1/*	$OpenBSD: var.c,v 1.44 2015/09/10 11:37:42 jca Exp $	*/
2
3/*-
4 * Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
5 *		 2011, 2012, 2013, 2014, 2015, 2016
6 *	mirabilos <m@mirbsd.org>
7 *
8 * Provided that these terms and disclaimer and all copyright notices
9 * are retained or reproduced in an accompanying document, permission
10 * is granted to deal in this work without restriction, including un-
11 * limited rights to use, publicly perform, distribute, sell, modify,
12 * merge, give away, or sublicence.
13 *
14 * This work is provided "AS IS" and WITHOUT WARRANTY of any kind, to
15 * the utmost extent permitted by applicable law, neither express nor
16 * implied; without malicious intent or gross negligence. In no event
17 * may a licensor, author or contributor be held liable for indirect,
18 * direct, other damage, loss, or other issues arising in any way out
19 * of dealing in the work, even if advised of the possibility of such
20 * damage or existence of a defect, except proven that it results out
21 * of said person's immediate fault when using the work as intended.
22 */
23
24#include "sh.h"
25#include "mirhash.h"
26
27#if defined(__OpenBSD__)
28#include <sys/sysctl.h>
29#endif
30
31__RCSID("$MirOS: src/bin/mksh/var.c,v 1.209 2016/11/11 23:31:39 tg Exp $");
32
33/*-
34 * Variables
35 *
36 * WARNING: unreadable code, needs a rewrite
37 *
38 * if (flag&INTEGER), val.i contains integer value, and type contains base.
39 * otherwise, (val.s + type) contains string value.
40 * if (flag&EXPORT), val.s contains "name=value" for E-Z exporting.
41 */
42
43static struct table specials;
44static uint32_t lcg_state = 5381, qh_state = 4711;
45/* may only be set by typeset() just before call to array_index_calc() */
46static enum namerefflag innermost_refflag = SRF_NOP;
47
48static char *formatstr(struct tbl *, const char *);
49static void exportprep(struct tbl *, const char *);
50static int special(const char *);
51static void unspecial(const char *);
52static void getspec(struct tbl *);
53static void setspec(struct tbl *);
54static void unsetspec(struct tbl *);
55static int getint(struct tbl *, mksh_ari_u *, bool);
56static const char *array_index_calc(const char *, bool *, uint32_t *);
57
58/*
59 * create a new block for function calls and simple commands
60 * assume caller has allocated and set up e->loc
61 */
62void
63newblock(void)
64{
65	struct block *l;
66	static const char *empty[] = { null };
67
68	l = alloc(sizeof(struct block), ATEMP);
69	l->flags = 0;
70	/* TODO: could use e->area (l->area => l->areap) */
71	ainit(&l->area);
72	if (!e->loc) {
73		l->argc = 0;
74		l->argv = empty;
75	} else {
76		l->argc = e->loc->argc;
77		l->argv = e->loc->argv;
78	}
79	l->exit = l->error = NULL;
80	ktinit(&l->area, &l->vars, 0);
81	ktinit(&l->area, &l->funs, 0);
82	l->next = e->loc;
83	e->loc = l;
84}
85
86/*
87 * pop a block handling special variables
88 */
89void
90popblock(void)
91{
92	ssize_t i;
93	struct block *l = e->loc;
94	struct tbl *vp, **vpp = l->vars.tbls, *vq;
95
96	/* pop block */
97	e->loc = l->next;
98
99	i = 1 << (l->vars.tshift);
100	while (--i >= 0)
101		if ((vp = *vpp++) != NULL && (vp->flag&SPECIAL)) {
102			if ((vq = global(vp->name))->flag & ISSET)
103				setspec(vq);
104			else
105				unsetspec(vq);
106		}
107	if (l->flags & BF_DOGETOPTS)
108		user_opt = l->getopts_state;
109	afreeall(&l->area);
110	afree(l, ATEMP);
111}
112
113/* called by main() to initialise variable data structures */
114#define VARSPEC_DEFNS
115#include "var_spec.h"
116
117enum var_specs {
118#define VARSPEC_ENUMS
119#include "var_spec.h"
120	V_MAX
121};
122
123/* this is biased with -1 relative to VARSPEC_ENUMS */
124static const char * const initvar_names[] = {
125#define VARSPEC_ITEMS
126#include "var_spec.h"
127};
128
129void
130initvar(void)
131{
132	int i = 0;
133	struct tbl *tp;
134
135	ktinit(APERM, &specials,
136	    /* currently 18 specials: 75% of 32 = 2^5 */
137	    5);
138	while (i < V_MAX - 1) {
139		tp = ktenter(&specials, initvar_names[i],
140		    hash(initvar_names[i]));
141		tp->flag = DEFINED|ISSET;
142		tp->type = ++i;
143	}
144}
145
146/* common code for several functions below and c_typeset() */
147struct block *
148varsearch(struct block *l, struct tbl **vpp, const char *vn, uint32_t h)
149{
150	register struct tbl *vp;
151
152	if (l) {
153 varsearch_loop:
154		if ((vp = ktsearch(&l->vars, vn, h)) != NULL)
155			goto varsearch_out;
156		if (l->next != NULL) {
157			l = l->next;
158			goto varsearch_loop;
159		}
160	}
161	vp = NULL;
162 varsearch_out:
163	*vpp = vp;
164	return (l);
165}
166
167/*
168 * Used to calculate an array index for global()/local(). Sets *arrayp
169 * to true if this is an array, sets *valp to the array index, returns
170 * the basename of the array. May only be called from global()/local()
171 * and must be their first callee.
172 */
173static const char *
174array_index_calc(const char *n, bool *arrayp, uint32_t *valp)
175{
176	const char *p;
177	size_t len;
178	char *ap = NULL;
179
180	*arrayp = false;
181 redo_from_ref:
182	p = skip_varname(n, false);
183	if (innermost_refflag == SRF_NOP && (p != n) && ksh_isalphx(n[0])) {
184		struct tbl *vp;
185		char *vn;
186
187		strndupx(vn, n, p - n, ATEMP);
188		/* check if this is a reference */
189		varsearch(e->loc, &vp, vn, hash(vn));
190		afree(vn, ATEMP);
191		if (vp && (vp->flag & (DEFINED | ASSOC | ARRAY)) ==
192		    (DEFINED | ASSOC)) {
193			char *cp;
194
195			/* gotcha! */
196			cp = shf_smprintf(Tf_ss, str_val(vp), p);
197			afree(ap, ATEMP);
198			n = ap = cp;
199			goto redo_from_ref;
200		}
201	}
202	innermost_refflag = SRF_NOP;
203
204	if (p != n && *p == '[' && (len = array_ref_len(p))) {
205		char *sub, *tmp;
206		mksh_ari_t rval;
207
208		/* calculate the value of the subscript */
209		*arrayp = true;
210		strndupx(tmp, p + 1, len - 2, ATEMP);
211		sub = substitute(tmp, 0);
212		afree(tmp, ATEMP);
213		strndupx(n, n, p - n, ATEMP);
214		evaluate(sub, &rval, KSH_UNWIND_ERROR, true);
215		*valp = (uint32_t)rval;
216		afree(sub, ATEMP);
217	}
218	return (n);
219}
220
221#define vn vname.ro
222/*
223 * Search for variable, if not found create globally.
