NULL)
	    return WRDE_NOSPACE;
	}
      else
	{
	  *word = w_addchar (*word, word_length, max_length, '~');
	  if (*word == NULL)
	    return WRDE_NOSPACE;
	}
    }
  else
    {
      /* Look up user name in database to get home directory */
      char *user = __strndup (&words[1 + *offset], i - *offset);
      struct passwd pwd, *tpwd;
      int buflen = 1000;
      char* buffer = __alloca (buflen);
      int result;

      while ((result = __getpwnam_r (user, &pwd, buffer, buflen, &tpwd)) != 0
	     && errno == ERANGE)
	{
	  buflen += 1000;
	  buffer = __alloca (buflen);
	}

      if (result == 0 && pwd.pw_dir)
	*word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
      else
	{
	  /* (invalid login name) */
	  *word = w_addchar (*word, word_length, max_length, '~');
	  if (*word != NULL)
	    *word = w_addstr (*word, word_length, max_length, user);
	}

      *offset = i - 1;
    }
  return *word ? 0 : WRDE_NOSPACE;
}

static int
internal_function
parse_glob (char **word, size_t *word_length, size_t *max_length,
	    const char *words, size_t *offset, int flags,
	    wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
{
  /* We are poised just after a '*', a '[' or a '?'. */
  int error;
  glob_t globbuf;
  int match;
  char *matching_word;
  int quoted = 0; /* 1 if singly-quoted, 2 if doubly */

  for (; words[*offset]; (*offset)++)
    {
      if ((ifs && strchr (ifs, words[*offset])) ||
	  (!ifs && strchr (" \t\n", words[*offset])))
	/* Reached IFS */
	break;

      /* Sort out quoting */
      if (words[*offset] == '\'')
	  if (quoted == 0)
	    {
	      quoted = 1;
	      continue;
	    }
	  else if (quoted == 1)
	    {
	      quoted = 0;
	      continue;
	    }
      else if (words[*offset] == '"')
	if (quoted == 0)
	  {
	    quoted = 2;
	    continue;
	  }
	else if (quoted == 2)
	  {
	    quoted = 0;
	    continue;
	  }

      /* Sort out other special characters */
      if (quoted != 1 && words[*offset] == '$')
	{
	  error = parse_dollars (word, word_length, max_length, words, offset,
				 flags, pwordexp, ifs, ifs_white, quoted == 2);
	  if (error)
	    return error;

	  continue;
	}
      else if (words[*offset] == '\\')
	{
	  if (quoted)
	    error = parse_qtd_backslash (word, word_length, max_length, words,
					 offset);
	  else
	    error = parse_backslash (word, word_length, max_length, words,
				     offset);

	  if (error)
	    return error;

	  continue;
	}

      *word = w_addchar (*word, word_length, max_length, words[*offset]);
      if (*word == NULL)
	return WRDE_NOSPACE;
    }

  error = glob (*word, GLOB_NOCHECK, NULL, &globbuf);

  if (error != 0)
    {
      /* We can only run into memory problems.  */
      assert (error == GLOB_NOSPACE);

      return WRDE_NOSPACE;
    }

  if (ifs && !*ifs)
    {
      /* No field splitting allowed */
      size_t length = strlen (globbuf.gl_pathv[0]);
      *word = realloc (*word, length + 1);
      if (*word == NULL)
	goto no_space;

      memcpy (*word, globbuf.gl_pathv[0], length + 1);
      *word_length = length;

      for (match = 1; match < globbuf.gl_pathc && *word != NULL; ++match)
	{
	  *word = w_addchar (*word, word_length, max_length, ' ');
	  if (*word != NULL)
	    *word = w_addstr (*word, word_length, max_length,
			      globbuf.gl_pathv[match]);
	}

      /* Re-parse white space on return */
      globfree (&globbuf);
      --(*offset);
      return *word ? 0 : WRDE_NOSPACE;
    }

  /* here ifs != "" */
  free (*word);
  *word = NULL;
  *word_length = 0;

  matching_word = __strdup (globbuf.gl_pathv[0]);
  if (matching_word == NULL)
    goto no_space;

  if (w_addword (pwordexp, matching_word) == WRDE_NOSPACE)
    goto no_space;

  for (match = 1; match < globbuf.gl_pathc; ++match)
    {
      matching_word = __strdup (globbuf.gl_pathv[match]);
      if (matching_word == NULL)
	goto no_space;

      if (w_addword (pwordexp, matching_word) == WRDE_NOSPACE)
	goto no_space;
    }

  globfree (&globbuf);

  /* Re-parse white space on return */
  --(*offset);
  return 0;

no_space:
  globfree (&globbuf);
  return WRDE_NOSPACE;
}

static int
internal_function
parse_squote (char **word, size_t *word_length, size_t *max_length,
	      const char *words, size_t *offset)
{
  /* We are poised just after a single quote */
  for (; words[*offset]; ++(*offset))
    {
      if (words[*offset] != '\'')
	{
	  *word = w_addchar (*word, word_length, max_length, words[*offset]);
	  if (*word == NULL)
	    return WRDE_NOSPACE;
	}
      else return 0;
    }

  /* Unterminated string */
  return WRDE_SYNTAX;
}

/* Functions to evaluate an arithmetic expression */
static int
internal_function
eval_expr_val (char **expr, long int *result)
{
  int sgn = +1;
  char *digit;

  /* Skip white space */
  for (digit = *expr; digit && *digit && isspace (*digit); ++digit);

  switch (*digit)
    {
    case '(':

      /* Scan for closing paren */
      for (++digit; **expr && **expr != ')'; ++(*expr));

      /* Is there one? */
      if (!**expr)
	return WRDE_SYNTAX;

