1/*-
2 * Copyright (c) 1992, 1993, 1994
3 *	The Regents of the University of California.  All rights reserved.
4 * Copyright (c) 1992, 1993, 1994, 1995, 1996
5 *	Keith Bostic.  All rights reserved.
6 *
7 * See the LICENSE file for redistribution information.
8 */
9
10/* $FreeBSD$ */
11
12#include "config.h"
13
14#ifndef lint
15static const char sccsid[] = "@(#)ex.c	10.57 (Berkeley) 10/10/96";
16#endif /* not lint */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/stat.h>
21#include <sys/time.h>
22
23#include <bitstring.h>
24#include <ctype.h>
25#include <errno.h>
26#include <fcntl.h>
27#include <limits.h>
28#include <stdio.h>
29#include <stdlib.h>
30#include <string.h>
31#include <unistd.h>
32
33#include "../common/common.h"
34#include "../vi/vi.h"
35
36#if defined(DEBUG) && defined(COMLOG)
37static void	ex_comlog __P((SCR *, EXCMD *));
38#endif
39static EXCMDLIST const *
40		ex_comm_search __P((char *, size_t));
41static int	ex_discard __P((SCR *));
42static int	ex_line __P((SCR *, EXCMD *, MARK *, int *, int *));
43static int	ex_load __P((SCR *));
44static void	ex_unknown __P((SCR *, char *, size_t));
45
46/*
47 * ex --
48 *	Main ex loop.
49 *
50 * PUBLIC: int ex __P((SCR **));
51 */
52int
53ex(spp)
54	SCR **spp;
55{
56	EX_PRIVATE *exp;
57	GS *gp;
58	MSGS *mp;
59	SCR *sp;
60	TEXT *tp;
61	u_int32_t flags;
62
63	sp = *spp;
64	gp = sp->gp;
65	exp = EXP(sp);
66
67	/* Start the ex screen. */
68	if (ex_init(sp))
69		return (1);
70
71	/* Flush any saved messages. */
72	while ((mp = gp->msgq.lh_first) != NULL) {
73		gp->scr_msg(sp, mp->mtype, mp->buf, mp->len);
74		LIST_REMOVE(mp, q);
75		free(mp->buf);
76		free(mp);
77	}
78
79	/* If reading from a file, errors should have name and line info. */
80	if (F_ISSET(gp, G_SCRIPTED)) {
81		gp->excmd.if_lno = 1;
82		gp->excmd.if_name = "script";
83	}
84
85	/*
86	 * !!!
87	 * Initialize the text flags.  The beautify edit option historically
88	 * applied to ex command input read from a file.  In addition, the
89	 * first time a ^H was discarded from the input, there was a message,
90	 * "^H discarded", that was displayed.  We don't bother.
91	 */
92	LF_INIT(TXT_BACKSLASH | TXT_CNTRLD | TXT_CR);
93	for (;; ++gp->excmd.if_lno) {
94		/* Display status line and flush. */
95		if (F_ISSET(sp, SC_STATUS)) {
96			if (!F_ISSET(sp, SC_EX_SILENT))
97				msgq_status(sp, sp->lno, 0);
98			F_CLR(sp, SC_STATUS);
99		}
100		(void)ex_fflush(sp);
101
102		/* Set the flags the user can reset. */
103		if (O_ISSET(sp, O_BEAUTIFY))
104			LF_SET(TXT_BEAUTIFY);
105		if (O_ISSET(sp, O_PROMPT))
106			LF_SET(TXT_PROMPT);
107
108		/* Clear any current interrupts, and get a command. */
109		CLR_INTERRUPT(sp);
110		if (ex_txt(sp, &sp->tiq, ':', flags))
111			return (1);
112		if (INTERRUPTED(sp)) {
113			(void)ex_puts(sp, "\n");
114			(void)ex_fflush(sp);
115			continue;
116		}
117
118		/* Initialize the command structure. */
119		CLEAR_EX_PARSER(&gp->excmd);
120
121		/*
122		 * If the user entered a single carriage return, send
123		 * ex_cmd() a separator -- it discards single newlines.
124		 */
125		tp = sp->tiq.cqh_first;
126		if (tp->len == 0) {
127			gp->excmd.cp = " ";	/* __TK__ why not |? */
128			gp->excmd.clen = 1;
129		} else {
130			gp->excmd.cp = tp->lb;
131			gp->excmd.clen = tp->len;
132		}
133		F_INIT(&gp->excmd, E_NRSEP);
134
135		if (ex_cmd(sp) && F_ISSET(gp, G_SCRIPTED))
136			return (1);
137
138		if (INTERRUPTED(sp)) {
139			CLR_INTERRUPT(sp);
140			msgq(sp, M_ERR, "170|Interrupted");
141		}
142
143		/*
144		 * If the last command caused a restart, or switched screens
145		 * or into vi, return.
146		 */
147		if (F_ISSET(gp, G_SRESTART) || F_ISSET(sp, SC_SSWITCH | SC_VI)) {
148			*spp = sp;
149			break;
150		}
151
152		/* If the last command switched files, we don't care. */
153		F_CLR(sp, SC_FSWITCH);
154
155		/*
156		 * If we're exiting this screen, move to the next one.  By
157		 * definition, this means returning into vi, so return to the
158		 * main editor loop.  The ordering is careful, don't discard
159		 * the contents of sp until the end.
160		 */
161		if (F_ISSET(sp, SC_EXIT | SC_EXIT_FORCE)) {
162			if (file_end(sp, NULL, F_ISSET(sp, SC_EXIT_FORCE)))
163				return (1);
164			*spp = screen_next(sp);
165			return (screen_end(sp));
166		}
167	}
168	return (0);
169}
170
171/*
172 * ex_cmd --
173 *	The guts of the ex parser: parse and execute a string containing
174 *	ex commands.
175 *
176 * !!!
177 * This code MODIFIES the string that gets passed in, to delete quoting
178 * characters, etc.  The string cannot be readonly/text space, nor should
179 * you expect to use it again after ex_cmd() returns.
180 *
181 * !!!
182 * For the fun of it, if you want to see if a vi clone got the ex argument
183 * parsing right, try:
184 *
185 *	echo 'foo|bar' > file1; echo 'foo/bar' > file2;
186 *	vi
187 *	:edit +1|s/|/PIPE/|w file1| e file2|1 | s/\//SLASH/|wq
188 *
189 * or:	vi
190 *	:set|file|append|set|file
191 *
192 * For extra credit, try them in a startup .exrc file.
193 *
194 * PUBLIC: int ex_cmd __P((SCR *));
195 */
196int
197ex_cmd(sp)
198	SCR *sp;
199{
200	enum nresult nret;
201	EX_PRIVATE *exp;
202	EXCMD *ecp;
203	GS *gp;
204	MARK cur;
205	recno_t lno;
206	size_t arg1_len, discard, len;
207	u_int32_t flags;
208	long ltmp;
209	int at_found, gv_found;
210	int ch, cnt, delim, isaddr, namelen;
211	int newscreen, notempty, tmp, vi_address;
212	char *arg1, *p, *s, *t;
213
214	gp = sp->gp;
215	exp = EXP(sp);
216
217	/*
218	 * We always start running the command on the top of the stack.
219	 * This means that *everything* must be resolved when we leave
220	 * this function for any reason.
221	 */
222loop:	ecp = gp->ecq.lh_first;
223
224	/* If we're reading a command from a file, set up error information. */
225	if (ecp->if_name != NULL) {
226		gp->if_lno = ecp->if_lno;
227		gp->if_name = ecp->if_name;
228	}
229
230	/*
231	 * If a move to the end of the file is scheduled for this command,
232	 * do it now.
233	 */
234	if (F_ISSET(ecp, E_MOVETOEND)) {
235		if (db_last(sp, &sp->lno))
236			goto rfail;
237		sp->cno = 0;
238		F_CLR(ecp, E_MOVETOEND);
239	}
240
241	/* If we found a newline, increment the count now. */
242	if (F_ISSET(ecp, E_NEWLINE)) {
243		++gp->if_lno;
244		++ecp->if_lno;
245		F_CLR(ecp, E_NEWLINE);
246	}
247
248	/* (Re)initialize the EXCMD structure, preserving some flags. */
249	CLEAR_EX_CMD(ecp);
250
251	/* Initialize the argument structures. */
252	if (argv_init(sp, ecp))
253		goto err;
254
255	/* Initialize +cmd, saved command information. */
256	arg1 = NULL;
257	ecp->save_cmdlen = 0;
258
259	/* Skip <blank>s, empty lines.  */
260	for (notempty = 0; ecp->clen > 0; ++ecp->cp, --ecp->clen)
261		if ((ch = *ecp->cp) == '\n') {
262			++gp->if_lno;
263			++ecp->if_lno;
264		} else if (isblank(ch))
265			notempty = 1;
266		else
267			break;
268
269	/*
270	 * !!!
271	 * Permit extra colons at the start of the line.  Historically,
272	 * ex/vi allowed a single extra one.  It's simpler not to count.
273	 * The stripping is done here because, historically, any command
274	 * could have preceding colons, e.g. ":g/pattern/:p" worked.
275	 */
276	if (ecp->clen != 0 && ch == ':') {
277		notempty = 1;
278		while (--ecp->clen > 0 && (ch = *++ecp->cp) == ':');
279	}
280
281	/*
282	 * Command lines that start with a double-quote are comments.
283	 *
284	 * !!!
285	 * Historically, there was no escape or delimiter for a comment, e.g.
286	 * :"foo|set was a single comment and nothing was output.  Since nvi
287	 * permits users to escape <newline> characters into command lines, we
288	 * have to check for that case.
289	 */
290	if (ecp->clen != 0 && ch == '"') {
291		while (--ecp->clen > 0 && *++ecp->cp != '\n');
292		if (*ecp->cp == '\n') {
293			F_SET(ecp, E_NEWLINE);
294			++ecp->cp;
295			--ecp->clen;
296		}
297		goto loop;
298	}
299
300	/* Skip whitespace. */
301	for (; ecp->clen > 0; ++ecp->cp, --ecp->clen) {
302		ch = *ecp->cp;
303		if (!isblank(ch))
304			break;
305	}
306
307	/*
308	 * The last point at which an empty line can mean do nothing.
309	 *
310	 * !!!
311	 * Historically, in ex mode, lines containing only <blank> characters
312	 * were the same as a single <carriage-return>, i.e. a default command.
313	 * In vi mode, they were ignored.  In .exrc files this was a serious
314	 * annoyance, as vi kept trying to treat them as print commands.  We
315	 * ignore backward compatibility in this case, discarding lines that
316	 * contain only <blank> characters from .exrc files.
317	 *
318	 * !!!
319	 * This is where you end up when you're done a command, i.e. clen has
320	 * gone to zero.  Continue if there are more commands to run.
321	 */
322	if (ecp->clen == 0 &&
323	    (!notempty || F_ISSET(sp, SC_VI) || F_ISSET(ecp, E_BLIGNORE))) {
324		if (ex_load(sp))
325			goto rfail;
326		ecp = gp->ecq.lh_first;
327		if (ecp->clen == 0)
328			goto rsuccess;
329		goto loop;
330	}
331
332	/*
333	 * Check to see if this is a command for which we may want to move
334	 * the cursor back up to the previous line.  (The command :1<CR>
335	 * wants a <newline> separator, but the command :<CR> wants to erase
336	 * the command line.)  If the line is empty except for <blank>s,
337	 * <carriage-return> or <eof>, we'll probably want to move up.  I
338	 * don't think there's any way to get <blank> characters *after* the
339	 * command character, but this is the ex parser, and I've been wrong
340	 * before.
