eval: Use the correct expansion mode for fd redirection

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

It has been reported that

	echo test >&$EMPTY_VARIABLE

causes dash to segfault.  This is a symptom of the bigger problem
that dash tries to perform pathname expansion as well as field
splitting on the word after >& and <&.  This is wrong and this
patch fixes it to use the same expansions as done on a normal
redirection.

Reported-by: Andrej Shadura <andrew.shadura@xxxxxxxxxxxxxxx>
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>

diff --git a/src/eval.c b/src/eval.c
index 6185db4..328fde3 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -529,7 +529,7 @@ expredir(union node *n)
 		case NFROMFD:
 		case NTOFD:
 			if (redir->ndup.vname) {
-				expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE);
+				expandarg(redir->ndup.vname, &fn, EXP_TILDE | EXP_REDIR);
 				fixredir(redir, fn.list->text, 1);
 			}
 			break;
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt