Merge branch 'busybox' into merge

104 files changed, 1482 insertions, 958 deletions

diff --git a/Config.in b/Config.in
index 4697f2a4d..10d8382a5 100644
--- a/Config.in
+++ b/Config.in
@@ -590,6 +590,14 @@ config USE_PORTABLE_CODE
         compiler other than gcc.
         If you do use gcc, this option may needlessly increase code size.
 
+config STACK_OPTIMIZATION_386
+        bool "Use -mpreferred-stack-boundary=2 on i386 arch"
+        default y
+        help
+        This option makes for smaller code, but some libc versions
+        do not work with it (they use SSE instructions without
+        ensuring stack alignment).
+
 comment 'Installation Options ("make install" behavior)'
 
 choice
diff --git a/arch/i386/Makefile b/arch/i386/Makefile
index e6c99c67d..425361fd9 100644
--- a/arch/i386/Makefile
+++ b/arch/i386/Makefile
@@ -2,6 +2,12 @@
 # Build system
 # ==========================================================================
 
+# Allow i486 insns (basically, bswap insn)
+# Do not try to tune for 486+ (might add padding)
+CFLAGS += $(call cc-option,-march=i486 -mtune=i386,)
+
+ifeq ($(CONFIG_STACK_OPTIMIZATION_386),y)
 # -mpreferred-stack-boundary=2 is essential in preventing gcc 4.2.x
 # from aligning stack to 16 bytes. (Which is gcc's way of supporting SSE).
-CFLAGS += $(call cc-option,-march=i386 -mpreferred-stack-boundary=2,)
+CFLAGS += $(call cc-option,-mpreferred-stack-boundary=2,)
+endif
diff --git a/archival/libarchive/decompress_bunzip2.c b/archival/libarchive/decompress_bunzip2.c
index bec89edd3..7ef4e035f 100644
--- a/archival/libarchive/decompress_bunzip2.c
+++ b/archival/libarchive/decompress_bunzip2.c
@@ -100,7 +100,7 @@ struct bunzip_data {
         unsigned dbufSize;
 
         /* For I/O error handling */
-        jmp_buf jmpbuf;
+        jmp_buf *jmpbuf;
 
         /* Big things go last (register-relative addressing can be larger for big offsets) */
         uint32_t crc32Table[256];
@@ -127,7 +127,7 @@ static unsigned get_bits(bunzip_data *bd, int bits_wanted)
                         /* if "no input fd" case: in_fd == -1, read fails, we jump */
                         bd->inbufCount = read(bd->in_fd, bd->inbuf, IOBUF_SIZE);
                         if (bd->inbufCount <= 0)
-                                longjmp(bd->jmpbuf, RETVAL_UNEXPECTED_INPUT_EOF);
+                                longjmp(*bd->jmpbuf, RETVAL_UNEXPECTED_INPUT_EOF);
                         bd->inbufPos = 0;
                 }
 
@@ -151,12 +151,12 @@ static unsigned get_bits(bunzip_data *bd, int bits_wanted)
 
         return bits;
 }
+//#define get_bits(bd, n) (dbg("%d:get_bits()", __LINE__), get_bits(bd, n))
 
 /* Unpacks the next block and sets up for the inverse Burrows-Wheeler step. */
 static int get_next_block(bunzip_data *bd)
 {
-        struct group_data *hufGroup;
-        int groupCount, *base, *limit, selector,
+        int groupCount, selector,
                 i, j, symCount, symTotal, nSelectors, byteCount[256];
         uint8_t uc, symToByte[256], mtfSymbol[256], *selectors;
         uint32_t *dbuf;
@@ -179,15 +179,19 @@ static int get_next_block(bunzip_data *bd)
         i = get_bits(bd, 24);
         j = get_bits(bd, 24);
         bd->headerCRC = get_bits(bd, 32);
-        if ((i == 0x177245) && (j == 0x385090)) return RETVAL_LAST_BLOCK;
-        if ((i != 0x314159) || (j != 0x265359)) return RETVAL_NOT_BZIP_DATA;
+        if ((i == 0x177245) && (j == 0x385090))
+                return RETVAL_LAST_BLOCK;
+        if ((i != 0x314159) || (j != 0x265359))
+                return RETVAL_NOT_BZIP_DATA;
 
         /* We can add support for blockRandomised if anybody complains.  There was
            some code for this in busybox 1.0.0-pre3, but nobody ever noticed that
            it didn't actually work. */
-        if (get_bits(bd, 1)) return RETVAL_OBSOLETE_INPUT;
+        if (get_bits(bd, 1))
+                return RETVAL_OBSOLETE_INPUT;
         origPtr = get_bits(bd, 24);
-        if (origPtr > bd->dbufSize) return RETVAL_DATA_ERROR;
+        if (origPtr > bd->dbufSize)
+                return RETVAL_DATA_ERROR;
 
         /* mapping table: if some byte values are never used (encoding things
            like ascii text), the compression code removes the gaps to have fewer
@@ -231,13 +235,21 @@ static int get_next_block(bunzip_data *bd)
                 /* Get next value */
                 int n = 0;
                 while (get_bits(bd, 1)) {
-                        if (n >= groupCount) return RETVAL_DATA_ERROR;
+                        if (n >= groupCount)
+                                return RETVAL_DATA_ERROR;
                         n++;
                 }
                 /* Decode MTF to get the next selector */
                 tmp_byte = mtfSymbol[n];
                 while (--n >= 0)
                         mtfSymbol[n + 1] = mtfSymbol[n];
+//We catch it later, in the second loop where we use selectors[i].
+//Maybe this is a better place, though?
+//              if (tmp_byte >= groupCount) {
+//                      dbg("%d: selectors[%d]:%d groupCount:%d",
+//                                      __LINE__, i, tmp_byte, groupCount);
+//                      return RETVAL_DATA_ERROR;
+//              }
                 mtfSymbol[0] = selectors[i] = tmp_byte;
         }
 
@@ -248,6 +260,8 @@ static int get_next_block(bunzip_data *bd)
                 uint8_t length[MAX_SYMBOLS];
                 /* 8 bits is ALMOST enough for temp[], see below */
                 unsigned temp[MAX_HUFCODE_BITS+1];
+                struct group_data *hufGroup;
+                int *base, *limit;
                 int minLen, maxLen, pp, len_m1;
 
                 /* Read Huffman code lengths for each symbol.  They're stored in
@@ -283,8 +297,10 @@ static int get_next_block(bunzip_data *bd)
                 /* Find largest and smallest lengths in this group */
                 minLen = maxLen = length[0];
                 for (i = 1; i < symCount; i++) {
-                        if (length[i] > maxLen) maxLen = length[i];
-                        else if (length[i] < minLen) minLen = length[i];
+                        if (length[i] > maxLen)
+                                maxLen = length[i];
+                        else if (length[i] < minLen)
+                                minLen = length[i];
                 }
 
                 /* Calculate permute[], base[], and limit[] tables from length[].
@@ -320,7 +336,8 @@ static int get_next_block(bunzip_data *bd)
                 /* Count symbols coded for at each bit length */
                 /* NB: in pathological cases, temp[8] can end ip being 256.
                  * That's why uint8_t is too small for temp[]. */
-                for (i = 0; i < symCount; i++) temp[length[i]]++;
+                for (i = 0; i < symCount; i++)
+                        temp[length[i]]++;
 
                 /* Calculate limit[] (the largest symbol-coding value at each bit
                  * length, which is (previous limit<<1)+symbols at this level), and
@@ -363,12 +380,22 @@ static int get_next_block(bunzip_data *bd)
 
         runPos = dbufCount = selector = 0;
         for (;;) {
+                struct group_data *hufGroup;
+                int *base, *limit;
                 int nextSym;
+                uint8_t ngrp;
 
                 /* Fetch next Huffman coding group from list. */
                 symCount = GROUP_SIZE - 1;
-                if (selector >= nSelectors) return RETVAL_DATA_ERROR;
-                hufGroup = bd->groups + selectors[selector++];
+                if (selector >= nSelectors)
+                        return RETVAL_DATA_ERROR;
+                ngrp = selectors[selector++];
+                if (ngrp >= groupCount) {
+                        dbg("%d selectors[%d]:%d groupCount:%d",
+                                __LINE__, selector-1, ngrp, groupCount);
+                        return RETVAL_DATA_ERROR;
+                }
+                hufGroup = bd->groups + ngrp;
                 base = hufGroup->base - 1;
                 limit = hufGroup->limit - 1;
 
@@ -403,7 +430,8 @@ static int get_next_block(bunzip_data *bd)
                 }
                 /* Figure how many bits are in next symbol and unget extras */
                 i = hufGroup->minLen;
-                while (nextSym > limit[i]) ++i;
+                while (nextSym > limit[i])
+                        ++i;
                 j = hufGroup->maxLen - i;
                 if (j < 0)
                         return RETVAL_DATA_ERROR;
@@ -671,7 +699,10 @@ int FAST_FUNC read_bunzip(bunzip_data *bd, char *outbuf, int len)
 /* Because bunzip2 is used for help text unpacking, and because bb_show_usage()
    should work for NOFORK applets too, we must be extremely careful to not leak
    any allocations! */
-int FAST_FUNC start_bunzip(bunzip_data **bdp, int in_fd,
+int FAST_FUNC start_bunzip(
+                void *jmpbuf,
+                bunzip_data **bdp,
+                int in_fd,
                 const void *inbuf, int len)
 {
         bunzip_data *bd;
@@ -683,11 +714,14 @@ int FAST_FUNC start_bunzip(bunzip_data **bdp, int in_fd,
 
         /* Figure out how much data to allocate */
         i = sizeof(bunzip_data);
-        if (in_fd != -1) i += IOBUF_SIZE;
+        if (in_fd != -1)
+                i += IOBUF_SIZE;
 
         /* Allocate bunzip_data.  Most fields initialize to zero. */
         bd = *bdp = xzalloc(i);
 
+        bd->jmpbuf = jmpbuf;
+
         /* Setup input buffer */
         bd->in_fd = in_fd;
         if (-1 == in_fd) {
@@ -702,10 +736,6 @@ int FAST_FUNC start_bunzip(bunzip_data **bdp, int in_fd,
         /* Init the CRC32 table (big endian) */
         crc32_filltable(bd->crc32Table, 1);
 
-        /* Setup for I/O error handling via longjmp */
-        i = setjmp(bd->jmpbuf);
-        if (i) return i;
-
         /* Ensure that file starts with "BZh['1'-'9']." */
         /* Update: now caller verifies 1st two bytes, makes .gz/.bz2
          * integration easier */
@@ -752,8 +782,12 @@ unpack_bz2_stream(transformer_state_t *xstate)
         outbuf = xmalloc(IOBUF_SIZE);
         len = 0;
         while (1) { /* "Process one BZ... stream" loop */
+                jmp_buf jmpbuf;
 
-                i = start_bunzip(&bd, xstate->src_fd, outbuf + 2, len);
+                /* Setup for I/O error handling via longjmp */
+                i = setjmp(jmpbuf);
+                if (i == 0)
+                        i = start_bunzip(&jmpbuf, &bd, xstate->src_fd, outbuf + 2, len);
 
                 if (i == 0) {
                         while (1) { /* "Produce some output bytes" loop */
diff --git a/archival/libarchive/decompress_gunzip.c b/archival/libarchive/decompress_gunzip.c
index 7483a2cea..32fcb6b51 100644
--- a/archival/libarchive/decompress_gunzip.c
+++ b/archival/libarchive/decompress_gunzip.c
@@ -32,7 +32,6 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
-#include <setjmp.h>
 #include "libbb.h"
 #include "bb_archive.h"
 
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c
index be4342414..80a453806 100644
--- a/archival/libarchive/decompress_unlzma.c
+++ b/archival/libarchive/decompress_unlzma.c
@@ -11,6 +11,13 @@
 #include "libbb.h"
 #include "bb_archive.h"
 
+#if 0
+# define dbg(...) bb_error_msg(__VA_ARGS__)
+#else
+# define dbg(...) ((void)0)
+#endif
+
+
 #if ENABLE_FEATURE_LZMA_FAST
 #  define speed_inline ALWAYS_INLINE
 #  define size_inline
@@ -417,6 +424,10 @@ unpack_lzma_stream(transformer_state_t *xstate)
                                                 for (; num_bits2 != LZMA_NUM_ALIGN_BITS; num_bits2--)
                                                         rep0 = (rep0 << 1) | rc_direct_bit(rc);
                                                 rep0 <<= LZMA_NUM_ALIGN_BITS;
+                                                if ((int32_t)rep0 < 0) {
+                                                        dbg("%d rep0:%d", __LINE__, rep0);
+                                                        goto bad;
+                                                }
                                                 prob3 = p + LZMA_ALIGN;
                                         }
                                         i2 = 1;
diff --git a/archival/lzop.c b/archival/lzop.c
index fef8cdba3..8f604254c 100644
--- a/archival/lzop.c
+++ b/archival/lzop.c
@@ -438,36 +438,33 @@ typedef struct chksum_t {
 } chksum_t;
 
 typedef struct header_t {
-        unsigned version;
-        unsigned lib_version;
-        unsigned version_needed_to_extract;
-        uint32_t flags;
-        uint32_t mode;
-        uint32_t mtime;
-        uint32_t gmtdiff;
-        uint32_t header_checksum;
-
-        uint32_t extra_field_len;
-        uint32_t extra_field_checksum;
-
-        unsigned char method;
-        unsigned char level;
-
-        /* info */
-        char name[255+1];
+        /* used to have auxiliary fields here */
+
+        /* Starting from here, the layout and endianness
+         * are exactly in on-disk format.
+         */
+        uint16_t version_be16;
+        uint16_t lib_version_be16;
+        uint16_t version_needed_to_extract_be16;
+        uint8_t  method;
+        uint8_t  level;
+        uint32_t flags32; /* be32 on disk, but we keep this field in native order */
+        uint32_t mode_be32;
+        uint32_t mtime_be32;
+        uint32_t gmtdiff_be32;
+        char     len_and_name[1+255+1];
 } header_t;
 
 struct globals {
         /*const uint32_t *lzo_crc32_table;*/
-        chksum_t chksum_in;
-        chksum_t chksum_out;
+        chksum_t chksum;
 } FIX_ALIASING;
 #define G (*(struct globals*)bb_common_bufsiz1)
-#define INIT_G() do { setup_common_bufsiz(); } while (0)
 //#define G (*ptr_to_globals)
-//#define INIT_G() do {
-//      SET_PTR_TO_GLOBALS(xzalloc(sizeof(G)));
-//} while (0)
+#define INIT_G() do { \
+        setup_common_bufsiz(); \
+        /*SET_PTR_TO_GLOBALS(xzalloc(sizeof(G)));*/ \
+} while (0)
 
 
 /**********************************************************************/
@@ -548,24 +545,24 @@ lzo_crc32(uint32_t c, const uint8_t* buf, unsigned len)
 }
 
 /**********************************************************************/
-static void init_chksum(chksum_t *ct)
+static void init_chksum(void)
 {
-        ct->f_adler32 = ADLER32_INIT_VALUE;
-        ct->f_crc32 = CRC32_INIT_VALUE;
+        G.chksum.f_adler32 = ADLER32_INIT_VALUE;
+        G.chksum.f_crc32 = CRC32_INIT_VALUE;
 }
 
-static void add_bytes_to_chksum(chksum_t *ct, const void* buf, int cnt)
+static void add_bytes_to_chksum(const void* buf, int cnt)
 {
         /* We need to handle the two checksums at once, because at the
          * beginning of the header, we don't know yet which one we'll
          * eventually need */
-        ct->f_adler32 = lzo_adler32(ct->f_adler32, (const uint8_t*)buf, cnt);
-        ct->f_crc32 = lzo_crc32(ct->f_crc32, (const uint8_t*)buf, cnt);
+        G.chksum.f_adler32 = lzo_adler32(G.chksum.f_adler32, (const uint8_t*)buf, cnt);
+        G.chksum.f_crc32 = lzo_crc32(G.chksum.f_crc32, (const uint8_t*)buf, cnt);
 }
 
-static uint32_t chksum_getresult(chksum_t *ct, const header_t *h)
+static uint32_t chksum_getresult(uint32_t h_flags32)
 {
-        return (h->flags & F_H_CRC32) ? ct->f_crc32 : ct->f_adler32;
+        return (h_flags32 & F_H_CRC32) ? G.chksum.f_crc32 : G.chksum.f_adler32;
 }
 
 /**********************************************************************/
@@ -575,50 +572,23 @@ static uint32_t read32(void)
         xread(0, &v, 4);
         return ntohl(v);
 }
-
-static void write32(uint32_t v)
-{
-        v = htonl(v);
-        xwrite(1, &v, 4);
-}
-
-static void f_write(const void* buf, int cnt)
-{
-        xwrite(1, buf, cnt);
-        add_bytes_to_chksum(&G.chksum_out, buf, cnt);
-}
-
 static void f_read(void* buf, int cnt)
 {
         xread(0, buf, cnt);
-        add_bytes_to_chksum(&G.chksum_in, buf, cnt);
+        add_bytes_to_chksum(buf, cnt);
 }
-
-static int f_read8(void)
-{
-        uint8_t v;
-        f_read(&v, 1);
-        return v;
-}
-
-static void f_write8(uint8_t v)
-{
-        f_write(&v, 1);
-}
-
-static unsigned f_read16(void)
-{
-        uint16_t v;
-        f_read(&v, 2);
-        return ntohs(v);
-}
-
-static void f_write16(uint16_t v)
-{
-        v = htons(v);
-        f_write(&v, 2);
-}
-
+//static int f_read8(void)
+//{
+//      uint8_t v;
+//      f_read(&v, 1);
+//      return v;
+//}
+//static unsigned f_read16(void)
+//{
+//      uint16_t v;
+//      f_read(&v, 2);
+//      return ntohs(v);
+//}
 static uint32_t f_read32(void)
 {
         uint32_t v;
@@ -626,34 +596,30 @@ static uint32_t f_read32(void)
         return ntohl(v);
 }
 
-static void f_write32(uint32_t v)
+static void write32(uint32_t v)
 {
         v = htonl(v);
-        f_write(&v, 4);
+        xwrite(1, &v, 4);
 }
-
-/**********************************************************************/
-static int lzo_get_method(header_t *h)
+static void f_write(const void* buf, int cnt)
 {
-        /* check method */
-        if (h->method == M_LZO1X_1) {
-                if (h->level == 0)
-                        h->level = 3;
-        } else if (h->method == M_LZO1X_1_15) {
-                if (h->level == 0)
-                        h->level = 1;
-        } else if (h->method == M_LZO1X_999) {
-                if (h->level == 0)
-                        h->level = 9;
-        } else
-                return -1;              /* not a LZO method */
-
-        /* check compression level */
-        if (h->level < 1 || h->level > 9)
-                return 15;
-
-        return 0;
+        xwrite(1, buf, cnt);
+        add_bytes_to_chksum(buf, cnt);
 }
+//static void f_write8(uint8_t v)
+//{
+//      f_write(&v, 1);
+//}
+//static void f_write16(uint16_t v)
+//{
+//      v = htons(v);
+//      f_write(&v, 2);
+//}
+//static void f_write32(uint32_t v)
+//{
+//      v = htonl(v);
+//      f_write(&v, 4);
+//}
 
 /**********************************************************************/
 #define LZO_BLOCK_SIZE  (256 * 1024l)
@@ -671,52 +637,61 @@ static NOINLINE int lzo_compress(const header_t *h)
         int r = 0; /* LZO_E_OK */
         uint8_t *const b1 = xzalloc(block_size);
         uint8_t *const b2 = xzalloc(MAX_COMPRESSED_SIZE(block_size));
-        unsigned src_len = 0, dst_len = 0;
         uint32_t d_adler32 = ADLER32_INIT_VALUE;
         uint32_t d_crc32 = CRC32_INIT_VALUE;
-        int l;
         uint8_t *wrk_mem = NULL;
 
+        /* Only these methods are possible, see lzo_set_method():
+         * -1:    M_LZO1X_1_15
+         * -2..6: M_LZO1X_1
+         * -7..9: M_LZO1X_999 if ENABLE_LZOP_COMPR_HIGH
+         */
         if (h->method == M_LZO1X_1)
                 wrk_mem = xzalloc(LZO1X_1_MEM_COMPRESS);
-        else if (h->method == M_LZO1X_1_15)
-                wrk_mem = xzalloc(LZO1X_1_15_MEM_COMPRESS);
-        else if (h->method == M_LZO1X_999)
+        else /* check only if it's not the only possibility */
+                IF_LZOP_COMPR_HIGH(if (h->method == M_LZO1X_1_15))
+                        wrk_mem = xzalloc(LZO1X_1_15_MEM_COMPRESS);
+#if ENABLE_LZOP_COMPR_HIGH
+        else /* must be h->method == M_LZO1X_999 */
                 wrk_mem = xzalloc(LZO1X_999_MEM_COMPRESS);
+#endif
 
         for (;;) {
+                unsigned src_len, dst_len;
+                int l;
+                uint32_t wordbuf[6];
+                uint32_t *wordptr = wordbuf;
+
                 /* read a block */
                 l = full_read(0, b1, block_size);
                 src_len = (l > 0 ? l : 0);
 
                 /* write uncompressed block size */
-                write32(src_len);
-
                 /* exit if last block */
-                if (src_len == 0)
+                if (src_len == 0) {
+                        write32(0);
                         break;
+                }
+                *wordptr++ = htonl(src_len);
 
                 /* compute checksum of uncompressed block */
-                if (h->flags & F_ADLER32_D)
+                if (h->flags32 & F_ADLER32_D)
                         d_adler32 = lzo_adler32(ADLER32_INIT_VALUE, b1, src_len);
-                if (h->flags & F_CRC32_D)
+                if (h->flags32 & F_CRC32_D)
                         d_crc32 = lzo_crc32(CRC32_INIT_VALUE, b1, src_len);
 
                 /* compress */
                 if (h->method == M_LZO1X_1)
                         r = lzo1x_1_compress(b1, src_len, b2, &dst_len, wrk_mem);
-                else if (h->method == M_LZO1X_1_15)
+                else IF_LZOP_COMPR_HIGH(if (h->method == M_LZO1X_1_15))
                         r = lzo1x_1_15_compress(b1, src_len, b2, &dst_len, wrk_mem);
 #if ENABLE_LZOP_COMPR_HIGH
-                else if (h->method == M_LZO1X_999)
+                else /* must be h->method == M_LZO1X_999 */
                         r = lzo1x_999_compress_level(b1, src_len, b2, &dst_len,
                                                 wrk_mem, h->level);
 #endif
-                else
-                        bb_error_msg_and_die("internal error");
-
                 if (r != 0) /* not LZO_E_OK */
-                        bb_error_msg_and_die("internal error - compression failed");
+                        bb_error_msg_and_die("%s: %s", "internal error", "compression");
 
                 /* write compressed block size */
                 if (dst_len < src_len) {
@@ -725,32 +700,38 @@ static NOINLINE int lzo_compress(const header_t *h)
                                 unsigned new_len = src_len;
                                 r = lzo1x_optimize(b2, dst_len, b1, &new_len /*, NULL*/);
                                 if (r != 0 /*LZO_E_OK*/ || new_len != src_len)
-                                        bb_error_msg_and_die("internal error - optimization failed");
+                                        bb_error_msg_and_die("%s: %s", "internal error", "optimization");
                         }
-                        write32(dst_len);
+                        *wordptr++ = htonl(dst_len);
                 } else {
                         /* data actually expanded => store data uncompressed */
-                        write32(src_len);
+                        *wordptr++ = htonl(src_len);
                 }
 
                 /* write checksum of uncompressed block */
-                if (h->flags & F_ADLER32_D)
-                        write32(d_adler32);
-                if (h->flags & F_CRC32_D)
-                        write32(d_crc32);
+                if (h->flags32 & F_ADLER32_D)
+                        *wordptr++ = htonl(d_adler32);
+                if (h->flags32 & F_CRC32_D)
+                        *wordptr++ = htonl(d_crc32);
 
                 if (dst_len < src_len) {
                         /* write checksum of compressed block */
-                        if (h->flags & F_ADLER32_C)
-                                write32(lzo_adler32(ADLER32_INIT_VALUE, b2, dst_len));
-                        if (h->flags & F_CRC32_C)
-                                write32(lzo_crc32(CRC32_INIT_VALUE, b2, dst_len));
+                        if (h->flags32 & F_ADLER32_C)
+                                *wordptr++ = htonl(lzo_adler32(ADLER32_INIT_VALUE, b2, dst_len));
+                        if (h->flags32 & F_CRC32_C)
+                                *wordptr++ = htonl(lzo_crc32(CRC32_INIT_VALUE, b2, dst_len));
+                }
+                xwrite(1, wordbuf, ((char*)wordptr) - ((char*)wordbuf));
+                if (dst_len < src_len) {
                         /* write compressed block data */
                         xwrite(1, b2, dst_len);
                 } else {
                         /* write uncompressed block data */
                         xwrite(1, b1, src_len);
                 }
+                // /* if full_read() was nevertheless "short", it was EOF */
+                // if (src_len < block_size)
+                //      break;
         }
 
         free(wrk_mem);
@@ -777,7 +758,9 @@ static FAST_FUNC void lzo_check(
 /**********************************************************************/
 // decompress a file
 /**********************************************************************/
-static NOINLINE int lzo_decompress(const header_t *h)
+// used to have "const header_t *h" parameter, but since it uses
+// only flags32 field, changed to receive only that.
+static NOINLINE int lzo_decompress(uint32_t h_flags32)
 {
         unsigned block_size = LZO_BLOCK_SIZE;
         int r;
@@ -822,16 +805,16 @@ static NOINLINE int lzo_decompress(const header_t *h)
                 }
 