341	 */
342	if (F_ISSET(ecp, E_NRSEP) &&
343	    ecp->clen != 0 && (ecp->clen != 1 || ecp->cp[0] != '\004'))
344		F_CLR(ecp, E_NRSEP);
345
346	/* Parse command addresses. */
347	if (ex_range(sp, ecp, &tmp))
348		goto rfail;
349	if (tmp)
350		goto err;
351
352	/*
353	 * Skip <blank>s and any more colons (the command :3,5:print
354	 * worked, historically).
355	 */
356	for (; ecp->clen > 0; ++ecp->cp, --ecp->clen) {
357		ch = *ecp->cp;
358		if (!isblank(ch) && ch != ':')
359			break;
360	}
361
362	/*
363	 * If no command, ex does the last specified of p, l, or #, and vi
364	 * moves to the line.  Otherwise, determine the length of the command
365	 * name by looking for the first non-alphabetic character.  (There
366	 * are a few non-alphabetic characters in command names, but they're
367	 * all single character commands.)  This isn't a great test, because
368	 * it means that, for the command ":e +cut.c file", we'll report that
369	 * the command "cut" wasn't known.  However, it makes ":e+35 file" work
370	 * correctly.
371	 *
372	 * !!!
373	 * Historically, lines with multiple adjacent (or <blank> separated)
374	 * command separators were very strange.  For example, the command
375	 * |||<carriage-return>, when the cursor was on line 1, displayed
376	 * lines 2, 3 and 5 of the file.  In addition, the command "   |  "
377	 * would only display the line after the next line, instead of the
378	 * next two lines.  No ideas why.  It worked reasonably when executed
379	 * from vi mode, and displayed lines 2, 3, and 4, so we do a default
380	 * command for each separator.
381	 */
382#define	SINGLE_CHAR_COMMANDS	"\004!#&*<=>@~"
383	newscreen = 0;
384	if (ecp->clen != 0 && ecp->cp[0] != '|' && ecp->cp[0] != '\n') {
385		if (strchr(SINGLE_CHAR_COMMANDS, *ecp->cp)) {
386			p = ecp->cp;
387			++ecp->cp;
388			--ecp->clen;
389			namelen = 1;
390		} else {
391			for (p = ecp->cp;
392			    ecp->clen > 0; --ecp->clen, ++ecp->cp)
393				if (!isalpha(*ecp->cp))
394					break;
395			if ((namelen = ecp->cp - p) == 0) {
396				msgq(sp, M_ERR, "080|Unknown command name");
397				goto err;
398			}
399		}
400
401		/*
402		 * !!!
403		 * Historic vi permitted flags to immediately follow any
404		 * subset of the 'delete' command, but then did not permit
405		 * further arguments (flag, buffer, count).  Make it work.
406		 * Permit further arguments for the few shreds of dignity
407		 * it offers.
408		 *
409		 * Adding commands that start with 'd', and match "delete"
410		 * up to a l, p, +, - or # character can break this code.
411		 *
412		 * !!!
413		 * Capital letters beginning the command names ex, edit,
414		 * next, previous, tag and visual (in vi mode) indicate the
415		 * command should happen in a new screen.
416		 */
417		switch (p[0]) {
418		case 'd':
419			for (s = p,
420			    t = cmds[C_DELETE].name; *s == *t; ++s, ++t);
421			if (s[0] == 'l' || s[0] == 'p' || s[0] == '+' ||
422			    s[0] == '-' || s[0] == '^' || s[0] == '#') {
423				len = (ecp->cp - p) - (s - p);
424				ecp->cp -= len;
425				ecp->clen += len;
426				ecp->rcmd = cmds[C_DELETE];
427				ecp->rcmd.syntax = "1bca1";
428				ecp->cmd = &ecp->rcmd;
429				goto skip_srch;
430			}
431			break;
432		case 'E': case 'F': case 'N': case 'P': case 'T': case 'V':
433			newscreen = 1;
434			p[0] = tolower(p[0]);
435			break;
436		}
437
438		/*
439		 * Search the table for the command.
440		 *
441		 * !!!
442		 * Historic vi permitted the mark to immediately follow the
443		 * 'k' in the 'k' command.  Make it work.
444		 *
445		 * !!!
446		 * Historic vi permitted any flag to follow the s command, e.g.
447		 * "s/e/E/|s|sgc3p" was legal.  Make the command "sgc" work.
448		 * Since the following characters all have to be flags, i.e.
449		 * alphabetics, we can let the s command routine return errors
450		 * if it was some illegal command string.  This code will break
451		 * if an "sg" or similar command is ever added.  The substitute
452		 * code doesn't care if it's a "cgr" flag or a "#lp" flag that
453		 * follows the 's', but we limit the choices here to "cgr" so
454		 * that we get unknown command messages for wrong combinations.
455		 */
456		if ((ecp->cmd = ex_comm_search(p, namelen)) == NULL)
457			switch (p[0]) {
458			case 'k':
459				if (namelen == 2) {
460					ecp->cp -= namelen - 1;
461					ecp->clen += namelen - 1;
462					ecp->cmd = &cmds[C_K];
463					break;
464				}
465				goto unknown;
466			case 's':
467				for (s = p + 1, cnt = namelen; --cnt; ++s)
468					if (s[0] != 'c' &&
469					    s[0] != 'g' && s[0] != 'r')
470						break;
471				if (cnt == 0) {
472					ecp->cp -= namelen - 1;
473					ecp->clen += namelen - 1;
474					ecp->rcmd = cmds[C_SUBSTITUTE];
475					ecp->rcmd.fn = ex_subagain;
476					ecp->cmd = &ecp->rcmd;
477					break;
478				}
479				/* FALLTHROUGH */
480			default:
481unknown:			if (newscreen)
482					p[0] = toupper(p[0]);
483				ex_unknown(sp, p, namelen);
484				goto err;
485			}
486
487		/*
488		 * The visual command has a different syntax when called
489		 * from ex than when called from a vi colon command.  FMH.
490		 * Make the change now, before we test for the newscreen
491		 * semantic, so that we're testing the right one.
492		 */
493skip_srch:	if (ecp->cmd == &cmds[C_VISUAL_EX] && F_ISSET(sp, SC_VI))
494			ecp->cmd = &cmds[C_VISUAL_VI];
495
496		/*
497		 * !!!
498		 * Historic vi permitted a capital 'P' at the beginning of
499		 * any command that started with 'p'.  Probably wanted the
500		 * P[rint] command for backward compatibility, and the code
501		 * just made Preserve and Put work by accident.  Nvi uses
502		 * Previous to mean previous-in-a-new-screen, so be careful.
503		 */
504		if (newscreen && !F_ISSET(ecp->cmd, E_NEWSCREEN) &&
505		    (ecp->cmd == &cmds[C_PRINT] ||
506		    ecp->cmd == &cmds[C_PRESERVE]))
507			newscreen = 0;
508
509		/* Test for a newscreen associated with this command. */
510		if (newscreen && !F_ISSET(ecp->cmd, E_NEWSCREEN))
511			goto unknown;
512
513		/* Secure means no shell access. */
514		if (F_ISSET(ecp->cmd, E_SECURE) && O_ISSET(sp, O_SECURE)) {
515			ex_emsg(sp, ecp->cmd->name, EXM_SECURE);
516			goto err;
517		}
518
519		/*
520		 * Multiple < and > characters; another "feature".  Note,
521		 * The string passed to the underlying function may not be
522		 * nul terminated in this case.
523		 */
524		if ((ecp->cmd == &cmds[C_SHIFTL] && *p == '<') ||
525		    (ecp->cmd == &cmds[C_SHIFTR] && *p == '>')) {
526			for (ch = *p;
527			    ecp->clen > 0; --ecp->clen, ++ecp->cp)
528				if (*ecp->cp != ch)
529					break;
530			if (argv_exp0(sp, ecp, p, ecp->cp - p))
531				goto err;
532		}
533
534		/* Set the format style flags for the next command. */
535		if (ecp->cmd == &cmds[C_HASH])
536			exp->fdef = E_C_HASH;
537		else if (ecp->cmd == &cmds[C_LIST])
538			exp->fdef = E_C_LIST;
539		else if (ecp->cmd == &cmds[C_PRINT])
540			exp->fdef = E_C_PRINT;
541		F_CLR(ecp, E_USELASTCMD);
542	} else {
543		/* Print is the default command. */
544		ecp->cmd = &cmds[C_PRINT];
545
546		/* Set the saved format flags. */
547		F_SET(ecp, exp->fdef);
548
549		/*
550		 * !!!
551		 * If no address was specified, and it's not a global command,
552		 * we up the address by one.  (I have no idea why globals are
553		 * exempted, but it's (ahem) historic practice.)
554		 */
555		if (ecp->addrcnt == 0 && !F_ISSET(sp, SC_EX_GLOBAL)) {
556			ecp->addrcnt = 1;
557			ecp->addr1.lno = sp->lno + 1;
558			ecp->addr1.cno = sp->cno;
559		}
560
561		F_SET(ecp, E_USELASTCMD);
562	}
563
564	/*
565	 * !!!
566	 * Historically, the number option applied to both ex and vi.  One
567	 * strangeness was that ex didn't switch display formats until a
568	 * command was entered, e.g. <CR>'s after the set didn't change to
569	 * the new format, but :1p would.
570	 */
571	if (O_ISSET(sp, O_NUMBER)) {
572		F_SET(ecp, E_OPTNUM);
573		FL_SET(ecp->iflags, E_C_HASH);
574	} else
575		F_CLR(ecp, E_OPTNUM);
576
577	/* Check for ex mode legality. */
578	if (F_ISSET(sp, SC_EX) && (F_ISSET(ecp->cmd, E_VIONLY) || newscreen)) {
579		msgq(sp, M_ERR,
580		    "082|%s: command not available in ex mode", ecp->cmd->name);
581		goto err;
582	}
583
584	/* Add standard command flags. */
585	F_SET(ecp, ecp->cmd->flags);
586	if (!newscreen)
587		F_CLR(ecp, E_NEWSCREEN);
588
589	/*
590	 * There are three normal termination cases for an ex command.  They
591	 * are the end of the string (ecp->clen), or unescaped (by <literal
592	 * next> characters) <newline> or '|' characters.  As we're now past
593	 * possible addresses, we can determine how long the command is, so we
594	 * don't have to look for all the possible terminations.  Naturally,
595	 * there are some exciting special cases:
596	 *
597	 * 1: The bang, global, v and the filter versions of the read and
598	 *    write commands are delimited by <newline>s (they can contain
599	 *    shell pipes).
600	 * 2: The ex, edit, next and visual in vi mode commands all take ex
601	 *    commands as their first arguments.
602	 * 3: The s command takes an RE as its first argument, and wants it
603	 *    to be specially delimited.
604	 *
605	 * Historically, '|' characters in the first argument of the ex, edit,
606	 * next, vi visual, and s commands didn't delimit the command.  And,
607	 * in the filter cases for read and write, and the bang, global and v
608	 * commands, they did not delimit the command at all.
