Merge branch 'origin/master' (early part)

18 files changed, 285 insertions, 199 deletions

diff --git a/shell/Config.in b/shell/Config.in
index 3b1650615..cf599dff4 100644
--- a/shell/Config.in
+++ b/shell/Config.in
@@ -354,9 +354,20 @@ config CTTYHACK
           It analyzes stdin with various ioctls, trying to determine whether
           it is a /dev/ttyN or /dev/ttySN (virtual terminal or serial line).
           If it detects one, it closes stdin/out/err and reopens that device.
-          Then it executes given program. Usage example for /etc/inittab
-          (for busybox init):
+          Then it executes given program. Opening the device will make
+          that device a controlling tty. This may require cttyhack
+          to be a session leader.
+
+          Example for /etc/inittab (for busybox init):
 
           ::respawn:/bin/cttyhack /bin/sh
 
+          Giving controlling tty to shell running with PID 1:
+
+          $ exec cttyhack sh
+
+          Starting an interactive shell from boot shell script:
+
+          setsid cttyhack sh
+
 endmenu
diff --git a/shell/README b/shell/README
index 59efe499f..550c712d3 100644
--- a/shell/README
+++ b/shell/README
@@ -1,108 +1,82 @@
-Various bits of what is known about busybox shells, in no particular order.
-
-2008-02-14
-ash: does not restore tty pgrp if killed by HUP. Symptom: Midnight Commander
-is backgrounded if you started ash under it, and then killed it with HUP.
-
-2007-11-23
-hush: fixed bogus glob handling; fixed exec <"$1"; added test and echo builtins
-
-2007-06-13
-hush: exec <"$1" doesn't do parameter subst
-
-2007-05-24
-hush: environment-related memory leak plugged, with net code size
-decrease.
-
-2007-05-24
-hush: '( echo ${name )' will show syntax error message, but prompt
-doesn't return (need to press <enter>). Pressing Ctrl-C, <enter>,
-'( echo ${name )' again, Ctrl-C segfaults.
-
-2007-05-21
-hush: environment cannot be handled by libc routines as they are leaky
-(by API design and thus unfixable): hush will leak memory in this script,
-bash does not:
-pid=$$
-while true; do
-    unset t;
-    t=111111111111111111111111111111111111111111111111111111111111111111111111
-    export t
-    ps -o vsz,pid,comm | grep " $pid "
-done
-The fix is to not use setenv/putenv/unsetenv but manipulate env ourself. TODO.
-hush: meanwhile, first three command subst bugs mentioned below are fixed. :)
-
-2007-05-06
-hush: more bugs spotted. Comparison with bash:
-bash-3.2# echo "TEST`date;echo;echo`BEST"
-TESTSun May  6 09:21:05 CEST 2007BEST         [we dont strip eols]
-bash-3.2# echo "TEST`echo '$(echo ZZ)'`BEST"
-TEST$(echo ZZ)BEST                            [we execute inner echo]
-bash-3.2# echo "TEST`echo "'"`BEST"
-TEST'BEST                                     [we totally mess up this one]
-bash-3.2# echo `sleep 5`
-[Ctrl-C should work, Ctrl-Z should do nothing][we totally mess up this one]
-bash-3.2# if true; then
-> [Ctrl-C]
-bash-3.2#                                     [we re-issue "> "]
-bash-3.2# if echo `sleep 5`; then
-> true; fi                                    [we execute sleep before "> "]
-
-2007-05-04
-hush: made ctrl-Z/C work correctly for "while true; do true; done"
-(namely, it backgrounds/interrupts entire "while")
-
-2007-05-03
-hush: new bug spotted: Ctrl-C on "while true; do true; done" doesn't
-work right:
-# while true; do true; done
-[1] 0 true <-- pressing Ctrl-C several times...
-[2] 0 true
-[3] 0 true
-Segmentation fault
-
-2007-05-03
-hush: update on "sleep 1 | exit 3; echo $?" bug.
-parse_stream_outer() repeatedly calls parse_stream().
-parse_stream() is now fixed to stop on ';' in this example,
-fixing it (parse_stream_outer() will call parse_stream() 1st time,
-execute the parse tree, call parse_stream() 2nd time and execute the tree).
-But it's not the end of story.
