sh: Don't create bad parse result when postponing a bad substitution error.

An invalid substitution like ${var@} does not cause a parse error but is
stored in the intermediate representation, to be written as part of the
error message. If there is a CTL* byte in the stored part, this confuses
some code such as the code to skip an unused alternative such as in
${var-alternative}.

To keep things simple, do not store CTL* bytes.

Found with afl-fuzz.

MFC after:	1 week

3 files changed, 10 insertions, 0 deletions

diff --git a/bin/sh/tests/errors/Makefile b/bin/sh/tests/errors/Makefile
index ace9a01..51a766f 100644
--- a/bin/sh/tests/errors/Makefile
+++ b/bin/sh/tests/errors/Makefile
@@ -19,6 +19,8 @@ FILES+=		bad-parm-exp3.2 bad-parm-exp3.2.stderr
 FILES+=		bad-parm-exp4.2 bad-parm-exp4.2.stderr
 FILES+=		bad-parm-exp5.2 bad-parm-exp5.2.stderr
 FILES+=		bad-parm-exp6.2 bad-parm-exp6.2.stderr
+FILES+=		bad-parm-exp7.0
+FILES+=		bad-parm-exp8.0
 FILES+=		option-error.0
 FILES+=		redirection-error.0
 FILES+=		redirection-error2.2
diff --git a/bin/sh/tests/errors/bad-parm-exp7.0 b/bin/sh/tests/errors/bad-parm-exp7.0
new file mode 100644
index 0000000..b8562fb
--- /dev/null
+++ b/bin/sh/tests/errors/bad-parm-exp7.0
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+v=1
+eval ": $(printf '${v-${\372}}')"
diff --git a/bin/sh/tests/errors/bad-parm-exp8.0 b/bin/sh/tests/errors/bad-parm-exp8.0
new file mode 100644
index 0000000..28f00cd
--- /dev/null
+++ b/bin/sh/tests/errors/bad-parm-exp8.0
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+v=1
+eval ": $(printf '${v-${w\372}}')"