609	 *
610	 * For example, the following commands were legal:
611	 *
612	 *	:edit +25|s/abc/ABC/ file.c
613	 *	:s/|/PIPE/
614	 *	:read !spell % | columnate
615	 *	:global/pattern/p|l
616	 *
617	 * It's not quite as simple as it sounds, however.  The command:
618	 *
619	 *	:s/a/b/|s/c/d|set
620	 *
621	 * was also legal, i.e. the historic ex parser (using the word loosely,
622	 * since "parser" implies some regularity of syntax) delimited the RE's
623	 * based on its delimiter and not anything so irretrievably vulgar as a
624	 * command syntax.
625	 *
626	 * Anyhow, the following code makes this all work.  First, for the
627	 * special cases we move past their special argument(s).  Then, we
628	 * do normal command processing on whatever is left.  Barf-O-Rama.
629	 */
630	discard = 0;		/* Characters discarded from the command. */
631	arg1_len = 0;
632	ecp->save_cmd = ecp->cp;
633	if (ecp->cmd == &cmds[C_EDIT] || ecp->cmd == &cmds[C_EX] ||
634	    ecp->cmd == &cmds[C_NEXT] || ecp->cmd == &cmds[C_VISUAL_VI]) {
635		/*
636		 * Move to the next non-whitespace character.  A '!'
637		 * immediately following the command is eaten as a
638		 * force flag.
639		 */
640		if (ecp->clen > 0 && *ecp->cp == '!') {
641			++ecp->cp;
642			--ecp->clen;
643			FL_SET(ecp->iflags, E_C_FORCE);
644
645			/* Reset, don't reparse. */
646			ecp->save_cmd = ecp->cp;
647		}
648		for (; ecp->clen > 0; --ecp->clen, ++ecp->cp)
649			if (!isblank(*ecp->cp))
650				break;
651		/*
652		 * QUOTING NOTE:
653		 *
654		 * The historic implementation ignored all escape characters
655		 * so there was no way to put a space or newline into the +cmd
656		 * field.  We do a simplistic job of fixing it by moving to the
657		 * first whitespace character that isn't escaped.  The escaping
658		 * characters are stripped as no longer useful.
659		 */
660		if (ecp->clen > 0 && *ecp->cp == '+') {
661			++ecp->cp;
662			--ecp->clen;
663			for (arg1 = p = ecp->cp;
664			    ecp->clen > 0; --ecp->clen, ++ecp->cp) {
665				ch = *ecp->cp;
666				if (IS_ESCAPE(sp, ecp, ch) &&
667				    ecp->clen > 1) {
668					++discard;
669					--ecp->clen;
670					ch = *++ecp->cp;
671				} else if (isblank(ch))
672					break;
673				*p++ = ch;
674			}
675			arg1_len = ecp->cp - arg1;
676
677			/* Reset, so the first argument isn't reparsed. */
678			ecp->save_cmd = ecp->cp;
679		}
680	} else if (ecp->cmd == &cmds[C_BANG] ||
681	    ecp->cmd == &cmds[C_GLOBAL] || ecp->cmd == &cmds[C_V]) {
682		/*
683		 * QUOTING NOTE:
684		 *
685		 * We use backslashes to escape <newline> characters, although
686		 * this wasn't historic practice for the bang command.  It was
687		 * for the global and v commands, and it's common usage when
688		 * doing text insert during the command.  Escaping characters
689		 * are stripped as no longer useful.
690		 */
691		for (p = ecp->cp; ecp->clen > 0; --ecp->clen, ++ecp->cp) {
692			ch = *ecp->cp;
693			if (ch == '\\' && ecp->clen > 1 && ecp->cp[1] == '\n') {
694				++discard;
695				--ecp->clen;
696				ch = *++ecp->cp;
697
698				++gp->if_lno;
699				++ecp->if_lno;
700			} else if (ch == '\n')
701				break;
702			*p++ = ch;
703		}
704	} else if (ecp->cmd == &cmds[C_READ] || ecp->cmd == &cmds[C_WRITE]) {
705		/*
706		 * For write commands, if the next character is a <blank>, and
707		 * the next non-blank character is a '!', it's a filter command
708		 * and we want to eat everything up to the <newline>.  For read
709		 * commands, if the next non-blank character is a '!', it's a
710		 * filter command and we want to eat everything up to the next
711		 * <newline>.  Otherwise, we're done.
712		 */
713		for (tmp = 0; ecp->clen > 0; --ecp->clen, ++ecp->cp) {
714			ch = *ecp->cp;
715			if (isblank(ch))
716				tmp = 1;
717			else
718				break;
719		}
720		if (ecp->clen > 0 && ch == '!' &&
721		    (ecp->cmd == &cmds[C_READ] || tmp))
722			for (; ecp->clen > 0; --ecp->clen, ++ecp->cp)
723				if (ecp->cp[0] == '\n')
724					break;
725	} else if (ecp->cmd == &cmds[C_SUBSTITUTE]) {
726		/*
727		 * Move to the next non-whitespace character, we'll use it as
728		 * the delimiter.  If the character isn't an alphanumeric or
729		 * a '|', it's the delimiter, so parse it.  Otherwise, we're
730		 * into something like ":s g", so use the special s command.
731		 */
732		for (; ecp->clen > 0; --ecp->clen, ++ecp->cp)
733			if (!isblank(ecp->cp[0]))
734				break;
735
736		if (isalnum(ecp->cp[0]) || ecp->cp[0] == '|') {
737			ecp->rcmd = cmds[C_SUBSTITUTE];
738			ecp->rcmd.fn = ex_subagain;
739			ecp->cmd = &ecp->rcmd;
740		} else if (ecp->clen > 0) {
741			/*
742			 * QUOTING NOTE:
743			 *
744			 * Backslashes quote delimiter characters for RE's.
745			 * The backslashes are NOT removed since they'll be
746			 * used by the RE code.  Move to the third delimiter
747			 * that's not escaped (or the end of the command).
748			 */
749			delim = *ecp->cp;
750			++ecp->cp;
751			--ecp->clen;
752			for (cnt = 2; ecp->clen > 0 &&
753			    cnt != 0; --ecp->clen, ++ecp->cp)
754				if (ecp->cp[0] == '\\' &&
755				    ecp->clen > 1) {
756					++ecp->cp;
757					--ecp->clen;
758				} else if (ecp->cp[0] == delim)
759					--cnt;
760		}
761	}
762
763	/*
764	 * Use normal quoting and termination rules to find the end of this
765	 * command.
766	 *
767	 * QUOTING NOTE:
768	 *
769	 * Historically, vi permitted ^V's to escape <newline>'s in the .exrc
770	 * file.  It was almost certainly a bug, but that's what bug-for-bug
771	 * compatibility means, Grasshopper.  Also, ^V's escape the command
772	 * delimiters.  Literal next quote characters in front of the newlines,
773	 * '|' characters or literal next characters are stripped as they're
774	 * no longer useful.
775	 */
776	vi_address = ecp->clen != 0 && ecp->cp[0] != '\n';
777	for (p = ecp->cp; ecp->clen > 0; --ecp->clen, ++ecp->cp) {
778		ch = ecp->cp[0];
779		if (IS_ESCAPE(sp, ecp, ch) && ecp->clen > 1) {
780			tmp = ecp->cp[1];
781			if (tmp == '\n' || tmp == '|') {
782				if (tmp == '\n') {
783					++gp->if_lno;
784					++ecp->if_lno;
785				}
786				++discard;
787				--ecp->clen;
788				++ecp->cp;
789				ch = tmp;
790			}
791		} else if (ch == '\n' || ch == '|') {
792			if (ch == '\n')
793				F_SET(ecp, E_NEWLINE);
794			--ecp->clen;
795			break;
796		}
797		*p++ = ch;
798	}
799
800	/*
801	 * Save off the next command information, go back to the
802	 * original start of the command.
803	 */
804	p = ecp->cp + 1;
805	ecp->cp = ecp->save_cmd;
806	ecp->save_cmd = p;
807	ecp->save_cmdlen = ecp->clen;
808	ecp->clen = ((ecp->save_cmd - ecp->cp) - 1) - discard;
809
810	/*
811	 * QUOTING NOTE:
812	 *
813	 * The "set tags" command historically used a backslash, not the
814	 * user's literal next character, to escape whitespace.  Handle
815	 * it here instead of complicating the argv_exp3() code.  Note,
816	 * this isn't a particularly complex trap, and if backslashes were
817	 * legal in set commands, this would have to be much more complicated.
818	 */
819	if (ecp->cmd == &cmds[C_SET])
820		for (p = ecp->cp, len = ecp->clen; len > 0; --len, ++p)
821			if (*p == '\\')
822				*p = CH_LITERAL;
823
824	/*
825	 * Set the default addresses.  It's an error to specify an address for
826	 * a command that doesn't take them.  If two addresses are specified
827	 * for a command that only takes one, lose the first one.  Two special
828	 * cases here, some commands take 0 or 2 addresses.  For most of them
829	 * (the E_ADDR2_ALL flag), 0 defaults to the entire file.  For one
830	 * (the `!' command, the E_ADDR2_NONE flag), 0 defaults to no lines.
831	 *
832	 * Also, if the file is empty, some commands want to use an address of
833	 * 0, i.e. the entire file is 0 to 0, and the default first address is
834	 * 0.  Otherwise, an entire file is 1 to N and the default line is 1.
835	 * Note, we also add the E_ADDR_ZERO flag to the command flags, for the
836	 * case where the 0 address is only valid if it's a default address.
837	 *
838	 * Also, set a flag if we set the default addresses.  Some commands
839	 * (ex: z) care if the user specified an address or if we just used
840	 * the current cursor.
