/*	$OpenBSD: var.c,v 1.44 2015/09/10 11:37:42 jca Exp $	*/

/*-

 * Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,

 *		 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018

 *	mirabilos <m@mirbsd.org>

 *

 * Provided that these terms and disclaimer and all copyright notices

 * are retained or reproduced in an accompanying document, permission

 * is granted to deal in this work without restriction, including un-

 * limited rights to use, publicly perform, distribute, sell, modify,

 * merge, give away, or sublicence.

 *

 * This work is provided "AS IS" and WITHOUT WARRANTY of any kind, to

 * the utmost extent permitted by applicable law, neither express nor

 * implied; without malicious intent or gross negligence. In no event

 * may a licensor, author or contributor be held liable for indirect,

 * direct, other damage, loss, or other issues arising in any way out

 * of dealing in the work, even if advised of the possibility of such

 * damage or existence of a defect, except proven that it results out

 * of said person's immediate fault when using the work as intended.

 */

#include "sh.h"

#include "mirhash.h"

#if defined(__OpenBSD__)

#include <sys/sysctl.h>

#endif

__RCSID("$MirOS: src/bin/mksh/var.c,v 1.223 2018/01/13 23:55:15 tg Exp $");

/*-

 * Variables

 *

 * WARNING: unreadable code, needs a rewrite

 *

 * if (flag&INTEGER), val.i contains integer value, and type contains base.

 * otherwise, (val.s + type) contains string value.

 * if (flag&EXPORT), val.s contains "name=value" for E-Z exporting.

 */

static struct table specials;

static uint32_t lcg_state = 5381, qh_state = 4711;

/* may only be set by typeset() just before call to array_index_calc() */

static enum namerefflag innermost_refflag = SRF_NOP;

static void c_typeset_vardump(struct tbl *, uint32_t, int, int, bool, bool);

static void c_typeset_vardump_recursive(struct block *, uint32_t, int, bool,

    bool);

static char *formatstr(struct tbl *, const char *);

static void exportprep(struct tbl *, const char *);

static int special(const char *);

static void unspecial(const char *);

static void getspec(struct tbl *);

static void setspec(struct tbl *);

static void unsetspec(struct tbl *);

static int getint(struct tbl *, mksh_ari_u *, bool);

static const char *array_index_calc(const char *, bool *, uint32_t *);

/*

 * create a new block for function calls and simple commands

 * assume caller has allocated and set up e->loc

 */

void

newblock(void)

{

	struct block *l;

	static const char *empty[] = { null };

	l = alloc(sizeof(struct block), ATEMP);

	l->flags = 0;

	/* TODO: could use e->area (l->area => l->areap) */

	ainit(&l->area);

	if (!e->loc) {

		l->argc = 0;

		l->argv = empty;

	} else {

		l->argc = e->loc->argc;

		l->argv = e->loc->argv;

	}

	l->exit = l->error = NULL;

	ktinit(&l->area, &l->vars, 0);

	ktinit(&l->area, &l->funs, 0);

	l->next = e->loc;

	e->loc = l;

}

/*

 * pop a block handling special variables

 */

void

popblock(void)

{

	ssize_t i;

	struct block *l = e->loc;

	struct tbl *vp, **vpp = l->vars.tbls, *vq;

	/* pop block */

	e->loc = l->next;

	i = 1 << (l->vars.tshift);

	while (--i >= 0)

		if ((vp = *vpp++) != NULL && (vp->flag&SPECIAL)) {

			if ((vq = global(vp->name))->flag & ISSET)

				setspec(vq);

			else

				unsetspec(vq);

		}

	if (l->flags & BF_DOGETOPTS)

		user_opt = l->getopts_state;

	afreeall(&l->area);

	afree(l, ATEMP);

}

/* called by main() to initialise variable data structures */

#define VARSPEC_DEFNS

#include "var_spec.h"

enum var_specs {

#define VARSPEC_ENUMS

#include "var_spec.h"

	V_MAX

};

/* this is biased with -1 relative to VARSPEC_ENUMS */

static const char * const initvar_names[] = {

#define VARSPEC_ITEMS

#include "var_spec.h"

};

void

initvar(void)

{

	int i = 0;

	struct tbl *tp;

	ktinit(APERM, &specials,

	    /* currently 21 specials: 75% of 32 = 2^5 */

	    5);

	while (i < V_MAX - 1) {

		tp = ktenter(&specials, initvar_names[i],

		    hash(initvar_names[i]));

		tp->flag = DEFINED|ISSET;

		tp->type = ++i;

	}

}

/* common code for several functions below and c_typeset() */

struct block *

varsearch(struct block *l, struct tbl **vpp, const char *vn, uint32_t h)

{

	register struct tbl *vp;

	if (l) {

 varsearch_loop:

		if ((vp = ktsearch(&l->vars, vn, h)) != NULL)

			goto varsearch_out;

		if (l->next != NULL) {

			l = l->next;

			goto varsearch_loop;

		}

	}

	vp = NULL;

 varsearch_out:

	*vpp = vp;

	return (l);

}

/*

 * Used to calculate an array index for global()/local(). Sets *arrayp

 * to true if this is an array, sets *valp to the array index, returns

 * the basename of the array. May only be called from global()/local()

 * and must be their first callee.

 */

static const char *

array_index_calc(const char *n, bool *arrayp, uint32_t *valp)

{

	const char *p;

	size_t len;

	char *ap = NULL;

	*arrayp = false;

 redo_from_ref:

	p = skip_varname(n, false);

	if (innermost_refflag == SRF_NOP && (p != n) && ctype(n[0], C_ALPHX)) {

		struct tbl *vp;

		char *vn;

		strndupx(vn, n, p - n, ATEMP);

		/* check if this is a reference */

		varsearch(e->loc, &vp, vn, hash(vn));

		afree(vn, ATEMP);

		if (vp && (vp->flag & (DEFINED | ASSOC | ARRAY)) ==

		    (DEFINED | ASSOC)) {

			char *cp;

			/* gotcha! */

			cp = shf_smprintf(Tf_ss, str_val(vp), p);

			afree(ap, ATEMP);

			n = ap = cp;

			goto redo_from_ref;

		}

	}

	innermost_refflag = SRF_NOP;

	if (p != n && ord(*p) == ORD('[') && (len = array_ref_len(p))) {

		char *sub, *tmp;

		mksh_ari_t rval;

		/* calculate the value of the subscript */

		*arrayp = true;

		strndupx(tmp, p + 1, len - 2, ATEMP);

		sub = substitute(tmp, 0);

		afree(tmp, ATEMP);

		strndupx(n, n, p - n, ATEMP);

		evaluate(sub, &rval, KSH_UNWIND_ERROR, true);

		*valp = (uint32_t)rval;

		afree(sub, ATEMP);

	}

	return (n);

}

#define vn vname.ro

/*

 * Search for variable, if not found create globally.

 */

struct tbl *

global(const char *n)

{

	return (isglobal(n, true));

}

/* search for variable; if not found, return NULL or create globally */

struct tbl *

isglobal(const char *n, bool docreate)

{

	struct tbl *vp;

	union mksh_cchack vname;

	struct block *l = e->loc;

	int c;

	bool array;

	uint32_t h, val;

	/*

	 * check to see if this is an array;

	 * dereference namerefs; must come first

	 */

	vn = array_index_calc(n, &array, &val;;

	h = hash(vn);

	c = (unsigned char)vn[0];

	if (!ctype(c, C_ALPHX)) {

		if (array)

			errorf(Tbadsubst);

		vp = vtemp;

		vp->flag = DEFINED;

		vp->type = 0;

		vp->areap = ATEMP;

		if (ctype(c, C_DIGIT)) {

			if (getn(vn, &c)) {

				/* main.c:main_init() says 12 */

				shf_snprintf(vp->name, 12, Tf_d, c);

				if (c <= l->argc) {

					/* setstr can't fail here */

					setstr(vp, l->argv[c],

					    KSH_RETURN_ERROR);

				}

			} else

				vp->name[0] = '\0';

			vp->flag |= RDONLY;

			goto out;

		}

		vp->name[0] = c;

		vp->name[1] = '\0';

		vp->flag |= RDONLY;

		if (vn[1] != '\0')

			goto out;

		vp->flag |= ISSET|INTEGER;

		switch (c) {

		case '$':

			vp->val.i = kshpid;

			break;

		case '!':

			/* if no job, expand to nothing */

			if ((vp->val.i = j_async()) == 0)

				vp->flag &= ~(ISSET|INTEGER);

			break;

		case '?':

			vp->val.i = exstat & 0xFF;

			break;

		case '#':

			vp->val.i = l->argc;

			break;

		case '-':

			vp->flag &= ~INTEGER;

			vp->val.s = getoptions();

			break;

		default:

			vp->flag &= ~(ISSET|INTEGER);

