now fix that segfault and other bug from yesternight

do it like ksh93 though, not like bash and zsh

check.t

@@ -1,4 +1,4 @@
-# $MirOS: src/bin/mksh/check.t,v 1.421 2011/03/12 23:04:44 tg Exp $
+# $MirOS: src/bin/mksh/check.t,v 1.422 2011/03/12 23:06:41 tg Exp $
 # $OpenBSD: bksl-nl.t,v 1.2 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: history.t,v 1.5 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: read.t,v 1.3 2003/03/10 03:48:16 david Exp $
@@ -1373,28 +1373,24 @@ expected-stdout:
 name: expand-threecolons-dblq
 description:
 	Check for a particular thing that used to segfault
-	XXX still does, and decide on stderr
 stdin:
 	TEST=1234
 	echo "${TEST:1:2:3}"
 	echo $? but still living
-expected-stdout:
-	1 but still living
 expected-stderr-pattern:
-	/.*/
+	/bad substitution/
+expected-exit: 1
 ---
 name: expand-threecolons-unq
 description:
 	Check for a particular thing that used to not error out
-	XXX still doesn't, and decide on stderr
 stdin:
 	TEST=1234
 	echo ${TEST:1:2:3}
 	echo $? but still living
-expected-stdout:
-	1 but still living
 expected-stderr-pattern:
-	/.*/
+	/bad substitution/
+expected-exit: 1
 ---
 name: eglob-bad-1
 description:

eval.c

@@ -22,7 +22,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.97 2011/03/12 23:04:45 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.98 2011/03/12 23:06:43 tg Exp $");
 
 /*
  * string expansion
@@ -391,7 +391,9 @@ expand(const char *cp,	/* input word */
 						} else {
 							end = mid +
 							    (wdscan(mid, ADELIM) - mid);
-							if (end >= stg)
+							if (end >= stg ||
+							    /* more than max delimiters */
+							    end[-1] != /*{*/ '}')
 								goto unwind_substsyn;
 							end[-2] = EOS;
 							sp += end - beg - 1;