841	 */
842	switch (F_ISSET(ecp, E_ADDR1 | E_ADDR2 | E_ADDR2_ALL | E_ADDR2_NONE)) {
843	case E_ADDR1:				/* One address: */
844		switch (ecp->addrcnt) {
845		case 0:				/* Default cursor/empty file. */
846			ecp->addrcnt = 1;
847			F_SET(ecp, E_ADDR_DEF);
848			if (F_ISSET(ecp, E_ADDR_ZERODEF)) {
849				if (db_last(sp, &lno))
850					goto err;
851				if (lno == 0) {
852					ecp->addr1.lno = 0;
853					F_SET(ecp, E_ADDR_ZERO);
854				} else
855					ecp->addr1.lno = sp->lno;
856			} else
857				ecp->addr1.lno = sp->lno;
858			ecp->addr1.cno = sp->cno;
859			break;
860		case 1:
861			break;
862		case 2:				/* Lose the first address. */
863			ecp->addrcnt = 1;
864			ecp->addr1 = ecp->addr2;
865		}
866		break;
867	case E_ADDR2_NONE:			/* Zero/two addresses: */
868		if (ecp->addrcnt == 0)		/* Default to nothing. */
869			break;
870		goto two_addr;
871	case E_ADDR2_ALL:			/* Zero/two addresses: */
872		if (ecp->addrcnt == 0) {	/* Default entire/empty file. */
873			F_SET(ecp, E_ADDR_DEF);
874			ecp->addrcnt = 2;
875			if (sp->ep == NULL)
876				ecp->addr2.lno = 0;
877			else if (db_last(sp, &ecp->addr2.lno))
878				goto err;
879			if (F_ISSET(ecp, E_ADDR_ZERODEF) &&
880			    ecp->addr2.lno == 0) {
881				ecp->addr1.lno = 0;
882				F_SET(ecp, E_ADDR_ZERO);
883			} else
884				ecp->addr1.lno = 1;
885			ecp->addr1.cno = ecp->addr2.cno = 0;
886			F_SET(ecp, E_ADDR2_ALL);
887			break;
888		}
889		/* FALLTHROUGH */
890	case E_ADDR2:				/* Two addresses: */
891two_addr:	switch (ecp->addrcnt) {
892		case 0:				/* Default cursor/empty file. */
893			ecp->addrcnt = 2;
894			F_SET(ecp, E_ADDR_DEF);
895			if (sp->lno == 1 &&
896			    F_ISSET(ecp, E_ADDR_ZERODEF)) {
897				if (db_last(sp, &lno))
898					goto err;
899				if (lno == 0) {
900					ecp->addr1.lno = ecp->addr2.lno = 0;
901					F_SET(ecp, E_ADDR_ZERO);
902				} else
903					ecp->addr1.lno =
904					    ecp->addr2.lno = sp->lno;
905			} else
906				ecp->addr1.lno = ecp->addr2.lno = sp->lno;
907			ecp->addr1.cno = ecp->addr2.cno = sp->cno;
908			break;
909		case 1:				/* Default to first address. */
910			ecp->addrcnt = 2;
911			ecp->addr2 = ecp->addr1;
912			break;
913		case 2:
914			break;
915		}
916		break;
917	default:
918		if (ecp->addrcnt)		/* Error. */
919			goto usage;
920	}
921
922	/*
923	 * !!!
924	 * The ^D scroll command historically scrolled the value of the scroll
925	 * option or to EOF.  It was an error if the cursor was already at EOF.
926	 * (Leading addresses were permitted, but were then ignored.)
927	 */
928	if (ecp->cmd == &cmds[C_SCROLL]) {
929		ecp->addrcnt = 2;
930		ecp->addr1.lno = sp->lno + 1;
931		ecp->addr2.lno = sp->lno + O_VAL(sp, O_SCROLL);
932		ecp->addr1.cno = ecp->addr2.cno = sp->cno;
933		if (db_last(sp, &lno))
934			goto err;
935		if (lno != 0 && lno > sp->lno && ecp->addr2.lno > lno)
936			ecp->addr2.lno = lno;
937	}
938
939	ecp->flagoff = 0;
940	for (p = ecp->cmd->syntax; *p != '\0'; ++p) {
941		/*
942		 * The force flag is sensitive to leading whitespace, i.e.
943		 * "next !" is different from "next!".  Handle it before
944		 * skipping leading <blank>s.
945		 */
946		if (*p == '!') {
947			if (ecp->clen > 0 && *ecp->cp == '!') {
948				++ecp->cp;
949				--ecp->clen;
950				FL_SET(ecp->iflags, E_C_FORCE);
951			}
952			continue;
953		}
954
955		/* Skip leading <blank>s. */
956		for (; ecp->clen > 0; --ecp->clen, ++ecp->cp)
957			if (!isblank(*ecp->cp))
958				break;
959		if (ecp->clen == 0)
960			break;
961
962		switch (*p) {
963		case '1':				/* +, -, #, l, p */
964			/*
965			 * !!!
966			 * Historically, some flags were ignored depending
967			 * on where they occurred in the command line.  For
968			 * example, in the command, ":3+++p--#", historic vi
969			 * acted on the '#' flag, but ignored the '-' flags.
970			 * It's unambiguous what the flags mean, so we just
971			 * handle them regardless of the stupidity of their
972			 * location.
973			 */
974			for (; ecp->clen; --ecp->clen, ++ecp->cp)
975				switch (*ecp->cp) {
976				case '+':
977					++ecp->flagoff;
978					break;
979				case '-':
980				case '^':
981					--ecp->flagoff;
982					break;
983				case '#':
984					F_CLR(ecp, E_OPTNUM);
985					FL_SET(ecp->iflags, E_C_HASH);
986					exp->fdef |= E_C_HASH;
987					break;
988				case 'l':
989					FL_SET(ecp->iflags, E_C_LIST);
990					exp->fdef |= E_C_LIST;
991					break;
992				case 'p':
993					FL_SET(ecp->iflags, E_C_PRINT);
994					exp->fdef |= E_C_PRINT;
995					break;
996				default:
997					goto end_case1;
998				}
999end_case1:		break;
1000		case '2':				/* -, ., +, ^ */
1001		case '3':				/* -, ., +, ^, = */
1002			for (; ecp->clen; --ecp->clen, ++ecp->cp)
1003				switch (*ecp->cp) {
1004				case '-':
1005					FL_SET(ecp->iflags, E_C_DASH);
1006					break;
1007				case '.':
1008					FL_SET(ecp->iflags, E_C_DOT);
1009					break;
1010				case '+':
1011					FL_SET(ecp->iflags, E_C_PLUS);
1012					break;
1013				case '^':
1014					FL_SET(ecp->iflags, E_C_CARAT);
1015					break;
1016				case '=':
1017					if (*p == '3') {
1018						FL_SET(ecp->iflags, E_C_EQUAL);
1019						break;
1020					}
1021					/* FALLTHROUGH */
1022				default:
1023					goto end_case23;
1024				}
1025end_case23:		break;
1026		case 'b':				/* buffer */
1027			/*
1028			 * !!!
1029			 * Historically, "d #" was a delete with a flag, not a
1030			 * delete into the '#' buffer.  If the current command
1031			 * permits a flag, don't use one as a buffer.  However,
1032			 * the 'l' and 'p' flags were legal buffer names in the
1033			 * historic ex, and were used as buffers, not flags.
1034			 */
1035			if ((ecp->cp[0] == '+' || ecp->cp[0] == '-' ||
1036			    ecp->cp[0] == '^' || ecp->cp[0] == '#') &&
1037			    strchr(p, '1') != NULL)
1038				break;
1039			/*
1040			 * !!!
1041			 * Digits can't be buffer names in ex commands, or the
1042			 * command "d2" would be a delete into buffer '2', and
1043			 * not a two-line deletion.
1044			 */
1045			if (!isdigit(ecp->cp[0])) {
1046				ecp->buffer = *ecp->cp;
1047				++ecp->cp;
1048				--ecp->clen;
1049				FL_SET(ecp->iflags, E_C_BUFFER);
1050			}
1051			break;
1052		case 'c':				/* count [01+a] */
1053			++p;
1054			/* Validate any signed value. */
1055			if (!isdigit(*ecp->cp) && (*p != '+' ||
1056			    (*ecp->cp != '+' && *ecp->cp != '-')))
1057				break;
1058			/* If a signed value, set appropriate flags. */
1059			if (*ecp->cp == '-')
1060				FL_SET(ecp->iflags, E_C_COUNT_NEG);
1061			else if (*ecp->cp == '+')
1062				FL_SET(ecp->iflags, E_C_COUNT_POS);
1063			if ((nret =
1064			    nget_slong(&ltmp, ecp->cp, &t, 10)) != NUM_OK) {
1065				ex_badaddr(sp, NULL, A_NOTSET, nret);
1066				goto err;
1067			}
1068			if (ltmp == 0 && *p != '0') {
1069				msgq(sp, M_ERR, "083|Count may not be zero");
1070				goto err;
1071			}
1072			ecp->clen -= (t - ecp->cp);
1073			ecp->cp = t;
1074
1075			/*
1076			 * Counts as address offsets occur in commands taking
1077			 * two addresses.  Historic vi practice was to use
1078			 * the count as an offset from the *second* address.
1079			 *
1080			 * Set a count flag; some underlying commands (see
1081			 * join) do different things with counts than with
1082			 * line addresses.
1083			 */
1084			if (*p == 'a') {
1085				ecp->addr1 = ecp->addr2;
1086				ecp->addr2.lno = ecp->addr1.lno + ltmp - 1;
1087			} else
1088				ecp->count = ltmp;
1089			FL_SET(ecp->iflags, E_C_COUNT);
1090			break;
1091		case 'f':				/* file */
1092			if (argv_exp2(sp, ecp, ecp->cp, ecp->clen))
1093				goto err;
1094			goto arg_cnt_chk;
1095		case 'l':				/* line */
1096			/*
1097			 * Get a line specification.
1098			 *
1099			 * If the line was a search expression, we may have
1100			 * changed state during the call, and we're now
1101			 * searching the file.  Push ourselves onto the state
1102			 * stack.
1103			 */
1104			if (ex_line(sp, ecp, &cur, &isaddr, &tmp))
1105				goto rfail;
1106			if (tmp)
1107				goto err;
1108
1109			/* Line specifications are always required. */
1110			if (!isaddr) {
1111				msgq_str(sp, M_ERR, ecp->cp,
1112				     "084|%s: bad line specification");
1113				goto err;
1114			}
1115			/*
1116			 * The target line should exist for these commands,
1117			 * but 0 is legal for them as well.
1118			 */
1119			if (cur.lno != 0 && !db_exist(sp, cur.lno)) {
1120				ex_badaddr(sp, NULL, A_EOF, NUM_OK);
1121				goto err;
1122			}
1123			ecp->lineno = cur.lno;
1124			break;
1125		case 'S':				/* string, file exp. */
1126			if (ecp->clen != 0) {
1127				if (argv_exp1(sp, ecp, ecp->cp,
1128				    ecp->clen, ecp->cmd == &cmds[C_BANG]))
1129					goto err;
1130				goto addr_verify;
1131			}
1132			/* FALLTHROUGH */
1133		case 's':				/* string */
1134			if (argv_exp0(sp, ecp, ecp->cp, ecp->clen))
1135				goto err;
1136			goto addr_verify;
1137		case 'W':				/* word string */
1138			/*
1139			 * QUOTING NOTE:
1140			 *
1141			 * Literal next characters escape the following
1142			 * character.  Quoting characters are stripped here
1143			 * since they are no longer useful.
1144			 *
1145			 * First there was the word.
1146			 */
1147			for (p = t = ecp->cp;
1148			    ecp->clen > 0; --ecp->clen, ++ecp->cp) {
1149				ch = *ecp->cp;
1150				if (IS_ESCAPE(sp,
1151				    ecp, ch) && ecp->clen > 1) {
1152					--ecp->clen;
1153					*p++ = *++ecp->cp;
1154				} else if (isblank(ch)) {
1155					++ecp->cp;
1156					--ecp->clen;
1157					break;
1158				} else
1159					*p++ = ch;
1160			}
1161			if (argv_exp0(sp, ecp, t, p - t))
1162				goto err;
1163
1164			/* Delete intervening whitespace. */
1165			for (; ecp->clen > 0;
1166			    --ecp->clen, ++ecp->cp) {
1167				ch = *ecp->cp;
1168				if (!isblank(ch))
1169					break;
1170			}
1171			if (ecp->clen == 0)
1172				goto usage;
1173
1174			/* Followed by the string. */
1175			for (p = t = ecp->cp; ecp->clen > 0;
1176			    --ecp->clen, ++ecp->cp, ++p) {
1177				ch = *ecp->cp;
1178				if (IS_ESCAPE(sp,
1179				    ecp, ch) && ecp->clen > 1) {
1180					--ecp->clen;
1181					*p = *++ecp->cp;
1182				} else
1183					*p = ch;
1184			}
1185			if (argv_exp0(sp, ecp, t, p - t))
1186				goto err;
1187			goto addr_verify;
1188		case 'w':				/* word */
1189			if (argv_exp3(sp, ecp, ecp->cp, ecp->clen))
1190				goto err;
1191arg_cnt_chk:		if (*++p != 'N') {		/* N */
1192				/*
1193				 * If a number is specified, must either be
1194				 * 0 or that number, if optional, and that
1195				 * number, if required.
