--- old/usr/src/cmd/awk/run.c	2013-05-11 15:20:45.824142601 +0000
+++ new/usr/src/cmd/awk/run.c	2013-05-11 15:20:45.848298484 +0000
@@ -23,155 +23,212 @@
  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
-/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
-/*	  All Rights Reserved  	*/
-
-#define	tempfree(x, s)	if (istemp(x)) tfree(x, s)
+/*
+ * Copyright (C) Lucent Technologies 1997
+ * All Rights Reserved
+ *
+ * Permission to use, copy, modify, and distribute this software and
+ * its documentation for any purpose and without fee is hereby
+ * granted, provided that the above copyright notice appear in all
+ * copies and that both that the copyright notice and this
+ * permission notice and warranty disclaimer appear in supporting
+ * documentation, and that the name Lucent Technologies or any of
+ * its entities not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.
+ *
+ * LUCENT DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.
+ * IN NO EVENT SHALL LUCENT OR ANY OF ITS ENTITIES BE LIABLE FOR ANY
+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER
+ * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+ * THIS SOFTWARE.
+ */
 
-#define	execute(p) r_execute(p)
+#define	tempfree(x)	if (istemp(x)) tfree(x);
 
 #define	DEBUG
-#include	"awk.h"
-#include	<math.h>
-#include	"y.tab.h"
-#include	<stdio.h>
-#include	<ctype.h>
-#include	<setjmp.h>
-#include	<time.h>
-
-#ifndef	FOPEN_MAX
-#define	FOPEN_MAX	15	/* max number of open files, from ANSI std. */
-#endif
-
+#include <setjmp.h>
+#include <math.h>
+#include <time.h>
+#include "awk.h"
+#include "y.tab.h"
+
+static	Cell	*execute(Node *);
+static	Cell	*gettemp(void);
+static	Cell	*copycell(Cell *);
+static	FILE	*openfile(int, const uchar *);
+static	FILE	*redirect(int, Node *);
+static	const char *filename(FILE *);
+static	void	flush_all(void);
 
 static jmp_buf env;
+extern	Awkfloat	srand_seed;
 
-static	Cell	*r_execute(Node *);
-static	Cell	*gettemp(char *), *copycell(Cell *);
-static	FILE	*openfile(int, uchar *), *redirect(int, Node *);
-
-int	paircnt;
-Node	*winner = NULL;
-
-static Cell	*tmps;
+Node	*winner = NULL;	/* root of parse tree */
 
+static Cell	*tmps;	/* free temporary cells for execution */
 static Cell	truecell	= { OBOOL, BTRUE, 0, 0, 1.0, NUM };
-Cell	*true	= &truecell;
+Cell	*True	= &truecell;
 static Cell	falsecell	= { OBOOL, BFALSE, 0, 0, 0.0, NUM };
-Cell	*false	= &falsecell;
+Cell	*False	= &falsecell;
 static Cell	breakcell	= { OJUMP, JBREAK, 0, 0, 0.0, NUM };
 Cell	*jbreak	= &breakcell;
 static Cell	contcell	= { OJUMP, JCONT, 0, 0, 0.0, NUM };
 Cell	*jcont	= &contcell;
 static Cell	nextcell	= { OJUMP, JNEXT, 0, 0, 0.0, NUM };
 Cell	*jnext	= &nextcell;
+static Cell	nextfilecell	= { OJUMP, JNEXTFILE, 0, 0, 0.0, NUM };
+Cell	*jnextfile	= &nextfilecell;
 static Cell	exitcell	= { OJUMP, JEXIT, 0, 0, 0.0, NUM };
 Cell	*jexit	= &exitcell;
 static Cell	retcell		= { OJUMP, JRET, 0, 0, 0.0, NUM };
 Cell	*jret	= &retcell;
-static Cell	tempcell	= { OCELL, CTEMP, 0, 0, 0.0, NUM };
+static Cell	tempcell	= { OCELL, CTEMP, 0, (uchar *)"", 0.0, NUM|
+    STR|DONTFREE};
 
 Node	*curnode = NULL;	/* the node being executed, for debugging */
 
-static	void	tfree(Cell *, char *);
+static	void	tfree(Cell *);
 static	void	closeall(void);
 static	double	ipow(double, int);
+static	void	stdinit(void);
+
+/*
+ * buffer memory management
+ *
+ * pbuf:    address of pointer to buffer being managed
+ * psiz:    address of buffer size variable
+ * minlen:  minimum length of buffer needed
+ * quantum: buffer size quantum
+ * pbptr:   address of movable pointer into buffer, or 0 if none
+ * whatrtn: name of the calling routine if failure should cause fatal error
+ *
+ * return   0 for realloc failure, !=0 for success
+ */
+int adjbuf(uchar **pbuf, size_t *psiz, int minlen, int quantum, uchar **pbptr,
+    const char *whatrtn)
+{
+	if (minlen > *psiz) {
+		uchar *tbuf;
+		int rminlen = quantum ? minlen % quantum : 0;
+		int boff = pbptr ? *pbptr - *pbuf : 0;
+		/* round up to next multiple of quantum */
+		if (rminlen)
+			minlen += quantum - rminlen;
+		tbuf = (uchar *)realloc(*pbuf, minlen);
+		dprintf(("adjbuf %s: %d %d (pbuf=%p, tbuf=%p)\n", whatrtn,
+		    *psiz, minlen, (void *)*pbuf, (void *)tbuf));
+		if (tbuf == NULL) {
+			if (whatrtn)
+				FATAL("out of memory in %s", whatrtn);
+			return (0);
+		}
+		*pbuf = (uchar *)tbuf;
+		*psiz = minlen;
+		if (pbptr)
+			*pbptr = tbuf + boff;
+	}
+	return (1);
+}
 
 void
-run(Node *a)
+run(Node *a)		/* execution of parse tree starts here */
 {
+	stdinit();
 	(void) execute(a);
 	closeall();
 }
 
 static Cell *
-r_execute(Node *u)
+execute(Node *u)	/* execute a node of the parse tree */
 {
-	register Cell *(*proc)();
-	register Cell *x;
-	register Node *a;
+	Cell *(*proc)(Node **, int);
+	Cell *x;
+	Node *a;
 
 	if (u == NULL)
-		return (true);
+		return (True);
 	for (a = u; ; a = a->nnext) {
 		curnode = a;
 		if (isvalue(a)) {
-			x = (Cell *) (a->narg[0]);
-			if ((x->tval & FLD) && !donefld)
+			x = (Cell *)(a->narg[0]);
+			if (isfld(x) && !donefld)
 				fldbld();
-			else if ((x->tval & REC) && !donerec)
+			else if (isrec(x) && !donerec)
 				recbld();
 			return (x);
 		}
 		/* probably a Cell* but too risky to print */
 		if (notlegal(a->nobj))
-			ERROR "illegal statement" FATAL;
+			FATAL("illegal statement");
 		proc = proctab[a->nobj-FIRSTTOKEN];
 		x = (*proc)(a->narg, a->nobj);
-		if ((x->tval & FLD) && !donefld)
+		if (isfld(x) && !donefld)
 			fldbld();
-		else if ((x->tval & REC) && !donerec)
+		else if (isrec(x) && !donerec)
 			recbld();
 		if (isexpr(a))
 			return (x);
-		/* a statement, goto next statement */
 		if (isjump(x))
 			return (x);
 		if (a->nnext == (Node *)NULL)
 			return (x);
-		tempfree(x, "execute");
+		tempfree(x);
 	}
 }
 
 /*ARGSUSED*/
 Cell *
-program(Node **a, int n)
-{
-	register Cell *x;
+program(Node **a, int n)	/* execute an awk program */
+{				/* a[0] = BEGIN, a[1] = body, a[2] = END */
+	Cell *x;
 
 	if (setjmp(env) != 0)
 		goto ex;
 	if (a[0]) {		/* BEGIN */
 		x = execute(a[0]);
 		if (isexit(x))
-			return (true);
+			return (True);
 		if (isjump(x)) {
-			ERROR "illegal break, continue or next from BEGIN"
-			    FATAL;
+			FATAL(
+		"illegal break, continue, next or nextfile from BEGIN");
 		}
-		tempfree(x, "");
+		tempfree(x);
 	}
-loop:
-	if (a[1] || a[2])
-		while (getrec(&record, &record_size) > 0) {
+
+	if (a[1] || a[2]) {
+		while (getrec(&record, &record_size, 1) > 0) {
 			x = execute(a[1]);
 			if (isexit(x))
 				break;
-			tempfree(x, "");
+			tempfree(x);
 		}
+	}
 ex:
-	if (setjmp(env) != 0)
+	if (setjmp(env) != 0)	/* handles exit within END */
 		goto ex1;
 	if (a[2]) {		/* END */
 		x = execute(a[2]);
-		if (iscont(x))	/* read some more */
-			goto loop;
-		if (isbreak(x) || isnext(x))
-			ERROR "illegal break or next from END" FATAL;
-		tempfree(x, "");
+		if (isbreak(x) || isnext(x) || iscont(x))
+			FATAL(
+		"illegal break, continue, next or nextfile from END");
+		tempfree(x);
 	}
 ex1:
-	return (true);
+	return (True);
 }
 
-struct Frame {
+struct Frame {	/* stack frame for awk function calls */
 	int nargs;	/* number of arguments in this call */
 	Cell *fcncell;	/* pointer to Cell for function */
 	Cell **args;	/* pointer to array of arguments after execute */
 	Cell *retval;	/* return value */
 };
 
-#define	NARGS	30
+#define	NARGS	50	/* max args in a call */
 
 struct Frame *frame = NULL; /* base of stack frames; dynamically allocated */
 int	nframe = 0;		/* number of frames allocated */
@@ -179,60 +236,63 @@
 
