From 9ac1dd9017b2b4acba4734f6f989b88da2ad7616 Mon Sep 17 00:00:00 2001
From: xiechengliang <[email protected]>
Date: Wed, 24 Nov 2021 19:15:25 +0800
Subject: [PATCH 2/2] ash: parser: Fix VSLENGTH parsing with trailing garbage

Let's adopt Herbert Xu's patch, not waiting for it to reach dash git:
hush already has a similar fix.

backport from upstream:
https://git.busybox.net/busybox/commit/?id=53a7a9cd8c15d64fcc2278cf8981ba526dfbe0d2

Signed-off-by: Denys Vlasenko <[email protected]>
---
 shell/ash.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/shell/ash.c b/shell/ash.c
index a33ab0626..1ca45f9c1 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -12635,7 +12635,7 @@ parsesub: {
 			do {
 				STPUTC(c, out);
 				c = pgetc_eatbnl();
-			} while (!subtype && isdigit(c));
+			} while ((subtype == 0 || subtype == VSLENGTH) && isdigit(c));
 		} else if (c != '}') {
 			/* $[{[#]]<specialchar>[}] */
 			int cc = c;
@@ -12665,11 +12665,6 @@ parsesub: {
 		} else
 			goto badsub;
 
-		if (c != '}' && subtype == VSLENGTH) {
-			/* ${#VAR didn't end with } */
-			goto badsub;
-		}
-
 		if (subtype == 0) {
 			static const char types[] ALIGN1 = "}-+?=";
 			/* ${VAR...} but not $VAR or ${#VAR} */
@@ -12726,6 +12721,8 @@ parsesub: {
 #endif
 			}
 		} else {
+			if (subtype == VSLENGTH && c != '}')
+				subtype = 0;
  badsub:
 			pungetc();
 		}
-- 
2.27.0