ash: parser: Only accept single-digit parameter expansion outside of braces

Upstream commit:

    Date: Mon, 27 May 2019 13:39:37 +0800
    parser: Only accept single-digit parameter expansion outside of braces

    This patch should fix the problem.

    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

shell/ash.c

@@ -12602,7 +12602,7 @@ parsesub: {
 			do {
 				STPUTC(c, out);
 				c = pgetc_eatbnl();
-			} while (isdigit(c));
+			} while (!subtype && isdigit(c));
 		} else if (c != '}') {
 			/* $[{[#]]<specialchar>[}] */
 			int cc = c;