 /*ARGSUSED*/
 Cell *
-call(Node **a, int n)
+call(Node **a, int n)	/* function call.  very kludgy and fragile */
 {
 	static Cell newcopycell =
-		{ OCELL, CCOPY, 0, (uchar *) "", 0.0, NUM|STR|DONTFREE };
-	int i, ncall, ndef, freed = 0;
+	    { OCELL, CCOPY, 0, (uchar *) "", 0.0, NUM|STR|DONTFREE };
+	int i, ncall, ndef;
+	/* handles potential double freeing when fcn & param share a tempcell */
+	int freed = 0;
 	Node *x;
-	Cell *args[NARGS], *oargs[NARGS], *y, *z, *fcn;
+	Cell *args[NARGS], *oargs[NARGS];	/* BUG: fixed size arrays */
+	Cell *y, *z, *fcn;
 	uchar *s;
 
 	fcn = execute(a[0]);	/* the function itself */
 	s = fcn->nval;
-	if (!isfunc(fcn))
-		ERROR "calling undefined function %s", s FATAL;
+	if (!isfcn(fcn))
+		FATAL("calling undefined function %s", s);
 	if (frame == NULL) {
 		fp = frame = (struct Frame *)calloc(nframe += 100,
 		    sizeof (struct Frame));
 		if (frame == NULL) {
-			ERROR "out of space for stack frames calling %s",
-			    s FATAL;
+			FATAL("out of space for stack frames calling %s", s);
 		}
 	}
 	for (ncall = 0, x = a[1]; x != NULL; x = x->nnext) /* args in call */
 		ncall++;
 	ndef = (int)fcn->fval;			/* args in defn */
 	dprintf(("calling %s, %d args (%d in defn), fp=%d\n",
-	    s, ncall, ndef, fp-frame));
+	    s, ncall, ndef, (int)(fp-frame)));
+
 	if (ncall > ndef) {
-		ERROR "function %s called with %d args, uses only %d",
-		    s, ncall, ndef WARNING;
+		WARNING("function %s called with %d args, uses only %d",
+		    s, ncall, ndef);
 	}
 	if (ncall + ndef > NARGS) {
-		ERROR "function %s has %d arguments, limit %d",
-		    s, ncall+ndef, NARGS FATAL;
+		FATAL("function %s has %d arguments, limit %d",
+		    s, ncall + ndef, NARGS);
 	}
 	for (i = 0, x = a[1]; x != NULL; i++, x = x->nnext) {
 		/* get call args */
-		dprintf(("evaluate args[%d], fp=%d:\n", i, fp-frame));
+		dprintf(("evaluate args[%d], fp=%d:\n", i, (int)(fp-frame)));
 		y = execute(x);
 		oargs[i] = y;
 		dprintf(("args[%d]: %s %f <%s>, t=%o\n",
 		    i, y->nval, y->fval,
 		    isarr(y) ? "(array)" : (char *)y->sval, y->tval));
-		if (isfunc(y)) {
-			ERROR "can't use function %s as argument in %s",
-			    y->nval, s FATAL;
+		if (isfcn(y)) {
+			FATAL("can't use function %s as argument in %s",
+			    y->nval, s);
 		}
 		if (isarr(y))
 			args[i] = y;	/* arrays by ref */
 		else
 			args[i] = copycell(y);
-		tempfree(y, "callargs");
+		tempfree(y);
 	}
 	for (; i < ndef; i++) { /* add null args for ones not provided */
-		args[i] = gettemp("nullargs");
+		args[i] = gettemp();
 		*args[i] = newcopycell;
 	}
 	fp++;	/* now ok to up frame */
@@ -241,18 +301,18 @@
 		frame = (struct Frame *)
 		    realloc(frame, (nframe += 100) * sizeof (struct Frame));
 		if (frame == NULL)
-			ERROR "out of space for stack frames in %s", s FATAL;
+			FATAL("out of space for stack frames in %s", s);
 		fp = frame + dfp;
 	}
 	fp->fcncell = fcn;
 	fp->args = args;
 	fp->nargs = ndef;	/* number defined with (excess are locals) */
-	fp->retval = gettemp("retval");
+	fp->retval = gettemp();
 
-	dprintf(("start exec of %s, fp=%d\n", s, fp-frame));
+	dprintf(("start exec of %s, fp=%d\n", s, (int)(fp-frame)));
 	/*LINTED align*/
 	y = execute((Node *)(fcn->sval));	/* execute body */
-	dprintf(("finished exec of %s, fp=%d\n", s, fp-frame));
+	dprintf(("finished exec of %s, fp=%d\n", s, (int)(fp-frame)));
 
 	for (i = 0; i < ndef; i++) {
 		Cell *t = fp->args[i];
@@ -261,24 +321,29 @@
 				if (i >= ncall) {
 					freesymtab(t);
 					t->csub = CTEMP;
+					tempfree(t);
 				} else {
 					oargs[i]->tval = t->tval;
 					oargs[i]->tval &= ~(STR|NUM|DONTFREE);
 					oargs[i]->sval = t->sval;
-					tempfree(t, "oargsarr");
+					tempfree(t);
 				}
 			}
-		} else {
+		} else if (t != y) {	/* kludge to prevent freeing twice */
 			t->csub = CTEMP;
-			tempfree(t, "fp->args");
-			if (t == y) freed = 1;
+			tempfree(t);
+		} else if (t == y && t->csub == CCOPY) {
+			t->csub = CTEMP;
+			tempfree(t);
+			freed = 1;
 		}
 	}
-	tempfree(fcn, "call.fcn");
+	tempfree(fcn);
 	if (isexit(y) || isnext(y))
 		return (y);
-	if (!freed)
-		tempfree(y, "fcn ret"); /* this can free twice! */
+	if (freed == 0) {
+		tempfree(y);	/* don't free twice! */
+	}
 	z = fp->retval;			/* return value */
 	dprintf(("%s returns %g |%s| %o\n",
 	    s, getfval(z), getsval(z), z->tval));
@@ -291,42 +356,41 @@
 {
 	Cell *y;
 
-	y = gettemp("copycell");
+	y = gettemp();
 	y->csub = CCOPY;	/* prevents freeing until call is over */
-	y->nval = x->nval;
-	y->sval = x->sval ? tostring(x->sval) : NULL;
+	y->nval = x->nval;	/* BUG? */
+	if (isstr(x))
+		y->sval = tostring(x->sval);
 	y->fval = x->fval;
 	/* copy is not constant or field is DONTFREE right? */
 	y->tval = x->tval & ~(CON|FLD|REC|DONTFREE);
 	return (y);
 }
 
-/*ARGSUSED*/
 Cell *
-arg(Node **a, int nnn)
+arg(Node **a, int n)		/* nth argument of a function */
 {
-	int n;
 
-	n = (int)a[0];	/* argument number, counting from 0 */
+	n = ptoi(a[0]);	/* argument number, counting from 0 */
 	dprintf(("arg(%d), fp->nargs=%d\n", n, fp->nargs));
-	if (n+1 > fp->nargs) {
-		ERROR "argument #%d of function %s was not supplied",
-		    n+1, fp->fcncell->nval FATAL;
+	if (n + 1 > fp->nargs) {
+		FATAL("argument #%d of function %s was not supplied",
+		    n + 1, fp->fcncell->nval);
 	}
 	return (fp->args[n]);
 }
 
 Cell *
-jump(Node **a, int n)
+jump(Node **a, int n)	/* break, continue, next, nextfile, return */
 {
-	register Cell *y;
+	Cell *y;
 
 	switch (n) {
 	case EXIT:
 		if (a[0] != NULL) {
 			y = execute(a[0]);
 			errorflag = (int)getfval(y);
-			tempfree(y, "");
+			tempfree(y);
 		}
 		longjmp(env, 1);
 		/*NOTREACHED*/
@@ -341,77 +405,87 @@
 				(void) setsval(fp->retval, getsval(y));
 			else if (y->tval & NUM)
 				(void) setfval(fp->retval, getfval(y));
-			tempfree(y, "");
+			else		/* can't happen */
+				FATAL("bad type variable %d", y->tval);
+			tempfree(y);
 		}
 		return (jret);
 	case NEXT:
 		return (jnext);
+	case NEXTFILE:
+		nextfile();
+		return (jnextfile);
 	case BREAK:
 		return (jbreak);
 	case CONTINUE:
 		return (jcont);
 	default:	/* can't happen */
-		ERROR "illegal jump type %d", n FATAL;
+		FATAL("illegal jump type %d", n);
 	}
 	/*NOTREACHED*/
 	return (NULL);
 }
 
+/*
+ * get next line from specific input
+ *
+ * a[0] is variable, a[1] is operator, a[2] is filename
+ */
 Cell *
-getaline(Node **a, int n)
+awkgetline(Node **a, int n)
 {
-	/* a[0] is variable, a[1] is operator, a[2] is filename */
-	register Cell *r, *x;
-	uchar *buf;
+	Cell *r, *x;
+	extern Cell **fldtab;
 	FILE *fp;
-	size_t len;
+	uchar *buf;
+	size_t bufsize = record_size;
+	int mode;
+
+	if ((buf = (uchar *)malloc(bufsize)) == NULL)
+		FATAL("out of memory in getline");
 
 	(void) fflush(stdout);	/* in case someone is waiting for a prompt */
-	r = gettemp("");
+	r = gettemp();
 	if (a[1] != NULL) {		/* getline < file */
 		x = execute(a[2]);		/* filename */
-		if ((int)a[1] == '|')	/* input pipe */
-			a[1] = (Node *)LE;	/* arbitrary flag */
-		fp = openfile((int)a[1], getsval(x));
-		tempfree(x, "");
-		buf = NULL;
+		mode = ptoi(a[1]);
+		if (mode == '|')	/* input pipe */
+			mode = LE;	/* arbitrary flag */
+		fp = openfile(mode, getsval(x));
+		tempfree(x);
 		if (fp == NULL)
 			n = -1;
 		else
-			n = readrec(&buf, &len, fp);
-		if (n > 0) {
-			if (a[0] != NULL) {	/* getline var <file */
-				(void) setsval(execute(a[0]), buf);
-			} else {			/* getline <file */
-				if (!(recloc->tval & DONTFREE))
-					xfree(recloc->sval);
-				expand_buf(&record, &record_size, len);
-				(void) memcpy(record, buf, len);
-				record[len] = '\0';
-				recloc->sval = record;
-				recloc->tval = REC | STR | DONTFREE;
-				donerec = 1; donefld = 0;
+			n = readrec(&buf, &bufsize, fp);
+		if (a[0] != NULL) {	/* getline var <file */
+			x = execute(a[0]);
+			(void) setsval(x, buf);
+			tempfree(x);
+		} else {			/* getline <file */
+			(void) setsval(fldtab[0], buf);
+			if (is_number(fldtab[0]->sval)) {
+				fldtab[0]->fval = atof((char *)fldtab[0]->sval);
+				fldtab[0]->tval |= NUM;
 			}
 		}
-		if (buf != NULL)
-			free(buf);
 	} else {			/* bare getline; use current input */
 		if (a[0] == NULL)	/* getline */
-			n = getrec(&record, &record_size);
+			n = getrec(&record, &record_size, 1);
 		else {			/* getline var */
-			init_buf(&buf, &len, LINE_INCR);
-			n = getrec(&buf, &len);
-			(void) setsval(execute(a[0]), buf);
-			free(buf);
+			n = getrec(&buf, &bufsize, 0);
+			x = execute(a[0]);
+			(void) setsval(x, buf);
+			tempfree(x);
 		}
 	}
 	(void) setfval(r, (Awkfloat)n);
+	free(buf);
 	return (r);
 }
 
 /*ARGSUSED*/
 Cell *
-getnf(Node **a, int n)
+getnf(Node **a, int n)		/* get NF */
 {
 	if (donefld == 0)
 		fldbld();
@@ -420,32 +494,30 @@
 
