When evaluating an arithmetical expression, for example inside $(()),

never do substitution (neither parameter, nor command, nor arithmetic,
nor tilde substitution) on the values of any variables encountered
inside the expression, but do recursively perform arithmetical
evaluation of subexpressions as required.  This makes behaviour
more consistent, without hindering any behaviour promised in the
manual page.

A quirk originally reported by Andy Chu <andychup at gmail dot com>
was that in the past, when encountering an array index, the shell
would not only do evaluation, but also substitution on the array
index, even though substitution would not be done on the expression
in general.

tobias@ contributed to initial efforts of understanding the quirk.
patch tested in a bulk build by naddy@
"please commit" deraadt@

4 files changed, 14 insertions, 4 deletions

diff --git a/bin/ksh/eval.c b/bin/ksh/eval.c
index 5232b79a703..5791d7348b6 100644
--- a/bin/ksh/eval.c
+++ b/bin/ksh/eval.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: eval.c,v 1.63 2018/07/09 00:20:35 anton Exp $	*/
+/*	$OpenBSD: eval.c,v 1.64 2019/02/20 23:59:17 schwarze Exp $	*/
 
 /*
  * Expansion - quoting, separation, substitution, globbing
@@ -66,6 +66,9 @@ substitute(const char *cp, int f)
 {
 	struct source *s, *sold;
 
+	if (disable_subst)
+		return str_save(cp, ATEMP);
+
 	sold = source;
 	s = pushs(SWSTR, ATEMP);
 	s->start = s->str = cp;
diff --git a/bin/ksh/expr.c b/bin/ksh/expr.c
index fd2f4be935c..782de57ebec 100644
--- a/bin/ksh/expr.c
+++ b/bin/ksh/expr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: expr.c,v 1.33 2018/04/09 17:53:36 tobias Exp $	*/
+/*	$OpenBSD: expr.c,v 1.34 2019/02/20 23:59:17 schwarze Exp $	*/
 
 /*
  * Korn expression evaluation
@@ -170,6 +170,7 @@ v_evaluate(struct tbl *vp, const char *expr, volatile int error_ok,
 	struct tbl *v;
 	Expr_state curstate;
 	Expr_state * const es = &curstate;
+	int save_disable_subst;
 	int i;
 
 	/* save state to allow recursive calls */
@@ -180,8 +181,10 @@ v_evaluate(struct tbl *vp, const char *expr, volatile int error_ok,
 	curstate.val = NULL;
 
 	newenv(E_ERRH);
+	save_disable_subst = disable_subst;
 	i = sigsetjmp(genv->jbuf, 0);
 	if (i) {
+		disable_subst = save_disable_subst;
 		/* Clear EXPRINEVAL in of any variables we were playing with */
 		if (curstate.evaling)
 			curstate.evaling->flag &= ~EXPRINEVAL;
@@ -588,7 +591,9 @@ intvar(Expr_state *es, struct tbl *vp)
 			evalerr(es, ET_RECURSIVE, vp->name);
 		es->evaling = vp;
 		vp->flag |= EXPRINEVAL;
+		disable_subst++;
 		v_evaluate(vq, str_val(vp), KSH_UNWIND_ERROR, es->arith);
+		disable_subst--;
 		vp->flag &= ~EXPRINEVAL;
 		es->evaling = NULL;
 	}
diff --git a/bin/ksh/main.c b/bin/ksh/main.c
index e74c12f3a37..86e0bbf56af 100644
--- a/bin/ksh/main.c
+++ b/bin/ksh/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.96 2018/11/20 07:02:23 martijn Exp $	*/
+/*	$OpenBSD: main.c,v 1.97 2019/02/20 23:59:17 schwarze Exp $	*/
 
 /*
  * startup, main loop, environments and error handling
@@ -35,6 +35,7 @@ uid_t	ksheuid;
 int	exstat;
 int	subst_exstat;
 const char *safe_prompt;
+int	disable_subst;
 
 Area	aperm;
 
diff --git a/bin/ksh/sh.h b/bin/ksh/sh.h
index 2efa875bb80..ad97d836fb4 100644
--- a/bin/ksh/sh.h
+++ b/bin/ksh/sh.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sh.h,v 1.74 2018/11/20 07:02:23 martijn Exp $	*/
+/*	$OpenBSD: sh.h,v 1.75 2019/02/20 23:59:17 schwarze Exp $	*/
 
 /*
  * Public Domain Bourne/Korn shell
@@ -44,6 +44,7 @@ extern	int	exstat;		/* exit status */
 extern	int	subst_exstat;	/* exit status of last $(..)/`..` */
 extern	const char *safe_prompt; /* safe prompt if PS1 substitution fails */
 extern	char	username[];	/* username for \u prompt expansion */
+extern	int	disable_subst;	/* disable substitution during evaluation */
 
 /*
  * Area-based allocation built on malloc/free