-In more complex situations we _must_ parse way farther before executing.
-Example #2: "{ sleep 1 | exit 3; echo $?; ...few_lines... } >file".
-Because of redirection, we cannot execute 1st pipe before we parse it all.
-We probably need to learn to store $var expressions in parse tree.
-Debug printing of parse tree would be nice too.
-
-2007-04-28
-hush: Ctrl-C and Ctrl-Z for single NOFORK commands are working.
-Memory and other resource leaks (opendir) are not addressed
-(testcase is "rm -i" interrupted by ctrl-c).
-
-2007-04-21
-hush: "sleep 5 | sleep 6" + Ctrl-Z + fg seems to work.
-"rm -i" + Ctrl-C, "sleep 5" + Ctrl-Z still doesn't work
-for SH_STANDALONE case :(
-
-2007-04-21
-hush: fixed non-backgrounding of "sleep 1 &" and totally broken
-"sleep 1 | sleep 2 &". Noticed a bug where successive jobs
-get numbers 1,2,3 even when job #1 has exited before job# 2 is started.
-(bash reuses #1 in this case)
-
-2007-04-21
-hush: "sleep 1 | exit 3; echo $?" prints 0 because $? is substituted
-_before_ pipe gets executed!! run_list_real() already has "pipe;echo"
-parsed and handed to it for execution, so it sees "pipe"; "echo 0".
-
-2007-04-21
-hush: removed setsid() and made job control sort-of-sometimes-work.
-Ctrl-C in "rm -i" works now except for SH_STANDALONE case.
-"sleep 1 | exit 3" + "echo $?" works, "sleep 1 | exit 3; echo $?"
-shows exitcode 0 (should be 3). "sleep 1 | sleep 2 &" fails horribly.
-
-2007-04-14
-lash, hush: both do setsid() and as a result don't have ctty!
-Ctrl-C doesn't work for any child (try rm -i), etc...
-lash: bare ">file" doesn't create a file (hush works)
+http://www.opengroup.org/onlinepubs/9699919799/
+Open Group Base Specifications Issue 7
+
+
+http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap01.html
+Shell & Utilities
+
+It says that any of the standard utilities may be implemented
+as a regular shell built-in. It gives a list of utilities which
+are usually implemented that way (and some of them can only
+be implemented as built-ins, like "alias"):
+
+alias
+bg
+cd
+command
+false
+fc
+fg
+getopts
+jobs
+kill
+newgrp
+pwd
+read
+true
+umask
+unalias
+wait
+
+
+http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html
+Shell Command Language
+
+It says that shell must implement special built-ins. Special built-ins
+differ from regular ones by the fact that variable assignments
+done on special builtin is *PRESERVED*. That is,
+
+VAR=VAL special_builtin; echo $VAR
+
+should print VAL.
+
+(Another distinction is that an error in special built-in should
+abort the shell, but this is not such a critical difference,
+and moreover, at least bash's "set" does not follow this rule,
+which is even codified in autoconf now...).
+
+List of special builtins:
+
+. file
+: [argument...]
+break [n]
+continue [n]
+eval [argument...]
+exec [command [argument...]]
+exit [n]
+export name[=word]...
+export -p
+readonly name[=word]...
+readonly -p
+return [n]
+set [-abCefhmnuvx] [-o option] [argument...]
+set [+abCefhmnuvx] [+o option] [argument...]
+set -- [argument...]
+set -o
+set +o
+shift [n]
+times
+trap n [condition...]
+trap [action condition...]
+unset [-fv] name...
+
+In practice, no one uses this obscure feature - none of these builtins
+gives any special reasons to play such dirty tricks.
+
+However. This section says that *function invocation* should act
+similar to special built-in. That is, variable assignments
+done on function invocation should be preserved after function invocation.
+
+This is significant: it is not unthinkable to want to run a function
+with some variables set to special values. But because of the above,
+it does not work: variable will "leak" out of the function.
diff --git a/shell/ash.c b/shell/ash.c
index 5d8415a79..16a331bb0 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -257,6 +257,7 @@ struct globals_misc {
 