                 /* read checksum of uncompressed block */
-                if (h->flags & F_ADLER32_D)
+                if (h_flags32 & F_ADLER32_D)
                         d_adler32 = read32();
-                if (h->flags & F_CRC32_D)
+                if (h_flags32 & F_CRC32_D)
                         d_crc32 = read32();
 
                 /* read checksum of compressed block */
                 if (src_len < dst_len) {
-                        if (h->flags & F_ADLER32_C)
+                        if (h_flags32 & F_ADLER32_C)
                                 c_adler32 = read32();
-                        if (h->flags & F_CRC32_C)
+                        if (h_flags32 & F_CRC32_C)
                                 c_crc32 = read32();
                 }
 
@@ -846,11 +829,11 @@ static NOINLINE int lzo_decompress(const header_t *h)
 
                         if (!(option_mask32 & OPT_F)) {
                                 /* verify checksum of compressed block */
-                                if (h->flags & F_ADLER32_C)
+                                if (h_flags32 & F_ADLER32_C)
                                         lzo_check(ADLER32_INIT_VALUE,
                                                         b1, src_len,
                                                         lzo_adler32, c_adler32);
-                                if (h->flags & F_CRC32_C)
+                                if (h_flags32 & F_CRC32_C)
                                         lzo_check(CRC32_INIT_VALUE,
                                                         b1, src_len,
                                                         lzo_crc32, c_crc32);
@@ -873,11 +856,11 @@ static NOINLINE int lzo_decompress(const header_t *h)
 
                 if (!(option_mask32 & OPT_F)) {
                         /* verify checksum of uncompressed block */
-                        if (h->flags & F_ADLER32_D)
+                        if (h_flags32 & F_ADLER32_D)
                                 lzo_check(ADLER32_INIT_VALUE,
                                         dst, dst_len,
                                         lzo_adler32, d_adler32);
-                        if (h->flags & F_CRC32_D)
+                        if (h_flags32 & F_CRC32_D)
                                 lzo_check(CRC32_INIT_VALUE,
                                         dst, dst_len,
                                         lzo_crc32, d_crc32);
@@ -917,7 +900,7 @@ static NOINLINE int lzo_decompress(const header_t *h)
  * -00000020  00 00 2d 67 04 17 00 04 00 00 00 03 ed ec 9d 6d
  * +00000020  00 00 10 5f 00 c1 00 04 00 00 00 03 ed ec 9d 6d
  *                  ^^^^^^^^^^^
- *                  chksum_out
+ *                  chksum
  * The rest is identical.
 */
 static const unsigned char lzop_magic[9] ALIGN1 = {
@@ -936,138 +919,138 @@ static void check_magic(void)
 /**********************************************************************/
 // lzop file header
 /**********************************************************************/
-static void write_header(const header_t *h)
+static void write_header(header_t *h)
 {
-        int l;
+        char *end;
 
         xwrite(1, lzop_magic, sizeof(lzop_magic));
 
-        init_chksum(&G.chksum_out);
+        init_chksum();
 
-        f_write16(h->version);
-        f_write16(h->lib_version);
-        f_write16(h->version_needed_to_extract);
-        f_write8(h->method);
-        f_write8(h->level);
-        f_write32(h->flags);
-        f_write32(h->mode);
-        f_write32(h->mtime);
-        f_write32(h->gmtdiff);
+        /* Our caller leaves name zero-filled, so len == 0 */
+        end = h->len_and_name+1 + 0; /* 0 is strlen(h->len_and_name+1) */
+        /* Store length byte */
+        /*h->len_and_name[0] = end - (h->len_and_name+1); - zero already */
 
-        l = (int) strlen(h->name);
-        f_write8(l);
-        if (l)
-                f_write(h->name, l);
+        f_write(&h->version_be16, end - (char*)&h->version_be16);
 
-        f_write32(chksum_getresult(&G.chksum_out, h));
+        h->flags32 = htonl(h->flags32); /* native endianness for lzo_compress() */
+
+        write32(chksum_getresult(h->flags32));
 }
 
 static int read_header(header_t *h)
 {
-        int r;
         int l;
         uint32_t checksum;
+        /* As it stands now, only h->flags32 is used by our caller.
+         * Therefore we don't store many fields in h->FIELD.
+         */
+        unsigned h_version;
+        unsigned h_version_needed_to_extract;
 
-        memset(h, 0, sizeof(*h));
-        h->version_needed_to_extract = 0x0900;  /* first lzop version */
-        h->level = 0;
-
-        init_chksum(&G.chksum_in);
+        init_chksum();
 
-        h->version = f_read16();
-        if (h->version < 0x0900)
-                return 3;
-        h->lib_version = f_read16();
-        if (h->version >= 0x0940) {
-                h->version_needed_to_extract = f_read16();
-                if (h->version_needed_to_extract > LZOP_VERSION)
-                        return 16;
-                if (h->version_needed_to_extract < 0x0900)
-                        return 3;
-        }
-        h->method = f_read8();
-        if (h->version >= 0x0940)
-                h->level = f_read8();
-        h->flags = f_read32();
-        if (h->flags & F_H_FILTER)
-                return 16; /* filter not supported */
-        h->mode = f_read32();
-        h->mtime = f_read32();
-        if (h->version >= 0x0940)
-                h->gmtdiff = f_read32();
+        /* We don't support versions < 0.94, since 0.94
+         * came only 2 months after 0.90:
+         * 0.90 (10 Aug 1997): First public release of lzop
+         * 0.94 (15 Oct 1997): Header format change
+         */
 
-        l = f_read8();
-        if (l > 0)
-                f_read(h->name, l);
-        h->name[l] = 0;
+        /* Read up to and including name length byte */
+        f_read(&h->version_be16, ((char*)&h->len_and_name[1]) - ((char*)&h->version_be16));
 
-        checksum = chksum_getresult(&G.chksum_in, h);
-        h->header_checksum = f_read32();
-        if (h->header_checksum != checksum)
-                return 2;
+        h_version = htons(h->version_be16);
+        if (h_version < 0x0940)
+                return 3;
+        h_version_needed_to_extract = htons(h->version_needed_to_extract_be16);
+        if (h_version_needed_to_extract > LZOP_VERSION)
+                return 16;
+        if (h_version_needed_to_extract < 0x0940)
+                return 3;
 
         if (h->method <= 0)
                 return 14;
-        r = lzo_get_method(h);
-        if (r != 0)
-                return r;
 
+        /* former lzo_get_method(h): */
+        if (h->method == M_LZO1X_1) {
+                if (h->level == 0)
+                        h->level = 3;
+        } else if (h->method == M_LZO1X_1_15) {
+                if (h->level == 0)
+                        h->level = 1;
+        } else if (h->method == M_LZO1X_999) {
+                if (h->level == 0)
+                        h->level = 9;
+        } else
+                return -1; /* not a LZO method */
+        /* check compression level */
+        if (h->level < 1 || h->level > 9)
+                return 15;
+
+        h->flags32 = ntohl(h->flags32);
+        if (h->flags32 & F_H_FILTER)
+                return 16; /* filter not supported */
         /* check reserved flags */
-        if (h->flags & F_RESERVED)
+        if (h->flags32 & F_RESERVED)
                 return -13;
 
+        l = h->len_and_name[0];
+        if (l > 0)
+                /* UNUSED */ f_read(h->len_and_name+1, l);
+        /* UNUSED h->len_and_name[1+l] = 0; */
+
+        checksum = chksum_getresult(h->flags32);
+        if (read32() != checksum)
+                return 2;
+
         /* skip extra field [not used yet] */
-        if (h->flags & F_H_EXTRA_FIELD) {
+        if (h->flags32 & F_H_EXTRA_FIELD) {
+                uint32_t extra_field_len;
+                uint32_t extra_field_checksum;
                 uint32_t k;
+                char dummy;
 
                 /* note: the checksum also covers the length */
-                init_chksum(&G.chksum_in);
-                h->extra_field_len = f_read32();
-                for (k = 0; k < h->extra_field_len; k++)
-                        f_read8();
-                checksum = chksum_getresult(&G.chksum_in, h);
-                h->extra_field_checksum = f_read32();
-                if (h->extra_field_checksum != checksum)
+                init_chksum();
+                extra_field_len = f_read32();
+                for (k = 0; k < extra_field_len; k++)
+                        f_read(&dummy, 1);
+                checksum = chksum_getresult(h->flags32);
+                extra_field_checksum = read32();
+                if (extra_field_checksum != checksum)
                         return 3;
         }
 
         return 0;
 }
 
-static void p_header(header_t *h)
-{
-        int r;
-
-        r = read_header(h);
-        if (r == 0)
-                return;
-        bb_error_msg_and_die("header_error %d", r);
-}
-
 /**********************************************************************/
 // compress
 /**********************************************************************/
 static void lzo_set_method(header_t *h)
 {
-        int level = 1;
+        smallint level;
+
+        /* levels 2..6 or none (defaults to level 3) */
+        h->method = M_LZO1X_1;
+        level = 5; /* levels 2-6 are actually the same */
 
         if (option_mask32 & OPT_1) {
                 h->method = M_LZO1X_1_15;
-        } else if (option_mask32 & OPT_789) {
+                level = 1;
+        }
+        if (option_mask32 & OPT_789) {
 #if ENABLE_LZOP_COMPR_HIGH
                 h->method = M_LZO1X_999;
+                level = 9;
                 if (option_mask32 & OPT_7)
                         level = 7;
                 else if (option_mask32 & OPT_8)
                         level = 8;
-                else
-                        level = 9;
 #else
                 bb_error_msg_and_die("high compression not compiled in");
 #endif
-        } else { /* levels 2..6 or none (defaults to level 3) */
-                h->method = M_LZO1X_1;
-                level = 5; /* levels 2-6 are actually the same */
         }
 
         h->level = level;
@@ -1082,18 +1065,21 @@ static int do_lzo_compress(void)
 
         lzo_set_method(h);
 
-        h->version = (LZOP_VERSION & 0xffff);
-        h->version_needed_to_extract = 0x0940;
-        h->lib_version = lzo_version() & 0xffff;
+        h->version_be16 = htons(LZOP_VERSION & 0xffff);
+        h->version_needed_to_extract_be16 = htons(0x0940);
+        h->lib_version_be16 = htons(lzo_version() & 0xffff);
 
-        h->flags = (F_OS & F_OS_MASK) | (F_CS & F_CS_MASK);
+        h->flags32 = htonl((F_OS & F_OS_MASK) | (F_CS & F_CS_MASK));
 
         if (!(option_mask32 & OPT_F) || h->method == M_LZO1X_999) {
-                h->flags |= F_ADLER32_D;
+                h->flags32 |= htonl(F_ADLER32_D);
                 if (option_mask32 & OPT_C)
-                        h->flags |= F_ADLER32_C;
+                        h->flags32 |= htonl(F_ADLER32_C);
         }
+
+        /* write_header() also converts h->flags32 to native endianness */
         write_header(h);
+
         return lzo_compress(h);
 #undef h
 }
@@ -1103,11 +1089,14 @@ static int do_lzo_compress(void)
 /**********************************************************************/
 static int do_lzo_decompress(void)
 {
+        int r;
         header_t header;
 
         check_magic();
-        p_header(&header);
-        return lzo_decompress(&header);
+        r = read_header(&header);
+        if (r != 0)
+                bb_error_msg_and_die("header_error %d", r);
+        return lzo_decompress(header.flags32);
 }
 
 static char* FAST_FUNC make_new_name_lzop(char *filename, const char *expected_ext UNUSED_PARAM)
@@ -1132,6 +1121,8 @@ static IF_DESKTOP(long long) int FAST_FUNC pack_lzop(transformer_state_t *xstate
 int lzop_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int lzop_main(int argc UNUSED_PARAM, char **argv)
 {
+        INIT_G();
+
         getopt32(argv, OPTION_STRING);
         argv += optind;
         /* -U is "anti -k", invert bit for bbunpack(): */
diff --git a/archival/tar.c b/archival/tar.c
index 308ce7701..afd8cfec5 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -799,8 +799,8 @@ static llist_t *append_file_list_to_list(llist_t *list)
 //usage:#define tar_full_usage "\n\n"
 //usage:        IF_FEATURE_TAR_CREATE("Create, extract, ")
 //usage:        IF_NOT_FEATURE_TAR_CREATE("Extract ")
-//usage:        "or list files from a tar file\n"
-//usage:     "\nOperation:"
+//usage:        "or list files from a tar file"
+//usage:     "\n"
 //usage:        IF_FEATURE_TAR_CREATE(
 //usage:     "\n        c       Create"
 //usage:        )
diff --git a/coreutils/mv.c b/coreutils/mv.c
index aeafd1e40..6e11197a1 100644
--- a/coreutils/mv.c
+++ b/coreutils/mv.c
@@ -101,7 +101,7 @@ int mv_main(int argc, char **argv)
                                 if (fprintf(stderr, "mv: overwrite '%s'? ", dest) < 0) {
                                         goto RET_1;  /* Ouch! fprintf failed! */
                                 }
-                                if (!bb_ask_confirmation()) {
+                                if (!bb_ask_y_confirmation()) {
                                         goto RET_0;
                                 }
                         }
diff --git a/coreutils/nice.c b/coreutils/nice.c
index aa8b06cce..da1696c42 100644
--- a/coreutils/nice.c
+++ b/coreutils/nice.c
@@ -22,7 +22,6 @@
 //usage:       "Change scheduling priority, run PROG\n"
 //usage:     "\n        -n ADJUST       Adjust priority by ADJUST"
 
-#include <sys/resource.h>
 #include "libbb.h"
 
 int nice_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
diff --git a/coreutils/sort.c b/coreutils/sort.c
index b39297a26..4d741e76d 100644
--- a/coreutils/sort.c
+++ b/coreutils/sort.c
@@ -18,16 +18,24 @@
 //config:       sort is used to sort lines of text in specified files.
 //config:
 //config:config FEATURE_SORT_BIG
-//config:       bool "Full SuSv3 compliant sort (support -ktcsbdfiozgM)"
+//config:       bool "Full SuSv3 compliant sort (support -ktcbdfiogM)"
 //config:       default y
 //config:       depends on SORT
 //config:       help
-//config:       Without this, sort only supports -r, -u, and an integer version
+//config:       Without this, sort only supports -rusz, and an integer version
 //config:       of -n. Selecting this adds sort keys, floating point support, and
 //config:       more. This adds a little over 3k to a nonstatic build on x86.
 //config:
 //config:       The SuSv3 sort standard is available at:
 //config:       http://www.opengroup.org/onlinepubs/007904975/utilities/sort.html
+//config:
+//config:config FEATURE_SORT_OPTIMIZE_MEMORY
+//config:       bool "Use less memory (but might be slower)"
+//config:       default n   # defaults to N since we are size-paranoid tribe
+//config:       depends on SORT
+//config:       help
+//config:       Attempt to use less memory (by storing only one copy
+//config:       of duplicated lines, and such). Useful if you work on huge files.
 
 //applet:IF_SORT(APPLET_NOEXEC(sort, sort, BB_DIR_USR_BIN, BB_SUID_DROP, sort))
 
@@ -46,26 +54,22 @@
 //usage:     "\n        -f      Ignore case"
 //usage:     "\n        -i      Ignore unprintable characters"
 //usage:     "\n        -d      Dictionary order (blank or alphanumeric only)"
-//usage:     "\n        -g      General numerical sort"
-//usage:     "\n        -M      Sort month"
 //usage:        )
 //-h, --human-numeric-sort: compare human readable numbers (e.g., 2K 1G)
 //usage:     "\n        -n      Sort numbers"
 //usage:        IF_FEATURE_SORT_BIG(
+//usage:     "\n        -g      General numerical sort"
+//usage:     "\n        -M      Sort month"
 //usage:     "\n        -t CHAR Field separator"
 //usage:     "\n        -k N[,M] Sort by Nth field"
 //usage:        )
 //usage:     "\n        -r      Reverse sort order"
-//usage:        IF_FEATURE_SORT_BIG(
 //usage:     "\n        -s      Stable (don't sort ties alphabetically)"
-//usage:        )
 //usage:     "\n        -u      Suppress duplicate lines"
-//usage:        IF_FEATURE_SORT_BIG(
 //usage:     "\n        -z      Lines are terminated by NUL, not newline"
 ///////:     "\n        -m      Ignored for GNU compatibility"
 ///////:     "\n        -S BUFSZ Ignored for GNU compatibility"
 ///////:     "\n        -T TMPDIR Ignored for GNU compatibility"
-//usage:        )
 //usage:
 //usage:#define sort_example_usage
 //usage:       "$ echo -e \"e\\nf\\nb\\nd\\nc\\na\" | sort\n"
@@ -404,6 +408,15 @@ int sort_main(int argc UNUSED_PARAM, char **argv)
         int i;
         int linecount;
         unsigned opts;
+#if ENABLE_FEATURE_SORT_OPTIMIZE_MEMORY
+        bool can_drop_dups;
+        size_t prev_len = 0;
+        char *prev_line = (char*) "";
+        /* Postpone optimizing if the input is small, < 16k lines:
+         * even just free()ing duplicate lines takes time.
+         */
+        size_t count_to_optimize_dups = 0x3fff;
+#endif
 
         xfunc_error_retval = 2;
 
@@ -412,6 +425,29 @@ int sort_main(int argc UNUSED_PARAM, char **argv)
                         sort_opt_str,
                         &str_ignored, &str_ignored, &str_o, &lst_k, &str_t
         );
+#if ENABLE_FEATURE_SORT_OPTIMIZE_MEMORY
+        /* Can drop dups only if -u but no "complicating" options,
+         * IOW: if we do a full line compares. Safe options:
+         * -o FILE Output to FILE
+         * -z      Lines are terminated by NUL, not newline
+         * -r      Reverse sort order
+         * -s      Stable (don't sort ties alphabetically)
+         * Not sure about these:
+         * -b      Ignore leading blanks
+         * -f      Ignore case
+         * -i      Ignore unprintable characters
+         * -d      Dictionary order (blank or alphanumeric only)
+         * -n      Sort numbers
+         * -g      General numerical sort
+         * -M      Sort month
+         */
+        can_drop_dups = ((opts & ~(FLAG_o|FLAG_z|FLAG_r|FLAG_s)) == FLAG_u);
+        /* Stable sort needs every line to be uniquely allocated,
+         * disable optimization to reuse strings:
+         */
+        if (opts & FLAG_s)
+                count_to_optimize_dups = (size_t)-1L;
+#endif
         /* global b strips leading and trailing spaces */
         if (opts & FLAG_b)
                 option_mask32 |= FLAG_bb;
@@ -489,6 +525,44 @@ int sort_main(int argc UNUSED_PARAM, char **argv)
                         char *line = GET_LINE(fp);
                         if (!line)
                                 break;
+
+#if ENABLE_FEATURE_SORT_OPTIMIZE_MEMORY
+                        if (count_to_optimize_dups != 0)
+                                count_to_optimize_dups--;
+                        if (count_to_optimize_dups == 0) {
+                                size_t len;
+                                char *new_line;
+
+                                /* On kernel/linux/arch/ *.[ch] files,
+                                 * this reduces memory usage by 6%.
+                                 *  yes | head -99999999 | sort
+                                 * goes down from 1900Mb to 380 Mb.
+                                 */
+                                len = strlen(line);
+                                if (len <= prev_len) {
+                                        new_line = prev_line + (prev_len - len);
+                                        if (strcmp(line, new_line) == 0) {
+                                                /* it's a tail of the prev line */
+                                                if (can_drop_dups && prev_len == len) {
+                                                        /* it's identical to prev line */
+                                                        free(line);
+                                                        continue;
+                                                }
+                                                free(line);
+                                                line = new_line;
+                                                /* continue using longer prev_line
+                                                 * for future tail tests.
+                                                 */
+                                                goto skip;
+                                        }
+                                }
+                                prev_len = len;
+                                prev_line = line;
+ skip: ;
+                        }
+#else
+//TODO: lighter version which only drops total dups if can_drop_dups == true
+#endif
                         lines = xrealloc_vector(lines, 6, linecount);
                         lines[linecount++] = line;
                 }
diff --git a/coreutils/test.c b/coreutils/test.c
index a8286525a..824ce3b5a 100644
--- a/coreutils/test.c
+++ b/coreutils/test.c
@@ -76,7 +76,6 @@
 //usage:       "1\n"
 
 #include "libbb.h"
-#include <setjmp.h>
 
 /* This is a NOFORK applet. Be very careful! */
 
diff --git a/debianutils/start_stop_daemon.c b/debianutils/start_stop_daemon.c
index c8b7fa8f2..fa77a7e00 100644
--- a/debianutils/start_stop_daemon.c
+++ b/debianutils/start_stop_daemon.c
@@ -116,8 +116,6 @@ Misc options:
 //usage:        )
 //usage:     "\n        -q              Quiet"
 
-#include <sys/resource.h>
-
 /* Override ENABLE_FEATURE_PIDFILE */
 #define WANT_PIDFILE 1
 #include "libbb.h"
diff --git a/findutils/xargs.c b/findutils/xargs.c
index 9e475d7e6..df2300207 100644
--- a/findutils/xargs.c
+++ b/findutils/xargs.c
@@ -570,27 +570,28 @@ static int xargs_ask_confirmation(void)
 {
 #if !ENABLE_PLATFORM_MINGW32
         FILE *tty_stream;
-#endif
-        int c, savec;
+        int r;
 
-#if !ENABLE_PLATFORM_MINGW32
         tty_stream = xfopen_for_read(CURRENT_TTY);
-#endif
+
         fputs(" ?...", stderr);
-        fflush_all();
-#if !ENABLE_PLATFORM_MINGW32
-        c = savec = getc(tty_stream);
-        while (c != EOF && c != '\n')
-                c = getc(tty_stream);
+        r = bb_ask_y_confirmation_FILE(tty_stream);
+
         fclose(tty_stream);
 #else
+        int r, c, savec;
+
+        fputs(" ?...", stderr);
+        fflush_all();
         c = savec = getche();
         while (c != EOF && c != '\r')
                 c = getche();
         fputs("\n", stderr);
         fflush_all();
+        r = (savec == 'y' || savec == 'Y');
 #endif
-        return (savec == 'y' || savec == 'Y');
+
+        return r;
 }
 #else
 # define xargs_ask_confirmation() 1
diff --git a/include/bb_archive.h b/include/bb_archive.h
index 91d5561fc..084ba9470 100644
--- a/include/bb_archive.h
+++ b/include/bb_archive.h
@@ -224,7 +224,7 @@ const llist_t *find_list_entry2(const llist_t *list, const char *filename) FAST_
 
 /* A bit of bunzip2 internals are exposed for compressed help support: */
 typedef struct bunzip_data bunzip_data;
-int start_bunzip(bunzip_data **bdp, int in_fd, const void *inbuf, int len) FAST_FUNC;
+int start_bunzip(void *, bunzip_data **bdp, int in_fd, const void *inbuf, int len) FAST_FUNC;
 /* NB: read_bunzip returns < 0 on error, or the number of *unfilled* bytes
  * in outbuf. IOW: on EOF returns len ("all bytes are not filled"), not 0: */
 int read_bunzip(bunzip_data *bd, char *outbuf, int len) FAST_FUNC;
diff --git a/include/libbb.h b/include/libbb.h
index d948f88f3..876875045 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -41,6 +41,7 @@
 #include <poll.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
+#include <sys/resource.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/time.h>
@@ -1456,11 +1457,13 @@ extern int set_loop(char **devname, const char *file, unsigned long long offset,
 #define BB_LO_FLAGS_READ_ONLY 1
 #define BB_LO_FLAGS_AUTOCLEAR 4
 