		}

		goto out;

	}

	l = varsearch(e->loc, &vp, vn, h);

	if (vp == NULL && docreate)

		vp = ktenter(&l->vars, vn, h);

	else

		docreate = false;

	if (vp != NULL) {

		if (array)

			vp = arraysearch(vp, val);

		if (docreate) {

			vp->flag |= DEFINED;

			if (special(vn))

				vp->flag |= SPECIAL;

		}

	}

 out:

	last_lookup_was_array = array;

	if (vn != n)

		afree(vname.rw, ATEMP);

	return (vp);

}

/*

 * Search for local variable, if not found create locally.

 */

struct tbl *

local(const char *n, bool copy)

{

	struct tbl *vp;

	union mksh_cchack vname;

	struct block *l = e->loc;

	bool array;

	uint32_t h, val;

	/*

	 * check to see if this is an array;

	 * dereference namerefs; must come first

	 */

	vn = array_index_calc(n, &array, &val;;

	h = hash(vn);

	if (!ctype(*vn, C_ALPHX)) {

		vp = vtemp;

		vp->flag = DEFINED|RDONLY;

		vp->type = 0;

		vp->areap = ATEMP;

		goto out;

	}

	vp = ktenter(&l->vars, vn, h);

	if (copy && !(vp->flag & DEFINED)) {

		struct tbl *vq;

		varsearch(l->next, &vq, vn, h);

		if (vq != NULL) {

			vp->flag |= vq->flag &

			    (EXPORT | INTEGER | RDONLY | LJUST | RJUST |

			    ZEROFIL | LCASEV | UCASEV_AL | INT_U | INT_L);

			if (vq->flag & INTEGER)

				vp->type = vq->type;

			vp->u2.field = vq->u2.field;

		}

	}

	if (array)

		vp = arraysearch(vp, val);

	vp->flag |= DEFINED;

	if (special(vn))

		vp->flag |= SPECIAL;

 out:

	last_lookup_was_array = array;

	if (vn != n)

		afree(vname.rw, ATEMP);

	return (vp);

}

#undef vn

/* get variable string value */

char *

str_val(struct tbl *vp)

{

	char *s;

	if ((vp->flag&SPECIAL))

		getspec(vp);

	if (!(vp->flag&ISSET))

		/* special to dollar() */

		s = null;

	else if (!(vp->flag&INTEGER))

		/* string source */

		s = vp->val.s + vp->type;

	else {

		/* integer source */

		mksh_uari_t n;

		unsigned int base;

		/**

		 * worst case number length is when base == 2:

		 *	1 (minus) + 2 (base, up to 36) + 1 ('#') +

		 *	number of bits in the mksh_uari_t + 1 (NUL)

		 */

		char strbuf[1 + 2 + 1 + 8 * sizeof(mksh_uari_t) + 1];

		const char *digits = (vp->flag & UCASEV_AL) ?

		    digits_uc : digits_lc;

		s = strbuf + sizeof(strbuf);

		if (vp->flag & INT_U)

			n = vp->val.u;

		else

			n = (vp->val.i < 0) ? -vp->val.u : vp->val.u;

		base = (vp->type == 0) ? 10U : (unsigned int)vp->type;

		if (base == 1 && n == 0)

			base = 2;

		if (base == 1) {

			size_t sz = 1;

			*(s = strbuf) = '1';

			s[1] = '#';

			if (!UTFMODE)

				s[2] = (unsigned char)n;

			else if ((n & 0xFF80) == 0xEF80)

				/* OPTU-16 -> raw octet */

				s[2] = asc2rtt(n & 0xFF);

			else

				sz = utf_wctomb(s + 2, n);

			s[2 + sz] = '\0';

		} else {

			*--s = '\0';

			do {

				*--s = digits[n % base];

				n /= base;

			} while (n != 0);

			if (base != 10) {

				*--s = '#';

				*--s = digits[base % 10];

				if (base >= 10)

					*--s = digits[base / 10];

			}

			if (!(vp->flag & INT_U) && vp->val.i < 0)

				*--s = '-';

		}

		if (vp->flag & (RJUST|LJUST))

			/* case already dealt with */

			s = formatstr(vp, s);

		else

			strdupx(s, s, ATEMP);

	}

	return (s);

}

/* set variable to string value */

int

setstr(struct tbl *vq, const char *s, int error_ok)

