Fix scoping of disciplines for certain special variables

Example reproducer:

	function pathlocal
	{
		typeset PATH=LocalValue
		print -r -- "in pathlocal: $PATH"
	}
	function PATH.get
	{
		.sh.value=MainShellValue
	}
	print -r -- "in main: $PATH"
	pathlocal

Expected output:

	in main: MainShellValue
	in pathlocal: LocalValue

Actual output (before this commit):

	in main: MainShellValue
	in pathlocal: MainShellValue

Analysis:

Normally, when a local variable is defined using 'typeset' in a ksh
function, it is initialised from scratch as a regular variable,
even if it is a special variable in the local scope. For example,
after 'typeset RANDOM' in a ksh function, the local RANDOM variable
will not produce pseudorandom numbers.

The same applies to user-defined shell discipline functions. They
apply to the variable in the global scope, not to local variables,
unless they are defined in the local scope for that local variable.

However, for reasons of security and correctness, certain variables
must keep their standard C discipline functions even when redefined
in a local scope. These currently include IFS, PATH, SHELL, FPATH,
CDPATH, SECONDS, ENV, and all the locale-related variables (LANG,
LC_*). So these keep their default special properties even as local
variables. This is not very consistent, but it's necessary, for
example, to properly enforce the 'restricted' shell option, or to
be able to have different IFS field splitting behaviour or set a
different locale temporarily in a local scope.

These variables are defined in nv_cover() in init.c. This function
returns a pointer to the variable's current discipline function
stack if it is one of these specific variables, otherwise NULL.

Two code points in name.c use this to simply copy the discipline
function stack pointer from the global scope to the local scope.

And therein lies the problem. If an additional custom discipline
(usually a shell discipline function) is defined for the variable,
that one will carry over to the local scope, too. And that is both
incorrect, because the local variable is a new variable even though
it has the same name, and inconsistent, because variables not
listed in nv_cover() don't work that way.

src/cmd/ksh93/sh/init.c:
- Rename nv_cover() to nv_enforcedisc() for clarity.
- nv_enforcedisc(): Don't return a pointer to the listed variables'
  existing discipline function stack (nvfun), but instead return a
  pointer to their standard C discipline, as assigned by nv_init().

src/cmd/ksh93/sh/{name,subshell}.c:
- In nv_setlist() and nv_create(), where the nvfun pointer was
  copied, instead call nv_stack() to initialise their discipline
  function stack using the pointer returned by nv_enforcedisc();
  this is what nv_init() does for their global scopes.
- No change is needed for the other nv_cover() calls (except for
  calling the new name), because they only check for a non-NULL
  result, and that hasn't changed.

src/cmd/ksh93/sh.1:
- Document the behaviour of special properties in local scopes.

Author: McDutchie

NEWS

@@ -2,6 +2,14 @@ This documents significant changes in the dev branch of ksh 93u+m.
 For full details, see the git log at: https://github.com/ksh93/ksh
 Uppercase BUG_* IDs are shell bug IDs as used by the Modernish shell library.
 
+2026-01-28:
+
+- Fixed incorrect behaviour that occurred when IFS, PATH, SHELL,
+  FPATH, CDPATH, SECONDS, ENV, LANG, LC_ALL, LC_CTYPE, LC_MESSAGES,
+  LC_COLLATE, LC_NUMERIC, or LC_TIME were declared as a local
+  variable within a function using 'typeset' while a custom shell
+  discipline function was defined for them in the global scope.
+
 2026-01-21:
 
 - Fixed several IFS field splitting bugs in read(1) that occurred

src/cmd/ksh93/include/name.h

@@ -144,7 +144,7 @@ struct Ufunction
 
 extern int		array_maxindex(Namval_t*);
 extern char 		*nv_endsubscript(Namval_t*, char*, int);
-extern Namfun_t 	*nv_cover(Namval_t*);
+extern Namfun_t 	*nv_enforcedisc(Namval_t*);
 extern int		nv_arrayisset(Namval_t*, Namarr_t*);
 extern int		nv_arraysettype(Namval_t*, Namval_t*,const char*,int);
 extern int		nv_aimax(Namval_t*);

src/cmd/ksh93/include/version.h

@@ -18,7 +18,7 @@
 #include <ast_release.h>
 #include "git.h"
 
