shell/math: bash-compatible handling of too large numbers

function                                             old     new   delta
parse_with_base                                        -     170    +170
evaluate_string                                     1477    1309    -168
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 0/1 up/down: 170/-168)            Total: 2 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

9 files changed, 118 insertions, 44 deletions

diff --git a/shell/ash_test/ash-arith/arith-bignum1.right b/shell/ash_test/ash-arith/arith-bignum1.right
new file mode 100644
index 000000000..42a8016ec
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-bignum1.right
@@ -0,0 +1,13 @@
+18 digits: 999999999999999999
+19 digits: -8446744073709551617
+20 digits: 7766279631452241919
+18 digits- -999999999999999999
+19 digits- 8446744073709551617
+20 digits- -7766279631452241919
+Hex base#:
+16 digits: 9876543210abcedf
+17 digits: 876543210abcedfc
+18 digits: 76543210abcedfcc
+16 digits: 6789abcdef543121
+17 digits: 789abcdef5431204
+18 digits: 89abcdef54312034
diff --git a/shell/ash_test/ash-arith/arith-bignum1.tests b/shell/ash_test/ash-arith/arith-bignum1.tests
new file mode 100755
index 000000000..ef8f928bc
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-bignum1.tests
@@ -0,0 +1,17 @@
+exec 2>&1
+# If the number does not fit in 64 bits, bash uses truncated 64-bit value
+# (essentially, it does not check for overflow in "n = n * base + digit"
+# calculation).
+echo 18 digits: $((999999999999999999))
+echo 19 digits: $((9999999999999999999))
+echo 20 digits: $((99999999999999999999))
+echo 18 digits- $((-999999999999999999))
+echo 19 digits- $((-9999999999999999999))
+echo 20 digits- $((-99999999999999999999))
+echo "Hex base#:"
+printf '16 digits: %016x\n' $((16#9876543210abcedf))
+printf '17 digits: %016x\n' $((16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((16#9876543210abcedfcc))
+printf '16 digits: %016x\n' $((-16#9876543210abcedf))
+printf '17 digits: %016x\n' $((-16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((-16#9876543210abcedfcc))
diff --git a/shell/ash_test/ash-arith/arith.right b/shell/ash_test/ash-arith/arith.right
index 8bc78b8d1..b2c3f56d8 100644
--- a/shell/ash_test/ash-arith/arith.right
+++ b/shell/ash_test/ash-arith/arith.right
@@ -80,8 +80,9 @@ other bases
 62 62
 63 63
 missing number after base
-0 0
+./arith.tests: line 161: arithmetic syntax error
 ./arith.tests: line 162: arithmetic syntax error
+./arith.tests: line 163: arithmetic syntax error
 ./arith.tests: line 164: divide by zero
 ./arith.tests: let: line 165: arithmetic syntax error
 ./arith.tests: line 166: arithmetic syntax error
diff --git a/shell/ash_test/ash-arith/arith.tests b/shell/ash_test/ash-arith/arith.tests
index b9cb8ba4c..42cd7fdbf 100755
--- a/shell/ash_test/ash-arith/arith.tests
+++ b/shell/ash_test/ash-arith/arith.tests
@@ -155,12 +155,12 @@ echo 63 $(( 64#_ ))
 #ash# # weird bases (error)
 #ash# echo $(( 3425#56 ))
 
-echo missing number after base
-echo 0 $(( 2# ))
 