-/* Like bb_ask below, but asks on stdin with no timeout.  */
-char *bb_ask_stdin(const char * prompt) FAST_FUNC;
-//TODO: pass buf pointer or return allocated buf (avoid statics)?
-char *bb_ask(const int fd, int timeout, const char * prompt) FAST_FUNC;
-int bb_ask_confirmation(void) FAST_FUNC;
+/* Returns malloced str */
+char *bb_ask_noecho(int fd, int timeout, const char *prompt) FAST_FUNC;
+/* Like bb_ask_noecho, but asks on stdin with no timeout.  */
+char *bb_ask_noecho_stdin(const char *prompt) FAST_FUNC;
+
+int bb_ask_y_confirmation_FILE(FILE *fp) FAST_FUNC;
+int bb_ask_y_confirmation(void) FAST_FUNC;
 
 /* Returns -1 if input is invalid. current_mode is a base for e.g. "u+rw" */
 int bb_parse_mode(const char* s, unsigned cur_mode) FAST_FUNC;
diff --git a/init/init.c b/init/init.c
index cac165fc7..6439e2bcd 100644
--- a/init/init.c
+++ b/init/init.c
@@ -130,7 +130,6 @@
 #include "libbb.h"
 #include "common_bufsiz.h"
 #include <syslog.h>
-#include <sys/resource.h>
 #ifdef __linux__
 # include <linux/vt.h>
 # include <sys/sysinfo.h>
diff --git a/libbb/appletlib.c b/libbb/appletlib.c
index 8fae11998..6a189a8c9 100644
--- a/libbb/appletlib.c
+++ b/libbb/appletlib.c
@@ -110,14 +110,21 @@ static const char *unpack_usage_messages(void)
         char *outbuf = NULL;
         bunzip_data *bd;
         int i;
+        jmp_buf jmpbuf;
 
-        i = start_bunzip(&bd,
+        /* Setup for I/O error handling via longjmp */
+        i = setjmp(jmpbuf);
+        if (i == 0) {
+                i = start_bunzip(&jmpbuf,
+                        &bd,
                         /* src_fd: */ -1,
                         /* inbuf:  */ packed_usage,
-                        /* len:    */ sizeof(packed_usage));
-        /* read_bunzip can longjmp to start_bunzip, and ultimately
-         * end up here with i != 0 on read data errors! Not trivial */
-        if (!i) {
+                        /* len:    */ sizeof(packed_usage)
+                );
+        }
+        /* read_bunzip can longjmp and end up here with i != 0
+         * on read data errors! Not trivial */
+        if (i == 0) {
                 /* Cannot use xmalloc: will leak bd in NOFORK case! */
                 outbuf = malloc_or_warn(sizeof(UNPACKED_USAGE));
                 if (outbuf)
diff --git a/libbb/ask_confirmation.c b/libbb/ask_confirmation.c
index 6fbed89f4..e4814e215 100644
--- a/libbb/ask_confirmation.c
+++ b/libbb/ask_confirmation.c
@@ -1,6 +1,6 @@
 /* vi: set sw=4 ts=4: */
 /*
- * bb_ask_confirmation implementation for busybox
+ * bb_ask_y_confirmation implementation for busybox
  *
  * Copyright (C) 2003  Manuel Novoa III  <mjn3@codepoet.org>
  *
@@ -8,15 +8,16 @@
  */
 #include "libbb.h"
 
-/* Read a line from stdin.  If the first non-whitespace char is 'y' or 'Y',
+/* Read a line from fp.  If the first non-whitespace char is 'y' or 'Y',
  * return 1.  Otherwise return 0.
  */
-int FAST_FUNC bb_ask_confirmation(void)
+int FAST_FUNC bb_ask_y_confirmation_FILE(FILE *fp)
 {
         char first = 0;
         int c;
 
-        while (((c = getchar()) != EOF) && (c != '\n')) {
+        fflush_all();
+        while (((c = fgetc(fp)) != EOF) && (c != '\n')) {
                 if (first == 0 && !isblank(c)) {
                         first = c|0x20;
                 }
@@ -24,3 +25,8 @@ int FAST_FUNC bb_ask_confirmation(void)
 
         return first == 'y';
 }
+
+int FAST_FUNC bb_ask_y_confirmation(void)
+{
+        return bb_ask_y_confirmation_FILE(stdin);
+}
diff --git a/libbb/bb_askpass.c b/libbb/bb_askpass.c
index aae35ec41..2dcead35a 100644
--- a/libbb/bb_askpass.c
+++ b/libbb/bb_askpass.c
@@ -13,16 +13,9 @@ static void askpass_timeout(int UNUSED_PARAM ignore)
 {
 }
 
-char* FAST_FUNC bb_ask_stdin(const char *prompt)
+char* FAST_FUNC bb_ask_noecho(int fd, int timeout, const char *prompt)
 {
-        return bb_ask(STDIN_FILENO, 0, prompt);
-}
-char* FAST_FUNC bb_ask(const int fd, int timeout, const char *prompt)
-{
-        /* Was static char[BIGNUM] */
-        enum { sizeof_passwd = 128 };
-
-        char *passwd;
+#define MAX_LINE 0xfff
         char *ret;
         int i;
         struct sigaction sa, oldsa;
@@ -37,16 +30,17 @@ char* FAST_FUNC bb_ask(const int fd, int timeout, const char *prompt)
 
         tcgetattr(fd, &oldtio);
         tio = oldtio;
-#if 0
-        /* Switch off UPPERCASE->lowercase conversion (never used since 198x)
-         * and XON/XOFF (why we want to mess with this??)
+        /* Switch off echo. ECHOxyz meaning:
+         * ECHO    echo input chars
+         * ECHOE   echo BS-SP-BS on erase character
+         * ECHOK   echo kill char specially, not as ^c (ECHOKE controls how exactly)
+         * ECHOKE  erase all input via BS-SP-BS on kill char (else go to next line)
+         * ECHOCTL Echo ctrl chars as ^c (else echo verbatim:
+         *         e.g. up arrow emits "ESC-something" and thus moves cursor up!)
+         * ECHONL  Echo NL even if ECHO is not set
+         * ECHOPRT On erase, echo erased chars
+         *         [qwe<BS><BS><BS> input looks like "qwe\ewq/" on screen]
          */
-# ifndef IUCLC
-#  define IUCLC 0
-# endif
-        tio.c_iflag &= ~(IUCLC|IXON|IXOFF|IXANY);
-#endif
-        /* Switch off echo */
         tio.c_lflag &= ~(ECHO|ECHOE|ECHOK|ECHONL);
         tcsetattr(fd, TCSANOW, &tio);
 
@@ -60,21 +54,30 @@ char* FAST_FUNC bb_ask(const int fd, int timeout, const char *prompt)
                 alarm(timeout);
         }
 
-        passwd = auto_string(xmalloc(sizeof_passwd));
-        ret = passwd;
+        ret = NULL;
         i = 0;
         while (1) {
-                int r = read(fd, &ret[i], 1);
+                int r;
+
+                /* User input is uber-slow, no need to optimize reallocs.
+                 * Grow it on every char.
+                 */
+                ret = xrealloc(ret, i + 2);
+                r = read(fd, &ret[i], 1);
+
                 if ((i == 0 && r == 0) /* EOF (^D) with no password */
-                 || r < 0
+                 || r < 0 /* read is interrupted by timeout or ^C */
                 ) {
-                        /* read is interrupted by timeout or ^C */
+                        ret[i] = '\0'; /* paranoia */
+                        nuke_str(ret); /* paranoia */
+                        free(ret);
                         ret = NULL;
                         break;
                 }
+
                 if (r == 0 /* EOF */
                  || ret[i] == '\r' || ret[i] == '\n' /* EOL */
-                 || ++i == sizeof_passwd-1 /* line limit */
+                 || ++i == MAX_LINE /* line limit */
                 ) {
                         ret[i] = '\0';
                         break;
@@ -90,3 +93,7 @@ char* FAST_FUNC bb_ask(const int fd, int timeout, const char *prompt)
         fflush_all();
         return ret;
 }
+char* FAST_FUNC bb_ask_noecho_stdin(const char *prompt)
+{
+        return bb_ask_noecho(STDIN_FILENO, 0, prompt);
+}
diff --git a/libbb/copy_file.c b/libbb/copy_file.c
index 5372d8680..c60765d95 100644
--- a/libbb/copy_file.c
+++ b/libbb/copy_file.c
@@ -48,7 +48,7 @@ static int ask_and_unlink(const char *dest, int flags)
                 // (No "opening without O_EXCL", no "unlink only if -f")
                 // Or else we will end up having 3 open()s!
                 fprintf(stderr, "%s: overwrite '%s'? ", applet_name, dest);
-                if (!bb_ask_confirmation())
+                if (!bb_ask_y_confirmation())
                         return 0; /* not allowed to overwrite */
         }
         if (unlink(dest) < 0) {
diff --git a/libbb/correct_password.c b/libbb/correct_password.c
index a6f7d9b3d..cbe6cb387 100644
--- a/libbb/correct_password.c
+++ b/libbb/correct_password.c
@@ -106,7 +106,7 @@ int FAST_FUNC ask_and_check_password_extended(const struct passwd *pw,
         if (!pw_pass[0]) /* empty password field? */
                 return CHECKPASS_PW_HAS_EMPTY_PASSWORD;
 
-        plaintext = bb_ask(STDIN_FILENO, timeout, prompt);
+        plaintext = bb_ask_noecho(STDIN_FILENO, timeout, prompt);
         if (!plaintext) {
                 /* EOF (such as ^D) or error (such as ^C) or timeout */
                 return -1;
diff --git a/libbb/dump.c b/libbb/dump.c
index db91fcfe7..5941ef902 100644
--- a/libbb/dump.c
+++ b/libbb/dump.c
@@ -464,11 +464,9 @@ static const char conv_str[] ALIGN1 =
         "\v"  "\\""v""\0"
         ;
 
-
 static void conv_c(PR *pr, unsigned char *p)
 {
         const char *str = conv_str;
-        char buf[10];
 
         do {
                 if (*p == *str) {
@@ -482,7 +480,9 @@ static void conv_c(PR *pr, unsigned char *p)
                 *pr->cchar = 'c';
                 printf(pr->fmt, *p);
         } else {
-                sprintf(buf, "%03o", (int) *p);
+                char buf[4];
+                /* gcc-8.0.1 needs lots of casts to shut up */
+                sprintf(buf, "%03o", (unsigned)(uint8_t)*p);
                 str = buf;
  strpr:
                 *pr->cchar = 's';
diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index 36b6abe2b..431f1c048 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -466,7 +466,8 @@ static void put_till_end_and_adv_cursor(void)
 static void goto_new_line(void)
 {
         put_till_end_and_adv_cursor();
-        if (cmdedit_x != 0)
+        /* "cursor == 0" is only if prompt is "" and user input is empty */
+        if (cursor == 0 || cmdedit_x != 0)
                 bb_putchar('\n');
 }
 
diff --git a/libbb/remove_file.c b/libbb/remove_file.c
index 8a1324393..86c9a5c56 100644
--- a/libbb/remove_file.c
+++ b/libbb/remove_file.c
@@ -39,9 +39,9 @@ int FAST_FUNC remove_file(const char *path, int flags)
                 if ((!(flags & FILEUTILS_FORCE) && access(path, W_OK) < 0 && isatty(0))
                  || (flags & FILEUTILS_INTERACTIVE)
                 ) {
-                        fprintf(stderr, "%s: descend into directory '%s'? ", applet_name,
-                                        path);
-                        if (!bb_ask_confirmation())
+                        fprintf(stderr, "%s: descend into directory '%s'? ",
+                                        applet_name, path);
+                        if (!bb_ask_y_confirmation())
                                 return 0;
                 }
 
@@ -67,8 +67,9 @@ int FAST_FUNC remove_file(const char *path, int flags)
                 }
 
                 if (flags & FILEUTILS_INTERACTIVE) {
-                        fprintf(stderr, "%s: remove directory '%s'? ", applet_name, path);
-                        if (!bb_ask_confirmation())
+                        fprintf(stderr, "%s: remove directory '%s'? ",
+                                        applet_name, path);
+                        if (!bb_ask_y_confirmation())
                                 return status;
                 }
 
@@ -92,7 +93,7 @@ int FAST_FUNC remove_file(const char *path, int flags)
          || (flags & FILEUTILS_INTERACTIVE)
         ) {
                 fprintf(stderr, "%s: remove '%s'? ", applet_name, path);
-                if (!bb_ask_confirmation())
+                if (!bb_ask_y_confirmation())
                         return 0;
         }
 
diff --git a/loginutils/cryptpw.c b/loginutils/cryptpw.c
index 76138a61f..fbb7f0515 100644
--- a/loginutils/cryptpw.c
+++ b/loginutils/cryptpw.c
@@ -133,8 +133,8 @@ int cryptpw_main(int argc UNUSED_PARAM, char **argv)
         if (!password) {
                 /* Only mkpasswd, and only from tty, prompts.
                  * Otherwise it is a plain read. */
-                password = (ENABLE_MKPASSWD && isatty(STDIN_FILENO) && applet_name[0] == 'm')
-                        ? bb_ask_stdin("Password: ")
+                password = (ENABLE_MKPASSWD && applet_name[0] == 'm' && isatty(STDIN_FILENO))
+                        ? bb_ask_noecho_stdin("Password: ")
                         : xmalloc_fgetline(stdin)
                 ;
                 /* may still be NULL on EOF/error */
diff --git a/loginutils/login.c b/loginutils/login.c
index fcdb9592c..25bb5203b 100644
--- a/loginutils/login.c
+++ b/loginutils/login.c
@@ -64,7 +64,6 @@
 #include "libbb.h"
 #include "common_bufsiz.h"
 #include <syslog.h>
-#include <sys/resource.h>
 
 #if ENABLE_SELINUX
 # include <selinux/selinux.h>  /* for is_selinux_enabled()  */
diff --git a/loginutils/passwd.c b/loginutils/passwd.c
index 3e1ef9abf..59f47fc7b 100644
--- a/loginutils/passwd.c
+++ b/loginutils/passwd.c
@@ -39,7 +39,6 @@
 
 #include "libbb.h"
 #include <syslog.h>
-#include <sys/resource.h> /* setrlimit */
 
 static char* new_password(const struct passwd *pw, uid_t myuid, const char *algo)
 {
@@ -52,7 +51,7 @@ static char* new_password(const struct passwd *pw, uid_t myuid, const char *algo
         if (myuid != 0 && pw->pw_passwd[0]) {
                 char *encrypted;
 
-                orig = bb_ask_stdin("Old password: "); /* returns ptr to static */
+                orig = bb_ask_noecho_stdin("Old password: "); /* returns ptr to static */
                 if (!orig)
                         goto err_ret;
                 encrypted = pw_encrypt(orig, pw->pw_passwd, 1); /* returns malloced str */
@@ -65,11 +64,9 @@ static char* new_password(const struct passwd *pw, uid_t myuid, const char *algo
                 if (ENABLE_FEATURE_CLEAN_UP)
                         free(encrypted);
         }
-        orig = xstrdup(orig); /* or else bb_ask_stdin() will destroy it */
-        newp = bb_ask_stdin("New password: "); /* returns ptr to static */
+        newp = bb_ask_noecho_stdin("New password: "); /* returns ptr to static */
         if (!newp)
                 goto err_ret;
-        newp = xstrdup(newp); /* we are going to bb_ask_stdin() again, so save it */
         if (ENABLE_FEATURE_PASSWD_WEAK_CHECK
          && obscure(orig, newp, pw)
          && myuid != 0
@@ -77,7 +74,7 @@ static char* new_password(const struct passwd *pw, uid_t myuid, const char *algo
                 goto err_ret; /* non-root is not allowed to have weak passwd */
         }
 
-        cp = bb_ask_stdin("Retype password: ");
+        cp = bb_ask_noecho_stdin("Retype password: ");
         if (!cp)
                 goto err_ret;
         if (strcmp(cp, newp) != 0) {
@@ -99,6 +96,7 @@ static char* new_password(const struct passwd *pw, uid_t myuid, const char *algo
         if (ENABLE_FEATURE_CLEAN_UP) free(newp);
 
         nuke_str(cp);
+        if (ENABLE_FEATURE_CLEAN_UP) free(cp);
         return ret;
 }
 
diff --git a/mailutils/mail.c b/mailutils/mail.c
index eceb89071..7af7edd6c 100644
--- a/mailutils/mail.c
+++ b/mailutils/mail.c
@@ -163,8 +163,8 @@ void FAST_FUNC encode_base64(char *fname, const char *text, const char *eol)
 void FAST_FUNC get_cred_or_die(int fd)
 {
         if (isatty(fd)) {
-                G.user = xstrdup(bb_ask(fd, /* timeout: */ 0, "User: "));
-                G.pass = xstrdup(bb_ask(fd, /* timeout: */ 0, "Password: "));
+                G.user = bb_ask_noecho(fd, /* timeout: */ 0, "User: ");
+                G.pass = bb_ask_noecho(fd, /* timeout: */ 0, "Password: ");
         } else {
                 G.user = xmalloc_reads(fd, /* maxsize: */ NULL);
                 G.pass = xmalloc_reads(fd, /* maxsize: */ NULL);
diff --git a/miscutils/bbconfig.c b/miscutils/bbconfig.c
index 2151c622c..aa42de648 100644
--- a/miscutils/bbconfig.c
+++ b/miscutils/bbconfig.c
@@ -45,13 +45,22 @@ int bbconfig_main(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
 #if ENABLE_FEATURE_COMPRESS_BBCONFIG
         bunzip_data *bd;
-        int i = start_bunzip(&bd,
+        int i;
+        jmp_buf jmpbuf;
+
+        /* Setup for I/O error handling via longjmp */
+        i = setjmp(jmpbuf);
+        if (i == 0) {
+                i = start_bunzip(&jmpbuf,
+                        &bd,
                         /* src_fd: */ -1,
                         /* inbuf:  */ bbconfig_config_bz2,
-                        /* len:    */ sizeof(bbconfig_config_bz2));
-        /* read_bunzip can longjmp to start_bunzip, and ultimately
-         * end up here with i != 0 on read data errors! Not trivial */
-        if (!i) {
+                        /* len:    */ sizeof(bbconfig_config_bz2)
+                );
+        }
+        /* read_bunzip can longjmp and end up here with i != 0
+         * on read data errors! Not trivial */
+        if (i == 0) {
                 /* Cannot use xmalloc: will leak bd in NOFORK case! */
                 char *outbuf = malloc_or_warn(sizeof(bbconfig_config));
                 if (outbuf) {
diff --git a/miscutils/i2c_tools.c b/miscutils/i2c_tools.c
index 82f9842bd..6a2134063 100644
--- a/miscutils/i2c_tools.c
+++ b/miscutils/i2c_tools.c
@@ -421,8 +421,7 @@ static void check_write_funcs(int fd, int mode, int pec)
 static void confirm_or_abort(void)
 {
         fprintf(stderr, "Continue? [y/N] ");
-        fflush_all();
-        if (!bb_ask_confirmation())
+        if (!bb_ask_y_confirmation())
                 bb_error_msg_and_die("aborting");
 }
 
diff --git a/miscutils/time.c b/miscutils/time.c
index 61f078755..7d6a7a29f 100644
--- a/miscutils/time.c
+++ b/miscutils/time.c
@@ -32,7 +32,6 @@
 //usage:     "\n        -a      Append (else overwrite)"
 
 #include "libbb.h"
-#include <sys/resource.h> /* getrusage */
 
 /* Information on the resources used by a child process.  */
 typedef struct {
diff --git a/networking/ftpd.c b/networking/ftpd.c
index 8abbf7f57..6ca231c90 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -57,7 +57,7 @@
 //usage:       "[-wvS]"IF_FEATURE_FTPD_AUTHENTICATION(" [-a USER]")" [-t N] [-T N] [DIR]"
 //usage:#define ftpd_full_usage "\n\n"
 //usage:        IF_NOT_FEATURE_FTPD_AUTHENTICATION(
-//usage:       "Anonymous FTP server. Accesses by clients occur under ftpd's UID.\n"
+//usage:       "Anonymous FTP server. Client access occurs under ftpd's UID.\n"
 //usage:        )
 //usage:        IF_FEATURE_FTPD_AUTHENTICATION(
 //usage:       "FTP server. "
@@ -66,9 +66,15 @@
 //usage:       "Should be used as inetd service, inetd.conf line:\n"
 //usage:       "        21 stream tcp nowait root ftpd ftpd /files/to/serve\n"
 //usage:       "Can be run from tcpsvd:\n"
-//usage:       "        tcpsvd -vE 0.0.0.0 21 ftpd /files/to/serve\n"
+//usage:       "        tcpsvd -vE 0.0.0.0 21 ftpd /files/to/serve"
+//usage:     "\n"
 //usage:     "\n        -w      Allow upload"
 //usage:        IF_FEATURE_FTPD_AUTHENTICATION(
+//usage:     "\n        -A      No login required, client access occurs under ftpd's UID"
+//
+// if !FTPD_AUTHENTICATION, -A is accepted too, but not shown in --help
+// since it's the only supported mode in that configuration
+//
 //usage:     "\n        -a USER Enable 'anonymous' login and map it to USER"
 //usage:        )
 //usage:     "\n        -v      Log errors to stderr. -vv: verbose log"
@@ -1155,11 +1161,12 @@ enum {
 #if !BB_MMU
         OPT_l = (1 << 0),
         OPT_1 = (1 << 1),
-        OPT_A = (1 << 2),
 #endif
-        OPT_v = (1 << ((!BB_MMU) * 3 + 0)),
-        OPT_S = (1 << ((!BB_MMU) * 3 + 1)),
-        OPT_w = (1 << ((!BB_MMU) * 3 + 2)) * ENABLE_FEATURE_FTPD_WRITE,
+        BIT_A =        (!BB_MMU) * 2,
+        OPT_A = (1 << (BIT_A + 0)),
+        OPT_v = (1 << (BIT_A + 1)),
+        OPT_S = (1 << (BIT_A + 2)),
+        OPT_w = (1 << (BIT_A + 3)) * ENABLE_FEATURE_FTPD_WRITE,
 };
 
 int ftpd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
@@ -1179,24 +1186,25 @@ int ftpd_main(int argc UNUSED_PARAM, char **argv)
         verbose_S = 0;
         G.timeout = 2 * 60;
 #if BB_MMU
-        opts = getopt32(argv, "^"    "vS"
-                IF_FEATURE_FTPD_WRITE("w") "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:")
+        opts = getopt32(argv, "^"   "AvS" IF_FEATURE_FTPD_WRITE("w")
+                "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:")
                 "\0" "vv:SS",
                 &G.timeout, &abs_timeout, IF_FEATURE_FTPD_AUTHENTICATION(&anon_opt,)
                 &G.verbose, &verbose_S
         );
 #else
-        opts = getopt32(argv, "^" "l1AvS"
-                IF_FEATURE_FTPD_WRITE("w") "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:")
+        opts = getopt32(argv, "^" "l1AvS" IF_FEATURE_FTPD_WRITE("w")
+                "t:+T:+" IF_FEATURE_FTPD_AUTHENTICATION("a:")
                 "\0" "vv:SS",
                 &G.timeout, &abs_timeout, IF_FEATURE_FTPD_AUTHENTICATION(&anon_opt,)
                 &G.verbose, &verbose_S
         );
         if (opts & (OPT_l|OPT_1)) {
-                /* Our secret backdoor to ls */
+                /* Our secret backdoor to ls: see popen_ls() */
                 if (fchdir(3) != 0)
                         _exit(127);
                 /* memset(&G, 0, sizeof(G)); - ls_main does it */
+                /* NB: in this case -A has a different meaning: like "ls -A" */
                 return ls_main(/*argc_unused*/ 0, argv);
         }
 #endif
@@ -1254,30 +1262,32 @@ int ftpd_main(int argc UNUSED_PARAM, char **argv)
         signal(SIGALRM, timeout_handler);
 
