[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openembedded-core
Subject:    Re: [OE-core][hardknott][PATCH V3] busybox: backport patches to fix CVEs
From:       "Chen Qi" <Qi.Chen () windriver ! com>
Date:       2021-12-31 2:06:18
Message-ID: 44ba683a-712c-6ecb-e356-51553df34f13 () windriver ! com
[Download RAW message or body]

[Attachment #2 (text/plain)]

On 12/30/21 11:03 PM, Mittal, Anuj wrote:
> On Tue, 2021-12-28 at 17:44 -0800, Chen Qi wrote:
>> Backport patches to fix the following CVEs:
>> CVE-2021-42373
>> CVE-2021-42378
>> CVE-2021-42379
>> CVE-2021-42380
>> CVE-2021-42381
>> CVE-2021-42382
>> CVE-2021-42383
>> CVE-2021-42384
>> CVE-2021-42385
>> CVE-2021-42386
> This is causing these ptests to fail:
>
> 'busybox': ['awk_break', 'awk_continue'],
>
> Please see:
>
> qemux86-64:
> https://autobuilder.yoctoproject.org/typhoon/#/builders/81/builds/2947
>
> qemuarm64:
> https://autobuilder.yoctoproject.org/typhoon/#/builders/82/builds/2674
>
> Thanks,
>
> Anuj

Sorry. I didn't realize that run-ptest would still give a 0 exit status 
when some tests failed. I'll re-work on this patch.

Regards,

Qi


>> Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
>> ---
>>   .../busybox/busybox/0001-awk-fix-CVEs.patch   | 3142
>> +++++++++++++++++
>>   .../0002-man-fix-segfault-in-man-1.patch      |   30 +
>>   meta/recipes-core/busybox/busybox_1.33.2.bb   |    2 +
>>   3 files changed, 3174 insertions(+)
>>   create mode 100644 meta/recipes-core/busybox/busybox/0001-awk-fix-
>> CVEs.patch
>>   create mode 100644 meta/recipes-core/busybox/busybox/0002-man-fix-
>> segfault-in-man-1.patch
>>
>> diff --git a/meta/recipes-core/busybox/busybox/0001-awk-fix-
>> CVEs.patch b/meta/recipes-core/busybox/busybox/0001-awk-fix-
>> CVEs.patch
>> new file mode 100644
>> index 0000000000..9b7079cbe9
>> --- /dev/null
>> +++ b/meta/recipes-core/busybox/busybox/0001-awk-fix-CVEs.patch
>> @@ -0,0 +1,3142 @@
>> +From 0b313943ee5c6611d32c55c3d16084d04a4c2a6d Mon Sep 17 00:00:00
>> 2001
>> +From: Chen Qi <Qi.Chen@windriver.com>
>> +Date: Mon, 27 Dec 2021 21:25:33 -0800
>> +Subject: [PATCH] awk: fix CVEs
>> +
>> +The awk CVEs is hard to be separated, thus we use the following
>> method
>> +to format the current patch.
>> +git format-patch --stdout 1_33_1..1_34_1 -- editors/awk.c | git am -
>> 3
>> +
>> +CVE: CVE-2021-42378
>> +CVE: CVE-2021-42379
>> +CVE: CVE-2021-42380
>> +CVE: CVE-2021-42381
>> +CVE: CVE-2021-42382
>> +CVE: CVE-2021-42383
>> +CVE: CVE-2021-42384
>> +CVE: CVE-2021-42385
>> +CVE: CVE-2021-42386
>> +
>> +Upstream-Status: Backport
>> +
>> +Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
>> +---
>> + editors/awk.c | 2060 +++++++++++++++++++++++++++++-----------------
>> ---
>> + 1 file changed, 1204 insertions(+), 856 deletions(-)
>> +
>> +diff --git a/editors/awk.c b/editors/awk.c
>> +index 2c15f9e4e..f6314ac72 100644
>> +--- a/editors/awk.c
>> ++++ b/editors/awk.c
>> +@@ -66,6 +66,8 @@
>> + #endif
>> + #ifndef debug_printf_parse
>> + # define debug_printf_parse(...) (fprintf(stderr, __VA_ARGS__))
>> ++#else
>> ++# define debug_parse_print_tc(...) ((void)0)
>> + #endif
>> +
>> +
>> +@@ -91,7 +93,6 @@ enum {
>> + };
>> +
>> + #define       MAXVARFMT       240
>> +-#define       MINNVBLOCK      64
>> +
>> + /* variable flags */
>> + #define       VF_NUMBER       0x0001  /* 1 = primary type is number
>> */
>> +@@ -101,7 +102,7 @@ enum {
>> + #define       VF_USER         0x0200  /* 1 = user input (may be
>> numeric string) */
>> + #define       VF_SPECIAL      0x0400  /* 1 = requires extra
>> handling when changed */
>> + #define       VF_WALK         0x0800  /* 1 = variable has alloc'd
>> x.walker list */
>> +-#define       VF_FSTR         0x1000  /* 1 = var::string points to
>> fstring buffer */
>> ++#define       VF_FSTR         0x1000  /* 1 = don't free()
>> var::string (not malloced, or is owned by something else) */
>> + #define       VF_CHILD        0x2000  /* 1 = function arg; x.parent
>> points to source */
>> + #define       VF_DIRTY        0x4000  /* 1 = variable was set
>> explicitly */
>> +
>> +@@ -118,8 +119,8 @@ typedef struct walker_list {
>> + /* Variable */
>> + typedef struct var_s {
>> +       unsigned type;            /* flags */
>> +-      double number;
>> +       char *string;
>> ++      double number;
>> +       union {
>> +               int aidx;               /* func arg idx (for
>> compilation stage) */
>> +               struct xhash_s *array;  /* array ptr */
>> +@@ -138,6 +139,7 @@ typedef struct chain_s {
>> + /* Function */
>> + typedef struct func_s {
>> +       unsigned nargs;
>> ++      smallint defined;
>> +       struct chain_s body;
>> + } func;
>> +
>> +@@ -177,7 +179,7 @@ typedef struct node_s {
>> +               struct node_s *n;
>> +               var *v;
>> +               int aidx;
>> +-              char *new_progname;
>> ++              const char *new_progname;
>> +               regex_t *re;
>> +       } l;
>> +       union {
>> +@@ -190,91 +192,120 @@ typedef struct node_s {
>> +       } a;
>> + } node;
>> +
>> +-/* Block of temporary variables */
>> +-typedef struct nvblock_s {
>> +-      int size;
>> +-      var *pos;
>> +-      struct nvblock_s *prev;
>> +-      struct nvblock_s *next;
>> +-      var nv[];
>> +-} nvblock;
>> +-
>> + typedef struct tsplitter_s {
>> +       node n;
>> +       regex_t re[2];
>> + } tsplitter;
>> +
>> + /* simple token classes */
>> +-/* Order and hex values are very important!!!  See next_token() */
>> +-#define       TC_SEQSTART     (1 << 0)                /* ( */
>> +-#define       TC_SEQTERM      (1 << 1)                /* ) */
>> +-#define       TC_REGEXP       (1 << 2)                /* /.../ */
>> +-#define       TC_OUTRDR       (1 << 3)                /* | > >> */
>> +-#define       TC_UOPPOST      (1 << 4)                /* unary
>> postfix operator */
>> +-#define       TC_UOPPRE1      (1 << 5)                /* unary
>> prefix operator */
>> +-#define       TC_BINOPX       (1 << 6)                /* two-opnd
>> operator */
>> +-#define       TC_IN           (1 << 7)
>> +-#define       TC_COMMA        (1 << 8)
>> +-#define       TC_PIPE         (1 << 9)                /* input
>> redirection pipe */
>> +-#define       TC_UOPPRE2      (1 << 10)               /* unary
>> prefix operator */
>> +-#define       TC_ARRTERM      (1 << 11)               /* ] */
>> +-#define       TC_GRPSTART     (1 << 12)               /* { */
>> +-#define       TC_GRPTERM      (1 << 13)               /* } */
>> +-#define       TC_SEMICOL      (1 << 14)
>> +-#define       TC_NEWLINE      (1 << 15)
>> +-#define       TC_STATX        (1 << 16)               /* ctl
>> statement (for, next...) */
>> +-#define       TC_WHILE        (1 << 17)
>> +-#define       TC_ELSE         (1 << 18)
>> +-#define       TC_BUILTIN      (1 << 19)
>> ++/* order and hex values are very important!!!  See next_token() */
>> ++#define TC_LPAREN       (1 << 0)        /* ( */
>> ++#define TC_RPAREN       (1 << 1)        /* ) */
>> ++#define TC_REGEXP       (1 << 2)        /* /.../ */
>> ++#define TC_OUTRDR       (1 << 3)        /* | > >> */
>> ++#define TC_UOPPOST      (1 << 4)        /* unary postfix operator
>> ++ -- */
>> ++#define TC_UOPPRE1      (1 << 5)        /* unary prefix operator ++
>> -- $ */
>> ++#define TC_BINOPX       (1 << 6)        /* two-opnd operator */
>> ++#define TC_IN           (1 << 7)        /* 'in' */
>> ++#define TC_COMMA        (1 << 8)        /* , */
>> ++#define TC_PIPE         (1 << 9)        /* input redirection pipe |
>> */
>> ++#define TC_UOPPRE2      (1 << 10)       /* unary prefix operator +
>> - ! */
>> ++#define TC_ARRTERM      (1 << 11)       /* ] */
>> ++#define TC_LBRACE       (1 << 12)       /* { */
>> ++#define TC_RBRACE       (1 << 13)       /* } */
>> ++#define TC_SEMICOL      (1 << 14)       /* ; */
>> ++#define TC_NEWLINE      (1 << 15)
>> ++#define TC_STATX        (1 << 16)       /* ctl statement (for,
>> next...) */
>> ++#define TC_WHILE        (1 << 17)       /* 'while' */
>> ++#define TC_ELSE         (1 << 18)       /* 'else' */
>> ++#define TC_BUILTIN      (1 << 19)
>> + /* This costs ~50 bytes of code.
>> +  * A separate class to support deprecated "length" form. If we
>> don't need that
>> +  * (i.e. if we demand that only "length()" with () is valid), then
>> TC_LENGTH
>> +  * can be merged with TC_BUILTIN:
>> +  */
>> +-#define       TC_LENGTH       (1 << 20)
>> +-#define       TC_GETLINE      (1 << 21)
>> +-#define       TC_FUNCDECL     (1 << 22)               /* 'function'
>> 'func' */
>> +-#define       TC_BEGIN        (1 << 23)
>> +-#define       TC_END          (1 << 24)
>> +-#define       TC_EOF          (1 << 25)
>> +-#define       TC_VARIABLE     (1 << 26)
>> +-#define       TC_ARRAY        (1 << 27)
>> +-#define       TC_FUNCTION     (1 << 28)
>> +-#define       TC_STRING       (1 << 29)
>> +-#define       TC_NUMBER       (1 << 30)
>> +-
>> +-#define       TC_UOPPRE  (TC_UOPPRE1 | TC_UOPPRE2)
>> +-
>> +-/* combined token classes */
>> +-#define       TC_BINOP   (TC_BINOPX | TC_COMMA | TC_PIPE | TC_IN)
>> +-//#define     TC_UNARYOP (TC_UOPPRE | TC_UOPPOST)
>> +-#define       TC_OPERAND (TC_VARIABLE | TC_ARRAY | TC_FUNCTION \
>> +-                   | TC_BUILTIN | TC_LENGTH | TC_GETLINE \
>> +-                   | TC_SEQSTART | TC_STRING | TC_NUMBER)
>> +-
>> +-#define       TC_STATEMNT (TC_STATX | TC_WHILE)
>> +-#define       TC_OPTERM  (TC_SEMICOL | TC_NEWLINE)
>> ++#define TC_LENGTH       (1 << 20)       /* 'length' */
>> ++#define TC_GETLINE      (1 << 21)       /* 'getline' */
>> ++#define TC_FUNCDECL     (1 << 22)       /* 'function' 'func' */
>> ++#define TC_BEGIN        (1 << 23)       /* 'BEGIN' */
>> ++#define TC_END          (1 << 24)       /* 'END' */
>> ++#define TC_EOF          (1 << 25)
>> ++#define TC_VARIABLE     (1 << 26)       /* name */
>> ++#define TC_ARRAY        (1 << 27)       /* name[ */
>> ++#define TC_FUNCTION     (1 << 28)       /* name( */
>> ++#define TC_STRING       (1 << 29)       /* "..." */
>> ++#define TC_NUMBER       (1 << 30)
>> ++
>> ++#ifndef debug_parse_print_tc
>> ++static void debug_parse_print_tc(uint32_t n)
>> ++{
>> ++      if (n & TC_LPAREN  ) debug_printf_parse(" LPAREN"  );
>> ++      if (n & TC_RPAREN  ) debug_printf_parse(" RPAREN"  );
>> ++      if (n & TC_REGEXP  ) debug_printf_parse(" REGEXP"  );
>> ++      if (n & TC_OUTRDR  ) debug_printf_parse(" OUTRDR"  );
>> ++      if (n & TC_UOPPOST ) debug_printf_parse(" UOPPOST" );
>> ++      if (n & TC_UOPPRE1 ) debug_printf_parse(" UOPPRE1" );
>> ++      if (n & TC_BINOPX  ) debug_printf_parse(" BINOPX"  );
>> ++      if (n & TC_IN      ) debug_printf_parse(" IN"      );
>> ++      if (n & TC_COMMA   ) debug_printf_parse(" COMMA"   );
>> ++      if (n & TC_PIPE    ) debug_printf_parse(" PIPE"    );
>> ++      if (n & TC_UOPPRE2 ) debug_printf_parse(" UOPPRE2" );
>> ++      if (n & TC_ARRTERM ) debug_printf_parse(" ARRTERM" );
>> ++      if (n & TC_LBRACE  ) debug_printf_parse(" LBRACE"  );
>> ++      if (n & TC_RBRACE  ) debug_printf_parse(" RBRACE"  );
>> ++      if (n & TC_SEMICOL ) debug_printf_parse(" SEMICOL" );
>> ++      if (n & TC_NEWLINE ) debug_printf_parse(" NEWLINE" );
>> ++      if (n & TC_STATX   ) debug_printf_parse(" STATX"   );
>> ++      if (n & TC_WHILE   ) debug_printf_parse(" WHILE"   );
>> ++      if (n & TC_ELSE    ) debug_printf_parse(" ELSE"    );
>> ++      if (n & TC_BUILTIN ) debug_printf_parse(" BUILTIN" );
>> ++      if (n & TC_LENGTH  ) debug_printf_parse(" LENGTH"  );
>> ++      if (n & TC_GETLINE ) debug_printf_parse(" GETLINE" );
>> ++      if (n & TC_FUNCDECL) debug_printf_parse(" FUNCDECL");
>> ++      if (n & TC_BEGIN   ) debug_printf_parse(" BEGIN"   );
>> ++      if (n & TC_END     ) debug_printf_parse(" END"     );
>> ++      if (n & TC_EOF     ) debug_printf_parse(" EOF"     );
>> ++      if (n & TC_VARIABLE) debug_printf_parse(" VARIABLE");
>> ++      if (n & TC_ARRAY   ) debug_printf_parse(" ARRAY"   );
>> ++      if (n & TC_FUNCTION) debug_printf_parse(" FUNCTION");
>> ++      if (n & TC_STRING  ) debug_printf_parse(" STRING"  );
>> ++      if (n & TC_NUMBER  ) debug_printf_parse(" NUMBER"  );
>> ++}
>> ++#endif
>> ++
>> ++/* combined token classes ("token [class] sets") */
>> ++#define       TS_UOPPRE   (TC_UOPPRE1 | TC_UOPPRE2)
>> ++
>> ++#define       TS_BINOP    (TC_BINOPX | TC_COMMA | TC_PIPE | TC_IN)
>> ++//#define TS_UNARYOP (TS_UOPPRE | TC_UOPPOST)
>> ++#define       TS_OPERAND  (TC_VARIABLE | TC_ARRAY | TC_FUNCTION \
>> ++                    | TC_BUILTIN | TC_LENGTH | TC_GETLINE \
>> ++                    | TC_LPAREN | TC_STRING | TC_NUMBER)
>> ++
>> ++#define       TS_LVALUE   (TC_VARIABLE | TC_ARRAY)
>> ++#define       TS_STATEMNT (TC_STATX | TC_WHILE)
>> +
>> + /* word tokens, cannot mean something else if not expected */
>> +-#define       TC_WORD    (TC_IN | TC_STATEMNT | TC_ELSE \
>> +-                   | TC_BUILTIN | TC_LENGTH | TC_GETLINE \
>> +-                   | TC_FUNCDECL | TC_BEGIN | TC_END)
>> ++#define       TS_WORD     (TC_IN | TS_STATEMNT | TC_ELSE \
>> ++                    | TC_BUILTIN | TC_LENGTH | TC_GETLINE \
>> ++                    | TC_FUNCDECL | TC_BEGIN | TC_END)
>> +
>> + /* discard newlines after these */
>> +-#define       TC_NOTERM  (TC_COMMA | TC_GRPSTART | TC_GRPTERM \
>> +-                   | TC_BINOP | TC_OPTERM)
>> ++#define       TS_NOTERM   (TS_BINOP | TC_COMMA | TC_LBRACE |
>> TC_RBRACE \
>> ++                    | TC_SEMICOL | TC_NEWLINE)
>> +
>> + /* what can expression begin with */
>> +-#define       TC_OPSEQ   (TC_OPERAND | TC_UOPPRE | TC_REGEXP)
