ash: error out on ${#1#}, ${#$11}, ${#11#}

Signed-off-by: Cristian Ionescu-Idbohrn <cristian.ionescu-idbohrn@axis.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
diff --git a/shell/ash.c b/shell/ash.c
index 9f1f8a4..44d3a99 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -11291,6 +11291,8 @@
  badsub:
 			raise_error_syntax("bad substitution");
 		}
+		if (c != '}' && subtype == VSLENGTH)
+			goto badsub;
 
 		STPUTC('=', out);
 		flags = 0;