 #if ENABLE_FEATURE_FTPD_AUTHENTICATION
-        while (1) {
-                uint32_t cmdval = cmdio_get_cmd_and_arg();
-                if (cmdval == const_USER) {
-                        if (anon_opt && strcmp(G.ftp_arg, "anonymous") == 0) {
-                                pw = getpwnam(anon_opt);
-                                if (pw)
-                                        break; /* does not even ask for password */
-                        }
-                        pw = getpwnam(G.ftp_arg);
-                        cmdio_write_raw(STR(FTP_GIVEPWORD)" Please specify password\r\n");
-                } else if (cmdval == const_PASS) {
-                        if (check_password(pw, G.ftp_arg) > 0) {
-                                break;  /* login success */
+        if (!(opts & OPT_A)) {
+                while (1) {
+                        uint32_t cmdval = cmdio_get_cmd_and_arg();
+                        if (cmdval == const_USER) {
+                                if (anon_opt && strcmp(G.ftp_arg, "anonymous") == 0) {
+                                        pw = getpwnam(anon_opt);
+                                        if (pw)
+                                                break; /* does not even ask for password */
+                                }
+                                pw = getpwnam(G.ftp_arg);
+                                cmdio_write_raw(STR(FTP_GIVEPWORD)" Specify password\r\n");
+                        } else if (cmdval == const_PASS) {
+                                if (check_password(pw, G.ftp_arg) > 0) {
+                                        break;  /* login success */
+                                }
+                                cmdio_write_raw(STR(FTP_LOGINERR)" Login failed\r\n");
+                                pw = NULL;
+                        } else if (cmdval == const_QUIT) {
+                                WRITE_OK(FTP_GOODBYE);
+                                return 0;
+                        } else {
+                                cmdio_write_raw(STR(FTP_LOGINERR)" Login with USER+PASS\r\n");
                         }
-                        cmdio_write_raw(STR(FTP_LOGINERR)" Login failed\r\n");
-                        pw = NULL;
-                } else if (cmdval == const_QUIT) {
-                        WRITE_OK(FTP_GOODBYE);
-                        return 0;
-                } else {
-                        cmdio_write_raw(STR(FTP_LOGINERR)" Login with USER and PASS\r\n");
                 }
+                WRITE_OK(FTP_LOGINOK);
         }
-        WRITE_OK(FTP_LOGINOK);
 #endif
 
         /* Do this after auth, else /etc/passwd is not accessible */
@@ -1309,7 +1319,9 @@ int ftpd_main(int argc UNUSED_PARAM, char **argv)
         }
 
 #if ENABLE_FEATURE_FTPD_AUTHENTICATION
-        change_identity(pw);
+        if (pw)
+                change_identity(pw);
+        /* else: -A is in effect */
 #endif
 
         /* RFC-959 Section 5.1
diff --git a/networking/ftpgetput.c b/networking/ftpgetput.c
index ffc4cd5f1..84ca547ff 100644
--- a/networking/ftpgetput.c
+++ b/networking/ftpgetput.c
@@ -315,7 +315,7 @@ int ftpgetput_main(int argc UNUSED_PARAM, char **argv)
         INIT_G();
         /* Set default values */
         user = "anonymous";
-        password = "busybox@";
+        password = "busybox";
 
         /*
          * Decipher the command line
diff --git a/networking/httpd.c b/networking/httpd.c
index 9439e206c..b52526a78 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -392,7 +392,10 @@ static const struct {
 struct globals {
         int verbose;            /* must be int (used by getopt32) */
         smallint flg_deny_all;
-
+#if ENABLE_FEATURE_HTTPD_GZIP
+        /* client can handle gzip / we are going to send gzip */
+        smallint content_gzip;
+#endif
         unsigned rmt_ip;        /* used for IP-based allow/deny rules */
         time_t last_mod;
         char *rmt_ip_str;       /* for $REMOTE_ADDR and $REMOTE_PORT */
@@ -440,14 +443,15 @@ struct globals {
 #if ENABLE_FEATURE_HTTPD_PROXY
         Htaccess_Proxy *proxy;
 #endif
-#if ENABLE_FEATURE_HTTPD_GZIP
-        /* client can handle gzip / we are going to send gzip */
-        smallint content_gzip;
-#endif
 };
 #define G (*ptr_to_globals)
 #define verbose           (G.verbose          )
 #define flg_deny_all      (G.flg_deny_all     )
+#if ENABLE_FEATURE_HTTPD_GZIP
+# define content_gzip     (G.content_gzip     )
+#else
+# define content_gzip     0
+#endif
 #define rmt_ip            (G.rmt_ip           )
 #define bind_addr_or_port (G.bind_addr_or_port)
 #define g_query           (G.g_query          )
@@ -481,11 +485,6 @@ enum {
 #define hdr_cnt           (G.hdr_cnt          )
 #define http_error_page   (G.http_error_page  )
 #define proxy             (G.proxy            )
-#if ENABLE_FEATURE_HTTPD_GZIP
-# define content_gzip     (G.content_gzip     )
-#else
-# define content_gzip     0
-#endif
 #define INIT_G() do { \
         setup_common_bufsiz(); \
         SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
@@ -944,7 +943,7 @@ static char *encodeString(const char *string)
                 if (isalnum(ch))
                         *p++ = ch;
                 else
-                        p += sprintf(p, "&#%d;", (unsigned char) ch);
+                        p += sprintf(p, "&#%u;", (unsigned char) ch);
         }
         *p = '\0';
         return out;
@@ -1040,7 +1039,7 @@ static void log_and_exit(void)
  * second packet is delayed for any reason.
  * responseNum - the result code to send.
  */
-static void send_headers(int responseNum)
+static void send_headers(unsigned responseNum)
 {
         static const char RFC1123FMT[] ALIGN1 = "%a, %d %b %Y %H:%M:%S GMT";
         /* Fixed size 29-byte string. Example: Sun, 06 Nov 1994 08:49:37 GMT */
@@ -1052,9 +1051,9 @@ static void send_headers(int responseNum)
 #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
         const char *error_page = NULL;
 #endif
+        unsigned len;
         unsigned i;
         time_t timer = time(NULL);
-        int len;
 
         for (i = 0; i < ARRAY_SIZE(http_response_type); i++) {
                 if (http_response_type[i] == responseNum) {
@@ -1078,16 +1077,21 @@ static void send_headers(int responseNum)
         strftime(date_str, sizeof(date_str), RFC1123FMT, gmtime_r(&timer, &tm));
         /* ^^^ using gmtime_r() instead of gmtime() to not use static data */
         len = sprintf(iobuf,
-                        "HTTP/1.0 %d %s\r\n"
-                        "Content-type: %s\r\n"
+                        "HTTP/1.0 %u %s\r\n"
                         "Date: %s\r\n"
                         "Connection: close\r\n",
                         responseNum, responseString,
-                        /* if it's error message, then it's HTML */
-                        (responseNum == HTTP_OK ? found_mime_type : "text/html"),
                         date_str
         );
 
+        if (responseNum != HTTP_OK || found_mime_type) {
+                len += sprintf(iobuf + len,
+                                "Content-type: %s\r\n",
+                                /* if it's error message, then it's HTML */
+                                (responseNum != HTTP_OK ? "text/html" : found_mime_type)
+                );
+        }
+
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
         if (responseNum == HTTP_UNAUTHORIZED) {
                 len += sprintf(iobuf + len,
@@ -1147,9 +1151,9 @@ static void send_headers(int responseNum)
                         "Accept-Ranges: bytes\r\n"
 #endif
                         "Last-Modified: %s\r\n"
-                        "%s %"OFF_FMT"u\r\n",
+                        "%s-Length: %"OFF_FMT"u\r\n",
                                 date_str,
-                                content_gzip ? "Transfer-Length:" : "Content-Length:",
+                                content_gzip ? "Transfer" : "Content",
                                 file_size
                 );
         }
@@ -1161,8 +1165,8 @@ static void send_headers(int responseNum)
         iobuf[len++] = '\n';
         if (infoString) {
                 len += sprintf(iobuf + len,
-                                "<HTML><HEAD><TITLE>%d %s</TITLE></HEAD>\n"
-                                "<BODY><H1>%d %s</H1>\n"
+                                "<HTML><HEAD><TITLE>%u %s</TITLE></HEAD>\n"
+                                "<BODY><H1>%u %s</H1>\n"
                                 "%s\n"
                                 "</BODY></HTML>\n",
                                 responseNum, responseString,
@@ -1300,9 +1304,9 @@ static NOINLINE void cgi_io_loop_and_exit(int fromCgi_rd, int toCgi_wr, int post
                                 continue;
                         }
                         if (DEBUG && WIFEXITED(status))
-                                bb_error_msg("CGI exited, status=%d", WEXITSTATUS(status));
+                                bb_error_msg("CGI exited, status=%u", WEXITSTATUS(status));
                         if (DEBUG && WIFSIGNALED(status))
-                                bb_error_msg("CGI killed, signal=%d", WTERMSIG(status));
+                                bb_error_msg("CGI killed, signal=%u", WTERMSIG(status));
 #endif
                         break;
                 }
@@ -1533,7 +1537,7 @@ static void send_cgi_and_exit(
         if (G.http_accept_language)
                 setenv1("HTTP_ACCEPT_LANGUAGE", G.http_accept_language);
         if (post_len)
-                putenv(xasprintf("CONTENT_LENGTH=%d", post_len));
+                putenv(xasprintf("CONTENT_LENGTH=%u", post_len));
         if (cookie)
                 setenv1("HTTP_COOKIE", cookie);
         if (content_type)
@@ -1684,8 +1688,8 @@ static NOINLINE void send_file_and_exit(const char *url, int what)
          * (happens if you abort downloads from local httpd): */
         signal(SIGPIPE, SIG_IGN);
 
-        /* If not found, default is "application/octet-stream" */
-        found_mime_type = "application/octet-stream";
+        /* If not found, default is to not send "Content-type:" */
+        /*found_mime_type = NULL; - already is */
         suffix = strrchr(url, '.');
         if (suffix) {
                 static const char suffixTable[] ALIGN1 =
@@ -2543,11 +2547,9 @@ static void mini_httpd_nommu(int server_socket, int argc, char **argv)
          */
         while (1) {
                 int n;
-                len_and_sockaddr fromAddr;
 
                 /* Wait for connections... */
-                fromAddr.len = LSA_SIZEOF_SA;
-                n = accept(server_socket, &fromAddr.u.sa, &fromAddr.len);
+                n = accept(server_socket, NULL, NULL);
                 if (n < 0)
                         continue;
 
@@ -2734,7 +2736,7 @@ int httpd_main(int argc UNUSED_PARAM, char **argv)
 
         xfunc_error_retval = 0;
         if (opt & OPT_INETD)
-                mini_httpd_inetd();
+                mini_httpd_inetd(); /* never returns */
 #if BB_MMU
         if (!(opt & OPT_FOREGROUND))
                 bb_daemonize(0); /* don't change current directory */
diff --git a/networking/ntpd.c b/networking/ntpd.c
index 8205ab271..6cd497090 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -94,7 +94,6 @@
 #include "libbb.h"
 #include <math.h>
 #include <netinet/ip.h> /* For IPTOS_LOWDELAY definition */
-#include <sys/resource.h> /* setpriority */
 #include <sys/timex.h>
 #ifndef IPTOS_LOWDELAY
 # define IPTOS_LOWDELAY 0x10
diff --git a/networking/telnet.c b/networking/telnet.c
index 8b0df7f5c..15d6a08d8 100644
--- a/networking/telnet.c
+++ b/networking/telnet.c
@@ -89,12 +89,6 @@
 # define TELOPT_NAWS  31  /* window size */
 #endif
 
-#ifdef DOTRACE
-# define TRACE(x, y) do { if (x) printf y; } while (0)
-#else
-# define TRACE(x, y)
-#endif
-
 enum {
         DATABUFSIZE = 128,
         IACBUFSIZE  = 128,
@@ -627,10 +621,6 @@ int telnet_main(int argc UNUSED_PARAM, char **argv)
 
         INIT_G();
 
-#if ENABLE_FEATURE_TELNET_WIDTH
-        get_terminal_width_height(0, &G.win_width, &G.win_height);
-#endif
-
 #if ENABLE_FEATURE_TELNET_TTYPE
         G.ttype = getenv("TERM");
 #endif
@@ -661,6 +651,11 @@ int telnet_main(int argc UNUSED_PARAM, char **argv)
 
         setsockopt_keepalive(netfd);
 
+#if ENABLE_FEATURE_TELNET_WIDTH
+        get_terminal_width_height(0, &G.win_width, &G.win_height);
+//TODO: support dynamic resize?
+#endif
+
         signal(SIGINT, record_signo);
 
         ufds[0].fd = STDIN_FILENO;
@@ -684,7 +679,6 @@ int telnet_main(int argc UNUSED_PARAM, char **argv)
                         len = safe_read(STDIN_FILENO, G.buf, DATABUFSIZE);
                         if (len <= 0)
                                 doexit(EXIT_SUCCESS);
-                        TRACE(0, ("Read con: %d\n", len));
                         handle_net_output(len);
                 }
 
@@ -694,7 +688,6 @@ int telnet_main(int argc UNUSED_PARAM, char **argv)
                                 full_write1_str("Connection closed by foreign host\r\n");
                                 doexit(EXIT_FAILURE);
                         }
-                        TRACE(0, ("Read netfd (%d): %d\n", netfd, len));
                         handle_net_input(len);
                 }
         } /* while (1) */
diff --git a/networking/wget.c b/networking/wget.c
index aaa068ba9..5ff31d278 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -794,12 +794,9 @@ static void spawn_ssl_client(const char *host, int network_fd, int flags)
 static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_sockaddr *lsa)
 {
         FILE *sfp;
-        char *str;
+        char *pass;
         int port;
 
-        if (!target->user)
-                target->user = xstrdup("anonymous:busybox@");
-
         sfp = open_socket(lsa);
 #if ENABLE_FEATURE_WGET_HTTPS
         if (target->protocol == P_FTPS)
@@ -810,18 +807,20 @@ static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_
                 bb_error_msg_and_die("%s", G.wget_buf);
                 /* note: ftpcmd() sanitizes G.wget_buf, ok to print */
 
-        /*
-         * Splitting username:password pair,
-         * trying to log in
-         */
-        str = strchr(target->user, ':');
-        if (str)
-                *str++ = '\0';
-        switch (ftpcmd("USER ", target->user, sfp)) {
+        /* Split username:password pair */
+        pass = (char*)"busybox"; /* password for "anonymous" */
+        if (target->user) {
+                pass = strchr(target->user, ':');
+                if (pass)
+                        *pass++ = '\0';
+        }
+
+        /* Log in */
+        switch (ftpcmd("USER ", target->user ?: "anonymous", sfp)) {
         case 230:
                 break;
         case 331:
-                if (ftpcmd("PASS ", str, sfp) == 230)
+                if (ftpcmd("PASS ", pass, sfp) == 230)
                         break;
                 /* fall through (failed login) */
         default:
@@ -830,20 +829,16 @@ static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_
 
         ftpcmd("TYPE I", NULL, sfp);
 
-        /*
-         * Querying file size
-         */
+        /* Query file size */
         if (ftpcmd("SIZE ", target->path, sfp) == 213) {
                 G.content_len = BB_STRTOOFF(G.wget_buf + 4, NULL, 10);
                 if (G.content_len < 0 || errno) {
-                        bb_error_msg_and_die("SIZE value is garbage");
+                        bb_error_msg_and_die("bad SIZE value '%s'", G.wget_buf + 4);
                 }
                 G.got_clen = 1;
         }
 
-        /*
-         * Entering passive mode
-         */
+        /* Enter passive mode */
         if (ENABLE_FEATURE_IPV6 && ftpcmd("EPSV", NULL, sfp) == 229) {
                 /* good */
         } else
@@ -1002,11 +997,19 @@ static void NOINLINE retrieve_file_data(FILE *dfp)
                 if (!G.chunked)
                         break;
 
-                fgets_trim_sanitize(dfp, NULL); /* Eat empty line */
+                /* Each chunk ends with "\r\n" - eat it */
+                fgets_trim_sanitize(dfp, NULL);
  get_clen:
+                /* chunk size format is "HEXNUM[;name[=val]]\r\n" */
                 fgets_trim_sanitize(dfp, NULL);
+                errno = 0;
                 G.content_len = STRTOOFF(G.wget_buf, NULL, 16);
-                /* FIXME: error check? */
+                /*
+                 * Had a bug with inputs like "ffffffff0001f400"
+                 * smashing the heap later. Ensure >= 0.
+                 */
+                if (G.content_len < 0 || errno)
+                        bb_error_msg_and_die("bad chunk length '%s'", G.wget_buf);
                 if (G.content_len == 0)
                         break; /* all done! */
                 G.got_clen = 1;
diff --git a/runit/chpst.c b/runit/chpst.c
index 3ecb85cba..c2641ce8a 100644
--- a/runit/chpst.c
+++ b/runit/chpst.c
@@ -135,7 +135,6 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 //usage:     "\n                        a SIGXCPU after N seconds"
 
 #include "libbb.h"
-#include <sys/resource.h> /* getrlimit */
 
 /*
 Five applets here: chpst, envdir, envuidgid, setuidgid, softlimit.
diff --git a/runit/sv.c b/runit/sv.c
index 86d181872..8054daedf 100644
--- a/runit/sv.c
+++ b/runit/sv.c
@@ -222,6 +222,7 @@ struct globals {
 #define str_equal(s,t) (strcmp((s), (t)) == 0)
 
 
+#if ENABLE_SV || ENABLE_SVC
 static void fatal_cannot(const char *m1) NORETURN;
 static void fatal_cannot(const char *m1)
 {
@@ -688,6 +689,7 @@ static int sv(char **argv)
         }
         return rc > 99 ? 99 : rc;
 }
+#endif
 
 #if ENABLE_SV
 int sv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 1d77aefb7..b92c2324e 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -334,7 +334,9 @@ int conf_write(const char *name)
         struct symbol *sym;
         struct menu *menu;
         const char *basename;
-        char dirname[128], tmpname[128], newname[128];
+        char dirname[128];
+        char tmpname[256];
+        char newname[256];
         int type, l;
         const char *str;
         time_t now;
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index d3ad12d90..9fc837c9f 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -31,6 +31,10 @@
 #include <unistd.h>
 #include <locale.h>
 
+#ifndef SIGWINCH
+#define SIGWINCH 28
+#endif
+
 #define LKC_DIRECT_LINK
 #include "lkc.h"
 
diff --git a/shell/ash.c b/shell/ash.c
index 5ec035043..35438a887 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -204,7 +204,6 @@
 
 #define JOBS ENABLE_ASH_JOB_CONTROL
 
-#include <setjmp.h>
 #include <fnmatch.h>
 #include <sys/times.h>
 #include <sys/utsname.h> /* for setting $HOSTNAME */
@@ -5755,7 +5754,7 @@ openredirect(union node *redir)
                                 f = open(fname, O_WRONLY, 0666);
                                 if (f < 0)
                                         goto ecreate;
-                                if (fstat(f, &sb) < 0 && S_ISREG(sb.st_mode)) {
+                                if (!fstat(f, &sb) && S_ISREG(sb.st_mode)) {
                                         close(f);
                                         errno = EEXIST;
                                         goto ecreate;
@@ -6255,10 +6254,9 @@ static int substr_atoi(const char *s)
  * performs globbing, and thus diverges from what we do).
  */
 #define EXP_CASE        0x10    /* keeps quotes around for CASE pattern */
-#define EXP_QPAT        0x20    /* pattern in quoted parameter expansion */
-#define EXP_VARTILDE2   0x40    /* expand tildes after colons only */
-#define EXP_WORD        0x80    /* expand word in parameter expansion */
-#define EXP_QUOTED      0x100   /* expand word in double quotes */
+#define EXP_VARTILDE2   0x20    /* expand tildes after colons only */
+#define EXP_WORD        0x40    /* expand word in parameter expansion */
+#define EXP_QUOTED      0x80    /* expand word in double quotes */
 /*
  * rmescape() flags
  */
@@ -6268,7 +6266,7 @@ static int substr_atoi(const char *s)
 #define RMESCAPE_HEAP   0x10    /* Malloc strings instead of stalloc */
 
 /* Add CTLESC when necessary. */
-#define QUOTES_ESC     (EXP_FULL | EXP_CASE | EXP_QPAT)
+#define QUOTES_ESC     (EXP_FULL | EXP_CASE)
 /* Do not skip NUL characters. */
 #define QUOTES_KEEPNUL EXP_TILDE
 
@@ -6343,7 +6341,10 @@ ifsbreakup(char *string, struct arglist *arglist)
                 realifs = ifsset() ? ifsval() : defifs;
                 ifsp = &ifsfirst;
                 do {
+                        int afternul;
+
                         p = string + ifsp->begoff;
+                        afternul = nulonly;
                         nulonly = ifsp->nulonly;
                         ifs = nulonly ? nullstr : realifs;
                         ifsspc = 0;
@@ -6355,7 +6356,7 @@ ifsbreakup(char *string, struct arglist *arglist)
                                         p++;
                                         continue;
                                 }
-                                if (!nulonly)
+                                if (!(afternul || nulonly))
                                         ifsspc = (strchr(defifs, *p) != NULL);
                                 /* Ignore IFS whitespace at start */
                                 if (q == start && ifsspc) {
@@ -6457,7 +6458,6 @@ rmescapes(char *str, int flag, int *slash_position)
                 IF_BASH_PATTERN_SUBST('/',) CTLESC, CTLQUOTEMARK, '\0' };
 
         char *p, *q, *r;
-        unsigned inquotes;
         unsigned protect_against_glob;
         unsigned globbing;
 
@@ -6488,18 +6488,21 @@ rmescapes(char *str, int flag, int *slash_position)
                 }
         }
 
-        inquotes = 0;
         globbing = flag & RMESCAPE_GLOB;
         protect_against_glob = globbing;
         while (*p) {
                 if ((unsigned char)*p == CTLQUOTEMARK) {
-// Note: both inquotes and protect_against_glob only affect whether
+// Note: protect_against_glob only affect whether
 // CTLESC,<ch> gets converted to <ch> or to \<ch>
-                        inquotes = ~inquotes;
                         p++;
                         protect_against_glob = globbing;
                         continue;
                 }
+                if (*p == '\\') {
+                        /* naked back slash */
+                        protect_against_glob = 0;
+                        goto copy;
+                }
                 if ((unsigned char)*p == CTLESC) {
                         p++;
 #if DEBUG
@@ -6535,10 +6538,6 @@ rmescapes(char *str, int flag, int *slash_position)
                                         *q++ = '\\';
                                 }
                         }
-                } else if (*p == '\\' && !inquotes) {
-                        /* naked back slash */
-                        protect_against_glob = 0;
-                        goto copy;
                 }
 #if BASH_PATTERN_SUBST
                 else if (slash_position && p == str + *slash_position) {
@@ -7032,12 +7031,12 @@ argstr(char *p, int flags)
                 case CTLENDVAR: /* ??? */
                         goto breakloop;
                 case CTLQUOTEMARK:
-                        inquotes ^= EXP_QUOTED;
                         /* "$@" syntax adherence hack */
-                        if (inquotes && !memcmp(p, dolatstr + 1, DOLATSTRLEN - 1)) {
-                                p = evalvar(p + 1, flags | inquotes) + 1;
+                        if (!inquotes && !memcmp(p, dolatstr + 1, DOLATSTRLEN - 1)) {
+                                p = evalvar(p + 1, flags | EXP_QUOTED) + 1;
                                 goto start;
                         }
+                        inquotes ^= EXP_QUOTED;
  addquote:
                         if (flags & QUOTES_ESC) {
                                 p--;
@@ -7048,16 +7047,6 @@ argstr(char *p, int flags)
                 case CTLESC:
                         startloc++;
                         length++;
-
-                        /*
-                         * Quoted parameter expansion pattern: remove quote
-                         * unless inside inner quotes or we have a literal
-                         * backslash.
-                         */
-                        if (((flags | inquotes) & (EXP_QPAT | EXP_QUOTED)) ==
-                            EXP_QPAT && *p != '\\')
-                                break;
-
                         goto addquote;
                 case CTLVAR:
                         TRACE(("argstr: evalvar('%s')\n", p));
@@ -7248,15 +7237,24 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
         }
 #endif
         argstr_flags = EXP_TILDE;
-        if (subtype != VSASSIGN && subtype != VSQUESTION)
-                argstr_flags |= (flag & (EXP_QUOTED | EXP_QPAT) ? EXP_QPAT : EXP_CASE);
+        if (subtype != VSASSIGN
+         && subtype != VSQUESTION
+#if BASH_SUBSTR
+         && subtype != VSSUBSTR
+#endif
+        ) {
+                /* EXP_CASE keeps CTLESC's */
+                argstr_flags = EXP_TILDE | EXP_CASE;
+        }
         argstr(p, argstr_flags);
+        //bb_error_msg("str0:'%s'", (char *)stackblock() + strloc);
 #if BASH_PATTERN_SUBST
         slash_pos = -1;
         if (repl) {
                 slash_pos = expdest - ((char *)stackblock() + strloc);
                 STPUTC('/', expdest);
-                argstr(repl + 1, argstr_flags);
+                //bb_error_msg("repl+1:'%s'", repl + 1);
+                argstr(repl + 1, EXP_TILDE); /* EXP_TILDE: echo "${v/x/~}" expands ~ ! */
                 *repl = '/';
         }
 #endif
@@ -11182,6 +11180,34 @@ pgetc_eatbnl(void)
         return c;
 }
 