>> ++#define       TS_OPSEQ    (TS_OPERAND | TS_UOPPRE | TC_REGEXP)
>> + /* what can group begin with */
>> +-#define       TC_GRPSEQ  (TC_OPSEQ | TC_OPTERM | TC_STATEMNT |
>> TC_GRPSTART)
>> ++#define       TS_GRPSEQ   (TS_OPSEQ | TS_STATEMNT \
>> ++                    | TC_SEMICOL | TC_NEWLINE | TC_LBRACE)
>> +
>> +-/* if previous token class is CONCAT1 and next is CONCAT2,
>> concatenation */
>> ++/* if previous token class is CONCAT_L and next is CONCAT_R,
>> concatenation */
>> + /* operator is inserted between them */
>> +-#define       TC_CONCAT1 (TC_VARIABLE | TC_ARRTERM | TC_SEQTERM \
>> ++#define       TS_CONCAT_L (TC_VARIABLE | TC_ARRTERM | TC_RPAREN \
>> +                    | TC_STRING | TC_NUMBER | TC_UOPPOST \
>> +                    | TC_LENGTH)
>> +-#define       TC_CONCAT2 (TC_OPERAND | TC_UOPPRE)
>> ++#define       TS_CONCAT_R (TS_OPERAND | TS_UOPPRE)
>> +
>> + #define       OF_RES1     0x010000
>> + #define       OF_RES2     0x020000
>> +@@ -284,13 +315,12 @@ typedef struct tsplitter_s {
>> + #define       OF_CHECKED  0x200000
>> + #define       OF_REQUIRED 0x400000
>> +
>> +-
>> + /* combined operator flags */
>> + #define       xx      0
>> + #define       xV      OF_RES2
>> + #define       xS      (OF_RES2 | OF_STR2)
>> + #define       Vx      OF_RES1
>> +-#define       Rx      (OF_RES1 | OF_NUM1 | OF_REQUIRED)
>> ++#define       Rx      OF_REQUIRED
>> + #define       VV      (OF_RES1 | OF_RES2)
>> + #define       Nx      (OF_RES1 | OF_NUM1)
>> + #define       NV      (OF_RES1 | OF_NUM1 | OF_RES2)
>> +@@ -302,8 +332,7 @@ typedef struct tsplitter_s {
>> + #define       OPNMASK   0x007F
>> +
>> + /* operator priority is a highest byte (even: r->l, odd: l->r
>> grouping)
>> +- * For builtins it has different meaning: n n s3 s2 s1 v3 v2 v1,
>> +- * n - min. number of args, vN - resolve Nth arg to var, sN -
>> resolve to string
>> ++ * (for builtins it has different meaning)
>> +  */
>> + #undef P
>> + #undef PRIMASK
>> +@@ -313,10 +342,8 @@ typedef struct tsplitter_s {
>> + #define PRIMASK2  0x7E000000
>> +
>> + /* Operation classes */
>> +-
>> + #define       SHIFT_TIL_THIS  0x0600
>> + #define       RECUR_FROM_THIS 0x1000
>> +-
>> + enum {
>> +       OC_DELETE = 0x0100,     OC_EXEC = 0x0200,       OC_NEWSOURCE
>> = 0x0300,
>> +       OC_PRINT = 0x0400,      OC_PRINTF = 0x0500,     OC_WALKINIT =
>> 0x0600,
>> +@@ -358,8 +385,8 @@ enum {
>> + #define NTCC    '\377'
>> +
>> + static const char tokenlist[] ALIGN1 =
>> +-      "\1("         NTC                                   /*
>> TC_SEQSTART */
>> +-      "\1)"         NTC                                   /*
>> TC_SEQTERM */
>> ++      "\1("         NTC                                   /*
>> TC_LPAREN */
>> ++      "\1)"         NTC                                   /*
>> TC_RPAREN */
>> +       "\1/"         NTC                                   /*
>> TC_REGEXP */
>> +       "\2>>"        "\1>"         "\1|"       NTC         /*
>> TC_OUTRDR */
>> +       "\2++"        "\2--"        NTC                     /*
>> TC_UOPPOST */
>> +@@ -376,8 +403,8 @@ static const char tokenlist[] ALIGN1 =
>> +       "\1|"         NTC                                   /*
>> TC_PIPE */
>> +       "\1+"         "\1-"         "\1!"       NTC         /*
>> TC_UOPPRE2 */
>> +       "\1]"         NTC                                   /*
>> TC_ARRTERM */
>> +-      "\1{"         NTC                                   /*
>> TC_GRPSTART */
>> +-      "\1}"         NTC                                   /*
>> TC_GRPTERM */
>> ++      "\1{"         NTC                                   /*
>> TC_LBRACE */
>> ++      "\1}"         NTC                                   /*
>> TC_RBRACE */
>> +       "\1;"         NTC                                   /*
>> TC_SEMICOL */
>> +       "\1\n"        NTC                                   /*
>> TC_NEWLINE */
>> +       "\2if"        "\2do"        "\3for"     "\5break"   /*
>> TC_STATX */
>> +@@ -391,7 +418,7 @@ static const char tokenlist[] ALIGN1 =
>> +       "\5close"     "\6system"    "\6fflush"  "\5atan2"
>> +       "\3cos"       "\3exp"       "\3int"     "\3log"
>> +       "\4rand"      "\3sin"       "\4sqrt"    "\5srand"
>> +-      "\6gensub"    "\4gsub"      "\5index"   /* "\6length" was
>> here */
>> ++      "\6gensub"    "\4gsub"      "\5index"   /* "\6length" was
>> here */
>> +       "\5match"     "\5split"     "\7sprintf" "\3sub"
>> +       "\6substr"    "\7systime"   "\10strftime" "\6mktime"
>> +       "\7tolower"   "\7toupper"   NTC
>> +@@ -403,25 +430,32 @@ static const char tokenlist[] ALIGN1 =
>> +       /* compiler adds trailing "\0" */
>> +       ;
>> +
>> +-#define OC_B  OC_BUILTIN
>> +-
>> + static const uint32_t tokeninfo[] ALIGN4 = {
>> +       0,
>> +       0,
>> +-      OC_REGEXP,
>> ++#define TI_REGEXP OC_REGEXP
>> ++      TI_REGEXP,
>> +       xS|'a',                  xS|'w',                  xS|'|',
>> +       OC_UNARY|xV|P(9)|'p',    OC_UNARY|xV|P(9)|'m',
>> +-      OC_UNARY|xV|P(9)|'P',    OC_UNARY|xV|P(9)|'M',
>> OC_FIELD|xV|P(5),
>> ++#define TI_PREINC (OC_UNARY|xV|P(9)|'P')
>> ++#define TI_PREDEC (OC_UNARY|xV|P(9)|'M')
>> ++      TI_PREINC,               TI_PREDEC,
>> OC_FIELD|xV|P(5),
>> +       OC_COMPARE|VV|P(39)|5,   OC_MOVE|VV|P(74),
>> OC_REPLACE|NV|P(74)|'+', OC_REPLACE|NV|P(74)|'-',
>> +       OC_REPLACE|NV|P(74)|'*', OC_REPLACE|NV|P(74)|'/',
>> OC_REPLACE|NV|P(74)|'%', OC_REPLACE|NV|P(74)|'&',
>> +       OC_BINARY|NV|P(29)|'+',  OC_BINARY|NV|P(29)|'-',
>> OC_REPLACE|NV|P(74)|'&', OC_BINARY|NV|P(15)|'&',
>> +       OC_BINARY|NV|P(25)|'/',  OC_BINARY|NV|P(25)|'%',
>> OC_BINARY|NV|P(15)|'&',  OC_BINARY|NV|P(25)|'*',
>> +       OC_COMPARE|VV|P(39)|4,   OC_COMPARE|VV|P(39)|3,
>> OC_COMPARE|VV|P(39)|0,   OC_COMPARE|VV|P(39)|1,
>> +-      OC_COMPARE|VV|P(39)|2,   OC_MATCH|Sx|P(45)|'!',
>> OC_MATCH|Sx|P(45)|'~',   OC_LAND|Vx|P(55),
>> +-      OC_LOR|Vx|P(59),         OC_TERNARY|Vx|P(64)|'?',
>> OC_COLON|xx|P(67)|':',
>> +-      OC_IN|SV|P(49), /* TC_IN */
>> +-      OC_COMMA|SS|P(80),
>> +-      OC_PGETLINE|SV|P(37),
>> ++#define TI_LESS     (OC_COMPARE|VV|P(39)|2)
>> ++      TI_LESS,                 OC_MATCH|Sx|P(45)|'!',
>> OC_MATCH|Sx|P(45)|'~',   OC_LAND|Vx|P(55),
>> ++#define TI_TERNARY  (OC_TERNARY|Vx|P(64)|'?')
>> ++#define TI_COLON    (OC_COLON|xx|P(67)|':')
>> ++      OC_LOR|Vx|P(59),         TI_TERNARY,              TI_COLON,
>> ++#define TI_IN       (OC_IN|SV|P(49))
>> ++      TI_IN,
>> ++#define TI_COMMA    (OC_COMMA|SS|P(80))
>> ++      TI_COMMA,
>> ++#define TI_PGETLINE (OC_PGETLINE|SV|P(37))
>> ++      TI_PGETLINE,
>> +       OC_UNARY|xV|P(19)|'+',   OC_UNARY|xV|P(19)|'-',
>> OC_UNARY|xV|P(19)|'!',
>> +       0, /* ] */
>> +       0,
>> +@@ -434,20 +468,45 @@ static const uint32_t tokeninfo[] ALIGN4 = {
>> +       OC_RETURN|Vx, OC_EXIT|Nx,
>> +       ST_WHILE,
>> +       0, /* else */
>> +-      OC_B|B_an|P(0x83), OC_B|B_co|P(0x41), OC_B|B_ls|P(0x83),
>> OC_B|B_or|P(0x83),
>> +-      OC_B|B_rs|P(0x83), OC_B|B_xo|P(0x83),
>> +-      OC_FBLTIN|Sx|F_cl, OC_FBLTIN|Sx|F_sy, OC_FBLTIN|Sx|F_ff,
>> OC_B|B_a2|P(0x83),
>> +-      OC_FBLTIN|Nx|F_co, OC_FBLTIN|Nx|F_ex, OC_FBLTIN|Nx|F_in,
>> OC_FBLTIN|Nx|F_lg,
>> +-      OC_FBLTIN|F_rn,    OC_FBLTIN|Nx|F_si, OC_FBLTIN|Nx|F_sq,
>> OC_FBLTIN|Nx|F_sr,
>> +-      OC_B|B_ge|P(0xd6), OC_B|B_gs|P(0xb6), OC_B|B_ix|P(0x9b), /*
>> OC_FBLTIN|Sx|F_le, was here */
>> +-      OC_B|B_ma|P(0x89), OC_B|B_sp|P(0x8b), OC_SPRINTF,
>> OC_B|B_su|P(0xb6),
>> +-      OC_B|B_ss|P(0x8f), OC_FBLTIN|F_ti,    OC_B|B_ti|P(0x0b),
>> OC_B|B_mt|P(0x0b),
>> +-      OC_B|B_lo|P(0x49), OC_B|B_up|P(0x49),
>> +-      OC_FBLTIN|Sx|F_le, /* TC_LENGTH */
>> +-      OC_GETLINE|SV|P(0),
>> +-      0,                 0,
>> +-      0,
>> +-      0 /* TC_END */
>> ++// OC_B's are builtins with enforced minimum number of arguments
>> (two upper bits).
>> ++//  Highest byte bit pattern: nn s3s2s1 v3v2v1
>> ++//  nn - min. number of args, sN - resolve Nth arg to string, vN -
>> resolve to var
>> ++// OC_F's are builtins with zero or one argument.
>> ++//  |Rx| enforces that arg is present for: system, close, cos, sin,
>> exp, int, log, sqrt
>> ++//  Check for no args is present in builtins' code (not in this
>> table): rand, systime
>> ++//  Have one _optional_ arg: fflush, srand, length
>> ++#define OC_B   OC_BUILTIN
>> ++#define OC_F   OC_FBLTIN
>> ++#define A1     P(0x40) /*one arg*/
>> ++#define A2     P(0x80) /*two args*/
>> ++#define A3     P(0xc0) /*three args*/
>> ++#define __v    P(1)
>> ++#define _vv    P(3)
>> ++#define __s__v P(9)
>> ++#define __s_vv P(0x0b)
>> ++#define __svvv P(0x0f)
>> ++#define _ss_vv P(0x1b)
>> ++#define _s_vv_ P(0x16)
>> ++#define ss_vv_ P(0x36)
>> ++      OC_B|B_an|_vv|A2,   OC_B|B_co|__v|A1,   OC_B|B_ls|_vv|A2,
>> OC_B|B_or|_vv|A2,   // and    compl   lshift   or
>> ++      OC_B|B_rs|_vv|A2,
>> OC_B|B_xo|_vv|A2,                                           // rshift
>> xor
>> ++      OC_F|F_cl|Sx|Rx,    OC_F|F_sy|Sx|Rx,    OC_F|F_ff|Sx,
>> OC_B|B_a2|_vv|A2,   // close  system  fflush   atan2
>> ++      OC_F|F_co|Nx|Rx,    OC_F|F_ex|Nx|Rx,    OC_F|F_in|Nx|Rx,
>> OC_F|F_lg|Nx|Rx,    // cos    exp     int      log
>> ++      OC_F|F_rn,          OC_F|F_si|Nx|Rx,    OC_F|F_sq|Nx|Rx,
>> OC_F|F_sr|Nx,       // rand   sin     sqrt     srand
>> ++      OC_B|B_ge|_s_vv_|A3,OC_B|B_gs|ss_vv_|A2,OC_B|B_ix|_ss_vv|A2,
>>                     // gensub gsub    index  /*length was here*/
>> ++      OC_B|B_ma|__s__v|A2,OC_B|B_sp|__s_vv|A2,OC_SPRINTF,
>> OC_B|B_su|ss_vv_|A2,// match  split   sprintf  sub
>> ++      OC_B|B_ss|__svvv|A2,OC_F|F_ti,          OC_B|B_ti|__s_vv,
>> OC_B|B_mt|__s_vv,   // substr systime strftime mktime
>> ++      OC_B|B_lo|__s__v|A1,OC_B|B_up|__s__v|A1,
>>                     // tolower toupper
>> ++      OC_F|F_le|Sx,   // length
>> ++      OC_GETLINE|SV,  // getline
>> ++      0, 0, // func function
>> ++      0, // BEGIN
>> ++      0  // END
>> ++#undef A1
>> ++#undef A2
>> ++#undef A3
>> ++#undef OC_B
>> ++#undef OC_F
>> + };
>> +
>> + /* internal variable names and their initial values       */
>> +@@ -488,21 +547,29 @@ struct globals {
>> +       chain *seq;
>> +       node *break_ptr, *continue_ptr;
>> +       rstream *iF;
>> +-      xhash *vhash, *ahash, *fdhash, *fnhash;
>> ++      xhash *ahash;  /* argument names, used only while parsing
>> function bodies */
>> ++      xhash *fnhash; /* function names, used only in parsing stage
>> */
>> ++      xhash *vhash;  /* variables and arrays */
>> ++      //xhash *fdhash; /* file objects, used only in execution
>> stage */
>> ++      //we are reusing ahash as fdhash, via define (see later)
>> +       const char *g_progname;
>> +       int g_lineno;
>> +       int nfields;
>> +       int maxfields; /* used in fsrealloc() only */
>> +       var *Fields;
>> +-      nvblock *g_cb;
>> +       char *g_pos;
>> +-      char *g_buf;
>> ++      char g_saved_ch;
>> +       smallint icase;
>> +       smallint exiting;
>> +       smallint nextrec;
>> +       smallint nextfile;
>> +       smallint is_f0_split;
>> +       smallint t_rollback;
>> ++
>> ++      /* former statics from various functions */
>> ++      smallint next_token__concat_inserted;
>> ++      uint32_t next_token__save_tclass;
>> ++      uint32_t next_token__save_info;
>> + };
>> + struct globals2 {
>> +       uint32_t t_info; /* often used */
>> +@@ -515,32 +582,35 @@ struct globals2 {
>> +       /* former statics from various functions */
>> +       char *split_f0__fstrings;
>> +
>> +-      uint32_t next_token__save_tclass;
>> +-      uint32_t next_token__save_info;
>> +-      uint32_t next_token__ltclass;
>> +-      smallint next_token__concat_inserted;
>> +-
>> +-      smallint next_input_file__files_happen;
>> +       rstream next_input_file__rsm;
>> ++      smallint next_input_file__files_happen;
>> ++
>> ++      smalluint exitcode;
>> +
>> +-      var *evaluate__fnargs;
>> +       unsigned evaluate__seed;
>> ++      var *evaluate__fnargs;
>> +       regex_t evaluate__sreg;
>> +
>> +-      var ptest__v;
>> ++      var ptest__tmpvar;
>> ++      var awk_printf__tmpvar;
>> ++      var as_regex__tmpvar;
>> ++      var exit__tmpvar;
>> ++      var main__tmpvar;
>> +
>> +       tsplitter exec_builtin__tspl;
>> +
>> +       /* biggest and least used members go last */
>> +       tsplitter fsplitter, rsplitter;
>> ++
>> ++      char g_buf[MAXVARFMT + 1];
>> + };
>> + #define G1 (ptr_to_globals[-1])
>> + #define G (*(struct globals2 *)ptr_to_globals)
>> + /* For debug. nm --size-sort awk.o | grep -vi ' [tr] ' */
>> +-/*char G1size[sizeof(G1)]; - 0x74 */
>> +-/*char Gsize[sizeof(G)]; - 0x1c4 */
>> ++//char G1size[sizeof(G1)]; // 0x70
>> ++//char Gsize[sizeof(G)]; // 0x2f8
>> + /* Trying to keep most of members accessible with short offsets: */
>> +-/*char Gofs_seed[offsetof(struct globals2, evaluate__seed)]; - 0x90
>> */
>> ++//char Gofs_seed[offsetof(struct globals2, evaluate__seed)]; //
>> 0x7c
>> + #define t_double     (G1.t_double    )
>> + #define beginseq     (G1.beginseq    )
>> + #define mainseq      (G1.mainseq     )
>> +@@ -549,18 +619,20 @@ struct globals2 {
>> + #define break_ptr    (G1.break_ptr   )
>> + #define continue_ptr (G1.continue_ptr)
>> + #define iF           (G1.iF          )
>> +-#define vhash        (G1.vhash       )
>> + #define ahash        (G1.ahash       )
>> +-#define fdhash       (G1.fdhash      )
>> + #define fnhash       (G1.fnhash      )
>> ++#define vhash        (G1.vhash       )
>> ++#define fdhash       ahash
>> ++//^^^^^^^^^^^^^^^^^^ ahash is cleared after every function parsing,
>> ++// and ends up empty after parsing phase. Thus, we can simply reuse
>> it
>> ++// for fdhash in execution stage.