1196				 */
1197				tmp = *p - '0';
1198				if ((*++p != 'o' || exp->argsoff != 0) &&
1199				    exp->argsoff != tmp)
1200					goto usage;
1201			}
1202			goto addr_verify;
1203		default:
1204			msgq(sp, M_ERR,
1205			    "085|Internal syntax table error (%s: %s)",
1206			    ecp->cmd->name, KEY_NAME(sp, *p));
1207		}
1208	}
1209
1210	/* Skip trailing whitespace. */
1211	for (; ecp->clen > 0; --ecp->clen) {
1212		ch = *ecp->cp++;
1213		if (!isblank(ch))
1214			break;
1215	}
1216
1217	/*
1218	 * There shouldn't be anything left, and no more required fields,
1219	 * i.e neither 'l' or 'r' in the syntax string.
1220	 */
1221	if (ecp->clen != 0 || strpbrk(p, "lr")) {
1222usage:		msgq(sp, M_ERR, "086|Usage: %s", ecp->cmd->usage);
1223		goto err;
1224	}
1225
1226	/*
1227	 * Verify that the addresses are legal.  Check the addresses here,
1228	 * because this is a place where all ex addresses pass through.
1229	 * (They don't all pass through ex_line(), for instance.)  We're
1230	 * assuming that any non-existent line doesn't exist because it's
1231	 * past the end-of-file.  That's a pretty good guess.
1232	 *
1233	 * If it's a "default vi command", an address of zero is okay.
1234	 */
1235addr_verify:
1236	switch (ecp->addrcnt) {
1237	case 2:
1238		/*
1239		 * Historic ex/vi permitted commands with counts to go past
1240		 * EOF.  So, for example, if the file only had 5 lines, the
1241		 * ex command "1,6>" would fail, but the command ">300"
1242		 * would succeed.  Since we don't want to have to make all
1243		 * of the underlying commands handle random line numbers,
1244		 * fix it here.
1245		 */
1246		if (ecp->addr2.lno == 0) {
1247			if (!F_ISSET(ecp, E_ADDR_ZERO) &&
1248			    (F_ISSET(sp, SC_EX) ||
1249			    !F_ISSET(ecp, E_USELASTCMD))) {
1250				ex_badaddr(sp, ecp->cmd, A_ZERO, NUM_OK);
1251				goto err;
1252			}
1253		} else if (!db_exist(sp, ecp->addr2.lno))
1254			if (FL_ISSET(ecp->iflags, E_C_COUNT)) {
1255				if (db_last(sp, &lno))
1256					goto err;
1257				ecp->addr2.lno = lno;
1258			} else {
1259				ex_badaddr(sp, NULL, A_EOF, NUM_OK);
1260				goto err;
1261			}
1262		/* FALLTHROUGH */
1263	case 1:
1264		if (ecp->addr1.lno == 0) {
1265			if (!F_ISSET(ecp, E_ADDR_ZERO) &&
1266			    (F_ISSET(sp, SC_EX) ||
1267			    !F_ISSET(ecp, E_USELASTCMD))) {
1268				ex_badaddr(sp, ecp->cmd, A_ZERO, NUM_OK);
1269				goto err;
1270			}
1271		} else if (!db_exist(sp, ecp->addr1.lno)) {
1272			ex_badaddr(sp, NULL, A_EOF, NUM_OK);
1273			goto err;
1274		}
1275		break;
1276	}
1277
1278	/*
1279	 * If doing a default command and there's nothing left on the line,
1280	 * vi just moves to the line.  For example, ":3" and ":'a,'b" just
1281	 * move to line 3 and line 'b, respectively, but ":3|" prints line 3.
1282	 *
1283	 * !!!
1284	 * In addition, IF THE LINE CHANGES, move to the first nonblank of
1285	 * the line.
1286	 *
1287	 * !!!
1288	 * This is done before the absolute mark gets set; historically,
1289	 * "/a/,/b/" did NOT set vi's absolute mark, but "/a/,/b/d" did.
1290	 */
1291	if ((F_ISSET(sp, SC_VI) || F_ISSET(ecp, E_NOPRDEF)) &&
1292	    F_ISSET(ecp, E_USELASTCMD) && vi_address == 0) {
1293		switch (ecp->addrcnt) {
1294		case 2:
1295			if (sp->lno !=
1296			    (ecp->addr2.lno ? ecp->addr2.lno : 1)) {
1297				sp->lno =
1298				    ecp->addr2.lno ? ecp->addr2.lno : 1;
1299				sp->cno = 0;
1300				(void)nonblank(sp, sp->lno, &sp->cno);
1301			}
1302			break;
1303		case 1:
1304			if (sp->lno !=
1305			    (ecp->addr1.lno ? ecp->addr1.lno : 1)) {
1306				sp->lno =
1307				    ecp->addr1.lno ? ecp->addr1.lno : 1;
1308				sp->cno = 0;
1309				(void)nonblank(sp, sp->lno, &sp->cno);
1310			}
1311			break;
1312		}
1313		ecp->cp = ecp->save_cmd;
1314		ecp->clen = ecp->save_cmdlen;
1315		goto loop;
1316	}
1317
1318	/*
1319	 * Set the absolute mark -- we have to set it for vi here, in case
1320	 * it's a compound command, e.g. ":5p|6" should set the absolute
1321	 * mark for vi.
1322	 */
1323	if (F_ISSET(ecp, E_ABSMARK)) {
1324		cur.lno = sp->lno;
1325		cur.cno = sp->cno;
1326		F_CLR(ecp, E_ABSMARK);
1327		if (mark_set(sp, ABSMARK1, &cur, 1))
1328			goto err;
1329	}
1330
1331#if defined(DEBUG) && defined(COMLOG)
1332	ex_comlog(sp, ecp);
1333#endif
1334	/* Increment the command count if not called from vi. */
1335	if (F_ISSET(sp, SC_EX))
1336		++sp->ccnt;
1337
1338	/*
1339	 * If file state available, and not doing a global command,
1340	 * log the start of an action.
1341	 */
1342	if (sp->ep != NULL && !F_ISSET(sp, SC_EX_GLOBAL))
1343		(void)log_cursor(sp);
1344
1345	/*
1346	 * !!!
1347	 * There are two special commands for the purposes of this code: the
1348	 * default command (<carriage-return>) or the scrolling commands (^D
1349	 * and <EOF>) as the first non-<blank> characters  in the line.
1350	 *
1351	 * If this is the first command in the command line, we received the
1352	 * command from the ex command loop and we're talking to a tty, and
1353	 * and there's nothing else on the command line, and it's one of the
1354	 * special commands, we move back up to the previous line, and erase
1355	 * the prompt character with the output.  Since ex runs in canonical
1356	 * mode, we don't have to do anything else, a <newline> has already
1357	 * been echoed by the tty driver.  It's OK if vi calls us -- we won't
1358	 * be in ex mode so we'll do nothing.
1359	 */
1360	if (F_ISSET(ecp, E_NRSEP)) {
1361		if (sp->ep != NULL &&
1362		    F_ISSET(sp, SC_EX) && !F_ISSET(gp, G_SCRIPTED) &&
1363		    (F_ISSET(ecp, E_USELASTCMD) || ecp->cmd == &cmds[C_SCROLL]))
1364			gp->scr_ex_adjust(sp, EX_TERM_SCROLL);
1365		F_CLR(ecp, E_NRSEP);
1366	}
1367
1368	/*
1369	 * Call the underlying function for the ex command.
1370	 *
1371	 * XXX
1372	 * Interrupts behave like errors, for now.
1373	 */
1374	if (ecp->cmd->fn(sp, ecp) || INTERRUPTED(sp)) {
1375		if (F_ISSET(gp, G_SCRIPTED))
1376			F_SET(sp, SC_EXIT_FORCE);
1377		goto err;
1378	}
1379
1380#ifdef DEBUG
1381	/* Make sure no function left global temporary space locked. */
1382	if (F_ISSET(gp, G_TMP_INUSE)) {
1383		F_CLR(gp, G_TMP_INUSE);
1384		msgq(sp, M_ERR, "087|%s: temporary buffer not released",
1385		    ecp->cmd->name);
1386	}
1387#endif
1388	/*
1389	 * Ex displayed the number of lines modified immediately after each
1390	 * command, so the command "1,10d|1,10d" would display:
1391	 *
1392	 *	10 lines deleted
1393	 *	10 lines deleted
1394	 *	<autoprint line>
1395	 *
1396	 * Executing ex commands from vi only reported the final modified
1397	 * lines message -- that's wrong enough that we don't match it.
1398	 */
1399	if (F_ISSET(sp, SC_EX))
1400		mod_rpt(sp);
1401
1402	/*
1403	 * Integrate any offset parsed by the underlying command, and make
1404	 * sure the referenced line exists.
1405	 *
1406	 * XXX
1407	 * May not match historic practice (which I've never been able to
1408	 * completely figure out.)  For example, the '=' command from vi
1409	 * mode often got the offset wrong, and complained it was too large,
1410	 * but didn't seem to have a problem with the cursor.  If anyone
1411	 * complains, ask them how it's supposed to work, they might know.
1412	 */
1413	if (sp->ep != NULL && ecp->flagoff) {
1414		if (ecp->flagoff < 0) {
1415			if (sp->lno <= -ecp->flagoff) {
1416				msgq(sp, M_ERR,
1417				    "088|Flag offset to before line 1");
1418				goto err;
1419			}
1420		} else {
1421			if (!NPFITS(MAX_REC_NUMBER, sp->lno, ecp->flagoff)) {
1422				ex_badaddr(sp, NULL, A_NOTSET, NUM_OVER);
1423				goto err;
1424			}
1425			if (!db_exist(sp, sp->lno + ecp->flagoff)) {
1426				msgq(sp, M_ERR,
1427				    "089|Flag offset past end-of-file");
1428				goto err;
1429			}
1430		}
1431		sp->lno += ecp->flagoff;
1432	}
1433
1434	/*
1435	 * If the command executed successfully, we may want to display a line
1436	 * based on the autoprint option or an explicit print flag.  (Make sure
1437	 * that there's a line to display.)  Also, the autoprint edit option is
1438	 * turned off for the duration of global commands.
1439	 */
1440	if (F_ISSET(sp, SC_EX) && sp->ep != NULL && sp->lno != 0) {
1441		/*
1442		 * The print commands have already handled the `print' flags.
1443		 * If so, clear them.
