Fix IFS field splitting bugs in read -d ''

@dicktyr reports:
> for the following script
>
> IFS=$'\n' read -d '' v1 v2 <<< "$(printf 'a\nb')" ; \
>	printf '[%s]\n' "$v1" "$v2"
>
> bash produces the expected output
>
> [a]
> [b]
>
> but ksh (93u+m/1.0.10) produces
>
> [a
> b
> ]
> []

The bug is that 'read' does not correctly do IFS splitting by
newline when given a null delimeter (-d '') or any delimiter other
than a newline.

In the course of debugging this, it was also found that there is
incorrect behavour when IFS is unset.

src/cmd/ksh93/bltins/read.c: sh_readline():
- If IFS is unset (ifs==NULL), handle field splitting using the
  default value, $' \t\n' (e_sptbnl). This is specified by POSIX.
  The type of ifs is changed to const char* to avoid a warning;
  this is a good idea anyway since sh_readline should never change
  the value of IFS.
- Backport a fix from ksh 93v- 2013-04-02: if the delimiter is not
  newline but IFS contains a newline, turn on S_DELIM handling for
  the newline in sh.ifstable. This gets us most of the way towards
  a full fix, but leaves trailing newline delimiters intact, which
  is incorrect.
- To fix that remaining problem, when stripping off trailing space
  delimiters, don't only look for the S_SPACE state but also for
  the S_DELIM state for isspace(3) characters. This *should* only
  ever be relevant for newline characters but I'm preferring a more
  generalised whitespace fix here, just in case.

src/cmd/ksh93/tests/builtins.sh:
- Remove an incorrect text that was enforcing the current buggy
  behaviour.  It was backported from ksh 93v- 2013-03-18, but we
  didn't notice at the time that this test had been removed again
  in ksh 93v- 2013-04-02. (re: cfc8744)
- Add tests for 10 reproducers related to this bug.

Resolves: #926

Author: McDutchie

COPYRIGHT

@@ -3,7 +3,7 @@ ksh 93u+m general copyright notice
 ########################################################################
 #                                                                      #
 #                   The KornShell 93u+m distribution                   #
-#          Copyright (c) 2020-2025 Contributors to ksh 93u+m           #
+#          Copyright (c) 2020-2026 Contributors to ksh 93u+m           #
 #                    <https://github.com/ksh93/ksh>                    #
 #             Derived from AT&T's ast package (see below)              #
 #       Licensed under the Eclipse Public License, Version 2.0         #

NEWS

@@ -2,6 +2,11 @@ This documents significant changes in the dev branch of ksh 93u+m.
 For full details, see the git log at: https://github.com/ksh93/ksh
 Uppercase BUG_* IDs are shell bug IDs as used by the Modernish shell library.
 
+2026-01-21:
+
+- Fixed several IFS field splitting bugs in read(1) that occurred
+  when it is given a null delimiter (read -d '').
+
 2025-09-30:
 