 # these should generate errors
+echo missing number after base
+(  echo $(( 2# ))          )
 (  echo $(( 7 = 43 ))      )
-#ash# echo $(( 2#44 ))
+(  echo $(( 2#44 ))        )
 (  echo $(( 44 / 0 ))      )
 (  let 'jv += $iv'         )
 (  echo $(( jv += \$iv ))  )
diff --git a/shell/hush_test/hush-arith/arith-bignum1.right b/shell/hush_test/hush-arith/arith-bignum1.right
new file mode 100644
index 000000000..42a8016ec
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-bignum1.right
@@ -0,0 +1,13 @@
+18 digits: 999999999999999999
+19 digits: -8446744073709551617
+20 digits: 7766279631452241919
+18 digits- -999999999999999999
+19 digits- 8446744073709551617
+20 digits- -7766279631452241919
+Hex base#:
+16 digits: 9876543210abcedf
+17 digits: 876543210abcedfc
+18 digits: 76543210abcedfcc
+16 digits: 6789abcdef543121
+17 digits: 789abcdef5431204
+18 digits: 89abcdef54312034
diff --git a/shell/hush_test/hush-arith/arith-bignum1.tests b/shell/hush_test/hush-arith/arith-bignum1.tests
new file mode 100755
index 000000000..ef8f928bc
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-bignum1.tests
@@ -0,0 +1,17 @@
+exec 2>&1
+# If the number does not fit in 64 bits, bash uses truncated 64-bit value
+# (essentially, it does not check for overflow in "n = n * base + digit"
+# calculation).
+echo 18 digits: $((999999999999999999))
+echo 19 digits: $((9999999999999999999))
+echo 20 digits: $((99999999999999999999))
+echo 18 digits- $((-999999999999999999))
+echo 19 digits- $((-9999999999999999999))
+echo 20 digits- $((-99999999999999999999))
+echo "Hex base#:"
+printf '16 digits: %016x\n' $((16#9876543210abcedf))
+printf '17 digits: %016x\n' $((16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((16#9876543210abcedfcc))
+printf '16 digits: %016x\n' $((-16#9876543210abcedf))
+printf '17 digits: %016x\n' $((-16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((-16#9876543210abcedfcc))
diff --git a/shell/hush_test/hush-arith/arith.right b/shell/hush_test/hush-arith/arith.right
index df8154f97..d3a978611 100644
--- a/shell/hush_test/hush-arith/arith.right
+++ b/shell/hush_test/hush-arith/arith.right
@@ -82,7 +82,8 @@ other bases
 62 62
 63 63
 missing number after base
-0 0
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 hush: arithmetic syntax error
 hush: divide by zero
 hush: can't execute 'let': No such file or directory
diff --git a/shell/hush_test/hush-arith/arith.tests b/shell/hush_test/hush-arith/arith.tests
index 6b707486c..9f0399816 100755
--- a/shell/hush_test/hush-arith/arith.tests
+++ b/shell/hush_test/hush-arith/arith.tests
@@ -159,12 +159,12 @@ echo 63 $(( 64#_ ))
 #ash# # weird bases (error)
 #ash# echo $(( 3425#56 ))
 
-echo missing number after base
-echo 0 $(( 2# ))
 
 # these should generate errors
+echo missing number after base
+(  echo $(( 2# ))          )
 (  echo $(( 7 = 43 ))      )
-#ash# echo $(( 2#44 ))
+(  echo $(( 2#44 ))        )
 (  echo $(( 44 / 0 ))      )
 (  let 'jv += $iv'         )
 (  echo $(( jv += \$iv ))  )
diff --git a/shell/math.c b/shell/math.c
index ac758639f..fbf5c587e 100644
--- a/shell/math.c
+++ b/shell/math.c
@@ -531,29 +531,11 @@ static const char op_tokens[] ALIGN1 = {
 #define END_POINTER (&op_tokens[sizeof(op_tokens)-1])
 
 #if ENABLE_FEATURE_SH_MATH_BASE
-static arith_t strto_arith_t(const char *nptr, char **endptr)
+static arith_t parse_with_base(const char *nptr, char **endptr, unsigned base)
 {
-	unsigned base;
-	arith_t n;
-
-# if ENABLE_FEATURE_SH_MATH_64
-	n = strtoull(nptr, endptr, 0);
-# else
-	n = strtoul(nptr, endptr, 0);
-# endif
-	if (**endptr != '#'
-	 || (*nptr < '1' || *nptr > '9')
-	 || (n < 2 || n > 64)
-	) {
-		return n;
-	}
+	arith_t n = 0;
+	const char *start = nptr;
 