+struct synstack {
+        smalluint syntax;
+        uint8_t innerdq   :1;
+        uint8_t varpushed :1;
+        uint8_t dblquote  :1;
+        int varnest;            /* levels of variables expansion */
+        int dqvarnest;          /* levels of variables expansion within double quotes */
+        int parenlevel;         /* levels of parens in arithmetic */
+        struct synstack *prev;
+        struct synstack *next;
+};
+
+static void
+synstack_push(struct synstack **stack, struct synstack *next, int syntax)
+{
+        memset(next, 0, sizeof(*next));
+        next->syntax = syntax;
+        next->next = *stack;
+        (*stack)->prev = next;
+        *stack = next;
+}
+
+static ALWAYS_INLINE void
+synstack_pop(struct synstack **stack)
+{
+        *stack = (*stack)->next;
+}
+
 /*
  * To handle the "." command, a stack of input files is used.  Pushfile
  * adds a new entry to the stack and popfile restores the previous level.
@@ -12443,19 +12469,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         size_t len;
         struct nodelist *bqlist;
         smallint quotef;
-        smallint dblquote;
         smallint oldstyle;
-        IF_FEATURE_SH_MATH(smallint prevsyntax;) /* syntax before arithmetic */
         smallint pssyntax;   /* we are expanding a prompt string */
-        int varnest;         /* levels of variables expansion */
-        IF_FEATURE_SH_MATH(int arinest;)    /* levels of arithmetic expansion */
-        IF_FEATURE_SH_MATH(int parenlevel;) /* levels of parens in arithmetic */
-        int dqvarnest;       /* levels of variables expansion within double quotes */
         IF_BASH_DOLLAR_SQUOTE(smallint bash_dollar_squote = 0;)
+        /* syntax stack */
+        struct synstack synbase = { };
+        struct synstack *synstack = &synbase;
 
-        bqlist = NULL;
-        quotef = 0;
-        IF_FEATURE_SH_MATH(prevsyntax = 0;)
 #if ENABLE_ASH_EXPAND_PRMT
         pssyntax = (syntax == PSSYNTAX);
         if (pssyntax)
@@ -12463,11 +12483,12 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
 #else
         pssyntax = 0; /* constant */
 #endif
-        dblquote = (syntax == DQSYNTAX);
-        varnest = 0;
-        IF_FEATURE_SH_MATH(arinest = 0;)
-        IF_FEATURE_SH_MATH(parenlevel = 0;)
-        dqvarnest = 0;
+        synstack->syntax = syntax;
+
+        if (syntax == DQSYNTAX)
+                synstack->dblquote = 1;
+        quotef = 0;
+        bqlist = NULL;
 
         STARTSTACKSTR(out);
  loop:
@@ -12475,9 +12496,9 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         CHECKEND();     /* set c to PEOF if at end of here document */
         for (;;) {      /* until end of line or end of word */
                 CHECKSTRSPACE(4, out);  /* permit 4 calls to USTPUTC */
-                switch (SIT(c, syntax)) {
+                switch (SIT(c, synstack->syntax)) {
                 case CNL:       /* '\n' */
-                        if (syntax == BASESYNTAX)
+                        if (synstack->syntax == BASESYNTAX)
                                 goto endword;   /* exit outer loop */
                         USTPUTC(c, out);
                         nlprompt();
@@ -12497,13 +12518,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                 if (c & 0x100) {
                                         /* Unknown escape. Encode as '\z' */
                                         c = (unsigned char)c;
-                                        if (eofmark == NULL || dblquote)
+                                        if (eofmark == NULL || synstack->dblquote)
                                                 USTPUTC(CTLESC, out);
                                         USTPUTC('\\', out);
                                 }
                         }
 #endif
-                        if (eofmark == NULL || dblquote)
+                        if (!eofmark || synstack->dblquote || synstack->varnest)
                                 USTPUTC(CTLESC, out);
                         USTPUTC(c, out);
                         break;
@@ -12523,20 +12544,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                 /* Backslash is retained if we are in "str"
                                  * and next char isn't dquote-special.
                                  */
-                                if (dblquote
+                                if (synstack->dblquote
                                  && c != '\\'
                                  && c != '`'
                                  && c != '$'
-                                 && (c != '"' || eofmark != NULL)
+                                 && (c != '"' || (eofmark != NULL && !synstack->varnest))
+                                 && (c != '}' || !synstack->varnest)
                                 ) {
-//dash survives not doing USTPUTC(CTLESC), but merely by chance:
-//Example: "\z" gets encoded as "\<CTLESC>z".
-//rmescapes() then emits "\", "\z", protecting z from globbing.
-//But it's wrong, should protect _both_ from globbing:
-//everything in double quotes is not globbed.
-//Unlike dash, we have a fix in rmescapes() which emits bare "z"
-//for "<CTLESC>z" since "z" is not glob-special (else unicode may break),
-//and glob would see "\z" and eat "\". Thus:
                                         USTPUTC(CTLESC, out); /* protect '\' from glob */
                                         USTPUTC('\\', out);
                                 }
@@ -12546,56 +12560,62 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                         }
                         break;
                 case CSQUOTE:
-                        syntax = SQSYNTAX;
+                        synstack->syntax = SQSYNTAX;
  quotemark:
                         if (eofmark == NULL) {
                                 USTPUTC(CTLQUOTEMARK, out);
                         }
                         break;
                 case CDQUOTE:
-                        syntax = DQSYNTAX;
-                        dblquote = 1;
+                        synstack->syntax = DQSYNTAX;
+                        synstack->dblquote = 1;
+ toggledq:
+                        if (synstack->varnest)
+                                synstack->innerdq ^= 1;
                         goto quotemark;
                 case CENDQUOTE:
                         IF_BASH_DOLLAR_SQUOTE(bash_dollar_squote = 0;)
-                        if (eofmark != NULL && varnest == 0) {
+                        if (eofmark != NULL && synstack->varnest == 0) {
                                 USTPUTC(c, out);
-                        } else {
-                                if (dqvarnest == 0) {
-                                        syntax = BASESYNTAX;
-                                        dblquote = 0;
-                                }
-                                quotef = 1;
-                                goto quotemark;
+                                break;
                         }
-                        break;
+
+                        if (synstack->dqvarnest == 0) {
+                                synstack->syntax = BASESYNTAX;
+                                synstack->dblquote = 0;
+                        }
+
+                        quotef = 1;
+
+                        if (c == '"')
+                                goto toggledq;
+
+                        goto quotemark;
                 case CVAR:      /* '$' */
                         PARSESUB();             /* parse substitution */
                         break;
                 case CENDVAR:   /* '}' */
-                        if (varnest > 0) {
-                                varnest--;
-                                if (dqvarnest > 0) {
-                                        dqvarnest--;
-                                }
+                        if (!synstack->innerdq && synstack->varnest > 0) {
+                                if (!--synstack->varnest && synstack->varpushed)
+                                        synstack_pop(&synstack);
+                                else if (synstack->dqvarnest > 0)
+                                        synstack->dqvarnest--;
                                 c = CTLENDVAR;
                         }
                         USTPUTC(c, out);
                         break;
 #if ENABLE_FEATURE_SH_MATH
                 case CLP:       /* '(' in arithmetic */
-                        parenlevel++;
+                        synstack->parenlevel++;
                         USTPUTC(c, out);
                         break;
                 case CRP:       /* ')' in arithmetic */
-                        if (parenlevel > 0) {
-                                parenlevel--;
+                        if (synstack->parenlevel > 0) {
+                                synstack->parenlevel--;
                         } else {
                                 if (pgetc_eatbnl() == ')') {
                                         c = CTLENDARI;
-                                        if (--arinest == 0) {
-                                                syntax = prevsyntax;
-                                        }
+                                        synstack_pop(&synstack);
                                 } else {
                                         /*
                                          * unbalanced parens
@@ -12621,7 +12641,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                 case CIGN:
                         break;
                 default:
-                        if (varnest == 0) {
+                        if (synstack->varnest == 0) {
 #if BASH_REDIR_OUTPUT
                                 if (c == '&') {
 //Can't call pgetc_eatbnl() here, this requires three-deep pungetc()
@@ -12640,12 +12660,12 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
  endword:
 
 #if ENABLE_FEATURE_SH_MATH
-        if (syntax == ARISYNTAX)
+        if (synstack->syntax == ARISYNTAX)
                 raise_error_syntax("missing '))'");
 #endif
-        if (syntax != BASESYNTAX && eofmark == NULL)
+        if (synstack->syntax != BASESYNTAX && eofmark == NULL)
                 raise_error_syntax("unterminated quoted string");
-        if (varnest != 0) {
+        if (synstack->varnest != 0) {
                 /* { */
                 raise_error_syntax("missing '}'");
         }
@@ -12827,7 +12847,7 @@ parsesub: {
          || (c != '(' && c != '{' && !is_name(c) && !is_special(c))
         ) {
 #if BASH_DOLLAR_SQUOTE
-                if (syntax != DQSYNTAX && c == '\'')
+                if (synstack->syntax != DQSYNTAX && c == '\'')
                         bash_dollar_squote = 1;
                 else
 #endif
@@ -12847,6 +12867,8 @@ parsesub: {
                 }
         } else {
                 /* $VAR, $<specialchar>, ${...}, or PEOA/PEOF */
+                smalluint newsyn = synstack->syntax;
+
                 USTPUTC(CTLVAR, out);
                 typeloc = out - (char *)stackblock();
                 STADJUST(1, out);
@@ -12905,6 +12927,8 @@ parsesub: {
                         static const char types[] ALIGN1 = "}-+?=";
                         /* ${VAR...} but not $VAR or ${#VAR} */
                         /* c == first char after VAR */
+                        int cc = c;
+
                         switch (c) {
                         case ':':
                                 c = pgetc_eatbnl();
@@ -12929,21 +12953,24 @@ parsesub: {
                                 break;
                         }
                         case '%':
-                        case '#': {
-                                int cc = c;
+                        case '#':
                                 subtype = (c == '#' ? VSTRIMLEFT : VSTRIMRIGHT);
                                 c = pgetc_eatbnl();
-                                if (c != cc)
-                                        goto badsub;
-                                subtype++;
+                                if (c == cc)
+                                        subtype++;
+                                else
+                                        pungetc();
+
+                                newsyn = BASESYNTAX;
                                 break;
-                        }
 #if BASH_PATTERN_SUBST
                         case '/':
                                 /* ${v/[/]pattern/repl} */
 //TODO: encode pattern and repl separately.
-// Currently ${v/$var_with_slash/repl} is horribly broken
+// Currently cases like: v=1;echo ${v/$((1/1))/ONE}
+// are broken (should print "ONE")
                                 subtype = VSREPLACE;
+                                newsyn = BASESYNTAX;
                                 c = pgetc_eatbnl();
                                 if (c != '/')
                                         goto badsub;
@@ -12955,11 +12982,26 @@ parsesub: {
  badsub:
                         pungetc();
                 }
+
+                if (newsyn == ARISYNTAX)
+                        newsyn = DQSYNTAX;
+
+                if ((newsyn != synstack->syntax || synstack->innerdq)
+                 && subtype != VSNORMAL
+                ) {
+                        synstack_push(&synstack,
+                                synstack->prev ?: alloca(sizeof(*synstack)),
+                                newsyn);
+
+                        synstack->varpushed = 1;
+                        synstack->dblquote = newsyn != BASESYNTAX;
+                }
+
                 ((unsigned char *)stackblock())[typeloc] = subtype;
                 if (subtype != VSNORMAL) {
-                        varnest++;
-                        if (dblquote)
-                                dqvarnest++;
+                        synstack->varnest++;
+                        if (synstack->dblquote)
+                                synstack->dqvarnest++;
                 }
                 STPUTC('=', out);
         }
@@ -13016,7 +13058,7 @@ parsebackq: {
                         case '\\':
                                 pc = pgetc(); /* or pgetc_eatbnl()? why (example)? */
                                 if (pc != '\\' && pc != '`' && pc != '$'
-                                 && (!dblquote || pc != '"')
+                                 && (!synstack->dblquote || pc != '"')
                                 ) {
                                         STPUTC('\\', pout);
                                 }
@@ -13091,10 +13133,11 @@ parsebackq: {
  * Parse an arithmetic expansion (indicate start of one and set state)
  */
 parsearith: {
-        if (++arinest == 1) {
-                prevsyntax = syntax;
-                syntax = ARISYNTAX;
-        }
+
+        synstack_push(&synstack,
+                        synstack->prev ?: alloca(sizeof(*synstack)),
+                        ARISYNTAX);
+        synstack->dblquote = 1;
         USTPUTC(CTLARI, out);
         goto parsearith_return;
 }
@@ -14542,7 +14585,7 @@ init(void)
 
 
 //usage:#define ash_trivial_usage
-//usage:        "[-/+OPTIONS] [-/+o OPT]... [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
+//usage:        "[-/+OPTIONS] [-/+o OPT]... [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS] / -s [ARGS]]"
 //usage:#define ash_full_usage "\n\n"
 //usage:        "Unix shell interpreter"
 
diff --git a/shell/ash_test/ash-arith/arith_nested1.right b/shell/ash_test/ash-arith/arith_nested1.right
new file mode 100644
index 000000000..d00491fd7
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith_nested1.right
@@ -0,0 +1 @@
+1
diff --git a/shell/ash_test/ash-arith/arith_nested1.tests b/shell/ash_test/ash-arith/arith_nested1.tests
new file mode 100755
index 000000000..28571b833
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith_nested1.tests
@@ -0,0 +1 @@
+echo $(( ( $((1)) ) ))
diff --git a/shell/ash_test/ash-heredoc/heredoc_var_expand1.right b/shell/ash_test/ash-heredoc/heredoc_var_expand1.right
new file mode 100644
index 000000000..eb221832d
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_var_expand1.right
@@ -0,0 +1,4 @@
+
+Ok1:0
+
+Ok2:0
diff --git a/shell/ash_test/ash-heredoc/heredoc_var_expand1.tests b/shell/ash_test/ash-heredoc/heredoc_var_expand1.tests
new file mode 100755
index 000000000..3b00bab7b
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_var_expand1.tests
@@ -0,0 +1,11 @@
+x='*'
+
+cat <<- EOF
+        ${x#'*'}
+EOF
+echo Ok1:$?
+
+cat <<EOF
+${x#'*'}
+EOF
+echo Ok2:$?
diff --git a/shell/ash_test/ash-misc/assignment5.right b/shell/ash_test/ash-misc/assignment5.right
new file mode 100644
index 000000000..a91554c09
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment5.right
@@ -0,0 +1,5 @@
+Zero1:0
+Zero2:0
+Zero3:0
+Zero4:0 x:1 y:1
+Three:3 x:1 y:1
diff --git a/shell/ash_test/ash-misc/assignment5.tests b/shell/ash_test/ash-misc/assignment5.tests
new file mode 100755
index 000000000..0b8104285
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment5.tests
@@ -0,0 +1,9 @@
+true;  a=1; echo Zero1:$?
+false; a=1; echo Zero2:$?
+false || a=1; echo Zero3:$?
+
+false || x=$? y=`echo $?`; echo Zero4:$? x:$x y:$y
+false || x=$? y=`echo $?; exit 3`; echo Three:$? x:$x y:$y
+
+#ash sets z=1 instead of z=3. disabled for now
+#false || x=$? y=`echo $?; exit 3` z=`echo $?`; echo x:$x y:$y z:$z
diff --git a/shell/ash_test/ash-misc/func5.right b/shell/ash_test/ash-misc/func5.right
index 2c9d316b3..01e79c32a 100644
--- a/shell/ash_test/ash-misc/func5.right
+++ b/shell/ash_test/ash-misc/func5.right
@@ -1,6 +1,3 @@
 1
 2
 3
-1
-2
-3
diff --git a/shell/ash_test/ash-misc/func5.tests b/shell/ash_test/ash-misc/func5.tests
index e967208cc..5c33560bc 100755
--- a/shell/ash_test/ash-misc/func5.tests
+++ b/shell/ash_test/ash-misc/func5.tests
@@ -6,8 +6,3 @@ f 2
 
 f() ( echo $1 )
 f 3
-
-f() for i in 1 2 3; do
-        echo $i
-done
-f
diff --git a/shell/ash_test/ash-misc/func_compound1.right b/shell/ash_test/ash-misc/func_compound1.right
new file mode 100644
index 000000000..01e79c32a
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_compound1.right
@@ -0,0 +1,3 @@
+1
+2
+3
diff --git a/shell/ash_test/ash-misc/func_compound1.tests b/shell/ash_test/ash-misc/func_compound1.tests
new file mode 100755
index 000000000..20c8bf18b
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_compound1.tests
@@ -0,0 +1,4 @@
+f() for i in 1 2 3; do
+        echo $i
+done
+f
diff --git a/shell/ash_test/ash-parsing/starquoted3.right b/shell/ash_test/ash-parsing/starquoted3.right
new file mode 100644
index 000000000..fea246c14
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted3.right
@@ -0,0 +1,2 @@
+<a>
+<>
diff --git a/shell/ash_test/ash-parsing/starquoted3.tests b/shell/ash_test/ash-parsing/starquoted3.tests
new file mode 100755
index 000000000..8eefe4245
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted3.tests
@@ -0,0 +1 @@
+set -- a ""; space=" "; printf "<%s>\n" "$@"$space
diff --git a/shell/ash_test/ash-quoting/bkslash_case2.right b/shell/ash_test/ash-quoting/bkslash_case2.right
new file mode 100644
index 000000000..8d2038bff
--- /dev/null
+++ b/shell/ash_test/ash-quoting/bkslash_case2.right
@@ -0,0 +1,3 @@
+ok1
+ok2
+Ok:0
diff --git a/shell/ash_test/ash-quoting/bkslash_case2.tests b/shell/ash_test/ash-quoting/bkslash_case2.tests
new file mode 100755
index 000000000..348ddc236
--- /dev/null
+++ b/shell/ash_test/ash-quoting/bkslash_case2.tests
@@ -0,0 +1,13 @@
+x='\abc'
+
+case "$x" in
+\\*) echo ok1;;
+*)   echo BUG1;;
+esac
+
+case $x in
+\\*) echo ok2;;
+*)   echo BUG2;;
+esac
+
+echo Ok:$?
diff --git a/shell/ash_test/ash-quoting/quote_in_varexp1.right b/shell/ash_test/ash-quoting/quote_in_varexp1.right
new file mode 100644
index 000000000..99a0aea7c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quote_in_varexp1.right
@@ -0,0 +1,2 @@
+''
+Ok:0
diff --git a/shell/ash_test/ash-quoting/quote_in_varexp1.tests b/shell/ash_test/ash-quoting/quote_in_varexp1.tests
new file mode 100755
index 000000000..1b97b0556
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quote_in_varexp1.tests
@@ -0,0 +1,2 @@
+x="''''"; echo "${x#"${x+''}"''}"
+echo Ok:$?
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp3.right b/shell/ash_test/ash-quoting/squote_in_varexp3.right
new file mode 100644
index 000000000..223b7836f
--- /dev/null
+++ b/shell/ash_test/ash-quoting/squote_in_varexp3.right
@@ -0,0 +1 @@
+B
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp3.tests b/shell/ash_test/ash-quoting/squote_in_varexp3.tests
new file mode 100755
index 000000000..028a88fd9
--- /dev/null
+++ b/shell/ash_test/ash-quoting/squote_in_varexp3.tests
@@ -0,0 +1 @@
+x=\'B; echo "${x#\'}"
diff --git a/shell/ash_test/ash-redir/redir_exec1.right b/shell/ash_test/ash-redir/redir_exec1.right
new file mode 100644
index 000000000..d4393d10c
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_exec1.right
@@ -0,0 +1,2 @@
+redir_exec1.tests: line 1: can't create /cant/be/created: nonexistent directory
+First
diff --git a/shell/ash_test/ash-redir/redir_exec1.tests b/shell/ash_test/ash-redir/redir_exec1.tests
new file mode 100755
index 000000000..290e1cb39
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_exec1.tests
@@ -0,0 +1,2 @@
+v=`echo First >&2` exec >/cant/be/created
+echo One:$?
diff --git a/shell/ash_test/ash-vars/var_bash3.right b/shell/ash_test/ash-vars/var_bash3.right
index a97c850ea..8899d981c 100644
--- a/shell/ash_test/ash-vars/var_bash3.right
+++ b/shell/ash_test/ash-vars/var_bash3.right
@@ -1,6 +1,6 @@
 1 a041#c
 2 a041#c
-3 a\041#c
+3 a041#c
 4 a\041#c
 5 a\041#c
 6 a\041#c
@@ -17,4 +17,4 @@
 17 a\tc
 18 a\tc
 19 atc
-20 a\tc
+20 atc
diff --git a/shell/ash_test/ash-vars/var_bash4.right b/shell/ash_test/ash-vars/var_bash4.right
index 0ef1bf661..9067e58e6 100644
--- a/shell/ash_test/ash-vars/var_bash4.right
+++ b/shell/ash_test/ash-vars/var_bash4.right
@@ -3,26 +3,26 @@ Replace str:   _\\_\z_
 Pattern:       single backslash and star: "replace literal star"
 Unquoted:      a_\_z_b\*c
 Unquoted =:    a_\_z_b\*c
-Quoted:        a_\_\z_b\*c
-Quoted =:      a_\_\z_b\*c
+Quoted:        a_\_z_b\*c
+Quoted =:      a_\_z_b\*c
 Pattern:       double backslash and star: "replace backslash and everything after it"
 Unquoted:      a*b_\_z_
 Unquoted =:    a*b_\_z_
-Quoted:        a*b_\_\z_
-Quoted =:      a*b_\_\z_
+Quoted:        a*b_\_z_
+Quoted =:      a*b_\_z_
 
 Source:        a\bc
 Replace str:   _\\_\z_
 Pattern:       single backslash and b: "replace b"
 Unquoted:      a\_\_z_c
 Unquoted =:    a\_\_z_c
-Quoted:        a\_\_\z_c
-Quoted =:      a\_\_\z_c
+Quoted:        a\_\_z_c
+Quoted =:      a\_\_z_c
 Pattern:       double backslash and b: "replace backslash and b"
 Unquoted:      a_\_z_c
 Unquoted =:    a_\_z_c
-Quoted:        a_\_\z_c
-Quoted =:      a_\_\z_c
+Quoted:        a_\_z_c
+Quoted =:      a_\_z_c
 
 Source:        a\bc
 Replace str:   _\\_\z_ (as variable $s)
diff --git a/shell/ash_test/ash-vars/var_bash6.right b/shell/ash_test/ash-vars/var_bash6.right
index 63fc23df8..115ff8b04 100644
--- a/shell/ash_test/ash-vars/var_bash6.right
+++ b/shell/ash_test/ash-vars/var_bash6.right
@@ -1,5 +1,5 @@
 Expected Actual
 a*z    : a*z
-\z     : \z
+z      : z
 a1z a2z: a1z a2z
 z      : z
diff --git a/shell/ash_test/ash-vars/var_bash6.tests b/shell/ash_test/ash-vars/var_bash6.tests
index cf2e4f020..686834177 100755
--- a/shell/ash_test/ash-vars/var_bash6.tests
+++ b/shell/ash_test/ash-vars/var_bash6.tests
@@ -3,7 +3,7 @@
 >a1z; >a2z;
           echo 'Expected' 'Actual'
 v='a bz'; echo 'a*z    :' "${v/a*z/a*z}"
-v='a bz'; echo '\z     :' "${v/a*z/\z}"
+v='a bz'; echo 'z      :' "${v/a*z/\z}"
 v='a bz'; echo 'a1z a2z:' ${v/a*z/a*z}
 v='a bz'; echo 'z      :' ${v/a*z/\z}
 rm a1z a2z
diff --git a/shell/ash_test/ash-vars/var_bash7.right b/shell/ash_test/ash-vars/var_bash7.right
new file mode 100644
index 000000000..223b7836f
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash7.right
@@ -0,0 +1 @@
+B
diff --git a/shell/ash_test/ash-vars/var_bash7.tests b/shell/ash_test/ash-vars/var_bash7.tests
new file mode 100755
index 000000000..c4ce03f7f
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash7.tests
@@ -0,0 +1 @@
+x=AB; echo "${x#$'\x41'}"
diff --git a/shell/hush.c b/shell/hush.c
index 06fe0e405..d5ea3b21f 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -79,20 +79,6 @@
  *      Some builtins mandated by standards:
  *          newgrp [GRP]: not a builtin in bash but a suid binary
  *              which spawns a new shell with new group ID
- *      In bash, export builtin is special, its arguments are assignments
- *          and therefore expansion of them should be "one-word" expansion:
- *              $ export i=`echo 'a  b'` # export has one arg: "i=a  b"
- *          compare with:
- *              $ ls i=`echo 'a  b'`     # ls has two args: "i=a" and "b"
- *              ls: cannot access i=a: No such file or directory
- *              ls: cannot access b: No such file or directory
- *          Note1: same applies to local builtin.
- *          Note2: bash 3.2.33(1) does this only if export word itself
- *          is not quoted:
- *              $ export i=`echo 'aaa  bbb'`; echo "$i"
- *              aaa  bbb
- *              $ "export" i=`echo 'aaa  bbb'`; echo "$i"
- *              aaa
  */
 //config:config HUSH
 //config:       bool "hush (64 kb)"
@@ -326,13 +312,13 @@
 //kbuild:lib-$(CONFIG_BASH_IS_HUSH) += hush.o match.o shell_common.o
 //kbuild:lib-$(CONFIG_HUSH_RANDOM_SUPPORT) += random.o
 