 /*ARGSUSED*/
 Cell *
-array(Node **a, int n)
+array(Node **a, int n)	/* a[0] is symtab, a[1] is list of subscripts */
 {
-	register Cell *x, *y, *z;
-	register uchar *s;
-	register Node *np;
-	uchar	*buf;
-	size_t	bsize, tlen, len, slen;
+	Cell *x, *y, *z;
+	uchar *s;
+	Node *np;
+	uchar *buf;
+	size_t bufsz = record_size;
+	size_t nsub = strlen((char *)*SUBSEP);
+
+	if ((buf = (uchar *)malloc(bufsz)) == NULL)
+		FATAL("out of memory in array");
 
 	x = execute(a[0]);	/* Cell* for symbol table */
-	init_buf(&buf, &bsize, LINE_INCR);
 	buf[0] = '\0';
-	tlen = 0;
-	slen = strlen((char *)*SUBSEP);
 	for (np = a[1]; np; np = np->nnext) {
 		y = execute(np);	/* subscript */
 		s = getsval(y);
-		len = strlen((char *)s);
-		expand_buf(&buf, &bsize, tlen + len + slen);
-		(void) memcpy(&buf[tlen], s, len);
-		tlen += len;
-		if (np->nnext) {
-			(void) memcpy(&buf[tlen], *SUBSEP, slen);
-			tlen += slen;
-		}
-		buf[tlen] = '\0';
-		tempfree(y, "");
+		if (!adjbuf(&buf, &bufsz, strlen((char *)buf) +
+		    strlen((char *)s) + nsub + 1, record_size, 0, "array"))
+			FATAL("out of memory for %s[%s...]", x->nval, buf);
+		(void) strcat((char *)buf, (char *)s);
+		if (np->nnext)
+			(void) strcat((char *)buf, (char *)*SUBSEP);
+		tempfree(y);
 	}
 	if (!isarr(x)) {
 		dprintf(("making %s into an array\n", x->nval));
@@ -453,265 +525,278 @@
 			xfree(x->sval);
 		x->tval &= ~(STR|NUM|DONTFREE);
 		x->tval |= ARR;
-		x->sval = (uchar *) makesymtab(NSYMTAB);
+		x->sval = (uchar *)makesymtab(NSYMTAB);
 	}
 	/*LINTED align*/
 	z = setsymtab(buf, (uchar *)"", 0.0, STR|NUM, (Array *)x->sval);
 	z->ctype = OCELL;
 	z->csub = CVAR;
-	tempfree(x, "");
+	tempfree(x);
 	free(buf);
 	return (z);
 }
 
 /*ARGSUSED*/
 Cell *
-delete(Node **a, int n)
+awkdelete(Node **a, int n) /* a[0] is symtab, a[1] is list of subscripts */
 {
 	Cell *x, *y;
 	Node *np;
-	uchar *buf, *s;
-	size_t bsize, tlen, slen, len;
+	uchar *s;
+	size_t nsub = strlen((char *)*SUBSEP);
 
 	x = execute(a[0]);	/* Cell* for symbol table */
 	if (!isarr(x))
-		return (true);
-	init_buf(&buf, &bsize, LINE_INCR);
-	buf[0] = '\0';
-	tlen = 0;
-	slen = strlen((char *)*SUBSEP);
-	for (np = a[1]; np; np = np->nnext) {
-		y = execute(np);	/* subscript */
-		s = getsval(y);
-		len = strlen((char *)s);
-		expand_buf(&buf, &bsize, tlen + len + slen);
-		(void) memcpy(&buf[tlen], s, len);
-		tlen += len;
-		if (np->nnext) {
-			(void) memcpy(&buf[tlen], *SUBSEP, slen);
-			tlen += slen;
+		return (True);
+	if (a[1] == 0) {	/* delete the elements, not the table */
+		freesymtab(x);
+		x->tval &= ~STR;
+		x->tval |= ARR;
+		x->sval = (uchar *)makesymtab(NSYMTAB);
+	} else {
+		size_t bufsz = record_size;
+		uchar *buf;
+		if ((buf = (uchar *)malloc(bufsz)) == NULL)
+			FATAL("out of memory in delete");
+		buf[0] = '\0';
+		for (np = a[1]; np; np = np->nnext) {
+			y = execute(np);	/* subscript */
+			s = getsval(y);
+			if (!adjbuf(&buf, &bufsz, strlen((char *)buf) +
+			    strlen((char *)s) + nsub + 1, record_size, 0,
+			    "awkdelete")) {
+				FATAL("out of memory deleting %s[%s...]",
+				    x->nval, buf);
+			}
+			(void) strcat((char *)buf, (char *)s);
+			if (np->nnext)
+				(void) strcat((char *)buf, (char *)*SUBSEP);
+			tempfree(y);
 		}
-		buf[tlen] = '\0';
-		tempfree(y, "");
+		freeelem(x, buf);
+		free(buf);
 	}
-	freeelem(x, buf);
-	tempfree(x, "");
-	free(buf);
-	return (true);
+	tempfree(x);
+	return (True);
 }
 
 /*ARGSUSED*/
 Cell *
-intest(Node **a, int n)
+intest(Node **a, int n)	/* a[0] is index (list), a[1] is symtab */
 {
-	register Cell *x, *ap, *k;
+	Cell *x, *ap, *k;
 	Node *p;
 	uchar *buf;
 	uchar *s;
-	size_t bsize, tlen, slen, len;
+	size_t bufsz = record_size;
+	size_t nsub = strlen((char *)*SUBSEP);
 
 	ap = execute(a[1]);	/* array name */
-	if (!isarr(ap))
-		ERROR "%s is not an array", ap->nval FATAL;
-	init_buf(&buf, &bsize, LINE_INCR);
+	if (!isarr(ap))	{
+		dprintf(("making %s into an array\n", ap->nval));
+		if (freeable(ap))
+			xfree(ap->sval);
+		ap->tval &= ~(STR|NUM|DONTFREE);
+		ap->tval |= ARR;
+		ap->sval = (uchar *)makesymtab(NSYMTAB);
+	}
+	if ((buf = (uchar *)malloc(bufsz)) == NULL) {
+		FATAL("out of memory in intest");
+	}
 	buf[0] = 0;
-	tlen = 0;
-	slen = strlen((char *)*SUBSEP);
 	for (p = a[0]; p; p = p->nnext) {
 		x = execute(p);	/* expr */
 		s = getsval(x);
-		len = strlen((char *)s);
-		expand_buf(&buf, &bsize, tlen + len + slen);
-		(void) memcpy(&buf[tlen], s, len);
-		tlen += len;
-		tempfree(x, "");
-		if (p->nnext) {
-			(void) memcpy(&buf[tlen], *SUBSEP, slen);
-			tlen += slen;
-		}
-		buf[tlen] = '\0';
+		if (!adjbuf(&buf, &bufsz, strlen((char *)buf) +
+		    strlen((char *)s) + nsub + 1, record_size, 0, "intest"))
+			FATAL("out of memory deleting %s[%s...]", x->nval, buf);
+		(void) strcat((char *)buf, (char *)s);
+		tempfree(x);
+		if (p->nnext)
+			(void) strcat((char *)buf, (char *)*SUBSEP);
 	}
 	/*LINTED align*/
 	k = lookup(buf, (Array *)ap->sval);
-	tempfree(ap, "");
+	tempfree(ap);
 	free(buf);
 	if (k == NULL)
-		return (false);
+		return (False);
 	else
-		return (true);
+		return (True);
 }
 
-
 Cell *
-matchop(Node **a, int n)
+matchop(Node **a, int n)	/* ~ and match() */
 {
-	register Cell *x, *y;
-	register uchar *s, *t;
-	register int i;
+	Cell *x, *y;
+	uchar *s, *t;
+	int i;
 	fa *pfa;
-	int (*mf)() = match, mode = 0;
+	int (*mf)(fa *, const uchar *) = match, mode = 0;
 
 	if (n == MATCHFCN) {
 		mf = pmatch;
 		mode = 1;
 	}
-	x = execute(a[1]);
+	x = execute(a[1]);	/* a[1] = target text */
 	s = getsval(x);
-	if (a[0] == 0)
-		i = (*mf)(a[2], s);
+	if (a[0] == 0)		/* a[1] == 0: already-compiled reg expr */
+		i = (*mf)((fa *)a[2], s);
 	else {
-		y = execute(a[2]);
+		y = execute(a[2]);	/* a[2] = regular expr */
 		t = getsval(y);
 		pfa = makedfa(t, mode);
 		i = (*mf)(pfa, s);
-		tempfree(y, "");
+		tempfree(y);
 	}
-	tempfree(x, "");
+	tempfree(x);
 	if (n == MATCHFCN) {
 		int start = patbeg - s + 1;
 		if (patlen < 0)
 			start = 0;
 		(void) setfval(rstartloc, (Awkfloat)start);
 		(void) setfval(rlengthloc, (Awkfloat)patlen);
-		x = gettemp("");
+		x = gettemp();
 		x->tval = NUM;
 		x->fval = start;
 		return (x);
-	} else if (n == MATCH && i == 1 || n == NOTMATCH && i == 0)
-		return (true);
+	} else if ((n == MATCH && i == 1) || (n == NOTMATCH && i == 0))
+		return (True);
 	else
-		return (false);
+		return (False);
 }
 
-
 Cell *
-boolop(Node **a, int n)
+boolop(Node **a, int n)		/* a[0] || a[1], a[0] && a[1], !a[0] */
 {
-	register Cell *x, *y;
-	register int i;
+	Cell *x, *y;
+	int i;
 
 	x = execute(a[0]);
 	i = istrue(x);
-	tempfree(x, "");
+	tempfree(x);
 	switch (n) {
 	case BOR:
 		if (i)
-			return (true);
+			return (True);
 		y = execute(a[1]);
 		i = istrue(y);
-		tempfree(y, "");
-		return (i ? true : false);
+		tempfree(y);
+		return (i ? True : False);
 	case AND:
 		if (!i)
-			return (false);
+			return (False);
 		y = execute(a[1]);
 		i = istrue(y);
-		tempfree(y, "");
-		return (i ? true : false);
+		tempfree(y);
+		return (i ? True : False);
 	case NOT:
-		return (i ? false : true);
+		return (i ? False : True);
 	default:	/* can't happen */
-		ERROR "unknown boolean operator %d", n FATAL;
+		FATAL("unknown boolean operator %d", n);
 	}
 	/*NOTREACHED*/
 	return (NULL);
 }
 
 Cell *
-relop(Node **a, int n)
+relop(Node **a, int n)		/* a[0 < a[1], etc. */
 {
-	register int i;
-	register Cell *x, *y;
+	int i;
+	Cell *x, *y;
 	Awkfloat j;
 
 	x = execute(a[0]);
 	y = execute(a[1]);
-	if (x->tval&NUM && y->tval&NUM) {
+	if (x->tval & NUM && y->tval & NUM) {
 		j = x->fval - y->fval;
 		i = j < 0 ? -1: (j > 0 ? 1: 0);
 	} else {
 		i = strcmp((char *)getsval(x), (char *)getsval(y));
 	}
-	tempfree(x, "");
-	tempfree(y, "");
+	tempfree(x);
+	tempfree(y);
 	switch (n) {
-	case LT:	return (i < 0 ? true : false);
-	case LE:	return (i <= 0 ? true : false);
-	case NE:	return (i != 0 ? true : false);
-	case EQ:	return (i == 0 ? true : false);
-	case GE:	return (i >= 0 ? true : false);
-	case GT:	return (i > 0 ? true : false);
+	case LT:	return (i < 0 ? True : False);
+	case LE:	return (i <= 0 ? True : False);
+	case NE:	return (i != 0 ? True : False);
+	case EQ:	return (i == 0 ? True : False);
+	case GE:	return (i >= 0 ? True : False);
+	case GT:	return (i > 0 ? True : False);
 	default:	/* can't happen */
-		ERROR "unknown relational operator %d", n FATAL;
+		FATAL("unknown relational operator %d", n);
 	}
 	/*NOTREACHED*/
-	return (false);
+	return (False);
 }
 
 static void
-tfree(Cell *a, char *s)
+tfree(Cell *a)		/* free a tempcell */
 {
-	if (dbg > 1) {
-		(void) printf("## tfree %.8s %06lo %s\n",
-		    s, (ulong_t)a, a->sval ? a->sval : (uchar *)"");
-	}
-	if (freeable(a))
+	if (freeable(a)) {
+		dprintf(("freeing %s %s %o\n", (char *)a->nval,
+		    (char *)a->sval, a->tval));
 		xfree(a->sval);
+	}
 	if (a == tmps)
-		ERROR "tempcell list is curdled" FATAL;
+		FATAL("tempcell list is curdled");
 	a->cnext = tmps;
 	tmps = a;
 }
 
 static Cell *
-gettemp(char *s)
+gettemp(void)		/* get a tempcell */
 {
 	int i;
-	register Cell *x;
+	Cell *x;
 
 	if (!tmps) {
 		tmps = (Cell *)calloc(100, sizeof (Cell));
 		if (!tmps)
-			ERROR "no space for temporaries" FATAL;
+			FATAL("out of space for temporaries");
 		for (i = 1; i < 100; i++)
-			tmps[i-1].cnext = &tmps[i];
-		tmps[i-1].cnext = 0;
+			tmps[i - 1].cnext = &tmps[i];
+		tmps[i - 1].cnext = 0;
 	}
 	x = tmps;
 	tmps = x->cnext;
 	*x = tempcell;
-	if (dbg > 1)
-		(void) printf("## gtemp %.8s %06lo\n", s, (ulong_t)x);
 	return (x);
 }
 