>> + #define g_progname   (G1.g_progname  )
>> + #define g_lineno     (G1.g_lineno    )
>> + #define nfields      (G1.nfields     )
>> + #define maxfields    (G1.maxfields   )
>> + #define Fields       (G1.Fields      )
>> +-#define g_cb         (G1.g_cb        )
>> + #define g_pos        (G1.g_pos       )
>> +-#define g_buf        (G1.g_buf       )
>> ++#define g_saved_ch   (G1.g_saved_ch  )
>> + #define icase        (G1.icase       )
>> + #define exiting      (G1.exiting     )
>> + #define nextrec      (G1.nextrec     )
>> +@@ -574,25 +646,13 @@ struct globals2 {
>> + #define intvar       (G.intvar      )
>> + #define fsplitter    (G.fsplitter   )
>> + #define rsplitter    (G.rsplitter   )
>> ++#define g_buf        (G.g_buf       )
>> + #define INIT_G() do { \
>> +       SET_PTR_TO_GLOBALS((char*)xzalloc(sizeof(G1)+sizeof(G)) +
>> sizeof(G1)); \
>> +-      G.next_token__ltclass = TC_OPTERM; \
>> ++      t_tclass = TC_NEWLINE; \
>> +       G.evaluate__seed = 1; \
>> + } while (0)
>> +
>> +-
>> +-/* function prototypes */
>> +-static void handle_special(var *);
>> +-static node *parse_expr(uint32_t);
>> +-static void chain_group(void);
>> +-static var *evaluate(node *, var *);
>> +-static rstream *next_input_file(void);
>> +-static int fmt_num(char *, int, const char *, double, int);
>> +-static int awk_exit(int) NORETURN;
>> +-
>> +-/* ---- error handling ---- */
>> +-
>> +-static const char EMSG_INTERNAL_ERROR[] ALIGN1 = "Internal error";
>> + static const char EMSG_UNEXP_EOS[] ALIGN1 = "Unexpected end of
>> string";
>> + static const char EMSG_UNEXP_TOKEN[] ALIGN1 = "Unexpected token";
>> + static const char EMSG_DIV_BY_ZERO[] ALIGN1 = "Division by zero";
>> +@@ -604,10 +664,7 @@ static const char EMSG_UNDEF_FUNC[] ALIGN1 =
>> "Call to undefined function";
>> + static const char EMSG_NO_MATH[] ALIGN1 = "Math support is not
>> compiled in";
>> + static const char EMSG_NEGATIVE_FIELD[] ALIGN1 = "Access to
>> negative field";
>> +
>> +-static void zero_out_var(var *vp)
>> +-{
>> +-      memset(vp, 0, sizeof(*vp));
>> +-}
>> ++static int awk_exit(void) NORETURN;
>> +
>> + static void syntax_error(const char *message) NORETURN;
>> + static void syntax_error(const char *message)
>> +@@ -638,12 +695,40 @@ static xhash *hash_init(void)
>> +       return newhash;
>> + }
>> +
>> ++static void hash_clear(xhash *hash)
>> ++{
>> ++      unsigned i;
>> ++      hash_item *hi, *thi;
>> ++
>> ++      for (i = 0; i < hash->csize; i++) {
>> ++              hi = hash->items[i];
>> ++              while (hi) {
>> ++                      thi = hi;
>> ++                      hi = hi->next;
>> ++//FIXME: this assumes that it's a hash of *variables*:
>> ++                      free(thi->data.v.string);
>> ++                      free(thi);
>> ++              }
>> ++              hash->items[i] = NULL;
>> ++      }
>> ++      hash->glen = hash->nel = 0;
>> ++}
>> ++
>> ++#if 0 //UNUSED
>> ++static void hash_free(xhash *hash)
>> ++{
>> ++      hash_clear(hash);
>> ++      free(hash->items);
>> ++      free(hash);
>> ++}
>> ++#endif
>> ++
>> + /* find item in hash, return ptr to data, NULL if not found */
>> +-static void *hash_search(xhash *hash, const char *name)
>> ++static NOINLINE void *hash_search3(xhash *hash, const char *name,
>> unsigned idx)
>> + {
>> +       hash_item *hi;
>> +
>> +-      hi = hash->items[hashidx(name) % hash->csize];
>> ++      hi = hash->items[idx % hash->csize];
>> +       while (hi) {
>> +               if (strcmp(hi->name, name) == 0)
>> +                       return &hi->data;
>> +@@ -652,6 +737,11 @@ static void *hash_search(xhash *hash, const
>> char *name)
>> +       return NULL;
>> + }
>> +
>> ++static void *hash_search(xhash *hash, const char *name)
>> ++{
>> ++      return hash_search3(hash, name, hashidx(name));
>> ++}
>> ++
>> + /* grow hash if it becomes too big */
>> + static void hash_rebuild(xhash *hash)
>> + {
>> +@@ -687,16 +777,17 @@ static void *hash_find(xhash *hash, const char
>> *name)
>> +       unsigned idx;
>> +       int l;
>> +
>> +-      hi = hash_search(hash, name);
>> ++      idx = hashidx(name);
>> ++      hi = hash_search3(hash, name, idx);
>> +       if (!hi) {
>> +-              if (++hash->nel / hash->csize > 10)
>> ++              if (++hash->nel > hash->csize * 8)
>> +                       hash_rebuild(hash);
>> +
>> +               l = strlen(name) + 1;
>> +               hi = xzalloc(sizeof(*hi) + l);
>> +               strcpy(hi->name, name);
>> +
>> +-              idx = hashidx(name) % hash->csize;
>> ++              idx = idx % hash->csize;
>> +               hi->next = hash->items[idx];
>> +               hash->items[idx] = hi;
>> +               hash->glen += l;
>> +@@ -731,7 +822,7 @@ static void hash_remove(xhash *hash, const char
>> *name)
>> +
>> + static char *skip_spaces(char *p)
>> + {
>> +-      while (1) {
>> ++      for (;;) {
>> +               if (*p == '\\' && p[1] == '\n') {
>> +                       p++;
>> +                       t_lineno++;
>> +@@ -747,8 +838,10 @@ static char *skip_spaces(char *p)
>> + static char *nextword(char **s)
>> + {
>> +       char *p = *s;
>> +-      while (*(*s)++ != '\0')
>> ++      char *q = p;
>> ++      while (*q++ != '\0')
>> +               continue;
>> ++      *s = q;
>> +       return p;
>> + }
>> +
>> +@@ -811,10 +904,27 @@ static double my_strtod(char **pp)
>> +
>> + /* -------- working with variables (set/get/copy/etc) -------- */
>> +
>> +-static xhash *iamarray(var *v)
>> ++static void fmt_num(const char *format, double n)
>> + {
>> +-      var *a = v;
>> ++      if (n == (long long)n) {
>> ++              snprintf(g_buf, MAXVARFMT, "%lld", (long long)n);
>> ++      } else {
>> ++              const char *s = format;
>> ++              char c;
>> ++
>> ++              do { c = *s; } while (c && *++s);
>> ++              if (strchr("diouxX", c)) {
>> ++                      snprintf(g_buf, MAXVARFMT, format, (int)n);
>> ++              } else if (strchr("eEfFgGaA", c)) {
>> ++                      snprintf(g_buf, MAXVARFMT, format, n);
>> ++              } else {
>> ++                      syntax_error(EMSG_INV_FMT);
>> ++              }
>> ++      }
>> ++}
>> +
>> ++static xhash *iamarray(var *a)
>> ++{
>> +       while (a->type & VF_CHILD)
>> +               a = a->x.parent;
>> +
>> +@@ -825,23 +935,7 @@ static xhash *iamarray(var *v)
>> +       return a->x.array;
>> + }
>> +
>> +-static void clear_array(xhash *array)
>> +-{
>> +-      unsigned i;
>> +-      hash_item *hi, *thi;
>> +-
>> +-      for (i = 0; i < array->csize; i++) {
>> +-              hi = array->items[i];
>> +-              while (hi) {
>> +-                      thi = hi;
>> +-                      hi = hi->next;
>> +-                      free(thi->data.v.string);
>> +-                      free(thi);
>> +-              }
>> +-              array->items[i] = NULL;
>> +-      }
>> +-      array->glen = array->nel = 0;
>> +-}
>> ++#define clear_array(array) hash_clear(array)
>> +
>> + /* clear a variable */
>> + static var *clrvar(var *v)
>> +@@ -855,6 +949,8 @@ static var *clrvar(var *v)
>> +       return v;
>> + }
>> +
>> ++static void handle_special(var *);
>> ++
>> + /* assign string value to variable */
>> + static var *setvar_p(var *v, char *value)
>> + {
>> +@@ -901,7 +997,7 @@ static const char *getvar_s(var *v)
>> + {
>> +       /* if v is numeric and has no cached string, convert it to
>> string */
>> +       if ((v->type & (VF_NUMBER | VF_CACHED)) == VF_NUMBER) {
>> +-              fmt_num(g_buf, MAXVARFMT, getvar_s(intvar[CONVFMT]),
>> v->number, TRUE);
>> ++              fmt_num(getvar_s(intvar[CONVFMT]), v->number);
>> +               v->string = xstrdup(g_buf);
>> +               v->type |= VF_CACHED;
>> +       }
>> +@@ -920,6 +1016,7 @@ static double getvar_i(var *v)
>> +                       v->number = my_strtod(&s);
>> +                       debug_printf_eval("%f (s:'%s')\n", v->number,
>> s);
>> +                       if (v->type & VF_USER) {
>> ++//TODO: skip_spaces() also skips backslash+newline, is it intended
>> here?
>> +                               s = skip_spaces(s);
>> +                               if (*s != '\0')
>> +                                       v->type &= ~VF_USER;
>> +@@ -981,94 +1078,28 @@ static int istrue(var *v)
>> +       return (v->string && v->string[0]);
>> + }
>> +
>> +-/* temporary variables allocator. Last allocated should be first
>> freed */
>> +-static var *nvalloc(int n)
>> +-{
>> +-      nvblock *pb = NULL;
>> +-      var *v, *r;
>> +-      int size;
>> +-
>> +-      while (g_cb) {
>> +-              pb = g_cb;
>> +-              if ((g_cb->pos - g_cb->nv) + n <= g_cb->size)
>> +-                      break;
>> +-              g_cb = g_cb->next;
>> +-      }
>> +-
>> +-      if (!g_cb) {
>> +-              size = (n <= MINNVBLOCK) ? MINNVBLOCK : n;
>> +-              g_cb = xzalloc(sizeof(nvblock) + size * sizeof(var));
>> +-              g_cb->size = size;
>> +-              g_cb->pos = g_cb->nv;
>> +-              g_cb->prev = pb;
>> +-              /*g_cb->next = NULL; - xzalloc did it */
>> +-              if (pb)
>> +-                      pb->next = g_cb;
>> +-      }
>> +-
>> +-      v = r = g_cb->pos;
>> +-      g_cb->pos += n;
>> +-
>> +-      while (v < g_cb->pos) {
>> +-              v->type = 0;
>> +-              v->string = NULL;
>> +-              v++;
>> +-      }
>> +-
>> +-      return r;
>> +-}
>> +-
>> +-static void nvfree(var *v)
>> +-{
>> +-      var *p;
>> +-
>> +-      if (v < g_cb->nv || v >= g_cb->pos)
>> +-              syntax_error(EMSG_INTERNAL_ERROR);
>> +-
>> +-      for (p = v; p < g_cb->pos; p++) {
>> +-              if ((p->type & (VF_ARRAY | VF_CHILD)) == VF_ARRAY) {
>> +-                      clear_array(iamarray(p));
>> +-                      free(p->x.array->items);
>> +-                      free(p->x.array);
>> +-              }
>> +-              if (p->type & VF_WALK) {
>> +-                      walker_list *n;
>> +-                      walker_list *w = p->x.walker;
>> +-                      debug_printf_walker("nvfree: freeing walker
>> @%p\n", &p->x.walker);
>> +-                      p->x.walker = NULL;
>> +-                      while (w) {
>> +-                              n = w->prev;
>> +-                              debug_printf_walker(" free(%p)\n",
>> w);
>> +-                              free(w);
>> +-                              w = n;
>> +-                      }
>> +-              }
>> +-              clrvar(p);
>> +-      }
>> +-
>> +-      g_cb->pos = v;
>> +-      while (g_cb->prev && g_cb->pos == g_cb->nv) {
>> +-              g_cb = g_cb->prev;
>> +-      }
>> +-}
>> +-
>> + /* ------- awk program text parsing ------- */
>> +
>> +-/* Parse next token pointed by global pos, place results into
>> global ttt.
>> +- * If token isn't expected, give away. Return token class
>> ++/* Parse next token pointed by global pos, place results into
>> global t_XYZ variables.
>> ++ * If token isn't expected, print error message and die.
>> ++ * Return token class (also store it in t_tclass).
>> +  */
>> + static uint32_t next_token(uint32_t expected)
>> + {
>> +-#define concat_inserted (G.next_token__concat_inserted)
>> +-#define save_tclass     (G.next_token__save_tclass)
>> +-#define save_info       (G.next_token__save_info)
>> +-/* Initialized to TC_OPTERM: */
>> +-#define ltclass         (G.next_token__ltclass)
>> ++#define concat_inserted (G1.next_token__concat_inserted)
>> ++#define save_tclass     (G1.next_token__save_tclass)
>> ++#define save_info       (G1.next_token__save_info)
>> +
>> +-      char *p, *s;
>> ++      char *p;
>> +       const char *tl;
>> +-      uint32_t tc;
>> +       const uint32_t *ti;
>> ++      uint32_t tc, last_token_class;
>> ++
>> ++      last_token_class = t_tclass; /* t_tclass is initialized to
>> TC_NEWLINE */
>> ++
>> ++      debug_printf_parse("%s() expected(%x):", __func__, expected);
>> ++      debug_parse_print_tc(expected);
>> ++      debug_printf_parse("\n");
>> +
>> +       if (t_rollback) {
>> +               debug_printf_parse("%s: using rolled-back token\n",
>> __func__);
>> +@@ -1080,6 +1111,10 @@ static uint32_t next_token(uint32_t expected)
>> +               t_info = save_info;
>> +       } else {
>> +               p = g_pos;
>> ++              if (g_saved_ch != '\0') {
>> ++                      *p = g_saved_ch;
>> ++                      g_saved_ch = '\0';
>> ++              }
>> +  readnext:
>> +               p = skip_spaces(p);
>> +               g_lineno = t_lineno;
>> +@@ -1087,15 +1122,12 @@ static uint32_t next_token(uint32_t
>> expected)
>> +                       while (*p != '\n' && *p != '\0')
>> +                               p++;
>> +
>> +-              if (*p == '\n')
>> +-                      t_lineno++;
>> +-
>> +               if (*p == '\0') {
>> +                       tc = TC_EOF;
>> +                       debug_printf_parse("%s: token found:
>> TC_EOF\n", __func__);
>> +               } else if (*p == '\"') {
>> +                       /* it's a string */
>> +-                      t_string = s = ++p;
>> ++                      char *s = t_string = ++p;
>> +                       while (*p != '\"') {
>> +                               char *pp;
>> +                               if (*p == '\0' || *p == '\n')
>> +@@ -1110,7 +1142,7 @@ static uint32_t next_token(uint32_t expected)
>> +                       debug_printf_parse("%s: token found:'%s'
>> TC_STRING\n", __func__, t_string);
>> +               } else if ((expected & TC_REGEXP) && *p == '/') {
>> +                       /* it's regexp */
>> +-                      t_string = s = ++p;
>> ++                      char *s = t_string = ++p;
>> +                       while (*p != '/') {
>> +                               if (*p == '\0' || *p == '\n')
>> +                                       syntax_error(EMSG_UNEXP_EOS);
>> +@@ -1141,6 +1173,11 @@ static uint32_t next_token(uint32_t expected)
>> +                       tc = TC_NUMBER;
>> +                       debug_printf_parse("%s: token found:%f
>> TC_NUMBER\n", __func__, t_double);
>> +               } else {
>> ++                      char *end_of_name;
>> ++
>> ++                      if (*p == '\n')
>> ++                              t_lineno++;
>> ++
>> +                       /* search for something known */
>> +                       tl = tokenlist;
>> +                       tc = 0x00000001;
>> +@@ -1155,9 +1192,9 @@ static uint32_t next_token(uint32_t expected)
>> +                                * token matches,
>> +                                * and it's not a longer word,
>> +                                */
>> +-                              if ((tc & (expected | TC_WORD |
>> TC_NEWLINE))
>> ++                              if ((tc & (expected | TS_WORD |
>> TC_NEWLINE))
>> +                                && strncmp(p, tl, l) == 0
>> +-                               && !((tc & TC_WORD) &&
>> isalnum_(p[l]))
>> ++                               && !((tc & TS_WORD) &&
>> isalnum_(p[l]))
>> +                               ) {
>> +                                       /* then this is what we are
>> looking for */
>> +                                       t_info = *ti;
>> +@@ -1174,67 +1211,94 @@ static uint32_t next_token(uint32_t
>> expected)
>> +                       if (!isalnum_(*p))
>> +                               syntax_error(EMSG_UNEXP_TOKEN); /* no
>> */
>> +                       /* yes */
>> +-                      t_string = --p;
>> +-                      while (isalnum_(*++p)) {
>> +-                              p[-1] = *p;
>> +-                      }
>> +-                      p[-1] = '\0';
>> +-                      tc = TC_VARIABLE;
>> +-                      /* also consume whitespace between
>> functionname and bracket */
>> +-                      if (!(expected & TC_VARIABLE) || (expected &
>> TC_ARRAY))
>> ++                      t_string = p;
>> ++                      while (isalnum_(*p))
>> ++                              p++;
>> ++                      end_of_name = p;
>> ++
>> ++                      if (last_token_class == TC_FUNCDECL)
>> ++                              /* eat space in "function FUNC (...)
>> {...}" declaration */
>> +                               p = skip_spaces(p);
>> ++                      else if (expected & TC_ARRAY) {
>> ++                              /* eat space between array name and [
>> */
>> ++                              char *s = skip_spaces(p);
>> ++                              if (*s == '[') /* array ref, not just
>> a name? */
>> ++                                      p = s;
>> ++                      }
>> ++                      /* else: do NOT consume whitespace after
>> variable name!
>> ++                       * gawk allows definition "function FUNC (p)
>> {...}" - note space,
>> ++                       * but disallows the call "FUNC (p)" because
>> it isn't one -
>> ++                       * expression "v (a)" should NOT be parsed as
>> TC_FUNCTION:
>> ++                       * it is a valid concatenation if "v" is a
>> variable,
>> ++                       * not a function name (and type of name is
>> not known at parse time).
>> ++                       */
>> ++
>> +                       if (*p == '(') {
>> ++                              p++;
>> +                               tc = TC_FUNCTION;
>> +                               debug_printf_parse("%s: token
>> found:'%s' TC_FUNCTION\n", __func__, t_string);
>> ++                      } else if (*p == '[') {
>> ++                              p++;
>> ++                              tc = TC_ARRAY;
>> ++                              debug_printf_parse("%s: token
>> found:'%s' TC_ARRAY\n", __func__, t_string);
>> +                       } else {
>> +-                              if (*p == '[') {
>> +-                                      p++;
>> +-                                      tc = TC_ARRAY;
>> +-                                      debug_printf_parse("%s: token
>> found:'%s' TC_ARRAY\n", __func__, t_string);
>> +-                              } else
>> +-                                      debug_printf_parse("%s: token
>> found:'%s' TC_VARIABLE\n", __func__, t_string);
>> ++                              tc = TC_VARIABLE;
>> ++                              debug_printf_parse("%s: token
>> found:'%s' TC_VARIABLE\n", __func__, t_string);
>> ++                              if (end_of_name == p) {
>> ++                                      /* there is no space for
>> trailing NUL in t_string!
>> ++                                       * We need to save the char
>> we are going to NUL.
>> ++                                       * (we'll use it in future
>> call to next_token())
>> ++                                       */
>> ++                                      g_saved_ch = *end_of_name;
>> ++// especially pathological example is V="abc"; V.2 - it's V
>> concatenated to .2
>> ++// (it evaluates to "abc0.2"). Because of this case, we can't
>> simply cache
>> ++// '.' and analyze it later: we also have to *store it back* in
>> next
>> ++// next_token(), in order to give my_strtod() the undamaged ".2"
>> string.
>> ++                              }
>> +                       }
>> ++                      *end_of_name = '\0'; /* terminate t_string */
>> +               }
>> +  token_found:
>> +               g_pos = p;
>> +
>> +               /* skipping newlines in some cases */
>> +-              if ((ltclass & TC_NOTERM) && (tc & TC_NEWLINE))
>> ++              if ((last_token_class & TS_NOTERM) && (tc &
>> TC_NEWLINE))
>> +                       goto readnext;
>> +
>> +               /* insert concatenation operator when needed */
>> +-              debug_printf_parse("%s: %x %x %x concat_inserted?\n",
>> __func__,
>> +-                      (ltclass & TC_CONCAT1), (tc & TC_CONCAT2),
>> (expected & TC_BINOP));
>> +-              if ((ltclass & TC_CONCAT1) && (tc & TC_CONCAT2) &&
>> (expected & TC_BINOP)
>> +-               && !(ltclass == TC_LENGTH && tc == TC_SEQSTART) /*
>> but not for "length(..." */
>> ++              debug_printf_parse("%s: concat_inserted if all
>> nonzero: %x %x %x %x\n", __func__,
>> ++                      (last_token_class & TS_CONCAT_L), (tc &
>> TS_CONCAT_R), (expected & TS_BINOP),
>> ++                      !(last_token_class == TC_LENGTH && tc ==
>> TC_LPAREN));
>> ++              if ((last_token_class & TS_CONCAT_L) && (tc &
>> TS_CONCAT_R) && (expected & TS_BINOP)
>> ++               && !(last_token_class == TC_LENGTH && tc ==
>> TC_LPAREN) /* but not for "length(..." */
>> +               ) {
>> +                       concat_inserted = TRUE;
>> +                       save_tclass = tc;
>> +                       save_info = t_info;
>> +-                      tc = TC_BINOP;
>> ++                      tc = TC_BINOPX;
>> +                       t_info = OC_CONCAT | SS | P(35);
>> +               }
>> +
>> +-              debug_printf_parse("%s: t_tclass=tc=%x\n", __func__,
>> t_tclass);
>> +               t_tclass = tc;
>> ++              debug_printf_parse("%s: t_tclass=tc=%x\n", __func__,
>> tc);
>> +       }
>> +-      ltclass = t_tclass;
>> +-
>> +       /* Are we ready for this? */
>> +-      if (!(ltclass & expected)) {
>> +-              syntax_error((ltclass & (TC_NEWLINE | TC_EOF)) ?
>> ++      if (!(t_tclass & expected)) {
>> ++              syntax_error((last_token_class & (TC_NEWLINE |
>> TC_EOF)) ?