      *(*expr)++ = 0;

      if (eval_expr (digit, result))
	return WRDE_SYNTAX;

      return 0;

    case '+':	/* Positive value */
      ++digit;
      break;

    case '-':	/* Negative value */
      ++digit;
      sgn = -1;
      break;

    default:
      if (!isdigit (*digit))
	return WRDE_SYNTAX;
    }

  *result = 0;
  for (; *digit && isdigit (*digit); ++digit)
    *result = (*result * 10) + (*digit - '0');

  *expr = digit;
  *result *= sgn;
  return 0;
}

static int
internal_function
eval_expr_multdiv (char **expr, long int *result)
{
  long int arg;

  /* Read a Value */
  if (eval_expr_val (expr, result) != 0)
    return WRDE_SYNTAX;

  while (**expr)
    {
      /* Skip white space */
      for (; *expr && **expr && isspace (**expr); ++(*expr));

      if (**expr == '*')
	{
	  ++(*expr);
	  if (eval_expr_val (expr, &arg) != 0)
	    return WRDE_SYNTAX;

	  *result *= arg;
	}
      else if (**expr == '/')
	{
	  ++(*expr);
	  if (eval_expr_val (expr, &arg) != 0)
	    return WRDE_SYNTAX;

	  *result /= arg;
	}
      else break;
    }

  return 0;
}

static int
internal_function
eval_expr (char *expr, long int *result)
{
  long int arg;

  /* Read a Multdiv */
  if (eval_expr_multdiv (&expr, result) != 0)
    return WRDE_SYNTAX;

  while (*expr)
    {
      /* Skip white space */
      for (; expr && *expr && isspace (*expr); ++expr);

      if (*expr == '+')
	{
	  ++expr;
	  if (eval_expr_multdiv (&expr, &arg) != 0)
	    return WRDE_SYNTAX;

	  *result += arg;
	}
      else if (*expr == '-')
	{
	  ++expr;
	  if (eval_expr_multdiv (&expr, &arg) != 0)
	    return WRDE_SYNTAX;

	  *result -= arg;
	}
      else break;
    }

  return 0;
}

static int
internal_function
parse_arith (char **word, size_t *word_length, size_t *max_length,
	     const char *words, size_t *offset, int flags, int bracket)
{
  /* We are poised just after "$((" or "$[" */
  int error;
  int paren_depth = 1;
  size_t expr_length = 0;
  size_t expr_maxlen = 0;
  char *expr = NULL;

  for (; words[*offset]; ++(*offset))
    {
      switch (words[*offset])
	{
	case '$':
	  error = parse_dollars (&expr, &expr_length, &expr_maxlen,
				 words, offset, flags, NULL, NULL, NULL, 1);
	  /* The ``1'' here is to tell parse_dollars not to
	   * split the fields.
	   */
	  if (error)
	    {
	      free (expr);
	      return error;
	    }
	  break;

	case '`':
	  (*offset)++;
	  error = parse_backtick (&expr, &expr_length, &expr_maxlen,
				  words, offset, flags, NULL, NULL, NULL);
	  /* The first NULL here is to tell parse_backtick not to
	   * split the fields.
	   */
	  if (error)
	    {
	      free (expr);
	      return error;
	    }
	  break;

	case '\\':
	  error = parse_qtd_backslash (&expr, &expr_length, &expr_maxlen,
				       words, offset);
	  if (error)
	    {
	      free (expr);
	      return error;
	    }
	  /* I think that a backslash within an
	   * arithmetic expansion is bound to
	   * cause an error sooner or later anyway though.
	   */
	  break;

	case ')':
	  if (--paren_depth == 0)
	    {
	      char result[21];	/* 21 = ceil(log10(2^64)) + 1 */
	      long int numresult = 0;
	      long long int convertme;

	      if (bracket || words[1 + *offset] != ')')
		return WRDE_SYNTAX;

	      ++(*offset);

	      /* Go - evaluate. */
	      if (*expr && eval_expr (expr, &numresult) != 0)
		return WRDE_SYNTAX;

	      if (numresult < 0)
		{
		  convertme = -numresult;
		  *word = w_addchar (*word, word_length, max_length, '-');
		  if (!*word)
		    {
		      free (expr);
		      return WRDE_NOSPACE;
		    }
		}
	      else
		convertme = numresult;

	      result[20] = '\0';
	      *word = w_addstr (*word, word_length, max_length,
				_itoa (convertme, &result[20], 10, 0));
	      free (expr);
	      return *word ? 0 : WRDE_NOSPACE;
	    }
	  expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
	  if (expr == NULL)
	    return WRDE_NOSPACE;

	  break;

	case ']':
	  if (bracket && paren_depth == 1)
	    {
	      char result[21];	/* 21 = ceil(log10(2^64)) + 1 */
	      long int numresult = 0;

	      /* Go - evaluate. */
	      if (*expr && eval_expr (expr, &numresult) != 0)
		return WRDE_SYNTAX;

	      result[20] = '\0';
	      *word = w_addstr (*word, word_length, max_length,
				_itoa_word (numresult, &result[20], 10, 0));
	      free (expr);
	      return *word ? 0 : WRDE_NOSPACE;
	    }

	  free (expr);
	  return WRDE_SYNTAX;

	case '\n':
	case ';':
	case '{':
	case '}':
	  free (expr);
	  return WRDE_BADCHAR;

	case '(':
	  ++paren_depth;
	default:
	  expr = w_addchar (expr, &expr_length, &expr_maxlen, words[*offset]);
	  if (expr == NULL)
	    return WRDE_NOSPACE;
	}
    }