-#define SH_RELEASE_DATE	"2026-01-21"	/* must be in this format for $((.sh.version)) */
+#define SH_RELEASE_DATE	"2026-01-28"	/* must be in this format for $((.sh.version)) */
 /*
  * This comment keeps SH_RELEASE_DATE a few lines away from SH_RELEASE_SVER to avoid
  * merge conflicts when cherry-picking dev branch commits onto a release branch.

src/cmd/ksh93/sh.1

@@ -2553,6 +2553,20 @@ and
 are also
 set by
 .IR login (1).
+.PP
+The shell variables listed in this section will normally lose any special
+properties if redeclared in a local scope. The exceptions to this rule are
+.BR CDPATH ,
+.BR ENV ,
+.BR FPATH ,
+.BR IFS ,
+.BR PATH ,
+.BR SECONDS ,
+.BR SHELL ,
+and all the locale-related variables
+.RB ( LANG ,
+.BR LC_* ),
+which have their special properties reset to default in that case.
 .SS Field Splitting.
 After parameter expansion and command substitution,
 the results of substitutions are scanned for the field separator

src/cmd/ksh93/sh/init.c

@@ -1550,14 +1550,27 @@ void sh_reinit(void)
 }
 
 /*
- * return discipline function tree pointer if a local variable of this name should share the parent's discipline function(s)
+ * Return default discipline function tree pointer for variables that must
+ * have their standard disciplines reset when redefined as local variables
  */
-Namfun_t *nv_cover(Namval_t *np)
-{
-	if(np==IFSNOD || np==PATHNOD || np==SHELLNOD || np==FPATHNOD || np==CDPNOD || np==SECONDS || np==ENVNOD)
-		return np->nvfun;
-	if(np==LCALLNOD || np==LCTYPENOD || np==LCMSGNOD || np==LCCOLLNOD || np==LCNUMNOD || np==LCTIMENOD || np==LANGNOD)
-		return np->nvfun;
+Namfun_t *nv_enforcedisc(Namval_t *np)
+{
+	Init_t *ip = sh.init_context;
+	if(np==IFSNOD) return &ip->IFS_init.hdr;
+	if(np==PATHNOD) return &ip->PATH_init;
+	if(np==SHELLNOD) return &ip->SHELL_init;
+	if(np==FPATHNOD) return &ip->FPATH_init;
+	if(np==CDPNOD) return &ip->CDPATH_init;
+	if(np==SECONDS) return &ip->SECONDS_init;
+	if(np==ENVNOD) return &ip->ENV_init;
+	/* locale */
+	if(np==LCALLNOD) return &ip->LC_ALL_init;
+	if(np==LCTYPENOD) return &ip->LC_TYPE_init;
+	if(np==LCMSGNOD) return &ip->LC_MSG_init;
+	if(np==LCCOLLNOD) return &ip->LC_COLL_init;
+	if(np==LCNUMNOD) return &ip->LC_NUM_init;
+	if(np==LCTIMENOD) return &ip->LC_TIME_init;
+	if(np==LANGNOD) return &ip->LANG_init;
 	return NULL;
 }
 