         /* indicates specified signal received */
         uint8_t gotsig[NSIG - 1]; /* offset by 1: "signal" 0 is meaningless */
+        uint8_t may_have_traps; /* 0: definitely no traps are set, 1: some traps may be set */
         char *trap[NSIG];
         char **trap_ptr;        /* used only by "trap hack" */
 
@@ -285,6 +286,7 @@ extern struct globals_misc *const ash_ptr_to_globals_misc;
 #define optlist     (G_misc.optlist    )
 #define sigmode     (G_misc.sigmode    )
 #define gotsig      (G_misc.gotsig     )
+#define may_have_traps    (G_misc.may_have_traps   )
 #define trap        (G_misc.trap       )
 #define trap_ptr    (G_misc.trap_ptr   )
 #define random_gen  (G_misc.random_gen )
@@ -382,7 +384,7 @@ raise_interrupt(void)
         /* Signal is not automatically unmasked after it is raised,
          * do it ourself - unmask all signals */
         sigprocmask_allsigs(SIG_UNBLOCK);
-        /* pending_sig = 0; - now done in onsig() */
+        /* pending_sig = 0; - now done in signal_handler() */
 
         ex_type = EXSIG;
         if (gotsig[SIGINT - 1] && !trap[SIGINT]) {
@@ -2743,9 +2745,7 @@ pwdcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 /* ============ ... */
 
 
-#define IBUFSIZ COMMON_BUFSIZE
-/* buffer for top level input file */
-#define basebuf bb_common_bufsiz1
+#define IBUFSIZ (ENABLE_FEATURE_EDITING ? CONFIG_FEATURE_EDITING_MAX_LEN : 1024)
 
 /* Syntax classes */
 #define CWORD     0             /* character is nothing special */
@@ -3424,10 +3424,10 @@ ignoresig(int signo)
 }
 
 /*
- * Signal handler. Only one usage site - in setsignal()
+ * Only one usage site - in setsignal()
  */
 static void
-onsig(int signo)
+signal_handler(int signo)
 {
         gotsig[signo - 1] = 1;
 
@@ -3524,7 +3524,7 @@ setsignal(int signo)
         act.sa_handler = SIG_DFL;
         switch (new_act) {
         case S_CATCH:
-                act.sa_handler = onsig;
+                act.sa_handler = signal_handler;
                 act.sa_flags = 0; /* matters only if !DFL and !IGN */
                 sigfillset(&act.sa_mask); /* ditto */
                 break;
@@ -4083,9 +4083,9 @@ dowait(int wait_flags, struct job *job)
 }
 
 static int
-blocking_wait_with_raise_on_sig(struct job *job)
+blocking_wait_with_raise_on_sig(void)
 {
-        pid_t pid = dowait(DOWAIT_BLOCK, job);
+        pid_t pid = dowait(DOWAIT_BLOCK, NULL);
         if (pid <= 0 && pending_sig)
                 raise_exception(EXSIG);
         return pid;
@@ -4281,14 +4281,21 @@ waitcmd(int argc UNUSED_PARAM, char **argv)
                                 jp->waited = 1;
                                 jp = jp->prev_job;
                         }
+                        blocking_wait_with_raise_on_sig();
         /* man bash:
          * "When bash is waiting for an asynchronous command via
          * the wait builtin, the reception of a signal for which a trap
          * has been set will cause the wait builtin to return immediately
          * with an exit status greater than 128, immediately after which
          * the trap is executed."
-         * Do we do it that way? */
-                        blocking_wait_with_raise_on_sig(NULL);
+         *
+         * blocking_wait_with_raise_on_sig raises signal handlers
+         * if it gets no pid (pid < 0). However,
+         * if child sends us a signal *and immediately exits*,
+         * blocking_wait_with_raise_on_sig gets pid > 0
+         * and does not handle pending_sig. Check this case: */
+                        if (pending_sig)
+                                raise_exception(EXSIG);
                 }
         }
 