{

	char *salloc = NULL;

	bool no_ro_check = tobool(error_ok & 0x4);

	error_ok &= ~0x4;

	if ((vq->flag & RDONLY) && !no_ro_check) {

		warningf(true, Tf_ro, vq->name);

		if (!error_ok)

			errorfxz(2);

		return (0);

	}

	if (!(vq->flag&INTEGER)) {

		/* string dest */

		if ((vq->flag&ALLOC)) {

#ifndef MKSH_SMALL

			/* debugging */

			if (s >= vq->val.s &&

			    s <= strnul(vq->val.s)) {

				internal_errorf(

				    "setstr: %s=%s: assigning to self",

				    vq->name, s);

			}

#endif

			afree(vq->val.s, vq->areap);

		}

		vq->flag &= ~(ISSET|ALLOC);

		vq->type = 0;

		if (s && (vq->flag & (UCASEV_AL|LCASEV|LJUST|RJUST)))

			s = salloc = formatstr(vq, s);

		if ((vq->flag&EXPORT))

			exportprep(vq, s);

		else {

			strdupx(vq->val.s, s, vq->areap);

			vq->flag |= ALLOC;

		}

	} else {

		/* integer dest */

		if (!v_evaluate(vq, s, error_ok, true))

			return (0);

	}

	vq->flag |= ISSET;

	if ((vq->flag&SPECIAL))

		setspec(vq);

	afree(salloc, ATEMP);

	return (1);

}

/* set variable to integer */

void

setint(struct tbl *vq, mksh_ari_t n)

{

	if (!(vq->flag&INTEGER)) {

		vtemp->flag = (ISSET|INTEGER);

		vtemp->type = 0;

		vtemp->areap = ATEMP;

		vtemp->val.i = n;

		/* setstr can't fail here */

		setstr(vq, str_val(vtemp), KSH_RETURN_ERROR);

	} else

		vq->val.i = n;

	vq->flag |= ISSET;

	if ((vq->flag&SPECIAL))

		setspec(vq);

}

static int

getint(struct tbl *vp, mksh_ari_u *nump, bool arith)

{

	mksh_uari_t c, num = 0, base = 10;

	const char *s;

	bool have_base = false, neg = false;

	if (vp->flag & SPECIAL)

		getspec(vp);

	/* XXX is it possible for ISSET to be set and val.s to be NULL? */

	if (!(vp->flag & ISSET) || (!(vp->flag & INTEGER) && vp->val.s == NULL))

		return (-1);

	if (vp->flag & INTEGER) {

		nump->i = vp->val.i;

		return (vp->type);

	}

	s = vp->val.s + vp->type;

	do {

		c = (unsigned char)*s++;

	} while (ctype(c, C_SPACE));

	switch (c) {

	case '-':

		neg = true;

		/* FALLTHROUGH */

	case '+':

		c = (unsigned char)*s++;

		break;

	}

	if (c == '0' && arith) {

		if (ksh_eq(s[0], 'X', 'x')) {

			/* interpret as hexadecimal */

			base = 16;

			++s;

			goto getint_c_style_base;

		} else if (Flag(FPOSIX) && ctype(s[0], C_DIGIT) &&

		    !(vp->flag & ZEROFIL)) {

			/* interpret as octal (deprecated) */

			base = 8;

 getint_c_style_base:

			have_base = true;

			c = (unsigned char)*s++;

		}

	}

	do {

		if (c == '#') {

			/* ksh-style base determination */

			if (have_base || num < 1)

				return (-1);

			if ((base = num) == 1) {

				/* mksh-specific extension */

				unsigned int wc;

				if (!UTFMODE)

					wc = *(const unsigned char *)s;

				else if (utf_mbtowc(&wc, s) == (size_t)-1)

					/* OPTU-8 -> OPTU-16 */

					/*

					 * (with a twist: 1#\uEF80 converts

					 * the same as 1#\x80 does, thus is

					 * not round-tripping correctly XXX)

					 */

					wc = 0xEF00 + rtt2asc(*s);

				nump->u = (mksh_uari_t)wc;

				return (1);

			} else if (base > 36)

				base = 10;

			num = 0;

			have_base = true;

			continue;

		}

		if (ctype(c, C_DIGIT))

			c = ksh_numdig(c);

		else if (ctype(c, C_UPPER))

			c = ksh_numuc(c) + 10;

		else if (ctype(c, C_LOWER))

			c = ksh_numlc(c) + 10;

		else

			return (-1);

		if (c >= base)

			return (-1);

		/* handle overflow as truncation */

		num = num * base + c;

	} while ((c = (unsigned char)*s++));

	if (neg)

		num = -num;

	nump->u = num;

	return (base);

}

/*

 * convert variable vq to integer variable, setting its value from vp

 * (vq and vp may be the same)

 */

struct tbl *

setint_v(struct tbl *vq, struct tbl *vp, bool arith)

{

	int base;

	mksh_ari_u num;

	if ((base = getint(vp, &num, arith)) == -1)

		return (NULL);

	setint_n(vq, num.i, 0);

	if (vq->type == 0)

		/* default base */

		vq->type = base;

	return (vq);

}

/* convert variable vq to integer variable, setting its value to num */

void

setint_n(struct tbl *vq, mksh_ari_t num, int newbase)

{

	if (!(vq->flag & INTEGER) && (vq->flag & ALLOC)) {

		vq->flag &= ~ALLOC;

		vq->type = 0;

		afree(vq->val.s, vq->areap);

	}

	vq->val.i = num;

	if (newbase != 0)

		vq->type = newbase;

	vq->flag |= ISSET|INTEGER;

	if (vq->flag&SPECIAL)

		setspec(vq);

}

static char *

formatstr(struct tbl *vp, const char *s)

{

	int olen, nlen;

	char *p, *q;

	size_t psiz;

	olen = (int)utf_mbswidth(s);

	if (vp->flag & (RJUST|LJUST)) {

		if (!vp->u2.field)

			/* default field width */

			vp->u2.field = olen;

		nlen = vp->u2.field;

	} else

		nlen = olen;

	p = alloc((psiz = nlen * /* MB_LEN_MAX */ 3 + 1), ATEMP);

	if (vp->flag & (RJUST|LJUST)) {

		int slen = olen;

		if (vp->flag & RJUST) {

			const char *qq;

			int n = 0;

			qq = utf_skipcols(s, slen, &slen);

			/* strip trailing spaces (AT&T uses qq[-1] == ' ') */

			while (qq > s && ctype(qq[-1], C_SPACE)) {

				--qq;

				--slen;

			}

			if (vp->flag & ZEROFIL && vp->flag & INTEGER) {

				if (!s[0] || !s[1])

					goto uhm_no;

				if (s[1] == '#')

					n = 2;

				else if (s[2] == '#')

					n = 3;

 uhm_no:

				if (vp->u2.field <= n)

					n = 0;

			}

			if (n) {

				memcpy(p, s, n);

				s += n;

			}

			while (slen > vp->u2.field)

				slen -= utf_widthadj(s, &s);

			if (vp->u2.field - slen)

				memset(p + n, (vp->flag & ZEROFIL) ? '0' : ' ',

				    vp->u2.field - slen);

			slen -= n;

			shf_snprintf(p + vp->u2.field - slen,

			    psiz - (vp->u2.field - slen),

			    "%.*s", slen, s);

		} else {

			/* strip leading spaces/zeros */

			while (ctype(*s, C_SPACE))

				s++;

			if (vp->flag & ZEROFIL)

				while (*s == '0')

					s++;

			shf_snprintf(p, nlen + 1, "%-*.*s",

				vp->u2.field, vp->u2.field, s);

		}

	} else

		memcpy(p, s, strlen(s) + 1);

	if (vp->flag & UCASEV_AL) {

		for (q = p; *q; q++)

			*q = ksh_toupper(*q);

	} else if (vp->flag & LCASEV) {

		for (q = p; *q; q++)

			*q = ksh_tolower(*q);

	}

	return (p);

}

/*

 * make vp->val.s be "name=value" for quick exporting.

 */

static void

exportprep(struct tbl *vp, const char *val)

{

	char *xp;

	char *op = (vp->flag&ALLOC) ? vp->val.s : NULL;

	size_t namelen, vallen;

	namelen = strlen(vp->name);

	vallen = strlen(val) + 1;

	vp->flag |= ALLOC;

	/* since name+val are both in memory this can go unchecked */

	xp = alloc(namelen + 1 + vallen, vp->areap);

	memcpy(vp->val.s = xp, vp->name, namelen);

	xp += namelen;

	*xp++ = '=';

	/* offset to value */

	vp->type = xp - vp->val.s;

	memcpy(xp, val, vallen);

	afree(op, vp->areap);

}

/*

 * lookup variable (according to (set&LOCAL)), set its attributes

 * (INTEGER, RDONLY, EXPORT, TRACE, LJUST, RJUST, ZEROFIL, LCASEV,

 * UCASEV_AL), and optionally set its value if an assignment.

