Merge branch 'busybox' into merge

30 files changed, 708 insertions, 384 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 62f750ca3..18e53a0da 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -409,7 +409,6 @@ struct globals_misc {
 #define EXERROR 1       /* a generic error */
 #define EXEXIT 4        /* exit the shell */
 
-        smallint isloginsh;
         char nullstr[1];        /* zero length string */
 
         char optlist[NOPTS];
@@ -484,7 +483,6 @@ extern struct globals_misc *const ash_ptr_to_globals_misc;
 #define pending_int       (G_misc.pending_int      )
 #define got_sigchld       (G_misc.got_sigchld      )
 #define pending_sig       (G_misc.pending_sig      )
-#define isloginsh   (G_misc.isloginsh  )
 #define nullstr     (G_misc.nullstr    )
 #define optlist     (G_misc.optlist    )
 #define sigmode     (G_misc.sigmode    )
@@ -2117,7 +2115,7 @@ struct redirtab;
 struct globals_var {
         struct shparam shellparam;      /* $@ current positional parameters */
         struct redirtab *redirlist;
-        int preverrout_fd;   /* save fd2 before print debug if xflag is set. */
+        int preverrout_fd;   /* stderr fd: usually 2, unless redirect moved it */
         struct var *vartab[VTABSIZE];
         struct var varinit[ARRAY_SIZE(varinit_data)];
 };
@@ -2596,8 +2594,20 @@ putprompt(const char *s)
 #endif
 
 /* expandstr() needs parsing machinery, so it is far away ahead... */
-static const char *expandstr(const char *ps);
+static const char *expandstr(const char *ps, int syntax_type);
+/* Values for syntax param */
+#define BASESYNTAX 0    /* not in quotes */
+#define DQSYNTAX   1    /* in double quotes */
+#define SQSYNTAX   2    /* in single quotes */
+#define ARISYNTAX  3    /* in arithmetic */
+#if ENABLE_ASH_EXPAND_PRMT
+# define PSSYNTAX  4    /* prompt. never passed to SIT() */
+#endif
+/* PSSYNTAX expansion is identical to DQSYNTAX, except keeping '\$' as '\$' */
 
+/*
+ * called by editline -- any expansions to the prompt should be added here.
+ */
 static void
 setprompt_if(smallint do_set, int whichprompt)
 {
@@ -2621,7 +2631,7 @@ setprompt_if(smallint do_set, int whichprompt)
         }
 #if ENABLE_ASH_EXPAND_PRMT
         pushstackmark(&smark, stackblocksize());
-        putprompt(expandstr(prompt));
+        putprompt(expandstr(prompt, PSSYNTAX));
         popstackmark(&smark);
 #else
         putprompt(prompt);
@@ -3047,13 +3057,6 @@ enum {
 /* c in SIT(c, syntax) must be an *unsigned char* or PEOA or PEOF,
  * caller must ensure proper cast on it if c is *char_ptr!
  */
-/* Values for syntax param */
-#define BASESYNTAX 0    /* not in quotes */
-#define DQSYNTAX   1    /* in double quotes */
-#define SQSYNTAX   2    /* in single quotes */
-#define ARISYNTAX  3    /* in arithmetic */
-#define PSSYNTAX   4    /* prompt. never passed to SIT() */
-
 #if USE_SIT_FUNCTION
 
 static int
@@ -4953,6 +4956,10 @@ cmdputs(const char *s)
                         /* These can only happen inside quotes */
                         cc[0] = c;
                         str = cc;
+//FIXME:
+// $ true $$ &
+// $ <cr>
+// [1]+  Done    true ${\$}   <<=== BUG: ${\$} is not a valid way to write $$ (${$} would be ok)
                         c = '\\';
                         break;
                 default:
@@ -5134,7 +5141,10 @@ cmdtxt(union node *n)
                 cmdputs(utoa(n->nfile.fd));
                 cmdputs(p);
                 if (n->type == NTOFD || n->type == NFROMFD) {
-                        cmdputs(utoa(n->ndup.dupfd));
+                        if (n->ndup.dupfd >= 0)
+                                cmdputs(utoa(n->ndup.dupfd));
+                        else
+                                cmdputs("-");
                         break;
                 }
                 n = n->nfile.fname;
@@ -5517,7 +5527,7 @@ stoppedjobs(void)
 #undef EMPTY
 #undef CLOSED
 #define EMPTY -2                /* marks an unused slot in redirtab */
-#define CLOSED -3               /* marks a slot of previously-closed fd */
+#define CLOSED -1               /* marks a slot of previously-closed fd */
 
 /*
  * Handle here documents.  Normally we fork off a process to write the
@@ -5713,73 +5723,182 @@ dup2_or_raise(int from, int to)
         }
         return newfd;
 }
+static int
+fcntl_F_DUPFD(int fd, int avoid_fd)
+{
+        int newfd;
+ repeat:
+        newfd = fcntl(fd, F_DUPFD, avoid_fd + 1);
+        if (newfd < 0) {
+                if (errno == EBUSY)
+                        goto repeat;
+                if (errno == EINTR)
+                        goto repeat;
+        }
+        return newfd;
+}
+static int
+xdup_CLOEXEC_and_close(int fd, int avoid_fd)
+{
+        int newfd;
+ repeat:
+        newfd = fcntl(fd, F_DUPFD, avoid_fd + 1);
+        if (newfd < 0) {
+                if (errno == EBUSY)
+                        goto repeat;
+                if (errno == EINTR)
+                        goto repeat;
+                /* fd was not open? */
+                if (errno == EBADF)
+                        return fd;
+                ash_msg_and_raise_perror("%d", newfd);
+        }
+        fcntl(newfd, F_SETFD, FD_CLOEXEC);
+        close(fd);
+        return newfd;
+}
 
 /* Struct def and variable are moved down to the first usage site */
-struct two_fd_t {
-        int orig, copy;
+struct squirrel {
+        int orig_fd;
+        int moved_to;
 };
 struct redirtab {
         struct redirtab *next;
         int pair_count;
-        struct two_fd_t two_fd[];
+        struct squirrel two_fd[];
 };
 #define redirlist (G_var.redirlist)
-enum {
-        COPYFD_RESTORE = (int)~(INT_MAX),
-};
 
-static int
-need_to_remember(struct redirtab *rp, int fd)
+static void
+add_squirrel_closed(struct redirtab *sq, int fd)
 {
         int i;
 
-        if (!rp) /* remembering was not requested */
-                return 0;
+        if (!sq)
+                return;
 
-        for (i = 0; i < rp->pair_count; i++) {
-                if (rp->two_fd[i].orig == fd) {
-                        /* already remembered */
-                        return 0;
+        for (i = 0; sq->two_fd[i].orig_fd != EMPTY; i++) {
+                /* If we collide with an already moved fd... */
+                if (fd == sq->two_fd[i].orig_fd) {
+                        /* Examples:
+                         * "echo 3>FILE 3>&- 3>FILE"
+                         * "echo 3>&- 3>FILE"
+                         * No need for last redirect to insert
+                         * another "need to close 3" indicator.
+                         */
+                        TRACE(("redirect_fd %d: already moved or closed\n", fd));
+                        return;
                 }
         }
-        return 1;
+        TRACE(("redirect_fd %d: previous fd was closed\n", fd));
+        sq->two_fd[i].orig_fd = fd;
+        sq->two_fd[i].moved_to = CLOSED;
 }
 
-/* "hidden" fd is a fd used to read scripts, or a copy of such */
 static int
-is_hidden_fd(struct redirtab *rp, int fd)
+save_fd_on_redirect(int fd, int avoid_fd, struct redirtab *sq)
 {
-        int i;
-        struct parsefile *pf;
+        int i, new_fd;
 
-        if (fd == -1)
+        if (avoid_fd < 9) /* the important case here is that it can be -1 */
+                avoid_fd = 9;
+
+#if JOBS
+        if (fd == ttyfd) {
+                /* Testcase: "ls -l /proc/$$/fd 10>&-" should work */
+                ttyfd = xdup_CLOEXEC_and_close(ttyfd, avoid_fd);
+                TRACE(("redirect_fd %d: matches ttyfd, moving it to %d\n", fd, ttyfd));
+                return 1; /* "we closed fd" */
+        }
+#endif
+        /* Are we called from redirect(0)? E.g. redirect
+         * in a forked child. No need to save fds,
+         * we aren't going to use them anymore, ok to trash.
+         */
+        if (!sq)
                 return 0;
-        /* Check open scripts' fds */
-        pf = g_parsefile;
-        while (pf) {
-                /* We skip pf_fd == 0 case because of the following case:
-                 * $ ash  # running ash interactively
-                 * $ . ./script.sh
-                 * and in script.sh: "exec 9>&0".
-                 * Even though top-level pf_fd _is_ 0,
-                 * it's still ok to use it: "read" builtin uses it,
-                 * why should we cripple "exec" builtin?
-                 */
-                if (pf->pf_fd > 0 && fd == pf->pf_fd) {
-                        return 1;
+
+        /* If this one of script's fds? */
+        if (fd != 0) {
+                struct parsefile *pf = g_parsefile;
+                while (pf) {
+                        /* We skip fd == 0 case because of the following:
+                         * $ ash  # running ash interactively
+                         * $ . ./script.sh
+                         * and in script.sh: "exec 9>&0".
+                         * Even though top-level pf_fd _is_ 0,
+                         * it's still ok to use it: "read" builtin uses it,
+                         * why should we cripple "exec" builtin?
+                         */
+                        if (fd == pf->pf_fd) {
+                                pf->pf_fd = xdup_CLOEXEC_and_close(fd, avoid_fd);
+                                return 1; /* "we closed fd" */
+                        }
+                        pf = pf->prev;
                 }
-                pf = pf->prev;
         }
 