>> +                               EMSG_UNEXP_EOS : EMSG_UNEXP_TOKEN);
>> +       }
>> +
>> +-      debug_printf_parse("%s: returning, ltclass:%x t_double:%f\n",
>> __func__, ltclass, t_double);
>> +-      return ltclass;
>> ++      debug_printf_parse("%s: returning, t_double:%f t_tclass:",
>> __func__, t_double);
>> ++      debug_parse_print_tc(t_tclass);
>> ++      debug_printf_parse("\n");
>> ++
>> ++      return t_tclass;
>> + #undef concat_inserted
>> + #undef save_tclass
>> + #undef save_info
>> +-#undef ltclass
>> + }
>> +
>> +-static void rollback_token(void)
>> ++static ALWAYS_INLINE void rollback_token(void)
>> + {
>> +       t_rollback = TRUE;
>> + }
>> +@@ -1251,169 +1315,188 @@ static node *new_node(uint32_t info)
>> +
>> + static void mk_re_node(const char *s, node *n, regex_t *re)
>> + {
>> +-      n->info = OC_REGEXP;
>> ++      n->info = TI_REGEXP;
>> +       n->l.re = re;
>> +       n->r.ire = re + 1;
>> +       xregcomp(re, s, REG_EXTENDED);
>> +       xregcomp(re + 1, s, REG_EXTENDED | REG_ICASE);
>> + }
>> +
>> +-static node *condition(void)
>> ++static node *parse_expr(uint32_t);
>> ++
>> ++static node *parse_lrparen_list(void)
>> + {
>> +-      next_token(TC_SEQSTART);
>> +-      return parse_expr(TC_SEQTERM);
>> ++      next_token(TC_LPAREN);
>> ++      return parse_expr(TC_RPAREN);
>> + }
>> +
>> + /* parse expression terminated by given argument, return ptr
>> +  * to built subtree. Terminator is eaten by parse_expr */
>> +-static node *parse_expr(uint32_t iexp)
>> ++static node *parse_expr(uint32_t term_tc)
>> + {
>> +       node sn;
>> +       node *cn = &sn;
>> +       node *vn, *glptr;
>> +-      uint32_t tc, xtc;
>> ++      uint32_t tc, expected_tc;
>> +       var *v;
>> +
>> +-      debug_printf_parse("%s(%x)\n", __func__, iexp);
>> ++      debug_printf_parse("%s() term_tc(%x):", __func__, term_tc);
>> ++      debug_parse_print_tc(term_tc);
>> ++      debug_printf_parse("\n");
>> +
>> +       sn.info = PRIMASK;
>> +       sn.r.n = sn.a.n = glptr = NULL;
>> +-      xtc = TC_OPERAND | TC_UOPPRE | TC_REGEXP | iexp;
>> ++      expected_tc = TS_OPERAND | TS_UOPPRE | TC_REGEXP | term_tc;
>> +
>> +-      while (!((tc = next_token(xtc)) & iexp)) {
>> ++      while (!((tc = next_token(expected_tc)) & term_tc)) {
>> +
>> +-              if (glptr && (t_info == (OC_COMPARE | VV | P(39) |
>> 2))) {
>> ++              if (glptr && (t_info == TI_LESS)) {
>> +                       /* input redirection (<) attached to glptr
>> node */
>> +                       debug_printf_parse("%s: input redir\n",
>> __func__);
>> +                       cn = glptr->l.n = new_node(OC_CONCAT | SS |
>> P(37));
>> +                       cn->a.n = glptr;
>> +-                      xtc = TC_OPERAND | TC_UOPPRE;
>> ++                      expected_tc = TS_OPERAND | TS_UOPPRE;
>> +                       glptr = NULL;
>> +-
>> +-              } else if (tc & (TC_BINOP | TC_UOPPOST)) {
>> +-                      debug_printf_parse("%s: TC_BINOP | TC_UOPPOST
>> tc:%x\n", __func__, tc);
>> ++                      continue;
>> ++              }
>> ++              if (tc & (TS_BINOP | TC_UOPPOST)) {
>> ++                      debug_printf_parse("%s: TS_BINOP | TC_UOPPOST
>> tc:%x\n", __func__, tc);
>> +                       /* for binary and postfix-unary operators,
>> jump back over
>> +                        * previous operators with higher priority */
>> +                       vn = cn;
>> +                       while (((t_info & PRIMASK) > (vn->a.n->info &
>> PRIMASK2))
>> +-                          || ((t_info == vn->info) && ((t_info &
>> OPCLSMASK) == OC_COLON))
>> ++                          || ((t_info == vn->info) && t_info ==
>> TI_COLON)
>> +                       ) {
>> +                               vn = vn->a.n;
>> +                               if (!vn->a.n)
>> syntax_error(EMSG_UNEXP_TOKEN);
>> +                       }
>> +-                      if ((t_info & OPCLSMASK) == OC_TERNARY)
>> ++                      if (t_info == TI_TERNARY)
>> ++//TODO: why?
>> +                               t_info += P(6);
>> +                       cn = vn->a.n->r.n = new_node(t_info);
>> +                       cn->a.n = vn->a.n;
>> +-                      if (tc & TC_BINOP) {
>> ++                      if (tc & TS_BINOP) {
>> +                               cn->l.n = vn;
>> +-                              xtc = TC_OPERAND | TC_UOPPRE |
>> TC_REGEXP;
>> +-                              if ((t_info & OPCLSMASK) ==
>> OC_PGETLINE) {
>> ++//FIXME: this is the place to detect and reject assignments to non-
>> lvalues.
>> ++//Currently we allow "assignments" to consts and temporaries,
>> nonsense like this:
>> ++// awk 'BEGIN { "qwe" = 1 }'
>> ++// awk 'BEGIN { 7 *= 7 }'
>> ++// awk 'BEGIN { length("qwe") = 1 }'
>> ++// awk 'BEGIN { (1+1) += 3 }'
>> ++                              expected_tc = TS_OPERAND | TS_UOPPRE
>> | TC_REGEXP;
>> ++                              if (t_info == TI_PGETLINE) {
>> +                                       /* it's a pipe */
>> +                                       next_token(TC_GETLINE);
>> +                                       /* give maximum priority to
>> this pipe */
>> +                                       cn->info &= ~PRIMASK;
>> +-                                      xtc = TC_OPERAND | TC_UOPPRE
>> | TC_BINOP | iexp;
>> ++                                      expected_tc = TS_OPERAND |
>> TS_UOPPRE | TS_BINOP | term_tc;
>> +                               }
>> +                       } else {
>> +                               cn->r.n = vn;
>> +-                              xtc = TC_OPERAND | TC_UOPPRE |
>> TC_BINOP | iexp;
>> ++                              expected_tc = TS_OPERAND | TS_UOPPRE
>> | TS_BINOP | term_tc;
>> +                       }
>> +                       vn->a.n = cn;
>> ++                      continue;
>> ++              }
>> +
>> +-              } else {
>> +-                      debug_printf_parse("%s: other\n", __func__);
>> +-                      /* for operands and prefix-unary operators,
>> attach them
>> +-                       * to last node */
>> +-                      vn = cn;
>> +-                      cn = vn->r.n = new_node(t_info);
>> +-                      cn->a.n = vn;
>> +-                      xtc = TC_OPERAND | TC_UOPPRE | TC_REGEXP;
>> +-                      if (tc & (TC_OPERAND | TC_REGEXP)) {
>> +-                              debug_printf_parse("%s: TC_OPERAND |
>> TC_REGEXP\n", __func__);
>> +-                              xtc = TC_UOPPRE | TC_UOPPOST |
>> TC_BINOP | TC_OPERAND | iexp;
>> +-                              /* one should be very careful with
>> switch on tclass -
>> +-                               * only simple tclasses should be
>> used! */
>> +-                              switch (tc) {
>> +-                              case TC_VARIABLE:
>> +-                              case TC_ARRAY:
>> +-                                      debug_printf_parse("%s:
>> TC_VARIABLE | TC_ARRAY\n", __func__);
>> +-                                      cn->info = OC_VAR;
>> +-                                      v = hash_search(ahash,
>> t_string);
>> +-                                      if (v != NULL) {
>> +-                                              cn->info = OC_FNARG;
>> +-                                              cn->l.aidx = v-
>>> x.aidx;
>> +-                                      } else {
>> +-                                              cn->l.v =
>> newvar(t_string);
>> +-                                      }
>> +-                                      if (tc & TC_ARRAY) {
>> +-                                              cn->info |= xS;
>> +-                                              cn->r.n =
>> parse_expr(TC_ARRTERM);
>> +-                                      }
>> +-                                      break;
>> ++              debug_printf_parse("%s: other, t_info:%x\n",
>> __func__, t_info);
>> ++              /* for operands and prefix-unary operators, attach
>> them
>> ++               * to last node */
>> ++              vn = cn;
>> ++              cn = vn->r.n = new_node(t_info);
>> ++              cn->a.n = vn;
>> +
>> +-                              case TC_NUMBER:
>> +-                              case TC_STRING:
>> +-                                      debug_printf_parse("%s:
>> TC_NUMBER | TC_STRING\n", __func__);
>> +-                                      cn->info = OC_VAR;
>> +-                                      v = cn->l.v =
>> xzalloc(sizeof(var));
>> +-                                      if (tc & TC_NUMBER)
>> +-                                              setvar_i(v,
>> t_double);
>> +-                                      else {
>> +-                                              setvar_s(v,
>> t_string);
>> +-                                              xtc &= ~TC_UOPPOST;
>> /* "str"++ is not allowed */
>> +-                                      }
>> +-                                      break;
>> ++              expected_tc = TS_OPERAND | TS_UOPPRE | TC_REGEXP;
>> ++              if (t_info == TI_PREINC || t_info == TI_PREDEC)
>> ++                      expected_tc = TS_LVALUE | TC_UOPPRE1;
>> +
>> +-                              case TC_REGEXP:
>> +-                                      debug_printf_parse("%s:
>> TC_REGEXP\n", __func__);
>> +-                                      mk_re_node(t_string, cn,
>> xzalloc(sizeof(regex_t)*2));
>> +-                                      break;
>> ++              if (!(tc & (TS_OPERAND | TC_REGEXP)))
>> ++                      continue;
>> +
>> +-                              case TC_FUNCTION:
>> +-                                      debug_printf_parse("%s:
>> TC_FUNCTION\n", __func__);
>> +-                                      cn->info = OC_FUNC;
>> +-                                      cn->r.f = newfunc(t_string);
>> +-                                      cn->l.n = condition();
>> +-                                      break;
>> ++              debug_printf_parse("%s: TS_OPERAND | TC_REGEXP\n",
>> __func__);
>> ++              expected_tc = TS_UOPPRE | TC_UOPPOST | TS_BINOP |
>> TS_OPERAND | term_tc;
>> ++              /* one should be very careful with switch on tclass -
>> ++               * only simple tclasses should be used (TC_xyz, not
>> TS_xyz) */
>> ++              switch (tc) {
>> ++              case TC_VARIABLE:
>> ++              case TC_ARRAY:
>> ++                      debug_printf_parse("%s: TC_VARIABLE |
>> TC_ARRAY\n", __func__);
>> ++                      cn->info = OC_VAR;
>> ++                      v = hash_search(ahash, t_string);
>> ++                      if (v != NULL) {
>> ++                              cn->info = OC_FNARG;
>> ++                              cn->l.aidx = v->x.aidx;
>> ++                      } else {
>> ++                              cn->l.v = newvar(t_string);
>> ++                      }
>> ++                      if (tc & TC_ARRAY) {
>> ++                              cn->info |= xS;
>> ++                              cn->r.n = parse_expr(TC_ARRTERM);
>> ++                      }
>> ++                      break;
>> +
>> +-                              case TC_SEQSTART:
>> +-                                      debug_printf_parse("%s:
>> TC_SEQSTART\n", __func__);
>> +-                                      cn = vn->r.n =
>> parse_expr(TC_SEQTERM);
>> +-                                      if (!cn)
>> +-                                              syntax_error("Empty
>> sequence");
>> +-                                      cn->a.n = vn;
>> +-                                      break;
>> ++              case TC_NUMBER:
>> ++              case TC_STRING:
>> ++                      debug_printf_parse("%s: TC_NUMBER |
>> TC_STRING\n", __func__);
>> ++                      cn->info = OC_VAR;
>> ++                      v = cn->l.v = xzalloc(sizeof(var));
>> ++                      if (tc & TC_NUMBER)
>> ++                              setvar_i(v, t_double);
>> ++                      else {
>> ++                              setvar_s(v, t_string);
>> ++                              expected_tc &= ~TC_UOPPOST; /*
>> "str"++ is not allowed */
>> ++                      }
>> ++                      break;
>> +
>> +-                              case TC_GETLINE:
>> +-                                      debug_printf_parse("%s:
>> TC_GETLINE\n", __func__);
>> +-                                      glptr = cn;
>> +-                                      xtc = TC_OPERAND | TC_UOPPRE
>> | TC_BINOP | iexp;
>> +-                                      break;
>> ++              case TC_REGEXP:
>> ++                      debug_printf_parse("%s: TC_REGEXP\n",
>> __func__);
>> ++                      mk_re_node(t_string, cn,
>> xzalloc(sizeof(regex_t)*2));
>> ++                      break;
>> +
>> +-                              case TC_BUILTIN:
>> +-                                      debug_printf_parse("%s:
>> TC_BUILTIN\n", __func__);
>> +-                                      cn->l.n = condition();
>> +-                                      break;
>> ++              case TC_FUNCTION:
>> ++                      debug_printf_parse("%s: TC_FUNCTION\n",
>> __func__);
>> ++                      cn->info = OC_FUNC;
>> ++                      cn->r.f = newfunc(t_string);
>> ++                      cn->l.n = parse_expr(TC_RPAREN);
>> ++                      break;
>> +
>> +-                              case TC_LENGTH:
>> +-                                      debug_printf_parse("%s:
>> TC_LENGTH\n", __func__);
>> +-                                      next_token(TC_SEQSTART /*
>> length(...) */
>> +-                                              | TC_OPTERM    /*
>> length; (or newline)*/
>> +-                                              | TC_GRPTERM   /*
>> length } */
>> +-                                              | TC_BINOPX    /*
>> length <op> NUM */
>> +-                                              | TC_COMMA     /*
>> print length, 1 */
>> +-                                      );
>> +-                                      rollback_token();
>> +-                                      if (t_tclass & TC_SEQSTART) {
>> +-                                              /* It was a "("
>> token. Handle just like TC_BUILTIN */
>> +-                                              cn->l.n =
>> condition();
>> +-                                      }
>> +-                                      break;
>> +-                              }
>> ++              case TC_LPAREN:
>> ++                      debug_printf_parse("%s: TC_LPAREN\n",
>> __func__);
>> ++                      cn = vn->r.n = parse_expr(TC_RPAREN);
>> ++                      if (!cn)
>> ++                              syntax_error("Empty sequence");
>> ++                      cn->a.n = vn;
>> ++                      break;
>> ++
>> ++              case TC_GETLINE:
>> ++                      debug_printf_parse("%s: TC_GETLINE\n",
>> __func__);
>> ++                      glptr = cn;
>> ++                      expected_tc = TS_OPERAND | TS_UOPPRE |
>> TS_BINOP | term_tc;
>> ++                      break;
>> ++
>> ++              case TC_BUILTIN:
>> ++                      debug_printf_parse("%s: TC_BUILTIN\n",
>> __func__);
>> ++                      cn->l.n = parse_lrparen_list();
>> ++                      break;
>> ++
>> ++              case TC_LENGTH:
>> ++                      debug_printf_parse("%s: TC_LENGTH\n",
>> __func__);
>> ++                      tc = next_token(TC_LPAREN /* length(...) */
>> ++                              | TC_SEMICOL   /* length; */
>> ++                              | TC_NEWLINE   /* length<newline> */
>> ++                              | TC_RBRACE    /* length } */
>> ++                              | TC_BINOPX    /* length <op> NUM */
>> ++                              | TC_COMMA     /* print length, 1 */
>> ++                      );
>> ++                      if (tc != TC_LPAREN)
>> ++                              rollback_token();
>> ++                      else {
>> ++                              /* It was a "(" token. Handle just
>> like TC_BUILTIN */
>> ++                              cn->l.n = parse_expr(TC_RPAREN);
>> +                       }
>> ++                      break;
>> +               }
>> +-      }
>> ++      } /* while() */
>> +
>> +       debug_printf_parse("%s() returns %p\n", __func__, sn.r.n);
>> +       return sn.r.n;
>> +@@ -1430,7 +1513,7 @@ static node *chain_node(uint32_t info)
>> +       if (seq->programname != g_progname) {
>> +               seq->programname = g_progname;
>> +               n = chain_node(OC_NEWSOURCE);
>> +-              n->l.new_progname = xstrdup(g_progname);
>> ++              n->l.new_progname = g_progname;
>> +       }
>> +
>> +       n = seq->last;
>> +@@ -1446,14 +1529,16 @@ static void chain_expr(uint32_t info)
>> +
>> +       n = chain_node(info);
>> +
>> +-      n->l.n = parse_expr(TC_OPTERM | TC_GRPTERM);
>> ++      n->l.n = parse_expr(TC_SEMICOL | TC_NEWLINE | TC_RBRACE);
>> +       if ((info & OF_REQUIRED) && !n->l.n)
>> +               syntax_error(EMSG_TOO_FEW_ARGS);
>> +
>> +-      if (t_tclass & TC_GRPTERM)
>> ++      if (t_tclass & TC_RBRACE)
>> +               rollback_token();
>> + }
>> +
>> ++static void chain_group(void);
>> ++
>> + static node *chain_loop(node *nn)
>> + {
>> +       node *n, *n2, *save_brk, *save_cont;
>> +@@ -1477,207 +1562,284 @@ static node *chain_loop(node *nn)
>> +       return n;
>> + }
>> +
>> ++static void chain_until_rbrace(void)
>> ++{
>> ++      uint32_t tc;
>> ++      while ((tc = next_token(TS_GRPSEQ | TC_RBRACE)) != TC_RBRACE)
>> {
>> ++              debug_printf_parse("%s: !TC_RBRACE\n", __func__);
>> ++              if (tc == TC_NEWLINE)
>> ++                      continue;
>> ++              rollback_token();
>> ++              chain_group();
>> ++      }
>> ++      debug_printf_parse("%s: TC_RBRACE\n", __func__);
>> ++}
>> ++
>> + /* parse group and attach it to chain */
>> + static void chain_group(void)
>> + {
>> +-      uint32_t c;
>> ++      uint32_t tc;
>> +       node *n, *n2, *n3;
>> +
>> +       do {
>> +-              c = next_token(TC_GRPSEQ);
>> +-      } while (c & TC_NEWLINE);
>> +-
>> +-      if (c & TC_GRPSTART) {
>> +-              debug_printf_parse("%s: TC_GRPSTART\n", __func__);
>> +-              while (next_token(TC_GRPSEQ | TC_GRPTERM) !=
>> TC_GRPTERM) {
>> +-                      debug_printf_parse("%s: !TC_GRPTERM\n",
>> __func__);
>> +-                      if (t_tclass & TC_NEWLINE)
>> +-                              continue;
>> +-                      rollback_token();
>> +-                      chain_group();
>> +-              }
>> +-              debug_printf_parse("%s: TC_GRPTERM\n", __func__);
>> +-      } else if (c & (TC_OPSEQ | TC_OPTERM)) {
>> +-              debug_printf_parse("%s: TC_OPSEQ | TC_OPTERM\n",
>> __func__);
>> ++              tc = next_token(TS_GRPSEQ);
>> ++      } while (tc == TC_NEWLINE);
>> ++
>> ++      if (tc == TC_LBRACE) {
>> ++              debug_printf_parse("%s: TC_LBRACE\n", __func__);
>> ++              chain_until_rbrace();
>> ++              return;
>> ++      }
>> ++      if (tc & (TS_OPSEQ | TC_SEMICOL)) {
>> ++              debug_printf_parse("%s: TS_OPSEQ | TC_SEMICOL\n",
>> __func__);
>> +               rollback_token();
>> +               chain_expr(OC_EXEC | Vx);
>> +-      } else {
