From caa7ccdc544c568182438f6abb716be58b10bf25 Mon Sep 17 00:00:00 2001
From: Jilles Tjoelker <jilles@FreeBSD.org>
Date: Wed, 20 Apr 2011 22:24:54 +0000
Subject: [PATCH] sh: Do not word split "${#parameter}".

This is only a problem if IFS contains digits, which is unusual but valid.

Because of an incorrect fix for PR bin/12137, "${#parameter}" was treated
as ${#parameter}. The underlying problem was that "${#parameter}"
erroneously added CTLESC bytes before determining the length. This
was properly fixed for PR bin/56147 but the incorrect fix was not backed
out.

Reported by:	Seeker on forums.freebsd.org
MFC after:	2 weeks
---
 bin/sh/parser.c                             | 4 ++--
 tools/regression/bin/sh/expansion/length6.0 | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 tools/regression/bin/sh/expansion/length6.0

diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index 075c04d6e488..c4191b4ea181 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -1572,8 +1572,8 @@ parsesub: {
 			pungetc();
 		}
 		STPUTC('=', out);
-		if (subtype != VSLENGTH && (state[level].syntax == DQSYNTAX ||
-		    state[level].syntax == ARISYNTAX))
+		if (state[level].syntax == DQSYNTAX ||
+		    state[level].syntax == ARISYNTAX)
 			flags |= VSQUOTE;
 		*(stackblock() + typeloc) = subtype | flags;
 		if (subtype != VSNORMAL) {
diff --git a/tools/regression/bin/sh/expansion/length6.0 b/tools/regression/bin/sh/expansion/length6.0
new file mode 100644
index 000000000000..6b78309f6b81
--- /dev/null
+++ b/tools/regression/bin/sh/expansion/length6.0
@@ -0,0 +1,8 @@
+# $FreeBSD$
+
+x='!@#$%^&*()[]'
+[ ${#x} = 12 ] || echo bad 1
+[ "${#x}" = 12 ] || echo bad 2
+IFS=2
+[ ${#x} = 1 ] || echo bad 3
+[ "${#x}" = 12 ] || echo bad 4