 /*ARGSUSED*/
 Cell *
-indirect(Node **a, int n)
+indirect(Node **a, int n)	/* $( a[0] ) */
 {
-	register Cell *x;
-	register int m;
-	register uchar *s;
+	Awkfloat val;
+	Cell *x;
+	int m;
+	uchar *s;
 
 	x = execute(a[0]);
-	m = (int)getfval(x);
+	/* freebsd: defend against super large field numbers */
+	val = getfval(x);
+	if ((Awkfloat)INT_MAX < val)
+		FATAL("trying to access out of range field %s", x->nval);
+	m = (int)val;
 	if (m == 0 && !is_number(s = getsval(x)))	/* suspicion! */
-		ERROR "illegal field $(%s)", s FATAL;
-	tempfree(x, "");
+		FATAL("illegal field $(%s), name \"%s\"", s, x->nval);
+		/* BUG: can x->nval ever be null??? */
+	tempfree(x);
 	x = fieldadr(m);
-	x->ctype = OCELL;
+	x->ctype = OCELL;	/* BUG?  why are these needed? */
 	x->csub = CFLD;
 	return (x);
 }
 
 /*ARGSUSED*/
 Cell *
-substr(Node **a, int nnn)
+substr(Node **a, int nnn)	/* substr(a[0], a[1], a[2]) */
 {
-	register int k, m, n;
-	register uchar *s;
+	int k, m, n;
+	uchar *s;
 	int temp;
-	register Cell *x, *y, *z;
+	Cell *x, *y, *z = 0;
 
 	x = execute(a[0]);
 	y = execute(a[1]);
@@ -720,11 +805,12 @@
 	s = getsval(x);
 	k = strlen((char *)s) + 1;
 	if (k <= 1) {
-		tempfree(x, "");
-		tempfree(y, "");
-		if (a[2] != 0)
-			tempfree(z, "");
-		x = gettemp("");
+		tempfree(x);
+		tempfree(y);
+		if (a[2] != 0) {
+			tempfree(z);
+		}
+		x = gettemp();
 		(void) setsval(x, (uchar *)"");
 		return (x);
 	}
@@ -733,10 +819,10 @@
 		m = 1;
 	else if (m > k)
 		m = k;
-	tempfree(y, "");
+	tempfree(y);
 	if (a[2] != 0) {
 		n = (int)getfval(z);
-		tempfree(z, "");
+		tempfree(z);
 	} else
 		n = k - 1;
 	if (n < 0)
@@ -744,21 +830,21 @@
 	else if (n > k - m)
 		n = k - m;
 	dprintf(("substr: m=%d, n=%d, s=%s\n", m, n, s));
-	y = gettemp("");
+	y = gettemp();
 	temp = s[n + m - 1];	/* with thanks to John Linderman */
 	s[n + m - 1] = '\0';
 	(void) setsval(y, s + m - 1);
 	s[n + m - 1] = temp;
-	tempfree(x, "");
+	tempfree(x);
 	return (y);
 }
 
 /*ARGSUSED*/
 Cell *
-sindex(Node **a, int nnn)
+sindex(Node **a, int nnn)	/* index(a[0], a[1]) */
 {
-	register Cell *x, *y, *z;
-	register uchar *s1, *s2, *p1, *p2, *q;
+	Cell *x, *y, *z;
+	uchar *s1, *s2, *p1, *p2, *q;
 	Awkfloat v = 0.0;
 
 	x = execute(a[0]);
@@ -766,179 +852,222 @@
 	y = execute(a[1]);
 	s2 = getsval(y);
 
-	z = gettemp("");
+	z = gettemp();
 	for (p1 = s1; *p1 != '\0'; p1++) {
 		for (q = p1, p2 = s2; *p2 != '\0' && *q == *p2; q++, p2++)
 			;
 		if (*p2 == '\0') {
-			v = (Awkfloat) (p1 - s1 + 1);	/* origin 1 */
+			v = (Awkfloat)(p1 - s1 + 1);	/* origin 1 */
 			break;
 		}
 	}
-	tempfree(x, "");
-	tempfree(y, "");
+	tempfree(x);
+	tempfree(y);
 	(void) setfval(z, v);
 	return (z);
 }
 
-void
-format(uchar **bufp, uchar *s, Node *a)
+#define	MAXNUMSIZE	50
+
+/*
+ * printf-like conversions
+ */
+int
+format(uchar **bufp, size_t *pbufsize, const uchar *s, Node *a)
 {
 	uchar *fmt;
-	register uchar *os;
-	register Cell *x;
-	int flag = 0, len;
-	uchar_t	*buf;
-	size_t bufsize, fmtsize, cnt, tcnt, ret;
+	uchar *p, *t;
+	const uchar *os;
+	Cell *x;
+	int flag = 0, n;
+	int fmtwd; /* format width */
+	size_t fmtsz = record_size;
+	uchar_t	*buf = *bufp;
+	size_t bufsize = *pbufsize;
 
-	init_buf(&buf, &bufsize, LINE_INCR);
-	init_buf(&fmt, &fmtsize, LINE_INCR);
 	os = s;
-	cnt = 0;
+	p = buf;
+	if ((fmt = (uchar *)malloc(fmtsz)) == NULL)
+		FATAL("out of memory in format()");
 	while (*s) {
+		(void) adjbuf(&buf, &bufsize, MAXNUMSIZE + 1 + p - buf,
+		    record_size, &p, "format1");
 		if (*s != '%') {
-			expand_buf(&buf, &bufsize, cnt);
-			buf[cnt++] = *s++;
+			*p++ = *s++;
 			continue;
 		}
 		if (*(s+1) == '%') {
-			expand_buf(&buf, &bufsize, cnt);
-			buf[cnt++] = '%';
+			*p++ = '%';
 			s += 2;
 			continue;
 		}
-		for (tcnt = 0; ; s++) {
-			expand_buf(&fmt, &fmtsize, tcnt);
-			fmt[tcnt++] = *s;
-			if (*s == '\0')
-				break;
-			if (isalpha(*s) && *s != 'l' && *s != 'h' && *s != 'L')
-				break;	/* the ansi panoply */
+		/*
+		 * have to be real careful in case this is a huge number,
+		 * eg, %100000d
+		 */
+		fmtwd = atoi((char *)s + 1);
+		if (fmtwd < 0)
+			fmtwd = -fmtwd;
+		(void) adjbuf(&buf, &bufsize, fmtwd + 1 + p - buf,
+		    record_size, &p, "format2");
+		for (t = fmt; (*t++ = *s) != '\0'; s++) {
+			if (!adjbuf(&fmt, &fmtsz, MAXNUMSIZE + 1 + t - fmt,
+			    record_size, &t, "format3"))
+				FATAL(
+			"format item %.30s... ran format() out of memory", os);
+			if (isalpha((uchar)*s) && *s != 'l' && *s != 'h' &&
+			    *s != 'L')
+				break;  /* the ansi panoply */
 			if (*s == '*') {
-				if (a == NULL) {
-					ERROR
-		"not enough args in printf(%s) or sprintf(%s)", os, os FATAL;
-				}
 				x = execute(a);
 				a = a->nnext;
-				tcnt--;
-				expand_buf(&fmt, &fmtsize, tcnt + 12);
-				ret = sprintf((char *)&fmt[tcnt], "%d",
-				    (int)getfval(x));
-				tcnt += ret;
-				tempfree(x, "");
+				(void) sprintf((char *)t - 1, "%d",
+				    fmtwd = (int)getfval(x));
+				if (fmtwd < 0)
+					fmtwd = -fmtwd;
+				(void) adjbuf(&buf, &bufsize, fmtwd + 1 + p -
+				    buf, record_size, &p, "format");
+				t = fmt + strlen((char *)fmt);
+				tempfree(x);
 			}
 		}
-		fmt[tcnt] = '\0';
+		*t = '\0';
+		if (fmtwd < 0)
+			fmtwd = -fmtwd;
+		(void) adjbuf(&buf, &bufsize, fmtwd + 1 + p - buf,
+		    record_size, &p, "format4");
 
