wordexp(): Fix syntax validation for backslashes in single-quotes.

2 files changed, 14 insertions, 1 deletions

diff --git a/lib/libc/gen/wordexp.c b/lib/libc/gen/wordexp.c
index 7d8b8f9..c361980 100644
--- a/lib/libc/gen/wordexp.c
+++ b/lib/libc/gen/wordexp.c
@@ -251,7 +251,8 @@ we_check(const char *words, int flags)
 	while ((c = *words++) != '\0') {
 		switch (c) {
 		case '\\':
-			quote ^= 1;
+			if (squote == 0)
+				quote ^= 1;
 			continue;
 		case '\'':
 			if (quote + dquote == 0)
diff --git a/tools/regression/lib/libc/gen/test-wordexp.c b/tools/regression/lib/libc/gen/test-wordexp.c
index d94f870..15d1b7c 100644
--- a/tools/regression/lib/libc/gen/test-wordexp.c
+++ b/tools/regression/lib/libc/gen/test-wordexp.c
@@ -195,6 +195,18 @@ main(int argc, char *argv[])
 	r = wordexp("test } test", &we, 0);
 	assert(r == WRDE_BADCHAR);
 
+	/* WRDE_SYNTAX */
+	r = wordexp("'", &we, 0);
+	assert(r == WRDE_SYNTAX);
+	r = wordexp("'", &we, WRDE_UNDEF);
+	assert(r == WRDE_SYNTAX);
+	r = wordexp("'\\'", &we, 0);
+	assert(r == 0);
+	assert(we.we_wordc == 1);
+	assert(strcmp(we.we_wordv[0], "\\") == 0);
+	assert(we.we_wordv[1] == NULL);
+	wordfree(&we);
+
 	/* With a SIGCHLD handler that reaps all zombies. */
 	sa.sa_flags = 0;
 	sigemptyset(&sa.sa_mask);