Merge commit '06f719fd79fe15ce6fd5431bc58fcb22851de24d^'

12 files changed, 637 insertions, 540 deletions

diff --git a/shell/ash.c b/shell/ash.c
index f1f044cbf..45ec13097 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -5766,25 +5766,17 @@ redirectsafe(union node *redir, int flags)
 static arith_t
 ash_arith(const char *s)
 {
-        arith_eval_hooks_t math_hooks;
+        arith_state_t math_state;
         arith_t result;
-        int errcode = 0;
 
-        math_hooks.lookupvar = lookupvar;
-        math_hooks.setvar    = setvar2;
-        //math_hooks.endofname = endofname;
+        math_state.lookupvar = lookupvar;
+        math_state.setvar    = setvar2;
+        //math_state.endofname = endofname;
 
         INT_OFF;
-        result = arith(s, &errcode, &math_hooks);
-        if (errcode < 0) {
-                if (errcode == -3)
-                        ash_msg_and_raise_error("exponent less than 0");
-                if (errcode == -2)
-                        ash_msg_and_raise_error("divide by zero");
-                if (errcode == -5)
-                        ash_msg_and_raise_error("expression recursion loop detected");
-                raise_error_syntax(s);
-        }
+        result = arith(&math_state, s);
+        if (math_state.errmsg)
+                ash_msg_and_raise_error(math_state.errmsg);
         INT_ON;
 
         return result;
@@ -5848,7 +5840,7 @@ cvtnum(arith_t num)
         int len;
 
         expdest = makestrspace(32, expdest);
-        len = fmtstr(expdest, 32, arith_t_fmt, num);
+        len = fmtstr(expdest, 32, ARITH_FMT, num);
         STADJUST(len, expdest);
         return len;
 }
@@ -8624,7 +8616,7 @@ static int evalstring(char *s, int mask);
 
 /* Called to execute a trap.
  * Single callsite - at the end of evaltree().
- * If we return non-zero, exaltree raises EXEXIT exception.
+ * If we return non-zero, evaltree raises EXEXIT exception.
  *
  * Perhaps we should avoid entering new trap handlers
  * while we are executing a trap handler. [is it a TODO?]
@@ -8814,11 +8806,15 @@ evaltree(union node *n, int flags)
 
  out:
         exception_handler = savehandler;
+
  out1:
+        /* Order of checks below is important:
+         * signal handlers trigger before exit caused by "set -e".
+         */
+        if (pending_sig && dotrap())
+                goto exexit;
         if (checkexit & exitstatus)
                 evalskip |= SKIPEVAL;
-        else if (pending_sig && dotrap())
-                goto exexit;
 
         if (flags & EV_EXIT) {
  exexit:
@@ -9212,7 +9208,7 @@ poplocalvars(void)
         while ((lvp = localvars) != NULL) {
                 localvars = lvp->next;
                 vp = lvp->vp;
-                TRACE(("poplocalvar %s\n", vp ? vp->text : "-"));
+                TRACE(("poplocalvar %s\n", vp ? vp->var_text : "-"));
                 if (vp == NULL) {       /* $- saved */
                         memcpy(optlist, lvp->text, sizeof(optlist));
                         free((char*)lvp->text);
@@ -13383,7 +13379,7 @@ init(void)
         /* bash re-enables SIGHUP which is SIG_IGNed on entry.
          * Try: "trap '' HUP; bash; echo RET" and type "kill -HUP $$"
          */
-        signal(SIGHUP, SIG_DFL);
+        signal(SIGHUP, SIG_DFL);
 
         /* from var.c: */
         {
@@ -13598,10 +13594,12 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                 if (e == EXERROR)
                         exitstatus = 2;
                 s = state;
-                if (e == EXEXIT || s == 0 || iflag == 0 || shlvl)
+                if (e == EXEXIT || s == 0 || iflag == 0 || shlvl) {
                         exitshell();
-                if (e == EXINT)
+                }
+                if (e == EXINT) {
                         outcslow('\n', stderr);
+                }
 
                 popstackmark(&smark);
                 FORCE_INT_ON; /* enable interrupts */
@@ -13705,6 +13703,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                 _mcleanup();
         }
 #endif
+        TRACE(("End of main reached\n"));
         exitshell();
         /* NOTREACHED */
 }
diff --git a/shell/ash_test/ash-arith/arith.right b/shell/ash_test/ash-arith/arith.right
index 3ea7ce680..9b9ca8e2f 100644
--- a/shell/ash_test/ash-arith/arith.right
+++ b/shell/ash_test/ash-arith/arith.right
@@ -55,28 +55,28 @@ Format: 'expected actual'
 30 30
 20 20
 30 30
-./arith.tests: line 117: syntax error: 1 ? 20 : x+=2
+./arith.tests: line 117: arithmetic syntax error
 6 6
 6,5,3 6,5,3
 263 263
 255 255
 40 40
-./arith.tests: line 163: syntax error:  7 = 43 
+./arith.tests: line 163: arithmetic syntax error
 ./arith.tests: line 165: divide by zero
-./arith.tests: let: line 166: syntax error: jv += $iv
-./arith.tests: line 167: syntax error:  jv += $iv 
-./arith.tests: let: line 168: syntax error: rv = 7 + (43 * 6
+./arith.tests: let: line 166: arithmetic syntax error
+./arith.tests: line 167: arithmetic syntax error
+./arith.tests: let: line 168: arithmetic syntax error
 abc
 def
 ghi
-./arith.tests: line 191: syntax error:  ( 4 + A ) + 4 
+./arith.tests: line 191: arithmetic syntax error
 16 16
-./arith.tests: line 196: syntax error:  4 ? : 3 + 5 
-./arith.tests: line 197: syntax error:  1 ? 20 
-./arith.tests: line 198: syntax error:  4 ? 20 : 
+./arith.tests: line 196: arithmetic syntax error
+./arith.tests: line 197: malformed ?: operator
+./arith.tests: line 198: arithmetic syntax error
 9 9
-./arith.tests: line 205: syntax error:  0 && B=42 
-./arith.tests: line 208: syntax error:  1 || B=88 
+./arith.tests: line 205: arithmetic syntax error
+./arith.tests: line 208: arithmetic syntax error
 9 9
 9 9
 9 9
@@ -97,18 +97,18 @@ ghi
 3 3
 4 4
 4 4
-./arith.tests: line 257: syntax error:  7-- 
-./arith.tests: line 259: syntax error:  --x=7 
-./arith.tests: line 260: syntax error:  ++x=7 
-./arith.tests: line 262: syntax error:  x++=7 
-./arith.tests: line 263: syntax error:  x--=7 
+./arith.tests: line 257: arithmetic syntax error
+./arith.tests: line 259: arithmetic syntax error
+./arith.tests: line 260: arithmetic syntax error
+./arith.tests: line 262: arithmetic syntax error
+./arith.tests: line 263: arithmetic syntax error
 4 4
 7 7
 -7 -7
-./arith1.sub: line 2: syntax error:  4-- 
-./arith1.sub: line 3: syntax error:  4++ 
-./arith1.sub: line 4: syntax error:  4 -- 
-./arith1.sub: line 5: syntax error:  4 ++ 
+./arith1.sub: line 2: arithmetic syntax error
+./arith1.sub: line 3: arithmetic syntax error
+./arith1.sub: line 4: arithmetic syntax error
+./arith1.sub: line 5: arithmetic syntax error
 6 6
 3 3
 7 7
@@ -119,19 +119,19 @@ ghi
 2 2
 -2 -2
 1 1
-./arith1.sub: line 37: syntax error:  +++7 
-./arith2.sub: line 2: syntax error:  --7 
-./arith2.sub: line 3: syntax error:  ++7 
-./arith2.sub: line 4: syntax error:  -- 7 
-./arith2.sub: line 5: syntax error:  ++ 7 
+./arith1.sub: line 37: arithmetic syntax error
+./arith2.sub: line 2: arithmetic syntax error
+./arith2.sub: line 3: arithmetic syntax error
+./arith2.sub: line 4: arithmetic syntax error
+./arith2.sub: line 5: arithmetic syntax error
 5 5
 1 1
 4 4
 0 0
-./arith2.sub: line 42: syntax error:  -- - 7 
-./arith2.sub: line 47: syntax error:  ++ + 7 
+./arith2.sub: line 42: arithmetic syntax error
+./arith2.sub: line 47: arithmetic syntax error
 8 12
-./arith.tests: line 290: syntax error: a b
+./arith.tests: line 290: arithmetic syntax error
 42
 42
 42
diff --git a/shell/ash_test/ash-signals/signal8.right b/shell/ash_test/ash-signals/signal8.right
new file mode 100644
index 000000000..39572f30e
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal8.right
@@ -0,0 +1,3 @@
+Removing traps
+End of exit_func
+Done: 0
diff --git a/shell/ash_test/ash-signals/signal8.tests b/shell/ash_test/ash-signals/signal8.tests
new file mode 100755
index 000000000..731af7477
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal8.tests
@@ -0,0 +1,18 @@
+"$THIS_SH" -c '
+exit_func() {
+    echo "Removing traps"
+    trap - EXIT TERM INT
+    echo "End of exit_func"
+}
+set -e
+trap exit_func EXIT TERM INT
+sleep 2
+exit 77
+' &
+
+sleep 1
+# BUG: ash kills -PGRP, but in non-interactive shell we do not create pgrps!
+# In this case, bash kills by PID, not PGRP.
+kill -TERM %1
+wait
+echo Done: $?
diff --git a/shell/ash_test/ash-signals/signal9.right b/shell/ash_test/ash-signals/signal9.right
new file mode 100644
index 000000000..39572f30e
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal9.right
@@ -0,0 +1,3 @@
+Removing traps
+End of exit_func
+Done: 0
diff --git a/shell/ash_test/ash-signals/signal9.tests b/shell/ash_test/ash-signals/signal9.tests
new file mode 100755
index 000000000..18e71012b
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal9.tests
@@ -0,0 +1,21 @@
+# Note: the inner script is a test which checks for a different bug
+# (ordering between INT handler and exit on "set -e"),
+# but so far I did not figure out how to simulate it non-interactively.
+
+"$THIS_SH" -c '
+exit_func() {
+    echo "Removing traps"
+    trap - EXIT TERM INT
+    echo "End of exit_func"
+}
+set -e
+trap exit_func EXIT TERM INT
+sleep 2
+exit 77
+' &
+
+child=$!
+sleep 1
+kill -TERM $child
+wait
+echo Done: $?
diff --git a/shell/hush.c b/shell/hush.c
index 752efd0c8..75083dc2e 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -8,6 +8,8 @@
  * Copyright (C) 2000,2001  Larry Doolittle <larry@doolittle.boa.org>
  * Copyright (C) 2008,2009  Denys Vlasenko <vda.linux@googlemail.com>
  *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ *
  * Credits:
  *      The parser routines proper are all original material, first
  *      written Dec 2000 and Jan 2001 by Larry Doolittle.  The
@@ -50,7 +52,6 @@
  *
  * Bash compat TODO:
  *      redirection of stdout+stderr: &> and >&
- *      brace expansion: one/{two,three,four}
  *      reserved words: function select
  *      advanced test: [[ ]]
  *      process substitution: <(list) and >(list)
@@ -63,7 +64,9 @@
  *          The EXPR is evaluated according to ARITHMETIC EVALUATION.
  *          This is exactly equivalent to let "EXPR".
  *      $[EXPR]: synonym for $((EXPR))
- *      export builtin should be special, its arguments are assignments
+ *
+ * Won't do:
+ *      In bash, export builtin is special, its arguments are assignments
  *          and therefore expansion of them should be "one-word" expansion:
  *              $ export i=`echo 'a  b'` # export has one arg: "i=a  b"
  *          compare with:
@@ -77,8 +80,6 @@
  *              aaa  bbb
  *              $ "export" i=`echo 'aaa  bbb'`; echo "$i"
  *              aaa
- *
- * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
 #include "busybox.h"  /* for APPLET_IS_NOFORK/NOEXEC */
 #include <malloc.h>   /* for malloc_trim */
@@ -119,8 +120,8 @@
 //config:
 //config:         It will compile and work on no-mmu systems.
 //config:
-//config:         It does not handle select, aliases, brace expansion,
-//config:         tilde expansion, &>file and >&file redirection of stdout+stderr.
+//config:         It does not handle select, aliases, tilde expansion,
+//config:         &>file and >&file redirection of stdout+stderr.
 //config:
 //config:config HUSH_BASH_COMPAT
 //config:       bool "bash-compatible extensions"
@@ -129,6 +130,13 @@
 //config:       help
 //config:         Enable bash-compatible extensions.
 //config:
+//config:config HUSH_BRACE_EXPANSION
+//config:       bool "Brace expansion"
+//config:       default y
+//config:       depends on HUSH_BASH_COMPAT
+//config:       help
+//config:         Enable {abc,def} extension.
+//config:
 //config:config HUSH_HELP
 //config:       bool "help builtin"
 //config:       default y
@@ -391,18 +399,10 @@ enum {
         RES_SNTX
 };
 