224 */
225struct tbl *
226global(const char *n)
227{
228	struct tbl *vp;
229	union mksh_cchack vname;
230	struct block *l = e->loc;
231	int c;
232	bool array;
233	uint32_t h, val;
234
235	/*
236	 * check to see if this is an array;
237	 * dereference namerefs; must come first
238	 */
239	vn = array_index_calc(n, &array, &val);
240	h = hash(vn);
241	c = (unsigned char)vn[0];
242	if (!ksh_isalphx(c)) {
243		if (array)
244			errorf(Tbadsubst);
245		vp = vtemp;
246		vp->flag = DEFINED;
247		vp->type = 0;
248		vp->areap = ATEMP;
249		if (ksh_isdigit(c)) {
250			if (getn(vn, &c)) {
251				/* main.c:main_init() says 12 */
252				shf_snprintf(vp->name, 12, Tf_d, c);
253				if (c <= l->argc) {
254					/* setstr can't fail here */
255					setstr(vp, l->argv[c],
256					    KSH_RETURN_ERROR);
257				}
258			} else
259				vp->name[0] = '\0';
260			vp->flag |= RDONLY;
261			goto out;
262		}
263		vp->name[0] = c;
264		vp->name[1] = '\0';
265		vp->flag |= RDONLY;
266		if (vn[1] != '\0')
267			goto out;
268		vp->flag |= ISSET|INTEGER;
269		switch (c) {
270		case '$':
271			vp->val.i = kshpid;
272			break;
273		case '!':
274			/* if no job, expand to nothing */
275			if ((vp->val.i = j_async()) == 0)
276				vp->flag &= ~(ISSET|INTEGER);
277			break;
278		case '?':
279			vp->val.i = exstat & 0xFF;
280			break;
281		case '#':
282			vp->val.i = l->argc;
283			break;
284		case '-':
285			vp->flag &= ~INTEGER;
286			vp->val.s = getoptions();
287			break;
288		default:
289			vp->flag &= ~(ISSET|INTEGER);
290		}
291		goto out;
292	}
293	l = varsearch(e->loc, &vp, vn, h);
294	if (vp != NULL) {
295		if (array)
296			vp = arraysearch(vp, val);
297		goto out;
298	}
299	vp = ktenter(&l->vars, vn, h);
300	if (array)
301		vp = arraysearch(vp, val);
302	vp->flag |= DEFINED;
303	if (special(vn))
304		vp->flag |= SPECIAL;
305 out:
306	last_lookup_was_array = array;
307	if (vn != n)
308		afree(vname.rw, ATEMP);
309	return (vp);
310}
311
312/*
313 * Search for local variable, if not found create locally.
314 */
315struct tbl *
316local(const char *n, bool copy)
317{
318	struct tbl *vp;
319	union mksh_cchack vname;
320	struct block *l = e->loc;
321	bool array;
322	uint32_t h, val;
323
324	/*
325	 * check to see if this is an array;
326	 * dereference namerefs; must come first
327	 */
328	vn = array_index_calc(n, &array, &val);
329	h = hash(vn);
330	if (!ksh_isalphx(*vn)) {
331		vp = vtemp;
332		vp->flag = DEFINED|RDONLY;
333		vp->type = 0;
334		vp->areap = ATEMP;
335		goto out;
336	}
337	vp = ktenter(&l->vars, vn, h);
338	if (copy && !(vp->flag & DEFINED)) {
339		struct tbl *vq;
340
341		varsearch(l->next, &vq, vn, h);
342		if (vq != NULL) {
343			vp->flag |= vq->flag &
344			    (EXPORT | INTEGER | RDONLY | LJUST | RJUST |
345			    ZEROFIL | LCASEV | UCASEV_AL | INT_U | INT_L);
346			if (vq->flag & INTEGER)
347				vp->type = vq->type;
348			vp->u2.field = vq->u2.field;
349		}
350	}
351	if (array)
352		vp = arraysearch(vp, val);
353	vp->flag |= DEFINED;
354	if (special(vn))
355		vp->flag |= SPECIAL;
356 out:
357	last_lookup_was_array = array;
358	if (vn != n)
359		afree(vname.rw, ATEMP);
360	return (vp);
361}
362#undef vn
363
364/* get variable string value */
365char *
366str_val(struct tbl *vp)
367{
368	char *s;
369
370	if ((vp->flag&SPECIAL))
371		getspec(vp);
372	if (!(vp->flag&ISSET))
373		/* special to dollar() */
374		s = null;
375	else if (!(vp->flag&INTEGER))
376		/* string source */
377		s = vp->val.s + vp->type;
378	else {
379		/* integer source */
380		mksh_uari_t n;
381		unsigned int base;
382		/**
383		 * worst case number length is when base == 2:
384		 *	1 (minus) + 2 (base, up to 36) + 1 ('#') +
385		 *	number of bits in the mksh_uari_t + 1 (NUL)
386		 */
387		char strbuf[1 + 2 + 1 + 8 * sizeof(mksh_uari_t) + 1];
388		const char *digits = (vp->flag & UCASEV_AL) ?
389		    digits_uc : digits_lc;
390
391		s = strbuf + sizeof(strbuf);
392		if (vp->flag & INT_U)
393			n = vp->val.u;
394		else
395			n = (vp->val.i < 0) ? -vp->val.u : vp->val.u;
396		base = (vp->type == 0) ? 10U : (unsigned int)vp->type;
397
398		if (base == 1 && n == 0)
399			base = 2;
400		if (base == 1) {
401			size_t sz = 1;
402
403			*(s = strbuf) = '1';
404			s[1] = '#';
405			if (!UTFMODE || ((n & 0xFF80) == 0xEF80))
406				/* OPTU-16 -> raw octet */
407				s[2] = n & 0xFF;
408			else
409				sz = utf_wctomb(s + 2, n);
410			s[2 + sz] = '\0';
411		} else {
412			*--s = '\0';
413			do {
414				*--s = digits[n % base];
415				n /= base;
416			} while (n != 0);
417			if (base != 10) {
418				*--s = '#';
419				*--s = digits[base % 10];
420				if (base >= 10)
421					*--s = digits[base / 10];
422			}
423			if (!(vp->flag & INT_U) && vp->val.i < 0)
424				*--s = '-';
425		}
426		if (vp->flag & (RJUST|LJUST))
427			/* case already dealt with */
428			s = formatstr(vp, s);
429		else
430			strdupx(s, s, ATEMP);
431	}
432	return (s);
433}
434
435/* set variable to string value */
436int
437setstr(struct tbl *vq, const char *s, int error_ok)
438{
439	char *salloc = NULL;
440	bool no_ro_check = tobool(error_ok & 0x4);
441
442	error_ok &= ~0x4;
443	if ((vq->flag & RDONLY) && !no_ro_check) {
444		warningf(true, Tf_ro, vq->name);
445		if (!error_ok)
446			errorfxz(2);
447		return (0);
448	}
449	if (!(vq->flag&INTEGER)) {
450		/* string dest */
451		if ((vq->flag&ALLOC)) {
452#ifndef MKSH_SMALL
453			/* debugging */
454			if (s >= vq->val.s &&
455			    s <= vq->val.s + strlen(vq->val.s)) {
456				internal_errorf(
457				    "setstr: %s=%s: assigning to self",
458				    vq->name, s);
459			}
460#endif
461			afree(vq->val.s, vq->areap);
462		}
463		vq->flag &= ~(ISSET|ALLOC);
464		vq->type = 0;
465		if (s && (vq->flag & (UCASEV_AL|LCASEV|LJUST|RJUST)))
466			s = salloc = formatstr(vq, s);
467		if ((vq->flag&EXPORT))
468			exportprep(vq, s);
469		else {