 		switch (*s) {
 		case 'f': case 'e': case 'g': case 'E': case 'G':
-			flag = 1;
+			flag = 'f';
 			break;
 		case 'd': case 'i':
-			flag = 2;
+			flag = 'd';
 			if (*(s-1) == 'l')
 				break;
-			fmt[tcnt - 1] = 'l';
-			expand_buf(&fmt, &fmtsize, tcnt);
-			fmt[tcnt++] = 'd';
-			fmt[tcnt] = '\0';
+			*(t-1) = 'l';
+			*t = 'd';
+			*++t = '\0';
 			break;
 		case 'o': case 'x': case 'X': case 'u':
-			flag = *(s-1) == 'l' ? 2 : 3;
+			flag = *(s-1) == 'l' ? 'd' : 'u';
 			break;
 		case 's':
-			flag = 4;
+			flag = 's';
 			break;
 		case 'c':
-			flag = 5;
+			flag = 'c';
 			break;
 		default:
-			flag = 0;
+			WARNING("weird printf conversion %s", fmt);
+			flag = '?';
 			break;
 		}
-		if (flag == 0) {
-			len = strlen((char *)fmt);
-			expand_buf(&buf, &bufsize, cnt + len);
-			(void) memcpy(&buf[cnt], fmt, len);
-			cnt += len;
-			buf[cnt] = '\0';
-			continue;
-		}
 		if (a == NULL) {
-			ERROR
-	"not enough args in printf(%s) or sprintf(%s)", os, os FATAL;
+			FATAL(
+	"not enough args in printf(%s)", os);
 		}
 		x = execute(a);
 		a = a->nnext;
-		for (;;) {
-			/* make sure we have at least 1 byte space */
-			expand_buf(&buf, &bufsize, cnt + 1);
-			len = bufsize - cnt;
-			switch (flag) {
-			case 1:
-				/*LINTED*/
-				ret = snprintf((char *)&buf[cnt], len,
-				    (char *)fmt, getfval(x));
-				break;
-			case 2:
-				/*LINTED*/
-				ret = snprintf((char *)&buf[cnt], len,
-				    (char *)fmt, (long)getfval(x));
-				break;
-			case 3:
-				/*LINTED*/
-				ret = snprintf((char *)&buf[cnt], len,
-				    (char *)fmt, (int)getfval(x));
-				break;
-			case 4:
-				/*LINTED*/
-				ret = snprintf((char *)&buf[cnt], len,
-				    (char *)fmt, getsval(x));
-				break;
-			case 5:
-				if (isnum(x)) {
-					/*LINTED*/
-					ret = snprintf((char *)&buf[cnt], len,
-					    (char *)fmt, (int)getfval(x));
-				} else {
-					/*LINTED*/
-					ret = snprintf((char *)&buf[cnt], len,
-					    (char *)fmt, getsval(x)[0]);
+		n = MAXNUMSIZE;
+		if (fmtwd > n)
+			n = fmtwd;
+		(void) adjbuf(&buf, &bufsize, 1 + n + p - buf, record_size,
+		    &p, "format5");
+
+		switch (flag) {
+		case '?':
+			/* unknown, so dump it too */
+			/* LINTED E_SEC_SPRINTF_UNBOUNDED_COPY */
+			(void) sprintf((char *)p, "%s", (char *)fmt);
+			t = getsval(x);
+			n = strlen((char *)t);
+			if (fmtwd > n)
+				n = fmtwd;
+			(void) adjbuf(&buf, &bufsize, 1 + strlen((char *)p) +
+			    n + p - buf, record_size, &p, "format6");
+			p += strlen((char *)p);
+			/* LINTED E_SEC_SPRINTF_UNBOUNDED_COPY */
+			(void) sprintf((char *)p, "%s", t);
+			break;
+		case 'f':
+			/* LINTED E_SEC_PRINTF_VAR_FMT */
+			(void) sprintf((char *)p, (char *)fmt, getfval(x));
+			break;
+		case 'd':
+			/* LINTED E_SEC_PRINTF_VAR_FMT */
+			(void) sprintf((char *)p, (char *)fmt,
+			    (long) getfval(x));
+			break;
+		case 'u':
+			/* LINTED E_SEC_PRINTF_VAR_FMT */
+			(void) sprintf((char *)p, (char *)fmt,
+			    (int) getfval(x));
+			break;
+		case 's':
+			t = getsval(x);
+			n = strlen((char *)t);
+			if (fmtwd > n)
+				n = fmtwd;
+			if (!adjbuf(&buf, &bufsize, 1+n+p-buf, record_size,
+			    &p, "format7"))
+				FATAL(
+		"huge string/format (%d chars) in printf %.30s... "
+		"ran format() out of memory", n, t);
+			/* LINTED E_SEC_PRINTF_VAR_FMT */
+			(void) sprintf((char *)p, (char *)fmt, t);
+			break;
+		case 'c':
+			if (isnum(x)) {
+				if (getfval(x))
+					/* LINTED E_SEC_PRINTF_VAR_FMT */
+					(void) sprintf((char *)p, (char *)fmt,
+					    (int) getfval(x));
+				else {
+					*p++ = '\0'; /* explicit null byte */
+					/* next output will start here */
+					*p = '\0';
 				}
-				break;
-			default:
-				ret = 0;
+			} else {
+				/* LINTED E_SEC_PRINTF_VAR_FMT */
+				(void) sprintf((char *)p, (char *)fmt,
+				    getsval(x)[0]);
 			}
-			if (ret < len)
-				break;
-			expand_buf(&buf, &bufsize, cnt + ret);
+			break;
+		default:
+			FATAL("can't happen: bad conversion %c in format()",
+			    flag);
 		}
-		tempfree(x, "");
-		cnt += ret;
+		tempfree(x);
+		p += strlen((char *)p);
 		s++;
 	}
-	buf[cnt] = '\0';
+	*p = '\0';
+	free(fmt);
 	for (; a; a = a->nnext)	/* evaluate any remaining args */
 		(void) execute(a);
-	*bufp = tostring(buf);
-	free(buf);
-	free(fmt);
+	*bufp = buf;
+	*pbufsize = bufsize;
+	return (p - buf);
 }
 
 /*ARGSUSED*/
 Cell *
-a_sprintf(Node **a, int n)
+awksprintf(Node **a, int n)	/* sprintf(a[0]) */
 {
-	register Cell *x;
-	register Node *y;
+	Cell *x;
+	Node *y;
 	uchar *buf;
+	size_t bufsz = 3 * record_size;
 
+	if ((buf = (uchar *)malloc(bufsz)) == NULL)
+		FATAL("out of memory in awksprintf");
 	y = a[0]->nnext;
 	x = execute(a[0]);
-	format(&buf, getsval(x), y);
-	tempfree(x, "");
-	x = gettemp("");
+	if (format(&buf, &bufsz, getsval(x), y) == -1)
+		FATAL("sprintf string %.30s... too long.  can't happen.", buf);
+	tempfree(x);
+	x = gettemp();
 	x->sval = buf;
 	x->tval = STR;
 	return (x);
@@ -946,44 +1075,56 @@
 
 /*ARGSUSED*/
 Cell *
-aprintf(Node **a, int n)
-{
+awkprintf(Node **a, int n)	/* printf */
+{	/* a[0] is list of args, starting with format string */
+	/* a[1] is redirection operator, a[2] is redirection file */
 	FILE *fp;
-	register Cell *x;
-	register Node *y;
+	Cell *x;
+	Node *y;
 	uchar *buf;
+	int len;
+	size_t bufsz = 3 * record_size;
 
+	if ((buf = (uchar *)malloc(bufsz)) == NULL)
+		FATAL("out of memory in awkprintf");
 	y = a[0]->nnext;
 	x = execute(a[0]);
-	format(&buf, getsval(x), y);
-	tempfree(x, "");
-	if (a[1] == NULL)
-		(void) fputs((char *)buf, stdout);
-	else {
-		fp = redirect((int)a[1], a[2]);
-		(void) fputs((char *)buf, fp);
+	if ((len = format(&buf, &bufsz, getsval(x), y)) == -1)
+		FATAL("printf string %.30s... too long.  can't happen.", buf);
+	tempfree(x);
+	if (a[1] == NULL) {
+		/* fputs(buf, stdout); */
+		(void) fwrite((char *)buf, len, 1, stdout);
+		if (ferror(stdout))
+			FATAL("write error on stdout");
+	} else {
+		fp = redirect(ptoi(a[1]), a[2]);
+		/* fputs(buf, fp); */
+		(void) fwrite(buf, len, 1, fp);
 		(void) fflush(fp);
+		if (ferror(fp))
+			FATAL("write error on %s", filename(fp));
 	}
 	free(buf);
-	return (true);
+	return (True);
 }
 
 Cell *
-arith(Node **a, int n)
+arith(Node **a, int n)	/* a[0] + a[1], etc.  also -a[0] */
 {
-	Awkfloat i, j;
+	Awkfloat i, j = 0;
 	double v;
-	register Cell *x, *y, *z;
+	Cell *x, *y, *z;
 
 	x = execute(a[0]);
 	i = getfval(x);
-	tempfree(x, "");
+	tempfree(x);
 	if (n != UMINUS) {
 		y = execute(a[1]);
 		j = getfval(y);
-		tempfree(y, "");
+		tempfree(y);
 	}
-	z = gettemp("");
+	z = gettemp();
 	switch (n) {
 	case ADD:
 		i += j;
@@ -996,12 +1137,12 @@
 		break;
 	case DIVIDE:
 		if (j == 0)
-			ERROR "division by zero" FATAL;
+			FATAL("division by zero");
 		i /= j;
 		break;
 	case MOD:
 		if (j == 0)
-			ERROR "division by zero in mod" FATAL;
+			FATAL("division by zero in mod");
 		(void) modf(i/j, &v);
 		i = i - j * v;
 		break;
@@ -1015,20 +1156,20 @@
 			i = errcheck(pow(i, j), "pow");
 		break;
 	default:	/* can't happen */
-		ERROR "illegal arithmetic operator %d", n FATAL;
+		FATAL("illegal arithmetic operator %d", n);
 	}
 	(void) setfval(z, i);
 	return (z);
 }
 
 static double
-ipow(double x, int n)
+ipow(double x, int n)	/* x**n.  ought to be done by pow, but isn't always */
 {
 	double v;
 
 	if (n <= 0)
 		return (1.0);
-	v = ipow(x, n/2);
+	v = ipow(x, n / 2);
 	if (n % 2 == 0)
 		return (v * v);
 	else
@@ -1036,10 +1177,10 @@
 }
 
 Cell *
-incrdecr(Node **a, int n)
+incrdecr(Node **a, int n)	/* a[0]++, etc. */
 {
-	register Cell *x, *z;
-	register int k;
+	Cell *x, *z;
+	int k;
 	Awkfloat xf;
 
 	x = execute(a[0]);
@@ -1049,34 +1190,39 @@
 		(void) setfval(x, xf + k);
 		return (x);
 	}
-	z = gettemp("");
+	z = gettemp();
 	(void) setfval(z, xf);
 	(void) setfval(x, xf + k);
-	tempfree(x, "");
+	tempfree(x);
 	return (z);
 }
 
 Cell *
-assign(Node **a, int n)
-{
-	register Cell *x, *y;
+assign(Node **a, int n)	/* a[0] = a[1], a[0] += a[1], etc. */
+{			/* this is subtle; don't muck with it. */
+	Cell *x, *y;
 	Awkfloat xf, yf;
 	double v;
 
 	y = execute(a[1]);
-	x = execute(a[0]);	/* order reversed from before... */
+	x = execute(a[0]);
 	if (n == ASSIGN) {	/* ordinary assignment */
-		if ((y->tval & (STR|NUM)) == (STR|NUM)) {
+		/* self-assignment: */
+		/* LINTED E_NOP_IF_STMT */
+		if (x == y && !(x->tval & (FLD|REC)))
+			/* leave alone unless it's a field */
+			;
+		else if ((y->tval & (STR|NUM)) == (STR|NUM)) {
 			(void) setsval(x, getsval(y));
 			x->fval = getfval(y);
 			x->tval |= NUM;
-		} else if (y->tval & STR)
+		} else if (isstr(y))
 			(void) setsval(x, getsval(y));
-		else if (y->tval & NUM)
+		else if (isnum(y))
 			(void) setfval(x, getfval(y));
 		else
 			funnyvar(y, "read value of");
-		tempfree(y, "");
+		tempfree(y);
 		return (x);
 	}
 	xf = getfval(x);
@@ -1093,12 +1239,12 @@
 		break;
 	case DIVEQ:
 		if (yf == 0)
-			ERROR "division by zero in /=" FATAL;
+			FATAL("division by zero in /=");
 		xf /= yf;
 		break;
 	case MODEQ:
 		if (yf == 0)
-			ERROR "division by zero in %%=" FATAL;
+			FATAL("division by zero in %%=");
 		(void) modf(xf/yf, &v);
 		xf = xf - yf * v;
 		break;
@@ -1109,21 +1255,21 @@
 			xf = errcheck(pow(xf, yf), "pow");
 		break;
 	default:
-		ERROR "illegal assignment operator %d", n FATAL;
+		FATAL("illegal assignment operator %d", n);
 		break;
 	}
-	tempfree(y, "");
+	tempfree(y);
 	(void) setfval(x, xf);
 	return (x);
 }
 
