[git commit] hush: fix 'x=; echo ${x:-"$@"}' producing 'BUG in varexp2' message

[Denys Vlasenko]

commit: https://git.busybox.net/busybox/commit/?id=2e71101e31b8b421cee0107c4136d68b65e3a5d8
branch: https://git.busybox.net/busybox/commit/?id=refs/heads/master

function                                             old     new   delta
expand_string_to_string                              126     128      +2

Signed-off-by: Denys Vlasenko <vda.linux at googlemail.com>
---
 shell/hush.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/shell/hush.c b/shell/hush.c
index 534fabbd0..da10a09a8 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -6529,13 +6529,20 @@ static char *expand_string_to_string(const char *str, int EXP_flags, int do_unba
 	argv[0] = (char*)str;
 	argv[1] = NULL;
 	list = expand_variables(argv, EXP_flags | EXP_FLAG_SINGLEWORD);
-	if (HUSH_DEBUG)
-		if (!list[0] || list[1])
-			bb_error_msg_and_die("BUG in varexp2");
-	/* actually, just move string 2*sizeof(char*) bytes back */
-	overlapping_strcpy((char*)list, list[0]);
-	if (do_unbackslash)
-		unbackslash((char*)list);
+	if (!list[0]) {
+		/* Example where it happens:
+		 * x=; echo ${x:-"$@"}
+		 */
+		((char*)list)[0] = '\0';
+	} else {
+		if (HUSH_DEBUG)
+			if (list[1])
+				bb_error_msg_and_die("BUG in varexp2");
+		/* actually, just move string 2*sizeof(char*) bytes back */
+		overlapping_strcpy((char*)list, list[0]);
+		if (do_unbackslash)
+			unbackslash((char*)list);
+	}
 	debug_printf_expand("string_to_string=>'%s'\n", (char*)list);
 	return (char*)list;
 }