 - The rm path-bound built-in command from libcmd no longer suppresses error

src/cmd/ksh93/bltins/read.c

@@ -2,7 +2,7 @@
 *                                                                      *
 *               This software is part of the ast package               *
 *          Copyright (c) 1982-2012 AT&T Intellectual Property          *
-*          Copyright (c) 2020-2025 Contributors to ksh 93u+m           *
+*          Copyright (c) 2020-2026 Contributors to ksh 93u+m           *
 *                      and is licensed under the                       *
 *                 Eclipse Public License, Version 2.0                  *
 *                                                                      *
@@ -221,7 +221,7 @@ int sh_readline(char **names, volatile int fd, int flags, ssize_t size, Sflong_t
 	char			*name, *val;
 	Sfio_t			*iop;
 	Namfun_t		*nfp;
-	char			*ifs;
+	const char		*ifs;
 	unsigned char		*cpmax;
 	unsigned char		*del;
 	char			was_escape = 0;
@@ -314,6 +314,8 @@ int sh_readline(char **names, volatile int fd, int flags, ssize_t size, Sflong_t
 		Namval_t *mp;
 		/* set up state table based on IFS */
 		ifs = nv_getval(mp=sh_scoped(IFSNOD));
+		if(!ifs)
+			ifs = e_sptbnl; /* unset == default */
 		if((flags&R_FLAG) && sh.ifstable['\\']==S_ESC)
 			sh.ifstable['\\'] = 0;
 		else if(!(flags&R_FLAG) && sh.ifstable['\\']==0)
@@ -322,7 +324,10 @@ int sh_readline(char **names, volatile int fd, int flags, ssize_t size, Sflong_t
 			sh.ifstable[delim] = S_NL;
 		if(delim!='\n')
 		{
-			sh.ifstable['\n'] = 0;
+			if(strchr(ifs,'\n'))
+				sh.ifstable['\n'] = S_DELIM;
+			else
+				sh.ifstable['\n'] = 0;
 			nv_putval(mp, ifs, NV_RDONLY);
 		}
 		sh.ifstable[0] = S_EOF;
@@ -782,13 +787,13 @@ int sh_readline(char **names, volatile int fd, int flags, ssize_t size, Sflong_t
 		{
 			/* strip off trailing space delimiters */
 			unsigned char	*vp = (unsigned char*)val + strlen(val);
-			while(sh.ifstable[*--vp]==S_SPACE);
+			while(sh.ifstable[*--vp]==S_SPACE || (isspace(*vp) && sh.ifstable[*vp]==S_DELIM));
 			if(vp==del)
 			{
 				if(vp==(unsigned char*)val)
 					vp--;
 				else
-					while(sh.ifstable[*--vp]==S_SPACE);
+					while(sh.ifstable[*--vp]==S_SPACE || (isspace(*vp) && sh.ifstable[*vp]==S_DELIM));
 			}
 			vp[1] = 0;
 		}

src/cmd/ksh93/include/version.h

@@ -2,7 +2,7 @@
 *                                                                      *
 *               This software is part of the ast package               *
 *          Copyright (c) 1982-2012 AT&T Intellectual Property          *
-*          Copyright (c) 2020-2025 Contributors to ksh 93u+m           *
+*          Copyright (c) 2020-2026 Contributors to ksh 93u+m           *
 *                      and is licensed under the                       *
 *                 Eclipse Public License, Version 2.0                  *
 *                                                                      *
@@ -18,14 +18,14 @@
 #include <ast_release.h>
 #include "git.h"
 
-#define SH_RELEASE_DATE	"2025-06-22"	/* must be in this format for $((.sh.version)) */
+#define SH_RELEASE_DATE	"2026-01-21"	/* must be in this format for $((.sh.version)) */
 /*
  * This comment keeps SH_RELEASE_DATE a few lines away from SH_RELEASE_SVER to avoid
  * merge conflicts when cherry-picking dev branch commits onto a release branch.
  */
 #define SH_RELEASE_FORK	"93u+m"		/* only change if you develop a new ksh93 fork */
 #define SH_RELEASE_SVER	"1.1.0-alpha"	/* semantic version number: https://semver.org */
-#define SH_RELEASE_CPYR	"(c) 2020-2025 Contributors to ksh " SH_RELEASE_FORK
+#define SH_RELEASE_CPYR	"(c) 2020-2026 Contributors to ksh " SH_RELEASE_FORK
 
 /* Scripts sometimes field-split ${.sh.version}, so don't change amount of whitespace. */
 /* Arithmetic $((.sh.version)) uses the last 10 chars, so the date must be at the end. */

src/cmd/ksh93/tests/builtins.sh

@@ -2,7 +2,7 @@
 #                                                                      #
 #               This software is part of the ast package               #
 #          Copyright (c) 1982-2012 AT&T Intellectual Property          #
-#          Copyright (c) 2020-2025 Contributors to ksh 93u+m           #
+#          Copyright (c) 2020-2026 Contributors to ksh 93u+m           #
 #                      and is licensed under the                       #
 #                 Eclipse Public License, Version 2.0                  #
 #                                                                      #
@@ -1576,16 +1576,6 @@ print ". $tmp/evalbug" > "$tmp/envfile"
 [[ $(ENV=$tmp/envfile "$SHELL" -i -c : 2> /dev/null) == ok ]] || err_exit 'eval inside dot script called from profile file not working'
 fi # !SHOPT_SCRIPTONLY
 