 /*ARGSUSED*/
 Cell *
-cat(Node **a, int q)
+cat(Node **a, int q)		/* a[0] cat a[1] */
 {
-	register Cell *x, *y, *z;
-	register int n1, n2;
-	register uchar *s;
+	Cell *x, *y, *z;
+	int n1, n2;
+	uchar *s;
 
 	x = execute(a[0]);
 	y = execute(a[1]);
@@ -1133,31 +1279,31 @@
 	n2 = strlen((char *)y->sval);
 	s = (uchar *)malloc(n1 + n2 + 1);
 	if (s == NULL) {
-		ERROR "out of space concatenating %.15s and %.15s",
-		    x->sval, y->sval FATAL;
+		FATAL("out of space concatenating %.15s... and %.15s...",
+		    x->sval, y->sval);
 	}
 	(void) strcpy((char *)s, (char *)x->sval);
 	(void) strcpy((char *)s + n1, (char *)y->sval);
-	tempfree(y, "");
-	z = gettemp("");
+	tempfree(x);
+	tempfree(y);
+	z = gettemp();
 	z->sval = s;
 	z->tval = STR;
-	tempfree(x, "");
 	return (z);
 }
 
 /*ARGSUSED*/
 Cell *
-pastat(Node **a, int n)
+pastat(Node **a, int n)		/* a[0] { a[1] } */
 {
-	register Cell *x;
+	Cell *x;
 
 	if (a[0] == 0)
 		x = execute(a[1]);
 	else {
 		x = execute(a[0]);
 		if (istrue(x)) {
-			tempfree(x, "");
+			tempfree(x);
 			x = execute(a[1]);
 		}
 	}
@@ -1166,60 +1312,51 @@
 
 /*ARGSUSED*/
 Cell *
-dopa2(Node **a, int n)
+dopa2(Node **a, int n)		/* a[0], a[1] { a[2] } */
 {
-	Cell	*x;
-	int	pair;
-	static int	*pairstack = NULL;
-
-	if (!pairstack) {
-		/* first time */
-		dprintf(("paircnt: %d\n", paircnt));
-		pairstack = (int *)malloc(sizeof (int) * paircnt);
-		if (!pairstack)
-			ERROR "out of space in dopa2" FATAL;
-		(void) memset(pairstack, 0, sizeof (int) * paircnt);
-	}
+	Cell *x;
+	int pair;
 
-	pair = (int)a[3];
+	pair = ptoi(a[3]);
 	if (pairstack[pair] == 0) {
 		x = execute(a[0]);
 		if (istrue(x))
 			pairstack[pair] = 1;
-		tempfree(x, "");
+		tempfree(x);
 	}
 	if (pairstack[pair] == 1) {
 		x = execute(a[1]);
 		if (istrue(x))
 			pairstack[pair] = 0;
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[2]);
 		return (x);
 	}
-	return (false);
+	return (False);
 }
 
 /*ARGSUSED*/
 Cell *
-split(Node **a, int nnn)
+split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 {
-	Cell *x, *y, *ap;
-	register uchar *s;
-	register int sep;
-	uchar *t, temp, num[11], *fs;
-	int n, tempstat;
+	Cell *x = 0, *y, *ap;
+	uchar *s, *origs;
+	int sep;
+	uchar *t, temp, num[50], *fs = 0;
+	int n, tempstat, arg3type;
 
 	y = execute(a[0]);	/* source string */
-	s = getsval(y);
+	origs = s = (uchar *)strdup((char *)getsval(y));
+	arg3type = ptoi(a[3]);
 	if (a[2] == 0)		/* fs string */
 		fs = *FS;
-	else if ((int)a[3] == STRING) {	/* split(str,arr,"string") */
+	else if (arg3type == STRING) {	/* split(str,arr,"string") */
 		x = execute(a[2]);
 		fs = getsval(x);
-	} else if ((int)a[3] == REGEXPR)
+	} else if (arg3type == REGEXPR)
 		fs = (uchar *)"(regexpr)";	/* split(str,arr,/regexpr/) */
 	else
-		ERROR "illegal type of split()" FATAL;
+		FATAL("illegal type of split");
 	sep = *fs;
 	ap = execute(a[1]);	/* array name */
 	freesymtab(ap);
@@ -1229,10 +1366,15 @@
 	ap->sval = (uchar *)makesymtab(NSYMTAB);
 
 	n = 0;
-	if (*s != '\0' && strlen((char *)fs) > 1 || (int)a[3] == REGEXPR) {
+	if (arg3type == REGEXPR && strlen((char *)((fa *)a[2])->restr) == 0) {
+		arg3type = 0;
+		fs = (uchar *)"";
+		sep = 0;
+	}
+	if (*s != '\0' && (strlen((char *)fs) > 1 || arg3type == REGEXPR)) {
 		/* reg expr */
 		fa *pfa;
-		if ((int)a[3] == REGEXPR) {	/* it's ready already */
+		if (arg3type == REGEXPR) {	/* it's ready already */
 			pfa = (fa *)a[2];
 		} else {
 			pfa = makedfa(fs, 1);
@@ -1267,6 +1409,9 @@
 					goto spdone;
 				}
 			} while (nematch(pfa, s));
+			/* bwk: has to be here to reset */
+			pfa->initstat = tempstat;
+			/* cf gsub and refldbld */
 		}
 		n++;
 		(void) sprintf((char *)num, "%d", n);
@@ -1309,6 +1454,23 @@
 			if (*s != 0)
 				s++;
 		}
+	} else if (sep == 0) {	/* new: split(s, a, "") => 1 char/elem */
+		for (n = 0; *s != 0; s++) {
+			uchar buf[2];
+			n++;
+			(void) sprintf((char *)num, "%d", n);
+			buf[0] = *s;
+			buf[1] = 0;
+			if (isdigit(buf[0])) {
+				(void) setsymtab(num, buf, atof((char *)buf),
+				    /* LINTED align */
+				    STR | NUM, (Array *)ap->sval);
+			} else {
+				(void) setsymtab(num, buf, 0.0,
+				    /* LINTED align */
+				    STR, (Array *)ap->sval);
+			}
+		}
 	} else if (*s != 0) {
 		for (;;) {
 			n++;
@@ -1332,11 +1494,13 @@
 				break;
 		}
 	}
-	tempfree(ap, "");
-	tempfree(y, "");
-	if (a[2] != 0 && (int)a[3] == STRING)
-		tempfree(x, "");
-	x = gettemp("");
+	tempfree(ap);
+	tempfree(y);
+	free(origs);
+	if (a[2] != 0 && arg3type == STRING) {
+		tempfree(x);
+	}
+	x = gettemp();
 	x->tval = NUM;
 	x->fval = n;
 	return (x);
@@ -1344,16 +1508,16 @@
 
 /*ARGSUSED*/
 Cell *
-condexpr(Node **a, int n)
+condexpr(Node **a, int n)	/* a[0] ? a[1] : a[2] */
 {
-	register Cell *x;
+	Cell *x;
 
 	x = execute(a[0]);
 	if (istrue(x)) {
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[1]);
 	} else {
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[2]);
 	}
 	return (x);
@@ -1361,16 +1525,16 @@
 
 /*ARGSUSED*/
 Cell *
-ifstat(Node **a, int n)
+ifstat(Node **a, int n)		/* if (a[0]) a[1]; else a[2] */
 {
-	register Cell *x;
+	Cell *x;
 
 	x = execute(a[0]);
 	if (istrue(x)) {
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[1]);
 	} else if (a[2] != 0) {
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[2]);
 	}
 	return (x);
@@ -1378,123 +1542,136 @@
 
 /*ARGSUSED*/
 Cell *
-whilestat(Node **a, int n)
+whilestat(Node **a, int n)	/* while (a[0]) a[1] */
 {
-	register Cell *x;
+	Cell *x;
 
 	for (;;) {
 		x = execute(a[0]);
 		if (!istrue(x))
 			return (x);
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[1]);
 		if (isbreak(x)) {
-			x = true;
+			x = True;
 			return (x);
 		}
 		if (isnext(x) || isexit(x) || isret(x))
 			return (x);
-		tempfree(x, "");
+		tempfree(x);
 	}
 }
 
 /*ARGSUSED*/
 Cell *
-dostat(Node **a, int n)
+dostat(Node **a, int n)		/* do a[0]; while(a[1]) */
 {
-	register Cell *x;
+	Cell *x;
 
 	for (;;) {
 		x = execute(a[0]);
 		if (isbreak(x))
-			return (true);
+			return (True);
 		if (isnext(x) || isexit(x) || isret(x))
 			return (x);
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[1]);
 		if (!istrue(x))
 			return (x);
-		tempfree(x, "");
+		tempfree(x);
 	}
 }
 
 /*ARGSUSED*/
 Cell *
-forstat(Node **a, int n)
+forstat(Node **a, int n)	/* for (a[0]; a[1]; a[2]) a[3] */
 {
-	register Cell *x;
+	Cell *x;
 
 	x = execute(a[0]);
-	tempfree(x, "");
+	tempfree(x);
 	for (;;) {
 		if (a[1] != 0) {
 			x = execute(a[1]);
 			if (!istrue(x))
 				return (x);
 			else
-				tempfree(x, "");
+				tempfree(x);
 		}
 		x = execute(a[3]);
 		if (isbreak(x))		/* turn off break */
-			return (true);
+			return (True);
 		if (isnext(x) || isexit(x) || isret(x))
 			return (x);
-		tempfree(x, "");
+		tempfree(x);
 		x = execute(a[2]);
-		tempfree(x, "");
+		tempfree(x);
 	}
 }
 
 /*ARGSUSED*/
 Cell *
-instat(Node **a, int n)
+instat(Node **a, int n)	/* for (a[0] in a[1]) a[2] */
 {
-	register Cell *x, *vp, *arrayp, *cp, *ncp;
+	Cell *x, *vp, *arrayp, *cp, *ncp;
 	Array *tp;
 	int i;
 
 	vp = execute(a[0]);
 	arrayp = execute(a[1]);
-	if (!isarr(arrayp))
-		ERROR "%s is not an array", arrayp->nval FATAL;
+	if (!isarr(arrayp)) {
+		return (True);
+	}
 	/*LINTED align*/
 	tp = (Array *)arrayp->sval;
-	tempfree(arrayp, "");
+	tempfree(arrayp);
 	for (i = 0; i < tp->size; i++) { /* this routine knows too much */
 		for (cp = tp->tab[i]; cp != NULL; cp = ncp) {
 			(void) setsval(vp, cp->nval);
 			ncp = cp->cnext;
 			x = execute(a[2]);
 			if (isbreak(x)) {
-				tempfree(vp, "");
-				return (true);
+				tempfree(vp);
+				return (True);
 			}
 			if (isnext(x) || isexit(x) || isret(x)) {
-				tempfree(vp, "");
+				tempfree(vp);
 				return (x);
 			}
-			tempfree(x, "");
+			tempfree(x);
 		}
 	}
-	return (true);
+	return (True);
 }
 