-	/* It's "N#nnnn" or "NN#nnnn" syntax, NN can't start with 0,
-	 * NN is in 2..64 range.
-	 */
-	base = (unsigned)n;
-	n = 0;
-	nptr = *endptr + 1;
 	for (;;) {
 		unsigned digit = (unsigned)*nptr - '0';
 		if (digit >= 10 /* not 0..9 */
@@ -582,15 +564,52 @@ static arith_t strto_arith_t(const char *nptr, char **endptr)
 		n = n * base + digit;
 		nptr++;
 	}
-	/* Note: we do not set errno on bad chars, we just set a pointer
-	 * to the first invalid char. For example, this allows
-	 * "N#" (empty "nnnn" part): 64#+1 is a valid expression,
-	 * it means 64# + 1, whereas 64#~... is not, since ~ is not a valid
-	 * operator.
-	 */
 	*endptr = (char*)nptr;
+	/* "64#" and "64#+1" used to be valid expressions, but bash 5.2.15
+	 * no longer allow such, detect this:
+	 */
+// NB: bash allows $((0x)), this is probably a bug...
+	if (nptr == start)
+		*endptr = NULL; /* there weren't any digits, bad */
 	return n;
 }
+
+static arith_t strto_arith_t(const char *nptr, char **endptr)
+{
+/* NB: we do not use strtoull here to be bash-compatible:
+ * $((99999999999999999999)) is 7766279631452241919
+ * (the 64-bit truncated value).
+ */
+	unsigned base;
+
+	/* nptr[0] is '0'..'9' here */
+
+	base = nptr[0] - '0';
+	if (base == 0) { /* nptr[0] is '0' */
+		base = 8;
+		if ((nptr[1] | 0x20) == 'x') {
+			base = 16;
+			nptr += 2;
+		}
+// NB: bash allows $((0x)), this is probably a bug...
+		return parse_with_base(nptr, endptr, base);
+	}
+
+	if (nptr[1] == '#') {
+		if (base > 1)
+			return parse_with_base(nptr + 2, endptr, base);
+		/* else: bash says "invalid arithmetic base" */
+	}
+
+	if (isdigit(nptr[1]) && nptr[2] == '#') {
+		base = 10 * base + (nptr[1] - '0');
+		if (base >= 2 && base <= 64)
+			return parse_with_base(nptr + 3, endptr, base);
+		/* else: bash says "invalid arithmetic base" */
+	}
+
+	return parse_with_base(nptr, endptr, 10);
+}
 #else /* !ENABLE_FEATURE_SH_MATH_BASE */
 # if ENABLE_FEATURE_SH_MATH_64
 #  define strto_arith_t(nptr, endptr) strtoull(nptr, endptr, 0)
@@ -702,7 +721,6 @@ evaluate_string(arith_state_t *math_state, const char *expr)
 				dbg("[%d] var:IGNORED", (int)(numstackptr - numstack));
 				expr = p;
 				numstackptr->var_name = NULL;
- push_num0:
 				numstackptr->val = 0;
 			}
  push_num:
@@ -715,11 +733,12 @@ evaluate_string(arith_state_t *math_state, const char *expr)
 			/* Number */
 			char *end;
 			numstackptr->var_name = NULL;
-			errno = 0;
 			/* code is smaller compared to using &expr here: */
 			numstackptr->val = strto_arith_t(expr, &end);
 			expr = end;
 			dbg("[%d] val:%lld", (int)(numstackptr - numstack), numstackptr->val);
+			if (!expr) /* example: $((10#)) */
+				goto syntax_err;
 			/* A number can't be followed by another number, or a variable name.
 			 * We'd catch this later anyway, but this would require numstack[]
 			 * to be ~twice as deep to handle strings where _every_ char is
@@ -728,13 +747,6 @@ evaluate_string(arith_state_t *math_state, const char *expr)
 			 */
 			if (isalnum(*expr) || *expr == '_')
 				goto syntax_err;
-			if (errno) {
-// TODO: bash 5.2.15 does not catch ERANGE (some older version did?).
-// $((99999999999999999999)) is 7766279631452241919 (the 64-bit truncated value).
-// Our BASE# code does this as well: try $((10#99999999999999999999)),
-// but the "ordinary" code path with strtoull() does not do this.
-				goto push_num0; /* bash compat */
-			}
 			goto push_num;
 		}