>> +-              /* TC_STATEMNT */
>> +-              debug_printf_parse("%s: TC_STATEMNT(?)\n", __func__);
>> +-              switch (t_info & OPCLSMASK) {
>> +-              case ST_IF:
>> +-                      debug_printf_parse("%s: ST_IF\n", __func__);
>> +-                      n = chain_node(OC_BR | Vx);
>> +-                      n->l.n = condition();
>> ++              return;
>> ++      }
>> ++
>> ++      /* TS_STATEMNT */
>> ++      debug_printf_parse("%s: TS_STATEMNT(?)\n", __func__);
>> ++      switch (t_info & OPCLSMASK) {
>> ++      case ST_IF:
>> ++              debug_printf_parse("%s: ST_IF\n", __func__);
>> ++              n = chain_node(OC_BR | Vx);
>> ++              n->l.n = parse_lrparen_list();
>> ++              chain_group();
>> ++              n2 = chain_node(OC_EXEC);
>> ++              n->r.n = seq->last;
>> ++              if (next_token(TS_GRPSEQ | TC_RBRACE | TC_ELSE) ==
>> TC_ELSE) {
>> +                       chain_group();
>> +-                      n2 = chain_node(OC_EXEC);
>> +-                      n->r.n = seq->last;
>> +-                      if (next_token(TC_GRPSEQ | TC_GRPTERM |
>> TC_ELSE) == TC_ELSE) {
>> +-                              chain_group();
>> +-                              n2->a.n = seq->last;
>> +-                      } else {
>> +-                              rollback_token();
>> +-                      }
>> +-                      break;
>> ++                      n2->a.n = seq->last;
>> ++              } else {
>> ++                      rollback_token();
>> ++              }
>> ++              break;
>> +
>> +-              case ST_WHILE:
>> +-                      debug_printf_parse("%s: ST_WHILE\n",
>> __func__);
>> +-                      n2 = condition();
>> +-                      n = chain_loop(NULL);
>> +-                      n->l.n = n2;
>> +-                      break;
>> ++      case ST_WHILE:
>> ++              debug_printf_parse("%s: ST_WHILE\n", __func__);
>> ++              n2 = parse_lrparen_list();
>> ++              n = chain_loop(NULL);
>> ++              n->l.n = n2;
>> ++              break;
>> +
>> +-              case ST_DO:
>> +-                      debug_printf_parse("%s: ST_DO\n", __func__);
>> +-                      n2 = chain_node(OC_EXEC);
>> +-                      n = chain_loop(NULL);
>> +-                      n2->a.n = n->a.n;
>> +-                      next_token(TC_WHILE);
>> +-                      n->l.n = condition();
>> +-                      break;
>> ++      case ST_DO:
>> ++              debug_printf_parse("%s: ST_DO\n", __func__);
>> ++              n2 = chain_node(OC_EXEC);
>> ++              n = chain_loop(NULL);
>> ++              n2->a.n = n->a.n;
>> ++              next_token(TC_WHILE);
>> ++              n->l.n = parse_lrparen_list();
>> ++              break;
>> +
>> +-              case ST_FOR:
>> +-                      debug_printf_parse("%s: ST_FOR\n", __func__);
>> +-                      next_token(TC_SEQSTART);
>> +-                      n2 = parse_expr(TC_SEMICOL | TC_SEQTERM);
>> +-                      if (t_tclass & TC_SEQTERM) {    /* for-in */
>> +-                              if (!n2 || (n2->info & OPCLSMASK) !=
>> OC_IN)
>> +-
>>                                        syntax_error(EMSG_UNEXP_TOKEN);
>> +-                              n = chain_node(OC_WALKINIT | VV);
>> +-                              n->l.n = n2->l.n;
>> +-                              n->r.n = n2->r.n;
>> +-                              n = chain_loop(NULL);
>> +-                              n->info = OC_WALKNEXT | Vx;
>> +-                              n->l.n = n2->l.n;
>> +-                      } else {                        /* for (;;)
>> */
>> +-                              n = chain_node(OC_EXEC | Vx);
>> +-                              n->l.n = n2;
>> +-                              n2 = parse_expr(TC_SEMICOL);
>> +-                              n3 = parse_expr(TC_SEQTERM);
>> +-                              n = chain_loop(n3);
>> +-                              n->l.n = n2;
>> +-                              if (!n2)
>> +-                                      n->info = OC_EXEC;
>> +-                      }
>> +-                      break;
>> ++      case ST_FOR:
>> ++              debug_printf_parse("%s: ST_FOR\n", __func__);
>> ++              next_token(TC_LPAREN);
>> ++              n2 = parse_expr(TC_SEMICOL | TC_RPAREN);
>> ++              if (t_tclass & TC_RPAREN) {     /* for (I in ARRAY)
>> */
>> ++                      if (!n2 || n2->info != TI_IN)
>> ++                              syntax_error(EMSG_UNEXP_TOKEN);
>> ++                      n = chain_node(OC_WALKINIT | VV);
>> ++                      n->l.n = n2->l.n;
>> ++                      n->r.n = n2->r.n;
>> ++                      n = chain_loop(NULL);
>> ++                      n->info = OC_WALKNEXT | Vx;
>> ++                      n->l.n = n2->l.n;
>> ++              } else {                        /* for (;;) */
>> ++                      n = chain_node(OC_EXEC | Vx);
>> ++                      n->l.n = n2;
>> ++                      n2 = parse_expr(TC_SEMICOL);
>> ++                      n3 = parse_expr(TC_RPAREN);
>> ++                      n = chain_loop(n3);
>> ++                      n->l.n = n2;
>> ++                      if (!n2)
>> ++                              n->info = OC_EXEC;
>> ++              }
>> ++              break;
>> +
>> +-              case OC_PRINT:
>> +-              case OC_PRINTF:
>> +-                      debug_printf_parse("%s: OC_PRINT[F]\n",
>> __func__);
>> +-                      n = chain_node(t_info);
>> +-                      n->l.n = parse_expr(TC_OPTERM | TC_OUTRDR |
>> TC_GRPTERM);
>> +-                      if (t_tclass & TC_OUTRDR) {
>> +-                              n->info |= t_info;
>> +-                              n->r.n = parse_expr(TC_OPTERM |
>> TC_GRPTERM);
>> +-                      }
>> +-                      if (t_tclass & TC_GRPTERM)
>> +-                              rollback_token();
>> +-                      break;
>> ++      case OC_PRINT:
>> ++      case OC_PRINTF:
>> ++              debug_printf_parse("%s: OC_PRINT[F]\n", __func__);
>> ++              n = chain_node(t_info);
>> ++              n->l.n = parse_expr(TC_SEMICOL | TC_NEWLINE |
>> TC_OUTRDR | TC_RBRACE);
>> ++              if (t_tclass & TC_OUTRDR) {
>> ++                      n->info |= t_info;
>> ++                      n->r.n = parse_expr(TC_SEMICOL | TC_NEWLINE |
>> TC_RBRACE);
>> ++              }
>> ++              if (t_tclass & TC_RBRACE)
>> ++                      rollback_token();
>> ++              break;
>> +
>> +-              case OC_BREAK:
>> +-                      debug_printf_parse("%s: OC_BREAK\n",
>> __func__);
>> +-                      n = chain_node(OC_EXEC);
>> +-                      n->a.n = break_ptr;
>> +-                      chain_expr(t_info);
>> +-                      break;
>> ++      case OC_BREAK:
>> ++              debug_printf_parse("%s: OC_BREAK\n", __func__);
>> ++              n = chain_node(OC_EXEC);
>> ++              if (!break_ptr)
>> ++                      syntax_error("'break' not in a loop");
>> ++              n->a.n = break_ptr;
>> ++              chain_expr(t_info);
>> ++              break;
>> +
>> +-              case OC_CONTINUE:
>> +-                      debug_printf_parse("%s: OC_CONTINUE\n",
>> __func__);
>> +-                      n = chain_node(OC_EXEC);
>> +-                      n->a.n = continue_ptr;
>> +-                      chain_expr(t_info);
>> +-                      break;
>> ++      case OC_CONTINUE:
>> ++              debug_printf_parse("%s: OC_CONTINUE\n", __func__);
>> ++              n = chain_node(OC_EXEC);
>> ++              if (!continue_ptr)
>> ++                      syntax_error("'continue' not in a loop");
>> ++              n->a.n = continue_ptr;
>> ++              chain_expr(t_info);
>> ++              break;
>> +
>> +-              /* delete, next, nextfile, return, exit */
>> +-              default:
>> +-                      debug_printf_parse("%s: default\n",
>> __func__);
>> +-                      chain_expr(t_info);
>> +-              }
>> ++      /* delete, next, nextfile, return, exit */
>> ++      default:
>> ++              debug_printf_parse("%s: default\n", __func__);
>> ++              chain_expr(t_info);
>> +       }
>> + }
>> +
>> + static void parse_program(char *p)
>> + {
>> +-      uint32_t tclass;
>> +-      node *cn;
>> +-      func *f;
>> +-      var *v;
>> ++      debug_printf_parse("%s()\n", __func__);
>> +
>> +       g_pos = p;
>> +       t_lineno = 1;
>> +-      while ((tclass = next_token(TC_EOF | TC_OPSEQ | TC_GRPSTART |
>> +-                      TC_OPTERM | TC_BEGIN | TC_END | TC_FUNCDECL))
>> != TC_EOF) {
>> ++      for (;;) {
>> ++              uint32_t tclass;
>> +
>> +-              if (tclass & TC_OPTERM) {
>> +-                      debug_printf_parse("%s: TC_OPTERM\n",
>> __func__);
>> ++              tclass = next_token(TS_OPSEQ | TC_LBRACE | TC_BEGIN |
>> TC_END | TC_FUNCDECL
>> ++                      | TC_EOF | TC_NEWLINE /* but not TC_SEMICOL
>> */);
>> ++ got_tok:
>> ++              if (tclass == TC_EOF) {
>> ++                      debug_printf_parse("%s: TC_EOF\n", __func__);
>> ++                      break;
>> ++              }
>> ++              if (tclass == TC_NEWLINE) {
>> ++                      debug_printf_parse("%s: TC_NEWLINE\n",
>> __func__);
>> +                       continue;
>> +               }
>> +-
>> +-              seq = &mainseq;
>> +-              if (tclass & TC_BEGIN) {
>> ++              if (tclass == TC_BEGIN) {
>> +                       debug_printf_parse("%s: TC_BEGIN\n",
>> __func__);
>> +                       seq = &beginseq;
>> +-                      chain_group();
>> +-              } else if (tclass & TC_END) {
>> ++                      /* ensure there is no newline between BEGIN
>> and { */
>> ++                      next_token(TC_LBRACE);
>> ++                      chain_until_rbrace();
>> ++                      goto next_tok;
>> ++              }
>> ++              if (tclass == TC_END) {
>> +                       debug_printf_parse("%s: TC_END\n", __func__);
>> +                       seq = &endseq;
>> +-                      chain_group();
>> +-              } else if (tclass & TC_FUNCDECL) {
>> ++                      /* ensure there is no newline between END and
>> { */
>> ++                      next_token(TC_LBRACE);
>> ++                      chain_until_rbrace();
>> ++                      goto next_tok;
>> ++              }
>> ++              if (tclass == TC_FUNCDECL) {
>> ++                      func *f;
>> ++
>> +                       debug_printf_parse("%s: TC_FUNCDECL\n",
>> __func__);
>> +                       next_token(TC_FUNCTION);
>> +-                      g_pos++;
>> +                       f = newfunc(t_string);
>> +-                      f->body.first = NULL;
>> +-                      f->nargs = 0;
>> +-                      /* Match func arg list: a comma sep list of
>>> = 0 args, and a close paren */
>> +-                      while (next_token(TC_VARIABLE | TC_SEQTERM |
>> TC_COMMA)) {
>> +-                              /* Either an empty arg list, or
>> trailing comma from prev iter
>> +-                               * must be followed by an arg */
>> +-                              if (f->nargs == 0 && t_tclass ==
>> TC_SEQTERM)
>> +-                                      break;
>> +-
>> +-                              /* TC_SEQSTART/TC_COMMA must be
>> followed by TC_VARIABLE */
>> +-                              if (t_tclass != TC_VARIABLE)
>> ++                      if (f->defined)
>> ++                              syntax_error("Duplicate function");
>> ++                      f->defined = 1;
>> ++                      //f->body.first = NULL; - already is
>> ++                      //f->nargs = 0; - already is
>> ++                      /* func arg list: comma sep list of args, and
>> a close paren */
>> ++                      for (;;) {
>> ++                              var *v;
>> ++                              if (next_token(TC_VARIABLE |
>> TC_RPAREN) == TC_RPAREN) {
>> ++                                      if (f->nargs == 0)
>> ++                                              break; /* func() is
>> ok */
>> ++                                      /* func(a,) is not ok */
>> +                                       syntax_error(EMSG_UNEXP_TOKEN
>> );
>> +-
>> ++                              }
>> +                               v = findvar(ahash, t_string);
>> +                               v->x.aidx = f->nargs++;
>> +-
>> +                               /* Arg followed either by end of arg
>> list or 1 comma */
>> +-                              if (next_token(TC_COMMA | TC_SEQTERM)
>> & TC_SEQTERM)
>> ++                              if (next_token(TC_COMMA | TC_RPAREN)
>> == TC_RPAREN)
>> +                                       break;
>> +-                              if (t_tclass != TC_COMMA)
>> +-
>>                                        syntax_error(EMSG_UNEXP_TOKEN);
>> ++                              /* it was a comma, we ate it */
>> +                       }
>> +                       seq = &f->body;
>> +-                      chain_group();
>> +-                      clear_array(ahash);
>> +-              } else if (tclass & TC_OPSEQ) {
>> +-                      debug_printf_parse("%s: TC_OPSEQ\n",
>> __func__);
>> ++                      /* ensure there is { after "func F(...)" -
>> but newlines are allowed */
>> ++                      while (next_token(TC_LBRACE | TC_NEWLINE) ==
>> TC_NEWLINE)
>> ++                              continue;
>> ++                      chain_until_rbrace();
>> ++                      hash_clear(ahash);
>> ++                      goto next_tok;
>> ++              }
>> ++              seq = &mainseq;
>> ++              if (tclass & TS_OPSEQ) {
>> ++                      node *cn;
>> ++
>> ++                      debug_printf_parse("%s: TS_OPSEQ\n",
>> __func__);
>> +                       rollback_token();
>> +                       cn = chain_node(OC_TEST);
>> +-                      cn->l.n = parse_expr(TC_OPTERM | TC_EOF |
>> TC_GRPSTART);
>> +-                      if (t_tclass & TC_GRPSTART) {
>> +-                              debug_printf_parse("%s:
>> TC_GRPSTART\n", __func__);
>> +-                              rollback_token();
>> +-                              chain_group();
>> ++                      cn->l.n = parse_expr(TC_SEMICOL | TC_NEWLINE
>> | TC_EOF | TC_LBRACE);
>> ++                      if (t_tclass == TC_LBRACE) {
>> ++                              debug_printf_parse("%s: TC_LBRACE\n",
>> __func__);
>> ++                              chain_until_rbrace();
>> +                       } else {
>> +-                              debug_printf_parse("%s:
>> !TC_GRPSTART\n", __func__);
>> ++                              /* no action, assume default "{ print
>> }" */
>> ++                              debug_printf_parse("%s:
>> !TC_LBRACE\n", __func__);
>> +                               chain_node(OC_PRINT);
>> +                       }
>> +                       cn->r.n = mainseq.last;
>> +-              } else /* if (tclass & TC_GRPSTART) */ {
>> +-                      debug_printf_parse("%s: TC_GRPSTART(?)\n",
>> __func__);
>> +-                      rollback_token();
>> +-                      chain_group();
>> ++                      goto next_tok;
>> +               }
>> +-      }
>> +-      debug_printf_parse("%s: TC_EOF\n", __func__);
>> ++              /* tclass == TC_LBRACE */
>> ++              debug_printf_parse("%s: TC_LBRACE(?)\n", __func__);
>> ++              chain_until_rbrace();
>> ++ next_tok:
>> ++              /* Same as next_token() at the top of the loop, +
>> TC_SEMICOL */
>> ++              tclass = next_token(TS_OPSEQ | TC_LBRACE | TC_BEGIN |
>> TC_END | TC_FUNCDECL
>> ++                      | TC_EOF | TC_NEWLINE | TC_SEMICOL);
>> ++              /* gawk allows many newlines, but does not allow more
>> than one semicolon:
>> ++               *  BEGIN {...}<newline>;<newline>;
>> ++               * would complain "each rule must have a pattern or
>> an action part".
>> ++               * Same message for
>> ++               *  ; BEGIN {...}
>> ++               */
>> ++              if (tclass != TC_SEMICOL)
>> ++                      goto got_tok; /* use this token */
>> ++              /* else: loop back - ate the semicolon, get and use
>> _next_ token */
>> ++      } /* for (;;) */
>> + }
>> +
>> +-
>> + /* -------- program execution part -------- */
>> +
>> ++/* temporary variables allocator */
>> ++static var *nvalloc(int sz)
>> ++{
>> ++      return xzalloc(sz * sizeof(var));
>> ++}
>> ++
>> ++static void nvfree(var *v, int sz)
>> ++{
>> ++      var *p = v;
>> ++
>> ++      while (--sz >= 0) {
>> ++              if ((p->type & (VF_ARRAY | VF_CHILD)) == VF_ARRAY) {
>> ++                      clear_array(iamarray(p));
>> ++                      free(p->x.array->items);
>> ++                      free(p->x.array);
>> ++              }
>> ++              if (p->type & VF_WALK) {
>> ++                      walker_list *n;
>> ++                      walker_list *w = p->x.walker;
>> ++                      debug_printf_walker("nvfree: freeing walker
>> @%p\n", &p->x.walker);
>> ++                      p->x.walker = NULL;
>> ++                      while (w) {
>> ++                              n = w->prev;
>> ++                              debug_printf_walker(" free(%p)\n",
>> w);
>> ++                              free(w);
>> ++                              w = n;
>> ++                      }
>> ++              }
>> ++              clrvar(p);
>> ++              p++;
>> ++      }
>> ++
>> ++      free(v);
>> ++}
>> ++
>> + static node *mk_splitter(const char *s, tsplitter *spl)
>> + {
>> +       regex_t *re, *ire;
>> +@@ -1686,7 +1848,7 @@ static node *mk_splitter(const char *s,
>> tsplitter *spl)
>> +       re = &spl->re[0];
>> +       ire = &spl->re[1];
>> +       n = &spl->n;
>> +-      if ((n->info & OPCLSMASK) == OC_REGEXP) {
>> ++      if (n->info == TI_REGEXP) {
>> +               regfree(re);
>> +               regfree(ire); // TODO: nuke ire, use re+1?
>> +       }
>> +@@ -1699,21 +1861,28 @@ static node *mk_splitter(const char *s,
>> tsplitter *spl)
>> +       return n;
>> + }
>> +
>> +-/* use node as a regular expression. Supplied with node ptr and
>> regex_t
>> ++static var *evaluate(node *, var *);
>> ++
>> ++/* Use node as a regular expression. Supplied with node ptr and
>> regex_t
>> +  * storage space. Return ptr to regex (if result points to preg, it
>> should
>> +- * be later regfree'd manually
>> ++ * be later regfree'd manually).
>> +  */
>> + static regex_t *as_regex(node *op, regex_t *preg)
>> + {
>> +       int cflags;
>> +-      var *v;
>> +       const char *s;
>> +
>> +-      if ((op->info & OPCLSMASK) == OC_REGEXP) {
>> ++      if (op->info == TI_REGEXP) {
>> +               return icase ? op->r.ire : op->l.re;
>> +       }
>> +-      v = nvalloc(1);
>> +-      s = getvar_s(evaluate(op, v));
>> ++
>> ++      //tmpvar = nvalloc(1);
>> ++#define TMPVAR (&G.as_regex__tmpvar)
>> ++      // We use a single "static" tmpvar (instead of on-stack or
>> malloced one)
>> ++      // to decrease memory consumption in deeply-recursive awk
>> programs.