-enum {
-        EXP_FLAG_GLOB = 0x200,
-        EXP_FLAG_ESC_GLOB_CHARS = 0x100,
-        EXP_FLAG_SINGLEWORD = 0x80, /* must be 0x80 */
-};
-
 typedef struct o_string {
         char *data;
         int length; /* position where data is appended */
         int maxlen;
-        /* Protect newly added chars against globbing
-         * (by prepending \ to *, ?, [, \) */
         int o_expflags;
         /* At least some part of the string was inside '' or "",
          * possibly empty one: word"", wo''rd etc. */
@@ -411,10 +411,18 @@ typedef struct o_string {
         smallint o_assignment; /* 0:maybe, 1:yes, 2:no */
 } o_string;
 enum {
-        MAYBE_ASSIGNMENT = 0,
+        EXP_FLAG_SINGLEWORD     = 0x80, /* must be 0x80 */
+        EXP_FLAG_GLOB           = 0x2,
+        /* Protect newly added chars against globbing
+         * by prepending \ to *, ?, [, \ */
+        EXP_FLAG_ESC_GLOB_CHARS = 0x1,
+};
+enum {
+        MAYBE_ASSIGNMENT      = 0,
         DEFINITELY_ASSIGNMENT = 1,
-        NOT_ASSIGNMENT = 2,
-        WORD_IS_KEYWORD = 3, /* not assigment, but next word may be: "if v=xyz cmd;" */
+        NOT_ASSIGNMENT        = 2,
+        /* Not an assigment, but next word may be: "if v=xyz cmd;" */
+        WORD_IS_KEYWORD       = 3,
 };
 /* Used for initialization: o_string foo = NULL_O_STRING; */
 #define NULL_O_STRING { NULL }
@@ -707,8 +715,7 @@ struct globals {
 #endif
         const char *ifs;
         const char *cwd;
-        struct variable *top_var; /* = &G.shell_ver (set in main()) */
-        struct variable shell_ver;
+        struct variable *top_var;
         char **expanded_assignments;
 #if ENABLE_HUSH_FUNCTIONS
         struct function *top_func;
@@ -2001,26 +2008,8 @@ static void o_addstr_with_NUL(o_string *o, const char *str)
         o_addblock(o, str, strlen(str) + 1);
 }
 
-static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len)
-{
-        while (len) {
-                len--;
-                o_addchr(o, *str);
-                if (*str++ == '\\') {
-                        /* \z -> \\\z; \<eol> -> \\<eol> */
-                        o_addchr(o, '\\');
-                        if (len) {
-                                len--;
-                                o_addchr(o, '\\');
-                                o_addchr(o, *str++);
-                        }
-                }
-        }
-}
-
-#undef HUSH_BRACE_EXP
 /*
- * HUSH_BRACE_EXP code needs corresponding quoting on variable expansion side.
+ * HUSH_BRACE_EXPANSION code needs corresponding quoting on variable expansion side.
  * Currently, "v='{q,w}'; echo $v" erroneously expands braces in $v.
  * Apparently, on unquoted $v bash still does globbing
  * ("v='*.txt'; echo $v" prints all .txt files),
@@ -2030,7 +2019,7 @@ static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len
  * We have only second one.
  */
 
-#ifdef HUSH_BRACE_EXP
+#if ENABLE_HUSH_BRACE_EXPANSION
 # define MAYBE_BRACES "{}"
 #else
 # define MAYBE_BRACES ""
@@ -2198,7 +2187,7 @@ static int o_get_last_ptr(o_string *o, int n)
         return ((int)(uintptr_t)list[n-1]) + string_start;
 }
 
-#ifdef HUSH_BRACE_EXP
+#if ENABLE_HUSH_BRACE_EXPANSION
 /* There in a GNU extension, GLOB_BRACE, but it is not usable:
  * first, it processes even {a} (no commas), second,
  * I didn't manage to make it return strings when they don't match
@@ -2394,7 +2383,7 @@ static int perform_glob(o_string *o, int n)
         return n;
 }
 
-#else /* !HUSH_BRACE_EXP */
+#else /* !HUSH_BRACE_EXPANSION */
 
 /* Helper */
 static int glob_needed(const char *s)
@@ -2471,7 +2460,7 @@ static int perform_glob(o_string *o, int n)
         return n;
 }
 
