sh: Fix corruption of command substitutions with special chars after newline

The CTLESC byte to protect a special character was output before instead of
after a newline directly preceding the special character.

The special handling of newlines is because command substitutions discard
all trailing newlines.

2 files changed, 22 insertions, 2 deletions

diff --git a/bin/sh/expand.c b/bin/sh/expand.c
index 1693a0b..354d5e9 100644
--- a/bin/sh/expand.c
+++ b/bin/sh/expand.c
@@ -499,8 +499,6 @@ expbackq(union node *cmd, int quoted, int flag)
 		}
 		lastc = *p++;
 		if (lastc != '\0') {
-			if (quotes && syntax[(int)lastc] == CCTL)
-				STPUTC(CTLESC, dest);
 			if (lastc == '\n') {
 				nnl++;
 			} else {
@@ -508,6 +506,8 @@ expbackq(union node *cmd, int quoted, int flag)
 					nnl--;
 					STPUTC('\n', dest);
 				}
+				if (quotes && syntax[(int)lastc] == CCTL)
+					STPUTC(CTLESC, dest);
 				STPUTC(lastc, dest);
 			}
 		}
diff --git a/tools/regression/bin/sh/expansion/cmdsubst3.0 b/tools/regression/bin/sh/expansion/cmdsubst3.0
new file mode 100644
index 0000000..dce9720
--- /dev/null
+++ b/tools/regression/bin/sh/expansion/cmdsubst3.0
@@ -0,0 +1,20 @@
+# $FreeBSD$
+
+e=
+for i in 0 1 2 3; do
+	for j in 0 1 2 3 4 5 6 7; do
+		for k in 0 1 2 3 4 5 6 7; do
+			case $i$j$k in
+			000) continue ;;
+			esac
+			e="$e\n\\$i$j$k"
+		done
+	done
+done
+e1=$(printf "$e")
+e2="$(printf "$e")"
+[ "${#e1}" = 510 ] || echo length bad
+[ "$e1" = "$e2" ] || echo e1 != e2
+[ "$e1" = "$(printf "$e")" ] || echo quoted bad
+IFS=
+[ "$e1" = $(printf "$e") ] || echo unquoted bad