1444		 */
1445		if (FL_ISSET(ecp->iflags, E_CLRFLAG))
1446			FL_CLR(ecp->iflags, E_C_HASH | E_C_LIST | E_C_PRINT);
1447
1448		/* If hash set only because of the number option, discard it. */
1449		if (F_ISSET(ecp, E_OPTNUM))
1450			FL_CLR(ecp->iflags, E_C_HASH);
1451
1452		/*
1453		 * If there was an explicit flag to display the new cursor line,
1454		 * or autoprint is set and a change was made, display the line.
1455		 * If any print flags were set use them, else default to print.
1456		 */
1457		LF_INIT(FL_ISSET(ecp->iflags, E_C_HASH | E_C_LIST | E_C_PRINT));
1458		if (!LF_ISSET(E_C_HASH | E_C_LIST | E_C_PRINT | E_NOAUTO) &&
1459		    !F_ISSET(sp, SC_EX_GLOBAL) &&
1460		    O_ISSET(sp, O_AUTOPRINT) && F_ISSET(ecp, E_AUTOPRINT))
1461			LF_INIT(E_C_PRINT);
1462
1463		if (LF_ISSET(E_C_HASH | E_C_LIST | E_C_PRINT)) {
1464			cur.lno = sp->lno;
1465			cur.cno = 0;
1466			(void)ex_print(sp, ecp, &cur, &cur, flags);
1467		}
1468	}
1469
1470	/*
1471	 * If the command had an associated "+cmd", it has to be executed
1472	 * before we finish executing any more of this ex command.  For
1473	 * example, consider a .exrc file that contains the following lines:
1474	 *
1475	 *	:set all
1476	 *	:edit +25 file.c|s/abc/ABC/|1
1477	 *	:3,5 print
1478	 *
1479	 * This can happen more than once -- the historic vi simply hung or
1480	 * dropped core, of course.  Prepend the + command back into the
1481	 * current command and continue.  We may have to add an additional
1482	 * <literal next> character.  We know that it will fit because we
1483	 * discarded at least one space and the + character.
1484	 */
1485	if (arg1_len != 0) {
1486		/*
1487		 * If the last character of the + command was a <literal next>
1488		 * character, it would be treated differently because of the
1489		 * append.  Quote it, if necessary.
1490		 */
1491		if (IS_ESCAPE(sp, ecp, arg1[arg1_len - 1])) {
1492			*--ecp->save_cmd = CH_LITERAL;
1493			++ecp->save_cmdlen;
1494		}
1495
1496		ecp->save_cmd -= arg1_len;
1497		ecp->save_cmdlen += arg1_len;
1498		memcpy(ecp->save_cmd, arg1, arg1_len);
1499
1500		/*
1501		 * Any commands executed from a +cmd are executed starting at
1502		 * the first column of the last line of the file -- NOT the
1503		 * first nonblank.)  The main file startup code doesn't know
1504		 * that a +cmd was set, however, so it may have put us at the
1505		 * top of the file.  (Note, this is safe because we must have
1506		 * switched files to get here.)
1507		 */
1508		F_SET(ecp, E_MOVETOEND);
1509	}
1510
1511	/* Update the current command. */
1512	ecp->cp = ecp->save_cmd;
1513	ecp->clen = ecp->save_cmdlen;
1514
1515	/*
1516	 * !!!
1517	 * If we've changed screens or underlying files, any pending global or
1518	 * v command, or @ buffer that has associated addresses, has to be
1519	 * discarded.  This is historic practice for globals, and necessary for
1520	 * @ buffers that had associated addresses.
1521	 *
1522	 * Otherwise, if we've changed underlying files, it's not a problem,
1523	 * we continue with the rest of the ex command(s), operating on the
1524	 * new file.  However, if we switch screens (either by exiting or by
1525	 * an explicit command), we have no way of knowing where to put output
1526	 * messages, and, since we don't control screens here, we could screw
1527	 * up the upper layers, (e.g. we could exit/reenter a screen multiple
1528	 * times).  So, return and continue after we've got a new screen.
1529	 */
1530	if (F_ISSET(sp, SC_EXIT | SC_EXIT_FORCE | SC_FSWITCH | SC_SSWITCH)) {
1531		at_found = gv_found = 0;
1532		for (ecp = sp->gp->ecq.lh_first;
1533		    ecp != NULL; ecp = ecp->q.le_next)
1534			switch (ecp->agv_flags) {
1535			case 0:
1536			case AGV_AT_NORANGE:
1537				break;
1538			case AGV_AT:
1539				if (!at_found) {
1540					at_found = 1;
1541					msgq(sp, M_ERR,
1542		"090|@ with range running when the file/screen changed");
1543				}
1544				break;
1545			case AGV_GLOBAL:
1546			case AGV_V:
1547				if (!gv_found) {
1548					gv_found = 1;
1549					msgq(sp, M_ERR,
1550		"091|Global/v command running when the file/screen changed");
1551				}
1552				break;
1553			default:
1554				abort();
1555			}
1556		if (at_found || gv_found)
1557			goto discard;
1558		if (F_ISSET(sp, SC_EXIT | SC_EXIT_FORCE | SC_SSWITCH))
1559			goto rsuccess;
1560	}
1561
1562	goto loop;
1563	/* NOTREACHED */
1564
1565err:	/*
1566	 * On command failure, we discard keys and pending commands remaining,
1567	 * as well as any keys that were mapped and waiting.  The save_cmdlen
1568	 * test is not necessarily correct.  If we fail early enough we don't
1569	 * know if the entire string was a single command or not.  Guess, as
1570	 * it's useful to know if commands other than the current one are being
1571	 * discarded.
1572	 */
1573	if (ecp->save_cmdlen == 0)
1574		for (; ecp->clen; --ecp->clen) {
1575			ch = *ecp->cp++;
1576			if (IS_ESCAPE(sp, ecp, ch) && ecp->clen > 1) {
1577				--ecp->clen;
1578				++ecp->cp;
1579			} else if (ch == '\n' || ch == '|') {
1580				if (ecp->clen > 1)
1581					ecp->save_cmdlen = 1;
1582				break;
1583			}
1584		}
1585	if (ecp->save_cmdlen != 0 || gp->ecq.lh_first != &gp->excmd) {
1586discard:	msgq(sp, M_BERR,
1587		    "092|Ex command failed: pending commands discarded");
1588		ex_discard(sp);
1589	}
1590	if (v_event_flush(sp, CH_MAPPED))
1591		msgq(sp, M_BERR,
1592		    "093|Ex command failed: mapped keys discarded");
1593
1594rfail:	tmp = 1;
1595	if (0)
1596rsuccess:	tmp = 0;
1597
1598	/* Turn off any file name error information. */
1599	gp->if_name = NULL;
1600
1601	/* Turn off the global bit. */
1602	F_CLR(sp, SC_EX_GLOBAL);
1603
1604	return (tmp);
1605}
1606
1607/*
1608 * ex_range --
1609 *	Get a line range for ex commands, or perform a vi ex address search.
1610 *
1611 * PUBLIC: int ex_range __P((SCR *, EXCMD *, int *));
1612 */
1613int
1614ex_range(sp, ecp, errp)
1615	SCR *sp;
1616	EXCMD *ecp;
1617	int *errp;
1618{
1619	enum { ADDR_FOUND, ADDR_NEED, ADDR_NONE } addr;
1620	GS *gp;
1621	EX_PRIVATE *exp;
1622	MARK m;
1623	int isaddr;
1624
1625	*errp = 0;
1626
1627	/*
1628	 * Parse comma or semi-colon delimited line specs.
1629	 *
1630	 * Semi-colon delimiters update the current address to be the last
1631	 * address.  For example, the command
1632	 *
1633	 *	:3;/pattern/ecp->cp
1634	 *
1635	 * will search for pattern from line 3.  In addition, if ecp->cp
1636	 * is not a valid command, the current line will be left at 3, not
1637	 * at the original address.
1638	 *
1639	 * Extra addresses are discarded, starting with the first.
1640	 *
1641	 * !!!
1642	 * If any addresses are missing, they default to the current line.
1643	 * This was historically true for both leading and trailing comma
1644	 * delimited addresses as well as for trailing semicolon delimited
1645	 * addresses.  For consistency, we make it true for leading semicolon
1646	 * addresses as well.
1647	 */
1648	gp = sp->gp;
1649	exp = EXP(sp);
1650	for (addr = ADDR_NONE, ecp->addrcnt = 0; ecp->clen > 0;)
1651		switch (*ecp->cp) {
1652		case '%':		/* Entire file. */
1653			/* Vi ex address searches didn't permit % signs. */
1654			if (F_ISSET(ecp, E_VISEARCH))
1655				goto ret;
1656
1657			/* It's an error if the file is empty. */
1658			if (sp->ep == NULL) {
1659				ex_badaddr(sp, NULL, A_EMPTY, NUM_OK);
1660				*errp = 1;
1661				return (0);
1662			}
1663			/*
1664			 * !!!
1665			 * A percent character addresses all of the lines in
1666			 * the file.  Historically, it couldn't be followed by
1667			 * any other address.  We do it as a text substitution
1668			 * for simplicity.  POSIX 1003.2 is expected to follow
1669			 * this practice.
1670			 *
1671			 * If it's an empty file, the first line is 0, not 1.
1672			 */
1673			if (addr == ADDR_FOUND) {
1674				ex_badaddr(sp, NULL, A_COMBO, NUM_OK);
1675				*errp = 1;
1676				return (0);
1677			}
1678			if (db_last(sp, &ecp->addr2.lno))
1679				return (1);
1680			ecp->addr1.lno = ecp->addr2.lno == 0 ? 0 : 1;
1681			ecp->addr1.cno = ecp->addr2.cno = 0;
1682			ecp->addrcnt = 2;
1683			addr = ADDR_FOUND;
1684			++ecp->cp;
1685			--ecp->clen;
1686			break;
1687		case ',':               /* Comma delimiter. */
1688			/* Vi ex address searches didn't permit commas. */
1689			if (F_ISSET(ecp, E_VISEARCH))
1690				goto ret;
1691			/* FALLTHROUGH */
1692		case ';':               /* Semi-colon delimiter. */
1693			if (sp->ep == NULL) {
1694				ex_badaddr(sp, NULL, A_EMPTY, NUM_OK);
1695				*errp = 1;
1696				return (0);
1697			}
1698			if (addr != ADDR_FOUND)
1699				switch (ecp->addrcnt) {
1700				case 0:
1701					ecp->addr1.lno = sp->lno;
1702					ecp->addr1.cno = sp->cno;
1703					ecp->addrcnt = 1;
1704					break;
1705				case 2:
1706					ecp->addr1 = ecp->addr2;
1707					/* FALLTHROUGH */
1708				case 1:
1709					ecp->addr2.lno = sp->lno;
1710					ecp->addr2.cno = sp->cno;
1711					ecp->addrcnt = 2;
1712					break;
1713				}
1714			if (*ecp->cp == ';')
1715				switch (ecp->addrcnt) {
1716				case 0:
1717					abort();
1718					/* NOTREACHED */
1719				case 1:
1720					sp->lno = ecp->addr1.lno;
1721					sp->cno = ecp->addr1.cno;
1722					break;
1723				case 2:
1724					sp->lno = ecp->addr2.lno;
1725					sp->cno = ecp->addr2.cno;
1726					break;
1727				}
1728			addr = ADDR_NEED;
1729			/* FALLTHROUGH */
1730		case ' ':		/* Whitespace. */
1731		case '\t':		/* Whitespace. */
1732			++ecp->cp;
1733			--ecp->clen;
1734			break;
1735		default:
1736			/* Get a line specification. */
1737			if (ex_line(sp, ecp, &m, &isaddr, errp))
1738				return (1);
1739			if (*errp)
1740				return (0);
1741			if (!isaddr)
1742				goto ret;
1743			if (addr == ADDR_FOUND) {
1744				ex_badaddr(sp, NULL, A_COMBO, NUM_OK);
1745				*errp = 1;
1746				return (0);
1747			}
1748			switch (ecp->addrcnt) {
1749			case 0:
1750				ecp->addr1 = m;
1751				ecp->addrcnt = 1;
1752				break;
1753			case 1:
1754				ecp->addr2 = m;
1755				ecp->addrcnt = 2;
1756				break;
1757			case 2:
1758				ecp->addr1 = ecp->addr2;
1759				ecp->addr2 = m;
1760				break;
1761			}
1762			addr = ADDR_FOUND;
1763			break;
1764		}
1765
1766	/*
1767	 * !!!