-#endif /* !HUSH_BRACE_EXP */
+#endif /* !HUSH_BRACE_EXPANSION */
 
 /* If o->o_expflags & EXP_FLAG_GLOB, glob the string so far remembered.
  * Otherwise, just finish current list[] and start new */
@@ -4388,6 +4377,37 @@ static int process_command_subs(o_string *dest, const char *s);
  * followed by strings themselves.
  * Caller can deallocate entire list by single free(list). */
 
+/* A horde of its helpers come first: */
+
+static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len)
+{
+        while (--len >= 0) {
+                char c = *str++;
+
+#if ENABLE_HUSH_BRACE_EXPANSION
+                if (c == '{' || c == '}') {
+                        /* { -> \{, } -> \} */
+                        o_addchr(o, '\\');
+                        /* And now we want to add { or } and continue:
+                         *  o_addchr(o, c);
+                         *  continue;
+                         * luckily, just falling throught achieves this.
+                         */
+                }
+#endif
+                o_addchr(o, c);
+                if (c == '\\') {
+                        /* \z -> \\\z; \<eol> -> \\<eol> */
+                        o_addchr(o, '\\');
+                        if (len) {
+                                len--;
+                                o_addchr(o, '\\');
+                                o_addchr(o, *str++);
+                        }
+                }
+        }
+}
+
 /* Store given string, finalizing the word and starting new one whenever
  * we encounter IFS char(s). This is used for expanding variable values.
  * End-of-string does NOT finalize word: think about 'echo -$VAR-' */
@@ -4396,9 +4416,9 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
         while (1) {
                 int word_len = strcspn(str, G.ifs);
                 if (word_len) {
-                        if (!(output->o_expflags & EXP_FLAG_GLOB))
+                        if (!(output->o_expflags & EXP_FLAG_GLOB)) {
                                 o_addblock(output, str, word_len);
-                        else {
+                        } else {
                                 /* Protect backslashes against globbing up :)
                                  * Example: "v='\*'; echo b$v" prints "b\*"
                                  * (and does not try to glob on "*")
@@ -4461,18 +4481,22 @@ static char *encode_then_expand_string(const char *str, int process_bkslash, int
 }
 
 #if ENABLE_SH_MATH_SUPPORT
-static arith_t expand_and_evaluate_arith(const char *arg, int *errcode_p)
+static arith_t expand_and_evaluate_arith(const char *arg, const char **errmsg_p)
 {
-        arith_eval_hooks_t hooks;
+        arith_state_t math_state;
         arith_t res;
         char *exp_str;
 
-        hooks.lookupvar = get_local_var_value;
-        hooks.setvar = set_local_var_from_halves;
-        //hooks.endofname = endofname;
+        math_state.lookupvar = get_local_var_value;
+        math_state.setvar = set_local_var_from_halves;
+        //math_state.endofname = endofname;
         exp_str = encode_then_expand_string(arg, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
-        res = arith(exp_str ? exp_str : arg, errcode_p, &hooks);
+        res = arith(&math_state, exp_str ? exp_str : arg);
         free(exp_str);
+        if (errmsg_p)
+                *errmsg_p = math_state.errmsg;
+        if (math_state.errmsg)
+                die_if_script(math_state.errmsg);
         return res;
 }
 #endif
@@ -4713,24 +4737,28 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                          * var:N<SPECIAL_VAR_SYMBOL>M<SPECIAL_VAR_SYMBOL>
                          */
                         arith_t beg, len;
-                        int errcode = 0;
+                        const char *errmsg;
 
-                        beg = expand_and_evaluate_arith(exp_word, &errcode);
+                        beg = expand_and_evaluate_arith(exp_word, &errmsg);
+                        if (errmsg)
+                                goto arith_err;
                         debug_printf_varexp("beg:'%s'=%lld\n", exp_word, (long long)beg);
                         *p++ = SPECIAL_VAR_SYMBOL;
                         exp_word = p;
                         p = strchr(p, SPECIAL_VAR_SYMBOL);
                         *p = '\0';
-                        len = expand_and_evaluate_arith(exp_word, &errcode);
+                        len = expand_and_evaluate_arith(exp_word, &errmsg);
+                        if (errmsg)
+                                goto arith_err;
                         debug_printf_varexp("len:'%s'=%lld\n", exp_word, (long long)len);
-
-                        if (errcode >= 0 && len >= 0) { /* bash compat: len < 0 is illegal */
+                        if (len >= 0) { /* bash compat: len < 0 is illegal */
                                 if (beg < 0) /* bash compat */
                                         beg = 0;
                                 debug_printf_varexp("from val:'%s'\n", val);
-                                if (len == 0 || !val || beg >= strlen(val))
-                                        val = "";
-                                else {
+                                if (len == 0 || !val || beg >= strlen(val)) {
+ arith_err:
+                                        val = NULL;
+                                } else {
                                         /* Paranoia. What if user entered 9999999999999
                                          * which fits in arith_t but not int? */
                                         if (len >= INT_MAX)
@@ -4742,7 +4770,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
 #endif
                         {
                                 die_if_script("malformed ${%s:...}", var);
-                                val = "";
+                                val = NULL;
                         }
                 } else { /* one of "-=+?" */
                         /* Standard-mandated substitution ops:
@@ -4925,30 +4953,13 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
 #if ENABLE_SH_MATH_SUPPORT
                 case '+': { /* <SPECIAL_VAR_SYMBOL>+cmd<SPECIAL_VAR_SYMBOL> */
                         arith_t res;
-                        int errcode;
 
                         arg++; /* skip '+' */
                         *p = '\0'; /* replace trailing <SPECIAL_VAR_SYMBOL> */
                         debug_printf_subst("ARITH '%s' first_ch %x\n", arg, first_ch);
-                        res = expand_and_evaluate_arith(arg, &errcode);
-
-                        if (errcode < 0) {
-                                const char *msg = "error in arithmetic";
-                                switch (errcode) {
-                                case -3:
-                                        msg = "exponent less than 0";
-                                        break;
-                                case -2:
-                                        msg = "divide by 0";
-                                        break;
-                                case -5:
-                                        msg = "expression recursion loop detected";
-                                        break;
-                                }
-                                die_if_script(msg);
-                        }
-                        debug_printf_subst("ARITH RES '"arith_t_fmt"'\n", res);
-                        sprintf(arith_buf, arith_t_fmt, res);
+                        res = expand_and_evaluate_arith(arg, NULL);
+                        debug_printf_subst("ARITH RES '"ARITH_FMT"'\n", res);
+                        sprintf(arith_buf, ARITH_FMT, res);
                         val = arith_buf;
                         break;
                 }
@@ -7346,6 +7357,7 @@ int hush_main(int argc, char **argv)
         unsigned builtin_argc;
         char **e;
         struct variable *cur_var;
+        struct variable shell_ver;
 
         INIT_G();
         if (EXIT_SUCCESS) /* if EXIT_SUCCESS == 0, it is already done */
@@ -7354,12 +7366,13 @@ int hush_main(int argc, char **argv)
         G.argv0_for_re_execing = argv[0];
 #endif
         /* Deal with HUSH_VERSION */
-        G.shell_ver.flg_export = 1;
-        G.shell_ver.flg_read_only = 1;
+        memset(&shell_ver, 0, sizeof(shell_ver));
+        shell_ver.flg_export = 1;
+        shell_ver.flg_read_only = 1;
         /* Code which handles ${var<op>...} needs writable values for all variables,
          * therefore we xstrdup: */
-        G.shell_ver.varstr = xstrdup(hush_version_str),
-        G.top_var = &G.shell_ver;
+        shell_ver.varstr = xstrdup(hush_version_str),
+        G.top_var = &shell_ver;
         /* Create shell local variables from the values
          * currently living in the environment */
         debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
@@ -7378,8 +7391,8 @@ int hush_main(int argc, char **argv)
                 e++;
         }
         /* (Re)insert HUSH_VERSION into env (AFTER we scanned the env!) */
-        debug_printf_env("putenv '%s'\n", G.shell_ver.varstr);
-        putenv(G.shell_ver.varstr);
+        debug_printf_env("putenv '%s'\n", shell_ver.varstr);
+        putenv(shell_ver.varstr);
 
         /* Export PWD */
         set_pwd_var(/*exp:*/ 1);
diff --git a/shell/hush_test/hush-arith/arith.right b/shell/hush_test/hush-arith/arith.right
index 718c26ad0..8a201fb3b 100644
--- a/shell/hush_test/hush-arith/arith.right
+++ b/shell/hush_test/hush-arith/arith.right
@@ -61,7 +61,7 @@ check that the unevaluated part of the ternary operator does not do evaluation o
 20 20
 30 30
 check precedence of assignment vs. conditional operator
-hush: error in arithmetic
+hush: arithmetic syntax error
 check precedence of assignment vs. conditional operator
 associativity of assignment-operator operator
 6 6
@@ -70,22 +70,22 @@ octal, hex
 263 263
 255 255
 40 40
-hush: error in arithmetic
-hush: divide by 0
+hush: arithmetic syntax error
+hush: divide by zero
 hush: can't execute 'let': No such file or directory
-hush: error in arithmetic
+hush: arithmetic syntax error
 hush: can't execute 'let': No such file or directory
 abc
 def
 ghi
-hush: error in arithmetic
+hush: arithmetic syntax error
 16 16
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
+hush: arithmetic syntax error
+hush: malformed ?: operator
+hush: arithmetic syntax error
 9 9
-hush: error in arithmetic
-hush: error in arithmetic
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 9 9
 9 9
 9 9
@@ -106,18 +106,18 @@ hush: error in arithmetic
 3 3
 4 4
 4 4
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 4 4
 7 7
 -7 -7
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 6 6
 3 3
 7 7
@@ -128,19 +128,19 @@ hush: error in arithmetic
 2 2
 -2 -2
 1 1
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
-hush: error in arithmetic
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 5 5
 1 1
 4 4
 0 0
-hush: error in arithmetic
-hush: error in arithmetic
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 8 12
-hush: error in arithmetic
+hush: arithmetic syntax error
 42
 42
 42
diff --git a/shell/hush_test/hush-glob/bash_brace1.right b/shell/hush_test/hush-glob/bash_brace1.right
new file mode 100644
index 000000000..63365c9e4
--- /dev/null
+++ b/shell/hush_test/hush-glob/bash_brace1.right
@@ -0,0 +1,4 @@
+bash_brace1.tests
+*{b,b}race1.t*
+bash_brace1.tests bash_brace1.tests
+Done: 0
diff --git a/shell/hush_test/hush-glob/bash_brace1.tests b/shell/hush_test/hush-glob/bash_brace1.tests
new file mode 100755
index 000000000..eb2f0e974
--- /dev/null
+++ b/shell/hush_test/hush-glob/bash_brace1.tests
@@ -0,0 +1,10 @@
+# unquoted $v should be globbed:
+v='*brace1.t*'; echo $v
+
+# ...but not brace expanded:
+v='*{b,b}race1.t*'; echo $v
+
+# whereas direct brces are expanded:
+echo *{b,b}race1.t*
+
+echo Done: $?
diff --git a/shell/math.c b/shell/math.c
index a4c55a4d0..760645d0f 100644
--- a/shell/math.c
+++ b/shell/math.c
@@ -1,5 +1,5 @@
 /*
- * arithmetic code ripped out of ash shell for code sharing
+ * Arithmetic code ripped out of ash shell for code sharing.
  *
  * This code is derived from software contributed to Berkeley by
  * Kenneth Almquist.
@@ -26,43 +26,41 @@
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
 /* Copyright (c) 2001 Aaron Lehmann <aaronl@vitelus.com>
-
-   Permission is hereby granted, free of charge, to any person obtaining
-   a copy of this software and associated documentation files (the
-   "Software"), to deal in the Software without restriction, including
-   without limitation the rights to use, copy, modify, merge, publish,
-   distribute, sublicense, and/or sell copies of the Software, and to
-   permit persons to whom the Software is furnished to do so, subject to
-   the following conditions:
-
-   The above copyright notice and this permission notice shall be
-   included in all copies or substantial portions of the Software.
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-   IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-   CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-   TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
 
 /* This is my infix parser/evaluator. It is optimized for size, intended
  * as a replacement for yacc-based parsers. However, it may well be faster
  * than a comparable parser written in yacc. The supported operators are
  * listed in #defines below. Parens, order of operations, and error handling
  * are supported. This code is thread safe. The exact expression format should
- * be that which POSIX specifies for shells. */
-
-/* The code uses a simple two-stack algorithm. See
+ * be that which POSIX specifies for shells.
+ *
+ * The code uses a simple two-stack algorithm. See
  * http://www.onthenet.com.au/~grahamis/int2008/week02/lect02.html
  * for a detailed explanation of the infix-to-postfix algorithm on which
  * this is based (this code differs in that it applies operators immediately
  * to the stack instead of adding them to a queue to end up with an
- * expression). */
-
-/* To use the routine, call it with an expression string and error return
- * pointer */
+ * expression).
+ */
 
 /*
  * Aug 24, 2001              Manuel Novoa III
@@ -104,28 +102,23 @@
  *  (C) 2003 Vladimir Oleynik <dzo@simtreas.ru>
  *
  * - allow access to variable,
- *   used recursive find value indirection (c=2*2; a="c"; $((a+=2)) produce 6)
- * - realize assign syntax (VAR=expr, +=, *= etc)
- * - realize exponentiation (** operator)
- * - realize comma separated - expr, expr
- * - realise ++expr --expr expr++ expr--
- * - realise expr ? expr : expr (but, second expr calculate always)
+ *   use recursive value indirection: c="2*2"; a="c"; echo $((a+=2)) produce 6
+ * - implement assign syntax (VAR=expr, +=, *= etc)
+ * - implement exponentiation (** operator)
+ * - implement comma separated - expr, expr
+ * - implement ++expr --expr expr++ expr--
+ * - implement expr ? expr : expr (but second expr is always calculated)
  * - allow hexadecimal and octal numbers
- * - was restored loses XOR operator
- * - remove one goto label, added three ;-)
- * - protect $((num num)) as true zero expr (Manuel`s error)
+ * - restore lost XOR operator
+ * - protect $((num num)) as true zero expr (Manuel's error)
  * - always use special isspace(), see comment from bash ;-)
  */
 #include "libbb.h"
 #include "math.h"
 
-#define a_e_h_t arith_eval_hooks_t
-#define lookupvar (math_hooks->lookupvar)
-#define setvar    (math_hooks->setvar   )
-//#define endofname (math_hooks->endofname)
-
-#define arith_isspace(arithval) \
-        (arithval == ' ' || arithval == '\n' || arithval == '\t')
+#define lookupvar (math_state->lookupvar)
+#define setvar    (math_state->setvar   )
+//#define endofname (math_state->endofname)
 
 typedef unsigned char operator;
 
@@ -133,181 +126,199 @@ typedef unsigned char operator;
  * precedence, and 3 high bits are an ID unique across operators of that
  * precedence. The ID portion is so that multiple operators can have the
  * same precedence, ensuring that the leftmost one is evaluated first.
- * Consider * and /. */
-
-#define tok_decl(prec,id) (((id)<<5)|(prec))
-#define PREC(op) ((op) & 0x1F)
-
-#define TOK_LPAREN tok_decl(0,0)
+ * Consider * and /
+ */
+#define tok_decl(prec,id)       (((id)<<5) | (prec))
+#define PREC(op)                ((op) & 0x1F)
 
-#define TOK_COMMA tok_decl(1,0)
+#define TOK_LPAREN              tok_decl(0,0)
 
-#define TOK_ASSIGN tok_decl(2,0)
-#define TOK_AND_ASSIGN tok_decl(2,1)
-#define TOK_OR_ASSIGN tok_decl(2,2)
-#define TOK_XOR_ASSIGN tok_decl(2,3)
-#define TOK_PLUS_ASSIGN tok_decl(2,4)
-#define TOK_MINUS_ASSIGN tok_decl(2,5)
-#define TOK_LSHIFT_ASSIGN tok_decl(2,6)
-#define TOK_RSHIFT_ASSIGN tok_decl(2,7)
+#define TOK_COMMA               tok_decl(1,0)
 
-#define TOK_MUL_ASSIGN tok_decl(3,0)
-#define TOK_DIV_ASSIGN tok_decl(3,1)
-#define TOK_REM_ASSIGN tok_decl(3,2)
+/* All assignments are right associative and have the same precedence,
+ * but there are 11 of them, which doesn't fit into 3 bits for unique id.
+ * Abusing another precedence level:
+ */
+#define TOK_ASSIGN              tok_decl(2,0)
+#define TOK_AND_ASSIGN          tok_decl(2,1)
+#define TOK_OR_ASSIGN           tok_decl(2,2)
+#define TOK_XOR_ASSIGN          tok_decl(2,3)
+#define TOK_PLUS_ASSIGN         tok_decl(2,4)
+#define TOK_MINUS_ASSIGN        tok_decl(2,5)
+#define TOK_LSHIFT_ASSIGN       tok_decl(2,6)
+#define TOK_RSHIFT_ASSIGN       tok_decl(2,7)
 