-# Backported ksh93v- 2013-03-18 test for 'read -A', where
-# IFS sets the delimiter to a newline while -d specifies
-# no delimiter (-d takes priority over IFS).
-if ((SHOPT_BRACEPAT)); then
-	got=$(printf %s\\n {a..f} | IFS=$'\n' read -rd '' -A a; typeset -p a)
-	exp=$'typeset -a a=($\'a\\nb\\nc\\nd\\ne\\nf\\n\')'
-	[[ $got == "$exp" ]] || err_exit "IFS overrides the delimiter specified by the read command's -d option" \
-		"(expected $(printf %q "$exp"), got $(printf %q "$got"))"
-fi
-
 # The read builtin's -a and -A flags should function identically
 read_a_test=$tmp/read_a_test.sh
 cat > "$read_a_test" << 'EOF'
@@ -1756,6 +1746,43 @@ exp='%'
 	"(expected $(printf %q "$exp"), got $(printf %q "$got"))"
 fi # SHOPT_MULTIBYTE
 
+# ======
+# read(1): IFS field splitting bugs when given a null delimiter (-d '')
+# https://github.com/ksh93/ksh/issues/926
+unset v1 v2 L
+IFS=$'\n' read -d '' v1 v2 <<< $'a\nb'
+got="<$v1> <$v2>"
+exp="<a> <b>"
+[[ $got == "$exp" ]] || err_exit "issue 926 r1 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+IFS='' read -d '' v1 v2 <<< $'a\nb'
+got="<$v1> <$v2>"
+exp=$'<a\nb\n> <>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r2 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf 'one\0two\0three\0' | while read -r -d "" L; do printf "<%s>\\n" "$L"; done; printf "end: <%s>\\n" "$L")
+exp=$'<one>\n<two>\n<three>\nend: <>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r3 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf 'one\0two\0three\0' | while IFS= read -r -d "" L; do printf "<%s>\\n" "$L"; done; printf "end: <%s>\\n" "$L")
+exp=$'<one>\n<two>\n<three>\nend: <>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r4 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf 'one\ntwo\nthree\n' | while read -r -d "" L; do printf "<%s>\\n" "$L"; done; printf "end: <%s>\\n" "$L")
+exp=$'end: <one\ntwo\nthree>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r5 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf 'one\ntwo\nthree\n' | while IFS= read -r -d "" L; do printf "<%s>\\n" "$L"; done; printf "end: <%s>\\n" "$L")
+exp=$'end: <one\ntwo\nthree\n>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r6 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf "one\ntwo\nthXree\nX" | while IFS=X read -r -d "" L; do printf "<%s>\n" "$L"; done; printf "end: <%s>\n" "$L")
+exp=$'end: <one\ntwo\nthXree\nX>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r7 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf "one\ntwo\nth ree\n " | while IFS=' ' read -r -d "" L; do printf "<%s>\n" "$L"; done; printf "end: <%s>\n" "$L")
+exp=$'end: <one\ntwo\nth ree\n>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r8 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(printf "one\ntwo\nthree\n" | while read -r -d "" L; do printf "<%s>\n" "$L"; done; printf "end: <%s>\n" "$L")
+exp=$'end: <one\ntwo\nthree>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r9 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+got=$(unset IFS; printf "one\ntwo\nthree\n" | while read -r -d "" L; do printf "<%s>\n" "$L"; done; printf "end: <%s>\n" "$L")
+exp=$'end: <one\ntwo\nthree>'
+[[ $got == "$exp" ]] || err_exit "issue 926 r10 (expected $(printf %q "$exp"), got $(printf %q "$got"))"
+
 # ====== MUST BE AT END ======
 # checks for tests run in parallel (see top)
 wait "$parallel_1"