1768	 * Vi ex address searches are indifferent to order or trailing
1769	 * semi-colons.
1770	 */
1771ret:	if (F_ISSET(ecp, E_VISEARCH))
1772		return (0);
1773
1774	if (addr == ADDR_NEED)
1775		switch (ecp->addrcnt) {
1776		case 0:
1777			ecp->addr1.lno = sp->lno;
1778			ecp->addr1.cno = sp->cno;
1779			ecp->addrcnt = 1;
1780			break;
1781		case 2:
1782			ecp->addr1 = ecp->addr2;
1783			/* FALLTHROUGH */
1784		case 1:
1785			ecp->addr2.lno = sp->lno;
1786			ecp->addr2.cno = sp->cno;
1787			ecp->addrcnt = 2;
1788			break;
1789		}
1790
1791	if (ecp->addrcnt == 2 && ecp->addr2.lno < ecp->addr1.lno) {
1792		msgq(sp, M_ERR,
1793		    "094|The second address is smaller than the first");
1794		*errp = 1;
1795	}
1796	return (0);
1797}
1798
1799/*
1800 * ex_line --
1801 *	Get a single line address specifier.
1802 *
1803 * The way the "previous context" mark worked was that any "non-relative"
1804 * motion set it.  While ex/vi wasn't totally consistent about this, ANY
1805 * numeric address, search pattern, '$', or mark reference in an address
1806 * was considered non-relative, and set the value.  Which should explain
1807 * why we're hacking marks down here.  The problem was that the mark was
1808 * only set if the command was called, i.e. we have to set a flag and test
1809 * it later.
1810 *
1811 * XXX
1812 * This is probably still not exactly historic practice, although I think
1813 * it's fairly close.
1814 */
1815static int
1816ex_line(sp, ecp, mp, isaddrp, errp)
1817	SCR *sp;
1818	EXCMD *ecp;
1819	MARK *mp;
1820	int *isaddrp, *errp;
1821{
1822	enum nresult nret;
1823	EX_PRIVATE *exp;
1824	GS *gp;
1825	long total, val;
1826	int isneg;
1827	int (*sf) __P((SCR *, MARK *, MARK *, char *, size_t, char **, u_int));
1828	char *endp;
1829
1830	gp = sp->gp;
1831	exp = EXP(sp);
1832
1833	*isaddrp = *errp = 0;
1834	F_CLR(ecp, E_DELTA);
1835
1836	/* No addresses permitted until a file has been read in. */
1837	if (sp->ep == NULL && strchr("$0123456789'\\/?.+-^", *ecp->cp)) {
1838		ex_badaddr(sp, NULL, A_EMPTY, NUM_OK);
1839		*errp = 1;
1840		return (0);
1841	}
1842
1843	switch (*ecp->cp) {
1844	case '$':				/* Last line in the file. */
1845		*isaddrp = 1;
1846		F_SET(ecp, E_ABSMARK);
1847
1848		mp->cno = 0;
1849		if (db_last(sp, &mp->lno))
1850			return (1);
1851		++ecp->cp;
1852		--ecp->clen;
1853		break;				/* Absolute line number. */
1854	case '0': case '1': case '2': case '3': case '4':
1855	case '5': case '6': case '7': case '8': case '9':
1856		*isaddrp = 1;
1857		F_SET(ecp, E_ABSMARK);
1858
1859		if ((nret = nget_slong(&val, ecp->cp, &endp, 10)) != NUM_OK) {
1860			ex_badaddr(sp, NULL, A_NOTSET, nret);
1861			*errp = 1;
1862			return (0);
1863		}
1864		if (!NPFITS(MAX_REC_NUMBER, 0, val)) {
1865			ex_badaddr(sp, NULL, A_NOTSET, NUM_OVER);
1866			*errp = 1;
1867			return (0);
1868		}
1869		mp->lno = val;
1870		mp->cno = 0;
1871		ecp->clen -= (endp - ecp->cp);
1872		ecp->cp = endp;
1873		break;
1874	case '\'':				/* Use a mark. */
1875		*isaddrp = 1;
1876		F_SET(ecp, E_ABSMARK);
1877
1878		if (ecp->clen == 1) {
1879			msgq(sp, M_ERR, "095|No mark name supplied");
1880			*errp = 1;
1881			return (0);
1882		}
1883		if (mark_get(sp, ecp->cp[1], mp, M_ERR)) {
1884			*errp = 1;
1885			return (0);
1886		}
1887		ecp->cp += 2;
1888		ecp->clen -= 2;
1889		break;
1890	case '\\':				/* Search: forward/backward. */
1891		/*
1892		 * !!!
1893		 * I can't find any difference between // and \/ or between
1894		 * ?? and \?.  Mark Horton doesn't remember there being any
1895		 * difference.  C'est la vie.
1896		 */
1897		if (ecp->clen < 2 ||
1898		    ecp->cp[1] != '/' && ecp->cp[1] != '?') {
1899			msgq(sp, M_ERR, "096|\\ not followed by / or ?");
1900			*errp = 1;
1901			return (0);
1902		}
1903		++ecp->cp;
1904		--ecp->clen;
1905		sf = ecp->cp[0] == '/' ? f_search : b_search;
1906		goto search;
1907	case '/':				/* Search forward. */
1908		sf = f_search;
1909		goto search;
1910	case '?':				/* Search backward. */
1911		sf = b_search;
1912
1913search:		mp->lno = sp->lno;
1914		mp->cno = sp->cno;
1915		if (sf(sp, mp, mp, ecp->cp, ecp->clen, &endp,
1916		    SEARCH_MSG | SEARCH_PARSE | SEARCH_SET |
1917		    (F_ISSET(ecp, E_SEARCH_WMSG) ? SEARCH_WMSG : 0))) {
1918			*errp = 1;
1919			return (0);
1920		}
1921
1922		/* Fix up the command pointers. */
1923		ecp->clen -= (endp - ecp->cp);
1924		ecp->cp = endp;
1925
1926		*isaddrp = 1;
1927		F_SET(ecp, E_ABSMARK);
1928		break;
1929	case '.':				/* Current position. */
1930		*isaddrp = 1;
1931		mp->cno = sp->cno;
1932
1933		/* If an empty file, then '.' is 0, not 1. */
1934		if (sp->lno == 1) {
1935			if (db_last(sp, &mp->lno))
1936				return (1);
1937			if (mp->lno != 0)
1938				mp->lno = 1;
1939		} else
1940			mp->lno = sp->lno;
1941
1942		/*
1943		 * !!!
1944		 * Historically, .<number> was the same as .+<number>, i.e.
1945		 * the '+' could be omitted.  (This feature is found in ed
1946		 * as well.)
1947		 */
1948		if (ecp->clen > 1 && isdigit(ecp->cp[1]))
1949			*ecp->cp = '+';
1950		else {
1951			++ecp->cp;
1952			--ecp->clen;
1953		}
1954		break;
1955	}
1956
1957	/* Skip trailing <blank>s. */
1958	for (; ecp->clen > 0 &&
1959	    isblank(ecp->cp[0]); ++ecp->cp, --ecp->clen);
1960
1961	/*
1962	 * Evaluate any offset.  If no address yet found, the offset
1963	 * is relative to ".".
1964	 */
1965	total = 0;
1966	if (ecp->clen != 0 && (isdigit(ecp->cp[0]) ||
1967	    ecp->cp[0] == '+' || ecp->cp[0] == '-' ||
1968	    ecp->cp[0] == '^')) {
1969		if (!*isaddrp) {
1970			*isaddrp = 1;
1971			mp->lno = sp->lno;
1972			mp->cno = sp->cno;
1973		}
1974		/*
1975		 * Evaluate an offset, defined as:
1976		 *
1977		 *		[+-^<blank>]*[<blank>]*[0-9]*
1978		 *
1979		 * The rough translation is any number of signs, optionally
1980		 * followed by numbers, or a number by itself, all <blank>
1981		 * separated.
1982		 *
1983		 * !!!
1984		 * All address offsets were additive, e.g. "2 2 3p" was the
1985		 * same as "7p", or, "/ZZZ/ 2" was the same as "/ZZZ/+2".
1986		 * Note, however, "2 /ZZZ/" was an error.  It was also legal
1987		 * to insert signs without numbers, so "3 - 2" was legal, and
1988		 * equal to 4.
1989		 *
1990		 * !!!
1991		 * Offsets were historically permitted for any line address,
1992		 * e.g. the command "1,2 copy 2 2 2 2" copied lines 1,2 after
1993		 * line 8.
1994		 *
1995		 * !!!
1996		 * Offsets were historically permitted for search commands,
1997		 * and handled as addresses: "/pattern/2 2 2" was legal, and
1998		 * referenced the 6th line after pattern.
1999		 */
2000		F_SET(ecp, E_DELTA);
2001		for (;;) {
2002			for (; ecp->clen > 0 && isblank(ecp->cp[0]);
2003			    ++ecp->cp, --ecp->clen);
2004			if (ecp->clen == 0 || !isdigit(ecp->cp[0]) &&
2005			    ecp->cp[0] != '+' && ecp->cp[0] != '-' &&
2006			    ecp->cp[0] != '^')
2007				break;
2008			if (!isdigit(ecp->cp[0]) &&
2009			    !isdigit(ecp->cp[1])) {
2010				total += ecp->cp[0] == '+' ? 1 : -1;
2011				--ecp->clen;
2012				++ecp->cp;
2013			} else {
2014				if (ecp->cp[0] == '-' ||
2015				    ecp->cp[0] == '^') {
2016					++ecp->cp;
2017					--ecp->clen;
2018					isneg = 1;
2019				} else
2020					isneg = 0;
2021
2022				/* Get a signed long, add it to the total. */
2023				if ((nret = nget_slong(&val,
2024				    ecp->cp, &endp, 10)) != NUM_OK ||
2025				    (nret = NADD_SLONG(sp,
2026				    total, val)) != NUM_OK) {
2027					ex_badaddr(sp, NULL, A_NOTSET, nret);
2028					*errp = 1;
2029					return (0);
2030				}
2031				total += isneg ? -val : val;
2032				ecp->clen -= (endp - ecp->cp);
2033				ecp->cp = endp;
2034			}
2035		}
2036	}
2037
2038	/*
2039	 * Any value less than 0 is an error.  Make sure that the new value
2040	 * will fit into a recno_t.