-/* all assign is right associativity and precedence eq, but (7+3)<<5 > 256 */
-#define convert_prec_is_assing(prec) do { if (prec == 3) prec = 2; } while (0)
+#define TOK_MUL_ASSIGN          tok_decl(3,0)
+#define TOK_DIV_ASSIGN          tok_decl(3,1)
+#define TOK_REM_ASSIGN          tok_decl(3,2)
 
-/* conditional is right associativity too */
-#define TOK_CONDITIONAL tok_decl(4,0)
-#define TOK_CONDITIONAL_SEP tok_decl(4,1)
+#define fix_assignment_prec(prec) do { if (prec == 3) prec = 2; } while (0)
 
-#define TOK_OR tok_decl(5,0)
+/* Ternary conditional operator is right associative too */
+#define TOK_CONDITIONAL         tok_decl(4,0)
+#define TOK_CONDITIONAL_SEP     tok_decl(4,1)
 
-#define TOK_AND tok_decl(6,0)
+#define TOK_OR                  tok_decl(5,0)
 
-#define TOK_BOR tok_decl(7,0)
+#define TOK_AND                 tok_decl(6,0)
 
-#define TOK_BXOR tok_decl(8,0)
+#define TOK_BOR                 tok_decl(7,0)
 
-#define TOK_BAND tok_decl(9,0)
+#define TOK_BXOR                tok_decl(8,0)
 
-#define TOK_EQ tok_decl(10,0)
-#define TOK_NE tok_decl(10,1)
+#define TOK_BAND                tok_decl(9,0)
 
-#define TOK_LT tok_decl(11,0)
-#define TOK_GT tok_decl(11,1)
-#define TOK_GE tok_decl(11,2)
-#define TOK_LE tok_decl(11,3)
+#define TOK_EQ                  tok_decl(10,0)
+#define TOK_NE                  tok_decl(10,1)
 
-#define TOK_LSHIFT tok_decl(12,0)
-#define TOK_RSHIFT tok_decl(12,1)
+#define TOK_LT                  tok_decl(11,0)
+#define TOK_GT                  tok_decl(11,1)
+#define TOK_GE                  tok_decl(11,2)
+#define TOK_LE                  tok_decl(11,3)
 
-#define TOK_ADD tok_decl(13,0)
-#define TOK_SUB tok_decl(13,1)
+#define TOK_LSHIFT              tok_decl(12,0)
+#define TOK_RSHIFT              tok_decl(12,1)
 
-#define TOK_MUL tok_decl(14,0)
-#define TOK_DIV tok_decl(14,1)
-#define TOK_REM tok_decl(14,2)
+#define TOK_ADD                 tok_decl(13,0)
+#define TOK_SUB                 tok_decl(13,1)
 
-/* exponent is right associativity */
-#define TOK_EXPONENT tok_decl(15,1)
+#define TOK_MUL                 tok_decl(14,0)
+#define TOK_DIV                 tok_decl(14,1)
+#define TOK_REM                 tok_decl(14,2)
 
-/* For now unary operators. */
-#define UNARYPREC 16
-#define TOK_BNOT tok_decl(UNARYPREC,0)
-#define TOK_NOT tok_decl(UNARYPREC,1)
+/* Exponent is right associative */
+#define TOK_EXPONENT            tok_decl(15,1)
 
-#define TOK_UMINUS tok_decl(UNARYPREC+1,0)
-#define TOK_UPLUS tok_decl(UNARYPREC+1,1)
+/* Unary operators */
+#define UNARYPREC               16
+#define TOK_BNOT                tok_decl(UNARYPREC,0)
+#define TOK_NOT                 tok_decl(UNARYPREC,1)
 
-#define PREC_PRE (UNARYPREC+2)
+#define TOK_UMINUS              tok_decl(UNARYPREC+1,0)
+#define TOK_UPLUS               tok_decl(UNARYPREC+1,1)
 
-#define TOK_PRE_INC tok_decl(PREC_PRE, 0)
-#define TOK_PRE_DEC tok_decl(PREC_PRE, 1)
+#define PREC_PRE                (UNARYPREC+2)
 
-#define PREC_POST (UNARYPREC+3)
+#define TOK_PRE_INC             tok_decl(PREC_PRE, 0)
+#define TOK_PRE_DEC             tok_decl(PREC_PRE, 1)
 
-#define TOK_POST_INC tok_decl(PREC_POST, 0)
-#define TOK_POST_DEC tok_decl(PREC_POST, 1)
+#define PREC_POST               (UNARYPREC+3)
 
-#define SPEC_PREC (UNARYPREC+4)
+#define TOK_POST_INC            tok_decl(PREC_POST, 0)
+#define TOK_POST_DEC            tok_decl(PREC_POST, 1)
 
-#define TOK_NUM tok_decl(SPEC_PREC, 0)
-#define TOK_RPAREN tok_decl(SPEC_PREC, 1)
+#define SPEC_PREC               (UNARYPREC+4)
 
-#define NUMPTR (*numstackptr)
+#define TOK_NUM                 tok_decl(SPEC_PREC, 0)
+#define TOK_RPAREN              tok_decl(SPEC_PREC, 1)
 
 static int
-tok_have_assign(operator op)
+is_assign_op(operator op)
 {
         operator prec = PREC(op);
-
-        convert_prec_is_assing(prec);
-        return (prec == PREC(TOK_ASSIGN) ||
-                        prec == PREC_PRE || prec == PREC_POST);
+        fix_assignment_prec(prec);
+        return prec == PREC(TOK_ASSIGN)
+        || prec == PREC_PRE
+        || prec == PREC_POST;
 }
 
 static int
-is_right_associativity(operator prec)
+is_right_associative(operator prec)
 {
-        return (prec == PREC(TOK_ASSIGN) || prec == PREC(TOK_EXPONENT)
-                || prec == PREC(TOK_CONDITIONAL));
+        return prec == PREC(TOK_ASSIGN)
+        || prec == PREC(TOK_EXPONENT)
+        || prec == PREC(TOK_CONDITIONAL);
 }
 
+
 typedef struct {
         arith_t val;
-        arith_t contidional_second_val;
-        char contidional_second_val_initialized;
-        char *var;      /* if NULL then is regular number,
-                           else is variable name */
-} v_n_t;
-
-typedef struct chk_var_recursive_looped_t {
+        /* We acquire second_val only when "expr1 : expr2" part
+         * of ternary ?: op is evaluated.
+         * We treat ?: as two binary ops: (expr ? (expr1 : expr2)).
+         * ':' produces a new value which has two parts, val and second_val;
+         * then '?' selects one of them based on its left side.
+         */
+        arith_t second_val;
+        char second_val_present;
+        /* If NULL then it's just a number, else it's a named variable */
+        char *var;
+} var_or_num_t;
+
+typedef struct remembered_name {
+        struct remembered_name *next;
         const char *var;
-        struct chk_var_recursive_looped_t *next;
-} chk_var_recursive_looped_t;
+} remembered_name;
 
-static chk_var_recursive_looped_t *prev_chk_var_recursive;
 
-static int
-arith_lookup_val(v_n_t *t, a_e_h_t *math_hooks)
+static arith_t FAST_FUNC
+evaluate_string(arith_state_t *math_state, const char *expr);
+
+static const char*
+arith_lookup_val(arith_state_t *math_state, var_or_num_t *t)
 {
         if (t->var) {
                 const char *p = lookupvar(t->var);
-
                 if (p) {
-                        int errcode;
-
-                        /* recursive try as expression */
-                        chk_var_recursive_looped_t *cur;
-                        chk_var_recursive_looped_t cur_save;
+                        remembered_name *cur;
+                        remembered_name cur_save;
 
-                        for (cur = prev_chk_var_recursive; cur; cur = cur->next) {
+                        /* did we already see this name?
+                         * testcase: a=b; b=a; echo $((a))
+                         */
+                        for (cur = math_state->list_of_recursed_names; cur; cur = cur->next) {
                                 if (strcmp(cur->var, t->var) == 0) {
-                                        /* expression recursion loop detected */
-                                        return -5;
+                                        /* Yes */
+                                        return "expression recursion loop detected";
                                 }
                         }
-                        /* save current lookuped var name */
-                        cur = prev_chk_var_recursive;
+
+                        /* push current var name */
+                        cur = math_state->list_of_recursed_names;
                         cur_save.var = t->var;
                         cur_save.next = cur;
-                        prev_chk_var_recursive = &cur_save;
+                        math_state->list_of_recursed_names = &cur_save;
+
+                        /* recursively evaluate p as expression */
+                        t->val = evaluate_string(math_state, p);
 
-                        t->val = arith (p, &errcode, math_hooks);
-                        /* restore previous ptr after recursiving */
-                        prev_chk_var_recursive = cur;
-                        return errcode;
+                        /* pop current var name */
+                        math_state->list_of_recursed_names = cur;
+
+                        return math_state->errmsg;
                 }
-                /* allow undefined var as 0 */
+                /* treat undefined var as 0 */
                 t->val = 0;
         }
         return 0;
 }
 