470			strdupx(vq->val.s, s, vq->areap);
471			vq->flag |= ALLOC;
472		}
473	} else {
474		/* integer dest */
475		if (!v_evaluate(vq, s, error_ok, true))
476			return (0);
477	}
478	vq->flag |= ISSET;
479	if ((vq->flag&SPECIAL))
480		setspec(vq);
481	afree(salloc, ATEMP);
482	return (1);
483}
484
485/* set variable to integer */
486void
487setint(struct tbl *vq, mksh_ari_t n)
488{
489	if (!(vq->flag&INTEGER)) {
490		vtemp->flag = (ISSET|INTEGER);
491		vtemp->type = 0;
492		vtemp->areap = ATEMP;
493		vtemp->val.i = n;
494		/* setstr can't fail here */
495		setstr(vq, str_val(vtemp), KSH_RETURN_ERROR);
496	} else
497		vq->val.i = n;
498	vq->flag |= ISSET;
499	if ((vq->flag&SPECIAL))
500		setspec(vq);
501}
502
503static int
504getint(struct tbl *vp, mksh_ari_u *nump, bool arith)
505{
506	mksh_uari_t c, num = 0, base = 10;
507	const char *s;
508	bool have_base = false, neg = false;
509
510	if (vp->flag & SPECIAL)
511		getspec(vp);
512	/* XXX is it possible for ISSET to be set and val.s to be NULL? */
513	if (!(vp->flag & ISSET) || (!(vp->flag & INTEGER) && vp->val.s == NULL))
514		return (-1);
515	if (vp->flag & INTEGER) {
516		nump->i = vp->val.i;
517		return (vp->type);
518	}
519	s = vp->val.s + vp->type;
520
521	do {
522		c = (unsigned char)*s++;
523	} while (ksh_isspace(c));
524
525	switch (c) {
526	case '-':
527		neg = true;
528		/* FALLTHROUGH */
529	case '+':
530		c = (unsigned char)*s++;
531		break;
532	}
533
534	if (c == '0' && arith) {
535		if (ksh_eq(s[0], 'X', 'x')) {
536			/* interpret as hexadecimal */
537			base = 16;
538			++s;
539			goto getint_c_style_base;
540		} else if (Flag(FPOSIX) && ksh_isdigit(s[0]) &&
541		    !(vp->flag & ZEROFIL)) {
542			/* interpret as octal (deprecated) */
543			base = 8;
544 getint_c_style_base:
545			have_base = true;
546			c = (unsigned char)*s++;
547		}
548	}
549
550	do {
551		if (c == '#') {
552			/* ksh-style base determination */
553			if (have_base || num < 1)
554				return (-1);
555			if ((base = num) == 1) {
556				/* mksh-specific extension */
557				unsigned int wc;
558
559				if (!UTFMODE)
560					wc = *(const unsigned char *)s;
561				else if (utf_mbtowc(&wc, s) == (size_t)-1)
562					/* OPTU-8 -> OPTU-16 */
563					/*
564					 * (with a twist: 1#\uEF80 converts
565					 * the same as 1#\x80 does, thus is
566					 * not round-tripping correctly XXX)
567					 */
568					wc = 0xEF00 + *(const unsigned char *)s;
569				nump->u = (mksh_uari_t)wc;
570				return (1);
571			} else if (base > 36)
572				base = 10;
573			num = 0;
574			have_base = true;
575			continue;
576		}
577		if (ksh_isdigit(c))
578			c = ksh_numdig(c);
579		else if (ksh_isupper(c))
580			c = ksh_numuc(c) + 10;
581		else if (ksh_islower(c))
582			c = ksh_numlc(c) + 10;
583		else
584			return (-1);
585		if (c >= base)
586			return (-1);
587		/* handle overflow as truncation */
588		num = num * base + c;
589	} while ((c = (unsigned char)*s++));
590
591	if (neg)
592		num = -num;
593	nump->u = num;
594	return (base);
595}
596
597/*
598 * convert variable vq to integer variable, setting its value from vp
599 * (vq and vp may be the same)
600 */
601struct tbl *
602setint_v(struct tbl *vq, struct tbl *vp, bool arith)
603{
604	int base;
605	mksh_ari_u num;
606
607	if ((base = getint(vp, &num, arith)) == -1)
608		return (NULL);
609	setint_n(vq, num.i, 0);
610	if (vq->type == 0)
611		/* default base */
612		vq->type = base;
613	return (vq);
614}
615
616/* convert variable vq to integer variable, setting its value to num */
617void
618setint_n(struct tbl *vq, mksh_ari_t num, int newbase)
619{
620	if (!(vq->flag & INTEGER) && (vq->flag & ALLOC)) {
621		vq->flag &= ~ALLOC;
622		vq->type = 0;
623		afree(vq->val.s, vq->areap);
624	}
625	vq->val.i = num;
626	if (newbase != 0)
627		vq->type = newbase;
628	vq->flag |= ISSET|INTEGER;
629	if (vq->flag&SPECIAL)
630		setspec(vq);
631}
632
633static char *
634formatstr(struct tbl *vp, const char *s)
635{
636	int olen, nlen;
637	char *p, *q;
638	size_t psiz;
639
640	olen = (int)utf_mbswidth(s);
641
642	if (vp->flag & (RJUST|LJUST)) {
643		if (!vp->u2.field)
644			/* default field width */
645			vp->u2.field = olen;
646		nlen = vp->u2.field;
647	} else
648		nlen = olen;
649
650	p = alloc((psiz = nlen * /* MB_LEN_MAX */ 3 + 1), ATEMP);
651	if (vp->flag & (RJUST|LJUST)) {
652		int slen = olen;
653
654		if (vp->flag & RJUST) {
655			const char *qq;
656			int n = 0;
657
658			qq = utf_skipcols(s, slen, &slen);
659
660			/* strip trailing spaces (AT&T uses qq[-1] == ' ') */
661			while (qq > s && ksh_isspace(qq[-1])) {
662				--qq;
663				--slen;
664			}
665			if (vp->flag & ZEROFIL && vp->flag & INTEGER) {
666				if (!s[0] || !s[1])
667					goto uhm_no;
668				if (s[1] == '#')
669					n = 2;
670				else if (s[2] == '#')
671					n = 3;
672 uhm_no:
673				if (vp->u2.field <= n)
674					n = 0;
675			}
676			if (n) {
677				memcpy(p, s, n);
678				s += n;
679			}
680			while (slen > vp->u2.field)
681				slen -= utf_widthadj(s, &s);
682			if (vp->u2.field - slen)
683				memset(p + n, (vp->flag & ZEROFIL) ? '0' : ' ',
684				    vp->u2.field - slen);
685			slen -= n;
686			shf_snprintf(p + vp->u2.field - slen,
687			    psiz - (vp->u2.field - slen),
688			    "%.*s", slen, s);
689		} else {
690			/* strip leading spaces/zeros */
691			while (ksh_isspace(*s))
692				s++;
693			if (vp->flag & ZEROFIL)
694				while (*s == '0')
695					s++;
696			shf_snprintf(p, nlen + 1, "%-*.*s",
697				vp->u2.field, vp->u2.field, s);
698		}
699	} else
700		memcpy(p, s, strlen(s) + 1);
701
702	if (vp->flag & UCASEV_AL) {
703		for (q = p; *q; q++)
704			*q = ksh_toupper(*q);
705	} else if (vp->flag & LCASEV) {
706		for (q = p; *q; q++)
707			*q = ksh_tolower(*q);
708	}
709
710	return (p);
711}
712
713/*
714 * make vp->val.s be "name=value" for quick exporting.