>> ++      // The rule to work safely is to never call evaluate() while
>> our static
>> ++      // TMPVAR's value is still needed.
>> ++      s = getvar_s(evaluate(op, TMPVAR));
>> +
>> +       cflags = icase ? REG_EXTENDED | REG_ICASE : REG_EXTENDED;
>> +       /* Testcase where REG_EXTENDED fails (unpaired '{'):
>> +@@ -1725,7 +1894,8 @@ static regex_t *as_regex(node *op, regex_t
>> *preg)
>> +               cflags &= ~REG_EXTENDED;
>> +               xregcomp(preg, s, cflags);
>> +       }
>> +-      nvfree(v);
>> ++      //nvfree(tmpvar, 1);
>> ++#undef TMPVAR
>> +       return preg;
>> + }
>> +
>> +@@ -1745,12 +1915,22 @@ static char* qrealloc(char *b, int n, int
>> *size)
>> + /* resize field storage space */
>> + static void fsrealloc(int size)
>> + {
>> +-      int i;
>> ++      int i, newsize;
>> +
>> +       if (size >= maxfields) {
>> ++              /* Sanity cap, easier than catering for overflows */
>> ++              if (size > 0xffffff)
>> ++                      bb_die_memory_exhausted();
>> ++
>> +               i = maxfields;
>> +               maxfields = size + 16;
>> +-              Fields = xrealloc(Fields, maxfields *
>> sizeof(Fields[0]));
>> ++
>> ++              newsize = maxfields * sizeof(Fields[0]);
>> ++              debug_printf_eval("fsrealloc: xrealloc(%p, %u)\n",
>> Fields, newsize);
>> ++              Fields = xrealloc(Fields, newsize);
>> ++              debug_printf_eval("fsrealloc: Fields=%p..%p\n",
>> Fields, (char*)Fields + newsize - 1);
>> ++              /* ^^^ did Fields[] move? debug aid for L.v getting
>> "upstaged" by R.v in evaluate() */
>> ++
>> +               for (; i < maxfields; i++) {
>> +                       Fields[i].type = VF_SPECIAL;
>> +                       Fields[i].string = NULL;
>> +@@ -1802,13 +1982,13 @@ static int awk_split(const char *s, node
>> *spl, char **slist)
>> +               c[2] = '\n';
>> +
>> +       n = 0;
>> +-      if ((spl->info & OPCLSMASK) == OC_REGEXP) {  /* regex split
>> */
>> ++      if (spl->info == TI_REGEXP) {  /* regex split */
>> +               if (!*s)
>> +                       return n; /* "": zero fields */
>> +               n++; /* at least one field will be there */
>> +               do {
>> +                       int l;
>> +-                      regmatch_t pmatch[2]; // TODO: why [2]? [1]
>> is enough...
>> ++                      regmatch_t pmatch[1];
>> +
>> +                       l = strcspn(s, c+2); /* len till next NUL or
>> \n */
>> +                       if (regexec1_nonempty(icase ? spl->r.ire :
>> spl->l.re, s, pmatch) == 0
>> +@@ -1969,7 +2149,7 @@ static node *nextarg(node **pn)
>> +       node *n;
>> +
>> +       n = *pn;
>> +-      if (n && (n->info & OPCLSMASK) == OC_COMMA) {
>> ++      if (n && n->info == TI_COMMA) {
>> +               *pn = n->r.n;
>> +               n = n->l.n;
>> +       } else {
>> +@@ -2000,8 +2180,7 @@ static void hashwalk_init(var *v, xhash
>> *array)
>> +       for (i = 0; i < array->csize; i++) {
>> +               hi = array->items[i];
>> +               while (hi) {
>> +-                      strcpy(w->end, hi->name);
>> +-                      nextword(&w->end);
>> ++                      w->end = stpcpy(w->end, hi->name) + 1;
>> +                       hi = hi->next;
>> +               }
>> +       }
>> +@@ -2027,15 +2206,18 @@ static int hashwalk_next(var *v)
>> + /* evaluate node, return 1 when result is true, 0 otherwise */
>> + static int ptest(node *pattern)
>> + {
>> +-      /* ptest__v is "static": to save stack space? */
>> +-      return istrue(evaluate(pattern, &G.ptest__v));
>> ++      // We use a single "static" tmpvar (instead of on-stack or
>> malloced one)
>> ++      // to decrease memory consumption in deeply-recursive awk
>> programs.
>> ++      // The rule to work safely is to never call evaluate() while
>> our static
>> ++      // TMPVAR's value is still needed.
>> ++      return istrue(evaluate(pattern, &G.ptest__tmpvar));
>> + }
>> +
>> + /* read next record from stream rsm into a variable v */
>> + static int awk_getline(rstream *rsm, var *v)
>> + {
>> +       char *b;
>> +-      regmatch_t pmatch[2]; // TODO: why [2]? [1] is enough...
>> ++      regmatch_t pmatch[1];
>> +       int size, a, p, pp = 0;
>> +       int fd, so, eo, r, rp;
>> +       char c, *m, *s;
>> +@@ -2061,7 +2243,7 @@ static int awk_getline(rstream *rsm, var *v)
>> +               so = eo = p;
>> +               r = 1;
>> +               if (p > 0) {
>> +-                      if ((rsplitter.n.info & OPCLSMASK) ==
>> OC_REGEXP) {
>> ++                      if (rsplitter.n.info == TI_REGEXP) {
>> +                               if (regexec(icase ? rsplitter.n.r.ire
>> : rsplitter.n.l.re,
>> +                                                       b, 1, pmatch,
>> 0) == 0) {
>> +                                       so = pmatch[0].rm_so;
>> +@@ -2133,82 +2315,126 @@ static int awk_getline(rstream *rsm, var
>> *v)
>> +       return r;
>> + }
>> +
>> +-static int fmt_num(char *b, int size, const char *format, double n,
>> int int_as_int)
>> +-{
>> +-      int r = 0;
>> +-      char c;
>> +-      const char *s = format;
>> +-
>> +-      if (int_as_int && n == (long long)n) {
>> +-              r = snprintf(b, size, "%lld", (long long)n);
>> +-      } else {
>> +-              do { c = *s; } while (c && *++s);
>> +-              if (strchr("diouxX", c)) {
>> +-                      r = snprintf(b, size, format, (int)n);
>> +-              } else if (strchr("eEfgG", c)) {
>> +-                      r = snprintf(b, size, format, n);
>> +-              } else {
>> +-                      syntax_error(EMSG_INV_FMT);
>> +-              }
>> +-      }
>> +-      return r;
>> +-}
>> +-
>> + /* formatted output into an allocated buffer, return ptr to buffer
>> */
>> +-static char *awk_printf(node *n)
>> ++#if !ENABLE_FEATURE_AWK_GNU_EXTENSIONS
>> ++# define awk_printf(a, b) awk_printf(a)
>> ++#endif
>> ++static char *awk_printf(node *n, size_t *len)
>> + {
>> +-      char *b = NULL;
>> +-      char *fmt, *s, *f;
>> +-      const char *s1;
>> +-      int i, j, incr, bsize;
>> +-      char c, c1;
>> +-      var *v, *arg;
>> +-
>> +-      v = nvalloc(1);
>> +-      fmt = f = xstrdup(getvar_s(evaluate(nextarg(&n), v)));
>> +-
>> ++      char *b;
>> ++      char *fmt, *f;
>> ++      size_t i;
>> ++
>> ++      //tmpvar = nvalloc(1);
>> ++#define TMPVAR (&G.awk_printf__tmpvar)
>> ++      // We use a single "static" tmpvar (instead of on-stack or
>> malloced one)
>> ++      // to decrease memory consumption in deeply-recursive awk
>> programs.
>> ++      // The rule to work safely is to never call evaluate() while
>> our static
>> ++      // TMPVAR's value is still needed.
>> ++      fmt = f = xstrdup(getvar_s(evaluate(nextarg(&n), TMPVAR)));
>> ++      // ^^^^^^^^^ here we immediately strdup() the value, so the
>> later call
>> ++      // to evaluate() potentially recursing into another
>> awk_printf() can't
>> ++      // mangle the value.
>> ++
>> ++      b = NULL;
>> +       i = 0;
>> +-      while (*f) {
>> ++      while (1) { /* "print one format spec" loop */
>> ++              char *s;
>> ++              char c;
>> ++              char sv;
>> ++              var *arg;
>> ++              size_t slen;
>> ++
>> ++              /* Find end of the next format spec, or end of line
>> */
>> +               s = f;
>> +-              while (*f && (*f != '%' || *++f == '%'))
>> +-                      f++;
>> +-              while (*f && !isalpha(*f)) {
>> +-                      if (*f == '*')
>> +-                              syntax_error("%*x formats are not
>> supported");
>> ++              while (1) {
>> ++                      c = *f;
>> ++                      if (!c) /* no percent chars found at all */
>> ++                              goto nul;
>> +                       f++;
>> ++                      if (c == '%')
>> ++                              break;
>> +               }
>> +-
>> +-              incr = (f - s) + MAXVARFMT;
>> +-              b = qrealloc(b, incr + i, &bsize);
>> ++              /* we are past % in "....%..." */
>> +               c = *f;
>> +-              if (c != '\0')
>> ++              if (!c) /* "....%" */
>> ++                      goto nul;
>> ++              if (c == '%') { /* "....%%...." */
>> ++                      slen = f - s;
>> ++                      s = xstrndup(s, slen);
>> +                       f++;
>> +-              c1 = *f;
>> ++                      goto append; /* print "....%" part verbatim
>> */
>> ++              }
>> ++              while (1) {
>> ++                      if (isalpha(c))
>> ++                              break;
>> ++                      if (c == '*')
>> ++                              syntax_error("%*x formats are not
>> supported");
>> ++                      c = *++f;
>> ++                      if (!c) { /* "....%...." and no letter found
>> after % */
>> ++                              /* Example: awk 'BEGIN { printf
>> "^^^%^^^\n"; }' */
>> ++ nul:
>> ++                              slen = f - s;
>> ++                              goto tail; /* print remaining string,
>> exit loop */
>> ++                      }
>> ++              }
>> ++              /* we are at A in "....%...A..." */
>> ++
>> ++              arg = evaluate(nextarg(&n), TMPVAR);
>> ++
>> ++              /* Result can be arbitrarily long. Example:
>> ++               *  printf "%99999s", "BOOM"
>> ++               */
>> ++              sv = *++f;
>> +               *f = '\0';
>> +-              arg = evaluate(nextarg(&n), v);
>> +-
>> +-              j = i;
>> +-              if (c == 'c' || !c) {
>> +-                      i += sprintf(b+i, s, is_numeric(arg) ?
>> +-                                      (char)getvar_i(arg) :
>> *getvar_s(arg));
>> +-              } else if (c == 's') {
>> +-                      s1 = getvar_s(arg);
>> +-                      b = qrealloc(b, incr+i+strlen(s1), &bsize);
>> +-                      i += sprintf(b+i, s, s1);
>> ++              if (c == 'c') {
>> ++                      char cc = is_numeric(arg) ? getvar_i(arg) :
>> *getvar_s(arg);
>> ++                      char *r = xasprintf(s, cc ? cc : '^' /* else
>> strlen will be wrong */);
>> ++                      slen = strlen(r);
>> ++                      if (cc == '\0') /* if cc is NUL, re-format
>> the string with it */
>> ++                              sprintf(r, s, cc);
>> ++                      s = r;
>> +               } else {
>> +-                      i += fmt_num(b+i, incr, s, getvar_i(arg),
>> FALSE);
>> ++                      if (c == 's') {
>> ++                              s = xasprintf(s, getvar_s(arg));
>> ++                      } else {
>> ++                              double d = getvar_i(arg);
>> ++                              if (strchr("diouxX", c)) {
>> ++//TODO: make it wider here (%x -> %llx etc)?
>> ++                                      s = xasprintf(s, (int)d);
>> ++                              } else if (strchr("eEfFgGaA", c)) {
>> ++                                      s = xasprintf(s, d);
>> ++                              } else {
>> ++//TODO: GNU Awk 5.0.1: printf "%W" prints "%W", does not error out
>> ++                                      syntax_error(EMSG_INV_FMT);
>> ++                              }
>> ++                      }
>> ++                      slen = strlen(s);
>> +               }
>> +-              *f = c1;
>> +-
>> +-              /* if there was an error while sprintf, return value
>> is negative */
>> +-              if (i < j)
>> +-                      i = j;
>> ++              *f = sv;
>> ++ append:
>> ++              if (i == 0) {
>> ++                      b = s;
>> ++                      i = slen;
>> ++                      continue;
>> ++              }
>> ++ tail:
>> ++              b = xrealloc(b, i + slen + 1);
>> ++              strcpy(b + i, s);
>> ++              i += slen;
>> ++              if (!c) /* s is NOT allocated and this is the last
>> part of string? */
>> ++                      break;
>> ++              free(s);
>> +       }
>> +
>> +       free(fmt);
>> +-      nvfree(v);
>> +-      b = xrealloc(b, i + 1);
>> +-      b[i] = '\0';
>> ++      //nvfree(tmpvar, 1);
>> ++#undef TMPVAR
>> ++
>> ++#if ENABLE_FEATURE_AWK_GNU_EXTENSIONS
>> ++      if (len)
>> ++              *len = i;
>> ++#endif
>> +       return b;
>> + }
>> +
>> +@@ -2338,33 +2564,59 @@ static NOINLINE int do_mktime(const char
>> *ds)
>> +       return mktime(&then);
>> + }
>> +
>> ++/* Reduce stack usage in exec_builtin() by keeping match() code
>> separate */
>> ++static NOINLINE var *do_match(node *an1, const char *as0)
>> ++{
>> ++      regmatch_t pmatch[1];
>> ++      regex_t sreg, *re;
>> ++      int n, start, len;
>> ++
>> ++      re = as_regex(an1, &sreg);
>> ++      n = regexec(re, as0, 1, pmatch, 0);
>> ++      if (re == &sreg)
>> ++              regfree(re);
>> ++      start = 0;
>> ++      len = -1;
>> ++      if (n == 0) {
>> ++              start = pmatch[0].rm_so + 1;
>> ++              len = pmatch[0].rm_eo - pmatch[0].rm_so;
>> ++      }
>> ++      setvar_i(newvar("RLENGTH"), len);
>> ++      return setvar_i(newvar("RSTART"), start);
>> ++}
>> ++
>> ++/* Reduce stack usage in evaluate() by keeping builtins' code
>> separate */
>> + static NOINLINE var *exec_builtin(node *op, var *res)
>> + {
>> + #define tspl (G.exec_builtin__tspl)
>> +
>> +-      var *tv;
>> ++      var *tmpvars;
>> +       node *an[4];
>> +       var *av[4];
>> +       const char *as[4];
>> +-      regmatch_t pmatch[2];
>> +-      regex_t sreg, *re;
>> +       node *spl;
>> +       uint32_t isr, info;
>> +       int nargs;
>> +       time_t tt;
>> +       int i, l, ll, n;
>> +
>> +-      tv = nvalloc(4);
>> ++      tmpvars = nvalloc(4);
>> ++#define TMPVAR0 (tmpvars)
>> ++#define TMPVAR1 (tmpvars + 1)
>> ++#define TMPVAR2 (tmpvars + 2)
>> ++#define TMPVAR3 (tmpvars + 3)
>> ++#define TMPVAR(i) (tmpvars + (i))
>> +       isr = info = op->info;
>> +       op = op->l.n;
>> +
>> +       av[2] = av[3] = NULL;
>> +       for (i = 0; i < 4 && op; i++) {
>> +               an[i] = nextarg(&op);
>> +-              if (isr & 0x09000000)
>> +-                      av[i] = evaluate(an[i], &tv[i]);
>> +-              if (isr & 0x08000000)
>> +-                      as[i] = getvar_s(av[i]);
>> ++              if (isr & 0x09000000) {
>> ++                      av[i] = evaluate(an[i], TMPVAR(i));
>> ++                      if (isr & 0x08000000)
>> ++                              as[i] = getvar_s(av[i]);
>> ++              }
>> +               isr >>= 1;
>> +       }
>> +
>> +@@ -2386,8 +2638,8 @@ static NOINLINE var *exec_builtin(node *op,
>> var *res)
>> +               char *s, *s1;
>> +
>> +               if (nargs > 2) {
>> +-                      spl = (an[2]->info & OPCLSMASK) == OC_REGEXP
>> ?
>> +-                              an[2] :
>> mk_splitter(getvar_s(evaluate(an[2], &tv[2])), &tspl);
>> ++                      spl = (an[2]->info == TI_REGEXP) ? an[2]
>> ++                              :
>> mk_splitter(getvar_s(evaluate(an[2], TMPVAR2)), &tspl);
>> +               } else {
>> +                       spl = &fsplitter.n;
>> +               }
>> +@@ -2501,20 +2753,7 @@ static NOINLINE var *exec_builtin(node *op,
>> var *res)
>> +               break;
>> +
>> +       case B_ma:
>> +-              re = as_regex(an[1], &sreg);
>> +-              n = regexec(re, as[0], 1, pmatch, 0);
>> +-              if (n == 0) {
>> +-                      pmatch[0].rm_so++;
>> +-                      pmatch[0].rm_eo++;
>> +-              } else {
>> +-                      pmatch[0].rm_so = 0;
>> +-                      pmatch[0].rm_eo = -1;
>> +-              }
>> +-              setvar_i(newvar("RSTART"), pmatch[0].rm_so);
>> +-              setvar_i(newvar("RLENGTH"), pmatch[0].rm_eo -
>> pmatch[0].rm_so);
>> +-              setvar_i(res, pmatch[0].rm_so);
>> +-              if (re == &sreg)
>> +-                      regfree(re);
>> ++              res = do_match(an[1], as[0]);
>> +               break;
>> +
>> +       case B_ge:
>> +@@ -2530,14 +2769,79 @@ static NOINLINE var *exec_builtin(node *op,
>> var *res)
>> +               break;
>> +       }
>> +
>> +-      nvfree(tv);
>> ++      nvfree(tmpvars, 4);
>> ++#undef TMPVAR0
>> ++#undef TMPVAR1
>> ++#undef TMPVAR2
>> ++#undef TMPVAR3
>> ++#undef TMPVAR
>> ++
>> +       return res;
>> + #undef tspl
>> + }
>> +
>> ++/* if expr looks like "var=value", perform assignment and return 1,
>> ++ * otherwise return 0 */
>> ++static int is_assignment(const char *expr)
>> ++{
>> ++      char *exprc, *val;
>> ++
>> ++      val = (char*)endofname(expr);
>> ++      if (val == (char*)expr || *val != '=') {
>> ++              return FALSE;
>> ++      }
>> ++
>> ++      exprc = xstrdup(expr);
>> ++      val = exprc + (val - expr);
>> ++      *val++ = '\0';
>> ++
>> ++      unescape_string_in_place(val);
>> ++      setvar_u(newvar(exprc), val);
>> ++      free(exprc);
>> ++      return TRUE;
>> ++}
>> ++
>> ++/* switch to next input file */
>> ++static rstream *next_input_file(void)
>> ++{
>> ++#define rsm          (G.next_input_file__rsm)
>> ++#define files_happen (G.next_input_file__files_happen)
>> ++
>> ++      const char *fname, *ind;
>> ++
>> ++      if (rsm.F)
>> ++              fclose(rsm.F);
>> ++      rsm.F = NULL;
>> ++      rsm.pos = rsm.adv = 0;
>> ++
>> ++      for (;;) {
>> ++              if (getvar_i(intvar[ARGIND])+1 >=
>> getvar_i(intvar[ARGC])) {
>> ++                      if (files_happen)
>> ++                              return NULL;
>> ++                      fname = "-";
>> ++                      rsm.F = stdin;
>> ++                      break;
>> ++              }
>> ++              ind = getvar_s(incvar(intvar[ARGIND]));
>> ++              fname = getvar_s(findvar(iamarray(intvar[ARGV]),
>> ind));
>> ++              if (fname && *fname && !is_assignment(fname)) {
>> ++                      rsm.F = xfopen_stdin(fname);
>> ++                      break;
>> ++              }
>> ++      }
>> ++
>> ++      files_happen = TRUE;
>> ++      setvar_s(intvar[FILENAME], fname);
>> ++      return &rsm;
>> ++#undef rsm
>> ++#undef files_happen
>> ++}
>> ++
>> + /*
>> +  * Evaluate node - the heart of the program. Supplied with subtree
>> +- * and place where to store result. returns ptr to result.
