From fbfd4d3ab8a17b13d2c74b8905ac38f954875cf9 Mon Sep 17 00:00:00 2001
From: Martijn Dekker <martijn@inlv.org>
Date: Tue, 5 Jul 2022 22:09:29 +0200
Subject: [PATCH] Fix syntax error detection in associative array assignments

Reproducer:

$ fn=([foo_key]=foo_val [bar_key])
-ksh: [bar_key]: not found

Expected output:
-ksh: syntax error: `[bar_key]' unexpected

As soon as one correct associative array assignment element has
been processed, a subsequent one, starting with '[' but not
containing ']=', is incorrectly seen as a command to execute.
If a command '[bar_key]' existed on $PATH, it would have been run.

src/cmd/ksh93/sh/parse.c: simple():
- In the syntax check for associative array assignments, don't just
  check for an initial '[' but also verify the presence of ']='.

Thanks to @JohnoKing for finding this bug.

Resolves: https://github.com/ksh93/ksh/issues/427
---
 NEWS                          |  3 +++
 src/cmd/ksh93/sh/parse.c      |  2 +-
 src/cmd/ksh93/tests/arrays.sh | 11 +++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index a3222b4d9..00c008ce9 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ Any uppercase BUG_* names are modernish shell bug IDs.
   following a redirection without being an argument to a redirection.
   For example, this now writes 'OK' to standard error: cat >&2 <(echo OK)
 
+- Fixed the detection of a syntax error in compound assignments to
+  associative arays.
+
 2022-07-02:
 
 - Fixed a bug where, if the last command in a subshell was an external
diff --git a/src/cmd/ksh93/sh/parse.c b/src/cmd/ksh93/sh/parse.c
index 17a714218..9747b53eb 100644
--- a/src/cmd/ksh93/sh/parse.c
+++ b/src/cmd/ksh93/sh/parse.c
@@ -1507,7 +1507,7 @@ static Shnode_t *simple(Lex_t *lexp,int flag, struct ionod *io)
 			lexp->token = LBRACE;
 			break;
 		}
-		if(associative && argp->argval[0]!='[')
+		if(associative && (argp->argval[0]!='[' || !strstr(argp->argval,"]=")))
 			sh_syntax(lexp);
 		/* check for assignment argument */
 		if((argp->argflag&ARG_ASSIGN) && assignment!=2)
diff --git a/src/cmd/ksh93/tests/arrays.sh b/src/cmd/ksh93/tests/arrays.sh
index 39c259d6d..039afbab4 100755
--- a/src/cmd/ksh93/tests/arrays.sh
+++ b/src/cmd/ksh93/tests/arrays.sh
@@ -830,5 +830,16 @@ exp=$'typeset -A a=([0]=1 [1]=2 [2]=3)\ntypeset -a a=(1 2 3)'
 [[ $got == "$exp" ]] || err_exit 'conversion of indexed array to associative fails in subshell' \
 	"(expected $(printf %q "$exp"), got $(printf %q "$got"))"
 
+# ======
+# spurious command execution of a word starting with '[' but not containing ']=' in associative array assignments
+# https://github.com/ksh93/ksh/issues/427
+exp='*: syntax error at line *: `\[badword]'\'' unexpected'
+got=$(set +x; PATH=/dev/null; eval 'typeset -A badword=([x]=1 \[badword])' 2>&1)
+case $((e=$?)),$got in
+3,$exp)	;;
+*)	err_exit 'spurious command execution in invalid associative array assignment' \
+		"(expected status 3 and $(printf %q "$exp"), got status $e and $(printf %q "$got"))" ;;
+esac
+
 # ======
 exit $((Errors<125?Errors:125))