715 */
716static void
717exportprep(struct tbl *vp, const char *val)
718{
719	char *xp;
720	char *op = (vp->flag&ALLOC) ? vp->val.s : NULL;
721	size_t namelen, vallen;
722
723	namelen = strlen(vp->name);
724	vallen = strlen(val) + 1;
725
726	vp->flag |= ALLOC;
727	/* since name+val are both in memory this can go unchecked */
728	xp = alloc(namelen + 1 + vallen, vp->areap);
729	memcpy(vp->val.s = xp, vp->name, namelen);
730	xp += namelen;
731	*xp++ = '=';
732	/* offset to value */
733	vp->type = xp - vp->val.s;
734	memcpy(xp, val, vallen);
735	afree(op, vp->areap);
736}
737
738/*
739 * lookup variable (according to (set&LOCAL)), set its attributes
740 * (INTEGER, RDONLY, EXPORT, TRACE, LJUST, RJUST, ZEROFIL, LCASEV,
741 * UCASEV_AL), and optionally set its value if an assignment.
742 */
743struct tbl *
744typeset(const char *var, uint32_t set, uint32_t clr, int field, int base)
745{
746	struct tbl *vp;
747	struct tbl *vpbase, *t;
748	char *tvar;
749	const char *val;
750	size_t len;
751	bool vappend = false;
752	enum namerefflag new_refflag = SRF_NOP;
753
754	if ((set & (ARRAY | ASSOC)) == ASSOC) {
755		new_refflag = SRF_ENABLE;
756		set &= ~(ARRAY | ASSOC);
757	}
758	if ((clr & (ARRAY | ASSOC)) == ASSOC) {
759		new_refflag = SRF_DISABLE;
760		clr &= ~(ARRAY | ASSOC);
761	}
762
763	/* check for valid variable name, search for value */
764	val = skip_varname(var, false);
765	if (val == var) {
766		/* no variable name given */
767		return (NULL);
768	}
769	if (*val == '[') {
770		if (new_refflag != SRF_NOP)
771			errorf(Tf_sD_s, var,
772			    "reference variable can't be an array");
773		len = array_ref_len(val);
774		if (len == 0)
775			return (NULL);
776		/*
777		 * IMPORT is only used when the shell starts up and is
778		 * setting up its environment. Allow only simple array
779		 * references at this time since parameter/command
780		 * substitution is performed on the [expression] which
781		 * would be a major security hole.
782		 */
783		if (set & IMPORT) {
784			size_t i;
785
786			for (i = 1; i < len - 1; i++)
787				if (!ksh_isdigit(val[i]))
788					return (NULL);
789		}
790		val += len;
791	}
792	if (val[0] == '=') {
793		strndupx(tvar, var, val - var, ATEMP);
794		++val;
795	} else if (set & IMPORT) {
796		/* environment invalid variable name or no assignment */
797		return (NULL);
798	} else if (val[0] == '+' && val[1] == '=') {
799		strndupx(tvar, var, val - var, ATEMP);
800		val += 2;
801		vappend = true;
802	} else if (val[0] != '\0') {
803		/* other invalid variable names (not from environment) */
804		return (NULL);
805	} else {
806		/* just varname with no value part nor equals sign */
807		strdupx(tvar, var, ATEMP);
808		val = NULL;
809		/* handle foo[*] => foo (whole array) mapping for R39b */
810		len = strlen(tvar);
811		if (len > 3 && tvar[len - 3] == '[' && tvar[len - 2] == '*' &&
812		    tvar[len - 1] == ']')
813			tvar[len - 3] = '\0';
814	}
815
816	if (new_refflag == SRF_ENABLE) {
817		const char *qval, *ccp;
818
819		/* bail out on 'nameref foo+=bar' */
820		if (vappend)
821			errorf("appending not allowed for nameref");
822		/* find value if variable already exists */
823		if ((qval = val) == NULL) {
824			varsearch(e->loc, &vp, tvar, hash(tvar));
825			if (vp == NULL)
826				goto nameref_empty;
827			qval = str_val(vp);
828		}
829		/* check target value for being a valid variable name */
830		ccp = skip_varname(qval, false);
831		if (ccp == qval) {
832			int c;
833
834			if (!(c = (unsigned char)qval[0]))
835				goto nameref_empty;
836			else if (ksh_isdigit(c) && getn(qval, &c))
837				goto nameref_rhs_checked;
838			else if (qval[1] == '\0') switch (c) {
839			case '$':
840			case '!':
841			case '?':
842			case '#':
843			case '-':
844				goto nameref_rhs_checked;
845			}
846 nameref_empty:
847			errorf(Tf_sD_s, var, "empty nameref target");
848		}
849		len = (*ccp == '[') ? array_ref_len(ccp) : 0;
850		if (ccp[len]) {
851			/*
852			 * works for cases "no array", "valid array with
853			 * junk after it" and "invalid array"; in the
854			 * latter case, len is also 0 and points to '['
855			 */
856			errorf(Tf_sD_s, qval,
857			    "nameref target not a valid parameter name");
858		}
859 nameref_rhs_checked:
860		/* prevent nameref loops */
861		while (qval) {
862			if (!strcmp(qval, tvar))
863				errorf(Tf_sD_s, qval,
864				    "expression recurses on parameter");
865			varsearch(e->loc, &vp, qval, hash(qval));
866			qval = NULL;
867			if (vp && ((vp->flag & (ARRAY | ASSOC)) == ASSOC))
868				qval = str_val(vp);
869		}
870	}
871
872	/* prevent typeset from creating a local PATH/ENV/SHELL */
873	if (Flag(FRESTRICTED) && (strcmp(tvar, TPATH) == 0 ||
874	    strcmp(tvar, "ENV") == 0 || strcmp(tvar, TSHELL) == 0))
875		errorf(Tf_sD_s, tvar, "restricted");
876
877	innermost_refflag = new_refflag;
878	vp = (set & LOCAL) ? local(tvar, tobool(set & LOCAL_COPY)) :
879	    global(tvar);
880	if (new_refflag == SRF_DISABLE && (vp->flag & (ARRAY|ASSOC)) == ASSOC)
881		vp->flag &= ~ASSOC;
882	else if (new_refflag == SRF_ENABLE) {
883		if (vp->flag & ARRAY) {
884			struct tbl *a, *tmp;
885
886			/* free up entire array */
887			for (a = vp->u.array; a; ) {
888				tmp = a;
889				a = a->u.array;
890				if (tmp->flag & ALLOC)
891					afree(tmp->val.s, tmp->areap);
892				afree(tmp, tmp->areap);
893			}
894			vp->u.array = NULL;
895			vp->flag &= ~ARRAY;
896		}
897		vp->flag |= ASSOC;
898	}
899
900	set &= ~(LOCAL|LOCAL_COPY);
901
902	vpbase = (vp->flag & ARRAY) ? global(arrayname(tvar)) : vp;
903
904	/*
905	 * only allow export flag to be set; AT&T ksh allows any
906	 * attribute to be changed which means it can be truncated or
907	 * modified (-L/-R/-Z/-i)
908	 */
909	if ((vpbase->flag & RDONLY) &&
910	    (val || clr || (set & ~EXPORT)))
911		/* XXX check calls - is error here ok by POSIX? */
912		errorfx(2, Tf_ro, tvar);
913	afree(tvar, ATEMP);
914
915	/* most calls are with set/clr == 0 */
916	if (set | clr) {
917		bool ok = true;
918
919		/*
920		 * XXX if x[0] isn't set, there will be problems: need
921		 * to have one copy of attributes for arrays...