 */

struct tbl *

typeset(const char *var, uint32_t set, uint32_t clr, int field, int base)

{

	struct tbl *vp;

	struct tbl *vpbase, *t;

	char *tvar;

	const char *val;

	size_t len;

	bool vappend = false;

	enum namerefflag new_refflag = SRF_NOP;

	if ((set & (ARRAY | ASSOC)) == ASSOC) {

		new_refflag = SRF_ENABLE;

		set &= ~(ARRAY | ASSOC);

	}

	if ((clr & (ARRAY | ASSOC)) == ASSOC) {

		new_refflag = SRF_DISABLE;

		clr &= ~(ARRAY | ASSOC);

	}

	/* check for valid variable name, search for value */

	val = skip_varname(var, false);

	if (val == var) {

		/* no variable name given */

		return (NULL);

	}

	if (ord(*val) == ORD('[')) {

		if (new_refflag != SRF_NOP)

			errorf(Tf_sD_s, var,

			    "reference variable can't be an array");

		len = array_ref_len(val);

		if (len == 0)

			return (NULL);

		/*

		 * IMPORT is only used when the shell starts up and is

		 * setting up its environment. Allow only simple array

		 * references at this time since parameter/command

		 * substitution is performed on the [expression] which

		 * would be a major security hole.

		 */

		if (set & IMPORT) {

			size_t i;

			for (i = 1; i < len - 1; i++)

				if (!ctype(val[i], C_DIGIT))

					return (NULL);

		}

		val += len;

	}

	if (ord(val[0]) == ORD('=')) {

		strndupx(tvar, var, val - var, ATEMP);

		++val;

	} else if (set & IMPORT) {

		/* environment invalid variable name or no assignment */

		return (NULL);

	} else if (ord(val[0]) == ORD('+') && ord(val[1]) == ORD('=')) {

		strndupx(tvar, var, val - var, ATEMP);

		val += 2;

		vappend = true;

	} else if (val[0] != '\0') {

		/* other invalid variable names (not from environment) */

		return (NULL);

	} else {

		/* just varname with no value part nor equals sign */

		strdupx(tvar, var, ATEMP);

		val = NULL;

		/* handle foo[*] => foo (whole array) mapping for R39b */

		len = strlen(tvar);

		if (len > 3 && ord(tvar[len - 3]) == ORD('[') &&

		    ord(tvar[len - 2]) == ORD('*') &&

		    ord(tvar[len - 1]) == ORD(']'))

			tvar[len - 3] = '\0';

	}

	if (new_refflag == SRF_ENABLE) {

		const char *qval, *ccp;

		/* bail out on 'nameref foo+=bar' */

		if (vappend)

			errorf("appending not allowed for nameref");

		/* find value if variable already exists */

		if ((qval = val) == NULL) {

			varsearch(e->loc, &vp, tvar, hash(tvar));

			if (vp == NULL)

				goto nameref_empty;

			qval = str_val(vp);

		}

		/* check target value for being a valid variable name */

		ccp = skip_varname(qval, false);

		if (ccp == qval) {

			int c;

			if (!(c = (unsigned char)qval[0]))

				goto nameref_empty;

			else if (ctype(c, C_DIGIT) && getn(qval, &c))

				goto nameref_rhs_checked;

			else if (qval[1] == '\0') switch (c) {

			case '$':

			case '!':

			case '?':

			case '#':

			case '-':

				goto nameref_rhs_checked;

			}

 nameref_empty:

			errorf(Tf_sD_s, var, "empty nameref target");

		}

		len = (ord(*ccp) == ORD('[')) ? array_ref_len(ccp) : 0;

		if (ccp[len]) {

			/*

			 * works for cases "no array", "valid array with

			 * junk after it" and "invalid array"; in the

			 * latter case, len is also 0 and points to '['

			 */

			errorf(Tf_sD_s, qval,

			    "nameref target not a valid parameter name");

		}

 nameref_rhs_checked:

		/* prevent nameref loops */

		while (qval) {

			if (!strcmp(qval, tvar))

				errorf(Tf_sD_s, qval,

				    "expression recurses on parameter");

			varsearch(e->loc, &vp, qval, hash(qval));