fix the rest of it

check.t

@@ -1,4 +1,4 @@
-# $MirOS: src/bin/mksh/check.t,v 1.123 2007/07/06 01:37:39 tg Exp $
+# $MirOS: src/bin/mksh/check.t,v 1.124 2007/07/06 02:22:55 tg Exp $
 # $OpenBSD: bksl-nl.t,v 1.2 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: history.t,v 1.5 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: read.t,v 1.3 2003/03/10 03:48:16 david Exp $
@@ -7,7 +7,7 @@
 # http://www.research.att.com/~gsf/public/ifs.sh
 
 expected-stdout:
-	@(#)MIRBSD KSH R29 2007/07/01
+	@(#)MIRBSD KSH R29 2007/07/05
 description:
 	Check version of shell.
 category: pdksh
@@ -4068,11 +4068,30 @@ stdin:
 	typeset -i 16 z=123456789	# 16#75bcd15
 	n=2
 	print a ${x:$n:3} ${y:$n:3} ${z:$n:3} a
-	print b ${x:n:3} ${y:n:3} ${z:n:3} b
+	print b ${x:(n):3} ${y:(n):3} ${z:(n):3} b
 	print c ${x:(-2):1} ${y:(-2):1} ${z:(-2):1} c
-expected-fail: yes
+	print d t${x: n:2} ${y: n:3} ${z: n:3} d
 expected-stdout:
 	a cde 345 #75 a
 	b cde 345 #75 b
 	c h 8 1 c
+	d tcd 345 #75 d
+---
+name: varexpand-substr-3
+description:
+	Check that some things that work in bash fail.
+	This is by design.
+stdin:
+	export x=abcdefghi n=2
+	"$0" -c 'print v${x:(n)}x'
+	"$0" -c 'print w${x: n}x'
+	"$0" -c 'print x${x:n}x'
+	"$0" -c 'print y${x:}x'
+	"$0" -c 'print z${x}x'
+expected-stdout:
+	vcdefghix
+	wcdefghix
+	zabcdefghix
+expected-stderr-pattern:
+	/x:n.*bad substitution.*\n.*bad substitution/
 ---

eval.c

@@ -2,7 +2,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.31 2007/07/06 01:53:35 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.32 2007/07/06 02:22:56 tg Exp $");
 
 #ifdef MKSH_SMALL
 #define MKSH_NOPWNAM
@@ -278,6 +278,7 @@ expand(const char *cp,	/* input word */
 				if (type < 0) {
 					char *beg, *end, *str;
 
+ unwind_substsyn:
 					sp = varname - 2; /* restore sp */
 					end = (beg = wdcopy(sp, ATEMP)) +
 					    (wdscan(sp, CSUBST) - sp);
@@ -321,6 +322,9 @@ expand(const char *cp,	/* input word */
 						quote = 0;
 						beg = wdcopy(sp, ATEMP);
 						mid = beg + (wdscan(sp, ADELIM) - sp);
+						stg = beg + (wdscan(sp, CSUBST) - sp);
+						if (mid >= stg)
+							goto unwind_substsyn;
 						mid[-2] = EOS;
 						if (mid[-1] == /*{*/'}') {
 							sp += mid - beg - 1;
@@ -328,11 +332,13 @@ expand(const char *cp,	/* input word */
 						} else {
 							end = mid +
 							    (wdscan(mid, ADELIM) - mid);
+							if (end >= stg)
+								goto unwind_substsyn;
 							end[-2] = EOS;
 							sp += end - beg - 1;
 						}
-						evaluate(stg = wdstrip(beg), &from,
-						    KSH_UNWIND_ERROR, true);
+						evaluate(substitute(stg = wdstrip(beg), 0),
+						    &from, KSH_UNWIND_ERROR, true);
 						afree(stg, ATEMP);
 						if (end) {
 							evaluate(stg = wdstrip(mid),
@@ -792,8 +798,7 @@ varsub(Expand *xp, const char *sp, const char *word,
 		stype = 0x80;
 		c = word[slen + 0] == CHAR ? word[slen + 1] : 0;
 	}
-	if (stype == 0x80 && (ksh_isdigit(c) || c == '('/*)*/ ||
-	    (!c && word[slen] && word[slen] != CHAR))) {
+	if (stype == 0x80 && !c && word[slen] && word[slen] != CHAR) {
 		stype |= '0';
 	} else if (ctype(c, C_SUBOP1)) {
 		slen += 2;

lex.c

@@ -2,7 +2,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/lex.c,v 1.39 2007/07/06 01:53:36 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/lex.c,v 1.40 2007/07/06 02:22:56 tg Exp $");
 
 /* Structure to keep track of the lexing state and the various pieces of info
  * needed for each particular state. */
@@ -287,7 +287,7 @@ yylex(int cf)
 						*wp++ = CHAR, *wp++ = c;
 						c = getsc();
 						if (c == ':') {
-							*wp++ = CHAR;
+							*wp++ = QCHAR;
 							*wp++ = '0';
 							*wp++ = ADELIM;
 							*wp++ = ':';
@@ -296,10 +296,11 @@ yylex(int cf)
 							statep->ls_sadelim.num = 1;
 							break;
 						} else if (ksh_isdigit(c) ||
-						    c == '('/*)*/ ||
+						    c == '('/*)*/ || c == ' ' ||
 						    c == '$' /* XXX what else? */) {
 							/* substring subst. */
-							ungetsc(c);
+							*wp++ = QCHAR;
+							*wp++ = c;
 							PUSH_STATE(SADELIM);
 							statep->ls_sadelim.delimiter = ':';
 							statep->ls_sadelim.num = 2;

mksh.1

@@ -1,7 +1,7 @@
-.\" $MirOS: src/bin/mksh/mksh.1,v 1.90 2007/06/27 23:12:59 tg Exp $
+.\" $MirOS: src/bin/mksh/mksh.1,v 1.91 2007/07/06 02:22:56 tg Exp $
 .\" $OpenBSD: ksh.1,v 1.120 2007/05/31 20:47:44 otto Exp $
 .\"
-.Dd June 27, 2007
+.Dd July 5, 2007
 .Dt MKSH 1
 .Os MirBSD
 .Sh NAME
@@ -1253,17 +1253,17 @@ and
 are optional.
 If
 .Ar pos
-.\"is negative, counting starts at the end of the string; if it
+is negative, counting starts at the end of the string; if it
 is omitted, it defaults to 0.
 If
 .Ar len
 is omitted or greater than the length of the remaining string,
 all of it is substituted.
-.\"Both
-.\".Ar pos
-.\"and
-.\".Ar len
-.\"are evaluated as arithmetic expressions.
+Both
+.Ar pos
+and
+.Ar len
+are evaluated as arithmetic expressions.
 .El
 .Pp
 The following special parameters are implicitly set by the shell and cannot be

sh.h

@@ -8,8 +8,8 @@
 /*	$OpenBSD: c_test.h,v 1.4 2004/12/20 11:34:26 otto Exp $	*/
 /*	$OpenBSD: tty.h,v 1.5 2004/12/20 11:34:26 otto Exp $	*/
 
-#define MKSH_SH_H_ID "$MirOS: src/bin/mksh/sh.h,v 1.155 2007/07/06 01:53:36 tg Exp $"
-#define MKSH_VERSION "R29 2007/07/01"
+#define MKSH_SH_H_ID "$MirOS: src/bin/mksh/sh.h,v 1.156 2007/07/06 02:22:57 tg Exp $"
+#define MKSH_VERSION "R29 2007/07/05"
 
 #if HAVE_SYS_PARAM_H
 #include <sys/param.h>