922		 */
923		for (t = vpbase; t; t = t->u.array) {
924			bool fake_assign;
925			char *s = NULL;
926			char *free_me = NULL;
927
928			fake_assign = (t->flag & ISSET) && (!val || t != vp) &&
929			    ((set & (UCASEV_AL|LCASEV|LJUST|RJUST|ZEROFIL)) ||
930			    ((t->flag & INTEGER) && (clr & INTEGER)) ||
931			    (!(t->flag & INTEGER) && (set & INTEGER)));
932			if (fake_assign) {
933				if (t->flag & INTEGER) {
934					s = str_val(t);
935					free_me = NULL;
936				} else {
937					s = t->val.s + t->type;
938					free_me = (t->flag & ALLOC) ? t->val.s :
939					    NULL;
940				}
941				t->flag &= ~ALLOC;
942			}
943			if (!(t->flag & INTEGER) && (set & INTEGER)) {
944				t->type = 0;
945				t->flag &= ~ALLOC;
946			}
947			t->flag = (t->flag | set) & ~clr;
948			/*
949			 * Don't change base if assignment is to be
950			 * done, in case assignment fails.
951			 */
952			if ((set & INTEGER) && base > 0 && (!val || t != vp))
953				t->type = base;
954			if (set & (LJUST|RJUST|ZEROFIL))
955				t->u2.field = field;
956			if (fake_assign) {
957				if (!setstr(t, s, KSH_RETURN_ERROR)) {
958					/*
959					 * Somewhat arbitrary action
960					 * here: zap contents of
961					 * variable, but keep the flag
962					 * settings.
963					 */
964					ok = false;
965					if (t->flag & INTEGER)
966						t->flag &= ~ISSET;
967					else {
968						if (t->flag & ALLOC)
969							afree(t->val.s, t->areap);
970						t->flag &= ~(ISSET|ALLOC);
971						t->type = 0;
972					}
973				}
974				afree(free_me, t->areap);
975			}
976		}
977		if (!ok)
978			errorfz();
979	}
980
981	if (val != NULL) {
982		char *tval;
983
984		if (vappend) {
985			tval = shf_smprintf(Tf_ss, str_val(vp), val);
986			val = tval;
987		} else
988			tval = NULL;
989
990		if (vp->flag&INTEGER) {
991			/* do not zero base before assignment */
992			setstr(vp, val, KSH_UNWIND_ERROR | 0x4);
993			/* done after assignment to override default */
994			if (base > 0)
995				vp->type = base;
996		} else
997			/* setstr can't fail (readonly check already done) */
998			setstr(vp, val, KSH_RETURN_ERROR | 0x4);
999
1000		afree(tval, ATEMP);
1001	}
1002
1003	/* only x[0] is ever exported, so use vpbase */
1004	if ((vpbase->flag&EXPORT) && !(vpbase->flag&INTEGER) &&
1005	    vpbase->type == 0)
1006		exportprep(vpbase, (vpbase->flag&ISSET) ? vpbase->val.s : null);
1007
1008	return (vp);
1009}
1010
1011/**
1012 * Unset a variable. The flags can be:
1013 * |1	= tear down entire array
1014 * |2	= keep attributes, only unset content
1015 */
1016void
1017unset(struct tbl *vp, int flags)
1018{
1019	if (vp->flag & ALLOC)
1020		afree(vp->val.s, vp->areap);
1021	if ((vp->flag & ARRAY) && (flags & 1)) {
1022		struct tbl *a, *tmp;
1023
1024		/* free up entire array */
1025		for (a = vp->u.array; a; ) {
1026			tmp = a;
1027			a = a->u.array;
1028			if (tmp->flag & ALLOC)
1029				afree(tmp->val.s, tmp->areap);
1030			afree(tmp, tmp->areap);
1031		}
1032		vp->u.array = NULL;
1033	}
1034	if (flags & 2) {
1035		vp->flag &= ~(ALLOC|ISSET);
1036		return;
1037	}
1038	/* if foo[0] is being unset, the remainder of the array is kept... */
1039	vp->flag &= SPECIAL | ((flags & 1) ? 0 : ARRAY|DEFINED);
1040	if (vp->flag & SPECIAL)
1041		/* responsible for 'unspecial'ing var */
1042		unsetspec(vp);
1043}
1044
1045/*
1046 * Return a pointer to the first char past a legal variable name
1047 * (returns the argument if there is no legal name, returns a pointer to
1048 * the terminating NUL if whole string is legal).
1049 */
1050const char *
1051skip_varname(const char *s, bool aok)
1052{
1053	size_t alen;
1054
1055	if (s && ksh_isalphx(*s)) {
1056		while (*++s && ksh_isalnux(*s))
1057			;
1058		if (aok && *s == '[' && (alen = array_ref_len(s)))
1059			s += alen;
1060	}
1061	return (s);
1062}
1063
1064/* Return a pointer to the first character past any legal variable name */
1065const char *
1066skip_wdvarname(const char *s,
1067    /* skip array de-reference? */
1068    bool aok)
1069{
1070	if (s[0] == CHAR && ksh_isalphx(s[1])) {
1071		do {
1072			s += 2;
1073		} while (s[0] == CHAR && ksh_isalnux(s[1]));
1074		if (aok && s[0] == CHAR && s[1] == '[') {
1075			/* skip possible array de-reference */
1076			const char *p = s;
1077			char c;
1078			int depth = 0;
1079
1080			while (/* CONSTCOND */ 1) {
1081				if (p[0] != CHAR)
1082					break;
1083				c = p[1];
1084				p += 2;
1085				if (c == '[')
1086					depth++;
1087				else if (c == ']' && --depth == 0) {
1088					s = p;
1089					break;
1090				}
1091			}
1092		}
1093	}
1094	return (s);
1095}
1096
1097/* Check if coded string s is a variable name */
1098int
1099is_wdvarname(const char *s, bool aok)
1100{
1101	const char *p = skip_wdvarname(s, aok);
1102
1103	return (p != s && p[0] == EOS);
1104}
1105
1106/* Check if coded string s is a variable assignment */
1107int
1108is_wdvarassign(const char *s)
1109{
1110	const char *p = skip_wdvarname(s, true);
1111
1112	return (p != s && p[0] == CHAR &&
1113	    (p[1] == '=' || (p[1] == '+' && p[2] == CHAR && p[3] == '=')));
1114}
1115
1116/*
1117 * Make the exported environment from the exported names in the dictionary.