@@ -4308,7 +4315,7 @@ waitcmd(int argc UNUSED_PARAM, char **argv)
                         job = getjob(*argv, 0);
                 /* loop until process terminated or stopped */
                 while (job->state == JOBRUNNING)
-                        blocking_wait_with_raise_on_sig(NULL);
+                        blocking_wait_with_raise_on_sig();
                 job->waited = 1;
                 retval = getstatus(job);
  repeat: ;
@@ -5715,7 +5722,11 @@ rmescapes(char *str, int flag)
                 size_t fulllen = len + strlen(p) + 1;
 
                 if (flag & RMESCAPE_GROW) {
+                        int strloc = str - (char *)stackblock();
                         r = makestrspace(fulllen, expdest);
+                        /* p and str may be invalidated by makestrspace */
+                        str = (char *)stackblock() + strloc;
+                        p = str + len;
                 } else if (flag & RMESCAPE_HEAP) {
                         r = ckmalloc(fulllen);
                 } else {
@@ -8819,7 +8830,7 @@ evalsubshell(union node *n, int flags)
         int status;
 
         expredir(n->nredir.redirect);
-        if (!backgnd && flags & EV_EXIT && !trap[0])
+        if (!backgnd && (flags & EV_EXIT) && !may_have_traps)
                 goto nofork;
         INT_OFF;
         jp = makejob(/*n,*/ 1);
@@ -8832,10 +8843,11 @@ evalsubshell(union node *n, int flags)
                 ash_msg_and_raise_error("unable to spawn shell");
 #endif
         if (forkshell(jp, n, backgnd) == 0) {
+                /* child */
                 INT_ON;
                 flags |= EV_EXIT;
                 if (backgnd)
-                        flags &=~ EV_TESTED;
+                        flags &= ~EV_TESTED;
  nofork:
                 redirect(n->nredir.redirect, 0);
                 evaltreenr(n->nredir.n, flags);
@@ -9365,7 +9377,9 @@ static const struct builtincmd builtintab[] = {
         { BUILTIN_SPEC_REG      "return"  , returncmd  },
         { BUILTIN_SPEC_REG      "set"     , setcmd     },
         { BUILTIN_SPEC_REG      "shift"   , shiftcmd   },
+#if ENABLE_ASH_BASH_COMPAT
         { BUILTIN_SPEC_REG      "source"  , dotcmd     },
+#endif
 #if ENABLE_ASH_BUILTIN_TEST
         { BUILTIN_REGULAR       "test"    , testcmd    },
 #endif
@@ -9646,16 +9660,19 @@ evalcommand(union node *cmd, int flags)
                 /* goes through to shellexec() */
 #endif
                 /* Fork off a child process if necessary. */
-                if (!(flags & EV_EXIT) || trap[0]) {
+                if (!(flags & EV_EXIT) || may_have_traps) {
                         INT_OFF;
                         jp = makejob(/*cmd,*/ 1);
                         if (forkshell(jp, cmd, FORK_FG) != 0) {
+                                /* parent */
                                 exitstatus = waitforjob(jp);
                                 INT_ON;
                                 TRACE(("forked child exited with %d\n", exitstatus));
                                 break;
                         }
+                        /* child */
                         FORCE_INT_ON;
+                        /* fall through to exec'ing external program */
                 }
                 listsetvar(varlist.list, VEXPORT|VSTACK);
                 shellexec(argv, path, cmdentry.u.index);
@@ -9900,12 +9917,12 @@ preadfd(void)
 #if ENABLE_FEATURE_EDITING
  retry:
         if (!iflag || g_parsefile->fd != STDIN_FILENO)
-                nr = nonblock_safe_read(g_parsefile->fd, buf, BUFSIZ - 1);
+                nr = nonblock_safe_read(g_parsefile->fd, buf, IBUFSIZ - 1);
         else {
 #if ENABLE_FEATURE_TAB_COMPLETION
                 line_input_state->path_lookup = pathval();
 #endif
-                nr = read_line_input(cmdedit_prompt, buf, BUFSIZ, line_input_state);
+                nr = read_line_input(cmdedit_prompt, buf, IBUFSIZ, line_input_state);
                 if (nr == 0) {
                         /* Ctrl+C pressed */
                         if (trap[SIGINT]) {
@@ -9922,7 +9939,7 @@ preadfd(void)
                 }
         }
 #else
-        nr = nonblock_safe_read(g_parsefile->fd, buf, BUFSIZ - 1);
+        nr = nonblock_safe_read(g_parsefile->fd, buf, IBUFSIZ - 1);
 #endif
 