-/* "applying" a token means performing it on the top elements on the integer
- * stack. For a unary operator it will only change the top element, but a
- * binary operator will pop two arguments and push a result */
-static NOINLINE int
-arith_apply(operator op, v_n_t *numstack, v_n_t **numstackptr, a_e_h_t *math_hooks)
+/* "Applying" a token means performing it on the top elements on the integer
+ * stack. For an unary operator it will only change the top element, but a
+ * binary operator will pop two arguments and push the result */
+static NOINLINE const char*
+arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_or_num_t **numstackptr)
 {
-        v_n_t *numptr_m1;
-        arith_t numptr_val, rez;
-        int ret_arith_lookup_val;
+#define NUMPTR (*numstackptr)
+
+        var_or_num_t *top_of_stack;
+        arith_t rez;
+        const char *err;
 
         /* There is no operator that can work without arguments */
-        if (NUMPTR == numstack) goto err;
-        numptr_m1 = NUMPTR - 1;
+        if (NUMPTR == numstack)
+                goto err;
+
+        top_of_stack = NUMPTR - 1;
 
-        /* check operand is var with noninteger value */
-        ret_arith_lookup_val = arith_lookup_val(numptr_m1, math_hooks);
-        if (ret_arith_lookup_val)
-                return ret_arith_lookup_val;
+        /* Resolve name to value, if needed */
+        err = arith_lookup_val(math_state, top_of_stack);
+        if (err)
+                return err;
 
-        rez = numptr_m1->val;
+        rez = top_of_stack->val;
         if (op == TOK_UMINUS)
-                rez *= -1;
+                rez = -rez;
         else if (op == TOK_NOT)
                 rez = !rez;
         else if (op == TOK_BNOT)
@@ -318,118 +329,123 @@ arith_apply(operator op, v_n_t *numstack, v_n_t **numstackptr, a_e_h_t *math_hoo
                 rez--;
         else if (op != TOK_UPLUS) {
                 /* Binary operators */
+                arith_t right_side_val;
+                char bad_second_val;
 
-                /* check and binary operators need two arguments */
-                if (numptr_m1 == numstack) goto err;
-
-                /* ... and they pop one */
-                --NUMPTR;
-                numptr_val = rez;
-                if (op == TOK_CONDITIONAL) {
-                        if (!numptr_m1->contidional_second_val_initialized) {
-                                /* protect $((expr1 ? expr2)) without ": expr" */
-                                goto err;
-                        }
-                        rez = numptr_m1->contidional_second_val;
-                } else if (numptr_m1->contidional_second_val_initialized) {
-                        /* protect $((expr1 : expr2)) without "expr ? " */
+                /* Binary operators need two arguments */
+                if (top_of_stack == numstack)
                         goto err;
+                /* ...and they pop one */
+                NUMPTR = top_of_stack; /* this decrements NUMPTR */
+
+                bad_second_val = top_of_stack->second_val_present;
+                if (op == TOK_CONDITIONAL) { /* ? operation */
+                        /* Make next if (...) protect against
+                         * $((expr1 ? expr2)) - that is, missing ": expr" */
+                        bad_second_val = !bad_second_val;
+                }
+                if (bad_second_val) {
+                        /* Protect against $((expr <not_?_op> expr1 : expr2)) */
+                        return "malformed ?: operator";
                 }
-                numptr_m1 = NUMPTR - 1;
+
+                top_of_stack--; /* now points to left side */
+
                 if (op != TOK_ASSIGN) {
-                        /* check operand is var with noninteger value for not '=' */
-                        ret_arith_lookup_val = arith_lookup_val(numptr_m1, math_hooks);
-                        if (ret_arith_lookup_val)
-                                return ret_arith_lookup_val;
+                        /* Resolve left side value (unless the op is '=') */
+                        err = arith_lookup_val(math_state, top_of_stack);
+                        if (err)
+                                return err;
                 }
-                if (op == TOK_CONDITIONAL) {
-                        numptr_m1->contidional_second_val = rez;
+
+                right_side_val = rez;
+                rez = top_of_stack->val;
+                if (op == TOK_CONDITIONAL) /* ? operation */
+                        rez = (rez ? right_side_val : top_of_stack[1].second_val);
+                else if (op == TOK_CONDITIONAL_SEP) { /* : operation */
+                        if (top_of_stack == numstack) {
+                                /* Protect against $((expr : expr)) */
+                                return "malformed ?: operator";
+                        }
+                        top_of_stack->second_val_present = op;
+                        top_of_stack->second_val = right_side_val;
                 }
-                rez = numptr_m1->val;
-                if (op == TOK_BOR || op == TOK_OR_ASSIGN)
-                        rez |= numptr_val;
+                else if (op == TOK_BOR || op == TOK_OR_ASSIGN)
+                        rez |= right_side_val;
                 else if (op == TOK_OR)
-                        rez = numptr_val || rez;
+                        rez = right_side_val || rez;
                 else if (op == TOK_BAND || op == TOK_AND_ASSIGN)
-                        rez &= numptr_val;
+                        rez &= right_side_val;
                 else if (op == TOK_BXOR || op == TOK_XOR_ASSIGN)
-                        rez ^= numptr_val;
+                        rez ^= right_side_val;
                 else if (op == TOK_AND)
-                        rez = rez && numptr_val;
+                        rez = rez && right_side_val;
                 else if (op == TOK_EQ)
-                        rez = (rez == numptr_val);
+                        rez = (rez == right_side_val);
                 else if (op == TOK_NE)
-                        rez = (rez != numptr_val);
+                        rez = (rez != right_side_val);
                 else if (op == TOK_GE)
-                        rez = (rez >= numptr_val);
+                        rez = (rez >= right_side_val);
                 else if (op == TOK_RSHIFT || op == TOK_RSHIFT_ASSIGN)
-                        rez >>= numptr_val;
+                        rez >>= right_side_val;
                 else if (op == TOK_LSHIFT || op == TOK_LSHIFT_ASSIGN)
-                        rez <<= numptr_val;
+                        rez <<= right_side_val;
                 else if (op == TOK_GT)
-                        rez = (rez > numptr_val);
+                        rez = (rez > right_side_val);
                 else if (op == TOK_LT)
-                        rez = (rez < numptr_val);
+                        rez = (rez < right_side_val);
                 else if (op == TOK_LE)
-                        rez = (rez <= numptr_val);
+                        rez = (rez <= right_side_val);
                 else if (op == TOK_MUL || op == TOK_MUL_ASSIGN)
-                        rez *= numptr_val;
+                        rez *= right_side_val;
                 else if (op == TOK_ADD || op == TOK_PLUS_ASSIGN)
-                        rez += numptr_val;
+                        rez += right_side_val;
                 else if (op == TOK_SUB || op == TOK_MINUS_ASSIGN)
-                        rez -= numptr_val;
+                        rez -= right_side_val;
                 else if (op == TOK_ASSIGN || op == TOK_COMMA)
-                        rez = numptr_val;
-                else if (op == TOK_CONDITIONAL_SEP) {
-                        if (numptr_m1 == numstack) {
-                                /* protect $((expr : expr)) without "expr ? " */
-                                goto err;
-                        }
-                        numptr_m1->contidional_second_val_initialized = op;
-                        numptr_m1->contidional_second_val = numptr_val;
-                } else if (op == TOK_CONDITIONAL) {
-                        rez = rez ?
-                                numptr_val : numptr_m1->contidional_second_val;
-                } else if (op == TOK_EXPONENT) {
-                        if (numptr_val < 0)
-                                return -3;      /* exponent less than 0 */
-                        else {
-                                arith_t c = 1;
-
-                                if (numptr_val)
-                                        while (numptr_val--)
-                                                c *= rez;
-                                rez = c;
-                        }
-                } else if (numptr_val==0)          /* zero divisor check */
-                        return -2;
+                        rez = right_side_val;
+                else if (op == TOK_EXPONENT) {
+                        arith_t c;
+                        if (right_side_val < 0)
+                                return "exponent less than 0";
+                        c = 1;
+                        while (--right_side_val >= 0)
+                            c *= rez;
+                        rez = c;
+                }
+                else if (right_side_val == 0)
+                        return "divide by zero";
                 else if (op == TOK_DIV || op == TOK_DIV_ASSIGN)
-                        rez /= numptr_val;
+                        rez /= right_side_val;
                 else if (op == TOK_REM || op == TOK_REM_ASSIGN)
-                        rez %= numptr_val;
+                        rez %= right_side_val;
         }
-        if (tok_have_assign(op)) {
+
+        if (is_assign_op(op)) {
                 char buf[sizeof(arith_t)*3 + 2];
 