1118 */
1119char **
1120makenv(void)
1121{
1122	ssize_t i;
1123	struct block *l;
1124	XPtrV denv;
1125	struct tbl *vp, **vpp;
1126
1127	XPinit(denv, 64);
1128	for (l = e->loc; l != NULL; l = l->next) {
1129		vpp = l->vars.tbls;
1130		i = 1 << (l->vars.tshift);
1131		while (--i >= 0)
1132			if ((vp = *vpp++) != NULL &&
1133			    (vp->flag&(ISSET|EXPORT)) == (ISSET|EXPORT)) {
1134				struct block *l2;
1135				struct tbl *vp2;
1136				uint32_t h = hash(vp->name);
1137
1138				/* unexport any redefined instances */
1139				for (l2 = l->next; l2 != NULL; l2 = l2->next) {
1140					vp2 = ktsearch(&l2->vars, vp->name, h);
1141					if (vp2 != NULL)
1142						vp2->flag &= ~EXPORT;
1143				}
1144				if ((vp->flag&INTEGER)) {
1145					/* integer to string */
1146					char *val;
1147					val = str_val(vp);
1148					vp->flag &= ~(INTEGER|RDONLY|SPECIAL);
1149					/* setstr can't fail here */
1150					setstr(vp, val, KSH_RETURN_ERROR);
1151				}
1152#ifdef __OS2__
1153				/* these special variables are not exported */
1154				if (!strcmp(vp->name, "BEGINLIBPATH") ||
1155				    !strcmp(vp->name, "ENDLIBPATH") ||
1156				    !strcmp(vp->name, "LIBPATHSTRICT"))
1157					continue;
1158#endif
1159				XPput(denv, vp->val.s);
1160			}
1161		if (l->flags & BF_STOPENV)
1162			break;
1163	}
1164	XPput(denv, NULL);
1165	return ((char **)XPclose(denv));
1166}
1167
1168/*
1169 * handle special variables with side effects - PATH, SECONDS.
1170 */
1171
1172/* Test if name is a special parameter */
1173static int
1174special(const char *name)
1175{
1176	struct tbl *tp;
1177
1178	tp = ktsearch(&specials, name, hash(name));
1179	return (tp && (tp->flag & ISSET) ? tp->type : V_NONE);
1180}
1181
1182/* Make a variable non-special */
1183static void
1184unspecial(const char *name)
1185{
1186	struct tbl *tp;
1187
1188	tp = ktsearch(&specials, name, hash(name));
1189	if (tp)
1190		ktdelete(tp);
1191}
1192
1193static time_t seconds;		/* time SECONDS last set */
1194static mksh_uari_t user_lineno;	/* what user set $LINENO to */
1195
1196/* minimum values from the OS we consider sane, lowered for R53 */
1197#define MIN_COLS	4
1198#define MIN_LINS	2
1199
1200static void
1201getspec(struct tbl *vp)
1202{
1203	mksh_ari_u num;
1204	int st;
1205	struct timeval tv;
1206
1207	switch ((st = special(vp->name))) {
1208	case V_COLUMNS:
1209	case V_LINES:
1210		/*
1211		 * Do NOT export COLUMNS/LINES. Many applications
1212		 * check COLUMNS/LINES before checking ws.ws_col/row,
1213		 * so if the app is started with C/L in the environ
1214		 * and the window is then resized, the app won't
1215		 * see the change cause the environ doesn't change.
1216		 */
1217		if (got_winch)
1218			change_winsz();
1219		break;
1220	}
1221	switch (st) {
1222	case V_BASHPID:
1223		num.u = (mksh_uari_t)procpid;
1224		break;
1225	case V_COLUMNS:
1226		num.i = x_cols;
1227		break;
1228	case V_HISTSIZE:
1229		num.i = histsize;
1230		break;
1231	case V_LINENO:
1232		num.u = (mksh_uari_t)current_lineno + user_lineno;
1233		break;
1234	case V_LINES:
1235		num.i = x_lins;
1236		break;
1237	case V_EPOCHREALTIME: {
1238		/* 10(%u) + 1(.) + 6 + NUL */
1239		char buf[18];
1240
1241		vp->flag &= ~SPECIAL;
1242		mksh_TIME(tv);
1243		shf_snprintf(buf, sizeof(buf), "%u.%06u",
1244		    (unsigned)tv.tv_sec, (unsigned)tv.tv_usec);
1245		setstr(vp, buf, KSH_RETURN_ERROR | 0x4);
1246		vp->flag |= SPECIAL;
1247		return;
1248	}
1249	case V_OPTIND:
1250		num.i = user_opt.uoptind;
1251		break;
1252	case V_RANDOM:
1253		num.i = rndget();
1254		break;
1255	case V_SECONDS:
1256		/*
1257		 * On start up the value of SECONDS is used before
1258		 * it has been set - don't do anything in this case
1259		 * (see initcoms[] in main.c).
1260		 */
1261		if (vp->flag & ISSET) {
1262			mksh_TIME(tv);
1263			num.i = tv.tv_sec - seconds;
1264		} else
1265			return;
1266		break;
1267	default:
1268		/* do nothing, do not touch vp at all */
1269		return;
1270	}
1271	vp->flag &= ~SPECIAL;
1272	setint_n(vp, num.i, 0);
1273	vp->flag |= SPECIAL;
1274}
1275
1276static void
1277setspec(struct tbl *vp)
1278{
1279	mksh_ari_u num;
1280	char *s;
1281	int st;
1282
1283	switch ((st = special(vp->name))) {
1284#ifdef __OS2__
1285	case V_BEGINLIBPATH:
1286	case V_ENDLIBPATH:
1287	case V_LIBPATHSTRICT:
1288		setextlibpath(vp->name, str_val(vp));
1289		return;
1290#endif
1291#if HAVE_PERSISTENT_HISTORY
1292	case V_HISTFILE:
1293		sethistfile(str_val(vp));
1294		return;
1295#endif
1296	case V_IFS:
1297		setctypes(s = str_val(vp), C_IFS);
1298		ifs0 = *s;
1299		return;
1300	case V_PATH:
1301		afree(path, APERM);
1302		s = str_val(vp);
1303		strdupx(path, s, APERM);
1304		/* clear tracked aliases */
1305		flushcom(true);
1306		return;
1307#ifndef MKSH_NO_CMDLINE_EDITING
1308	case V_TERM:
1309		x_initterm(str_val(vp));
1310		return;
1311#endif
1312	case V_TMPDIR:
1313		afree(tmpdir, APERM);
1314		tmpdir = NULL;
1315		/*
1316		 * Use tmpdir iff it is an absolute path, is writable
1317		 * and searchable and is a directory...
