sh: Fix '-' from quoted arithmetic in case/glob pattern range.

It does not make much sense to generate the '-' in a pattern bracket
expression using arithmetic expansion, but it does not make sense to forbid
it either.

Try to avoid reprocessing the string if it is unnecessary.

3 files changed, 20 insertions, 2 deletions

diff --git a/bin/sh/expand.c b/bin/sh/expand.c
index 74bb63e1f67e..3b44d5569a66 100644
--- a/bin/sh/expand.c
+++ b/bin/sh/expand.c
@@ -440,8 +440,15 @@ expari(const char *p, struct nodelist **restrict argbackq, int flag,
 	fmtstr(expdest, DIGITS(result), ARITH_FORMAT_STR, result);
 	adj = strlen(expdest);
 	STADJUST(adj, expdest);
-	if (!quoted)
-		reprocess(expdest - adj - stackblock(), flag, VSNORMAL, 0, dst);
+	/*
+	 * If this is quoted, a '-' must not indicate a range in [...].
+	 * If this is not quoted, splitting may occur.
+	 */
+	if (quoted ?
+	    result < 0 && begoff > 1 && flag & (EXP_GLOB | EXP_CASE) :
+	    flag & EXP_SPLIT)
+		reprocess(expdest - adj - stackblock(), flag, VSNORMAL, quoted,
+		    dst);
 	return p;
 }
 
diff --git a/bin/sh/tests/builtins/Makefile b/bin/sh/tests/builtins/Makefile
index 09aa095ecf0e..620951415c6e 100644
--- a/bin/sh/tests/builtins/Makefile
+++ b/bin/sh/tests/builtins/Makefile
@@ -41,6 +41,7 @@ ${PACKAGE}FILES+=		case18.0
 ${PACKAGE}FILES+=		case19.0
 ${PACKAGE}FILES+=		case20.0
 ${PACKAGE}FILES+=		case21.0
+${PACKAGE}FILES+=		case22.0
 ${PACKAGE}FILES+=		cd1.0
 ${PACKAGE}FILES+=		cd2.0
 ${PACKAGE}FILES+=		cd3.0
diff --git a/bin/sh/tests/builtins/case22.0 b/bin/sh/tests/builtins/case22.0
new file mode 100644
index 000000000000..ddc80051fa0a
--- /dev/null
+++ b/bin/sh/tests/builtins/case22.0
@@ -0,0 +1,10 @@
+# $FreeBSD$
+
+case 5 in
+[0"$((-9))"]) echo bad1 ;;
+esac
+
+case - in
+[0"$((-9))"]) ;;
+*) echo bad2 ;;
+esac