 #if 0
@@ -12484,36 +12501,43 @@ find_dot_file(char *name)
 static int FAST_FUNC
 dotcmd(int argc, char **argv)
 {
+        char *fullname;
         struct strlist *sp;
         volatile struct shparam saveparam;
-        int status = 0;
 
         for (sp = cmdenviron; sp; sp = sp->next)
                 setvareq(ckstrdup(sp->text), VSTRFIXED | VTEXTFIXED);
 
-        if (argv[1]) {        /* That's what SVR2 does */
-                char *fullname = find_dot_file(argv[1]);
-                argv += 2;
-                argc -= 2;
-                if (argc) { /* argc > 0, argv[0] != NULL */
-                        saveparam = shellparam;
-                        shellparam.malloced = 0;
-                        shellparam.nparam = argc;
-                        shellparam.p = argv;
-                };
-
-                setinputfile(fullname, INPUT_PUSH_FILE);
-                commandname = fullname;
-                cmdloop(0);
-                popfile();
-
-                if (argc) {
-                        freeparam(&shellparam);
-                        shellparam = saveparam;
-                };
-                status = exitstatus;
+        if (!argv[1]) {
+                /* bash says: "bash: .: filename argument required" */
+                return 2; /* bash compat */
         }
-        return status;
+
+        /* "false; . empty_file; echo $?" should print 0, not 1: */
+        exitstatus = 0;
+
+        fullname = find_dot_file(argv[1]);
+
+        argv += 2;
+        argc -= 2;
+        if (argc) { /* argc > 0, argv[0] != NULL */
+                saveparam = shellparam;
+                shellparam.malloced = 0;
+                shellparam.nparam = argc;
+                shellparam.p = argv;
+        };
+
+        setinputfile(fullname, INPUT_PUSH_FILE);
+        commandname = fullname;
+        cmdloop(0);
+        popfile();
+
+        if (argc) {
+                freeparam(&shellparam);
+                shellparam = saveparam;
+        };
+
+        return exitstatus;
 }
 
 static int FAST_FUNC
@@ -12824,6 +12848,8 @@ trapcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                                 action = ckstrdup(action);
                 }
                 free(trap[signo]);
+                if (action)
+                        may_have_traps = 1;
                 trap[signo] = action;
                 if (signo != 0)
                         setsignal(signo);
@@ -13219,7 +13245,8 @@ static void
 init(void)
 {
         /* from input.c: */
-        basepf.next_to_pgetc = basepf.buf = basebuf;
+        /* we will never free this */
+        basepf.next_to_pgetc = basepf.buf = ckmalloc(IBUFSIZ);
 