src/cmd/ksh93/sh/name.c

@@ -594,11 +594,13 @@ void nv_setlist(struct argnod *arg,int flags, Namval_t *typ)
 			*eqp = '\0';
 			if((np = nv_search(cp,dtvnext(vartree),0)) && np->nvflag)
 			{
+				Namfun_t *fp;
 				mp = nv_search(cp,vartree,NV_ADD|NV_NOSCOPE);
 				mp->nvname = np->nvname;  /* put_lang() (init.c) compares nvname pointers */
 				mp->nvflag = np->nvflag;
 				mp->nvsize = np->nvsize;
-				mp->nvfun = nv_cover(np);
+				if (fp = nv_enforcedisc(np))
+					nv_stack(mp, fp);
 			}
 			*eqp = '=';
 		}
@@ -881,18 +883,24 @@ Namval_t *nv_create(const char *name,  Dt_t *root, int flags, Namfun_t *dp)
 					}
 					else if(nq)
 					{
-						if(nv_isnull(np) && c!='.' && ((np->nvfun=nv_cover(nq)) || nq==OPTINDNOD))
+						if(nv_isnull(np) && c!='.')
 						{
-							np->nvname = nq->nvname;
+							Namfun_t *fp = nv_enforcedisc(nq);
+							if (fp)
+								nv_stack(np,fp);
+							if (fp || nq==OPTINDNOD)
+							{
+								np->nvname = nq->nvname;
 #if SHOPT_NAMESPACE
-							if(sh.namespace && nv_dict(sh.namespace)==sh.var_tree && nv_isattr(nq,NV_EXPORT))
-								nv_onattr(np,NV_EXPORT);
+								if(sh.namespace && nv_dict(sh.namespace)==sh.var_tree && nv_isattr(nq,NV_EXPORT))
+									nv_onattr(np,NV_EXPORT);
 #endif /* SHOPT_NAMESPACE */
-							if(nq==OPTINDNOD)
-							{
-								np->nvfun = nq->nvfun;
-								np->nvalue = &sh.st.optindex;
-								nv_onattr(np,NV_INTEGER|NV_NOFREE);
+								if(nq==OPTINDNOD)
+								{
+									np->nvfun = nq->nvfun;
+									np->nvalue = &sh.st.optindex;
+									nv_onattr(np,NV_INTEGER|NV_NOFREE);
+								}
 							}
 						}
 						flags |= NV_NOSCOPE;
@@ -2291,7 +2299,7 @@ static void table_unset(Dt_t *root, int flags, Dt_t *oroot)
 	{
 		if(nq=dtsearch(oroot,np))
 		{
-			if(nv_cover(nq))
+			if(nv_enforcedisc(nq))
 			{
 				unsigned int subshell = sh.subshell;
 				sh.subshell = 0;

src/cmd/ksh93/sh/subshell.c

@@ -359,7 +359,7 @@ static void nv_restore(struct subshell *sp)
 			flags |= NV_NOFREE;
 		}
 		mp->nvflag = np->nvflag|(flags&NV_MINIMAL);
-		if(nv_cover(mp))
+		if(nv_enforcedisc(mp))
 			nv_putval(mp,nv_getval(np),NV_RDONLY);
 		else
 			mp->nvalue = np->nvalue;

src/cmd/ksh93/tests/variables.sh

@@ -1769,5 +1769,32 @@ got=$(./issue861.sh 2>&1)
 	"(got status $e, $(printf %q "$got"))"
 unset i
 
+# ======'"
+
+# Problem: the global discipline function kept applying to the local variable
+# for certain special variables. This was a design problem with nv_cover() in
+# init.c which copied the nvfun pointer, i.e., the entire discipline function
+# tree. (Note: nv_cover() is now renamed to nv_enforcedisc().)
+# Here we can only test nv_enforcedisc() variables without value constraints.
+
+exp=$'in main: MainShellValue\nin pathlocal: LocalValue'
+for v in IFS PATH SHELL FPATH CDPATH ENV
+do	got=$(eval "
+		function pathlocal
+		{
+			typeset $v=LocalValue
+			print -r -- \"in pathlocal: \$$v\"
+		}
+		function $v.get
+		{
+			.sh.value=MainShellValue
+		}
+		print -r -- \"in main: \$$v\"
+		pathlocal
+	")
+	[[ $got == "$exp" ]] || err_exit "$v discipline not scoped properly" \
+		"(expected $(printf %q "$exp"), got $(printf %q "$got"))"
+done
+
 # ======
 exit $((Errors<125?Errors:125))