hush: fix segfault in ${?:N:M}

function                                             old     new   delta
expand_vars_to_list                                 2374    2409     +35
builtin_umask                                        132     133      +1
builtin_exit                                          47      48      +1
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/0 up/down: 37/0)               Total: 37 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

4 files changed, 31 insertions, 3 deletions

diff --git a/shell/hush_test/hush-vars/param_expand_alt.right b/shell/hush_test/hush-vars/param_expand_alt.right
index 4d2197a5e..67f18d69c 100644
--- a/shell/hush_test/hush-vars/param_expand_alt.right
+++ b/shell/hush_test/hush-vars/param_expand_alt.right
@@ -1,6 +1,6 @@
 hush: syntax error: unterminated ${name}
 hush: syntax error: unterminated ${name}
-_0 _0
+__ __
 _ _ _ _ _
 _aaaa _ _ _word _word
 _ _ _ _ _
diff --git a/shell/hush_test/hush-vars/param_expand_alt.tests b/shell/hush_test/hush-vars/param_expand_alt.tests
index dcdca86d4..3b646b142 100755
--- a/shell/hush_test/hush-vars/param_expand_alt.tests
+++ b/shell/hush_test/hush-vars/param_expand_alt.tests
@@ -2,8 +2,8 @@
 "$THIS_SH" -c 'echo ${+}  ; echo moo'
 "$THIS_SH" -c 'echo ${:+} ; echo moo'
 
-# now some funky ones
-echo _${#+} _${#:+}
+# now some funky ones. (bash doesn't accept ${#+})
+echo _${#+}_ _${#:+}_
 
 # now some valid ones
 set --
diff --git a/shell/hush_test/hush-vars/param_expand_bash_substring.right b/shell/hush_test/hush-vars/param_expand_bash_substring.right
index 53b8836ff..2f4c51d06 100644
--- a/shell/hush_test/hush-vars/param_expand_bash_substring.right
+++ b/shell/hush_test/hush-vars/param_expand_bash_substring.right
@@ -39,6 +39,19 @@ f:1:2=|12|
 f::2 =|01|
 f:1: =||
 f::  =||
+Substrings from special vars
+?    =|0|
+?:1  =||
+?:1:2=||
+?::2 =|0|
+?:1: =||
+?::  =||
+#    =|11|
+#:1  =|1|
+#:1:2=|1|
+#::2 =|11|
+#:1: =||
+#::  =||
 Substrings with expressions
 f            =|01234567|
 f:1+1:2+2    =|2345|
diff --git a/shell/hush_test/hush-vars/param_expand_bash_substring.tests b/shell/hush_test/hush-vars/param_expand_bash_substring.tests
index a80523add..5c9552dba 100755
--- a/shell/hush_test/hush-vars/param_expand_bash_substring.tests
+++ b/shell/hush_test/hush-vars/param_expand_bash_substring.tests
@@ -55,6 +55,21 @@ f=0123456789; echo "f::2 =|${f::2}|"
 f=0123456789; echo "f:1: =|${f:1:}|"
 f=0123456789; echo "f::  =|${f::}|"
 
+echo "Substrings from special vars"
+echo '?    '"=|$?|"
+echo '?:1  '"=|${?:1}|"
+echo '?:1:2'"=|${?:1:2}|"
+echo '?::2 '"=|${?::2}|"
+echo '?:1: '"=|${?:1:}|"
+echo '?::  '"=|${?::}|"
+set -- 1 2 3 4 5 6 7 8 9 10 11
+echo '#    '"=|$#|"
+echo '#:1  '"=|${#:1}|"
+echo '#:1:2'"=|${#:1:2}|"
+echo '#::2 '"=|${#::2}|"
+echo '#:1: '"=|${#:1:}|"
+echo '#::  '"=|${#::}|"
+
 echo "Substrings with expressions"
 f=01234567; echo 'f            '"=|$f|"
 f=01234567; echo 'f:1+1:2+2    '"=|${f:1+1:2+2}|"