  /* Premature end */
  free (expr);
  return WRDE_SYNTAX;
}

/* Function to execute a command and retrieve the results */
/* pwordexp contains NULL if field-splitting is forbidden */
static int
internal_function
exec_comm (char *comm, char **word, size_t *word_length, size_t *max_length,
	   int flags, wordexp_t *pwordexp, const char *ifs,
	   const char *ifs_white)
{
  int fildes[2];
  int bufsize = 128;
  int buflen;
  int i;
  char *buffer;
  pid_t pid;

  /* Don't fork() unless necessary */
  if (!comm || !*comm)
    return 0;

  if (pipe (fildes))
    /* Bad */
    return WRDE_NOSPACE;

  if ((pid = fork ()) < 0)
    {
      /* Bad */
      return WRDE_NOSPACE;
    }

  if (pid == 0)
    {
      /* Child */
      const char *args[4] = { _PATH_BSHELL, "-c", comm, NULL };

      /* Redirect input and output */
      dup2 (fildes[1], 1);

      /* Close stderr if we have to */
      if ((flags & WRDE_SHOWERR) == 0)
	close (2);

      __execve (_PATH_BSHELL, (char *const *) args, __environ);

      /* Bad.  What now?  */
      abort ();
    }

  /* Parent */

  close (fildes[1]);
  buffer = __alloca (bufsize);

  if (!pwordexp)
    { /* Quoted - no field splitting */

      while (1)
	{
	  if ((buflen = read (fildes[0], buffer, bufsize)) < 1)
	    {
	      if (__waitpid (pid, NULL, WNOHANG) == 0)
		continue;
	      if ((buflen = read (fildes[0], buffer, bufsize)) < 1)
		break;
	    }

	  *word = w_addmem (*word, word_length, max_length, buffer, buflen);
	  if (*word == NULL)
	    {
	      close (fildes[0]);
	      return WRDE_NOSPACE;
	    }
	}

      close (fildes[0]);

      /* bash chops off a terminating linefeed, which seems sensible */
      if ((*word)[*word_length - 1] == '\n')
	(*word)[--*word_length] = '\0';

      return 0;
    }
  else
    /* Not quoted - split fields */
    {
      int copying = 0;
      /* 'copying' is:
       *  0 when searching for first character in a field not IFS white space
       *  1 when copying the text of a field
       *  2 when searching for possible non-whitespace IFS
       */

      while (1)
	{
	  if ((buflen = read (fildes[0], buffer, bufsize)) < 1)
	    {
	      if (__waitpid (pid, NULL, WNOHANG) == 0)
		continue;
	      if ((read (fildes[0], buffer, bufsize)) < 1)
		break;
	    }

	  for (i = 0; i < buflen; ++i)
	    {
	      if (strchr (ifs, buffer[i]) != NULL)
		{
		  /* Current character is IFS */
		  if (strchr (ifs_white, buffer[i]) == NULL)
		    {
		      /* Current character is IFS but not whitespace */
		      if (copying == 2)
			{
			  /*            current character
			   *                   |
			   *                   V
			   * eg: text<space><comma><space>moretext
			   *
			   * So, strip whitespace IFS (like at the start)
			   */
			  copying = 0;
			  continue;
			}

		      copying = 0;
		      /* fall through and delimit field.. */
		    }
		  else
		    {
		      /* Current character is IFS white space */

		      /* If not copying a field, ignore it */
		      if (copying != 1)
			continue;

		      /* End of field (search for non-IFS afterwards) */
		      copying = 2;
		    }

		  /* First IFS white space, or IFS non-whitespace.
		   * Delimit the field. */
		  if (!*word)
		    {
		      /* This field is null, so make it an empty string */
		      *word = w_addchar (*word, word_length, max_length, 0);
		      if (*word == NULL)
			{
			  close (fildes[0]);
			  return WRDE_NOSPACE;
			}
		    }

		  if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
		    {
		      /* Should do __waitpid? */
		      close (fildes[0]);
		      return WRDE_NOSPACE;
		    }

		  *word = NULL;
		  *word_length = 0;
		  *max_length = 0;
		  /* fall back round the loop.. */
		}
	      else
		{
		  /* Not IFS character */
		  copying = 1;
		  *word = w_addchar (*word, word_length, max_length,
				     buffer[i]);
		  if (*word == NULL)
		    {
		      close (fildes[0]);
		      return WRDE_NOSPACE;
		    }
		}
	    }
	}
    }

  close (fildes[0]);
  return 0;
}

static int
internal_function
parse_comm (char **word, size_t *word_length, size_t *max_length,
	    const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
	    const char *ifs, const char *ifs_white)
{
  /* We are poised just after "$(" */
  int paren_depth = 1;
  int error;
  size_t comm_length = 0;
  size_t comm_maxlen = 0;
  char *comm = NULL;

  for (; words[*offset]; ++(*offset))
    {
      switch (words[*offset])
	{
	case ')':
	  if (--paren_depth == 0)
	    {
	      /* Go -- give script to the shell */
	      error = exec_comm (comm, word, word_length, max_length, flags,
				 pwordexp, ifs, ifs_white);
	      free (comm);
	      return error;
	    }