-/* -i (interactive) and -s (read stdin) are also accepted,
- * but currently do nothing, therefore aren't shown in help.
+/* -i (interactive) is also accepted,
+ * but does nothing, therefore not shown in help.
  * NOMMU-specific options are not meant to be used by users,
  * therefore we don't show them either.
  */
 //usage:#define hush_trivial_usage
-//usage:        "[-enxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
+//usage:        "[-enxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS] / -s [ARGS]]"
 //usage:#define hush_full_usage "\n\n"
 //usage:        "Unix shell interpreter"
 
@@ -454,6 +440,7 @@
 #define debug_printf_redir(...)  do {} while (0)
 #define debug_printf_list(...)   do {} while (0)
 #define debug_printf_subst(...)  do {} while (0)
+#define debug_printf_prompt(...) do {} while (0)
 #define debug_printf_clean(...)  do {} while (0)
 
 #define ERR_PTR ((void*)(long)1)
@@ -489,7 +476,6 @@ static const char hush_version_str[] ALIGN1 = "HUSH_VERSION="BB_VER;
  */
 #if !BB_MMU
 typedef struct nommu_save_t {
-        char **new_env;
         struct variable *old_vars;
         char **argv;
         char **argv_from_re_execing;
@@ -566,9 +552,6 @@ static const char *const assignment_flag[] = {
 
 typedef struct in_str {
         const char *p;
-#if ENABLE_HUSH_INTERACTIVE
-        smallint promptmode; /* 0: PS1, 1: PS2 */
-#endif
         int peek_buf[2];
         int last_char;
         FILE *file;
@@ -623,15 +606,17 @@ typedef enum redir_type {
 
 struct command {
         pid_t pid;                  /* 0 if exited */
-        int assignment_cnt;         /* how many argv[i] are assignments? */
+        unsigned assignment_cnt;    /* how many argv[i] are assignments? */
 #if ENABLE_HUSH_LINENO_VAR
         unsigned lineno;
 #endif
         smallint cmd_type;          /* CMD_xxx */
 #define CMD_NORMAL   0
 #define CMD_SUBSHELL 1
-#if BASH_TEST2
-/* used for "[[ EXPR ]]" */
+#if BASH_TEST2 || ENABLE_HUSH_LOCAL || ENABLE_HUSH_EXPORT || ENABLE_HUSH_READONLY
+/* used for "[[ EXPR ]]", and to prevent word splitting and globbing in
+ * "export v=t*"
+ */
 # define CMD_SINGLEWORD_NOGLOB 2
 #endif
 #if ENABLE_HUSH_FUNCTIONS
@@ -742,10 +727,8 @@ struct parse_context {
 struct variable {
         struct variable *next;
         char *varstr;        /* points to "name=" portion */
-#if ENABLE_HUSH_LOCAL
-        unsigned func_nest_level;
-#endif
         int max_len;         /* if > 0, name is part of initial env; else name is malloced */
+        uint16_t var_nest_level;
         smallint flg_export; /* putenv should be done on this var */
         smallint flg_read_only;
 };
@@ -843,7 +826,7 @@ struct globals {
          * _AND_ if we decided to act interactively */
         int interactive_fd;
         const char *PS1;
-        const char *PS2;
+        IF_FEATURE_EDITING_FANCY_PROMPT(const char *PS2;)
 # define G_interactive_fd (G.interactive_fd)
 #else
 # define G_interactive_fd 0
@@ -891,6 +874,9 @@ struct globals {
 #else
 # define G_x_mode 0
 #endif
+#if ENABLE_HUSH_INTERACTIVE
+        smallint promptmode; /* 0: PS1, 1: PS2 */
+#endif
         smallint flag_SIGINT;
 #if ENABLE_HUSH_LOOPS
         smallint flag_break_continue;
@@ -906,8 +892,9 @@ struct globals {
 # define G_flag_return_in_progress 0
 #endif
         smallint exiting; /* used to prevent EXIT trap recursion */
-        /* These four support $?, $#, and $1 */
+        /* These support $?, $#, and $1 */
         smalluint last_exitcode;
+        smalluint expand_exitcode;
         smalluint last_bg_pid_exitcode;
 #if ENABLE_HUSH_SET
         /* are global_argv and global_argv[1..n] malloced? (note: not [0]) */
@@ -933,12 +920,13 @@ struct globals {
         const char *cwd;
         struct variable *top_var;
         char **expanded_assignments;
+        struct variable **shadowed_vars_pp;
+        unsigned var_nest_level;
 #if ENABLE_HUSH_FUNCTIONS
-        struct function *top_func;
 # if ENABLE_HUSH_LOCAL
-        struct variable **shadowed_vars_pp;
-        unsigned func_nest_level;
+        unsigned func_nest_level; /* solely to prevent "local v" in non-functions */
 # endif
+        struct function *top_func;
 #endif
         /* Signal and trap handling */
 #if ENABLE_HUSH_FAST
@@ -1261,6 +1249,10 @@ static const struct built_in_command bltins2[] = {
 # define debug_printf_subst(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
+#ifndef debug_printf_prompt
+# define debug_printf_prompt(...) (indent(), fdprintf(2, __VA_ARGS__))
+#endif
+
 #ifndef debug_printf_clean
 # define debug_printf_clean(...) (indent(), fdprintf(2, __VA_ARGS__))
 # define DEBUG_CLEAN 1
@@ -1407,7 +1399,7 @@ static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
 #endif
 
 
-#if ENABLE_HUSH_INTERACTIVE
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
 static void cmdedit_update_prompt(void);
 #else
 # define cmdedit_update_prompt() ((void)0)
@@ -2136,40 +2128,58 @@ static const char* FAST_FUNC get_local_var_value(const char *name)
         return NULL;
 }
 
+static void handle_changed_special_names(const char *name, unsigned name_len)
+{
+        if (ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
+         && name_len == 3 && name[0] == 'P' && name[1] == 'S'
+        ) {
+                cmdedit_update_prompt();
+                return;
+        }
+
+        if ((ENABLE_HUSH_LINENO_VAR || ENABLE_HUSH_GETOPTS)
+         && name_len == 6
+        ) {
+#if ENABLE_HUSH_LINENO_VAR
+                if (strncmp(name, "LINENO", 6) == 0) {
+                        G.lineno_var = NULL;
+                        return;
+                }
+#endif
+#if ENABLE_HUSH_GETOPTS
+                if (strncmp(name, "OPTIND", 6) == 0) {
+                        G.getopt_count = 0;
+                        return;
+                }
+#endif
+        }
+}
+
 /* str holds "NAME=VAL" and is expected to be malloced.
  * We take ownership of it.
  */
 #define SETFLAG_EXPORT   (1 << 0)
 #define SETFLAG_UNEXPORT (1 << 1)
 #define SETFLAG_MAKE_RO  (1 << 2)
-#define SETFLAG_LOCAL_SHIFT    3
+#define SETFLAG_VARLVL_SHIFT   3
 static int set_local_var(char *str, unsigned flags)
 {
-        struct variable **var_pp;
+        struct variable **cur_pp;
         struct variable *cur;
         char *free_me = NULL;
         char *eq_sign;
         int name_len;
-        IF_HUSH_LOCAL(unsigned local_lvl = (flags >> SETFLAG_LOCAL_SHIFT);)
+        unsigned local_lvl = (flags >> SETFLAG_VARLVL_SHIFT);
 
         eq_sign = strchr(str, '=');
-        if (!eq_sign) { /* not expected to ever happen? */
-                free(str);
-                return -1;
-        }
+        if (HUSH_DEBUG && !eq_sign)
+                bb_error_msg_and_die("BUG in setvar");
 
         name_len = eq_sign - str + 1; /* including '=' */
-#if ENABLE_HUSH_LINENO_VAR
-        if (G.lineno_var) {
-                if (name_len == 7 && strncmp("LINENO", str, 6) == 0)
-                        G.lineno_var = NULL;
-        }
-#endif
-
-        var_pp = &G.top_var;
-        while ((cur = *var_pp) != NULL) {
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
                 if (strncmp(cur->varstr, str, name_len) != 0) {
-                        var_pp = &cur->next;
+                        cur_pp = &cur->next;
                         continue;
                 }
 
@@ -2187,15 +2197,7 @@ static int set_local_var(char *str, unsigned flags)
                         unsetenv(str);
                         *eq_sign = '=';
                 }
-#if ENABLE_HUSH_LOCAL
-                if (cur->func_nest_level < local_lvl) {
-                        /* New variable is declared as local,
-                         * and existing one is global, or local
-                         * from enclosing function.
-                         * Remove and save old one: */
-                        *var_pp = cur->next;
-                        cur->next = *G.shadowed_vars_pp;
-                        *G.shadowed_vars_pp = cur;
+                if (cur->var_nest_level < local_lvl) {
                         /* bash 3.2.33(1) and exported vars:
                          * # export z=z
                          * # f() { local z=a; env | grep ^z; }
@@ -2206,17 +2208,46 @@ static int set_local_var(char *str, unsigned flags)
                          */
                         if (cur->flg_export)
                                 flags |= SETFLAG_EXPORT;
+                        /* New variable is local ("local VAR=VAL" or
+                         * "VAR=VAL cmd")
+                         * and existing one is global, or local
+                         * on a lower level that new one.
+                         * Remove it from global variable list:
+                         */
+                        *cur_pp = cur->next;
+                        if (G.shadowed_vars_pp) {
+                                /* Save in "shadowed" list */
+                                debug_printf_env("shadowing %s'%s'/%u by '%s'/%u\n",
+                                        cur->flg_export ? "exported " : "",
+                                        cur->varstr, cur->var_nest_level, str, local_lvl
+                                );
+                                cur->next = *G.shadowed_vars_pp;
+                                *G.shadowed_vars_pp = cur;
+                        } else {
+                                /* Came from pseudo_exec_argv(), no need to save: delete it */
+                                debug_printf_env("shadow-deleting %s'%s'/%u by '%s'/%u\n",
+                                        cur->flg_export ? "exported " : "",
+                                        cur->varstr, cur->var_nest_level, str, local_lvl
+                                );
+                                if (cur->max_len == 0) /* allocated "VAR=VAL"? */
+                                        free_me = cur->varstr; /* then free it later */
+                                free(cur);
+                        }
                         break;
                 }
-#endif
+
                 if (strcmp(cur->varstr + name_len, eq_sign + 1) == 0) {
+                        debug_printf_env("assignement '%s' does not change anything\n", str);
  free_and_exp:
                         free(str);
                         goto exp;
                 }
+
+                /* Replace the value in the found "struct variable" */
                 if (cur->max_len != 0) {
-                        if (cur->max_len >= strlen(str)) {
+                        if (cur->max_len >= strnlen(str, cur->max_len + 1)) {
                                 /* This one is from startup env, reuse space */
+                                debug_printf_env("reusing startup env for '%s'\n", str);
                                 strcpy(cur->varstr, str);
                                 goto free_and_exp;
                         }
@@ -2234,11 +2265,11 @@ static int set_local_var(char *str, unsigned flags)
                 goto set_str_and_exp;
         }
 
-        /* Not found - create new variable struct */
+        /* Not found or shadowed - create new variable struct */
         cur = xzalloc(sizeof(*cur));
-        IF_HUSH_LOCAL(cur->func_nest_level = local_lvl;)
-        cur->next = *var_pp;
-        *var_pp = cur;
+        cur->var_nest_level = local_lvl;
+        cur->next = *cur_pp;
+        *cur_pp = cur;
 
  set_str_and_exp:
         cur->varstr = str;
@@ -2250,20 +2281,13 @@ static int set_local_var(char *str, unsigned flags)
 #endif
         if (flags & SETFLAG_EXPORT)
                 cur->flg_export = 1;
-        if (name_len == 4 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
-                cmdedit_update_prompt();
-#if ENABLE_HUSH_GETOPTS
-        /* defoptindvar is a "OPTIND=..." constant string */
-        if (strncmp(cur->varstr, defoptindvar, 7) == 0)
-                G.getopt_count = 0;
-#endif
         if (cur->flg_export) {
                 if (flags & SETFLAG_UNEXPORT) {
                         cur->flg_export = 0;
                         /* unsetenv was already done */
                 } else {
                         int i;
-                        debug_printf_env("%s: putenv '%s'\n", __func__, cur->varstr);
+                        debug_printf_env("%s: putenv '%s'/%u\n", __func__, cur->varstr, cur->var_nest_level);
                         i = putenv(cur->varstr);
                         /* only now we can free old exported malloced string */
                         free(free_me);
@@ -2271,6 +2295,9 @@ static int set_local_var(char *str, unsigned flags)
                 }
         }
         free(free_me);
+
+        handle_changed_special_names(cur->varstr, name_len - 1);
+
         return 0;
 }
 
@@ -2283,39 +2310,33 @@ static void set_pwd_var(unsigned flag)
 static int unset_local_var_len(const char *name, int name_len)
 {
         struct variable *cur;
-        struct variable **var_pp;
-
-        if (!name)
-                return EXIT_SUCCESS;
+        struct variable **cur_pp;
 
-#if ENABLE_HUSH_GETOPTS
-        if (name_len == 6 && strncmp(name, "OPTIND", 6) == 0)
-                G.getopt_count = 0;
-#endif
-#if ENABLE_HUSH_LINENO_VAR
-        if (name_len == 6 && G.lineno_var && strncmp(name, "LINENO", 6) == 0)
-                G.lineno_var = NULL;
-#endif
-
-        var_pp = &G.top_var;
-        while ((cur = *var_pp) != NULL) {
-                if (strncmp(cur->varstr, name, name_len) == 0 && cur->varstr[name_len] == '=') {
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
+                if (strncmp(cur->varstr, name, name_len) == 0
+                 && cur->varstr[name_len] == '='
+                ) {
                         if (cur->flg_read_only) {
                                 bb_error_msg("%s: readonly variable", name);
                                 return EXIT_FAILURE;
                         }
-                        *var_pp = cur->next;
+
+                        *cur_pp = cur->next;
                         debug_printf_env("%s: unsetenv '%s'\n", __func__, cur->varstr);
                         bb_unsetenv(cur->varstr);
-                        if (name_len == 3 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
-                                cmdedit_update_prompt();
                         if (!cur->max_len)
                                 free(cur->varstr);
                         free(cur);
-                        return EXIT_SUCCESS;
+
+                        break;
                 }
-                var_pp = &cur->next;
+                cur_pp = &cur->next;
         }
+
+        /* Handle "unset PS1" et al even if did not find the variable to unset */
+        handle_changed_special_names(name, name_len);
+
         return EXIT_SUCCESS;
 }
 
@@ -2326,21 +2347,6 @@ static int unset_local_var(const char *name)
 }
 #endif
 
-static void unset_vars(char **strings)
-{
-        char **v;
-
-        if (!strings)
-                return;
-        v = strings;
-        while (*v) {
-                const char *eq = strchrnul(*v, '=');
-                unset_local_var_len(*v, (int)(eq - *v));
-                v++;
-        }
-        free(strings);
-}
-
 #if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
@@ -2362,22 +2368,27 @@ static void add_vars(struct variable *var)
                 var->next = G.top_var;
                 G.top_var = var;
                 if (var->flg_export) {
-                        debug_printf_env("%s: restoring exported '%s'\n", __func__, var->varstr);
+                        debug_printf_env("%s: restoring exported '%s'/%u\n", __func__, var->varstr, var->var_nest_level);
                         putenv(var->varstr);
                 } else {
-                        debug_printf_env("%s: restoring variable '%s'\n", __func__, var->varstr);
+                        debug_printf_env("%s: restoring variable '%s'/%u\n", __func__, var->varstr, var->var_nest_level);
                 }
                 var = next;
         }
 }
 
-static struct variable *set_vars_and_save_old(char **strings)
+/* We put strings[i] into variable table and possibly putenv them.
+ * If variable is read only, we can free the strings[i]
+ * which attempts to overwrite it.
+ * The strings[] vector itself is freed.
+ */
+static void set_vars_and_save_old(char **strings)
 {
         char **s;
-        struct variable *old = NULL;
 
         if (!strings)
-                return old;
+                return;
+
         s = strings;
         while (*s) {
                 struct variable *var_p;
@@ -2404,19 +2415,20 @@ static struct variable *set_vars_and_save_old(char **strings)
                                         do { *p = p[1]; p++; } while (*p);
                                         goto next;
                                 }
-                                /* Remove variable from global linked list */
-                                debug_printf_env("%s: removing '%s'\n", __func__, var_p->varstr);
-                                *var_pp = var_p->next;
-                                /* Add it to returned list */
-                                var_p->next = old;
-                                old = var_p;
+                                /* below, set_local_var() with nest level will
+                                 * "shadow" (remove) this variable from
+                                 * global linked list.
+                                 */
                         }
-                        set_local_var(*s, SETFLAG_EXPORT);
+                        //bb_error_msg("G.var_nest_level:%d", G.var_nest_level);
+                        set_local_var(*s, (G.var_nest_level << SETFLAG_VARLVL_SHIFT) | SETFLAG_EXPORT);
+                } else if (HUSH_DEBUG) {
+                        bb_error_msg_and_die("BUG in varexp4");
                 }
- next:
                 s++;
+ next: ;
         }
-        return old;
+        free(strings);
 }
 
 
@@ -2452,36 +2464,36 @@ static void reinit_unicode_for_hush(void)
  *      \
  * It exercises a lot of corner cases.
  */
+# if ENABLE_FEATURE_EDITING_FANCY_PROMPT
 static void cmdedit_update_prompt(void)
 {
-        if (ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
-                G.PS1 = get_local_var_value("PS1");
-                if (G.PS1 == NULL)
-                        G.PS1 = "\\w \\$ ";
-                G.PS2 = get_local_var_value("PS2");
-        } else {
-                G.PS1 = NULL;
-        }
+        G.PS1 = get_local_var_value("PS1");
+        if (G.PS1 == NULL)
+                G.PS1 = "";
+        G.PS2 = get_local_var_value("PS2");
         if (G.PS2 == NULL)
-                G.PS2 = "> ";
+                G.PS2 = "";
 }
-static const char *setup_prompt_string(int promptmode)
+# endif
+static const char *setup_prompt_string(void)
 {
         const char *prompt_str;
-        debug_printf("setup_prompt_string %d ", promptmode);
-        if (!ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
-                /* Set up the prompt */
-                if (promptmode == 0) { /* PS1 */
+
+        debug_printf_prompt("%s promptmode:%d\n", __func__, G.promptmode);
+
+        IF_FEATURE_EDITING_FANCY_PROMPT(    prompt_str = G.PS2;)
+        IF_NOT_FEATURE_EDITING_FANCY_PROMPT(prompt_str = "> ";)
+        if (G.promptmode == 0) { /* PS1 */
+                if (!ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
+                        /* No fancy prompts supported, (re)generate "CURDIR $ " by hand */
                         free((char*)G.PS1);
                         /* bash uses $PWD value, even if it is set by user.
                          * It uses current dir only if PWD is unset.
                          * We always use current dir. */
                         G.PS1 = xasprintf("%s %c ", get_cwd(0), (geteuid() != 0) ? '$' : '#');
-                        prompt_str = G.PS1;
-                } else
-                        prompt_str = G.PS2;
-        } else
-                prompt_str = (promptmode == 0) ? G.PS1 : G.PS2;
+                }
+                prompt_str = G.PS1;
+        }
         debug_printf("prompt_str '%s'\n", prompt_str);
         return prompt_str;
 }
@@ -2490,7 +2502,7 @@ static int get_user_input(struct in_str *i)
         int r;
         const char *prompt_str;
 
-        prompt_str = setup_prompt_string(i->promptmode);
+        prompt_str = setup_prompt_string();
 # if ENABLE_FEATURE_EDITING
         for (;;) {
                 reinit_unicode_for_hush();
@@ -2560,7 +2572,8 @@ static int fgetc_interactive(struct in_str *i)
         if (G_interactive_fd && i->file == stdin) {
                 /* Returns first char (or EOF), the rest is in i->p[] */
                 ch = get_user_input(i);
-                i->promptmode = 1; /* PS2 */
+                G.promptmode = 1; /* PS2 */
+                debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
         } else {
                 /* Not stdin: script file, sourced file, etc */
                 do ch = fgetc(i->file); while (ch == '\0');
@@ -2733,7 +2746,6 @@ static int i_peek_and_eat_bkslash_nl(struct in_str *input)
 static void setup_file_in_str(struct in_str *i, FILE *f)
 {
         memset(i, 0, sizeof(*i));
-        /* i->promptmode = 0; - PS1 (memset did it) */
         i->file = f;
         /* i->p = NULL; */
 }
@@ -2741,7 +2753,6 @@ static void setup_file_in_str(struct in_str *i, FILE *f)
 static void setup_string_in_str(struct in_str *i, const char *s)
 {
         memset(i, 0, sizeof(*i));
-        /* i->promptmode = 0; - PS1 (memset did it) */
         /*i->file = NULL */;
         i->p = s;
 }
@@ -3933,14 +3944,37 @@ static int done_word(o_string *word, struct parse_context *ctx)
                                                 (ctx->ctx_res_w == RES_SNTX));
                                 return (ctx->ctx_res_w == RES_SNTX);
                         }
-# if BASH_TEST2
-                        if (strcmp(word->data, "[[") == 0) {
+# if defined(CMD_SINGLEWORD_NOGLOB)
+                        if (0
+#  if BASH_TEST2
+                         || strcmp(word->data, "[[") == 0
+#  endif
+                        /* In bash, local/export/readonly are special, args
+                         * are assignments and therefore expansion of them
+                         * should be "one-word" expansion:
+                         *  $ export i=`echo 'a  b'` # one arg: "i=a  b"
+                         * compare with:
+                         *  $ ls i=`echo 'a  b'`     # two args: "i=a" and "b"
+                         *  ls: cannot access i=a: No such file or directory
+                         *  ls: cannot access b: No such file or directory
+                         * Note: bash 3.2.33(1) does this only if export word
+                         * itself is not quoted:
+                         *  $ export i=`echo 'aaa  bbb'`; echo "$i"
+                         *  aaa  bbb
+                         *  $ "export" i=`echo 'aaa  bbb'`; echo "$i"
+                         *  aaa
+                         */
+                        IF_HUSH_LOCAL(    || strcmp(word->data, "local") == 0)
+                        IF_HUSH_EXPORT(   || strcmp(word->data, "export") == 0)
+                        IF_HUSH_READONLY( || strcmp(word->data, "readonly") == 0)
+                        ) {
                                 command->cmd_type = CMD_SINGLEWORD_NOGLOB;
                         }
                         /* fall through */
 # endif
                 }
-#endif
+#endif /* HAS_KEYWORDS */
+
                 if (command->group) {
                         /* "{ echo foo; } echo bar" - bad */
                         syntax_error_at(word->data);
@@ -4240,7 +4274,6 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
 
                                         redir->rd_type = REDIRECT_HEREDOC2;
                                         /* redir->rd_dup is (ab)used to indicate <<- */
-bb_error_msg("redir->rd_filename:'%s'",  redir->rd_filename);
                                         p = fetch_till_str(&ctx->as_string, input,
                                                         redir->rd_filename, redir->rd_dup);
                                         if (!p) {
@@ -4286,6 +4319,11 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
         /* dest contains characters seen prior to ( or {.
          * Typically it's empty, but for function defs,
          * it contains function name (without '()'). */
+#if BB_MMU
+# define as_string NULL
+#else
+        char *as_string = NULL;
+#endif
         struct pipe *pipe_list;
         int endch;
         struct command *command = ctx->command;
@@ -4314,7 +4352,7 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
                 do
                         ch = i_getch(input);
                 while (ch == ' ' || ch == '\t' || ch == '\n');
-                if (ch != '{') {
+                if (ch != '{' && ch != '(') {
                         syntax_error_unexpected_ch(ch);
                         return 1;
                 }
@@ -4336,13 +4374,13 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
         }
 #endif
 
-#if ENABLE_HUSH_FUNCTIONS
- skip:
-#endif
+ IF_HUSH_FUNCTIONS(skip:)
+
         endch = '}';
         if (ch == '(') {
                 endch = ')';
-                command->cmd_type = CMD_SUBSHELL;
+                IF_HUSH_FUNCTIONS(if (command->cmd_type != CMD_FUNCDEF))
+                        command->cmd_type = CMD_SUBSHELL;
         } else {
                 /* bash does not allow "{echo...", requires whitespace */
                 ch = i_peek(input);
@@ -4358,38 +4396,54 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
                 }
         }
 