         /* from trap.c: */
         signal(SIGCHLD, SIG_DFL);
diff --git a/shell/ash_test/ash-misc/source2.right b/shell/ash_test/ash-misc/source2.right
new file mode 100644
index 000000000..ce7171c87
--- /dev/null
+++ b/shell/ash_test/ash-misc/source2.right
@@ -0,0 +1 @@
+Done: 0
diff --git a/shell/ash_test/ash-misc/source2.tests b/shell/ash_test/ash-misc/source2.tests
new file mode 100755
index 000000000..1870cdf7e
--- /dev/null
+++ b/shell/ash_test/ash-misc/source2.tests
@@ -0,0 +1,3 @@
+false
+. /dev/null
+echo Done: $?
diff --git a/shell/ash_test/ash-redir/redir3.tests b/shell/ash_test/ash-redir/redir3.tests
index f50a7674c..e37d5e45a 100755
--- a/shell/ash_test/ash-redir/redir3.tests
+++ b/shell/ash_test/ash-redir/redir3.tests
@@ -1,4 +1,4 @@
-# redirects to closed descriptors should not leave these descriptors"
+# redirects to closed descriptors should not leave these descriptors
 # open afterwards
 echo TEST 9>/dev/null
 echo MUST ERROR OUT >&9
diff --git a/shell/ash_test/ash-redir/redir7.tests b/shell/ash_test/ash-redir/redir7.tests
index 17d1040e0..ca3979a81 100755
--- a/shell/ash_test/ash-redir/redir7.tests
+++ b/shell/ash_test/ash-redir/redir7.tests
@@ -7,6 +7,6 @@
 echo -e 'echo Ok >uni\x81code' >>unicode.sh
 echo -e 'cat uni\x81code' >>unicode.sh
 echo -e 'cat uni?code' >>unicode.sh
-. unicode.sh
+. ./unicode.sh
 rm uni*code*
 echo Done
diff --git a/shell/ash_test/ash-redir/redir8.tests b/shell/ash_test/ash-redir/redir8.tests
index 32ab607b8..8cb42c0d3 100755
--- a/shell/ash_test/ash-redir/redir8.tests
+++ b/shell/ash_test/ash-redir/redir8.tests
@@ -10,6 +10,6 @@ echo -e 'v=uni\x81code' >>unicode.sh
 echo -e 'echo Ok >"$v"' >>unicode.sh
 echo -e 'cat uni\x81code' >>unicode.sh
 echo -e 'cat uni?code' >>unicode.sh
-. unicode.sh
+. ./unicode.sh
 rm uni*code*
 echo Done
diff --git a/shell/ash_test/ash-signals/signal5.right b/shell/ash_test/ash-signals/signal5.right
new file mode 100644
index 000000000..162f56bbc
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal5.right
@@ -0,0 +1,12 @@
+sleeping for 3 sec
+sleeping for 2 sec
+Waiting
+2 sec passed, sending USR1 to parent
+USR1 received
+Wait exit code: 138
+Waiting
+3 sec passed, sending USR1 to parent
+USR1 received
+Wait exit code: 138
+Waiting
+Wait returned 0
diff --git a/shell/ash_test/ash-signals/signal5.tests b/shell/ash_test/ash-signals/signal5.tests
new file mode 100755
index 000000000..371120e95
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal5.tests
@@ -0,0 +1,14 @@
+trap "echo USR1 received" USR1
+stub() {
+    echo "sleeping for $1 sec"
+    sleep $1
+    echo "$1 sec passed, sending USR1 to parent"
+    kill -USR1 $$
+}
+stub 3 &
+stub 2 &
+sleep 1
+until { echo "Waiting"; wait; } do
+    echo "Wait exit code: $?"
+done
+echo "Wait returned 0"
diff --git a/shell/ash_test/ash-signals/signal6.right b/shell/ash_test/ash-signals/signal6.right
new file mode 100644
index 000000000..df4d9306a
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal6.right
@@ -0,0 +1,2 @@
+got TERM
+Done: 0
diff --git a/shell/ash_test/ash-signals/signal6.tests b/shell/ash_test/ash-signals/signal6.tests
new file mode 100755
index 000000000..3ce151060
--- /dev/null
+++ b/shell/ash_test/ash-signals/signal6.tests
@@ -0,0 +1,2 @@
+{ trap "echo got TERM" TERM; sleep 3; }& sleep 1; kill $!; wait
+echo Done: $?
diff --git a/shell/ash_test/ash-vars/var_leak.right b/shell/ash_test/ash-vars/var_leak.right
index 45c5458dd..be78112c8 100644
--- a/shell/ash_test/ash-vars/var_leak.right
+++ b/shell/ash_test/ash-vars/var_leak.right
@@ -1,2 +1,3 @@
 should be empty: ''
-should be empty: ''
+should be not empty: 'val2'
+should be not empty: 'val3'
diff --git a/shell/ash_test/ash-vars/var_leak.tests b/shell/ash_test/ash-vars/var_leak.tests
index 1b1123fb7..032059295 100755
--- a/shell/ash_test/ash-vars/var_leak.tests
+++ b/shell/ash_test/ash-vars/var_leak.tests
@@ -1,9 +1,18 @@
-# This currently fails with CONFIG_FEATURE_SH_NOFORK=y
+# true is a regular builtin, varibale should not leak out of it
+# this currently fails with CONFIG_FEATURE_SH_NOFORK=y
 VAR=''
-VAR=qwe true
+VAR=val1 true
 echo "should be empty: '$VAR'"
 