	  /* This is just part of the script */
	  comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
	  if (comm == NULL)
	    return WRDE_NOSPACE;

	  break;

	case '(':
	  ++paren_depth;
	default:
	  comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
	  if (comm == NULL)
	    return WRDE_NOSPACE;

	  break;
	}
    }

  /* Premature end */
  free (comm);
  return WRDE_SYNTAX;
}

static int
internal_function
parse_param (char **word, size_t *word_length, size_t *max_length,
	     const char *words, size_t *offset, int flags, wordexp_t *pwordexp,
	     const char *ifs, const char *ifs_white, int quoted)
{
  /* We are poised just after "$" */
  enum remove_pattern_enum
  {
    RP_NONE = 0,
    RP_SHORT_LEFT,
    RP_LONG_LEFT,
    RP_SHORT_RIGHT,
    RP_LONG_RIGHT
  };
  size_t start = *offset;
  size_t env_length = 0;
  size_t env_maxlen = 0;
  size_t pat_length = 0;
  size_t pat_maxlen = 0;
  char *env = NULL;
  char *pattern = NULL;
  char *value = NULL;
  char action = '\0';
  enum remove_pattern_enum remove = RP_NONE;
  int colon_seen = 0;
  int depth = 0;
  int seen_hash = 0;
  int free_value = 0;
  int error;

  for (; words[*offset]; ++(*offset))
    {
      switch (words[*offset])
	{
	case '{':
	  ++depth;

	  if (action != '\0' || remove != RP_NONE)
	    {
	      pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
				   words[*offset]);
	      if (pattern == NULL)
		goto no_space;

	      break;
	    }

	  if (*offset == start)
	    break;

	  /* Otherwise evaluate */
	  /* (and re-parse this character) */
	  --(*offset);
	  goto envsubst;

	case '}':
	  if (words[start] != '{')
	      --(*offset);

	  if (action != '\0' || remove != RP_NONE)
	    {
	      if (--depth)
		{
		  pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
				       words[*offset]);
		  if (pattern == NULL)
		    goto no_space;

		  break;
		}
	    }

	  /* Evaluate */
	  goto envsubst;

	case '#':
	  /* '#' only has special meaning inside braces or as the very
	   * first character after $ */
	  if (*offset == start)
	    {
	      seen_hash = 1;
	      goto envsubst;
	    }

	  if (words[start] != '{')
	    {
	      /* Evaluate */
	      /* (and re-parse this character) */
	      --(*offset);
	      goto envsubst;
	    }

	  /* At the start? (i.e. 'string length') */
	  if (*offset == start + 1)
	    {
	      seen_hash = 1;
	      break;
	    }
	  else if (seen_hash)
	    goto syntax;

	  /* Separating variable name from prefix pattern? */
	  if (remove == RP_NONE)
	    {
	      remove = RP_SHORT_LEFT;
	      break;
	    }
	  else if (remove == RP_SHORT_LEFT)
	    {
	      remove = RP_LONG_LEFT;
	      break;
	    }

	  /* Must be part of prefix/suffix pattern. */
	  pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
			       words[*offset]);
	  if (pattern == NULL)
	    goto no_space;

	  break;

	case '%':
	  if (!env || !*env)
	    goto syntax;

	  /* Separating variable name from suffix pattern? */
	  if (remove == RP_NONE)
	    {
	      remove = RP_SHORT_RIGHT;
	      break;
	    }
	  else if (remove == RP_SHORT_RIGHT)
	    {
	      remove = RP_LONG_RIGHT;
	      break;
	    }

	  /* Must be part of prefix/suffix pattern. */
	  pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
			       words[*offset]);
	  if (pattern == NULL)
	    goto no_space;

	  break;

	case ':':
	  if (!env || !*env)
	    goto syntax;

	  if (action != '\0' || remove != RP_NONE)
	    {
	      pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
				   words[*offset]);
	      if (pattern == NULL)
		goto no_space;

	      break;
	    }

	  if ((words[1 + *offset] == '-') || (words[1 + *offset] == '=')
	      || (words[1 + *offset] == '?') || (words[1 + *offset] == '+'))
	    {
	      colon_seen = 1;
	      break;
	    }

	  goto syntax;

	case '-':
	case '=':
	case '?':
	case '+':
	  if (!env || !*env)
	    goto syntax;

	  if (seen_hash)
	    goto syntax;

	  if (action != '\0' || remove != RP_NONE)
	    {
	      pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
				   words[*offset]);
	      if (pattern == NULL)
		goto no_space;

	      break;
	    }

	  action = words[*offset];
	  break;

	case '\\':
	  if (action != '\0' || remove != RP_NONE)
	    {
	      /* Um. Is this right? */
	      error = parse_qtd_backslash (word, word_length, max_length,
					   words, offset);
	      if (error == 0)
		break;
	    }
	  else
	    {
	      error = WRDE_SYNTAX;
	    }

	  if (env)
	    free (env);

	  if (pattern != NULL)
	    free (pattern);

	  return error;

	default:
	  if (action != '\0' || remove != RP_NONE)
	    {
	      pattern = w_addchar (pattern, &pat_length, &pat_maxlen,
				   words[*offset]);
	      if (pattern == NULL)
		goto no_space;

	      break;
	    }
	  else
	    {
	      int special = (strchr ("*@$", words[*offset]) != NULL
			     || isdigit (words[*offset]));

	      if (isalpha (words[*offset]) || special)
		{
		  env = w_addchar (env, &env_length, &env_maxlen,
				   words[*offset]);
		  if (env == NULL)
		    goto no_space;

		  if (special && words[start] != '{')
		    goto envsubst;

		  /* Keep going (get next char) */
		  break;
		}

	      /* Stop and evaluate, remembering char we stopped at */
	      --(*offset);
	      goto envsubst;
	    }
	}
    }