-        if (!rp)
-                return 0;
-        /* Check saved fds of redirects */
-        fd |= COPYFD_RESTORE;
-        for (i = 0; i < rp->pair_count; i++) {
-                if (rp->two_fd[i].copy == fd) {
-                        return 1;
+        /* Check whether it collides with any open fds (e.g. stdio), save fds as needed */
+
+        /* First: do we collide with some already moved fds? */
+        for (i = 0; sq->two_fd[i].orig_fd != EMPTY; i++) {
+                /* If we collide with an already moved fd... */
+                if (fd == sq->two_fd[i].moved_to) {
+                        new_fd = fcntl_F_DUPFD(fd, avoid_fd);
+                        sq->two_fd[i].moved_to = new_fd;
+                        TRACE(("redirect_fd %d: already busy, moving to %d\n", fd, new_fd));
+                        if (new_fd < 0) /* what? */
+                                xfunc_die();
+                        return 0; /* "we did not close fd" */
+                }
+                if (fd == sq->two_fd[i].orig_fd) {
+                        /* Example: echo Hello >/dev/null 1>&2 */
+                        TRACE(("redirect_fd %d: already moved\n", fd));
+                        return 0; /* "we did not close fd" */
                 }
         }
+
+        /* If this fd is open, we move and remember it; if it's closed, new_fd = CLOSED (-1) */
+        new_fd = fcntl_F_DUPFD(fd, avoid_fd);
+        TRACE(("redirect_fd %d: previous fd is moved to %d (-1 if it was closed)\n", fd, new_fd));
+        if (new_fd < 0) {
+                if (errno != EBADF)
+                        xfunc_die();
+                /* new_fd = CLOSED; - already is -1 */
+        }
+        sq->two_fd[i].moved_to = new_fd;
+        sq->two_fd[i].orig_fd = fd;
+
+        /* if we move stderr, let "set -x" code know */
+        if (fd == preverrout_fd)
+                preverrout_fd = new_fd;
+
+        return 0; /* "we did not close fd" */
+}
+
+static int
+internally_opened_fd(int fd, struct redirtab *sq)
+{
+        int i;
+#if JOBS
+        if (fd == ttyfd)
+                return 1;
+#endif
+        /* If this one of script's fds? */
+        if (fd != 0) {
+                struct parsefile *pf = g_parsefile;
+                while (pf) {
+                        if (fd == pf->pf_fd)
+                                return 1;
+                        pf = pf->prev;
+                }
+        }
+
+        if (sq) for (i = 0; i < sq->pair_count && sq->two_fd[i].orig_fd != EMPTY; i++) {
+                if (fd == sq->two_fd[i].moved_to)
+                        return 1;
+        }
         return 0;
 }
 
@@ -5790,148 +5909,149 @@ is_hidden_fd(struct redirtab *rp, int fd)
  */
 /* flags passed to redirect */
 #define REDIR_PUSH    01        /* save previous values of file descriptors */
-#define REDIR_SAVEFD2 03        /* set preverrout */
 static void
 redirect(union node *redir, int flags)
 {
         struct redirtab *sv;
         int sv_pos;
-        int i;
-        int fd;
-        int newfd;
-        int copied_fd2 = -1;
 
-        if (!redir) {
+        if (!redir)
                 return;
-        }
 
-        sv = NULL;
         sv_pos = 0;
+        sv = NULL;
         INT_OFF;
-        if (flags & REDIR_PUSH) {
-                union node *tmp = redir;
-                do {
-                        sv_pos++;
-#if BASH_REDIR_OUTPUT
-                        if (tmp->nfile.type == NTO2)
-                                sv_pos++;
-#endif
-                        tmp = tmp->nfile.next;
-                } while (tmp);
-                sv = ckmalloc(sizeof(*sv) + sv_pos * sizeof(sv->two_fd[0]));
-                sv->next = redirlist;
-                sv->pair_count = sv_pos;
-                redirlist = sv;
-                while (sv_pos > 0) {
-                        sv_pos--;
-                        sv->two_fd[sv_pos].orig = sv->two_fd[sv_pos].copy = EMPTY;
-                }
-        }
-
+        if (flags & REDIR_PUSH)
+                sv = redirlist;
         do {
-                int right_fd = -1;
+                int fd;
+                int newfd;
+                int close_fd;
+                int closed;
+
                 fd = redir->nfile.fd;
                 if (redir->nfile.type == NTOFD || redir->nfile.type == NFROMFD) {
-                        right_fd = redir->ndup.dupfd;
-                        //bb_error_msg("doing %d > %d", fd, right_fd);
-                        /* redirect from/to same file descriptor? */
-                        if (right_fd == fd)
-                                continue;
-                        /* "echo >&10" and 10 is a fd opened to a sh script? */
-                        if (is_hidden_fd(sv, right_fd)) {
-                                errno = EBADF; /* as if it is closed */
-                                ash_msg_and_raise_perror("%d", right_fd);
-                        }
-                        newfd = -1;
+                        //bb_error_msg("doing %d > %d", fd, newfd);
+                        newfd = redir->ndup.dupfd;
+                        close_fd = -1;
                 } else {
                         newfd = openredirect(redir); /* always >= 0 */
                         if (fd == newfd) {
-                                /* Descriptor wasn't open before redirect.
-                                 * Mark it for close in the future */
-                                if (need_to_remember(sv, fd)) {
-                                        goto remember_to_close;
-                                }
+                                /* open() gave us precisely the fd we wanted.
+                                 * This means that this fd was not busy
+                                 * (not opened to anywhere).
+                                 * Remember to close it on restore:
+                                 */
+                                add_squirrel_closed(sv, fd);
                                 continue;
                         }
+                        close_fd = newfd;
                 }
-#if BASH_REDIR_OUTPUT
- redirect_more:
-#endif
-                if (need_to_remember(sv, fd)) {
-                        /* Copy old descriptor */
-                        /* Careful to not accidentally "save"
-                         * to the same fd as right side fd in N>&M */
-                        int minfd = right_fd < 10 ? 10 : right_fd + 1;
-#if defined(F_DUPFD_CLOEXEC)
-                        i = fcntl(fd, F_DUPFD_CLOEXEC, minfd);
-#else
-                        i = fcntl(fd, F_DUPFD, minfd);
-#endif
-                        if (i == -1) {
-                                i = errno;
-                                if (i != EBADF) {
-                                        /* Strange error (e.g. "too many files" EMFILE?) */
-                                        if (newfd >= 0)
-                                                close(newfd);
-                                        errno = i;
-                                        ash_msg_and_raise_perror("%d", fd);
-                                        /* NOTREACHED */
-                                }
-                                /* EBADF: it is not open - good, remember to close it */
- remember_to_close:
-                                i = CLOSED;
-                        } else { /* fd is open, save its copy */
-#if !defined(F_DUPFD_CLOEXEC)
-                                fcntl(i, F_SETFD, FD_CLOEXEC);
-#endif
-                                /* "exec fd>&-" should not close fds
-                                 * which point to script file(s).
-                                 * Force them to be restored afterwards */
-                                if (is_hidden_fd(sv, fd))
-                                        i |= COPYFD_RESTORE;
-                        }
-                        if (fd == 2)
-                                copied_fd2 = i;
-                        sv->two_fd[sv_pos].orig = fd;
-                        sv->two_fd[sv_pos].copy = i;
-                        sv_pos++;
-                }
-                if (newfd < 0) {
-                        /* NTOFD/NFROMFD: copy redir->ndup.dupfd to fd */
-                        if (redir->ndup.dupfd < 0) { /* "fd>&-" */
-                                /* Don't want to trigger debugging */
-                                if (fd != -1)
-                                        close(fd);
-                        } else {
-                                dup2_or_raise(redir->ndup.dupfd, fd);
+
+                if (fd == newfd)
+                        continue;
+
+                /* if "N>FILE": move newfd to fd */
+                /* if "N>&M": dup newfd to fd */
+                /* if "N>&-": close fd (newfd is -1) */
+
+ IF_BASH_REDIR_OUTPUT(redirect_more:)
+
+                closed = save_fd_on_redirect(fd, /*avoid:*/ newfd, sv);
+                if (newfd == -1) {
+                        /* "N>&-" means "close me" */
+                        if (!closed) {
+                                /* ^^^ optimization: saving may already
+                                 * have closed it. If not... */
+                                close(fd);
+                        }
+                } else {
+                        /* if newfd is a script fd or saved fd, simulate EBADF */
+                        if (internally_opened_fd(newfd, sv)) {
+                                errno = EBADF;
+                                ash_msg_and_raise_perror("%d", newfd);
                         }
-                } else if (fd != newfd) { /* move newfd to fd */
                         dup2_or_raise(newfd, fd);
+                        if (close_fd >= 0) /* "N>FILE" or ">&FILE" or heredoc? */
+                                close(close_fd);
 #if BASH_REDIR_OUTPUT
-                        if (!(redir->nfile.type == NTO2 && fd == 2))
+                        if (redir->nfile.type == NTO2 && fd == 1) {
+                                /* ">&FILE". we already redirected to 1, now copy 1 to 2 */
+                                fd = 2;
+                                newfd = 1;
+                                close_fd = -1;
+                                goto redirect_more;
+                        }
 #endif
-                                close(newfd);
                 }
+        } while ((redir = redir->nfile.next) != NULL);
+        INT_ON;
+
+//dash:#define REDIR_SAVEFD2 03        /* set preverrout */
+#define REDIR_SAVEFD2 0
+        // dash has a bug: since REDIR_SAVEFD2=3 and REDIR_PUSH=1, this test
+        // triggers for pure REDIR_PUSH too. Thus, this is done almost always,
+        // not only for calls with flags containing REDIR_SAVEFD2.
+        // We do this unconditionally (see save_fd_on_redirect()).
+        //if ((flags & REDIR_SAVEFD2) && copied_fd2 >= 0)
+        //      preverrout_fd = copied_fd2;
+}
+
+static int
+redirectsafe(union node *redir, int flags)
+{
+        int err;
+        volatile int saveint;
+        struct jmploc *volatile savehandler = exception_handler;
+        struct jmploc jmploc;
+
+        SAVE_INT(saveint);
+        /* "echo 9>/dev/null; echo >&9; echo result: $?" - result should be 1, not 2! */
+        err = setjmp(jmploc.loc); /* was = setjmp(jmploc.loc) * 2; */
+        if (!err) {
+                exception_handler = &jmploc;
+                redirect(redir, flags);
+        }
+        exception_handler = savehandler;
+        if (err && exception_type != EXERROR)
+                longjmp(exception_handler->loc, 1);
+        RESTORE_INT(saveint);
+        return err;
+}
+
+static struct redirtab*
+pushredir(union node *redir)
+{
+        struct redirtab *sv;
+        int i;
+
+        if (!redir)
+                return redirlist;
+
+        i = 0;
+        do {
+                i++;
 #if BASH_REDIR_OUTPUT
-                if (redir->nfile.type == NTO2 && fd == 1) {
-                        /* We already redirected it to fd 1, now copy it to 2 */
-                        newfd = 1;
-                        fd = 2;
-                        goto redirect_more;
-                }
+                if (redir->nfile.type == NTO2)
+                        i++;
 #endif
-        } while ((redir = redir->nfile.next) != NULL);
+                redir = redir->nfile.next;
+        } while (redir);
 
-        INT_ON;
-        if ((flags & REDIR_SAVEFD2) && copied_fd2 >= 0)
-                preverrout_fd = copied_fd2;
+        sv = ckzalloc(sizeof(*sv) + i * sizeof(sv->two_fd[0]));
+        sv->pair_count = i;
+        while (--i >= 0)
+                sv->two_fd[i].orig_fd = sv->two_fd[i].moved_to = EMPTY;
+        sv->next = redirlist;
+        redirlist = sv;
+        return sv->next;
 }
 
 /*
  * Undo the effects of the last redirection.
  */
 static void
-popredir(int drop, int restore)
+popredir(int drop)
 {
         struct redirtab *rp;
         int i;
@@ -5941,20 +6061,19 @@ popredir(int drop, int restore)
         INT_OFF;
         rp = redirlist;
         for (i = 0; i < rp->pair_count; i++) {
-                int fd = rp->two_fd[i].orig;
-                int copy = rp->two_fd[i].copy;
+                int fd = rp->two_fd[i].orig_fd;
+                int copy = rp->two_fd[i].moved_to;
                 if (copy == CLOSED) {
                         if (!drop)
                                 close(fd);
                         continue;
                 }
                 if (copy != EMPTY) {
-                        if (!drop || (restore && (copy & COPYFD_RESTORE))) {
-                                copy &= ~COPYFD_RESTORE;
+                        if (!drop) {
                                 /*close(fd);*/
                                 dup2_or_raise(copy, fd);
                         }
-                        close(copy & ~COPYFD_RESTORE);
+                        close(copy);
                 }
         }
         redirlist = rp->next;
@@ -5962,30 +6081,11 @@ popredir(int drop, int restore)
         INT_ON;
 }
 
-/*
- * Undo all redirections.  Called on error or interrupt.
- */
-
-static int
-redirectsafe(union node *redir, int flags)
+static void
+unwindredir(struct redirtab *stop)
 {
-        int err;
-        volatile int saveint;
-        struct jmploc *volatile savehandler = exception_handler;
-        struct jmploc jmploc;
-
-        SAVE_INT(saveint);
-        /* "echo 9>/dev/null; echo >&9; echo result: $?" - result should be 1, not 2! */
-        err = setjmp(jmploc.loc); // huh?? was = setjmp(jmploc.loc) * 2;
-        if (!err) {
-                exception_handler = &jmploc;
-                redirect(redir, flags);
-        }
-        exception_handler = savehandler;
-        if (err && exception_type != EXERROR)
-                longjmp(exception_handler->loc, 1);
-        RESTORE_INT(saveint);
-        return err;
+        while (redirlist != stop)
+                popredir(/*drop:*/ 0);
 }
 
 
@@ -8076,7 +8176,7 @@ tryexec(IF_FEATURE_SH_STANDALONE(int applet_no,) const char *cmd, char **argv, c
                         clearenv();
                         while (*envp)
                                 putenv(*envp++);
-                        popredir(/*drop:*/ 1, /*restore:*/ 0);
+                        popredir(/*drop:*/ 1);
                         run_applet_no_and_exit(applet_no, cmd, argv);
                 }
                 /* re-exec ourselves with the new arguments */
@@ -9159,12 +9259,13 @@ evaltree(union node *n, int flags)
                 goto setstatus;
         case NREDIR:
                 expredir(n->nredir.redirect);
+                pushredir(n->nredir.redirect);
                 status = redirectsafe(n->nredir.redirect, REDIR_PUSH);
                 if (!status) {
                         status = evaltree(n->nredir.n, flags & EV_TESTED);
                 }
                 if (n->nredir.redirect)
-                        popredir(/*drop:*/ 0, /*restore:*/ 0 /* not sure */);
+                        popredir(/*drop:*/ 0);
                 goto setstatus;
         case NCMD:
                 evalfn = evalcommand;
@@ -10079,6 +10180,7 @@ evalcommand(union node *cmd, int flags)
                 "\0\0", bltincmd /* why three NULs? */
         };
         struct localvar_list *localvar_stop;
+        struct redirtab *redir_stop;
         struct stackmark smark;
         union node *argp;
         struct arglist arglist;
@@ -10093,9 +10195,7 @@ evalcommand(union node *cmd, int flags)
         int spclbltin;
         int status;
         char **nargv;
-        struct builtincmd *bcmd;
         smallint cmd_is_exec;
-        smallint pseudovarflag = 0;
 
         /* First expand the arguments. */
         TRACE(("evalcommand(0x%lx, %d) called\n", (long)cmd, flags));
@@ -10112,21 +10212,24 @@ evalcommand(union node *cmd, int flags)
 
         argc = 0;
         if (cmd->ncmd.args) {
+                struct builtincmd *bcmd;
+                smallint pseudovarflag;
+
                 bcmd = find_builtin(cmd->ncmd.args->narg.text);
                 pseudovarflag = bcmd && IS_BUILTIN_ASSIGN(bcmd);
-        }
 
-        for (argp = cmd->ncmd.args; argp; argp = argp->narg.next) {
-                struct strlist **spp;
+                for (argp = cmd->ncmd.args; argp; argp = argp->narg.next) {
+                        struct strlist **spp;
 
-                spp = arglist.lastp;
-                if (pseudovarflag && isassignment(argp->narg.text))
-                        expandarg(argp, &arglist, EXP_VARTILDE);
-                else
-                        expandarg(argp, &arglist, EXP_FULL | EXP_TILDE);
+                        spp = arglist.lastp;
+                        if (pseudovarflag && isassignment(argp->narg.text))
+                                expandarg(argp, &arglist, EXP_VARTILDE);
+                        else
+                                expandarg(argp, &arglist, EXP_FULL | EXP_TILDE);
 
-                for (sp = *spp; sp; sp = sp->next)
-                        argc++;
+                        for (sp = *spp; sp; sp = sp->next)
+                                argc++;
+                }
         }
 
         /* Reserve one extra spot at the front for shellexec. */
@@ -10142,8 +10245,9 @@ evalcommand(union node *cmd, int flags)
         if (iflag && funcnest == 0 && argc > 0)
                 lastarg = nargv[-1];
 
-        preverrout_fd = 2;
         expredir(cmd->ncmd.redirect);
+        redir_stop = pushredir(cmd->ncmd.redirect);
+        preverrout_fd = 2;
         status = redirectsafe(cmd->ncmd.redirect, REDIR_PUSH | REDIR_SAVEFD2);
 
         path = vpath.var_text;
@@ -10169,7 +10273,7 @@ evalcommand(union node *cmd, int flags)
         if (xflag) {
                 const char *pfx = "";
 
-                fdprintf(preverrout_fd, "%s", expandstr(ps4val()));
+                fdprintf(preverrout_fd, "%s", expandstr(ps4val(), DQSYNTAX));
 
                 sp = varlist.list;
                 while (sp) {
@@ -10365,7 +10469,8 @@ evalcommand(union node *cmd, int flags)
 
  out:
         if (cmd->ncmd.redirect)
-                popredir(/*drop:*/ cmd_is_exec, /*restore:*/ cmd_is_exec);
+                popredir(/*drop:*/ cmd_is_exec);
+        unwindredir(redir_stop);
         unwindlocalvars(localvar_stop);
         if (lastarg) {
                 /* dsl: I think this is intended to be used to support
@@ -10482,6 +10587,7 @@ static smallint checkkwd;
 #define CHKALIAS        0x1
 #define CHKKWD          0x2
 #define CHKNL           0x4
+#define CHKEOFMARK      0x8
 
 /*
  * Push a string back onto the input at this current parsefile level.
@@ -10794,31 +10900,6 @@ pgetc_without_PEOA(void)
 #endif
 
 /*
- * Read a line from the script.
- */
-static char *
-pfgets(char *line, int len)
-{
-        char *p = line;
-        int nleft = len;
-        int c;
-
-        while (--nleft > 0) {
-                c = pgetc_without_PEOA();
-                if (c == PEOF) {
-                        if (p == line)
-                                return NULL;
-                        break;
-                }
-                *p++ = c;
-                if (c == '\n')
-                        break;
-        }
-        *p = '\0';
-        return line;
-}
-
-/*
  * Undo a call to pgetc.  Only two characters may be pushed back.
  * PEOF may be pushed back.
  */
@@ -11127,7 +11208,7 @@ setoption(int flag, int val)
         /* NOTREACHED */
 }
 static int
-options(int cmdline)
+options(int cmdline, int *login_sh)
 {
         char *p;
         int val;
@@ -11168,11 +11249,14 @@ options(int cmdline)
                                 if (*argptr)
                                         argptr++;
                         } else if (cmdline && (c == 'l')) { /* -l or +l == --login */
-                                isloginsh = 1;
+                                if (login_sh)
+                                        *login_sh = 1;
                         /* bash does not accept +-login, we also won't */
                         } else if (cmdline && val && (c == '-')) { /* long options */
-                                if (strcmp(p, "login") == 0)
-                                        isloginsh = 1;
+                                if (strcmp(p, "login") == 0) {
+                                        if (login_sh)
+                                                *login_sh = 1;
+                                }
                                 break;
                         } else {
                                 setoption(c, val);
@@ -11256,7 +11340,7 @@ setcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                 return showvars(nullstr, 0, VUNSET);
 
         INT_OFF;
-        retval = options(/*cmdline:*/ 0);
+        retval = options(/*cmdline:*/ 0, NULL);
         if (retval == 0) { /* if no parse error... */
                 optschanged();
                 if (*argptr != NULL) {
@@ -11453,8 +11537,6 @@ raise_error_unexpected_syntax(int token)
         /* NOTREACHED */
 }
 
-#define EOFMARKLEN 79
-
 /* parsing is heavily cross-recursive, need these forward decls */
 static union node *andor(void);
 static union node *pipeline(void);
@@ -11634,43 +11716,22 @@ fixredir(union node *n, const char *text, int err)
         }
 }
 
-/*
- * Returns true if the text contains nothing to expand (no dollar signs
- * or backquotes).
- */
-static int
-noexpand(const char *text)
-{
-        unsigned char c;
-
-        while ((c = *text++) != '\0') {
-                if (c == CTLQUOTEMARK)
-                        continue;
-                if (c == CTLESC)
-                        text++;
-                else if (SIT(c, BASESYNTAX) == CCTL)
-                        return 0;
-        }
-        return 1;
-}
-
 static void
 parsefname(void)
 {
         union node *n = redirnode;
 
+        if (n->type == NHERE)
+                checkkwd = CHKEOFMARK;
         if (readtoken() != TWORD)
                 raise_error_unexpected_syntax(-1);
         if (n->type == NHERE) {
                 struct heredoc *here = heredoc;
                 struct heredoc *p;
-                int i;
 
                 if (quoteflag == 0)
                         n->type = NXHERE;
                 TRACE(("Here document %d\n", n->type));
-                if (!noexpand(wordtext) || (i = strlen(wordtext)) == 0 || i > EOFMARKLEN)
-                        raise_error_syntax("illegal eof marker for << redirection");
                 rmescapes(wordtext, 0);
                 here->eofmark = wordtext;
                 here->next = NULL;
@@ -12062,6 +12123,15 @@ decode_dollar_squote(void)
 }
 #endif
 
+/* Used by expandstr to get here-doc like behaviour. */
+#define FAKEEOFMARK ((char*)(uintptr_t)1)
+
+static ALWAYS_INLINE int
+realeofmark(const char *eofmark)
+{
+        return eofmark && eofmark != FAKEEOFMARK;
+}
+
 /*
  * If eofmark is NULL, read a word or a redirection symbol.  If eofmark
  * is not NULL, read a here document.  In the latter case, eofmark is the
@@ -12086,7 +12156,6 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         /* c parameter is an unsigned char or PEOF or PEOA */
         char *out;
         size_t len;
-        char line[EOFMARKLEN + 1];
         struct nodelist *bqlist;
         smallint quotef;
         smallint dblquote;
@@ -12104,9 +12173,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         bqlist = NULL;
         quotef = 0;
         IF_FEATURE_SH_MATH(prevsyntax = 0;)
+#if ENABLE_ASH_EXPAND_PRMT
         pssyntax = (syntax == PSSYNTAX);
         if (pssyntax)
                 syntax = DQSYNTAX;
+#else
+        pssyntax = 0; /* constant */
+#endif
         dblquote = (syntax == DQSYNTAX);
         varnest = 0;
         IF_FEATURE_SH_MATH(arinest = 0;)
@@ -12160,7 +12233,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                         } else if (c == '\n') {
                                 nlprompt();
                         } else {
-                                if (c == '$' && pssyntax) {
+                                if (pssyntax && c == '$') {
                                         USTPUTC(CTLESC, out);
                                         USTPUTC('\\', out);
                                 }
@@ -12308,7 +12381,10 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
  * we are at the end of the here document, this routine sets the c to PEOF.
  */
 checkend: {
-        if (eofmark) {
+        if (realeofmark(eofmark)) {
+                int markloc;
+                char *p;
+
 #if ENABLE_ASH_ALIAS
                 if (c == PEOA)
                         c = pgetc_without_PEOA();
@@ -12318,27 +12394,42 @@ checkend: {
                                 c = pgetc_without_PEOA();
                         }
                 }
-                if (c == *eofmark) {
-                        if (pfgets(line, sizeof(line)) != NULL) {
-                                char *p, *q;
-                                int cc;
 
-                                p = line;
-                                for (q = eofmark + 1;; p++, q++) {
-                                        cc = *p;
-                                        if (cc == '\n')
-                                                cc = 0;
-                                        if (!*q || cc != *q)
-                                                break;
-                                }
-                                if (cc == *q) {
-                                        c = PEOF;
-                                        nlnoprompt();
-                                } else {
-                                        pushstring(line, NULL);
+                markloc = out - (char *)stackblock();
+                for (p = eofmark; STPUTC(c, out), *p; p++) {
+                        if (c != *p)
+                                goto more_heredoc;
+
+                        c = pgetc_without_PEOA();
+                }
+
+                if (c == '\n' || c == PEOF) {
+                        c = PEOF;
+                        g_parsefile->linno++;
+                        needprompt = doprompt;
+                } else {
+                        int len_here;
+
+ more_heredoc:
+                        p = (char *)stackblock() + markloc + 1;
+                        len_here = out - p;
+
+                        if (len_here) {
+                                len_here -= (c >= PEOF);
+                                c = p[-1];
+
+                                if (len_here) {
+                                        char *str;
+
+                                        str = alloca(len_here + 1);
+                                        *(char *)mempcpy(str, p, len_here) = '\0';
+
+                                        pushstring(str, NULL);
                                 }
                         }
                 }
+
+                STADJUST((char *)stackblock() + markloc - out, out);
         }
         goto checkend_return;
 }
@@ -12432,7 +12523,8 @@ parsesub: {
         int typeloc;
 
         c = pgetc_eatbnl();
-        if (c > 255 /* PEOA or PEOF */
+        if ((checkkwd & CHKEOFMARK)
+         || c > 255 /* PEOA or PEOF */
          || (c != '(' && c != '{' && !is_name(c) && !is_special(c))
         ) {
 #if BASH_DOLLAR_SQUOTE
@@ -12994,22 +13086,18 @@ parseheredoc(void)
 }
 
 
-/*
- * called by editline -- any expansions to the prompt should be added here.
- */
 static const char *
-expandstr(const char *ps)
+expandstr(const char *ps, int syntax_type)
 {
         union node n;
         int saveprompt;
 
-        /* XXX Fix (char *) cast. It _is_ a bug. ps is variable's value,
-         * and token processing _can_ alter it (delete NULs etc). */
+        /* XXX Fix (char *) cast. */
         setinputstring((char *)ps);
 
         saveprompt = doprompt;
         doprompt = 0;
-        readtoken1(pgetc(), PSSYNTAX, nullstr, 0);
+        readtoken1(pgetc(), syntax_type, FAKEEOFMARK, 0);
         doprompt = saveprompt;
 
         popfile();
@@ -14133,21 +14221,23 @@ init(void)
 /*
  * Process the shell command line arguments.
  */
-static void
+static int
 procargs(char **argv)
 {
         int i;
         const char *xminusc;
         char **xargv;
+        int login_sh;
 
         xargv = argv;
+        login_sh = xargv[0] && xargv[0][0] == '-';
         arg0 = xargv[0];
         /* if (xargv[0]) - mmm, this is always true! */
                 xargv++;
         for (i = 0; i < NOPTS; i++)
                 optlist[i] = 2;
         argptr = xargv;
-        if (options(/*cmdline:*/ 1)) {
+        if (options(/*cmdline:*/ 1, &login_sh)) {
                 /* it already printed err message */
                 raise_exception(EXERROR);
         }
@@ -14191,6 +14281,8 @@ procargs(char **argv)
                 xargv++;
         }
         optschanged();
+
+        return login_sh;
 }
 
 /*
@@ -14199,7 +14291,7 @@ procargs(char **argv)
 static void
 read_profile(const char *name)
 {
-        name = expandstr(name);
+        name = expandstr(name, DQSYNTAX);
         if (setinputfile(name, INPUT_PUSH_FILE | INPUT_NOFILE_OK) < 0)
                 return;
         cmdloop(0);
@@ -14227,8 +14319,7 @@ reset(void)
         popallfiles();
 
         /* from redir.c: */
-        while (redirlist)
-                popredir(/*drop:*/ 0, /*restore:*/ 0);
+        unwindredir(NULL);
 
         /* from var.c: */
         unwindlocalvars(NULL);
@@ -14252,6 +14343,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
         volatile smallint state;
         struct jmploc jmploc;
         struct stackmark smark;
+        int login_sh;
 
         /* Initialize global data */
         INIT_G_misc();
@@ -14304,6 +14396,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
 #if ENABLE_PLATFORM_MINGW32
         hSIGINT = CreateEvent(NULL, TRUE, FALSE, NULL);
         SetConsoleCtrlHandler(ctrl_handler, TRUE);
+
         if (argc == 3 && !strcmp(argv[1], "--forkshell")) {
                 forkshell_init(argv[2]);
 
@@ -14311,7 +14404,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                 bb_error_msg_and_die("subshell ended unexpectedly");
         }
 #endif
-        procargs(argv);
+        login_sh = procargs(argv);
 #if DEBUG
         TRACE(("Shell args: "));
         trace_puts_args(argv);
@@ -14327,9 +14420,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
         }
 #endif
 
-        if (argv[0] && argv[0][0] == '-')
-                isloginsh = 1;
-        if (isloginsh) {
+        if (login_sh) {
                 const char *hp;
 
 #if ENABLE_PLATFORM_MINGW32
@@ -14367,7 +14458,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                  * Testcase: ash -c 'exec 1>&0' must not complain. */
                 // if (!sflag) g_parsefile->pf_fd = -1;
                 // ^^ not necessary since now we special-case fd 0
-                // in is_hidden_fd() to not be considered "hidden fd"
+                // in save_fd_on_redirect()
                 evalstring(minusc, sflag ? 0 : EV_EXIT);
         }
 
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty.right b/shell/ash_test/ash-heredoc/heredoc_empty.right
new file mode 100644
index 000000000..0eabe3671
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty.right
@@ -0,0 +1,3 @@
+OK
+OK
+OK
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty.tests b/shell/ash_test/ash-heredoc/heredoc_empty.tests
new file mode 100755
index 000000000..3629bc6d1
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty.tests
@@ -0,0 +1,8 @@
+unset a
+cat <<- $a
+        OK
+$a
+cat <<- ""
+        OK
+
+echo OK
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty2.right b/shell/ash_test/ash-heredoc/heredoc_empty2.right
new file mode 100644
index 000000000..e32c6ea58
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty2.right
@@ -0,0 +1,4 @@
+OK1
+Ok:0
+OK2
+Ok:0
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty2.tests b/shell/ash_test/ash-heredoc/heredoc_empty2.tests
new file mode 100755
index 000000000..20fc35fe9
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty2.tests
@@ -0,0 +1,14 @@
+unset a
+
+# Heredoc with empty delimiter
+cat <<- ""
+        OK1
+
+echo Ok:$?
+
+# Heredoc with empty delimiter
+cat <<- ""
+        OK2
+        
+
+echo Ok:$?
diff --git a/shell/ash_test/ash-misc/func_prio_over_builtins.right b/shell/ash_test/ash-misc/func_prio_over_builtins.right
new file mode 100644
index 000000000..54e56dff4
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_prio_over_builtins.right
@@ -0,0 +1,5 @@
+YES
+YES
+YES
+YES
+Ok:YES
diff --git a/shell/ash_test/ash-misc/func_prio_over_builtins.tests b/shell/ash_test/ash-misc/func_prio_over_builtins.tests
new file mode 100755
index 000000000..4f71bfda0
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_prio_over_builtins.tests
@@ -0,0 +1,5 @@
+true() { echo YES >&2; }
+true
+true | true
+(true)
+echo Ok:`true 2>&1`
diff --git a/shell/ash_test/ash-misc/func6.right b/shell/ash_test/ash-misc/func_return1.right
index 0ebd8e5a3..0ebd8e5a3 100644
--- a/shell/ash_test/ash-misc/func6.right
+++ b/shell/ash_test/ash-misc/func_return1.right
diff --git a/shell/ash_test/ash-misc/func6.tests b/shell/ash_test/ash-misc/func_return1.tests
index 029c3e85e..029c3e85e 100755
--- a/shell/ash_test/ash-misc/func6.tests
+++ b/shell/ash_test/ash-misc/func_return1.tests
diff --git a/shell/hush_test/hush-misc/func6.right b/shell/ash_test/ash-misc/func_return2.right
index 0ebd8e5a3..0ebd8e5a3 100644
--- a/shell/hush_test/hush-misc/func6.right
+++ b/shell/ash_test/ash-misc/func_return2.right
diff --git a/shell/ash_test/ash-misc/func_return2.tests b/shell/ash_test/ash-misc/func_return2.tests
new file mode 100755
index 000000000..a049dd180
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_return2.tests
@@ -0,0 +1,6 @@
+f1() { return 2; }
+f1
+echo Two:$?
+false
+true | f1
+echo Two:$?
diff --git a/shell/ash_test/ash-redir/redir_script.tests b/shell/ash_test/ash-redir/redir_script.tests
index ccc497d7b..740daa461 100755
--- a/shell/ash_test/ash-redir/redir_script.tests
+++ b/shell/ash_test/ash-redir/redir_script.tests
@@ -20,10 +20,15 @@ eval "find_fds $fds"
 
 # Shell should not lose that fd. Did it?
 find_fds
-test x"$fds1" = x"$fds" && { echo "Ok: script fd is not closed"; exit 0; }
+test x"$fds1" = x"$fds" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
+
+# One legit way to handle it is to move script fd. For example, if we see that fd 10 moved to fd 11:
+test x"$fds1" = x" 10>&- 3>&-" && \
+test x"$fds"  = x" 11>&- 3>&-" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
 
 echo "Bug: script fd is closed"
 echo "fds1:$fds1"
 echo "fds2:$fds"
 exit 1
-
diff --git a/shell/ash_test/ash-redir/redir_to_bad_fd255.right b/shell/ash_test/ash-redir/redir_to_bad_fd255.right
new file mode 100644
index 000000000..9c5e35b36
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_to_bad_fd255.right
@@ -0,0 +1,2 @@
+./redir_to_bad_fd255.tests: line 2: 255: Bad file descriptor
+OK
diff --git a/shell/ash_test/ash-redir/redir_to_bad_fd255.tests b/shell/ash_test/ash-redir/redir_to_bad_fd255.tests
new file mode 100755
index 000000000..2266af6da
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_to_bad_fd255.tests
@@ -0,0 +1,3 @@
+# ash uses fd 10 (usually) for reading the script
+echo LOST >&255
+echo OK
diff --git a/shell/ash_test/ash-redir/redir_to_bad_fd3.right b/shell/ash_test/ash-redir/redir_to_bad_fd3.right
new file mode 100644
index 000000000..895a4a0a6
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_to_bad_fd3.right
@@ -0,0 +1,2 @@
+./redir_to_bad_fd3.tests: line 2: 3: Bad file descriptor
+OK
diff --git a/shell/ash_test/ash-redir/redir_to_bad_fd3.tests b/shell/ash_test/ash-redir/redir_to_bad_fd3.tests
new file mode 100755
index 000000000..98c54cfc6
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_to_bad_fd3.tests
@@ -0,0 +1,3 @@
+# ash uses fd 10 (usually) for reading the script
+echo LOST >&3
+echo OK
diff --git a/shell/hush.c b/shell/hush.c
index d0225edb9..9f946d82f 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -1454,11 +1454,11 @@ static int fcntl_F_DUPFD(int fd, int avoid_fd)
         return newfd;
 }
 
-static int xdup_and_close(int fd, int F_DUPFD_maybe_CLOEXEC, int avoid_fd)
+static int xdup_CLOEXEC_and_close(int fd, int avoid_fd)
 {
         int newfd;
  repeat:
-        newfd = fcntl(fd, F_DUPFD_maybe_CLOEXEC, avoid_fd + 1);
+        newfd = fcntl(fd, F_DUPFD_CLOEXEC, avoid_fd + 1);
         if (newfd < 0) {
                 if (errno == EBUSY)
                         goto repeat;
@@ -1469,6 +1469,8 @@ static int xdup_and_close(int fd, int F_DUPFD_maybe_CLOEXEC, int avoid_fd)
                         return fd;
                 xfunc_die();
         }
+        if (F_DUPFD_CLOEXEC == F_DUPFD) /* if old libc (w/o F_DUPFD_CLOEXEC) */
+                fcntl(newfd, F_SETFD, FD_CLOEXEC);
         close(fd);
         return newfd;
 }
@@ -1507,7 +1509,7 @@ static int save_FILEs_on_redirect(int fd, int avoid_fd)
         while (fl) {
                 if (fd == fl->fd) {
                         /* We use it only on script files, they are all CLOEXEC */
-                        fl->fd = xdup_and_close(fd, F_DUPFD_CLOEXEC, avoid_fd);
+                        fl->fd = xdup_CLOEXEC_and_close(fd, avoid_fd);
                         debug_printf_redir("redirect_fd %d: matches a script fd, moving it to %d\n", fd, fl->fd);
                         return 1;
                 }
@@ -1544,6 +1546,16 @@ static void close_all_FILE_list(void)
         }
 }
 #endif
+static int fd_in_FILEs(int fd)
+{
+        struct FILE_list *fl = G.FILE_list;
+        while (fl) {
+                if (fl->fd == fd)
+                        return 1;
+                fl = fl->next;
+        }
+        return 0;
+}
 
 
 /* Helpers for setting new $n and restoring them back
@@ -4001,24 +4013,34 @@ static char *fetch_till_str(o_string *as_string,
                 ch = i_getch(input);
                 if (ch != EOF)
                         nommu_addchr(as_string, ch);
-                if ((ch == '\n' || ch == EOF)
-                 && ((heredoc_flags & HEREDOC_QUOTED) || prev != '\\')
-                ) {
-                        if (strcmp(heredoc.data + past_EOL, word) == 0) {
-                                heredoc.data[past_EOL] = '\0';
-                                debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
-                                return heredoc.data;
-                        }
-                        while (ch == '\n') {
-                                o_addchr(&heredoc, ch);
-                                prev = ch;
+                if (ch == '\n' || ch == EOF) {
+ check_heredoc_end:
+                        if ((heredoc_flags & HEREDOC_QUOTED) || prev != '\\') {
+                                if (strcmp(heredoc.data + past_EOL, word) == 0) {
+                                        heredoc.data[past_EOL] = '\0';
+                                        debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
+                                        return heredoc.data;
+                                }
+                                if (ch == '\n') {
+                                        /* This is a new line.
+                                         * Remember position and backslash-escaping status.
+                                         */
+                                        o_addchr(&heredoc, ch);
+                                        prev = ch;
  jump_in:
-                                past_EOL = heredoc.length;
-                                do {
-                                        ch = i_getch(input);
-                                        if (ch != EOF)
-                                                nommu_addchr(as_string, ch);
-                                } while ((heredoc_flags & HEREDOC_SKIPTABS) && ch == '\t');
+                                        past_EOL = heredoc.length;
+                                        /* Get 1st char of next line, possibly skipping leading tabs */
+                                        do {
+                                                ch = i_getch(input);
+                                                if (ch != EOF)
+                                                        nommu_addchr(as_string, ch);
+                                        } while ((heredoc_flags & HEREDOC_SKIPTABS) && ch == '\t');
+                                        /* If this immediately ended the line,
+                                         * go back to end-of-line checks.
+                                         */
+                                        if (ch == '\n')
+                                                goto check_heredoc_end;
+                                }
                         }
                 }
                 if (ch == EOF) {
@@ -6674,9 +6696,9 @@ static struct squirrel *append_squirrel(struct squirrel *sq, int i, int orig, in
 static struct squirrel *add_squirrel(struct squirrel *sq, int fd, int avoid_fd)
 {
         int moved_to;
-        int i = 0;
+        int i;
 
-        if (sq) while (sq[i].orig_fd >= 0) {
+        if (sq) for (i = 0; sq[i].orig_fd >= 0; i++) {
                 /* If we collide with an already moved fd... */
                 if (fd == sq[i].moved_to) {
                         sq[i].moved_to = fcntl_F_DUPFD(sq[i].moved_to, avoid_fd);
@@ -6690,7 +6712,6 @@ static struct squirrel *add_squirrel(struct squirrel *sq, int fd, int avoid_fd)
                         debug_printf_redir("redirect_fd %d: already moved\n", fd);
                         return sq;
                 }
-                i++;
         }
 
         /* If this fd is open, we move and remember it; if it's closed, moved_to = -1 */
@@ -6701,18 +6722,41 @@ static struct squirrel *add_squirrel(struct squirrel *sq, int fd, int avoid_fd)
         return append_squirrel(sq, i, fd, moved_to);
 }
 
+static struct squirrel *add_squirrel_closed(struct squirrel *sq, int fd)
+{
+        int i;
+
+        if (sq) for (i = 0; sq[i].orig_fd >= 0; i++) {
+                /* If we collide with an already moved fd... */
+                if (fd == sq[i].orig_fd) {
+                        /* Examples:
+                         * "echo 3>FILE 3>&- 3>FILE"
+                         * "echo 3>&- 3>FILE"
+                         * No need for last redirect to insert
+                         * another "need to close 3" indicator.
+                         */
+                        debug_printf_redir("redirect_fd %d: already moved or closed\n", fd);
+                        return sq;
+                }
+        }
+
+        debug_printf_redir("redirect_fd %d: previous fd was closed\n", fd);
+        return append_squirrel(sq, i, fd, -1);
+}
+
 /* fd: redirect wants this fd to be used (e.g. 3>file).
  * Move all conflicting internally used fds,
  * and remember them so that we can restore them later.
  */
-static int save_fds_on_redirect(int fd, int avoid_fd, struct squirrel **sqp)
+static int save_fd_on_redirect(int fd, int avoid_fd, struct squirrel **sqp)
 {
         if (avoid_fd < 9) /* the important case here is that it can be -1 */
                 avoid_fd = 9;
 
 #if ENABLE_HUSH_INTERACTIVE
-        if (fd != 0 && fd == G.interactive_fd) {
-                G.interactive_fd = xdup_and_close(G.interactive_fd, F_DUPFD_CLOEXEC, avoid_fd);
+        if (fd == G.interactive_fd) {
+                /* Testcase: "ls -l /proc/$$/fd 255>&-" should work */
+                G.interactive_fd = xdup_CLOEXEC_and_close(G.interactive_fd, avoid_fd);
                 debug_printf_redir("redirect_fd %d: matches interactive_fd, moving it to %d\n", fd, G.interactive_fd);
                 return 1; /* "we closed fd" */
         }
@@ -6738,10 +6782,9 @@ static int save_fds_on_redirect(int fd, int avoid_fd, struct squirrel **sqp)
 
 static void restore_redirects(struct squirrel *sq)
 {
-
         if (sq) {
-                int i = 0;
-                while (sq[i].orig_fd >= 0) {
+                int i;
+                for (i = 0; sq[i].orig_fd >= 0; i++) {
                         if (sq[i].moved_to >= 0) {
                                 /* We simply die on error */
                                 debug_printf_redir("restoring redirected fd from %d to %d\n", sq[i].moved_to, sq[i].orig_fd);
@@ -6751,7 +6794,6 @@ static void restore_redirects(struct squirrel *sq)
                                 debug_printf_redir("restoring redirected fd %d: closing it\n", sq[i].orig_fd);
                                 close(sq[i].orig_fd);
                         }
-                        i++;
                 }
                 free(sq);
         }
@@ -6761,17 +6803,47 @@ static void restore_redirects(struct squirrel *sq)
         restore_redirected_FILEs();
 }
 
+#if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
+static void close_saved_fds_and_FILE_fds(void)
+{
+        if (G_interactive_fd)
+                close(G_interactive_fd);
+        close_all_FILE_list();
+}
+#endif
+
+static int internally_opened_fd(int fd, struct squirrel *sq)
+{
+        int i;
+
+#if ENABLE_HUSH_INTERACTIVE
+        if (fd == G.interactive_fd)
+                return 1;
+#endif
+        /* If this one of script's fds? */
+        if (fd_in_FILEs(fd))
+                return 1;
+
+        if (sq) for (i = 0; sq[i].orig_fd >= 0; i++) {
+                if (fd == sq[i].moved_to)
+                        return 1;
+        }
+        return 0;
+}
+
 /* squirrel != NULL means we squirrel away copies of stdin, stdout,
  * and stderr if they are redirected. */
 static int setup_redirects(struct command *prog, struct squirrel **sqp)
 {
-        int openfd, mode;
         struct redir_struct *redir;
 
         for (redir = prog->redirects; redir; redir = redir->next) {
+                int newfd;
+                int closed;
+
                 if (redir->rd_type == REDIRECT_HEREDOC2) {
                         /* "rd_fd<<HERE" case */
-                        save_fds_on_redirect(redir->rd_fd, /*avoid:*/ 0, sqp);
+                        save_fd_on_redirect(redir->rd_fd, /*avoid:*/ 0, sqp);
                         /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
                          * of the heredoc */
                         debug_printf_parse("set heredoc '%s'\n",
@@ -6783,6 +6855,8 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                 if (redir->rd_dup == REDIRFD_TO_FILE) {
                         /* "rd_fd<*>file" case (<*> is <,>,>>,<>) */
                         char *p;
+                        int mode;
+
                         if (redir->rd_filename == NULL) {
                                 /*
                                  * Examples:
@@ -6794,9 +6868,9 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                         }
                         mode = redir_table[redir->rd_type].mode;
                         p = expand_string_to_string(redir->rd_filename, /*unbackslash:*/ 1);
-                        openfd = open_or_warn(p, mode);
+                        newfd = open_or_warn(p, mode);
                         free(p);
-                        if (openfd < 0) {
+                        if (newfd < 0) {
                                 /* Error message from open_or_warn can be lost
                                  * if stderr has been redirected, but bash
                                  * and ash both lose it as well
@@ -6804,40 +6878,52 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                                  */
                                 return 1;
                         }
-                        if (openfd == redir->rd_fd && sqp) {
+                        if (newfd == redir->rd_fd && sqp) {
                                 /* open() gave us precisely the fd we wanted.
                                  * This means that this fd was not busy
                                  * (not opened to anywhere).
                                  * Remember to close it on restore:
                                  */
-                                struct squirrel *sq = *sqp;
-                                int i = 0;
-                                if (sq) while (sq[i].orig_fd >= 0)
-                                        i++;
-                                *sqp = append_squirrel(sq, i, openfd, -1); /* -1 = "it was closed" */
-                                debug_printf_redir("redir to previously closed fd %d\n", openfd);
+                                *sqp = add_squirrel_closed(*sqp, newfd);
+                                debug_printf_redir("redir to previously closed fd %d\n", newfd);
                         }
                 } else {
-                        /* "rd_fd<*>rd_dup" or "rd_fd<*>-" cases */
-                        openfd = redir->rd_dup;
-                }
-
-                if (openfd != redir->rd_fd) {
-                        int closed = save_fds_on_redirect(redir->rd_fd, /*avoid:*/ openfd, sqp);
-                        if (openfd == REDIRFD_CLOSE) {
-                                /* "rd_fd >&-" means "close me" */
-                                if (!closed) {
-                                        /* ^^^ optimization: saving may already
-                                         * have closed it. If not... */
-                                        close(redir->rd_fd);
-                                }
-                        } else {
-                                xdup2(openfd, redir->rd_fd);
-                                if (redir->rd_dup == REDIRFD_TO_FILE)
-                                        /* "rd_fd > FILE" */
-                                        close(openfd);
-                                /* else: "rd_fd > rd_dup" */
+                        /* "rd_fd>&rd_dup" or "rd_fd>&-" case */
+                        newfd = redir->rd_dup;
+                }
+
+                if (newfd == redir->rd_fd)
+                        continue;
+
+                /* if "N>FILE": move newfd to redir->rd_fd */
+                /* if "N>&M": dup newfd to redir->rd_fd */
+                /* if "N>&-": close redir->rd_fd (newfd is REDIRFD_CLOSE) */
+
+                closed = save_fd_on_redirect(redir->rd_fd, /*avoid:*/ newfd, sqp);
+                if (newfd == REDIRFD_CLOSE) {
+                        /* "N>&-" means "close me" */
+                        if (!closed) {
+                                /* ^^^ optimization: saving may already
+                                 * have closed it. If not... */
+                                close(redir->rd_fd);
+                        }
+                        /* Sometimes we do another close on restore, getting EBADF.
+                         * Consider "echo 3>FILE 3>&-"
+                         * first redirect remembers "need to close 3",
+                         * and second redirect closes 3! Restore code then closes 3 again.
+                         */
+                } else {
+                        /* if newfd is a script fd or saved fd, simulate EBADF */
+                        if (internally_opened_fd(newfd, sqp ? *sqp : NULL)) {
+                                //errno = EBADF;
+                                //bb_perror_msg_and_die("can't duplicate file descriptor");
+                                newfd = -1; /* same effect as code above */
                         }
+                        xdup2(newfd, redir->rd_fd);
+                        if (redir->rd_dup == REDIRFD_TO_FILE)
+                                /* "rd_fd > FILE" */
+                                close(newfd);
+                        /* else: "rd_fd > rd_dup" */
                 }
         }
         return 0;
@@ -7004,11 +7090,34 @@ static void exec_function(char ***to_free,
         argv[0] = G.global_argv[0];
         G.global_argv = argv;
         G.global_argc = n = 1 + string_array_len(argv + 1);
+
+// Example when we are here: "cmd | func"
+// func will run with saved-redirect fds open.
+// $ f() { echo /proc/self/fd/*; }
+// $ true | f
+// /proc/self/fd/0 /proc/self/fd/1 /proc/self/fd/2 /proc/self/fd/255 /proc/self/fd/3
+// stdio^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ G_interactive_fd^ DIR fd for glob
+// Same in script:
+// $ . ./SCRIPT
+// /proc/self/fd/0 /proc/self/fd/1 /proc/self/fd/2 /proc/self/fd/255 /proc/self/fd/3 /proc/self/fd/4
+// stdio^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ G_interactive_fd^ opened ./SCRIPT DIR fd for glob
+// They are CLOEXEC so external programs won't see them, but
+// for "more correctness" we might want to close those extra fds here:
+//?     close_saved_fds_and_FILE_fds();
+
+        /* "we are in function, ok to use return" */
+        G_flag_return_in_progress = -1;
+        IF_HUSH_LOCAL(G.func_nest_level++;)
+
         /* On MMU, funcp->body is always non-NULL */
         n = run_list(funcp->body);
         fflush_all();
         _exit(n);
 # else
+//?     close_saved_fds_and_FILE_fds();
+
+//TODO: check whether "true | func_with_return" works
+
         re_execute_shell(to_free,
                         funcp->body_as_string,
                         G.global_argv[0],
@@ -7028,9 +7137,7 @@ static int run_function(const struct function *funcp, char **argv)
         /* "we are in function, ok to use return" */
         sv_flg = G_flag_return_in_progress;
         G_flag_return_in_progress = -1;
-# if ENABLE_HUSH_LOCAL
-        G.func_nest_level++;
-# endif
+        IF_HUSH_LOCAL(G.func_nest_level++;)
 
         /* On MMU, funcp->body is always non-NULL */
 # if !BB_MMU
@@ -7094,6 +7201,7 @@ static void exec_builtin(char ***to_free,
 #if BB_MMU
         int rcode;
         fflush_all();
+//?     close_saved_fds_and_FILE_fds();
         rcode = x->b_function(argv);
         fflush_all();
         _exit(rcode);
@@ -7215,6 +7323,16 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                 goto skip;
 #endif
 
+#if ENABLE_HUSH_FUNCTIONS
+        /* Check if the command matches any functions (this goes before bltins) */
+        {
+                const struct function *funcp = find_function(argv[0]);
+                if (funcp) {
+                        exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
+                }
+        }
+#endif
+
         /* Check if the command matches any of the builtins.
          * Depending on context, this might be redundant.  But it's
          * easier to waste a few CPU cycles than it is to figure out
@@ -7231,15 +7349,6 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                         exec_builtin(&nommu_save->argv_from_re_execing, x, argv);
                 }
         }
-#if ENABLE_HUSH_FUNCTIONS
-        /* Check if the command matches any functions */
-        {
-                const struct function *funcp = find_function(argv[0]);
-                if (funcp) {
-                        exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
-                }
-        }
-#endif
 
 #if ENABLE_FEATURE_SH_STANDALONE
         /* Check if the command matches any busybox applets */
@@ -7248,8 +7357,12 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                 if (a >= 0) {
 # if BB_MMU /* see above why on NOMMU it is not allowed */
                         if (APPLET_IS_NOEXEC(a)) {
-                                /* Do not leak open fds from opened script files etc */
-                                close_all_FILE_list();
+                                /* Do not leak open fds from opened script files etc.
+                                 * Testcase: interactive "ls -l /proc/self/fd"
+                                 * should not show tty fd open.
+                                 */
+                                close_saved_fds_and_FILE_fds();
+//FIXME: should also close saved redir fds
                                 debug_printf_exec("running applet '%s'\n", argv[0]);
                                 run_applet_no_and_exit(a, argv[0], argv);
                         }
@@ -7886,12 +7999,13 @@ static NOINLINE int run_pipe(struct pipe *pi)
                         return G.last_exitcode;
                 }
 
-                x = find_builtin(argv_expanded[0]);
 #if ENABLE_HUSH_FUNCTIONS
-                funcp = NULL;
-                if (!x)
-                        funcp = find_function(argv_expanded[0]);
+                /* Check if argv[0] matches any functions (this goes before bltins) */
+                funcp = find_function(argv_expanded[0]);
 #endif
+                x = NULL;
+                if (!funcp)
+                        x = find_builtin(argv_expanded[0]);
                 if (x || funcp) {
                         if (!funcp) {
                                 if (x->b_function == builtin_exec && argv_expanded[1] == NULL) {
@@ -9158,6 +9272,14 @@ static int FAST_FUNC builtin_exec(char **argv)
         if (G_saved_tty_pgrp && getpid() == G.root_pid)
                 tcsetpgrp(G_interactive_fd, G_saved_tty_pgrp);
 
+        /* Saved-redirect fds, script fds and G_interactive_fd are still
+         * open here. However, they are all CLOEXEC, and execv below
+         * closes them. Try interactive "exec ls -l /proc/self/fd",
+         * it should show no extra open fds in the "ls" process.
+         * If we'd try to run builtins/NOEXECs, this would need improving.
+         */
+        //close_saved_fds_and_FILE_fds();
+
         /* TODO: if exec fails, bash does NOT exit! We do.
          * We'll need to undo trap cleanup (it's inside execvp_or_die)
          * and tcsetpgrp, and this is inherently racy.
diff --git a/shell/hush_test/hush-heredoc/heredoc_empty2.right b/shell/hush_test/hush-heredoc/heredoc_empty2.right
new file mode 100644
index 000000000..e32c6ea58
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_empty2.right
@@ -0,0 +1,4 @@
+OK1
+Ok:0
+OK2
+Ok:0
diff --git a/shell/hush_test/hush-heredoc/heredoc_empty2.tests b/shell/hush_test/hush-heredoc/heredoc_empty2.tests
new file mode 100755
index 000000000..20fc35fe9
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_empty2.tests
@@ -0,0 +1,14 @@
+unset a
+
+# Heredoc with empty delimiter
+cat <<- ""
+        OK1
+
+echo Ok:$?
+
+# Heredoc with empty delimiter
+cat <<- ""
+        OK2
+        
+
+echo Ok:$?
diff --git a/shell/hush_test/hush-misc/func_prio_over_builtins.right b/shell/hush_test/hush-misc/func_prio_over_builtins.right
new file mode 100644
index 000000000..54e56dff4
--- /dev/null
+++ b/shell/hush_test/hush-misc/func_prio_over_builtins.right
@@ -0,0 +1,5 @@
+YES
+YES
+YES
+YES
+Ok:YES
diff --git a/shell/hush_test/hush-misc/func_prio_over_builtins.tests b/shell/hush_test/hush-misc/func_prio_over_builtins.tests
new file mode 100755
index 000000000..4f71bfda0
--- /dev/null
+++ b/shell/hush_test/hush-misc/func_prio_over_builtins.tests
@@ -0,0 +1,5 @@
+true() { echo YES >&2; }
+true
+true | true
+(true)
+echo Ok:`true 2>&1`
diff --git a/shell/hush_test/hush-misc/func_return1.right b/shell/hush_test/hush-misc/func_return1.right
new file mode 100644
index 000000000..0ebd8e5a3
--- /dev/null
+++ b/shell/hush_test/hush-misc/func_return1.right
@@ -0,0 +1,2 @@
+Two:2
+Two:2
diff --git a/shell/hush_test/hush-misc/func6.tests b/shell/hush_test/hush-misc/func_return1.tests
index 029c3e85e..029c3e85e 100755
--- a/shell/hush_test/hush-misc/func6.tests
+++ b/shell/hush_test/hush-misc/func_return1.tests
diff --git a/shell/hush_test/hush-misc/func_return2.right b/shell/hush_test/hush-misc/func_return2.right
new file mode 100644
index 000000000..0ebd8e5a3
--- /dev/null
+++ b/shell/hush_test/hush-misc/func_return2.right
@@ -0,0 +1,2 @@
+Two:2
+Two:2
diff --git a/shell/hush_test/hush-misc/func_return2.tests b/shell/hush_test/hush-misc/func_return2.tests
new file mode 100755
index 000000000..a049dd180
--- /dev/null
+++ b/shell/hush_test/hush-misc/func_return2.tests
@@ -0,0 +1,6 @@
+f1() { return 2; }
+f1
+echo Two:$?
+false
+true | f1
+echo Two:$?
diff --git a/shell/hush_test/hush-redir/redir_script.tests b/shell/hush_test/hush-redir/redir_script.tests
index ccc497d7b..740daa461 100755
--- a/shell/hush_test/hush-redir/redir_script.tests
+++ b/shell/hush_test/hush-redir/redir_script.tests
@@ -20,10 +20,15 @@ eval "find_fds $fds"
 
 # Shell should not lose that fd. Did it?
 find_fds
-test x"$fds1" = x"$fds" && { echo "Ok: script fd is not closed"; exit 0; }
+test x"$fds1" = x"$fds" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
+
+# One legit way to handle it is to move script fd. For example, if we see that fd 10 moved to fd 11:
+test x"$fds1" = x" 10>&- 3>&-" && \
+test x"$fds"  = x" 11>&- 3>&-" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
 
 echo "Bug: script fd is closed"
 echo "fds1:$fds1"
 echo "fds2:$fds"
 exit 1
-
diff --git a/shell/hush_test/hush-redir/redir_to_bad_fd255.right b/shell/hush_test/hush-redir/redir_to_bad_fd255.right
new file mode 100644
index 000000000..936911ce5
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_to_bad_fd255.right
@@ -0,0 +1 @@
+hush: can't duplicate file descriptor: Bad file descriptor
diff --git a/shell/hush_test/hush-redir/redir_to_bad_fd255.tests b/shell/hush_test/hush-redir/redir_to_bad_fd255.tests
new file mode 100755
index 000000000..2266af6da
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_to_bad_fd255.tests
@@ -0,0 +1,3 @@
+# ash uses fd 10 (usually) for reading the script
+echo LOST >&255
+echo OK
diff --git a/shell/hush_test/hush-redir/redir_to_bad_fd3.right b/shell/hush_test/hush-redir/redir_to_bad_fd3.right
new file mode 100644
index 000000000..936911ce5
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_to_bad_fd3.right
@@ -0,0 +1 @@
+hush: can't duplicate file descriptor: Bad file descriptor
diff --git a/shell/hush_test/hush-redir/redir_to_bad_fd3.tests b/shell/hush_test/hush-redir/redir_to_bad_fd3.tests
new file mode 100755
index 000000000..98c54cfc6
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_to_bad_fd3.tests
@@ -0,0 +1,3 @@
+# ash uses fd 10 (usually) for reading the script
+echo LOST >&3
+echo OK