-                if (numptr_m1->var == NULL) {
+                if (top_of_stack->var == NULL) {
                         /* Hmm, 1=2 ? */
+//TODO: actually, bash allows ++7 but for some reason it evals to 7, not 8
                         goto err;
                 }
-                /* save to shell variable */
-                sprintf(buf, arith_t_fmt, rez);
-                setvar(numptr_m1->var, buf);
-                /* after saving, make previous value for v++ or v-- */
+                /* Save to shell variable */
+                sprintf(buf, ARITH_FMT, rez);
+                setvar(top_of_stack->var, buf);
+                /* After saving, make previous value for v++ or v-- */
                 if (op == TOK_POST_INC)
                         rez--;
                 else if (op == TOK_POST_DEC)
                         rez++;
         }
-        numptr_m1->val = rez;
-        /* protect geting var value, is number now */
-        numptr_m1->var = NULL;
-        return 0;
+
+        top_of_stack->val = rez;
+        /* Erase var name, it is just a number now */
+        top_of_stack->var = NULL;
+        return NULL;
  err:
-        return -1;
+        return "arithmetic syntax error";
+#undef NUMPTR
 }
 
 /* longest must be first */
@@ -476,8 +492,7 @@ static const char op_tokens[] ALIGN1 = {
         '(',        0, TOK_LPAREN,
         0
 };
-/* ptr to ")" */
-#define endexpression (&op_tokens[sizeof(op_tokens)-7])
+#define ptr_to_rparen (&op_tokens[sizeof(op_tokens)-7])
 
 const char* FAST_FUNC
 endofname(const char *name)
@@ -491,35 +506,40 @@ endofname(const char *name)
         return name;
 }
 
-arith_t
-arith(const char *expr, int *perrcode, a_e_h_t *math_hooks)
+static arith_t FAST_FUNC
+evaluate_string(arith_state_t *math_state, const char *expr)
 {
-        char arithval; /* Current character under analysis */
-        operator lasttok, op;
-        operator prec;
-        operator *stack, *stackptr;
-        const char *p = endexpression;
-        int errcode;
-        v_n_t *numstack, *numstackptr;
-        unsigned datasizes = strlen(expr) + 2;
-
+        operator lasttok;
+        const char *errmsg;
+        const char *start_expr = expr = skip_whitespace(expr);
+        unsigned expr_len = strlen(expr) + 2;
         /* Stack of integers */
-        /* The proof that there can be no more than strlen(startbuf)/2+1 integers
-         * in any given correct or incorrect expression is left as an exercise to
-         * the reader. */
-        numstackptr = numstack = alloca((datasizes / 2) * sizeof(numstack[0]));
+        /* The proof that there can be no more than strlen(startbuf)/2+1
+         * integers in any given correct or incorrect expression
+         * is left as an exercise to the reader. */
+        var_or_num_t *const numstack = alloca((expr_len / 2) * sizeof(numstack[0]));
+        var_or_num_t *numstackptr = numstack;
         /* Stack of operator tokens */
-        stackptr = stack = alloca(datasizes * sizeof(stack[0]));
+        operator *const stack = alloca(expr_len * sizeof(stack[0]));
+        operator *stackptr = stack;
 
-        *stackptr++ = lasttok = TOK_LPAREN;     /* start off with a left paren */
-        *perrcode = errcode = 0;
+        /* Start with a left paren */
+        *stackptr++ = lasttok = TOK_LPAREN;
+        errmsg = NULL;
 
         while (1) {
+                const char *p;
+                operator op;
+                operator prec;
+                char arithval;
+
+                expr = skip_whitespace(expr);
                 arithval = *expr;
-                if (arithval == 0) {
-                        if (p == endexpression) {
-                                /* Null expression. */
-                                return 0;
+                if (arithval == '\0') {
+                        if (expr == start_expr) {
+                                /* Null expression */
+                                numstack->val = 0;
+                                goto ret;
                         }
 
                         /* This is only reached after all tokens have been extracted from the
@@ -527,77 +547,80 @@ arith(const char *expr, int *perrcode, a_e_h_t *math_hooks)
                          * are to be applied in order. At the end, there should be a final
                          * result on the integer stack */
 
-                        if (expr != endexpression + 1) {
-                                /* If we haven't done so already, */
-                                /* append a closing right paren */
-                                expr = endexpression;
-                                /* and let the loop process it. */
+                        if (expr != ptr_to_rparen + 1) {
+                                /* If we haven't done so already,
+                                 * append a closing right paren
+                                 * and let the loop process it */
+                                expr = ptr_to_rparen;
                                 continue;
                         }
-                        /* At this point, we're done with the expression. */
-                        if (numstackptr != numstack+1) {
-                                /* ... but if there isn't, it's bad */
- err:
-                                *perrcode = -1;
-                                return *perrcode;
+                        /* At this point, we're done with the expression */
+                        if (numstackptr != numstack + 1) {
+                                /* ...but if there isn't, it's bad */
+                                goto err;
                         }
                         if (numstack->var) {
                                 /* expression is $((var)) only, lookup now */
-                                errcode = arith_lookup_val(numstack, math_hooks);
+                                errmsg = arith_lookup_val(math_state, numstack);
                         }
- ret:
-                        *perrcode = errcode;
-                        return numstack->val;
+                        goto ret;
                 }
 
-                /* Continue processing the expression. */
-                if (arith_isspace(arithval)) {
-                        /* Skip whitespace */
-                        goto prologue;
-                }
                 p = endofname(expr);
                 if (p != expr) {
-                        size_t var_name_size = (p-expr) + 1;  /* trailing zero */
-
+                        /* Name */
+                        size_t var_name_size = (p-expr) + 1;  /* +1 for NUL */
                         numstackptr->var = alloca(var_name_size);
                         safe_strncpy(numstackptr->var, expr, var_name_size);
                         expr = p;
  num:
-                        numstackptr->contidional_second_val_initialized = 0;
+                        numstackptr->second_val_present = 0;
                         numstackptr++;
                         lasttok = TOK_NUM;
                         continue;
                 }
+
                 if (isdigit(arithval)) {
+                        /* Number */
                         numstackptr->var = NULL;
                         errno = 0;
-                        /* call strtoul[l]: */
-                        numstackptr->val = strto_arith_t(expr, (char **) &expr, 0);
+                        numstackptr->val = strto_arith_t(expr, (char**) &expr, 0);
                         if (errno)
                                 numstackptr->val = 0; /* bash compat */
                         goto num;
                 }
-                for (p = op_tokens; ; p++) {
-                        const char *o;
 
-                        if (*p == 0) {
-                                /* strange operator not found */
-                                goto err;
-                        }
-                        for (o = expr; *p && *o == *p; p++)
-                                o++;
-                        if (!*p) {
-                                /* found */
-                                expr = o - 1;
-                                break;
+                /* Should be an operator */
+                p = op_tokens;
+                while (1) {
+// TODO: bash allows 7+++v, treats it as 7 + ++v
+// we treat it as 7++ + v and reject
+                        /* Compare expr to current op_tokens[] element */
+                        const char *e = expr;
+                        while (1) {
+                                if (*p == '\0') {
+                                        /* Match: operator is found */
+                                        expr = e;
+                                        goto tok_found;
+                                }
+                                if (*p != *e)
+                                        break;
+                                p++;
+                                e++;
                         }
-                        /* skip tail uncompared token */
+                        /* No match, go to next element of op_tokens[] */
                         while (*p)
                                 p++;
-                        /* skip zero delim */
-                        p++;
+                        p += 2; /* skip NUL and TOK_foo bytes */
+                        if (*p == '\0') {
+                                /* No next element, operator not found */
+                                //math_state->syntax_error_at = expr;
+                                goto err;
+                        }
                 }
-                op = p[1];
+ tok_found:
+                op = p[1]; /* fetch TOK_foo value */
+                /* NB: expr now points past the operator */
 
