Fix `*' matches any string, including the null string as e.g.

   T=""
   echo ">${T//*/ }<"

had not worked,, that is return string "> <"

---
 lib/glob/gmisc.c |    4 ++--
 subst.c          |   20 +++++++++++++++++---
 2 files changed, 19 insertions(+), 5 deletions(-)

--- subst.c
+++ subst.c	2018-09-24 10:46:21.913346656 +0000
@@ -4396,7 +4396,7 @@ match_pattern (string, pat, mtype, sp, e
   size_t slen, plen, mslen, mplen;
 #endif
 
-  if (string == 0 || *string == 0 || pat == 0 || *pat == 0)
+  if (string == 0 || pat == 0 || *pat == 0)
     return (0);
 
 #if defined (HANDLE_MULTIBYTE)
@@ -6453,6 +6453,7 @@ get_var_and_type (varname, value, ind, q
     {
       if (value && vtype == VT_VARIABLE)
 	{
+	  *varp = find_variable (vname);
 	  if (quoted & (Q_DOUBLE_QUOTES|Q_HERE_DOCUMENT))
 	    *valp = dequote_string (value);
 	  else
@@ -6642,6 +6643,8 @@ pat_subst (string, pat, rep, mflags)
    *	    with REP and return the result.
    *	2.  A null pattern with mtype == MATCH_END means to append REP to
    *	    STRING and return the result.
+   *	3.  A null STRING with a matching pattern means to append REP to
+   *	    STRING and return the result.
    * These don't understand or process `&' in the replacement string.
    */
   if ((pat == 0 || *pat == 0) && (mtype == MATCH_BEG || mtype == MATCH_END))
@@ -6663,17 +6666,27 @@ pat_subst (string, pat, rep, mflags)
 	}
       return (ret);
     }
+  else if (*string == 0 && (match_pattern (string, pat, mtype, &s, &e) != 0))
+    {
+      replen = STRLEN (rep);
+      ret = (char *)xmalloc (replen + 1);
+      if (replen == 0)
+	ret[0] = '\0';
+      else
+	strcpy (ret, rep);
+      return (ret);
+    }
 
   ret = (char *)xmalloc (rsize = 64);
   ret[0] = '\0';
 
-  for (replen = STRLEN (rep), rptr = 0, str = string;;)
+  for (replen = STRLEN (rep), rptr = 0, str = string; *str;)
     {
       if (match_pattern (str, pat, mtype, &s, &e) == 0)
 	break;
       l = s - str;
 
-      if (rxpand)
+      if (rep && rxpand)
         {
           int x;
           mlen = e - s;
@@ -6682,6 +6695,7 @@ pat_subst (string, pat, rep, mflags)
 	    mstr[x] = s[x];
           mstr[mlen] = '\0';
           rstr = strcreplace (rep, '&', mstr, 0);
+	  free (mstr);
           rslen = strlen (rstr);
         }
       else
--- lib/glob/gmisc.c
+++ lib/glob/gmisc.c	2018-09-24 10:46:30.673185840 +0000
@@ -53,7 +53,7 @@ match_pattern_wchar (wpat, wstring)
   wchar_t wc;
 
   if (*wstring == 0)
-    return (0);
+    return (*wpat == L'*');	/* XXX - allow only * to match empty string */
 
   switch (wc = *wpat++)
     {
@@ -230,7 +230,7 @@ match_pattern_char (pat, string)
   char c;
 
   if (*string == 0)
-    return (0);
+    return (*pat == '*');	/* XXX - allow only * to match empty string */
 
   switch (c = *pat++)
     {