>> ++ * and "res" variable to assign the result to if we evaluate an
>> expression.
>> ++ * If node refers to e.g. a variable or a field, no assignment
>> happens.
>> ++ * Return ptr to the result (which may or may not be the "res"
>> variable!)
>> +  */
>> + #define XC(n) ((n) >> 8)
>> +
>> +@@ -2549,14 +2853,16 @@ static var *evaluate(node *op, var *res)
>> + #define seed   (G.evaluate__seed)
>> + #define sreg   (G.evaluate__sreg)
>> +
>> +-      var *v1;
>> ++      var *tmpvars;
>> +
>> +       if (!op)
>> +               return setvar_s(res, NULL);
>> +
>> +       debug_printf_eval("entered %s()\n", __func__);
>> +
>> +-      v1 = nvalloc(2);
>> ++      tmpvars = nvalloc(2);
>> ++#define TMPVAR0 (tmpvars)
>> ++#define TMPVAR1 (tmpvars + 1)
>> +
>> +       while (op) {
>> +               struct {
>> +@@ -2578,48 +2884,35 @@ static var *evaluate(node *op, var *res)
>> +               op1 = op->l.n;
>> +               debug_printf_eval("opinfo:%08x opn:%08x\n", opinfo,
>> opn);
>> +
>> +-              /* "delete" is special:
>> +-               * "delete array[var--]" must evaluate index expr
>> only once,
>> +-               * must not evaluate it in "execute inevitable
>> things" part.
>> +-               */
>> +-              if (XC(opinfo & OPCLSMASK) == XC(OC_DELETE)) {
>> +-                      uint32_t info = op1->info & OPCLSMASK;
>> +-                      var *v;
>> +-
>> +-                      debug_printf_eval("DELETE\n");
>> +-                      if (info == OC_VAR) {
>> +-                              v = op1->l.v;
>> +-                      } else if (info == OC_FNARG) {
>> +-                              v = &fnargs[op1->l.aidx];
>> +-                      } else {
>> +-                              syntax_error(EMSG_NOT_ARRAY);
>> ++              /* execute inevitable things */
>> ++              if (opinfo & OF_RES1) {
>> ++                      if ((opinfo & OF_REQUIRED) && !op1)
>> ++                              syntax_error(EMSG_TOO_FEW_ARGS);
>> ++                      L.v = evaluate(op1, TMPVAR0);
>> ++                      if (opinfo & OF_STR1) {
>> ++                              L.s = getvar_s(L.v);
>> ++                              debug_printf_eval("L.s:'%s'\n", L.s);
>> +                       }
>> +-                      if (op1->r.n) { /* array ref? */
>> +-                              const char *s;
>> +-                              s = getvar_s(evaluate(op1->r.n, v1));
>> +-                              hash_remove(iamarray(v), s);
>> +-                      } else {
>> +-                              clear_array(iamarray(v));
>> ++                      if (opinfo & OF_NUM1) {
>> ++                              L_d = getvar_i(L.v);
>> ++                              debug_printf_eval("L_d:%f\n", L_d);
>> +                       }
>> +-                      goto next;
>> +               }
>> +-
>> +-              /* execute inevitable things */
>> +-              if (opinfo & OF_RES1)
>> +-                      L.v = evaluate(op1, v1);
>> +-              if (opinfo & OF_RES2)
>> +-                      R.v = evaluate(op->r.n, v1+1);
>> +-              if (opinfo & OF_STR1) {
>> +-                      L.s = getvar_s(L.v);
>> +-                      debug_printf_eval("L.s:'%s'\n", L.s);
>> +-              }
>> +-              if (opinfo & OF_STR2) {
>> +-                      R.s = getvar_s(R.v);
>> +-                      debug_printf_eval("R.s:'%s'\n", R.s);
>> +-              }
>> +-              if (opinfo & OF_NUM1) {
>> +-                      L_d = getvar_i(L.v);
>> +-                      debug_printf_eval("L_d:%f\n", L_d);
>> ++              /* NB: Must get string/numeric values of L (done
>> above)
>> ++               * _before_ evaluate()'ing R.v: if both L and R are
>> $NNNs,
>> ++               * and right one is large, then L.v points to
>> Fields[NNN1],
>> ++               * second evaluate() reallocates and moves (!)
>> Fields[],
>> ++               * R.v points to Fields[NNN2] but L.v now points to
>> freed mem!
>> ++               * (Seen trying to evaluate "$444 $44444")
>> ++               */
>> ++              if (opinfo & OF_RES2) {
>> ++                      R.v = evaluate(op->r.n, TMPVAR1);
>> ++                      //TODO: L.v may be invalid now, set L.v to
>> NULL to catch bugs?
>> ++                      //L.v = NULL;
>> ++                      if (opinfo & OF_STR2) {
>> ++                              R.s = getvar_s(R.v);
>> ++                              debug_printf_eval("R.s:'%s'\n", R.s);
>> ++                      }
>> +               }
>> +
>> +               debug_printf_eval("switch(0x%x)\n", XC(opinfo &
>> OPCLSMASK));
>> +@@ -2629,7 +2922,8 @@ static var *evaluate(node *op, var *res)
>> +
>> +               /* test pattern */
>> +               case XC( OC_TEST ):
>> +-                      if ((op1->info & OPCLSMASK) == OC_COMMA) {
>> ++                      debug_printf_eval("TEST\n");
>> ++                      if (op1->info == TI_COMMA) {
>> +                               /* it's range pattern */
>> +                               if ((opinfo & OF_CHECKED) ||
>> ptest(op1->l.n)) {
>> +                                       op->info |= OF_CHECKED;
>> +@@ -2646,25 +2940,32 @@ static var *evaluate(node *op, var *res)
>> +
>> +               /* just evaluate an expression, also used as
>> unconditional jump */
>> +               case XC( OC_EXEC ):
>> ++                      debug_printf_eval("EXEC\n");
>> +                       break;
>> +
>> +               /* branch, used in if-else and various loops */
>> +               case XC( OC_BR ):
>> ++                      debug_printf_eval("BR\n");
>> +                       op = istrue(L.v) ? op->a.n : op->r.n;
>> +                       break;
>> +
>> +               /* initialize for-in loop */
>> +               case XC( OC_WALKINIT ):
>> ++                      debug_printf_eval("WALKINIT\n");
>> +                       hashwalk_init(L.v, iamarray(R.v));
>> +                       break;
>> +
>> +               /* get next array item */
>> +               case XC( OC_WALKNEXT ):
>> ++                      debug_printf_eval("WALKNEXT\n");
>> +                       op = hashwalk_next(L.v) ? op->a.n : op->r.n;
>> +                       break;
>> +
>> +               case XC( OC_PRINT ):
>> +-              case XC( OC_PRINTF ): {
>> ++                      debug_printf_eval("PRINT /\n");
>> ++              case XC( OC_PRINTF ):
>> ++                      debug_printf_eval("PRINTF\n");
>> ++              {
>> +                       FILE *F = stdout;
>> +
>> +                       if (op->r.n) {
>> +@@ -2682,55 +2983,94 @@ static var *evaluate(node *op, var *res)
>> +                               F = rsm->F;
>> +                       }
>> +
>> ++                      /* Can't just check 'opinfo == OC_PRINT'
>> here, parser ORs
>> ++                       * additional bits to opinfos of print/printf
>> with redirects
>> ++                       */
>> +                       if ((opinfo & OPCLSMASK) == OC_PRINT) {
>> +                               if (!op1) {
>> +                                       fputs(getvar_s(intvar[F0]),
>> F);
>> +                               } else {
>> +-                                      while (op1) {
>> +-                                              var *v =
>> evaluate(nextarg(&op1), v1);
>> ++                                      for (;;) {
>> ++                                              var *v =
>> evaluate(nextarg(&op1), TMPVAR0);
>> +                                               if (v->type &
>> VF_NUMBER) {
>> +-
>>                                                        fmt_num(g_buf,
>> MAXVARFMT, getvar_s(intvar[OFMT]),
>> +-
>>                                                                       
>>   getvar_i(v), TRUE);
>> ++                                                      fmt_num(getva
>> r_s(intvar[OFMT]),
>> ++
>>     getvar_i(v));
>> +                                                       fputs(g_buf,
>> F);
>> +                                               } else {
>> +                                                       fputs(getvar_
>> s(v), F);
>> +                                               }
>> +-
>> +-                                              if (op1)
>> +-
>>                                                        fputs(getvar_s(
>> intvar[OFS]), F);
>> ++                                              if (!op1)
>> ++                                                      break;
>> ++                                              fputs(getvar_s(intvar
>> [OFS]), F);
>> +                                       }
>> +                               }
>> +                               fputs(getvar_s(intvar[ORS]), F);
>> +-
>> +-                      } else {        /* OC_PRINTF */
>> +-                              char *s = awk_printf(op1);
>> ++                      } else {        /* PRINTF */
>> ++                              IF_FEATURE_AWK_GNU_EXTENSIONS(size_t
>> len;)
>> ++                              char *s = awk_printf(op1, &len);
>> ++#if ENABLE_FEATURE_AWK_GNU_EXTENSIONS
>> ++                              fwrite(s, len, 1, F);
>> ++#else
>> +                               fputs(s, F);
>> ++#endif
>> +                               free(s);
>> +                       }
>> +                       fflush(F);
>> +                       break;
>> +               }
>> +
>> +-              /* case XC( OC_DELETE ): - moved to happen before arg
>> evaluation */
>> ++              case XC( OC_DELETE ):
>> ++                      debug_printf_eval("DELETE\n");
>> ++              {
>> ++                      /* "delete" is special:
>> ++                       * "delete array[var--]" must evaluate index
>> expr only once.
>> ++                       */
>> ++                      uint32_t info = op1->info & OPCLSMASK;
>> ++                      var *v;
>> ++
>> ++                      if (info == OC_VAR) {
>> ++                              v = op1->l.v;
>> ++                      } else if (info == OC_FNARG) {
>> ++                              v = &fnargs[op1->l.aidx];
>> ++                      } else {
>> ++                              syntax_error(EMSG_NOT_ARRAY);
>> ++                      }
>> ++                      if (op1->r.n) { /* array ref? */
>> ++                              const char *s;
>> ++                              s = getvar_s(evaluate(op1->r.n,
>> TMPVAR0));
>> ++                              hash_remove(iamarray(v), s);
>> ++                      } else {
>> ++                              clear_array(iamarray(v));
>> ++                      }
>> ++                      break;
>> ++              }
>> +
>> +               case XC( OC_NEWSOURCE ):
>> ++                      debug_printf_eval("NEWSOURCE\n");
>> +                       g_progname = op->l.new_progname;
>> +                       break;
>> +
>> +               case XC( OC_RETURN ):
>> ++                      debug_printf_eval("RETURN\n");
>> +                       copyvar(res, L.v);
>> +                       break;
>> +
>> +               case XC( OC_NEXTFILE ):
>> ++                      debug_printf_eval("NEXTFILE\n");
>> +                       nextfile = TRUE;
>> +               case XC( OC_NEXT ):
>> ++                      debug_printf_eval("NEXT\n");
>> +                       nextrec = TRUE;
>> +               case XC( OC_DONE ):
>> ++                      debug_printf_eval("DONE\n");
>> +                       clrvar(res);
>> +                       break;
>> +
>> +               case XC( OC_EXIT ):
>> +-                      awk_exit(L_d);
>> ++                      debug_printf_eval("EXIT\n");
>> ++                      if (op1)
>> ++                              G.exitcode = (int)L_d;
>> ++                      awk_exit();
>> +
>> +               /* -- recursive node type -- */
>> +
>> +@@ -2749,15 +3089,18 @@ static var *evaluate(node *op, var *res)
>> +                       break;
>> +
>> +               case XC( OC_IN ):
>> ++                      debug_printf_eval("IN\n");
>> +                       setvar_i(res, hash_search(iamarray(R.v), L.s)
>> ? 1 : 0);
>> +                       break;
>> +
>> +               case XC( OC_REGEXP ):
>> ++                      debug_printf_eval("REGEXP\n");
>> +                       op1 = op;
>> +                       L.s = getvar_s(intvar[F0]);
>> +                       goto re_cont;
>> +
>> +               case XC( OC_MATCH ):
>> ++                      debug_printf_eval("MATCH\n");
>> +                       op1 = op->r.n;
>> +  re_cont:
>> +                       {
>> +@@ -2772,61 +3115,80 @@ static var *evaluate(node *op, var *res)
>> +               case XC( OC_MOVE ):
>> +                       debug_printf_eval("MOVE\n");
>> +                       /* if source is a temporary string, jusk
>> relink it to dest */
>> +-//Disabled: if R.v is numeric but happens to have cached R.v-
>>> string,
>> +-//then L.v ends up being a string, which is wrong
>> +-//                    if (R.v == v1+1 && R.v->string) {
>> +-//                            res = setvar_p(L.v, R.v->string);
>> +-//                            R.v->string = NULL;
>> +-//                    } else {
>> ++                      if (R.v == TMPVAR1
>> ++                       && !(R.v->type & VF_NUMBER)
>> ++                              /* Why check !NUMBER? if R.v is a
>> number but has cached R.v->string,
>> ++                               * L.v ends up a string, which is
>> wrong */
>> ++                       /*&& R.v->string - always not NULL (right?)
>> */
>> ++                      ) {
>> ++                              res = setvar_p(L.v, R.v->string); /*
>> avoids strdup */
>> ++                              R.v->string = NULL;
>> ++                      } else {
>> +                               res = copyvar(L.v, R.v);
>> +-//                    }
>> ++                      }
>> +                       break;
>> +
>> +               case XC( OC_TERNARY ):
>> +-                      if ((op->r.n->info & OPCLSMASK) != OC_COLON)
>> ++                      debug_printf_eval("TERNARY\n");
>> ++                      if (op->r.n->info != TI_COLON)
>> +                               syntax_error(EMSG_POSSIBLE_ERROR);
>> +                       res = evaluate(istrue(L.v) ? op->r.n->l.n :
>> op->r.n->r.n, res);
>> +                       break;
>> +
>> +               case XC( OC_FUNC ): {
>> +-                      var *vbeg, *v;
>> ++                      var *argvars, *sv_fnargs;
>> +                       const char *sv_progname;
>> ++                      int nargs, i;
>> +
>> +-                      /* The body might be empty, still has to eval
>> the args */
>> +-                      if (!op->r.n->info && !op->r.f->body.first)
>> ++                      debug_printf_eval("FUNC\n");
>> ++
>> ++                      if (!op->r.f->defined)
>> +                               syntax_error(EMSG_UNDEF_FUNC);
>> +
>> +-                      vbeg = v = nvalloc(op->r.f->nargs + 1);
>> ++                      /* The body might be empty, still has to eval
>> the args */
>> ++                      nargs = op->r.f->nargs;
>> ++                      argvars = nvalloc(nargs);
>> ++                      i = 0;
>> +                       while (op1) {
>> +-                              var *arg = evaluate(nextarg(&op1),
>> v1);
>> +-                              copyvar(v, arg);
>> +-                              v->type |= VF_CHILD;
>> +-                              v->x.parent = arg;
>> +-                              if (++v - vbeg >= op->r.f->nargs)
>> +-                                      break;
>> ++                              var *arg = evaluate(nextarg(&op1),
>> TMPVAR0);
>> ++                              if (i == nargs) {
>> ++                                      /* call with more arguments
>> than function takes.
>> ++                                       * (gawk warns: "warning:
>> function 'f' called with more arguments than declared").
>> ++                                       * They are still evaluated,
>> but discarded: */
>> ++                                      clrvar(arg);
>> ++                                      continue;
>> ++                              }
>> ++                              copyvar(&argvars[i], arg);
>> ++                              argvars[i].type |= VF_CHILD;
>> ++                              argvars[i].x.parent = arg;
>> ++                              i++;
>> +                       }
>> +
>> +-                      v = fnargs;
>> +-                      fnargs = vbeg;
>> ++                      sv_fnargs = fnargs;
>> +                       sv_progname = g_progname;
>> +
>> ++                      fnargs = argvars;
>> +                       res = evaluate(op->r.f->body.first, res);
>> ++                      nvfree(argvars, nargs);
>> +
>> +                       g_progname = sv_progname;
>> +-                      nvfree(fnargs);
>> +-                      fnargs = v;
>> ++                      fnargs = sv_fnargs;
>> +
>> +                       break;
>> +               }
>> +
>> +               case XC( OC_GETLINE ):
>> +-              case XC( OC_PGETLINE ): {
>> ++                      debug_printf_eval("GETLINE /\n");
>> ++              case XC( OC_PGETLINE ):
>> ++                      debug_printf_eval("PGETLINE\n");
>> ++              {
>> +                       rstream *rsm;
>> +                       int i;
>> +
>> +                       if (op1) {
>> +                               rsm = newfile(L.s);
>> +                               if (!rsm->F) {
>> ++                                      /* NB: can't use "opinfo ==
>> TI_PGETLINE", would break "cmd" | getline */
>> +                                       if ((opinfo & OPCLSMASK) ==
>> OC_PGETLINE) {
>> +                                               rsm->F = popen(L.s,
>> "r");
>> +                                               rsm->is_pipe = TRUE;
>> +@@ -2861,16 +3223,34 @@ static var *evaluate(node *op, var *res)
>> +               /* simple builtins */
>> +               case XC( OC_FBLTIN ): {
>> +                       double R_d = R_d; /* for compiler */
>> ++                      debug_printf_eval("FBLTIN\n");
>> ++
>> ++                      if (op1 && op1->info == TI_COMMA)
>> ++                              /* Simple builtins take one arg
>> maximum */
>> ++                              syntax_error("Too many arguments");
>> +
>> +                       switch (opn) {
>> +                       case F_in:
>> +                               R_d = (long long)L_d;
>> +                               break;
>> +
>> +-                      case F_rn:
>> +-                              R_d = (double)rand() /
>> (double)RAND_MAX;
>> ++                      case F_rn: /*rand*/
>> ++                              if (op1)
>> ++                                      syntax_error("Too many
>> arguments");
>> ++                      {
>> ++#if RAND_MAX >= 0x7fffffff
>> ++                              uint32_t u = ((uint32_t)rand() << 16)
>> ^ rand();
>> ++                              uint64_t v = ((uint64_t)rand() << 32)
>> | u;
>> ++                              /* the above shift+or is optimized
>> out on 32-bit arches */
>> ++# if RAND_MAX > 0x7fffffff
>> ++                              v &= 0x7fffffffffffffffULL;
>> ++# endif
>> ++                              R_d = (double)v /
>> 0x8000000000000000ULL;
>> ++#else
>> ++# error Not implemented for this value of RAND_MAX
>> ++#endif
>> +                               break;
>> +-
>> ++                      }
>> +                       case F_co:
>> +                               if (ENABLE_FEATURE_AWK_LIBM) {
>> +                                       R_d = cos(L_d);
>> +@@ -2910,7 +3290,9 @@ static var *evaluate(node *op, var *res)
>> +                               srand(seed);
>> +                               break;
>> +
>> +-                      case F_ti:
>> ++                      case F_ti: /*systime*/
>> ++                              if (op1)
>> ++                                      syntax_error("Too many
>> arguments");
>> +                               R_d = time(NULL);
>> +                               break;
>> +
>> +@@ -2949,7 +3331,7 @@ static var *evaluate(node *op, var *res)
>> +                               rstream *rsm;
>> +                               int err = 0;
>> +                               rsm = (rstream *)hash_search(fdhash,
>> L.s);
>> +-                              debug_printf_eval("OC_FBLTIN F_cl
>> rsm:%p\n", rsm);
>> ++                              debug_printf_eval("OC_FBLTIN close:
>> op1:%p s:'%s' rsm:%p\n", op1, L.s, rsm);
>> +                               if (rsm) {
>> +                                       debug_printf_eval("OC_FBLTIN
>> F_cl "
>> +                                               "rsm->is_pipe:%d, -
>>> F:%p\n",
>> +@@ -2960,6 +3342,11 @@ static var *evaluate(node *op, var *res)
>> +                                        */
>> +                                       if (rsm->F)
>> +                                               err = rsm->is_pipe ?