                 /* post grammar: a++ reduce to num */
                 if (lasttok == TOK_POST_INC || lasttok == TOK_POST_DEC)
@@ -626,13 +649,13 @@ arith(const char *expr, int *perrcode, a_e_h_t *math_hooks)
                 /* We don't want an unary operator to cause recursive descent on the
                  * stack, because there can be many in a row and it could cause an
                  * operator to be evaluated before its argument is pushed onto the
-                 * integer stack. */
-                /* But for binary operators, "apply" everything on the operator
+                 * integer stack.
+                 * But for binary operators, "apply" everything on the operator
                  * stack until we find an operator with a lesser priority than the
-                 * one we have just extracted. */
-                /* Left paren is given the lowest priority so it will never be
+                 * one we have just extracted. If op is right-associative,
+                 * then stop "applying" on the equal priority too.
+                 * Left paren is given the lowest priority so it will never be
                  * "applied" in this way.
-                 * if associativity is right and priority eq, applied also skip
                  */
                 prec = PREC(op);
                 if ((prec > 0 && prec < UNARYPREC) || prec == SPEC_PREC) {
@@ -642,41 +665,56 @@ arith(const char *expr, int *perrcode, a_e_h_t *math_hooks)
                                 goto err;
                         }
                         while (stackptr != stack) {
+                                operator prev_op = *--stackptr;
                                 if (op == TOK_RPAREN) {
                                         /* The algorithm employed here is simple: while we don't
                                          * hit an open paren nor the bottom of the stack, pop
                                          * tokens and apply them */
-                                        if (stackptr[-1] == TOK_LPAREN) {
-                                                --stackptr;
-                                                /* Any operator directly after a */
+                                        if (prev_op == TOK_LPAREN) {
+                                                /* Any operator directly after a
+                                                 * close paren should consider itself binary */
                                                 lasttok = TOK_NUM;
-                                                /* close paren should consider itself binary */
-                                                goto prologue;
+                                                goto next;
                                         }
                                 } else {
-                                        operator prev_prec = PREC(stackptr[-1]);
-
-                                        convert_prec_is_assing(prec);
-                                        convert_prec_is_assing(prev_prec);
-                                        if (prev_prec < prec)
-                                                break;
-                                        /* check right assoc */
-                                        if (prev_prec == prec && is_right_associativity(prec))
+                                        operator prev_prec = PREC(prev_op);
+                                        fix_assignment_prec(prec);
+                                        fix_assignment_prec(prev_prec);
+                                        if (prev_prec < prec
+                                         || (prev_prec == prec && is_right_associative(prec))
+                                        ) {
+                                                stackptr++;
                                                 break;
+                                        }
                                 }
-                                errcode = arith_apply(*--stackptr, numstack, &numstackptr, math_hooks);
-                                if (errcode) goto ret;
+                                errmsg = arith_apply(math_state, prev_op, numstack, &numstackptr);
+                                if (errmsg)
+                                        goto err_with_custom_msg;
                         }
-                        if (op == TOK_RPAREN) {
+                        if (op == TOK_RPAREN)
                                 goto err;
-                        }
                 }
 
-                /* Push this operator to the stack and remember it. */
+                /* Push this operator to the stack and remember it */
                 *stackptr++ = lasttok = op;
- prologue:
-                ++expr;
-        } /* while */
+ next: ;
+        } /* while (1) */
+
+ err:
+        errmsg = "arithmetic syntax error";
+ err_with_custom_msg:
+        numstack->val = -1;
+ ret:
+        math_state->errmsg = errmsg;
+        return numstack->val;
+}
+
+arith_t FAST_FUNC
+arith(arith_state_t *math_state, const char *expr)
+{
+        math_state->errmsg = NULL;
+        math_state->list_of_recursed_names = NULL;
+        return evaluate_string(math_state, expr);
 }
 
 /*
diff --git a/shell/math.h b/shell/math.h
index 96088b4d2..2d305eb12 100644
--- a/shell/math.h
+++ b/shell/math.h
@@ -9,67 +9,53 @@
 
 /* The math library has just one function:
  *
- *      arith_t arith(const char *expr, int *perrcode, arith_eval_hooks_t *hooks);
+ * arith_t arith(arith_state_t *state, const char *expr);
  *
- *      The first argument is the math string to parse.  All normal expansions must
- *      be done already.  i.e. no dollar symbols should be present.
+ * The expr argument is the math string to parse.  All normal expansions must
+ * be done already.  i.e. no dollar symbols should be present.
  *
- *      The second argument is a semi-detailed error description in case something
- *      goes wrong in the parsing steps.  Currently, those values are (for
- *      compatibility, you should assume all negative values are errors):
- *               0 - no errors (yay!)
- *              -1 - unspecified problem
- *              -2 - divide by zero
- *              -3 - exponent less than 0
- *              -5 - expression recursion loop detected
+ * The state argument is a pointer to a struct of hooks for your shell (see below),
+ * and an error message string (NULL if no error).
  *
- *      The third argument is a struct pointer of hooks for your shell (see below).
- *
- *      The function returns the answer to the expression.  So if you called it
- *      with the expression:
- *              "1 + 2 + 3"
- *      You would obviously get back 6.
+ * The function returns the answer to the expression.  So if you called it
+ * with the expression:
+ * "1 + 2 + 3"
+ * you would obviously get back 6.
  */
 
 /* To add support to a shell, you need to implement three functions:
  *
- *      lookupvar() - look up and return the value of a variable
+ * lookupvar() - look up and return the value of a variable
  *
- *              If the shell does:
- *                      foo=123
- *              Then the code:
- *                      const char *val = lookupvar("foo");
- *              Will result in val pointing to "123"
+ *      If the shell does:
+ *              foo=123
+ *      Then the code:
+ *              const char *val = lookupvar("foo");
+ *      will result in val pointing to "123"
  *
- *      setvar() - set a variable to some value
+ * setvar() - set a variable to some value
  *
- *              If the arithmetic expansion does something like:
- *                      $(( i = 1))
- *              Then the math code will make a call like so:
- *                      setvar("i", "1", 0);
- *              The storage for the first two parameters are not allocated, so your
- *              shell implementation will most likely need to strdup() them to save.
+ *      If the arithmetic expansion does something like:
+ *              $(( i = 1))
+ *      then the math code will make a call like so:
+ *              setvar("i", "1", 0);
+ *      The storage for the first two parameters are not allocated, so your
+ *      shell implementation will most likely need to strdup() them to save.
  *
- *      endofname() - return the end of a variable name from input
+ * endofname() - return the end of a variable name from input
  *
- *              The arithmetic code does not know about variable naming conventions.
- *              So when it is given an experession, it knows something is not numeric,
- *              but it is up to the shell to dictate what is a valid identifiers.
- *              So when it encounters something like:
- *                      $(( some_var + 123 ))
- *              It will make a call like so:
- *                      end = endofname("some_var + 123");
- *              So the shell needs to scan the input string and return a pointer to the
- *              first non-identifier string.  In this case, it should return the input
- *              pointer with an offset pointing to the first space.  The typical
- *              implementation will return the offset of first char that does not match
- *              the regex (in C locale): ^[a-zA-Z_][a-zA-Z_0-9]*
- */
-
-/* To make your life easier when dealing with optional 64bit math support,
- * rather than assume that the type is "signed long" and you can always
- * use "%ld" to scan/print the value, use the arith_t helper defines.  See
- * below for the exact things that are available.
+ *      The arithmetic code does not know about variable naming conventions.
+ *      So when it is given an experession, it knows something is not numeric,
+ *      but it is up to the shell to dictate what is a valid identifiers.
+ *      So when it encounters something like:
+ *              $(( some_var + 123 ))
+ *      It will make a call like so:
+ *              end = endofname("some_var + 123");
+ *      So the shell needs to scan the input string and return a pointer to the
+ *      first non-identifier string.  In this case, it should return the input
+ *      pointer with an offset pointing to the first space.  The typical
+ *      implementation will return the offset of first char that does not match
+ *      the regex (in C locale): ^[a-zA-Z_][a-zA-Z_0-9]*
  */
 
 #ifndef SHELL_MATH_H
@@ -79,11 +65,11 @@ PUSH_AND_SET_FUNCTION_VISIBILITY_TO_HIDDEN
 
 #if ENABLE_SH_MATH_SUPPORT_64
 typedef long long arith_t;
-#define arith_t_fmt "%lld"
+#define ARITH_FMT "%lld"
 #define strto_arith_t strtoull
 #else
 typedef long arith_t;
-#define arith_t_fmt "%ld"
+#define ARITH_FMT "%ld"
 #define strto_arith_t strtoul
 #endif
 
@@ -96,13 +82,15 @@ typedef const char* FAST_FUNC (*arith_var_lookup_t)(const char *name);
 typedef void        FAST_FUNC (*arith_var_set_t)(const char *name, const char *val);
 //typedef const char* FAST_FUNC (*arith_var_endofname_t)(const char *name);
 
-typedef struct arith_eval_hooks {
+typedef struct arith_state_t {
+        const char           *errmsg;
         arith_var_lookup_t    lookupvar;
         arith_var_set_t       setvar;
 //      arith_var_endofname_t endofname;
-} arith_eval_hooks_t;
+        void                 *list_of_recursed_names;
+} arith_state_t;
 
-arith_t arith(const char *expr, int *perrcode, arith_eval_hooks_t*);
+arith_t FAST_FUNC arith(arith_state_t *state, const char *expr);
 
 POP_SAVED_FUNCTION_VISIBILITY