  /* End of input string -- remember to reparse the character that we stopped
   * at.  */
  --(*offset);

envsubst:
  if (words[start] == '{' && words[*offset] != '}')
    goto syntax;

  if (!env || !*env)
    {
      if (seen_hash)
	{
	  /* $# expands to the number of positional parameters */
	  char buffer[21];
	  buffer[20] = '\0';
	  *word = w_addstr (*word, word_length, max_length,
			    _itoa_word (__libc_argc - 1, &buffer[20], 10, 0));
	}
      else
	{
	  /* Just $ on its own */
	  *offset = start - 1;
	  *word = w_addchar (*word, word_length, max_length, '$');
	}

      if (env)
	free (env);

      return *word ? 0 : WRDE_NOSPACE;
    }

  /* Is it a special parameter? */
  if (strpbrk (env, "0123456789*@$"))
    {
      if (env[1])
	{
	  /* Bad substitution if there is more than one character */
	  free (env);
	  fprintf (stderr, "${%s}: bad substitution\n", env);
	  return WRDE_SYNTAX;
	}

      /* Is it a digit? */
      if (isdigit(*env))
	{
	  int n = *env - '0';

	  free (env);
	  if (n >= __libc_argc)
	    /* Substitute NULL */
	    return 0;

	  /* Replace with the appropriate positional parameter */
	  value = __libc_argv[n];
	  goto maybe_fieldsplit;
	}
      /* Is it `$$' ? */
      else if (*env == '$')
	{
	  char pidstr[21];

	  free (env);
	  pidstr[20] = '\0';
	  *word = w_addstr (*word, word_length, max_length,
			    _itoa_word (getpid(), &pidstr[20], 10, 0));
	  return *word ? 0 : WRDE_NOSPACE;
	}
      /* Is it `$*' or `$@' (unquoted) ? */
      else if (*env == '*' || (*env == '@' && !quoted))
	{
	  size_t plist_len = 1;
	  int p;

	  /* Build up value parameter by parameter (copy them) */
	  free (env);
	  for (p = 1; __libc_argv[p]; ++p)
	    {
	      char *old_pointer = value;
	      size_t argv_len = strlen (__libc_argv[p]);
	      size_t old_plist_len = plist_len;

	      if (value)
		value[plist_len - 1] = 0;

	      plist_len += 1 + argv_len;

	      /* First realloc will act as malloc because value is
	       * initialised to NULL. */
	      value = realloc (value, plist_len);
	      if (value == NULL)
		{
		  free (old_pointer);
		  return WRDE_NOSPACE;
		}

	      memcpy (&value[old_plist_len - 1], __libc_argv[p], argv_len + 1);
	      if (__libc_argv[p + 1])
		{
		  value[plist_len - 1] = '\0';
		  value[plist_len - 2] = ' ';
		}
	    }

	  free_value = 1;
	  if (value)
	    goto maybe_fieldsplit;

	  return 0;
	}

      /* Must be a quoted `$@' */
      assert (*env == '@');
      assert (quoted);
      free (env);

      /* Each parameter is a separate word ("$@") */
      if (__libc_argv[0] == NULL)
	{
	  /* This can happen if the application is started without any
	     parameter, not even a name.  This is legal according to
	     POSIX since the giving parameters is only a "should" rule.  */
	  *word = __strdup ("");
	  *max_length = *word_length = 0;
	}
      else
	{
	  int p;

	  for (p = 1; __libc_argv[p + 1]; p++)
	    {
	      char *copy = __strdup (__libc_argv[p]);
	      if (copy == NULL)
		return WRDE_NOSPACE;

	      error = w_addword (pwordexp, copy);
	      if (error)
		{
		  free (copy);
		  return error;
		}
	    }

	  /* Last parameter becomes current word */
	  if (__libc_argv[p])
	    {
	      *word = __strdup (__libc_argv[p]);
	      if (*word == NULL)
		return WRDE_NOSPACE;

	      *max_length = *word_length = strlen (*word);
	    }
	}

      return 0;
    }

  value = getenv (env);

  if (action != '\0' || remove != RP_NONE)
    {
      switch (action)
	{
	case 0:
	  {
	    char *p;
	    char c;
	    char *end;

	    if (!pattern || !*pattern)
	      break;

	    end = value + strlen (value);

	    if (value == NULL)
	      break;

	    switch (remove)
	      {
	      case RP_SHORT_LEFT:
		for (p = value; p <= end; ++p)
		  {
		    c = *p;
		    *p = '\0';
		    if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
		      {
			*p = c;
			value = p;
			break;
		      }
		    *p = c;
		  }

		break;

	      case RP_LONG_LEFT:
		for (p = end; p >= value; --p)
		  {
		    c = *p;
		    *p = '\0';
		    if (fnmatch (pattern, value, 0) != FNM_NOMATCH)
		      {
			*p = c;
			value = p;
			break;
		      }
		    *p = c;
		  }

		break;

	      case RP_SHORT_RIGHT:
		for (p = end; p >= value; --p)
		  {
		    if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
		      {
			*p = '\0';
			break;
		      }
		  }

		break;

	      case RP_LONG_RIGHT:
		for (p = value; p <= end; ++p)
		  {
		    if (fnmatch (pattern, p, 0) != FNM_NOMATCH)
		      {
			*p = '\0';
			break;
		      }
		  }

		break;

	      default:
		assert (! "Unexpected `remove' value\n");
	      }

	    break;
	  }

	case '?':
	  if (value && *value)
	    /* Substitute parameter */
	    break;

	  if (!colon_seen && value)
	    {
	      /* Substitute NULL */
	      free (env);
	      free (pattern);
	      return 0;
	    }