+/*
+ * builtin functions. a[0] is type, a[1] is arg list
+ */
 /*ARGSUSED*/
 Cell *
 bltin(Node **a, int n)
 {
-	register Cell *x, *y;
+	Cell *x, *y;
 	Awkfloat u;
-	register int t;
+	int t;
+	Awkfloat tmp;
 	uchar *p, *buf;
 	Node *nextarg;
+	FILE *fp;
 
-	t = (int)a[0];
+	t = ptoi(a[0]);
 	x = execute(a[1]);
 	nextarg = a[1]->nnext;
 	switch (t) {
 	case FLENGTH:
-		u = (Awkfloat)strlen((char *)getsval(x)); break;
+		if (isarr(x)) {
+			/* GROT.  should be function */
+			/* LINTED align */
+			u = (Awkfloat)((Array *)x->sval)->nelem;
+		} else {
+			u = (Awkfloat)strlen((char *)getsval(x));
+		}
+		break;
 	case FLOG:
 		u = errcheck(log(getfval(x)), "log"); break;
 	case FINT:
@@ -1509,13 +1686,12 @@
 		u = cos(getfval(x)); break;
 	case FATAN:
 		if (nextarg == 0) {
-			ERROR "atan2 requires two arguments; returning 1.0"
-			    WARNING;
+			WARNING("atan2 requires two arguments; returning 1.0");
 			u = 1.0;
 		} else {
 			y = execute(a[1]->nnext);
 			u = atan2(getfval(x), getfval(y));
-			tempfree(y, "");
+			tempfree(y);
 			nextarg = nextarg->nnext;
 		}
 		break;
@@ -1526,14 +1702,18 @@
 		u = (Awkfloat)system((char *)getsval(x)) / 256;
 		break;
 	case FRAND:
-		u = (Awkfloat)(rand() % 32767) / 32767.0;
+		/* in principle, rand() returns something in 0..RAND_MAX */
+		u = (Awkfloat)(rand() % RAND_MAX) / RAND_MAX;
 		break;
 	case FSRAND:
-		if (x->tval & REC)	/* no argument provided */
+		if (isrec(x))	/* no argument provided */
 			u = time((time_t *)0);
 		else
 			u = getfval(x);
-		srand((int)u); u = (int)u;
+		tmp = u;
+		srand((unsigned int)u);
+		u = srand_seed;
+		srand_seed = tmp;
 		break;
 	case FTOUPPER:
 	case FTOLOWER:
@@ -1547,20 +1727,30 @@
 				if (isupper(*p))
 					*p = tolower(*p);
 		}
-		tempfree(x, "");
-		x = gettemp("");
+		tempfree(x);
+		x = gettemp();
 		(void) setsval(x, buf);
 		free(buf);
 		return (x);
+	case FFLUSH:
+		if (isrec(x) || strlen((char *)getsval(x)) == 0) {
+			/* fflush() or fflush("") -> all */
+			flush_all();
+			u = 0;
+		} else if ((fp = openfile(FFLUSH, getsval(x))) == NULL)
+			u = EOF;
+		else
+			u = fflush(fp);
+		break;
 	default:	/* can't happen */
-		ERROR "illegal function type %d", t FATAL;
+		FATAL("illegal function type %d", t);
 		break;
 	}
-	tempfree(x, "");
-	x = gettemp("");
+	tempfree(x);
+	x = gettemp();
 	(void) setfval(x, u);
 	if (nextarg != 0) {
-		ERROR "warning: function has too many arguments" WARNING;
+		WARNING("warning: function has too many arguments");
 		for (; nextarg; nextarg = nextarg->nnext)
 			(void) execute(nextarg);
 	}
@@ -1569,20 +1759,20 @@
 
 /*ARGSUSED*/
 Cell *
-print(Node **a, int n)
+printstat(Node **a, int n)		/* print a[0] */
 {
-	register Node *x;
-	register Cell *y;
+	Node *x;
+	Cell *y;
 	FILE *fp;
 
-	if (a[1] == 0)
+	if (a[1] == 0)	/* a[1] is redirection operator, a[2] is file */
 		fp = stdout;
 	else
-		fp = redirect((int)a[1], a[2]);
+		fp = redirect(ptoi(a[1]), a[2]);
 	for (x = a[0]; x != NULL; x = x->nnext) {
 		y = execute(x);
 		(void) fputs((char *)getsval(y), fp);
-		tempfree(y, "");
+		tempfree(y);
 		if (x->nnext == NULL)
 			(void) fputs((char *)*ORS, fp);
 		else
@@ -1590,7 +1780,9 @@
 	}
 	if (a[1] != 0)
 		(void) fflush(fp);
-	return (true);
+	if (ferror(fp))
+		FATAL("write error on %s", filename(fp));
+	return (True);
 }
 
 /*ARGSUSED*/
@@ -1600,14 +1792,8 @@
 	return (0);
 }
 
-struct {
-	FILE	*fp;
-	uchar	*fname;
-	int	mode;	/* '|', 'a', 'w' */
-} files[FOPEN_MAX];
-
 static FILE *
-redirect(int a, Node *b)
+redirect(int a, Node *b)	/* set up all i/o redirections */
 {
 	FILE *fp;
 	Cell *x;
@@ -1617,34 +1803,74 @@
 	fname = getsval(x);
 	fp = openfile(a, fname);
 	if (fp == NULL)
-		ERROR "can't open file %s", fname FATAL;
-	tempfree(x, "");
+		FATAL("can't open file %s", fname);
+	tempfree(x);
 	return (fp);
 }
 
+struct files {
+	FILE	*fp;
+	const uchar	*fname;
+	int	mode;	/* '|', 'a', 'w' => LE/LT, GT */
+} *files;
+
+int nfiles;
+
+static void
+stdinit(void)	/* in case stdin, etc., are not constants */
+{
+	nfiles = FOPEN_MAX;
+	files = calloc(nfiles, sizeof (*files));
+	if (files == NULL)
+		FATAL("can't allocate file memory for %u files", nfiles);
+	files[0].fp = stdin;
+	files[0].fname = (uchar *)"/dev/stdin";
+	files[0].mode = LT;
+	files[1].fp = stdout;
+	files[1].fname = (uchar *)"/dev/stdout";
+	files[1].mode = GT;
+	files[2].fp = stderr;
+	files[2].fname = (uchar *)"/dev/stderr";
+	files[2].mode = GT;
+}
+
 static FILE *
-openfile(int a, uchar *s)
+openfile(int a, const uchar *us)
 {
-	register int i, m;
-	register FILE *fp;
+	const uchar *s = us;
+	int i, m;
+	FILE *fp = 0;
 
 	if (*s == '\0')
-		ERROR "null file name in print or getline" FATAL;
-	for (i = 0; i < FOPEN_MAX; i++) {
+		FATAL("null file name in print or getline");
+	for (i = 0; i < nfiles; i++) {
 		if (files[i].fname &&
-		    strcmp((char *)s, (char *)files[i].fname) == 0) {
+		    (strcmp((char *)s, (char *)files[i].fname) == 0)) {
 			if (a == files[i].mode ||
-			    a == APPEND && files[i].mode == GT) {
+			    (a == APPEND && files[i].mode == GT)) {
 				return (files[i].fp);
 			}
+			if (a == FFLUSH)
+				return (files[i].fp);
 		}
 	}
-	for (i = 0; i < FOPEN_MAX; i++) {
+	if (a == FFLUSH)	/* didn't find it, so don't create it! */
+		return (NULL);
+
+	for (i = 0; i < nfiles; i++) {
 		if (files[i].fp == 0)
 			break;
 	}
-	if (i >= FOPEN_MAX)
-		ERROR "%s makes too many open files", s FATAL;
+	if (i >= nfiles) {
+		struct files *nf;
+		int nnf = nfiles + FOPEN_MAX;
+		nf = realloc(files, nnf * sizeof (*nf));
+		if (nf == NULL)
+			FATAL("cannot grow files for %s and %d files", s, nnf);
+		(void) memset(&nf[nfiles], 0, FOPEN_MAX * sizeof (*nf));
+		nfiles = nnf;
+		files = nf;
+	}
 	(void) fflush(stdout);	/* force a semblance of order */
 	m = a;
 	if (a == GT) {
@@ -1660,7 +1886,7 @@
 		fp = strcmp((char *)s, "-") == 0 ?
 		    stdin : fopen((char *)s, "r");	/* "-" is stdin */
 	} else	/* can't happen */
-		ERROR "illegal redirection" FATAL;
+		FATAL("illegal redirection %d", a);
 	if (fp != NULL) {
 		files[i].fname = tostring(s);
 		files[i].fp = fp;
@@ -1669,38 +1895,55 @@
 	return (fp);
 }
 
+static const char *
+filename(FILE *fp)
+{
+	int i;
+
+	for (i = 0; i < nfiles; i++) {
+		if (fp == files[i].fp)
+			return ((char *)files[i].fname);
+	}
+
+	return ("???");
+}
+
 /*ARGSUSED*/
 Cell *
 closefile(Node **a, int n)
 {
-	register Cell *x;
+	Cell *x;
 	int i, stat;
 
 	x = execute(a[0]);
 	(void) getsval(x);
-	for (i = 0; i < FOPEN_MAX; i++) {
+	stat = -1;
+	for (i = 0; i < nfiles; i++) {
 		if (files[i].fname &&
 		    strcmp((char *)x->sval, (char *)files[i].fname) == 0) {
 			if (ferror(files[i].fp)) {
-				ERROR "i/o error occurred on %s",
-				    files[i].fname WARNING;
+				WARNING("i/o error occurred on %s",
+				    files[i].fname);
 			}
 			if (files[i].mode == '|' || files[i].mode == LE)
 				stat = pclose(files[i].fp);
 			else
 				stat = fclose(files[i].fp);
 			if (stat == EOF) {
-				ERROR "i/o error occurred closing %s",
-				    files[i].fname WARNING;
+				WARNING("i/o error occurred closing %s",
+				    files[i].fname);
 			}
-			xfree(files[i].fname);
+			if (i > 2)	/* don't do /dev/std... */
+				xfree(files[i].fname);
 			/* watch out for ref thru this */
 			files[i].fname = NULL;
 			files[i].fp = NULL;
 		}
 	}
-	tempfree(x, "close");
-	return (true);
+	tempfree(x);
+	x = gettemp();
+	(void) setfval(x, (Awkfloat)stat);
+	return (x);
 }
 
 static void
@@ -1711,114 +1954,131 @@
 	for (i = 0; i < FOPEN_MAX; i++) {
 		if (files[i].fp) {
 			if (ferror(files[i].fp)) {
-				ERROR "i/o error occurred on %s",
-				    files[i].fname WARNING;
+				WARNING("i/o error occurred on %s",
+				    files[i].fname);
 			}
 			if (files[i].mode == '|' || files[i].mode == LE)
 				stat = pclose(files[i].fp);
 			else
 				stat = fclose(files[i].fp);
 			if (stat == EOF) {
-				ERROR "i/o error occurred while closing %s",
-				    files[i].fname WARNING;
+				WARNING("i/o error occurred while closing %s",
+				    files[i].fname);
 			}
 		}
 	}
 }
 