-        {
-#if BB_MMU
-# define as_string NULL
-#else
-                char *as_string = NULL;
-#endif
-                pipe_list = parse_stream(&as_string, input, endch);
+        pipe_list = parse_stream(&as_string, input, endch);
 #if !BB_MMU
-                if (as_string)
-                        o_addstr(&ctx->as_string, as_string);
+        if (as_string)
+                o_addstr(&ctx->as_string, as_string);
 #endif
-                /* empty ()/{} or parse error? */
-                if (!pipe_list || pipe_list == ERR_PTR) {
-                        /* parse_stream already emitted error msg */
-                        if (!BB_MMU)
-                                free(as_string);
-                        debug_printf_parse("parse_group return 1: "
-                                "parse_stream returned %p\n", pipe_list);
-                        return 1;
-                }
-                command->group = pipe_list;
+
+        /* empty ()/{} or parse error? */
+        if (!pipe_list || pipe_list == ERR_PTR) {
+                /* parse_stream already emitted error msg */
+                if (!BB_MMU)
+                        free(as_string);
+                debug_printf_parse("parse_group return 1: "
+                        "parse_stream returned %p\n", pipe_list);
+                return 1;
+        }
 #if !BB_MMU
-                as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
-                command->group_as_string = as_string;
-                debug_printf_parse("end of group, remembering as:'%s'\n",
-                                command->group_as_string);
+        as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
+        command->group_as_string = as_string;
+        debug_printf_parse("end of group, remembering as:'%s'\n",
+                        command->group_as_string);
 #endif
-#undef as_string
+
+#if ENABLE_HUSH_FUNCTIONS
+        /* Convert "f() (cmds)" to "f() {(cmds)}" */
+        if (command->cmd_type == CMD_FUNCDEF && endch == ')') {
+                struct command *cmd2;
+
+                cmd2 = xzalloc(sizeof(*cmd2));
+                cmd2->cmd_type = CMD_SUBSHELL;
+                cmd2->group = pipe_list;
+# if !BB_MMU
+//UNTESTED!
+                cmd2->group_as_string = command->group_as_string;
+                command->group_as_string = xasprintf("(%s)", command->group_as_string);
+# endif
+
+                pipe_list = new_pipe();
+                pipe_list->cmds = cmd2;
+                pipe_list->num_cmds = 1;
         }
+#endif
+
+        command->group = pipe_list;
+
         debug_printf_parse("parse_group return 0\n");
         return 0;
         /* command remains "open", available for possible redirects */
+#undef as_string
 }
 
 #if ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS
@@ -4499,6 +4553,9 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
 # endif
         end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
 
+        G.promptmode = 1; /* PS2 */
+        debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
+
         while (1) {
                 ch = i_getch(input);
                 if (ch == EOF) {
@@ -4564,6 +4621,7 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
                         continue;
                 }
         }
+        debug_printf_parse("%s return '%s' ch:'%c'\n", __func__, dest->data, ch);
         return ch;
 }
 #endif /* ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS */
@@ -5477,7 +5535,7 @@ static struct pipe *parse_stream(char **pstring,
                         goto parse_error2;
                 default:
                         if (HUSH_DEBUG)
-                                bb_error_msg_and_die("BUG: unexpected %c\n", ch);
+                                bb_error_msg_and_die("BUG: unexpected %c", ch);
                 }
         } /* while (1) */
 
@@ -5916,11 +5974,11 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 /* pattern uses non-standard expansion.
                                  * repl should be unbackslashed and globbed
                                  * by the usual expansion rules:
-                                 * >az; >bz;
-                                 * v='a bz'; echo "${v/a*z/a*z}" prints "a*z"
-                                 * v='a bz'; echo "${v/a*z/\z}"  prints "\z"
-                                 * v='a bz'; echo ${v/a*z/a*z}   prints "az"
-                                 * v='a bz'; echo ${v/a*z/\z}    prints "z"
+                                 *  >az >bz
+                                 *  v='a bz'; echo "${v/a*z/a*z}" #prints "a*z"
+                                 *  v='a bz'; echo "${v/a*z/\z}"  #prints "z"
+                                 *  v='a bz'; echo ${v/a*z/a*z}   #prints "az"
+                                 *  v='a bz'; echo ${v/a*z/\z}    #prints "z"
                                  * (note that a*z _pattern_ is never globbed!)
                                  */
                                 char *pattern, *repl, *t;
@@ -5932,7 +5990,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 exp_word = p;
                                 p = strchr(p, SPECIAL_VAR_SYMBOL);
                                 *p = '\0';
-                                repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ arg0 & 0x80, /*unbackslash:*/ 1);
+                                repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 1);
                                 debug_printf_varexp("repl:'%s'->'%s'\n", exp_word, repl);
                                 /* HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
@@ -6199,6 +6257,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                          * and $IFS-split */
                         debug_printf_subst("SUBST '%s' first_ch %x\n", arg, first_ch);
                         G.last_exitcode = process_command_subs(&subst_result, arg);
+                        G.expand_exitcode = G.last_exitcode;
                         debug_printf_subst("SUBST RES:%d '%s'\n", G.last_exitcode, subst_result.data);
                         val = subst_result.data;
                         goto store_val;
@@ -6300,7 +6359,7 @@ static char **expand_strvec_to_strvec(char **argv)
         return expand_variables(argv, EXP_FLAG_GLOB | EXP_FLAG_ESC_GLOB_CHARS);
 }
 
-#if BASH_TEST2
+#if defined(CMD_SINGLEWORD_NOGLOB)
 static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 {
         return expand_variables(argv, EXP_FLAG_SINGLEWORD);
@@ -6308,7 +6367,7 @@ static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 #endif
 
 /* Used for expansion of right hand of assignments,
- * $((...)), heredocs, variable espansion parts.
+ * $((...)), heredocs, variable expansion parts.
  *
  * NB: should NOT do globbing!
  * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*"
@@ -6348,7 +6407,7 @@ static char *expand_string_to_string(const char *str, int do_unbackslash)
         return (char*)list;
 }
 
-#if ENABLE_HUSH_CASE
+#if 0
 static char* expand_strvec_to_string(char **argv)
 {
         char **list;
@@ -6619,8 +6678,10 @@ static void parse_and_run_stream(struct in_str *inp, int end_trigger)
                 struct pipe *pipe_list;
 
 #if ENABLE_HUSH_INTERACTIVE
-                if (end_trigger == ';')
-                        inp->promptmode = 0; /* PS1 */
+                if (end_trigger == ';') {
+                        G.promptmode = 0; /* PS1 */
+                        debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
+                }
 #endif
                 pipe_list = parse_stream(NULL, inp, end_trigger);
                 if (!pipe_list || pipe_list == ERR_PTR) { /* EOF/error */
@@ -7329,8 +7390,9 @@ static void exec_function(char ***to_free,
 // for "more correctness" we might want to close those extra fds here:
 //?     close_saved_fds_and_FILE_fds();
 
-        /* "we are in function, ok to use return" */
+        /* "we are in a function, ok to use return" */
         G_flag_return_in_progress = -1;
+        G.var_nest_level++;
         IF_HUSH_LOCAL(G.func_nest_level++;)
 
         /* On MMU, funcp->body is always non-NULL */
@@ -7350,6 +7412,53 @@ static void exec_function(char ***to_free,
 # endif
 }
 
+static void enter_var_nest_level(void)
+{
+        G.var_nest_level++;
+        debug_printf_env("var_nest_level++ %u\n", G.var_nest_level);
+
+        /* Try: f() { echo -n .; f; }; f
+         * struct variable::var_nest_level is uint16_t,
+         * thus limiting recursion to < 2^16.
+         * In any case, with 8 Mbyte stack SEGV happens
+         * not too long after 2^16 recursions anyway.
+         */
+        if (G.var_nest_level > 0xff00)
+                bb_error_msg_and_die("fatal recursion (depth %u)", G.var_nest_level);
+}
+
+static void leave_var_nest_level(void)
+{
+        struct variable *cur;
+        struct variable **cur_pp;
+
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
+                if (cur->var_nest_level < G.var_nest_level) {
+                        cur_pp = &cur->next;
+                        continue;
+                }
+                /* Unexport */
+                if (cur->flg_export) {
+                        debug_printf_env("unexporting nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        bb_unsetenv(cur->varstr);
+                }
+                /* Remove from global list */
+                *cur_pp = cur->next;
+                /* Free */
+                if (!cur->max_len) {
+                        debug_printf_env("freeing nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        free(cur->varstr);
+                }
+                free(cur);
+        }
+
+        G.var_nest_level--;
+        debug_printf_env("var_nest_level-- %u\n", G.var_nest_level);
+        if (HUSH_DEBUG && (int)G.var_nest_level < 0)
+                bb_error_msg_and_die("BUG: nesting underflow");
+}
+
 static int run_function(const struct function *funcp, char **argv)
 {
         int rc;
@@ -7358,9 +7467,12 @@ static int run_function(const struct function *funcp, char **argv)
 
         save_and_replace_G_args(&sv, argv);
 
-        /* "we are in function, ok to use return" */
+        /* "We are in function, ok to use return" */
         sv_flg = G_flag_return_in_progress;
         G_flag_return_in_progress = -1;
+
+        /* Make "local" variables properly shadow previous ones */
+        IF_HUSH_LOCAL(enter_var_nest_level();)
         IF_HUSH_LOCAL(G.func_nest_level++;)
 
         /* On MMU, funcp->body is always non-NULL */
@@ -7375,30 +7487,9 @@ static int run_function(const struct function *funcp, char **argv)
                 rc = run_list(funcp->body);
         }
 
-# if ENABLE_HUSH_LOCAL
-        {
-                struct variable *var;
-                struct variable **var_pp;
+        IF_HUSH_LOCAL(G.func_nest_level--;)
+        IF_HUSH_LOCAL(leave_var_nest_level();)
 
-                var_pp = &G.top_var;
-                while ((var = *var_pp) != NULL) {
-                        if (var->func_nest_level < G.func_nest_level) {
-                                var_pp = &var->next;
-                                continue;
-                        }
-                        /* Unexport */
-                        if (var->flg_export)
-                                bb_unsetenv(var->varstr);
-                        /* Remove from global list */
-                        *var_pp = var->next;
-                        /* Free */
-                        if (!var->max_len)
-                                free(var->varstr);
-                        free(var);
-                }
-                G.func_nest_level--;
-        }
-# endif
         G_flag_return_in_progress = sv_flg;
 
         restore_G_args(&sv, argv);
@@ -7535,10 +7626,10 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                 char **argv_expanded)
 {
         const struct built_in_command *x;
+        struct variable **sv_shadowed;
         char **new_env;
-#if ENABLE_HUSH_COMMAND
-        char opt_vV = 0;
-#endif
+        IF_HUSH_COMMAND(char opt_vV = 0;)
+        IF_HUSH_FUNCTIONS(const struct function *funcp;)
 
         new_env = expand_assignments(argv, assignment_cnt);
         dump_cmd_in_x_mode(new_env);
@@ -7552,15 +7643,14 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                 _exit(EXIT_SUCCESS);
         }
 
+        sv_shadowed = G.shadowed_vars_pp;
 #if BB_MMU
-        set_vars_and_save_old(new_env);
-        free(new_env); /* optional */
-        /* we can also destroy set_vars_and_save_old's return value,
-         * to save memory */
+        G.shadowed_vars_pp = NULL; /* "don't save, free them instead" */
 #else
-        nommu_save->new_env = new_env;
-        nommu_save->old_vars = set_vars_and_save_old(new_env);
+        G.shadowed_vars_pp = &nommu_save->old_vars;
 #endif
+        set_vars_and_save_old(new_env);
+        G.shadowed_vars_pp = sv_shadowed;
 
         if (argv_expanded) {
                 argv = argv_expanded;
@@ -7579,12 +7669,9 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 
 #if ENABLE_HUSH_FUNCTIONS
         /* Check if the command matches any functions (this goes before bltins) */
-        {
-                const struct function *funcp = find_function(argv[0]);
-                if (funcp) {
-                        exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
-                }
-        }
+        funcp = find_function(argv[0]);
+        if (funcp)
+                exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
 #endif
 
 #if ENABLE_HUSH_COMMAND
@@ -7693,6 +7780,15 @@ static void pseudo_exec(nommu_save_t *nommu_save,
                 struct command *command,
                 char **argv_expanded)
 {
+#if ENABLE_HUSH_FUNCTIONS
+        if (command->cmd_type == CMD_FUNCDEF) {
+                /* Ignore funcdefs in pipes:
+                 * true | f() { cmd }
+                 */
+                _exit(0);
+        }
+#endif
+
         if (command->argv) {
                 pseudo_exec_argv(nommu_save, command->argv,
                                 command->assignment_cnt, argv_expanded);
@@ -8111,29 +8207,29 @@ static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
  * subshell:     ( list ) [&]
  */
 #if !ENABLE_HUSH_MODE_X
-#define redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel, argv_expanded) \
-        redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel)
+#define redirect_and_varexp_helper(old_vars_p, command, squirrel, argv_expanded) \
+        redirect_and_varexp_helper(old_vars_p, command, squirrel)
 #endif
-static int redirect_and_varexp_helper(char ***new_env_p,
-                struct variable **old_vars_p,
+static int redirect_and_varexp_helper(
                 struct command *command,
                 struct squirrel **sqp,
                 char **argv_expanded)
 {
+        /* Assignments occur before redirects. Try:
+         * a=`sleep 1` sleep 2 3>/qwe/rty
+         */
+
+        char **new_env = expand_assignments(command->argv, command->assignment_cnt);
+        dump_cmd_in_x_mode(new_env);
+        dump_cmd_in_x_mode(argv_expanded);
+        /* this takes ownership of new_env[i] elements, and frees new_env: */
+        set_vars_and_save_old(new_env);
+
         /* setup_redirects acts on file descriptors, not FILEs.
          * This is perfect for work that comes after exec().
          * Is it really safe for inline use?  Experimentally,
          * things seem to work. */
-        int rcode = setup_redirects(command, sqp);
-        if (rcode == 0) {
-                char **new_env = expand_assignments(command->argv, command->assignment_cnt);
-                *new_env_p = new_env;
-                dump_cmd_in_x_mode(new_env);
-                dump_cmd_in_x_mode(argv_expanded);
-                if (old_vars_p)
-                        *old_vars_p = set_vars_and_save_old(new_env);
-        }
-        return rcode;
+        return setup_redirects(command, sqp);
 }
 static NOINLINE int run_pipe(struct pipe *pi)
 {
@@ -8221,13 +8317,10 @@ static NOINLINE int run_pipe(struct pipe *pi)
         argv = command->argv ? command->argv : (char **) &null_ptr;
         {
                 const struct built_in_command *x;
-#if ENABLE_HUSH_FUNCTIONS
-                const struct function *funcp;
-#else
-                enum { funcp = 0 };
-#endif
-                char **new_env = NULL;
-                struct variable *old_vars = NULL;
+                IF_HUSH_FUNCTIONS(const struct function *funcp;)
+                IF_NOT_HUSH_FUNCTIONS(enum { funcp = 0 };)
+                struct variable **sv_shadowed;
+                struct variable *old_vars;
 
 #if ENABLE_HUSH_LINENO_VAR
                 if (G.lineno_var)
@@ -8235,99 +8328,109 @@ static NOINLINE int run_pipe(struct pipe *pi)
 #endif
 
                 if (argv[command->assignment_cnt] == NULL) {
-                        /* Assignments, but no command */
-                        /* Ensure redirects take effect (that is, create files).
-                         * Try "a=t >file" */
-#if 0 /* A few cases in testsuite fail with this code. FIXME */
-                        rcode = redirect_and_varexp_helper(&new_env, /*old_vars:*/ NULL, command, &squirrel, /*argv_expanded:*/ NULL);
-                        /* Set shell variables */
-                        if (new_env) {
-                                argv = new_env;
-                                while (*argv) {
-                                        if (set_local_var(*argv, /*flag:*/ 0)) {
-                                                /* assignment to readonly var / putenv error? */
-                                                rcode = 1;
-                                        }
-                                        argv++;
-                                }
-                        }
-                        /* Redirect error sets $? to 1. Otherwise,
-                         * if evaluating assignment value set $?, retain it.
-                         * Try "false; q=`exit 2`; echo $?" - should print 2: */
-                        if (rcode == 0)
-                                rcode = G.last_exitcode;
-                        /* Exit, _skipping_ variable restoring code: */
-                        goto clean_up_and_ret0;
-
-#else /* Older, bigger, but more correct code */
-
+                        /* Assignments, but no command.
+                         * Ensure redirects take effect (that is, create files).
+                         * Try "a=t >file"
+                         */
+                        unsigned i;
+                        G.expand_exitcode = 0;
+ only_assignments:
                         rcode = setup_redirects(command, &squirrel);
                         restore_redirects(squirrel);
+
                         /* Set shell variables */
                         if (G_x_mode)
                                 bb_putchar_stderr('+');
-                        while (*argv) {
-                                char *p = expand_string_to_string(*argv, /*unbackslash:*/ 1);
+                        i = 0;
+                        while (i < command->assignment_cnt) {
+                                char *p = expand_string_to_string(argv[i], /*unbackslash:*/ 1);
                                 if (G_x_mode)
                                         fprintf(stderr, " %s", p);
-                                debug_printf_exec("set shell var:'%s'->'%s'\n",
-                                                *argv, p);
+                                debug_printf_env("set shell var:'%s'->'%s'\n", *argv, p);
                                 if (set_local_var(p, /*flag:*/ 0)) {
                                         /* assignment to readonly var / putenv error? */
                                         rcode = 1;
                                 }
-                                argv++;
+                                i++;
                         }
                         if (G_x_mode)
                                 bb_putchar_stderr('\n');
                         /* Redirect error sets $? to 1. Otherwise,
                          * if evaluating assignment value set $?, retain it.
-                         * Try "false; q=`exit 2`; echo $?" - should print 2: */
+                         * Else, clear $?:
+                         *  false; q=`exit 2`; echo $? - should print 2
+                         *  false; x=1; echo $? - should print 0
+                         * Because of the 2nd case, we can't just use G.last_exitcode.
+                         */
                         if (rcode == 0)
-                                rcode = G.last_exitcode;
+                                rcode = G.expand_exitcode;
                         IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
                         debug_leave();
                         debug_printf_exec("run_pipe: return %d\n", rcode);
                         return rcode;
-#endif
                 }
 
                 /* Expand the rest into (possibly) many strings each */
-#if BASH_TEST2
-                if (command->cmd_type == CMD_SINGLEWORD_NOGLOB) {
+#if defined(CMD_SINGLEWORD_NOGLOB)
+                if (command->cmd_type == CMD_SINGLEWORD_NOGLOB)
                         argv_expanded = expand_strvec_to_strvec_singleword_noglob(argv + command->assignment_cnt);
-                } else
+                else
 #endif
-                {
                         argv_expanded = expand_strvec_to_strvec(argv + command->assignment_cnt);
-                }
 
-                /* if someone gives us an empty string: `cmd with empty output` */
+                /* If someone gives us an empty string: `cmd with empty output` */
                 if (!argv_expanded[0]) {
                         free(argv_expanded);
-                        debug_leave();
-                        return G.last_exitcode;
+                        /* `false` still has to set exitcode 1 */
+                        G.expand_exitcode = G.last_exitcode;
+                        goto only_assignments;
                 }
 
-#if ENABLE_HUSH_FUNCTIONS
+                old_vars = NULL;
+                sv_shadowed = G.shadowed_vars_pp;
+
                 /* Check if argv[0] matches any functions (this goes before bltins) */
-                funcp = find_function(argv_expanded[0]);
-#endif
-                x = NULL;
-                if (!funcp)
+                IF_HUSH_FUNCTIONS(funcp = find_function(argv_expanded[0]);)
+                IF_HUSH_FUNCTIONS(x = NULL;)
+                IF_HUSH_FUNCTIONS(if (!funcp))
                         x = find_builtin(argv_expanded[0]);
                 if (x || funcp) {
-                        if (!funcp) {
-                                if (x->b_function == builtin_exec && argv_expanded[1] == NULL) {
-                                        debug_printf("exec with redirects only\n");
-                                        rcode = setup_redirects(command, NULL);
-                                        /* rcode=1 can be if redir file can't be opened */
-                                        goto clean_up_and_ret1;
-                                }
+                        if (x && x->b_function == builtin_exec && argv_expanded[1] == NULL) {
+                                debug_printf("exec with redirects only\n");
+                                /*
+                                 * Variable assignments are executed, but then "forgotten":
+                                 *  a=`sleep 1;echo A` exec 3>&-; echo $a
+                                 * sleeps, but prints nothing.
+                                 */
+                                enter_var_nest_level();
+                                G.shadowed_vars_pp = &old_vars;
+                                rcode = redirect_and_varexp_helper(command, /*squirrel:*/ NULL, argv_expanded);
+                                G.shadowed_vars_pp = sv_shadowed;
+                                /* rcode=1 can be if redir file can't be opened */
+
+                                goto clean_up_and_ret1;
                         }
-                        rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, &squirrel, argv_expanded);
+
+                        /* Bump var nesting, or this will leak exported $a:
+                         * a=b true; env | grep ^a=
+                         */
+                        enter_var_nest_level();
+                        /* Collect all variables "shadowed" by helper
+                         * (IOW: old vars overridden by "var1=val1 var2=val2 cmd..." syntax)
+                         * into old_vars list:
+                         */
+                        G.shadowed_vars_pp = &old_vars;
+                        rcode = redirect_and_varexp_helper(command, &squirrel, argv_expanded);
                         if (rcode == 0) {
                                 if (!funcp) {
+                                        /* Do not collect *to old_vars list* vars shadowed
+                                         * by e.g. "local VAR" builtin (collect them
+                                         * in the previously nested list instead):
+                                         * don't want them to be restored immediately
+                                         * after "local" completes.
+                                         */
+                                        G.shadowed_vars_pp = sv_shadowed;
+
                                         debug_printf_exec(": builtin '%s' '%s'...\n",
                                                 x->b_cmd, argv_expanded[1]);
                                         fflush_all();
@@ -8336,72 +8439,74 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                 }
 #if ENABLE_HUSH_FUNCTIONS
                                 else {
-# if ENABLE_HUSH_LOCAL
-                                        struct variable **sv;
-                                        sv = G.shadowed_vars_pp;
-                                        G.shadowed_vars_pp = &old_vars;
-# endif
                                         debug_printf_exec(": function '%s' '%s'...\n",
                                                 funcp->name, argv_expanded[1]);
                                         rcode = run_function(funcp, argv_expanded) & 0xff;
-# if ENABLE_HUSH_LOCAL
-                                        G.shadowed_vars_pp = sv;
-# endif
+                                        /*
+                                         * But do collect *to old_vars list* vars shadowed
+                                         * within function execution. To that end, restore
+                                         * this pointer _after_ function run:
+                                         */
+                                        G.shadowed_vars_pp = sv_shadowed;
                                 }
 #endif
                         }
- clean_up_and_ret:
-                        unset_vars(new_env);
-                        add_vars(old_vars);
-/* clean_up_and_ret0: */
-                        restore_redirects(squirrel);
-                        /*
-                         * Try "usleep 99999999" + ^C + "echo $?"
-                         * with FEATURE_SH_NOFORK=y.
-                         */
-                        if (!funcp) {
-                                /* It was builtin or nofork.
-                                 * if this would be a real fork/execed program,
-                                 * it should have died if a fatal sig was received.
-                                 * But OTOH, there was no separate process,
-                                 * the sig was sent to _shell_, not to non-existing
-                                 * child.
-                                 * Let's just handle ^C only, this one is obvious:
-                                 * we aren't ok with exitcode 0 when ^C was pressed
-                                 * during builtin/nofork.
+                } else
+                if (ENABLE_FEATURE_SH_NOFORK && NUM_APPLETS > 1) {
+                        int n = find_applet_by_name(argv_expanded[0]);
+                        if (n < 0 || !APPLET_IS_NOFORK(n))
+                                goto must_fork;
+
+                        enter_var_nest_level();
+                        /* Collect all variables "shadowed" by helper into old_vars list */
+                        G.shadowed_vars_pp = &old_vars;
+                        rcode = redirect_and_varexp_helper(command, &squirrel, argv_expanded);
+                        G.shadowed_vars_pp = sv_shadowed;
+
+                        if (rcode == 0) {
+                                debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
+                                        argv_expanded[0], argv_expanded[1]);
+                                /*
+                                 * Note: signals (^C) can't interrupt here.
+                                 * We remember them and they will be acted upon
+                                 * after applet returns.
+                                 * This makes applets which can run for a long time
+                                 * and/or wait for user input ineligible for NOFORK:
+                                 * for example, "yes" or "rm" (rm -i waits for input).
                                  */
-                                if (sigismember(&G.pending_set, SIGINT))
-                                        rcode = 128 + SIGINT;
+                                rcode = run_nofork_applet(n, argv_expanded);
                         }
+                } else
+                        goto must_fork;
+
+                restore_redirects(squirrel);
  clean_up_and_ret1:
-                        free(argv_expanded);
-                        IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
-                        debug_leave();
-                        debug_printf_exec("run_pipe return %d\n", rcode);
-                        return rcode;
-                }
+                leave_var_nest_level();
+                add_vars(old_vars);
 