	  /* Error - exit */
	  fprintf (stderr, "%s: ", env);

	  if (*pattern)
	    {
	      /* Expand 'pattern' and write it to stderr */
	      wordexp_t	we;

	      error = wordexp (pattern, &we, flags);

	      if (error == 0)
		{
		  int i;

		  for (i = 0; i < we.we_wordc; ++i)
		    {
		      fprintf (stderr, "%s%s", i ? " " : "", we.we_wordv[i]);
		    }

		  fprintf (stderr, "\n");
		  error = WRDE_BADVAL;
		}

	      wordfree (&we);
	      free (env);
	      free (pattern);
	      return error;
	    }

	  fprintf (stderr, "parameter null or not set\n");
	  free (env);
	  free (pattern);
	  return WRDE_BADVAL;

	case '-':
	  if (value && *value)
	    /* Substitute parameter */
	    break;

	  if (!colon_seen && value)
	    {
	      /* Substitute NULL */
	      free (env);
	      free (pattern);
	      return 0;
	    }

	subst_word:
	  {
	    /* Substitute word */
	    wordexp_t we;
	    int i;

	    if (quoted)
	      {
		/* No field-splitting is allowed, so imagine
		   quotes around the word.  */
		char *qtd_pattern = malloc (3 + strlen (pattern));
		sprintf (qtd_pattern, "\"%s\"", pattern);
		free (pattern);
		pattern = qtd_pattern;
	      }

	    error = wordexp (pattern, &we, flags);
	    if (error)
	      {
		free (env);
		free (pattern);
		return error;
	      }

	    /* Fingers crossed that the quotes worked.. */
	    assert (!quoted || we.we_wordc == 1);

	    /* Substitute */
	    for (i = 0; i < we.we_wordc; i++)
	      if (w_addword (pwordexp, __strdup(we.we_wordv[i]))
		  == WRDE_NOSPACE)
		break;

	    if (i < we.we_wordc)
	      {
		/* Ran out of space */
		wordfree (&we);
		goto no_space;
	      }

	    if (action == '=')
	      {
		char *words;
		char *cp;
		size_t words_size = 0;

		for (i = 0; i < we.we_wordc; i++)
		  words_size += strlen (we.we_wordv[i]) + 1; /* for <space> */
		words_size++;

		cp = words = __alloca (words_size);
		*words = 0;
		for (i = 0; i < we.we_wordc - 1; i++)
		  {
		    cp = __stpcpy (cp, we.we_wordv[i]);
		    *cp++ = ' ';
		  }

		__stpcpy (cp, we.we_wordv[i]);

		/* Also assign */
		setenv (env, words, 1);
	      }

	    wordfree (&we);
	    return 0;
	  }

	case '+':
	  if (value && *value)
	    goto subst_word;

	  if (!colon_seen && value)
	    goto subst_word;

	  /* Substitute NULL */
	  free (env);
	  free (pattern);
	  return 0;

	case '=':
	  if (value && *value)
	    /* Substitute parameter */
	    break;

	  if (!colon_seen && value)
	    {
	      /* Substitute NULL */
	      free (env);
	      free (pattern);
	      return 0;
	    }

	  /* This checks for '=' so it knows to assign */
	  goto subst_word;

	default:
	  assert (! "Unrecognised action!");
	}
    }

  free (env);
  free (pattern);

  if (value == NULL)
    {
      /* Variable not defined */
      if (flags & WRDE_UNDEF)
	return WRDE_BADVAL;

      return 0;
    }

  if (seen_hash)
    {
      char param_length[21];
      param_length[20] = '\0';
      *word = w_addstr (*word, word_length, max_length,
			_itoa_word (strlen (value), &param_length[20], 10, 0));
      return *word ? 0 : WRDE_NOSPACE;
    }

 maybe_fieldsplit:
  if (quoted || !pwordexp)
    {
      /* Quoted - no field split */
      *word = w_addstr (*word, word_length, max_length, value);
      if (free_value)
	free (value);

      return *word ? 0 : WRDE_NOSPACE;
    }
  else
    {
      /* Need to field-split */
      char *value_copy = __strdup (value); /* Don't modify value */
      char *field_begin = value_copy;
      int seen_nonws_ifs = 0;

      if (free_value)
	free (value);

      if (value_copy == NULL)
	return WRDE_NOSPACE;

      do
	{
	  char *field_end = field_begin;
	  char *next_field;

	  /* If this isn't the first field, start a new word */
	  if (field_begin != value_copy)
	    {
	      if (w_addword (pwordexp, *word) == WRDE_NOSPACE)
		{
		  free (value_copy);
		  return WRDE_NOSPACE;
		}

	      *word = NULL;
	      *word_length = *max_length = 0;
	    }

	  /* Skip IFS whitespace before the field */
	  while (*field_begin && strchr (ifs_white, *field_begin) != NULL)
	    field_begin++;

	  if (!seen_nonws_ifs && *field_begin == 0)
	    /* Nothing but whitespace */
	    break;

	  /* Search for the end of the field */
	  field_end = field_begin;
	  while (*field_end && strchr (ifs, *field_end) == NULL)
	    field_end++;

	  /* Set up pointer to the character after end of field */
	  next_field = *field_end ? field_end : NULL;

	  /* Skip whitespace IFS after the field */
	  while (next_field && *next_field && strchr (ifs_white, *next_field))
	    next_field++;

	  /* Skip at most one non-whitespace IFS character after the field */
	  seen_nonws_ifs = 0;
	  if (next_field && *next_field && strchr (ifs, *next_field))
	    {
	      seen_nonws_ifs = 1;
	      next_field++;
	    }

	  /* Null-terminate it */
	  *field_end = 0;

