18565: bug when ${(u)...} reduced array to length 1

1 files changed, 17 insertions, 10 deletions

diff --git a/Src/subst.c b/Src/subst.c
index dc5044959..89ecbab7a 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -1951,25 +1951,32 @@ paramsubst(LinkList l, LinkNode n, char **str, int qt, int ssub)
 	int i;
 	LinkNode on = n;
 
-	if (!aval[0] && !plan9) {
+	if (unique) {
+	    if(!copied)
+		aval = arrdup(aval);
+
+	    i = arrlen(aval);
+	    if (i > 1)
+		zhuniqarray(aval);
+	}
+	if ((!aval[0] || !aval[1]) && !plan9) {
+	    int vallen;
 	    if (aptr > (char *) getdata(n) &&
 		aptr[-1] == Dnull && *fstr == Dnull)
 		*--aptr = '\0', fstr++;
-	    y = (char *) hcalloc((aptr - ostr) + strlen(fstr) + 1);
+	    vallen = aval[0] ? strlen(aval[0]) : 0;
+	    y = (char *) hcalloc((aptr - ostr) + vallen + strlen(fstr) + 1);
 	    strcpy(y, ostr);
 	    *str = y + (aptr - ostr);
+	    if (vallen)
+	    {
+		strcpy(*str, aval[0]);
+		*str += vallen;
+	    }
 	    strcpy(*str, fstr);
 	    setdata(n, y);
 	    return n;
 	}
-	if (unique) {
-	    if(!copied)
-		aval = arrdup(aval);
-
-	    i = arrlen(aval);
-	    if (i > 1)
-		zhuniqarray(aval);
-	}
 	if (sortit) {
 	    if (!copied)
 		aval = arrdup(aval);