-# This fails (always)
+# ash follows the "special builtin leaks variables" rule here:
+# exec is a special builtin. (bash does not do it)
 VAR=''
-VAR=qwe exec 2>&1
-echo "should be empty: '$VAR'"
+VAR=val2 exec 2>&1
+echo "should be not empty: '$VAR'"
+
+# ash follows the "function call is a special builtin" rule here
+# (bash does not do it)
+f() { true; }
+VAR=''
+VAR=val3 f
+echo "should be not empty: '$VAR'"
diff --git a/shell/cttyhack.c b/shell/cttyhack.c
index 572a3af03..bde2acdc9 100644
--- a/shell/cttyhack.c
+++ b/shell/cttyhack.c
@@ -53,23 +53,32 @@ int cttyhack_main(int argc UNUSED_PARAM, char **argv)
         }
 
         strcpy(console, "/dev/tty");
-        if (ioctl(0, TIOCGSERIAL, &u.sr) == 0) {
-                /* this is a serial console */
-                sprintf(console + 8, "S%d", u.sr.line);
-        } else if (ioctl(0, VT_GETSTATE, &u.vt) == 0) {
-                /* this is linux virtual tty */
-                sprintf(console + 8, "S%d" + 1, u.vt.v_active);
-        }
-
-        if (console[8]) {
-                fd = xopen(console, O_RDWR);
-                //bb_error_msg("switching to '%s'", console);
-                dup2(fd, 0);
-                dup2(fd, 1);
-                dup2(fd, 2);
-                while (fd > 2) close(fd--);
-                /* Some other session may have it as ctty. Steal it from them */
-                ioctl(0, TIOCSCTTY, 1);
+        fd = open(console, O_RDWR);
+        if (fd >= 0) {
+                /* We already have ctty, nothing to do */
+                close(fd);
+        } else {
+                /* We don't have ctty (or don't have "/dev/tty" node...) */
+                if (ioctl(0, TIOCGSERIAL, &u.sr) == 0) {
+                        /* this is a serial console */
+                        sprintf(console + 8, "S%d", u.sr.line);
+                } else if (ioctl(0, VT_GETSTATE, &u.vt) == 0) {
+                        /* this is linux virtual tty */
+                        sprintf(console + 8, "S%d" + 1, u.vt.v_active);
+                }
+                if (console[8]) {
+                        fd = xopen(console, O_RDWR);
+                        //bb_error_msg("switching to '%s'", console);
+                        dup2(fd, 0);
+                        dup2(fd, 1);
+                        dup2(fd, 2);
+                        while (fd > 2)
+                                close(fd--);
+                        /* Some other session may have it as ctty,
+                         * steal it from them:
+                         */
+                        ioctl(0, TIOCSCTTY, 1);
+                }
         }
 