2041	 */
2042	if (*isaddrp && total != 0) {
2043		if (total < 0) {
2044			if (-total > mp->lno) {
2045				msgq(sp, M_ERR,
2046			    "097|Reference to a line number less than 0");
2047				*errp = 1;
2048				return (0);
2049			}
2050		} else
2051			if (!NPFITS(MAX_REC_NUMBER, mp->lno, total)) {
2052				ex_badaddr(sp, NULL, A_NOTSET, NUM_OVER);
2053				*errp = 1;
2054				return (0);
2055			}
2056		mp->lno += total;
2057	}
2058	return (0);
2059}
2060
2061
2062/*
2063 * ex_load --
2064 *	Load up the next command, which may be an @ buffer or global command.
2065 */
2066static int
2067ex_load(sp)
2068	SCR *sp;
2069{
2070	GS *gp;
2071	EXCMD *ecp;
2072	RANGE *rp;
2073
2074	F_CLR(sp, SC_EX_GLOBAL);
2075
2076	/*
2077	 * Lose any exhausted commands.  We know that the first command
2078	 * can't be an AGV command, which makes things a bit easier.
2079	 */
2080	for (gp = sp->gp;;) {
2081		/*
2082		 * If we're back to the original structure, leave it around,
2083		 * but discard any allocated source name, we've returned to
2084		 * the beginning of the command stack.
2085		 */
2086		if ((ecp = gp->ecq.lh_first) == &gp->excmd) {
2087			if (F_ISSET(ecp, E_NAMEDISCARD)) {
2088				free(ecp->if_name);
2089				ecp->if_name = NULL;
2090			}
2091			return (0);
2092		}
2093
2094		/*
2095		 * ecp->clen will be 0 for the first discarded command, but
2096		 * may not be 0 for subsequent ones, e.g. if the original
2097		 * command was ":g/xx/@a|s/b/c/", then when we discard the
2098		 * command pushed on the stack by the @a, we have to resume
2099		 * the global command which included the substitute command.
2100		 */
2101		if (ecp->clen != 0)
2102			return (0);
2103
2104		/*
2105		 * If it's an @, global or v command, we may need to continue
2106		 * the command on a different line.
2107		 */
2108		if (FL_ISSET(ecp->agv_flags, AGV_ALL)) {
2109			/* Discard any exhausted ranges. */
2110			while ((rp = ecp->rq.cqh_first) != (void *)&ecp->rq)
2111				if (rp->start > rp->stop) {
2112					CIRCLEQ_REMOVE(&ecp->rq, rp, q);
2113					free(rp);
2114				} else
2115					break;
2116
2117			/* If there's another range, continue with it. */
2118			if (rp != (void *)&ecp->rq)
2119				break;
2120
2121			/* If it's a global/v command, fix up the last line. */
2122			if (FL_ISSET(ecp->agv_flags,
2123			    AGV_GLOBAL | AGV_V) && ecp->range_lno != OOBLNO)
2124				if (db_exist(sp, ecp->range_lno))
2125					sp->lno = ecp->range_lno;
2126				else {
2127					if (db_last(sp, &sp->lno))
2128						return (1);
2129					if (sp->lno == 0)
2130						sp->lno = 1;
2131				}
2132			free(ecp->o_cp);
2133		}
2134
2135		/* Discard the EXCMD. */
2136		LIST_REMOVE(ecp, q);
2137		free(ecp);
2138	}
2139
2140	/*
2141	 * We only get here if it's an active @, global or v command.  Set
2142	 * the current line number, and get a new copy of the command for
2143	 * the parser.  Note, the original pointer almost certainly moved,
2144	 * so we have play games.
2145	 */
2146	ecp->cp = ecp->o_cp;
2147	memcpy(ecp->cp, ecp->cp + ecp->o_clen, ecp->o_clen);
2148	ecp->clen = ecp->o_clen;
2149	ecp->range_lno = sp->lno = rp->start++;
2150
2151	if (FL_ISSET(ecp->agv_flags, AGV_GLOBAL | AGV_V))
2152		F_SET(sp, SC_EX_GLOBAL);
2153	return (0);
2154}
2155
2156/*
2157 * ex_discard --
2158 *	Discard any pending ex commands.
2159 */
2160static int
2161ex_discard(sp)
2162	SCR *sp;
2163{
2164	GS *gp;
2165	EXCMD *ecp;
2166	RANGE *rp;
2167
2168	/*
2169	 * We know the first command can't be an AGV command, so we don't
2170	 * process it specially.  We do, however, nail the command itself.
2171	 */
2172	for (gp = sp->gp; (ecp = gp->ecq.lh_first) != &gp->excmd;) {
2173		if (FL_ISSET(ecp->agv_flags, AGV_ALL)) {
2174			while ((rp = ecp->rq.cqh_first) != (void *)&ecp->rq) {
2175				CIRCLEQ_REMOVE(&ecp->rq, rp, q);
2176				free(rp);
2177			}
2178			free(ecp->o_cp);
2179		}
2180		LIST_REMOVE(ecp, q);
2181		free(ecp);
2182	}
2183	gp->ecq.lh_first->clen = 0;
2184	return (0);
2185}
2186
2187/*
2188 * ex_unknown --
2189 *	Display an unknown command name.
2190 */
2191static void
2192ex_unknown(sp, cmd, len)
2193	SCR *sp;
2194	char *cmd;
2195	size_t len;
2196{
2197	size_t blen;
2198	char *bp;
2199
2200	GET_SPACE_GOTO(sp, bp, blen, len + 1);
2201	bp[len] = '\0';
2202	memcpy(bp, cmd, len);
2203	msgq_str(sp, M_ERR, bp, "098|The %s command is unknown");
2204	FREE_SPACE(sp, bp, blen);
2205
2206alloc_err:
2207	return;
2208}
2209
2210/*
2211 * ex_is_abbrev -
2212 *	The vi text input routine needs to know if ex thinks this is an
2213 *	[un]abbreviate command, so it can turn off abbreviations.  See
2214 *	the usual ranting in the vi/v_txt_ev.c:txt_abbrev() routine.
2215 *
2216 * PUBLIC: int ex_is_abbrev __P((char *, size_t));
2217 */
2218int
2219ex_is_abbrev(name, len)
2220	char *name;
2221	size_t len;
2222{
2223	EXCMDLIST const *cp;
2224
2225	return ((cp = ex_comm_search(name, len)) != NULL &&
2226	    (cp == &cmds[C_ABBR] || cp == &cmds[C_UNABBREVIATE]));
2227}
2228
2229/*
2230 * ex_is_unmap -
2231 *	The vi text input routine needs to know if ex thinks this is an
2232 *	unmap command, so it can turn off input mapping.  See the usual
2233 *	ranting in the vi/v_txt_ev.c:txt_unmap() routine.
2234 *
2235 * PUBLIC: int ex_is_unmap __P((char *, size_t));
2236 */
2237int
2238ex_is_unmap(name, len)
2239	char *name;
2240	size_t len;
2241{
2242	EXCMDLIST const *cp;
2243
2244	/*
2245	 * The command the vi input routines are really interested in
2246	 * is "unmap!", not just unmap.
2247	 */
2248	if (name[len - 1] != '!')
2249		return (0);
2250	--len;
2251	return ((cp = ex_comm_search(name, len)) != NULL &&
2252	    cp == &cmds[C_UNMAP]);
2253}
2254
2255/*
2256 * ex_comm_search --
2257 *	Search for a command name.
2258 */
2259static EXCMDLIST const *
2260ex_comm_search(name, len)
2261	char *name;
2262	size_t len;
2263{
2264	EXCMDLIST const *cp;
2265
2266	for (cp = cmds; cp->name != NULL; ++cp) {
2267		if (cp->name[0] > name[0])
2268			return (NULL);
2269		if (cp->name[0] != name[0])
2270			continue;
2271		if (!memcmp(name, cp->name, len))
2272			return (cp);
2273	}
2274	return (NULL);
2275}
2276
2277/*
2278 * ex_badaddr --
2279 *	Display a bad address message.
2280 *
2281 * PUBLIC: void ex_badaddr
2282 * PUBLIC:    __P((SCR *, EXCMDLIST const *, enum badaddr, enum nresult));
2283 */
2284void
2285ex_badaddr(sp, cp, ba, nret)
2286	SCR *sp;
2287	EXCMDLIST const *cp;
2288	enum badaddr ba;
2289	enum nresult nret;
2290{
2291	recno_t lno;
2292
2293	switch (nret) {
2294	case NUM_OK:
2295		break;
2296	case NUM_ERR:
2297		msgq(sp, M_SYSERR, NULL);
2298		return;
2299	case NUM_OVER:
2300		msgq(sp, M_ERR, "099|Address value overflow");
2301		return;
2302	case NUM_UNDER:
2303		msgq(sp, M_ERR, "100|Address value underflow");
2304		return;
2305	}
2306
2307	/*
2308	 * When encountering an address error, tell the user if there's no
2309	 * underlying file, that's the real problem.
2310	 */
2311	if (sp->ep == NULL) {
2312		ex_emsg(sp, cp ? cp->name : NULL, EXM_NOFILEYET);
2313		return;
2314	}
2315
2316	switch (ba) {
2317	case A_COMBO:
2318		msgq(sp, M_ERR, "101|Illegal address combination");
2319		break;
2320	case A_EOF:
2321		if (db_last(sp, &lno))
2322			return;
2323		if (lno != 0) {
2324			msgq(sp, M_ERR,
2325			    "102|Illegal address: only %lu lines in the file",
2326			    lno);
2327			break;
2328		}
2329		/* FALLTHROUGH */
2330	case A_EMPTY:
2331		msgq(sp, M_ERR, "103|Illegal address: the file is empty");
2332		break;
2333	case A_NOTSET:
2334		abort();
2335		/* NOTREACHED */
2336	case A_ZERO:
2337		msgq(sp, M_ERR,
2338		    "104|The %s command doesn't permit an address of 0",
2339		    cp->name);
2340		break;
2341	}
2342	return;
2343}
2344
2345#if defined(DEBUG) && defined(COMLOG)
2346/*
2347 * ex_comlog --
2348 *	Log ex commands.
2349 */
2350static void
2351ex_comlog(sp, ecp)
2352	SCR *sp;
2353	EXCMD *ecp;
2354{
2355	TRACE(sp, "ecmd: %s", ecp->cmd->name);
2356	if (ecp->addrcnt > 0) {
2357		TRACE(sp, " a1 %d", ecp->addr1.lno);
2358		if (ecp->addrcnt > 1)
2359			TRACE(sp, " a2: %d", ecp->addr2.lno);
2360	}
2361	if (ecp->lineno)
2362		TRACE(sp, " line %d", ecp->lineno);
2363	if (ecp->flags)
2364		TRACE(sp, " flags 0x%x", ecp->flags);
2365	if (F_ISSET(&exc, E_BUFFER))
2366		TRACE(sp, " buffer %c", ecp->buffer);
2367	if (ecp->argc)
2368		for (cnt = 0; cnt < ecp->argc; ++cnt)
2369			TRACE(sp, " arg %d: {%s}", cnt, ecp->argv[cnt]->bp);
2370	TRACE(sp, "\n");
2371}
2372#endif
2373