sh: Detect various additional errors in the parser.

Apart from detecting breakage earlier or at all, this also fixes a segfault
in the testsuite. The "handling" of the breakage left an invalid internal
representation in some cases.

Examples:
  echo a; do echo b
  echo `) echo a`
  echo `date; do do do`

Exp-run done by:	pav (with some other sh(1) changes)

bin/sh/parser.c

@@ -220,7 +220,7 @@ parsecmd(int interact)
 	if (t == TNL)
 		return NULL;
 	tokpushback++;
-	return list(1, 0);
+	return list(1, 1);
 }
 
 
@@ -231,7 +231,7 @@ list(int nlflag, int erflag)
 	int tok;
 
 	checkkwd = 2;
-	if (nlflag == 0 && tokendlist[peektoken()])
+	if (!nlflag && !erflag && tokendlist[peektoken()])
 		return NULL;
 	n1 = NULL;
 	for (;;) {
@@ -277,7 +277,7 @@ list(int nlflag, int erflag)
 				tokpushback++;
 			}
 			checkkwd = 2;
-			if (tokendlist[peektoken()])
+			if (!nlflag && !erflag && tokendlist[peektoken()])
 				return n1;
 			break;
 		case TEOF:

tools/regression/bin/sh/errors/bad-keyword1.0

@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+echo ':; fi' | sh -n 2>/dev/null && exit 1
+exit 0