SEGV parsing of ${#1\x82} and ${#1\x84}

[Denys Vlasenko <vda.linux@xxxxxxxxxxxxxx>]

Hi,

CTLVAR and CTLBACKQ are not properly handled if encountered
inside {$#...}. Testcase:

dash -c "`printf 'echo ${#1\x82}'`" 00 111 222

It should execute "echo ${#1 <byte 0x82> }" and thus print "3"
(the length of $1, which is "111").

Instead, it segfaults.

(Ideally, it should fail since "1 <byte 0x82>" is not a valid
variable name, but currently dash accepts e.g. "${#1abc}"
as if it is "${#1}bc". A separate, less serious bug...).