1318		 */
1319		{
1320			struct stat statb;
1321
1322			s = str_val(vp);
1323			/* LINTED use of access */
1324			if (mksh_abspath(s) && access(s, W_OK|X_OK) == 0 &&
1325			    stat(s, &statb) == 0 && S_ISDIR(statb.st_mode))
1326				strdupx(tmpdir, s, APERM);
1327		}
1328		return;
1329	/* common sub-cases */
1330	case V_COLUMNS:
1331	case V_LINES:
1332		if (vp->flag & IMPORT) {
1333			/* do not touch */
1334			unspecial(vp->name);
1335			vp->flag &= ~SPECIAL;
1336			return;
1337		}
1338		/* FALLTHROUGH */
1339	case V_HISTSIZE:
1340	case V_LINENO:
1341	case V_OPTIND:
1342	case V_RANDOM:
1343	case V_SECONDS:
1344	case V_TMOUT:
1345		vp->flag &= ~SPECIAL;
1346		if (getint(vp, &num, false) == -1) {
1347			s = str_val(vp);
1348			if (st != V_RANDOM)
1349				errorf(Tf_sD_sD_s, vp->name, "bad number", s);
1350			num.u = hash(s);
1351		}
1352		vp->flag |= SPECIAL;
1353		break;
1354	default:
1355		/* do nothing, do not touch vp at all */
1356		return;
1357	}
1358
1359	/* process the singular parts of the common cases */
1360
1361	switch (st) {
1362	case V_COLUMNS:
1363		if (num.i >= MIN_COLS)
1364			x_cols = num.i;
1365		break;
1366	case V_HISTSIZE:
1367		sethistsize(num.i);
1368		break;
1369	case V_LINENO:
1370		/* The -1 is because line numbering starts at 1. */
1371		user_lineno = num.u - (mksh_uari_t)current_lineno - 1;
1372		break;
1373	case V_LINES:
1374		if (num.i >= MIN_LINS)
1375			x_lins = num.i;
1376		break;
1377	case V_OPTIND:
1378		getopts_reset((int)num.i);
1379		break;
1380	case V_RANDOM:
1381		/*
1382		 * mksh R39d+ no longer has the traditional repeatability
1383		 * of $RANDOM sequences, but always retains state
1384		 */
1385		rndset((unsigned long)num.u);
1386		break;
1387	case V_SECONDS:
1388		{
1389			struct timeval tv;
1390
1391			mksh_TIME(tv);
1392			seconds = tv.tv_sec - num.i;
1393		}
1394		break;
1395	case V_TMOUT:
1396		ksh_tmout = num.i >= 0 ? num.i : 0;
1397		break;
1398	}
1399}
1400
1401static void
1402unsetspec(struct tbl *vp)
1403{
1404	/*
1405	 * AT&T ksh man page says OPTIND, OPTARG and _ lose special
1406	 * meaning, but OPTARG does not (still set by getopts) and _ is
1407	 * also still set in various places. Don't know what AT&T does
1408	 * for HISTSIZE, HISTFILE. Unsetting these in AT&T ksh does not
1409	 * loose the 'specialness': IFS, COLUMNS, PATH, TMPDIR
1410	 */
1411
1412	switch (special(vp->name)) {
1413#ifdef __OS2__
1414	case V_BEGINLIBPATH:
1415	case V_ENDLIBPATH:
1416	case V_LIBPATHSTRICT:
1417		setextlibpath(vp->name, "");
1418		return;
1419#endif
1420#if HAVE_PERSISTENT_HISTORY
1421	case V_HISTFILE:
1422		sethistfile(NULL);
1423		return;
1424#endif
1425	case V_IFS:
1426		setctypes(TC_IFSWS, C_IFS);
1427		ifs0 = ' ';
1428		break;
1429	case V_PATH:
1430		afree(path, APERM);
1431		strdupx(path, def_path, APERM);
1432		/* clear tracked aliases */
1433		flushcom(true);
1434		break;
1435#ifndef MKSH_NO_CMDLINE_EDITING
1436	case V_TERM:
1437		x_initterm(null);
1438		return;
1439#endif
1440	case V_TMPDIR:
1441		/* should not become unspecial */
1442		if (tmpdir) {
1443			afree(tmpdir, APERM);
1444			tmpdir = NULL;
1445		}
1446		break;
1447	case V_LINENO:
1448	case V_RANDOM:
1449	case V_SECONDS:
1450	case V_TMOUT:
1451		/* AT&T ksh leaves previous value in place */
1452		unspecial(vp->name);
1453		break;
1454	}
1455}
1456
1457/*
1458 * Search for (and possibly create) a table entry starting with
1459 * vp, indexed by val.
1460 */
1461struct tbl *
1462arraysearch(struct tbl *vp, uint32_t val)
1463{
1464	struct tbl *prev, *curr, *news;
1465	size_t len;
1466
1467	vp->flag = (vp->flag | (ARRAY | DEFINED)) & ~ASSOC;
1468	/* the table entry is always [0] */
1469	if (val == 0)
1470		return (vp);
1471	prev = vp;
1472	curr = vp->u.array;
1473	while (curr && curr->ua.index < val) {
1474		prev = curr;
1475		curr = curr->u.array;
1476	}
1477	if (curr && curr->ua.index == val) {
1478		if (curr->flag&ISSET)
1479			return (curr);
1480		news = curr;
1481	} else
1482		news = NULL;
1483	if (!news) {
1484		len = strlen(vp->name);
1485		checkoktoadd(len, 1 + offsetof(struct tbl, name[0]));
1486		news = alloc(offsetof(struct tbl, name[0]) + ++len, vp->areap);
1487		memcpy(news->name, vp->name, len);
1488	}
1489	news->flag = (vp->flag & ~(ALLOC|DEFINED|ISSET|SPECIAL)) | AINDEX;
1490	news->type = vp->type;
1491	news->areap = vp->areap;
1492	news->u2.field = vp->u2.field;
1493	news->ua.index = val;
1494
1495	if (curr != news) {
1496		/* not reusing old array entry */
1497		prev->u.array = news;
1498		news->u.array = curr;
1499	}
1500	return (news);
1501}
1502
1503/*
1504 * Return the length of an array reference (eg, [1+2]) - cp is assumed
1505 * to point to the open bracket. Returns 0 if there is no matching
1506 * closing bracket.
1507 *
1508 * XXX this should parse the actual arithmetic syntax
1509 */
1510size_t
1511array_ref_len(const char *cp)
1512{
1513	const char *s = cp;
1514	char c;
1515	int depth = 0;
1516
1517	while ((c = *s++) && (c != ']' || --depth))
1518		if (c == '[')
1519			depth++;
1520	if (!c)
1521		return (0);
1522	return (s - cp);
1523}
1524
1525/*
1526 * Make a copy of the base of an array name
1527 */
1528char *
1529arrayname(const char *str)
1530{
1531	const char *p;
1532	char *rv;
1533
1534	if (!(p = cstrchr(str, '[')))
1535		/* Shouldn't happen, but why worry? */
1536		strdupx(rv, str, ATEMP);
1537	else
1538		strndupx(rv, str, p - str, ATEMP);
1539
1540	return (rv);
1541}
1542
1543/* set (or overwrite, if reset) the array variable var to the values in vals */
1544mksh_uari_t
1545set_array(const char *var, bool reset, const char **vals)
1546{
1547	struct tbl *vp, *vq;
1548	mksh_uari_t i = 0, j = 0;
1549	const char *ccp = var;
1550	char *cp = NULL;
1551	size_t n;
1552
1553	/* to get local array, use "local foo; set -A foo" */
1554	n = strlen(var);
1555	if (n > 0 && var[n - 1] == '+') {
1556		/* append mode */
1557		reset = false;
1558		strndupx(cp, var, n - 1, ATEMP);
1559		ccp = cp;
1560	}
1561	vp = global(ccp);
1562
1563	/* Note: AT&T ksh allows set -A but not set +A of a read-only var */
1564	if ((vp->flag&RDONLY))
1565		errorfx(2, Tf_ro, ccp);
1566	/* This code is quite non-optimal */
1567	if (reset) {
1568		/* trash existing values and attributes */
1569		unset(vp, 1);
1570		/* allocate-by-access the [0] element to keep in scope */
1571		arraysearch(vp, 0);
1572	}
1573	/*
1574	 * TODO: would be nice for assignment to completely succeed or
1575	 * completely fail. Only really effects integer arrays:
1576	 * evaluation of some of vals[] may fail...
1577	 */
1578	if (cp != NULL) {
1579		/* find out where to set when appending */
1580		for (vq = vp; vq; vq = vq->u.array) {
1581			if (!(vq->flag & ISSET))
1582				continue;
1583			if (arrayindex(vq) >= j)
1584				j = arrayindex(vq) + 1;
1585		}
1586		afree(cp, ATEMP);
1587	}
1588	while ((ccp = vals[i])) {
1589#if 0 /* temporarily taken out due to regression */
1590		if (*ccp == '[') {
1591			int level = 0;
1592
1593			while (*ccp) {
1594				if (*ccp == ']' && --level == 0)
1595					break;
1596				if (*ccp == '[')
1597					++level;
1598				++ccp;
1599			}
1600			if (*ccp == ']' && level == 0 && ccp[1] == '=') {
1601				strndupx(cp, vals[i] + 1, ccp - (vals[i] + 1),
1602				    ATEMP);
1603				evaluate(substitute(cp, 0), (mksh_ari_t *)&j,
1604				    KSH_UNWIND_ERROR, true);
1605				afree(cp, ATEMP);
1606				ccp += 2;
1607			} else
1608				ccp = vals[i];
1609		}
1610#endif
1611
1612		vq = arraysearch(vp, j);
1613		/* would be nice to deal with errors here... (see above) */
1614		setstr(vq, ccp, KSH_RETURN_ERROR);
1615		i++;
1616		j++;
1617	}
1618
1619	return (i);
1620}
1621
1622void
1623change_winsz(void)
1624{
1625	struct timeval tv;
1626
1627	mksh_TIME(tv);
1628	BAFHUpdateMem_mem(qh_state, &tv, sizeof(tv));
1629
1630#ifdef TIOCGWINSZ
1631	/* check if window size has changed */
1632	if (tty_init_fd() < 2) {
1633		struct winsize ws;
1634
1635		if (ioctl(tty_fd, TIOCGWINSZ, &ws) >= 0) {
1636			if (ws.ws_col)
1637				x_cols = ws.ws_col;
1638			if (ws.ws_row)
1639				x_lins = ws.ws_row;
1640		}
1641	}
1642#endif
1643
1644	/* bounds check for sane values, use defaults otherwise */
1645	if (x_cols < MIN_COLS)
1646		x_cols = 80;
1647	if (x_lins < MIN_LINS)
1648		x_lins = 24;
1649
1650#ifdef SIGWINCH
1651	got_winch = 0;
1652#endif
1653}
1654
1655uint32_t
1656hash(const void *s)
1657{
1658	register uint32_t h;
1659
1660	BAFHInit(h);
1661	BAFHUpdateStr_reg(h, s);
1662	BAFHFinish_reg(h);
1663	return (h);
1664}
1665
1666uint32_t
1667chvt_rndsetup(const void *bp, size_t sz)
1668{
1669	register uint32_t h;
1670
1671	/* use LCG as seed but try to get them to deviate immediately */
1672	h = lcg_state;
1673	(void)rndget();
1674	BAFHFinish_reg(h);
1675	/* variation through pid, ppid, and the works */
1676	BAFHUpdateMem_reg(h, &rndsetupstate, sizeof(rndsetupstate));
1677	/* some variation, some possibly entropy, depending on OE */
1678	BAFHUpdateMem_reg(h, bp, sz);
1679	/* mix them all up */
1680	BAFHFinish_reg(h);
1681
1682	return (h);
1683}
1684
1685mksh_ari_t
1686rndget(void)
1687{
1688	/*
1689	 * this is the same Linear Congruential PRNG as Borland
1690	 * C/C++ allegedly uses in its built-in rand() function
1691	 */
1692	return (((lcg_state = 22695477 * lcg_state + 1) >> 16) & 0x7FFF);
1693}
1694
1695void
1696rndset(unsigned long v)
1697{
1698	register uint32_t h;
1699#if defined(arc4random_pushb_fast) || defined(MKSH_A4PB)
1700	register uint32_t t;
1701#endif
1702	struct {
1703		struct timeval tv;
1704		void *sp;
1705		uint32_t qh;
1706		pid_t pp;
1707		short r;
1708	} z;
1709
1710	/* clear the allocated space, for valgrind and to avoid UB */
1711	memset(&z, 0, sizeof(z));
1712
1713	h = lcg_state;
1714	BAFHFinish_reg(h);
1715	BAFHUpdateMem_reg(h, &v, sizeof(v));
1716
1717	mksh_TIME(z.tv);
1718	z.sp = &lcg_state;
1719	z.pp = procpid;
1720	z.r = (short)rndget();
1721
1722#if defined(arc4random_pushb_fast) || defined(MKSH_A4PB)
1723	t = qh_state;
1724	BAFHFinish_reg(t);
1725	z.qh = (t & 0xFFFF8000) | rndget();
1726	lcg_state = (t << 15) | rndget();
1727	/*
1728	 * either we have very chap entropy get and push available,
1729	 * with malloc() pulling in this code already anyway, or the
1730	 * user requested us to use the old functions
1731	 */
1732	t = h;
1733	BAFHUpdateMem_reg(t, &lcg_state, sizeof(lcg_state));
1734	BAFHFinish_reg(t);
1735	lcg_state = t;
1736#if defined(arc4random_pushb_fast)
1737	arc4random_pushb_fast(&lcg_state, sizeof(lcg_state));
1738	lcg_state = arc4random();
1739#else
1740	lcg_state = arc4random_pushb(&lcg_state, sizeof(lcg_state));
1741#endif
1742	BAFHUpdateMem_reg(h, &lcg_state, sizeof(lcg_state));
1743#else
1744	z.qh = qh_state;
1745#endif
1746
1747	BAFHUpdateMem_reg(h, &z, sizeof(z));
1748	BAFHFinish_reg(h);
1749	lcg_state = h;
1750}
1751
1752void
1753rndpush(const void *s)
1754{
1755	register uint32_t h = qh_state;
1756
1757	BAFHUpdateStr_reg(h, s);
1758	BAFHUpdateOctet_reg(h, 0);
1759	qh_state = h;
1760}
1761
1762/* record last glob match */
1763void
1764record_match(const char *istr)
1765{
1766	struct tbl *vp;
1767
1768	vp = local("KSH_MATCH", false);
1769	unset(vp, 1);
1770	vp->flag = DEFINED | RDONLY;
1771	setstr(vp, istr, 0x4);
1772}
1773