>> pclose(rsm->F) : fclose(rsm->F);
>> ++//TODO: fix this case:
>> ++// $ awk 'BEGIN { print close(""); print ERRNO }'
>> ++// -1
>> ++// close of redirection that was never opened
>> ++// (we print 0, 0)
>> +                                       free(rsm->buffer);
>> +                                       hash_remove(fdhash, L.s);
>> +                               }
>> +@@ -2974,14 +3361,18 @@ static var *evaluate(node *op, var *res)
>> +               }
>> +
>> +               case XC( OC_BUILTIN ):
>> ++                      debug_printf_eval("BUILTIN\n");
>> +                       res = exec_builtin(op, res);
>> +                       break;
>> +
>> +               case XC( OC_SPRINTF ):
>> +-                      setvar_p(res, awk_printf(op1));
>> ++                      debug_printf_eval("SPRINTF\n");
>> ++                      setvar_p(res, awk_printf(op1, NULL));
>> +                       break;
>> +
>> +-              case XC( OC_UNARY ): {
>> ++              case XC( OC_UNARY ):
>> ++                      debug_printf_eval("UNARY\n");
>> ++              {
>> +                       double Ld, R_d;
>> +
>> +                       Ld = R_d = getvar_i(R.v);
>> +@@ -3011,7 +3402,9 @@ static var *evaluate(node *op, var *res)
>> +                       break;
>> +               }
>> +
>> +-              case XC( OC_FIELD ): {
>> ++              case XC( OC_FIELD ):
>> ++                      debug_printf_eval("FIELD\n");
>> ++              {
>> +                       int i = (int)getvar_i(R.v);
>> +                       if (i < 0)
>> +                               syntax_error(EMSG_NEGATIVE_FIELD);
>> +@@ -3028,26 +3421,33 @@ static var *evaluate(node *op, var *res)
>> +
>> +               /* concatenation (" ") and index joining (",") */
>> +               case XC( OC_CONCAT ):
>> ++                      debug_printf_eval("CONCAT /\n");
>> +               case XC( OC_COMMA ): {
>> +                       const char *sep = "";
>> +-                      if ((opinfo & OPCLSMASK) == OC_COMMA)
>> ++                      debug_printf_eval("COMMA\n");
>> ++                      if (opinfo == TI_COMMA)
>> +                               sep = getvar_s(intvar[SUBSEP]);
>> +                       setvar_p(res, xasprintf("%s%s%s", L.s, sep,
>> R.s));
>> +                       break;
>> +               }
>> +
>> +               case XC( OC_LAND ):
>> ++                      debug_printf_eval("LAND\n");
>> +                       setvar_i(res, istrue(L.v) ? ptest(op->r.n) :
>> 0);
>> +                       break;
>> +
>> +               case XC( OC_LOR ):
>> ++                      debug_printf_eval("LOR\n");
>> +                       setvar_i(res, istrue(L.v) ? 1 : ptest(op-
>>> r.n));
>> +                       break;
>> +
>> +               case XC( OC_BINARY ):
>> +-              case XC( OC_REPLACE ): {
>> ++                      debug_printf_eval("BINARY /\n");
>> ++              case XC( OC_REPLACE ):
>> ++                      debug_printf_eval("REPLACE\n");
>> ++              {
>> +                       double R_d = getvar_i(R.v);
>> +-                      debug_printf_eval("BINARY/REPLACE: R_d:%f
>> opn:%c\n", R_d, opn);
>> ++                      debug_printf_eval("R_d:%f opn:%c\n", R_d,
>> opn);
>> +                       switch (opn) {
>> +                       case '+':
>> +                               L_d += R_d;
>> +@@ -3083,6 +3483,7 @@ static var *evaluate(node *op, var *res)
>> +               case XC( OC_COMPARE ): {
>> +                       int i = i; /* for compiler */
>> +                       double Ld;
>> ++                      debug_printf_eval("COMPARE\n");
>> +
>> +                       if (is_numeric(L.v) && is_numeric(R.v)) {
>> +                               Ld = getvar_i(L.v) - getvar_i(R.v);
>> +@@ -3109,7 +3510,7 @@ static var *evaluate(node *op, var *res)
>> +               default:
>> +                     �� syntax_error(EMSG_POSSIBLE_ERROR);
>> +               } /* switch */
>> +- next:
>> ++
>> +               if ((opinfo & OPCLSMASK) <= SHIFT_TIL_THIS)
>> +                       op = op->a.n;
>> +               if ((opinfo & OPCLSMASK) >= RECUR_FROM_THIS)
>> +@@ -3118,7 +3519,10 @@ static var *evaluate(node *op, var *res)
>> +                       break;
>> +       } /* while (op) */
>> +
>> +-      nvfree(v1);
>> ++      nvfree(tmpvars, 2);
>> ++#undef TMPVAR0
>> ++#undef TMPVAR1
>> ++
>> +       debug_printf_eval("returning from %s(): %p\n", __func__,
>> res);
>> +       return res;
>> + #undef fnargs
>> +@@ -3126,25 +3530,21 @@ static var *evaluate(node *op, var *res)
>> + #undef sreg
>> + }
>> +
>> +-
>> + /* -------- main & co. -------- */
>> +
>> +-static int awk_exit(int r)
>> ++static int awk_exit(void)
>> + {
>> +-      var tv;
>> +       unsigned i;
>> +-      hash_item *hi;
>> +-
>> +-      zero_out_var(&tv);
>> +
>> +       if (!exiting) {
>> +               exiting = TRUE;
>> +               nextrec = FALSE;
>> +-              evaluate(endseq.first, &tv);
>> ++              evaluate(endseq.first, &G.exit__tmpvar);
>> +       }
>> +
>> +       /* waiting for children */
>> +       for (i = 0; i < fdhash->csize; i++) {
>> ++              hash_item *hi;
>> +               hi = fdhash->items[i];
>> +               while (hi) {
>> +                       if (hi->data.rs.F && hi->data.rs.is_pipe)
>> +@@ -3153,65 +3553,7 @@ static int awk_exit(int r)
>> +               }
>> +       }
>> +
>> +-      exit(r);
>> +-}
>> +-
>> +-/* if expr looks like "var=value", perform assignment and return 1,
>> +- * otherwise return 0 */
>> +-static int is_assignment(const char *expr)
>> +-{
>> +-      char *exprc, *val;
>> +-
>> +-      if (!isalnum_(*expr) || (val = strchr(expr, '=')) == NULL) {
>> +-              return FALSE;
>> +-      }
>> +-
>> +-      exprc = xstrdup(expr);
>> +-      val = exprc + (val - expr);
>> +-      *val++ = '\0';
>> +-
>> +-      unescape_string_in_place(val);
>> +-      setvar_u(newvar(exprc), val);
>> +-      free(exprc);
>> +-      return TRUE;
>> +-}
>> +-
>> +-/* switch to next input file */
>> +-static rstream *next_input_file(void)
>> +-{
>> +-#define rsm          (G.next_input_file__rsm)
>> +-#define files_happen (G.next_input_file__files_happen)
>> +-
>> +-      FILE *F;
>> +-      const char *fname, *ind;
>> +-
>> +-      if (rsm.F)
>> +-              fclose(rsm.F);
>> +-      rsm.F = NULL;
>> +-      rsm.pos = rsm.adv = 0;
>> +-
>> +-      for (;;) {
>> +-              if (getvar_i(intvar[ARGIND])+1 >=
>> getvar_i(intvar[ARGC])) {
>> +-                      if (files_happen)
>> +-                              return NULL;
>> +-                      fname = "-";
>> +-                      F = stdin;
>> +-                      break;
>> +-              }
>> +-              ind = getvar_s(incvar(intvar[ARGIND]));
>> +-              fname = getvar_s(findvar(iamarray(intvar[ARGV]),
>> ind));
>> +-              if (fname && *fname && !is_assignment(fname)) {
>> +-                      F = xfopen_stdin(fname);
>> +-                      break;
>> +-              }
>> +-      }
>> +-
>> +-      files_happen = TRUE;
>> +-      setvar_s(intvar[FILENAME], fname);
>> +-      rsm.F = F;
>> +-      return &rsm;
>> +-#undef rsm
>> +-#undef files_happen
>> ++      exit(G.exitcode);
>> + }
>> +
>> + int awk_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
>> +@@ -3224,12 +3566,7 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> + #if ENABLE_FEATURE_AWK_GNU_EXTENSIONS
>> +       llist_t *list_e = NULL;
>> + #endif
>> +-      int i, j;
>> +-      var *v;
>> +-      var tv;
>> +-      char **envp;
>> +-      char *vnames = (char *)vNames; /* cheat */
>> +-      char *vvalues = (char *)vValues;
>> ++      int i;
>> +
>> +       INIT_G();
>> +
>> +@@ -3238,48 +3575,43 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> +       if (ENABLE_LOCALE_SUPPORT)
>> +               setlocale(LC_NUMERIC, "C");
>> +
>> +-      zero_out_var(&tv);
>> +-
>> +-      /* allocate global buffer */
>> +-      g_buf = xmalloc(MAXVARFMT + 1);
>> +-
>> +-      vhash = hash_init();
>> +-      ahash = hash_init();
>> +-      fdhash = hash_init();
>> +-      fnhash = hash_init();
>> +-
>> +       /* initialize variables */
>> +-      for (i = 0; *vnames; i++) {
>> +-              intvar[i] = v = newvar(nextword(&vnames));
>> +-              if (*vvalues != '\377')
>> +-                      setvar_s(v, nextword(&vvalues));
>> +-              else
>> +-                      setvar_i(v, 0);
>> +-
>> +-              if (*vnames == '*') {
>> +-                      v->type |= VF_SPECIAL;
>> +-                      vnames++;
>> ++      vhash = hash_init();
>> ++      {
>> ++              char *vnames = (char *)vNames; /* cheat */
>> ++              char *vvalues = (char *)vValues;
>> ++              for (i = 0; *vnames; i++) {
>> ++                      var *v;
>> ++                      intvar[i] = v = newvar(nextword(&vnames));
>> ++                      if (*vvalues != '\377')
>> ++                              setvar_s(v, nextword(&vvalues));
>> ++                      else
>> ++                              setvar_i(v, 0);
>> ++
>> ++                      if (*vnames == '*') {
>> ++                              v->type |= VF_SPECIAL;
>> ++                              vnames++;
>> ++                      }
>> +               }
>> +       }
>> +
>> +       handle_special(intvar[FS]);
>> +       handle_special(intvar[RS]);
>> +
>> +-      newfile("/dev/stdin")->F = stdin;
>> +-      newfile("/dev/stdout")->F = stdout;
>> +-      newfile("/dev/stderr")->F = stderr;
>> +-
>> +       /* Huh, people report that sometimes environ is NULL. Oh
>> well. */
>> +-      if (environ) for (envp = environ; *envp; envp++) {
>> +-              /* environ is writable, thus we don't strdup it
>> needlessly */
>> +-              char *s = *envp;
>> +-              char *s1 = strchr(s, '=');
>> +-              if (s1) {
>> +-                      *s1 = '\0';
>> +-                      /* Both findvar and setvar_u take const char*
>> +-                       * as 2nd arg -> environment is not trashed
>> */
>> +-                      setvar_u(findvar(iamarray(intvar[ENVIRON]),
>> s), s1 + 1);
>> +-                      *s1 = '=';
>> ++      if (environ) {
>> ++              char **envp;
>> ++              for (envp = environ; *envp; envp++) {
>> ++                      /* environ is writable, thus we don't strdup
>> it needlessly */
>> ++                      char *s = *envp;
>> ++                      char *s1 = strchr(s, '=');
>> ++                      if (s1) {
>> ++                              *s1 = '\0';
>> ++                              /* Both findvar and setvar_u take
>> const char*
>> ++                               * as 2nd arg -> environment is not
>> trashed */
>> ++                              setvar_u(findvar(iamarray(intvar[ENVI
>> RON]), s), s1 + 1);
>> ++                              *s1 = '=';
>> ++                      }
>> +               }
>> +       }
>> +       opt = getopt32(argv, OPTSTR_AWK, &opt_F, &list_v, &list_f,
>> IF_FEATURE_AWK_GNU_EXTENSIONS(&list_e,) NULL);
>> +@@ -3295,20 +3627,19 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> +               if (!is_assignment(llist_pop(&list_v)))
>> +                       bb_show_usage();
>> +       }
>> ++
>> ++      /* Parse all supplied programs */
>> ++      fnhash = hash_init();
>> ++      ahash = hash_init();
>> +       while (list_f) {
>> +-              char *s = NULL;
>> +-              FILE *from_file;
>> ++              int fd;
>> ++              char *s;
>> +
>> +               g_progname = llist_pop(&list_f);
>> +-              from_file = xfopen_stdin(g_progname);
>> +-              /* one byte is reserved for some trick in next_token
>> */
>> +-              for (i = j = 1; j > 0; i += j) {
>> +-                      s = xrealloc(s, i + 4096);
>> +-                      j = fread(s + i, 1, 4094, from_file);
>> +-              }
>> +-              s[i] = '\0';
>> +-              fclose(from_file);
>> +-              parse_program(s + 1);
>> ++              fd = xopen_stdin(g_progname);
>> ++              s = xmalloc_read(fd, NULL); /* it's NUL-terminated */
>> ++              close(fd);
>> ++              parse_program(s);
>> +               free(s);
>> +       }
>> +       g_progname = "cmd. line";
>> +@@ -3317,11 +3648,23 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> +               parse_program(llist_pop(&list_e));
>> +       }
>> + #endif
>> ++//FIXME: preserve order of -e and -f
>> ++//TODO: implement -i LIBRARY and -E FILE too, they are easy-ish
>> +       if (!(opt & (OPT_f | OPT_e))) {
>> +               if (!*argv)
>> +                       bb_show_usage();
>> +               parse_program(*argv++);
>> +       }
>> ++      /* Free unused parse structures */
>> ++      //hash_free(fnhash); // ~250 bytes when empty, used only for
>> function names
>> ++      //^^^^^^^^^^^^^^^^^ does not work, hash_clear() inside SEGVs
>> ++      // (IOW: hash_clear() assumes it's a hash of variables.
>> fnhash is not).
>> ++      free(fnhash->items);
>> ++      free(fnhash);
>> ++      fnhash = NULL; // debug
>> ++      //hash_free(ahash); // empty after parsing, will reuse as
>> fdhash instead of freeing
>> ++
>> ++      /* Parsing done, on to executing */
>> +
>> +       /* fill in ARGV array */
>> +       setari_u(intvar[ARGV], 0, "awk");
>> +@@ -3330,9 +3673,14 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> +               setari_u(intvar[ARGV], ++i, *argv++);
>> +       setvar_i(intvar[ARGC], i + 1);
>> +
>> +-      evaluate(beginseq.first, &tv);
>> ++      //fdhash = ahash; // done via define
>> ++      newfile("/dev/stdin")->F = stdin;
>> ++      newfile("/dev/stdout")->F = stdout;
>> ++      newfile("/dev/stderr")->F = stderr;
>> ++
>> ++      evaluate(beginseq.first, &G.main__tmpvar);
>> +       if (!mainseq.first && !endseq.first)
>> +-              awk_exit(EXIT_SUCCESS);
>> ++              awk_exit();
>> +
>> +       /* input file could already be opened in BEGIN block */
>> +       if (!iF)
>> +@@ -3347,7 +3695,7 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> +                       nextrec = FALSE;
>> +                       incvar(intvar[NR]);
>> +                       incvar(intvar[FNR]);
>> +-                      evaluate(mainseq.first, &tv);
>> ++                      evaluate(mainseq.first, &G.main__tmpvar);
>> +
>> +                       if (nextfile)
>> +                               break;
>> +@@ -3359,6 +3707,6 @@ int awk_main(int argc UNUSED_PARAM, char
>> **argv)
>> +               iF = next_input_file();
>> +       }
>> +
>> +-      awk_exit(EXIT_SUCCESS);
>> ++      awk_exit();
>> +       /*return 0;*/
>> + }
>> +--
>> +2.33.0
>> +
>> diff --git a/meta/recipes-core/busybox/busybox/0002-man-fix-segfault-
>> in-man-1.patch b/meta/recipes-core/busybox/busybox/0002-man-fix-
>> segfault-in-man-1.patch
>> new file mode 100644
>> index 0000000000..4a930b7b6f
>> --- /dev/null
>> +++ b/meta/recipes-core/busybox/busybox/0002-man-fix-segfault-in-man-
>> 1.patch
>> @@ -0,0 +1,30 @@
>> +From 4975cace9bf96bfde174f8bb5cc4068d2ea294d4 Mon Sep 17 00:00:00
>> 2001
>> +From: Denys Vlasenko <vda.linux@googlemail.com>
>> +Date: Tue, 15 Jun 2021 14:47:46 +0200
>> +Subject: [PATCH] man: fix segfault in "man 1"
>> +
>> +function                                             old     new
>> delta
>> +man_main                                             942     954
>> +12
>> +
>> +Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
>> +
>> +Upstream-Status: Backport [4d4fc5ca5ee4f]
>> +CVE: CVE-2021-42373
>> +Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
>> +---
>> + miscutils/man.c | 2 +-
>> + 1 file changed, 1 insertion(+), 1 deletion(-)
>> +
>> +diff --git a/miscutils/man.c b/miscutils/man.c
>> +index 722f6641e..d319e8bba 100644
>> +--- a/miscutils/man.c
>> ++++ b/miscutils/man.c
>> +@@ -324,7 +324,7 @@ int man_main(int argc UNUSED_PARAM, char **argv)
>> +
>> +       /* is 1st ARG a SECTION? */
>> +       sec_list = conf_sec_list;
>> +-      if (is_section_name(conf_sec_list, *argv)) {
>> ++      if (is_section_name(conf_sec_list, *argv) && argv[1]) {
>> +               /* yes */
>> +               sec_list = *argv++;
>> +       }
>> diff --git a/meta/recipes-core/busybox/busybox_1.33.2.bb
>> b/meta/recipes-core/busybox/busybox_1.33.2.bb
>> index 44c83ab83c..4a0d3b4556 100644
>> --- a/meta/recipes-core/busybox/busybox_1.33.2.bb
>> +++ b/meta/recipes-core/busybox/busybox_1.33.2.bb
>> @@ -48,6 +48,8 @@ SRC_URI =
>> "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
>>             
>> file://0001-sysctl-ignore-EIO-of-stable_secret-below-proc-sys-ne.patch
>>   \
>>             
>> file://0001-gen_build_files-Use-C-locale-when-calling-sed-on-glo.patch
>>   \
>>              file://0001-mktemp-add-tmpdir-option.patch \
>> +           file://0001-awk-fix-CVEs.patch \
>> +           file://0002-man-fix-segfault-in-man-1.patch \
>>              "
>>   SRC_URI_append_libc-musl = " file://musl.cfg "
>>   
>>
>> 
>>



-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#160083): https://lists.openembedded.org/g/openembedded-core/message/160083
Mute This Topic: https://lists.openembedded.org/mt/88007703/4454766
Group Owner: openembedded-core+owner@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [openembedded-core@marc.info]
-=-=-=-=-=-=-=-=-=-=-=-



[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic