hush: fix two nasty bugs:

hush-bugs/tick2.tests: ok
hush-bugs/tick.tests: ok

function                                             old     new   delta
parse_stream                                        1332    1557    +225
b_addptr                                               -      97     +97
add_till_backquote                                     -      82     +82
b_addstr                                               -      58     +58
b_grow_by                                              -      50     +50
setup_string_in_str                                    -      29     +29
expand_variables                                    1196    1199      +3
expand_on_ifs                                        100      97      -3
b_addqchr                                             57      50      -7
parse_and_run_string                                  48      31     -17
lookup_param                                          27       -     -27
b_addchr                                              75      45     -30
count_ifs                                             44       -     -44
process_command_subs                                 222       -    -222
------------------------------------------------------------------------------
(add/remove: 5/3 grow/shrink: 2/4 up/down: 544/-350)          Total: 194 bytes
   text    data     bss     dec     hex filename
 759354     604    6684  766642   bb2b2 busybox_old
 759534     604    6684  766822   bb366 busybox_unstripped

1 files changed, 297 insertions, 190 deletions

diff --git a/shell/hush.c b/shell/hush.c
index d7b9c39ec..58100d4d1 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -341,8 +341,9 @@ typedef struct {
         int maxlen;
         smallint o_quote;
         smallint nonnull;
+        smallint has_empty_slot;
 } o_string;
-#define NULL_O_STRING {NULL,0,0,0,0}
+#define NULL_O_STRING { NULL }
 /* used for initialization: o_string foo = NULL_O_STRING; */
 
 /* I can almost use ordinary FILE *.  Is open_memstream() universally
@@ -464,8 +465,6 @@ enum { run_list_level = 0 };
 } while (0)
 
 
-#define B_CHUNK  100
-#define B_NOSPAC 1
 #define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
 
 #if 1
@@ -494,11 +493,6 @@ static void syntax_lineno(int line)
 #endif
 
 /* Index of subroutines: */
-/*   o_string manipulation: */
-static int b_check_space(o_string *o, int len);
-static int b_addchr(o_string *o, int ch);
-static void b_reset(o_string *o);
-static int b_addqchr(o_string *o, int ch, int quote);
 /*  in_str manipulations: */
 static int static_get(struct in_str *i);
 static int static_peek(struct in_str *i);
@@ -1176,57 +1170,143 @@ static int builtin_unset(char **argv)
 //      return EXIT_FAILURE;
 //}
 
-static int b_check_space(o_string *o, int len)
+/*
+ * o_string support
+ */
+#define B_CHUNK  (32 * sizeof(char*))
+
+static void b_reset(o_string *o)
+{
+        o->length = 0;
+        o->nonnull = 0;
+        if (o->data)
+                o->data[0] = '\0';
+}
+
+static void b_free(o_string *o)
+{
+        free(o->data);
+        memset(o, 0, sizeof(*o));
+}
+
+static void b_grow_by(o_string *o, int len)
 {
-        /* It would be easy to drop a more restrictive policy
-         * in here, such as setting a maximum string length */
         if (o->length + len > o->maxlen) {
-                /* assert(data == NULL || o->maxlen != 0); */
                 o->maxlen += (2*len > B_CHUNK ? 2*len : B_CHUNK);
                 o->data = xrealloc(o->data, 1 + o->maxlen);
         }
-        return o->data == NULL;
 }
 
-static int b_addchr(o_string *o, int ch)
+static void b_addchr(o_string *o, int ch)
 {
         debug_printf("b_addchr: '%c' o->length=%d o=%p\n", ch, o->length, o);
-        if (b_check_space(o, 1))
-                return B_NOSPAC;
+        b_grow_by(o, 1);
         o->data[o->length] = ch;
         o->length++;
         o->data[o->length] = '\0';
-        return 0;
-}
-
-static void b_reset(o_string *o)
-{
-        o->length = 0;
-        o->nonnull = 0;
-        if (o->data)
-                o->data[0] = '\0';
 }
 
-static void b_free(o_string *o)
+static void b_addstr(o_string *o, const char *str, int len)
 {
-        free(o->data);
-        memset(o, 0, sizeof(*o));
+        b_grow_by(o, len);
+        memcpy(&o->data[o->length], str, len);
+        o->length += len;
+        o->data[o->length] = '\0';
 }
 
 /* My analysis of quoting semantics tells me that state information
  * is associated with a destination, not a source.
  */
-static int b_addqchr(o_string *o, int ch, int quote)
+static void b_addqchr(o_string *o, int ch, int quote)
 {
         if (quote && strchr("*?[\\", ch)) {
-                int rc;
-                rc = b_addchr(o, '\\');
-                if (rc)
-                        return rc;
+                b_addchr(o, '\\');
+        }
+        b_addchr(o, ch);
+}
+
+/* A special kind of o_string for $VAR and `cmd` expansion.
+ * It contains char* list[] at the beginning, which is grown in 16 element
+ * increments. Actual string data starts at the next multiple of 16.
+ * list[i] contains an INDEX (int!) into this string data.
+ * It means that if list[] needs to grow, data needs to be moved higher up
+ * but list[i]'s need not be modified.
+ * NB: remembering how many list[i]'s you have there is crucial.
+ * b_finalize_list() operation post-processes this structure - calculates
+ * and stores actual char* ptrs in list[]. Oh, it NULL terminates it as well.
+ */
+static int b_addptr(o_string *o, int n)
+{
+        char **list = (char**)o->data;
+        int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
+        int string_len = o->length - string_start;
+
+        if (!o->has_empty_slot) {
+                if (!(n & 0xf)) { /* 0, 0x10, 0x20...? */
+                        /* list[n] points to string_start, make space for 16 more pointers */
+                        o->maxlen += 0x10 * sizeof(list[0]);
+                        o->data = xrealloc(o->data, o->maxlen + 1);
+                        list = (char**)o->data;
+                        memmove(list + n + 0x10, list + n, string_len);
+                        o->length += 0x10 * sizeof(list[0]);
+                }
+        } else {
+                /* We have empty slot at list[n], reuse without growth */
+                o->has_empty_slot = 0;
+        }
+        list[n] = (char*)string_len;
+        return n + 1;
+}
+
+static int b_get_last_ptr(o_string *o, int n)
+{
+        char **list = (char**)o->data;
+        int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
+
+        return ((int)list[n-1]) + string_start;
+}
+
+static char **b_finalize_list(o_string *o, int n)
+{
+        char **list = (char**)o->data;
+        int string_start;
+
+        b_addptr(o, n); /* force growth for list[n] if necessary */
+        string_start = ((n+1 + 0xf) & ~0xf) * sizeof(list[0]);
+        list[n] = NULL;
+        while (n) {
+                n--;
+                list[n] = o->data + (int)list[n] + string_start;
+        }
+        return list;
+}
+
+#ifdef DEBUG_EXPAND
+static void b_debug_list(const char *prefix, o_string *o, int n)
+{
+        char **list = (char**)o->data;
+        int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
+        int i = 0;
+        fprintf(stderr, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d\n",
+                        prefix, list, n, string_start, o->length, o->maxlen);
+        while (i < n) {
+                fprintf(stderr, " list[%d]=%d '%s'\n", i, (int)list[i],
+                                o->data + (int)list[i] + string_start);
+                i++;
+        }
+        if (n) {
+                const char *p = o->data + (int)list[n] + string_start;
+                fprintf(stderr, " total_sz:%d\n", (p + strlen(p) + 1) - o->data);
         }
-        return b_addchr(o, ch);
 }
+#else
+#define b_debug_list(prefix, o, n) ((void)0)
+#endif
+
 
+/*
+ * in_str support
+ */
 static int static_get(struct in_str *i)
 {
         int ch = *i->p++;
@@ -2461,106 +2541,25 @@ static int xglob(o_string *dest, char ***pglob)
  * followed by strings themself.
  * Caller can deallocate entire list by single free(list). */
 
-/* Helpers first:
- * count_XXX estimates size of the block we need. It's okay
- * to over-estimate sizes a bit, if it makes code simpler */
-static int count_ifs(const char *str)
-{
-        int cnt = 0;
-        debug_printf_expand("count_ifs('%s') ifs='%s'", str, ifs);
-        while (1) {
-                str += strcspn(str, ifs);
-                if (!*str) break;
-                str++; /* str += strspn(str, ifs); */
-                cnt++; /* cnt += strspn(str, ifs); - but this code is larger */
-        }
-        debug_printf_expand(" return %d\n", cnt);
-        return cnt;
-}
-
-static void count_var_expansion_space(int *countp, int *lenp, char *arg)
-{
-        char first_ch;
-        int i;
-        int len = *lenp;
-        int count = *countp;
-        const char *val;
-        char *p;
-
-        while ((p = strchr(arg, SPECIAL_VAR_SYMBOL))) {
-                len += p - arg;
-                arg = ++p;
-                p = strchr(p, SPECIAL_VAR_SYMBOL);
-                first_ch = arg[0];
-
-                switch (first_ch & 0x7f) {
-                /* high bit in 1st_ch indicates that var is double-quoted */
-                case '$': /* pid */
-                case '!': /* bg pid */
-                case '?': /* exitcode */
-                case '#': /* argc */
-                        len += sizeof(int)*3 + 1; /* enough for int */
-                        break;
-                case '*':
-                case '@':
-                        for (i = 1; global_argv[i]; i++) {
-                                len += strlen(global_argv[i]) + 1;
-                                count++;
-                                if (!(first_ch & 0x80))
-                                        count += count_ifs(global_argv[i]);
-                        }
-                        break;
-                default:
-                        *p = '\0';
-                        arg[0] = first_ch & 0x7f;
-                        if (isdigit(arg[0])) {
-                                i = xatoi_u(arg);
-                                val = NULL;
-                                if (i < global_argc)
-                                        val = global_argv[i];
-                        } else
-                                val = lookup_param(arg);
-                        arg[0] = first_ch;
-                        *p = SPECIAL_VAR_SYMBOL;
-
-                        if (val) {
-                                len += strlen(val) + 1;
-                                if (!(first_ch & 0x80))
-                                        count += count_ifs(val);
-                        }
-                }
-                arg = ++p;
-        }
-
-        len += strlen(arg) + 1;
-        count++;
-        *lenp = len;
-        *countp = count;
-}
-
 /* Store given string, finalizing the word and starting new one whenever
  * we encounter ifs char(s). This is used for expanding variable values.
  * End-of-string does NOT finalize word: think about 'echo -$VAR-' */
-static int expand_on_ifs(char **list, int n, char **posp, const char *str)
+static int expand_on_ifs(o_string *output, int n, const char *str)
 {
-        char *pos = *posp;
         while (1) {
                 int word_len = strcspn(str, ifs);
                 if (word_len) {
-                        memcpy(pos, str, word_len); /* store non-ifs chars */
-                        pos += word_len;
+                        b_addstr(output, str, word_len); /* store non-ifs chars */
                         str += word_len;
                 }
                 if (!*str)  /* EOL - do not finalize word */
                         break;
-                *pos++ = '\0';
-                if (n) debug_printf_expand("expand_on_ifs finalized list[%d]=%p '%s' "
-                        "strlen=%d next=%p pos=%p\n", n-1, list[n-1], list[n-1],
-                        strlen(list[n-1]), list[n-1] + strlen(list[n-1]) + 1, pos);
-                list[n++] = pos;
+                b_addchr(output, '\0');
+                b_debug_list("expand_on_ifs", output, n);
+                n = b_addptr(output, n);
                 str += strspn(str, ifs); /* skip ifs chars */
         }
-        *posp = pos;
+        b_debug_list("expand_on_ifs[1]", output, n);
         return n;
 }
 
@@ -2571,7 +2570,7 @@ static int expand_on_ifs(char **list, int n, char **posp, const char *str)
  * 'echo -$*-'. If you play here, you must run testsuite afterwards! */
 /* NB: another bug is that we cannot detect empty strings yet:
  * "" or $empty"" expands to zero words, has to expand to empty word */
-static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char or_mask)
+static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
 {
         /* or_mask is either 0 (normal case) or 0x80
          * (expansion of right-hand side of assignment == 1-element expand) */
@@ -2580,18 +2579,19 @@ static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char
         int i;
         const char *val;
         char *p;
-        char *pos = *posp;
 
         ored_ch = 0;
 
-        if (n) debug_printf_expand("expand_vars_to_list finalized list[%d]=%p '%s' "
-                "strlen=%d next=%p pos=%p\n", n-1, list[n-1], list[n-1],
-                strlen(list[n-1]), list[n-1] + strlen(list[n-1]) + 1, pos);
-        list[n++] = pos;
+        debug_printf_expand("expand_vars_to_list: arg '%s'\n", arg);
+        b_debug_list("expand_vars_to_list", output, n);
+        n = b_addptr(output, n);
+        b_debug_list("expand_vars_to_list[0]", output, n);
+
+        while ((p = strchr(arg, SPECIAL_VAR_SYMBOL)) != NULL) {
+                o_string subst_result = NULL_O_STRING;
 
-        while ((p = strchr(arg, SPECIAL_VAR_SYMBOL))) {
-                memcpy(pos, arg, p - arg);
-                pos += (p - arg);
+                b_addstr(output, arg, p - arg);
+                b_debug_list("expand_vars_to_list[1]", output, n);
                 arg = ++p;
                 p = strchr(p, SPECIAL_VAR_SYMBOL);
 
@@ -2620,16 +2620,15 @@ static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char
                                 break;
                         if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
                                 while (global_argv[i]) {
-                                        n = expand_on_ifs(list, n, &pos, global_argv[i]);
+                                        n = expand_on_ifs(output, n, global_argv[i]);
                                         debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, global_argc-1);
                                         if (global_argv[i++][0] && global_argv[i]) {
                                                 /* this argv[] is not empty and not last:
                                                  * put terminating NUL, start new word */
-                                                *pos++ = '\0';
-                                                if (n) debug_printf_expand("expand_vars_to_list 2 finalized list[%d]=%p '%s' "
-                                                        "strlen=%d next=%p pos=%p\n", n-1, list[n-1], list[n-1],
-                                                        strlen(list[n-1]), list[n-1] + strlen(list[n-1]) + 1, pos);
-                                                list[n++] = pos;
+                                                b_addchr(output, '\0');
+                                                b_debug_list("expand_vars_to_list[2]", output, n);
+                                                n = b_addptr(output, n);
+                                                b_debug_list("expand_vars_to_list[3]", output, n);
                                         }
                                 }
                         } else
@@ -2637,27 +2636,34 @@ static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char
                          * and in this case should treat it like '$*' - see 'else...' below */
                         if (first_ch == ('@'|0x80) && !or_mask) { /* quoted $@ */
                                 while (1) {
-                                        strcpy(pos, global_argv[i]);
-                                        pos += strlen(global_argv[i]);
+                                        b_addstr(output, global_argv[i], strlen(global_argv[i]));
                                         if (++i >= global_argc)
                                                 break;
-                                        *pos++ = '\0';
-                                        if (n) debug_printf_expand("expand_vars_to_list 3 finalized list[%d]=%p '%s' "
-                                                "strlen=%d next=%p pos=%p\n", n-1, list[n-1], list[n-1],
-                                                        strlen(list[n-1]), list[n-1] + strlen(list[n-1]) + 1, pos);
-                                        list[n++] = pos;
+                                        b_addchr(output, '\0');
+                                        b_debug_list("expand_vars_to_list[4]", output, n);
+                                        n = b_addptr(output, n);
                                 }
                         } else { /* quoted $*: add as one word */
                                 while (1) {
-                                        strcpy(pos, global_argv[i]);
-                                        pos += strlen(global_argv[i]);
+                                        b_addstr(output, global_argv[i], strlen(global_argv[i]));
                                         if (!global_argv[++i])
                                                 break;
                                         if (ifs[0])
-                                                *pos++ = ifs[0];
+                                                b_addchr(output, ifs[0]);
                                 }
                         }
                         break;
+                case '`': {
+                        struct in_str input;
+                        *p = '\0';
+                        arg++;
+                        //bb_error_msg("SUBST '%s' first_ch %x", arg, first_ch);
+                        setup_string_in_str(&input, arg);
+                        process_command_subs(&subst_result, &input, NULL);
+                        //bb_error_msg("RES '%s'", subst_result.data);
+                        val = subst_result.data;
+                        goto store_val;
+                }
                 default:
                         *p = '\0';
                         arg[0] = first_ch & 0x7f;
@@ -2669,66 +2675,52 @@ static int expand_vars_to_list(char **list, int n, char **posp, char *arg, char
                         } else
                                 val = lookup_param(arg);
                         arg[0] = first_ch;
+ store_val:
                         *p = SPECIAL_VAR_SYMBOL;
                         if (!(first_ch & 0x80)) { /* unquoted $VAR */
                                 if (val) {
-                                        n = expand_on_ifs(list, n, &pos, val);
+                                        n = expand_on_ifs(output, n, val);
                                         val = NULL;
                                 }
-                        } /* else: quoted $VAR, val will be appended at pos */
-                }
-                if (val) {
-                        strcpy(pos, val);
-                        pos += strlen(val);
+                        } /* else: quoted $VAR, val will be appended below */
                 }
+                if (val)
+                        b_addstr(output, val, strlen(val));
+
+                b_free(&subst_result);
                 arg = ++p;
-        }
-        debug_printf_expand("expand_vars_to_list adding tail '%s' at %p\n", arg, pos);
-        strcpy(pos, arg);
-        pos += strlen(arg) + 1;
-        if (pos == list[n-1] + 1) { /* expansion is empty */
+        } /* end of "while (SPECIAL_VAR_SYMBOL is found) ..." */
+
+        b_debug_list("expand_vars_to_list[a]", output, n);
+        b_addstr(output, arg, strlen(arg) + 1);
+        b_debug_list("expand_vars_to_list[b]", output, n);
+//TESTME
+        if (output->length - 1 == b_get_last_ptr(output, n)) { /* expansion is empty */
                 if (!(ored_ch & 0x80)) { /* all vars were not quoted... */
-                        debug_printf_expand("expand_vars_to_list list[%d] empty, going back\n", n);
-                        pos--;
                         n--;
+                        /* allow to reuse list[n] later without re-growth */
+                        output->has_empty_slot = 1;
                 }
         }
 
-        *posp = pos;
         return n;
 }
 
 static char **expand_variables(char **argv, char or_mask)
 {
         int n;
-        int count = 1;
-        int len = 0;
-        char *pos, **v, **list;
+        char **list;
+        char **v;
+        o_string output = NULL_O_STRING;
 
-        v = argv;
-        if (!*v) debug_printf_expand("count_var_expansion_space: "
-                        "argv[0]=NULL count=%d len=%d alloc_space=%d\n",
-                        count, len, sizeof(char*) * count + len);
-        while (*v) {
-                count_var_expansion_space(&count, &len, *v);
-                debug_printf_expand("count_var_expansion_space: "
-                        "'%s' count=%d len=%d alloc_space=%d\n",
-                        *v, count, len, sizeof(char*) * count + len);
-                v++;
-        }
-        len += sizeof(char*) * count; /* total to alloc */
-        list = xmalloc(len);
-        pos = (char*)(list + count);
-        debug_printf_expand("list=%p, list[0] should be %p\n", list, pos);
         n = 0;
         v = argv;
         while (*v)
-                n = expand_vars_to_list(list, n, &pos, *v++, or_mask);
+                n = expand_vars_to_list(&output, n, *v++, or_mask);
+        b_debug_list("expand_variables", &output, n);
 
-        if (n) debug_printf_expand("finalized list[%d]=%p '%s' "
-                "strlen=%d next=%p pos=%p\n", n-1, list[n-1], list[n-1],
-                strlen(list[n-1]), list[n-1] + strlen(list[n-1]) + 1, pos);
-        list[n] = NULL;
+        /* output.data (malloced) gets returned in "list" */
+        list = b_finalize_list(&output, n);
 
 #ifdef DEBUG_EXPAND
         {
@@ -2737,12 +2729,8 @@ static char **expand_variables(char **argv, char or_mask)
                         debug_printf_expand("list[%d]=%p '%s'\n", m, list[m], list[m]);
                         m++;
                 }
-                debug_printf_expand("used_space=%d\n", pos - (char*)list);
         }
 #endif
-        if (ENABLE_HUSH_DEBUG)
-                if (pos - (char*)list > len)
-                        bb_error_msg_and_die("BUG in varexp");
         return list;
 }
 
@@ -3391,6 +3379,116 @@ static const char *lookup_param(const char *src)
         return NULL;
 }
 
+#if ENABLE_HUSH_TICK
+/* Subroutines for copying $(...) and `...` things */
+static void add_till_backquote(o_string *dest, struct in_str *input);
+/* '...' */
+static void add_till_single_quote(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = b_getch(input);
+                if (ch == EOF)
+                        break;
+                if (ch == '\'')
+                        break;
+                b_addchr(dest, ch);
+        }
+}
+/* "...\"...`..`...." - do we need to handle "...$(..)..." too? */
+static void add_till_double_quote(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = b_getch(input);
+                if (ch == '"')
+                        break;
+                if (ch == '\\') {  /* \x. Copy both chars. */
+                        b_addchr(dest, ch);
+                        ch = b_getch(input);
+                }
+                if (ch == EOF)
+                        break;
+                b_addchr(dest, ch);
+                if (ch == '`') {
+                        add_till_backquote(dest, input);
+                        b_addchr(dest, ch);
+                        continue;
+                }
+//              if (ch == '$') ...
+        }
+}
+/* Process `cmd` - copy contents until "`" is seen. Complicated by
+ * \` quoting.
+ * "Within the backquoted style of command substitution, backslash
+ * shall retain its literal meaning, except when followed by: '$', '`', or '\'.
+ * The search for the matching backquote shall be satisfied by the first
+ * backquote found without a preceding backslash; during this search,
+ * if a non-escaped backquote is encountered within a shell comment,
+ * a here-document, an embedded command substitution of the $(command)
+ * form, or a quoted string, undefined results occur. A single-quoted
+ * or double-quoted string that begins, but does not end, within the
+ * "`...`" sequence produces undefined results."
+ * Example                               Output
+ * echo `echo '\'TEST\`echo ZZ\`BEST`    \TESTZZBEST
+ */
+static void add_till_backquote(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = b_getch(input);
+//bb_error_msg("ADD '%c'", ch);
+                if (ch == '`')
+                        break;
+                if (ch == '\\') {  /* \x. Copy both chars unless it is \` */
+                        int ch2 = b_getch(input);
+                        if (ch2 != '`' && ch2 != '$' && ch2 != '\\')
+                                b_addchr(dest, ch);
+                        ch = ch2;
+                }
+                if (ch == EOF)
+                        break;
+                b_addchr(dest, ch);
+        }
+}
+/* Process $(cmd) - copy contents until ")" is seen. Complicated by
+ * quoting and nested ()s.
+ * "With the $(command) style of command substitution, all characters
+ * following the open parenthesis to the matching closing parenthesis
+ * constitute the command. Any valid shell script can be used for command,
+ * except a script consisting solely of redirections which produces
+ * unspecified results."
+ * Example                              Output
+ * echo $(echo '(TEST)' BEST)           (TEST) BEST
+ * echo $(echo 'TEST)' BEST)            TEST) BEST
+ * echo $(echo \(\(TEST\) BEST)         ((TEST) BEST
+ */
+static void add_till_closing_curly_brace(o_string *dest, struct in_str *input)
+{
+        int count = 0;
+        while (1) {
+                int ch = b_getch(input);
+                if (ch == EOF)
+                        break;
+                if (ch == '(')
+                        count++;
+                if (ch == ')')
+                        if (--count < 0)
+                                break;
+                b_addchr(dest, ch);
+                if (ch == '\'') {
+                        add_till_single_quote(dest, input);
+                        b_addchr(dest, ch);
+                        continue;
+                }
+                if (ch == '"') {
+                        add_till_double_quote(dest, input);
+                        b_addchr(dest, ch);
+                        continue;
+                }
+        }
+}
+#endif /* ENABLE_HUSH_TICK */
+
+//FIXME: remove ctx and sp
+
 /* return code: 0 for OK, 1 for syntax error */
 static int handle_dollar(o_string *dest, /*struct p_context *ctx,*/ struct in_str *input)
 {
@@ -3450,7 +3548,10 @@ static int handle_dollar(o_string *dest, /*struct p_context *ctx,*/ struct in_st
 #if ENABLE_HUSH_TICK
                 case '(':
                         b_getch(input);
-                        process_command_subs(dest, /*ctx,*/ input, ")");
+                        b_addchr(dest, SPECIAL_VAR_SYMBOL);
+                        b_addchr(dest, quote_mask | '`');
+                        add_till_closing_curly_brace(dest, input);
+                        b_addchr(dest, SPECIAL_VAR_SYMBOL);
                         break;
 #endif
                 case '-':
@@ -3572,9 +3673,15 @@ static int parse_stream(o_string *dest, struct p_context *ctx,
                         dest->o_quote ^= 1; /* invert */
                         break;
 #if ENABLE_HUSH_TICK
-                case '`':
-                        process_command_subs(dest, /*ctx,*/ input, "`");
+                case '`': {
+                        //int pos = dest->length;
+                        b_addchr(dest, SPECIAL_VAR_SYMBOL);
+                        b_addchr(dest, dest->o_quote ? 0x80 | '`' : '`');
+                        add_till_backquote(dest, input);
+                        b_addchr(dest, SPECIAL_VAR_SYMBOL);
+                        //bb_error_msg("RES '%s'", dest->data + pos);
                         break;
+                }
 #endif
                 case '>':
                         redir_fd = redirect_opt_num(dest);