Reject invalid ${#...} expansions.

Test case: echo ${#bad stuff}
hvdijk · Sep 12, 2018 · 4546fe7 · 4546fe7
1 parent 50220f3
commit 4546fe7
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/expand.c b/src/expand.c
@@ -649,13 +649,16 @@ evalvar(char *p, int flag)
 	subtype = varflags & VSTYPE;
 
 	if (!subtype)
+badsub:
 		sh_error("Bad substitution");
 
 	quoted = flag & EXP_QUOTED;
 	var = p;
 	easy = (!quoted || (*var == '@' && shellparam.nparam));
 	startloc = expdest - (char *)stackblock();
 	p = strchr(p, '=') + 1;
+	if (subtype == VSLENGTH && *p != (char)CTLENDVAR)
+		goto badsub;
 
 again:
 	varlen = varvalue(var, varflags, flag);