+static void
+flush_all(void)
+{
+	int i;
+
+	for (i = 0; i < nfiles; i++)
+		if (files[i].fp)
+			(void) fflush(files[i].fp);
+}
+
+void backsub(uchar **pb_ptr, uchar **sptr_ptr);
+
 /*ARGSUSED*/
 Cell *
-sub(Node **a, int nnn)
+sub(Node **a, int nnn)	/* substitute command */
 {
-	register uchar *sptr;
-	register Cell *x, *y, *result;
-	uchar *buf, *t;
+	uchar *sptr, *pb, *q;
+	Cell *x, *y, *result;
+	uchar *t, *buf;
 	fa *pfa;
-	size_t	bsize, cnt, len;
+	size_t	bufsz = record_size;
 
+	if ((buf = (uchar *)malloc(bufsz)) == NULL)
+		FATAL("out of memory in sub");
 	x = execute(a[3]);	/* target string */
 	t = getsval(x);
-	if (a[0] == 0)
+	if (a[0] == 0)		/* 0 => a[1] is already-compiled regexpr */
 		pfa = (fa *)a[1];	/* regular expression */
 	else {
 		y = execute(a[1]);
 		pfa = makedfa(getsval(y), 1);
-		tempfree(y, "");
+		tempfree(y);
 	}
 	y = execute(a[2]);	/* replacement string */
-	result = false;
+	result = False;
 	if (pmatch(pfa, t)) {
-		init_buf(&buf, &bsize, LINE_INCR);
-		cnt = 0;
 		sptr = t;
-		len = patbeg - sptr;
-		if (len > 0) {
-			expand_buf(&buf, &bsize, cnt + len);
-			(void) memcpy(buf, sptr, len);
-			cnt += len;
-		}
+		(void) adjbuf(&buf, &bufsz, 1+patbeg-sptr, record_size,
+		    0, "sub");
+		pb = buf;
+		while (sptr < patbeg)
+			*pb++ = *sptr++;
 		sptr = getsval(y);
 		while (*sptr != 0) {
-			expand_buf(&buf, &bsize, cnt);
-			if (*sptr == '\\' &&
-			    (*(sptr+1) == '&' || *(sptr+1) == '\\')) {
-				sptr++;		/* skip \, */
-				buf[cnt++] = *sptr++; /* add & or \ */
+			(void) adjbuf(&buf, &bufsz, 5 + pb - buf, record_size,
+			    &pb, "sub");
+			if (*sptr == '\\') {
+				backsub(&pb, &sptr);
 			} else if (*sptr == '&') {
-				expand_buf(&buf, &bsize, cnt + patlen);
 				sptr++;
-				(void) memcpy(&buf[cnt], patbeg, patlen);
-				cnt += patlen;
+				(void) adjbuf(&buf, &bufsz, 1+patlen+pb-buf,
+				    record_size, &pb, "sub");
+				for (q = patbeg; q < patbeg + patlen; )
+					*pb++ = *q++;
 			} else {
-				buf[cnt++] = *sptr++;
+				*pb++ = *sptr++;
 			}
 		}
+		*pb = '\0';
+		if (pb > buf + bufsz)
+			FATAL("sub result1 %.30s too big; can't happen", buf);
 		sptr = patbeg + patlen;
 		if ((patlen == 0 && *patbeg) || (patlen && *(sptr-1))) {
-			len = strlen((char *)sptr);
-			expand_buf(&buf, &bsize, cnt + len);
-			(void) memcpy(&buf[cnt], sptr, len);
-			cnt += len;
+			(void) adjbuf(&buf, &bufsz, 1 + strlen((char *)sptr) +
+			    pb - buf, 0, &pb, "sub");
+			while ((*pb++ = *sptr++) != 0)
+				;
 		}
-		buf[cnt] = '\0';
+		if (pb > buf + bufsz)
+			FATAL("sub result2 %.30s too big; can't happen", buf);
+		/* BUG: should be able to avoid copy */
 		(void) setsval(x, buf);
-		free(buf);
-		result = true;
+		result = True;
 	}
-	tempfree(x, "");
-	tempfree(y, "");
+	tempfree(x);
+	tempfree(y);
+	free(buf);
 	return (result);
 }
 
 /*ARGSUSED*/
 Cell *
-gsub(Node **a, int nnn)
+gsub(Node **a, int nnn)		/* global substitute */
 {
-	register Cell *x, *y;
-	register uchar *rptr, *sptr, *t;
+	Cell *x, *y;
+	uchar *rptr, *sptr, *t, *pb, *q;
 	uchar *buf;
-	register fa *pfa;
+	fa *pfa;
 	int mflag, tempstat, num;
-	size_t	bsize, cnt, len;
+	size_t bufsz = record_size;
 
+	if ((buf = (uchar *)malloc(bufsz)) == NULL)
+		FATAL("out of memory in gsub");
 	mflag = 0;	/* if mflag == 0, can replace empty string */
 	num = 0;
 	x = execute(a[3]);	/* target string */
 	t = getsval(x);
-	if (a[0] == 0)
-		pfa = (fa *) a[1];	/* regular expression */
+	if (a[0] == 0)		/* 0 => a[1] is already-compiled regexpr */
+		pfa = (fa *)a[1];	/* regular expression */
 	else {
 		y = execute(a[1]);
 		pfa = makedfa(getsval(y), 1);
-		tempfree(y, "");
+		tempfree(y);
 	}
 	y = execute(a[2]);	/* replacement string */
 	if (pmatch(pfa, t)) {
 		tempstat = pfa->initstat;
 		pfa->initstat = 2;
-		init_buf(&buf, &bsize, LINE_INCR);
+		pb = buf;
 		rptr = getsval(y);
-		cnt = 0;
 		do {
 			if (patlen == 0 && *patbeg != 0) {
 				/* matched empty string */
@@ -1826,79 +2086,112 @@
 					num++;
 					sptr = rptr;
 					while (*sptr != 0) {
-						expand_buf(&buf, &bsize, cnt);
-						if (*sptr == '\\' &&
-						    (*(sptr+1) == '&' ||
-						    *(sptr+1) == '\\')) {
-							sptr++;
-							buf[cnt++] = *sptr++;
-						} else if (*sptr == '&') {
-							expand_buf(&buf,
-							    &bsize,
-							    cnt + patlen);
-							sptr++;
-							(void) memcpy(&buf[cnt],
-							    patbeg, patlen);
-							cnt += patlen;
-						} else {
-							buf[cnt++] = *sptr++;
-						}
+					(void) adjbuf(&buf, &bufsz, 5+pb-buf,
+					    record_size, &pb, "gsub");
+					if (*sptr == '\\') {
+						backsub(&pb, &sptr);
+					} else if (*sptr == '&') {
+						sptr++;
+						(void) adjbuf(&buf, &bufsz, 1 +
+						    patlen+pb-buf, record_size,
+						    &pb, "gsub");
+					for (q = patbeg; q < patbeg+patlen; )
+						*pb++ = *q++;
+					} else {
+						*pb++ = *sptr++;
+					}
 					}
 				}
 				if (*t == 0)	/* at end */
 					goto done;
-				expand_buf(&buf, &bsize, cnt);
-				buf[cnt++] = *t++;
+				(void) adjbuf(&buf, &bufsz, 2 + pb - buf,
+				    record_size, &pb, "gsub");
+				*pb++ = *t++;
+				/* BUG: not sure of this test */
+				if (pb > buf + bufsz)
+					FATAL(
+			"gsub result0 %.30s too big; can't happen", buf);
 				mflag = 0;
 			} else {	/* matched nonempty string */
 				num++;
 				sptr = t;
-				len = patbeg - sptr;
-				if (len > 0) {
-					expand_buf(&buf, &bsize, cnt + len);
-					(void) memcpy(&buf[cnt], sptr, len);
-					cnt += len;
-				}
+				(void) adjbuf(&buf, &bufsz, 1 +
+				    (patbeg - sptr) + pb - buf, record_size,
+				    &pb, "gsub");
+				while (sptr < patbeg)
+					*pb++ = *sptr++;
 				sptr = rptr;
 				while (*sptr != 0) {
-					expand_buf(&buf, &bsize, cnt);
-					if (*sptr == '\\' &&
-					    (*(sptr+1) == '&' ||
-					    *(sptr+1) == '\\')) {
-						sptr++;
-						buf[cnt++] = *sptr++;
+					(void) adjbuf(&buf, &bufsz, 5 + pb -
+					    buf, record_size, &pb, "gsub");
+					if (*sptr == '\\') {
+						backsub(&pb, &sptr);
 					} else if (*sptr == '&') {
-						expand_buf(&buf, &bsize,
-						    cnt + patlen);
 						sptr++;
-						(void) memcpy(&buf[cnt],
-						    patbeg, patlen);
-						cnt += patlen;
+					(void) adjbuf(&buf, &bufsz, 1 +
+					    patlen + pb - buf, record_size,
+					    &pb, "gsub");
+				for (q = patbeg; q < patbeg + patlen; )
+							*pb++ = *q++;
 					} else {
-						buf[cnt++] = *sptr++;
+						*pb++ = *sptr++;
 					}
 				}
 				t = patbeg + patlen;
-				if ((*(t-1) == 0) || (*t == 0))
+				if (patlen == 0 || *t == 0 || *(t - 1) == 0)
 					goto done;
+				if (pb > buf + bufsz)
+					FATAL(
+			"gsub result1 %.30s too big; can't happen", buf);
 				mflag = 1;
 			}
 		} while (pmatch(pfa, t));
 		sptr = t;
-		len = strlen((char *)sptr);
-		expand_buf(&buf, &bsize, len + cnt);
-		(void) memcpy(&buf[cnt], sptr, len);
-		cnt += len;
-	done:
-		buf[cnt] = '\0';
+		(void) adjbuf(&buf, &bufsz, 1 + strlen((char *)sptr) + pb -
+		    buf, 0, &pb, "gsub");
+		while ((*pb++ = *sptr++) != 0)
+			;
+	done:	if (pb < buf + bufsz)
+			*pb = '\0';
+		else if (*(pb-1) != '\0')
+			FATAL("gsub result2 %.30s truncated; can't happen",
+			    buf);
+		/* BUG: should be able to avoid copy + free */
 		(void) setsval(x, buf);
-		free(buf);
 		pfa->initstat = tempstat;
 	}
-	tempfree(x, "");
-	tempfree(y, "");
-	x = gettemp("");
+	tempfree(x);
+	tempfree(y);
+	x = gettemp();
 	x->tval = NUM;
 	x->fval = num;
+	free(buf);
 	return (x);
 }
+
+void
+backsub(uchar **pb_ptr, uchar **sptr_ptr)	/* handle \\& variations */
+{					/* sptr[0] == '\\' */
+	uchar *pb = *pb_ptr, *sptr = *sptr_ptr;
+
+	if (sptr[1] == '\\') {
+		if (sptr[2] == '\\' && sptr[3] == '&') { /* \\\& -> \& */
+			*pb++ = '\\';
+			*pb++ = '&';
+			sptr += 4;
+		} else if (sptr[2] == '&') {	/* \\& -> \ + matched */
+			*pb++ = '\\';
+			sptr += 2;
+		} else {			/* \\x -> \\x */
+			*pb++ = *sptr++;
+			*pb++ = *sptr++;
+		}
+	} else if (sptr[1] == '&') {	/* literal & */
+		sptr++;
+		*pb++ = *sptr++;
+	} else				/* literal \ */
+		*pb++ = *sptr++;
+
+	*pb_ptr = pb;
+	*sptr_ptr = sptr;
+}