         BB_EXECVP(argv[0], argv);
diff --git a/shell/hush.c b/shell/hush.c
index 9b15efb30..8baccf246 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -39,25 +39,28 @@
  *
  * POSIX syntax not implemented:
  *      aliases
- *      <(list) and >(list) Process Substitution
  *      Tilde Expansion
  *
- * Bash stuff (optionally enabled):
- *      &> and >& redirection of stdout+stderr
- *      Brace Expansion
- *      reserved words: [[ ]] function select
- *      substrings ${var:1:5}
+ * Bash compat TODO:
+ *      redirection of stdout+stderr: &> and >&
+ *      brace expansion: one/{two,three,four}
+ *      reserved words: function select
+ *      advanced test: [[ ]]
+ *      substrings: ${var:1:5}
+ *      process substitution: <(list) and >(list)
+ *      =~: regex operator
  *      let EXPR [EXPR...]
  *        Each EXPR is an arithmetic expression (ARITHMETIC EVALUATION)
  *        If the last arg evaluates to 0, let returns 1; 0 otherwise.
  *        NB: let `echo 'a=a + 1'` - error (IOW: multi-word expansion is used)
  *      ((EXPR))
  *        The EXPR is evaluated according to ARITHMETIC EVALUATION.
- *        This is exactly equivalent to let "expression".
+ *        This is exactly equivalent to let "EXPR".
+ *      $[EXPR]: synonym for $((EXPR))
  *
  * TODOs:
  *      grep for "TODO" and fix (some of them are easy)
- *      special variables (done: PWD)
+ *      special variables (done: PWD, PPID, RANDOM)
  *      follow IFS rules more precisely, including update semantics
  *      export builtin should be special, its arguments are assignments
  *          and therefore expansion of them should be "one-word" expansion:
@@ -673,6 +676,9 @@ static const struct built_in_command bltins1[] = {
 #endif
         BLTIN("set"      , builtin_set     , "Set/unset positional parameters"),
         BLTIN("shift"    , builtin_shift   , "Shift positional parameters"),
+#if ENABLE_HUSH_BASH_COMPAT
+        BLTIN("source"   , builtin_source  , "Run commands in a file"),
+#endif
         BLTIN("trap"     , builtin_trap    , "Trap signals"),
         BLTIN("type"     , builtin_type    , "Show command type"),
         BLTIN("ulimit"   , shell_builtin_ulimit  , "Control resource limits"),
@@ -6232,10 +6238,15 @@ static struct pipe *parse_stream(char **pstring,
                 is_special = "{}<>;&|()#'" /* special outside of "str" */
                                 "\\$\"" IF_HUSH_TICK("`"); /* always special */
                 /* Are { and } special here? */
-                if (ctx.command->argv /* word [word]{... */
-                 || dest.length /* word{... */
-                 || dest.o_quoted /* ""{... */
-                 || (next != ';' && next != ')' && !strchr(G.ifs, next)) /* {word */
+                if (ctx.command->argv /* word [word]{... - non-special */
+                 || dest.length       /* word{... - non-special */
+                 || dest.o_quoted     /* ""{... - non-special */
+                 || (next != ';'            /* }; - special */
+                    && next != ')'          /* }) - special */
+                    && next != '&'          /* }& and }&& ... - special */
+                    && next != '|'          /* }|| ... - special */
+                    && !strchr(G.ifs, next) /* {word - non-special */
+                    )
                 ) {
                         /* They are not special, skip "{}" */
                         is_special += 2;
@@ -7859,21 +7870,26 @@ static int FAST_FUNC builtin_shift(char **argv)
 
 static int FAST_FUNC builtin_source(char **argv)
 {
-        char *arg_path;
+        char *arg_path, *filename;
         FILE *input;
         save_arg_t sv;
 #if ENABLE_HUSH_FUNCTIONS
         smallint sv_flg;
 #endif
 
-        if (*++argv == NULL)
-                return EXIT_FAILURE;
-
-        if (strchr(*argv, '/') == NULL && (arg_path = find_in_path(*argv)) != NULL) {
-                input = fopen_for_read(arg_path);
-                free(arg_path);
-        } else
-                input = fopen_or_warn(*argv, "r");
+        arg_path = NULL;
+        filename = *++argv;
+        if (!filename) {
+                /* bash says: "bash: .: filename argument required" */
+                return 2; /* bash compat */
+        }
+        if (!strchr(filename, '/')) {
+                arg_path = find_in_path(filename);
+                if (arg_path)
+                        filename = arg_path;
+        }
+        input = fopen_or_warn(filename, "r");
+        free(arg_path);
         if (!input) {
                 /* bb_perror_msg("%s", *argv); - done by fopen_or_warn */
                 return EXIT_FAILURE;
diff --git a/shell/hush_test/hush-parsing/group2.right b/shell/hush_test/hush-parsing/group2.right
new file mode 100644
index 000000000..df4d9306a
--- /dev/null
+++ b/shell/hush_test/hush-parsing/group2.right
@@ -0,0 +1,2 @@
+got TERM
+Done: 0
diff --git a/shell/hush_test/hush-parsing/group2.tests b/shell/hush_test/hush-parsing/group2.tests
new file mode 100755
index 000000000..d99178585
--- /dev/null
+++ b/shell/hush_test/hush-parsing/group2.tests
@@ -0,0 +1,3 @@
+# Bug was in handling of "}&" without space
+{ trap "echo got TERM" TERM; sleep 2; }& sleep 1; kill $!; wait
+echo Done: $?