	  /* Tag a copy onto the current word */
	  *word = w_addstr (*word, word_length, max_length, field_begin);

	  if (*word == NULL)
	    {
	      free (value_copy);
	      return WRDE_NOSPACE;
	    }

	  field_begin = next_field;
	}
      while (seen_nonws_ifs || (field_begin != NULL && *field_begin));

      free (value_copy);
    }

  return 0;

no_space:
  if (env)
    free (env);

  if (pattern)
    free (pattern);

  return WRDE_NOSPACE;

syntax:
  if (env)
    free (env);

  if (pattern)
    free (pattern);

  return WRDE_SYNTAX;
}

static int
internal_function
parse_dollars (char **word, size_t *word_length, size_t *max_length,
	       const char *words, size_t *offset, int flags,
	       wordexp_t *pwordexp, const char *ifs, const char *ifs_white,
	       int quoted)
{
  /* We are poised _at_ "$" */
  switch (words[1 + *offset])
    {
    case '"':
    case '\'':
    case 0:
      *word = w_addchar (*word, word_length, max_length, '$');
      return *word ? 0 : WRDE_NOSPACE;

    case '(':
      if (words[2 + *offset] == '(')
	{
	  /* Differentiate between $((1+3)) and $((echo);(ls)) */
	  int i = 3 + *offset;
	  while (words[i] && words[i] != ')')
	    ++i;
	  if (words[i] == ')' && words[i + 1] == ')')
	    {
	      (*offset) += 3;
	      /* Call parse_arith -- 0 is for "no brackets" */
	      return parse_arith (word, word_length, max_length, words, offset,
				  flags, 0);
	    }
	}

      if (flags & WRDE_NOCMD)
	return WRDE_CMDSUB;

      (*offset) += 2;
      return parse_comm (word, word_length, max_length, words, offset, flags,
			 quoted? NULL : pwordexp, ifs, ifs_white);

    case '[':
      (*offset) += 2;
      /* Call parse_arith -- 1 is for "brackets" */
      return parse_arith (word, word_length, max_length, words, offset, flags,
			  1);

    case '{':
    default:
      ++(*offset);	/* parse_param needs to know if "{" is there */
      return parse_param (word, word_length, max_length, words, offset, flags,
			   pwordexp, ifs, ifs_white, quoted);
    }
}

static int
parse_backtick (char **word, size_t *word_length, size_t *max_length,
		const char *words, size_t *offset, int flags,
		wordexp_t *pwordexp, const char *ifs, const char *ifs_white)
{
  /* We are poised just after "`" */
  int error;
  size_t comm_length = 0;
  size_t comm_maxlen = 0;
  char *comm = NULL;
  int squoting = 0;

  for (; words[*offset]; ++(*offset))
    {
      switch (words[*offset])
	{
	case '`':
	  /* Go -- give the script to the shell */
	  error = exec_comm (comm, word, word_length, max_length, flags,
			     pwordexp, ifs, ifs_white);
	  free (comm);
	  return error;

	case '\\':
	  if (squoting)
	    {
	      error = parse_qtd_backslash (&comm, &comm_length, &comm_maxlen,
					   words, offset);

	      if (error)
		{
		  free (comm);
		  return error;
		}

	      break;
	    }

	  ++(*offset);
	  error = parse_backslash (&comm, &comm_length, &comm_maxlen, words,
				   offset);

	  if (error)
	    {
	      free (comm);
	      return error;
	    }

	  break;

	case '\'':
	  squoting = 1 - squoting;
	default:
	  comm = w_addchar (comm, &comm_length, &comm_maxlen, words[*offset]);
	  if (comm == NULL)
	    return WRDE_NOSPACE;
	}
    }

  /* Premature end */
  free (comm);
  return WRDE_SYNTAX;
}

static int
internal_function
parse_dquote (char **word, size_t *word_length, size_t *max_length,
	      const char *words, size_t *offset, int flags,
	      wordexp_t *pwordexp, const char * ifs, const char * ifs_white)
{
  /* We are poised just after a double-quote */
  int error;

  for (; words[*offset]; ++(*offset))
    {
      switch (words[*offset])
	{
	case '"':
	  return 0;

	case '$':
	  error = parse_dollars (word, word_length, max_length, words, offset,
				 flags, pwordexp, ifs, ifs_white, 1);
	  /* The ``1'' here is to tell parse_dollars not to
	   * split the fields.  It may need to, however ("$@").
	   */
	  if (error)
	    return error;

	  break;

	case '`':
	  if (flags & WRDE_NOCMD)
	    return WRDE_CMDSUB;

	  ++(*offset);
	  error = parse_backtick (word, word_length, max_length, words,
				  offset, flags, NULL, NULL, NULL);
	  /* The first NULL here is to tell parse_backtick not to
	   * split the fields.
	   */
	  if (error)
	    return error;

	  break;

	case '\\':
	  error = parse_qtd_backslash (word, word_length, max_length, words,
				       offset);

	  if (error)
	    return error;

	  break;

	default:
	  *word = w_addchar (*word, word_length, max_length, words[*offset]);
	  if (*word == NULL)
	    return WRDE_NOSPACE;
	}
    }

  /* Unterminated string */
  return WRDE_SYNTAX;
}

/*
 * wordfree() is to be called after pwordexp is finished with.
 */

void
wordfree (wordexp_t *pwordexp)
{

  /* wordexp can set pwordexp to NULL */
  if (pwordexp && pwordexp->we_wordv)
    {
      char **wordv = pwordexp->we_wordv;

      for (wordv += pwordexp->we_offs; *wordv; ++wordv)
	free (*wordv);

      free (pwordexp->we_wordv);
      pwordexp->we_wordv = NULL;
    }
}

/*
 * wordexp()
 */

int
wordexp (const char *words, wordexp_t *pwordexp, int flags)
{
  size_t wordv_offset;
  size_t words_offset;
  size_t word_length = 0;
  size_t max_length = 0;
  char *word = NULL;
  int error;
  char *ifs;
  char ifs_white[4];
  char **old_wordv = pwordexp->we_wordv;
  size_t old_wordc = (flags & WRDE_REUSE) ? pwordexp->we_wordc : 0;