-                if (ENABLE_FEATURE_SH_NOFORK && NUM_APPLETS > 1) {
-                        int n = find_applet_by_name(argv_expanded[0]);
-                        if (n >= 0 && APPLET_IS_NOFORK(n)) {
-                                rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, &squirrel, argv_expanded);
-                                if (rcode == 0) {
-                                        debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
-                                                argv_expanded[0], argv_expanded[1]);
-                                        /*
-                                         * Note: signals (^C) can't interrupt here.
-                                         * We remember them and they will be acted upon
-                                         * after applet returns.
-                                         * This makes applets which can run for a long time
-                                         * and/or wait for user input ineligible for NOFORK:
-                                         * for example, "yes" or "rm" (rm -i waits for input).
-                                         */
-                                        rcode = run_nofork_applet(n, argv_expanded);
-                                }
-                                goto clean_up_and_ret;
-                        }
+                /*
+                 * Try "usleep 99999999" + ^C + "echo $?"
+                 * with FEATURE_SH_NOFORK=y.
+                 */
+                if (!funcp) {
+                        /* It was builtin or nofork.
+                         * if this would be a real fork/execed program,
+                         * it should have died if a fatal sig was received.
+                         * But OTOH, there was no separate process,
+                         * the sig was sent to _shell_, not to non-existing
+                         * child.
+                         * Let's just handle ^C only, this one is obvious:
+                         * we aren't ok with exitcode 0 when ^C was pressed
+                         * during builtin/nofork.
+                         */
+                        if (sigismember(&G.pending_set, SIGINT))
+                                rcode = 128 + SIGINT;
                 }
-                /* It is neither builtin nor applet. We must fork. */
+                free(argv_expanded);
+                IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
+                debug_leave();
+                debug_printf_exec("run_pipe return %d\n", rcode);
+                return rcode;
         }
 
  must_fork:
@@ -8418,7 +8523,6 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 struct fd_pair pipefds;
 #if !BB_MMU
                 volatile nommu_save_t nommu_save;
-                nommu_save.new_env = NULL;
                 nommu_save.old_vars = NULL;
                 nommu_save.argv = NULL;
                 nommu_save.argv_from_re_execing = NULL;
@@ -8511,7 +8615,6 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 /* Clean up after vforked child */
                 free(nommu_save.argv);
                 free(nommu_save.argv_from_re_execing);
-                unset_vars(nommu_save.new_env);
                 add_vars(nommu_save.old_vars);
 #endif
                 free(argv_expanded);
@@ -8732,8 +8835,10 @@ static int run_list(struct pipe *pi)
 #if ENABLE_HUSH_CASE
                 if (rword == RES_CASE) {
                         debug_printf_exec("CASE cond_code:%d\n", cond_code);
-                        case_word = expand_strvec_to_string(pi->cmds->argv);
-                        unbackslash(case_word);
+                        case_word = expand_string_to_string(pi->cmds->argv[0], 1);
+                        debug_printf_exec("CASE word1:'%s'\n", case_word);
+                        //unbackslash(case_word);
+                        //debug_printf_exec("CASE word2:'%s'\n", case_word);
                         continue;
                 }
                 if (rword == RES_MATCH) {
@@ -9060,9 +9165,9 @@ int hush_main(int argc, char **argv)
 {
         enum {
                 OPT_login = (1 << 0),
+                OPT_s     = (1 << 1),
         };
         unsigned flags;
-        int opt;
         unsigned builtin_argc;
         char **e;
         struct variable *cur_var;
@@ -9112,6 +9217,14 @@ int hush_main(int argc, char **argv)
         /* Export PWD */
         set_pwd_var(SETFLAG_EXPORT);
 
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
+        /* Set (but not export) PS1/2 unless already set */
+        if (!get_local_var_value("PS1"))
+                set_local_var_from_halves("PS1", "\\w \\$ ");
+        if (!get_local_var_value("PS2"))
+                set_local_var_from_halves("PS2", "> ");
+#endif
+
 #if BASH_HOSTNAME_VAR
         /* Set (but not export) HOSTNAME unless already set */
         if (!get_local_var_value("HOSTNAME")) {
@@ -9150,8 +9263,6 @@ int hush_main(int argc, char **argv)
          * OPTERR=1
          * OPTIND=1
          * IFS=$' \t\n'
-         * PS1='\s-\v\$ '
-         * PS2='> '
          * PS4='+ '
          */
 #endif
@@ -9185,7 +9296,7 @@ int hush_main(int argc, char **argv)
         flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
         builtin_argc = 0;
         while (1) {
-                opt = getopt(argc, argv, "+c:exinsl"
+                int opt = getopt(argc, argv, "+c:exinsl"
 #if !BB_MMU
                                 "<:$:R:V:"
 # if ENABLE_HUSH_FUNCTIONS
@@ -9243,8 +9354,7 @@ int hush_main(int argc, char **argv)
                         /* G_interactive_fd++; */
                         break;
                 case 's':
-                        /* "-s" means "read from stdin", but this is how we always
-                         * operate, so simply do nothing here. */
+                        flags |= OPT_s;
                         break;
                 case 'l':
                         flags |= OPT_login;
@@ -9347,7 +9457,8 @@ int hush_main(int argc, char **argv)
                  */
         }
 
-        if (G.global_argv[1]) {
+        /* -s is: hush -s ARGV1 ARGV2 (no SCRIPT) */
+        if (!(flags & OPT_s) && G.global_argv[1]) {
                 FILE *input;
                 /*
                  * "bash <script>" (which is never interactive (unless -i?))
@@ -9909,8 +10020,8 @@ static int helper_export_local(char **argv, unsigned flags)
 # if ENABLE_HUSH_LOCAL
                         /* Is this "local" bltin? */
                         if (!(flags & (SETFLAG_EXPORT|SETFLAG_UNEXPORT|SETFLAG_MAKE_RO))) {
-                                unsigned lvl = flags >> SETFLAG_LOCAL_SHIFT;
-                                if (var && var->func_nest_level == lvl) {
+                                unsigned lvl = flags >> SETFLAG_VARLVL_SHIFT;
+                                if (var && var->var_nest_level == lvl) {
                                         /* "local x=abc; ...; local x" - ignore second local decl */
                                         continue;
                                 }
@@ -9934,6 +10045,7 @@ static int helper_export_local(char **argv, unsigned flags)
                         /* (Un)exporting/making local NAME=VALUE */
                         name = xstrdup(name);
                 }
+                debug_printf_env("%s: set_local_var('%s')\n", __func__, name);
                 if (set_local_var(name, flags))
                         return EXIT_FAILURE;
         } while (*++argv);
@@ -9995,7 +10107,11 @@ static int FAST_FUNC builtin_local(char **argv)
                 return EXIT_FAILURE; /* bash compat */
         }
         argv++;
-        return helper_export_local(argv, G.func_nest_level << SETFLAG_LOCAL_SHIFT);
+        /* Since all builtins run in a nested variable level,
+         * need to use level - 1 here. Or else the variable will be removed at once
+         * after builtin returns.
+         */
+        return helper_export_local(argv, (G.var_nest_level - 1) << SETFLAG_VARLVL_SHIFT);
 }
 #endif
 
diff --git a/shell/hush_test/hush-arith/arith_nested1.right b/shell/hush_test/hush-arith/arith_nested1.right
new file mode 100644
index 000000000..d00491fd7
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith_nested1.right
@@ -0,0 +1 @@
+1
diff --git a/shell/hush_test/hush-arith/arith_nested1.tests b/shell/hush_test/hush-arith/arith_nested1.tests
new file mode 100755
index 000000000..28571b833
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith_nested1.tests
@@ -0,0 +1 @@
+echo $(( ( $((1)) ) ))
diff --git a/shell/hush_test/hush-misc/assignment5.right b/shell/hush_test/hush-misc/assignment5.right
new file mode 100644
index 000000000..a91554c09
--- /dev/null
+++ b/shell/hush_test/hush-misc/assignment5.right
@@ -0,0 +1,5 @@
+Zero1:0
+Zero2:0
+Zero3:0
+Zero4:0 x:1 y:1
+Three:3 x:1 y:1
diff --git a/shell/hush_test/hush-misc/assignment5.tests b/shell/hush_test/hush-misc/assignment5.tests
new file mode 100755
index 000000000..0b8104285
--- /dev/null
+++ b/shell/hush_test/hush-misc/assignment5.tests
@@ -0,0 +1,9 @@
+true;  a=1; echo Zero1:$?
+false; a=1; echo Zero2:$?
+false || a=1; echo Zero3:$?
+
+false || x=$? y=`echo $?`; echo Zero4:$? x:$x y:$y
+false || x=$? y=`echo $?; exit 3`; echo Three:$? x:$x y:$y
+
+#ash sets z=1 instead of z=3. disabled for now
+#false || x=$? y=`echo $?; exit 3` z=`echo $?`; echo x:$x y:$y z:$z
diff --git a/shell/hush_test/hush-misc/func5.tests b/shell/hush_test/hush-misc/func5.tests
index 9c5f9fa48..5c33560bc 100755
--- a/shell/hush_test/hush-misc/func5.tests
+++ b/shell/hush_test/hush-misc/func5.tests
@@ -1,9 +1,8 @@
 f() { echo $1; }
 f 1
 
-# hush fails on this syntax, but i've never seen anyone use it ...
-#f() ( echo $1; )
+f() ( echo $1; )
 f 2
 
-#f() ( echo $1 )
+f() ( echo $1 )
 f 3
diff --git a/shell/hush_test/hush-parsing/starquoted3.right b/shell/hush_test/hush-parsing/starquoted3.right
new file mode 100644
index 000000000..fea246c14
--- /dev/null
+++ b/shell/hush_test/hush-parsing/starquoted3.right
@@ -0,0 +1,2 @@
+<a>
+<>
diff --git a/shell/hush_test/hush-parsing/starquoted3.tests b/shell/hush_test/hush-parsing/starquoted3.tests
new file mode 100755
index 000000000..8eefe4245
--- /dev/null
+++ b/shell/hush_test/hush-parsing/starquoted3.tests
@@ -0,0 +1 @@
+set -- a ""; space=" "; printf "<%s>\n" "$@"$space
diff --git a/shell/hush_test/hush-psubst/falsetick2.right b/shell/hush_test/hush-psubst/falsetick2.right
new file mode 100644
index 000000000..670f560f1
--- /dev/null
+++ b/shell/hush_test/hush-psubst/falsetick2.right
@@ -0,0 +1 @@
+Two:2 v:[]
diff --git a/shell/hush_test/hush-psubst/falsetick2.tests b/shell/hush_test/hush-psubst/falsetick2.tests
new file mode 100755
index 000000000..cfbd1a5de
--- /dev/null
+++ b/shell/hush_test/hush-psubst/falsetick2.tests
@@ -0,0 +1,3 @@
+v=v
+v=`exit 2` `false`
+echo Two:$? v:"[$v]"
diff --git a/shell/hush_test/hush-quoting/bkslash_case2.right b/shell/hush_test/hush-quoting/bkslash_case2.right
new file mode 100644
index 000000000..8d2038bff
--- /dev/null
+++ b/shell/hush_test/hush-quoting/bkslash_case2.right
@@ -0,0 +1,3 @@
+ok1
+ok2
+Ok:0
diff --git a/shell/hush_test/hush-quoting/bkslash_case2.tests b/shell/hush_test/hush-quoting/bkslash_case2.tests
new file mode 100755
index 000000000..348ddc236
--- /dev/null
+++ b/shell/hush_test/hush-quoting/bkslash_case2.tests
@@ -0,0 +1,13 @@
+x='\abc'
+
+case "$x" in
+\\*) echo ok1;;
+*)   echo BUG1;;
+esac
+
+case $x in
+\\*) echo ok2;;
+*)   echo BUG2;;
+esac
+
+echo Ok:$?
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp3.right b/shell/hush_test/hush-quoting/squote_in_varexp3.right
new file mode 100644
index 000000000..223b7836f
--- /dev/null
+++ b/shell/hush_test/hush-quoting/squote_in_varexp3.right
@@ -0,0 +1 @@
+B
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp3.tests b/shell/hush_test/hush-quoting/squote_in_varexp3.tests
new file mode 100755
index 000000000..028a88fd9
--- /dev/null
+++ b/shell/hush_test/hush-quoting/squote_in_varexp3.tests
@@ -0,0 +1 @@
+x=\'B; echo "${x#\'}"
diff --git a/shell/hush_test/hush-redir/redir_backquote1.right b/shell/hush_test/hush-redir/redir_backquote1.right
new file mode 100644
index 000000000..810cc2314
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_backquote1.right
@@ -0,0 +1,11 @@
+hush: can't open '/cant/be/created': No such file or directory
+First
+One:1 v1:[]
+hush: can't open '/cant/be/created': No such file or directory
+Second
+One:1 v2:[]
+Third
+Zero:0 v3:[]
+Fourth
+Zero:0 v4:[]
+Zero:0 v5:[1]
diff --git a/shell/hush_test/hush-redir/redir_backquote1.tests b/shell/hush_test/hush-redir/redir_backquote1.tests
new file mode 100755
index 000000000..41bb4913c
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_backquote1.tests
@@ -0,0 +1,19 @@
+v=v
+v=`echo First >&2` `` >/cant/be/created
+echo One:$? v1:"[$v]"
+
+v=v
+v=`echo Second >&2` `true` >/cant/be/created
+echo One:$? v2:"[$v]"
+
+v=v
+v=`echo Third >&2` `true` 2>/dev/null
+echo Zero:$? v3:"[$v]"
+
+v=v
+v=`echo Fourth >&2` `false` 2>/dev/null
+echo Zero:$? v4:"[$v]"
+
+v=v
+v=`echo $?` `false` 2>/dev/null
+echo Zero:$? v5:"[$v]"
diff --git a/shell/hush_test/hush-redir/redir_exec1.right b/shell/hush_test/hush-redir/redir_exec1.right
new file mode 100644
index 000000000..6ff8fc832
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_exec1.right
@@ -0,0 +1,3 @@
+First
+hush: can't open '/cant/be/created': No such file or directory
+One:1
diff --git a/shell/hush_test/hush-redir/redir_exec1.tests b/shell/hush_test/hush-redir/redir_exec1.tests
new file mode 100755
index 000000000..290e1cb39
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_exec1.tests
@@ -0,0 +1,2 @@
+v=`echo First >&2` exec >/cant/be/created
+echo One:$?
diff --git a/shell/hush_test/hush-vars/readonly3.right b/shell/hush_test/hush-vars/readonly3.right
new file mode 100644
index 000000000..acd931243
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly3.right
@@ -0,0 +1,4 @@
+hush: v=2: readonly variable
+hush: v=3: readonly variable
+1
+Ok:1
diff --git a/shell/hush_test/hush-vars/readonly3.tests b/shell/hush_test/hush-vars/readonly3.tests
new file mode 100755
index 000000000..17780cfda
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly3.tests
@@ -0,0 +1,4 @@
+readonly v=1
+# there was a bug causing second assignment to be not checked
+v=2 v=3 echo $v
+echo Ok:$v
diff --git a/shell/hush_test/hush-vars/var_bash3.right b/shell/hush_test/hush-vars/var_bash3.right
index a97c850ea..8899d981c 100644
--- a/shell/hush_test/hush-vars/var_bash3.right
+++ b/shell/hush_test/hush-vars/var_bash3.right
@@ -1,6 +1,6 @@
 1 a041#c
 2 a041#c
-3 a\041#c
+3 a041#c
 4 a\041#c
 5 a\041#c
 6 a\041#c
@@ -17,4 +17,4 @@
 17 a\tc
 18 a\tc
 19 atc
-20 a\tc
+20 atc
diff --git a/shell/hush_test/hush-vars/var_bash4.right b/shell/hush_test/hush-vars/var_bash4.right
index 0ef1bf661..9067e58e6 100644
--- a/shell/hush_test/hush-vars/var_bash4.right
+++ b/shell/hush_test/hush-vars/var_bash4.right
@@ -3,26 +3,26 @@ Replace str:   _\\_\z_
 Pattern:       single backslash and star: "replace literal star"
 Unquoted:      a_\_z_b\*c
 Unquoted =:    a_\_z_b\*c
-Quoted:        a_\_\z_b\*c
-Quoted =:      a_\_\z_b\*c
+Quoted:        a_\_z_b\*c
+Quoted =:      a_\_z_b\*c
 Pattern:       double backslash and star: "replace backslash and everything after it"
 Unquoted:      a*b_\_z_
 Unquoted =:    a*b_\_z_
-Quoted:        a*b_\_\z_
-Quoted =:      a*b_\_\z_
+Quoted:        a*b_\_z_
+Quoted =:      a*b_\_z_
 
 Source:        a\bc
 Replace str:   _\\_\z_
 Pattern:       single backslash and b: "replace b"
 Unquoted:      a\_\_z_c
 Unquoted =:    a\_\_z_c
-Quoted:        a\_\_\z_c
-Quoted =:      a\_\_\z_c
+Quoted:        a\_\_z_c
+Quoted =:      a\_\_z_c
 Pattern:       double backslash and b: "replace backslash and b"
 Unquoted:      a_\_z_c
 Unquoted =:    a_\_z_c
-Quoted:        a_\_\z_c
-Quoted =:      a_\_\z_c
+Quoted:        a_\_z_c
+Quoted =:      a_\_z_c
 
 Source:        a\bc
 Replace str:   _\\_\z_ (as variable $s)
diff --git a/shell/hush_test/hush-vars/var_bash6.right b/shell/hush_test/hush-vars/var_bash6.right
index 63fc23df8..115ff8b04 100644
--- a/shell/hush_test/hush-vars/var_bash6.right
+++ b/shell/hush_test/hush-vars/var_bash6.right
@@ -1,5 +1,5 @@
 Expected Actual
 a*z    : a*z
-\z     : \z
+z      : z
 a1z a2z: a1z a2z
 z      : z
diff --git a/shell/hush_test/hush-vars/var_bash6.tests b/shell/hush_test/hush-vars/var_bash6.tests
index cf2e4f020..686834177 100755
--- a/shell/hush_test/hush-vars/var_bash6.tests
+++ b/shell/hush_test/hush-vars/var_bash6.tests
@@ -3,7 +3,7 @@
 >a1z; >a2z;
           echo 'Expected' 'Actual'
 v='a bz'; echo 'a*z    :' "${v/a*z/a*z}"
-v='a bz'; echo '\z     :' "${v/a*z/\z}"
+v='a bz'; echo 'z      :' "${v/a*z/\z}"
 v='a bz'; echo 'a1z a2z:' ${v/a*z/a*z}
 v='a bz'; echo 'z      :' ${v/a*z/\z}
 rm a1z a2z
diff --git a/shell/hush_test/hush-vars/var_nested1.right b/shell/hush_test/hush-vars/var_nested1.right
new file mode 100644
index 000000000..f4bc5f4b6
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested1.right
@@ -0,0 +1,3 @@
+Expected:AB Actual:AB
+Expected:Ab Actual:Ab
+Expected:ab Actual:ab
diff --git a/shell/hush_test/hush-vars/var_nested1.tests b/shell/hush_test/hush-vars/var_nested1.tests
new file mode 100755
index 000000000..59e4a14fa
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested1.tests
@@ -0,0 +1,16 @@
+f() { a=A; b=B; }
+
+a=a
+b=b
+f
+echo Expected:AB Actual:$a$b
+
+a=a
+b=b
+b= f
+echo Expected:Ab Actual:$a$b
+
+a=a
+b=b
+a= b= f
+echo Expected:ab Actual:$a$b
diff --git a/shell/hush_test/hush-vars/var_nested2.right b/shell/hush_test/hush-vars/var_nested2.right
new file mode 100644
index 000000000..c930d971c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested2.right
@@ -0,0 +1 @@
+aB
diff --git a/shell/hush_test/hush-vars/var_nested2.tests b/shell/hush_test/hush-vars/var_nested2.tests
new file mode 100755
index 000000000..e8865861e
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested2.tests
@@ -0,0 +1,2 @@
+# the bug was easier to trigger in one-liner form
+a=a; b=b; f() { a=A; b=B; }; a= f; echo $a$b
diff --git a/shell/shell_common.c b/shell/shell_common.c
index a44ad0caf..aa0791285 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -18,7 +18,6 @@
  */
 #include "libbb.h"
 #include "shell_common.h"
-#include <sys/resource.h> /* getrlimit */
 
 #if !ENABLE_PLATFORM_MINGW32
 const char defifsvar[] ALIGN1 = "IFS= \t\n";
diff --git a/testsuite/bunzip2.tests b/testsuite/bunzip2.tests
index fcfce1a31..edb332748 100755
--- a/testsuite/bunzip2.tests
+++ b/testsuite/bunzip2.tests
@@ -552,6 +552,22 @@ if test "${0##*/}" = "bunzip2.tests"; then
         echo "FAIL: $unpack: pbzip_4m_zeros file"
         FAILCOUNT=$((FAILCOUNT + 1))
     fi
+
+    errout="`${bb}bunzip2 <bz2_issue_11.bz2 2>&1 >/dev/null`"
+    if test x"$errout:$?" = x"bunzip2: bunzip error -5:1"; then
+        echo "PASS: $unpack: bz2_issue_11.bz2 corrupted example"
+    else
+        echo "FAIL: $unpack: bz2_issue_11.bz2 corrupted example"
+        FAILCOUNT=$((FAILCOUNT + 1))
+    fi
+
+    errout="`${bb}bunzip2 <bz2_issue_12.bz2 2>&1 >/dev/null`"
+    if test x"$errout:$?" = x"bunzip2: bunzip error -3:1"; then
+        echo "PASS: $unpack: bz2_issue_12.bz2 corrupted example"
+    else
+        echo "FAIL: $unpack: bz2_issue_12.bz2 corrupted example"
+        FAILCOUNT=$((FAILCOUNT + 1))
+    fi
 fi
 
 exit $((FAILCOUNT <= 255 ? FAILCOUNT : 255))
diff --git a/testsuite/bz2_issue_11.bz2 b/testsuite/bz2_issue_11.bz2
new file mode 100644
index 000000000..62b252046
--- /dev/null
+++ b/testsuite/bz2_issue_11.bz2
diff --git a/testsuite/bz2_issue_12.bz2 b/testsuite/bz2_issue_12.bz2
new file mode 100644
index 000000000..4215f08d6
--- /dev/null
+++ b/testsuite/bz2_issue_12.bz2
diff --git a/testsuite/unlzma.tests b/testsuite/unlzma.tests
new file mode 100755
index 000000000..0e98afe09
--- /dev/null
+++ b/testsuite/unlzma.tests
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+. ./testing.sh
+
+# testing "test name" "commands" "expected result" "file input" "stdin"
+#   file input will be file called "input"
+#   test can create a file "actual" instead of writing to stdout
+
+# Damaged encrypted streams
+testing "unlzma (bad archive 1)" \
+        "unlzma <unlzma_issue_1.lzma >/dev/null; echo \$?" \
+"1
+" "" ""
+
+# Damaged encrypted streams
+testing "unlzma (bad archive 2)" \
+        "unlzma <unlzma_issue_2.lzma >/dev/null; echo \$?" \
+"1
+" "" ""
+
+exit $FAILCOUNT
diff --git a/testsuite/unlzma_issue_1.lzma b/testsuite/unlzma_issue_1.lzma
new file mode 100644
index 000000000..fb70104ba
--- /dev/null
+++ b/testsuite/unlzma_issue_1.lzma
diff --git a/testsuite/unlzma_issue_2.lzma b/testsuite/unlzma_issue_2.lzma
new file mode 100644
index 000000000..853f0fc29
--- /dev/null
+++ b/testsuite/unlzma_issue_2.lzma
diff --git a/util-linux/renice.c b/util-linux/renice.c
index 46704591f..ee0fb3c8e 100644
--- a/util-linux/renice.c
+++ b/util-linux/renice.c
@@ -39,7 +39,6 @@
 //usage:     "\n        -u      Process user names"
 
 #include "libbb.h"
-#include <sys/resource.h>
 
 int renice_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int renice_main(int argc UNUSED_PARAM, char **argv)