  if (flags & WRDE_REUSE)
    /* Minimal implementation of WRDE_REUSE for now */
    wordfree (pwordexp);

  if (flags & WRDE_DOOFFS)
    {
      pwordexp->we_wordv = calloc (1 + pwordexp->we_offs, sizeof (char *));
      if (pwordexp->we_wordv == NULL)
	return WRDE_NOSPACE;
    }
  else
    {
      pwordexp->we_wordv = calloc (1, sizeof (char *));
      if (pwordexp->we_wordv == NULL)
	return WRDE_NOSPACE;

      pwordexp->we_offs = 0;
    }

  if ((flags & WRDE_APPEND) == 0)
    pwordexp->we_wordc = 0;

  wordv_offset = pwordexp->we_offs + pwordexp->we_wordc;

  /* Find out what the field separators are.
   * There are two types: whitespace and non-whitespace.
   */
  ifs = getenv ("IFS");

  if (!ifs)
    /* NULL IFS means no field-splitting is to be performed */
    ifs = strcpy (ifs_white, "");
  else
    {
      char *ifsch = ifs;
      char *whch = ifs_white;

      /* Start off with no whitespace IFS characters */
      ifs_white[0] = '\0';

      while (*ifsch != '\0')
	{
	  if ((*ifsch == ' ') || (*ifsch == '\t') || (*ifsch == '\n'))
	    {
	      /* Whitespace IFS.  See first whether it is already in our
		 collection.  */
	      char *runp = ifs_white;

	      while (runp < whch && *runp != '\0' && *runp != *ifsch)
		++runp;

	      if (runp == whch)
		*whch++ = *ifsch;
	    }

	  ++ifsch;
	}
      *whch = '\0';
    }

  for (words_offset = 0 ; words[words_offset] ; ++words_offset)
    switch (words[words_offset])
      {
      case '\n':
      case '|':
      case '&':
      case ';':
      case '<':
      case '>':
      case '(':
      case ')':
	case '{':
      case '}':
	/* Fail */
	wordfree (pwordexp);
	pwordexp->we_wordc = 0;
	pwordexp->we_wordv = old_wordv;
	return WRDE_BADCHAR;

      case '\\':
	error = parse_backslash (&word, &word_length, &max_length, words,
				 &words_offset);

	if (error)
	  goto do_error;

	break;

      case '$':
	error = parse_dollars (&word, &word_length, &max_length, words,
			       &words_offset, flags, pwordexp, ifs, ifs_white,
			       0);

	if (error)
	  goto do_error;

	break;

      case '`':
	if (flags & WRDE_NOCMD)
	  return WRDE_CMDSUB;

	++words_offset;
	error = parse_backtick (&word, &word_length, &max_length, words,
				&words_offset, flags, pwordexp, ifs,
				ifs_white);

	if (error)
	  goto do_error;

	break;

      case '"':
	++words_offset;
	error = parse_dquote (&word, &word_length, &max_length, words,
			      &words_offset, flags, pwordexp, ifs, ifs_white);

	if (error)
	  goto do_error;

	break;

      case '\'':
	++words_offset;
	error = parse_squote (&word, &word_length, &max_length, words,
			      &words_offset);

	if (error)
	  goto do_error;

	break;

      case '~':
	error = parse_tilde (&word, &word_length, &max_length, words,
			     &words_offset, pwordexp->we_wordc);

	if (error)
	  goto do_error;

	break;

      case '*':
      case '[':
      case '?':
	error = parse_glob (&word, &word_length, &max_length, words,
			    &words_offset, flags, pwordexp, ifs, ifs_white);

	if (error)
	  goto do_error;

	break;

      default:
	/* Is it a field separator? */
	if (strchr (ifs, words[words_offset]) == NULL)
	  {
	    /* "Ordinary" character -- add it to word */

	    word = w_addchar (word, &word_length, &max_length,
			      words[words_offset]);
	    if (word == NULL)
	      {
		error = WRDE_NOSPACE;
		goto do_error;
	      }

	    break;
	  }

	/* Field separator */
	if (strchr (ifs_white, words[words_offset]))
	  {
	    /* It's a whitespace IFS char.  Ignore it at the beginning
	       of a line and ignore multiple instances.  */
	    if (!word || !*word)
	      break;

	    if (w_addword (pwordexp, word) == WRDE_NOSPACE)
	      {
		error = WRDE_NOSPACE;
		goto do_error;
	      }

	    word = NULL;
	    word_length = 0;
	    max_length = 0;
	    break;
	  }

	/* It's a non-whitespace IFS char */

	/* Multiple non-whitespace IFS chars are treated as one;
	 * IS THIS CORRECT?
	 */
	if (word != NULL)
	  {
	    if (w_addword (pwordexp, word) == WRDE_NOSPACE)
	      {
		error = WRDE_NOSPACE;
		goto do_error;
	      }
	  }

	word = NULL;
	word_length = 0;
	max_length = 0;
      }

  /* End of string */

  /* There was a field separator at the end */
  if (word == NULL)
    return 0;

  /* There was no field separator at the end */
  return w_addword (pwordexp, word);

do_error:
  /* Error:
   *	free memory used (unless error is WRDE_NOSPACE), and
   *	set we_wordc and wd_wordv back to what they were.
   */

  if (error == WRDE_NOSPACE)
    return WRDE_NOSPACE;

  if (word != NULL)
    free (word);

  wordfree (pwordexp);
  pwordexp->we_wordv = old_wordv;
  pwordexp->we_wordc = old_wordc;
  return error;
}