hush: big reordering: move parser functions to the beginning. no code changes

Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>

1 files changed, 2042 insertions, 2042 deletions

diff --git a/shell/hush.c b/shell/hush.c
index 1bed72159..2afe12fea 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -2515,20 +2515,1864 @@ static char **o_finalize_list(o_string *o, int n)
         return list;
 }
 
+static void free_pipe_list(struct pipe *head);
 
-/* Expansion can recurse */
-#if ENABLE_HUSH_TICK
-static int process_command_subs(o_string *dest, const char *s);
+/* Return code is the exit status of the pipe */
+static void free_pipe(struct pipe *pi)
+{
+        char **p;
+        struct command *command;
+        struct redir_struct *r, *rnext;
+        int a, i;
+
+        if (pi->stopped_cmds > 0) /* why? */
+                return;
+        debug_printf_clean("run pipe: (pid %d)\n", getpid());
+        for (i = 0; i < pi->num_cmds; i++) {
+                command = &pi->cmds[i];
+                debug_printf_clean("  command %d:\n", i);
+                if (command->argv) {
+                        for (a = 0, p = command->argv; *p; a++, p++) {
+                                debug_printf_clean("   argv[%d] = %s\n", a, *p);
+                        }
+                        free_strings(command->argv);
+                        command->argv = NULL;
+                }
+                /* not "else if": on syntax error, we may have both! */
+                if (command->group) {
+                        debug_printf_clean("   begin group (cmd_type:%d)\n",
+                                        command->cmd_type);
+                        free_pipe_list(command->group);
+                        debug_printf_clean("   end group\n");
+                        command->group = NULL;
+                }
+                /* else is crucial here.
+                 * If group != NULL, child_func is meaningless */
+#if ENABLE_HUSH_FUNCTIONS
+                else if (command->child_func) {
+                        debug_printf_exec("cmd %p releases child func at %p\n", command, command->child_func);
+                        command->child_func->parent_cmd = NULL;
+                }
 #endif
-static char *expand_string_to_string(const char *str);
+#if !BB_MMU
+                free(command->group_as_string);
+                command->group_as_string = NULL;
+#endif
+                for (r = command->redirects; r; r = rnext) {
+                        debug_printf_clean("   redirect %d%s",
+                                        r->rd_fd, redir_table[r->rd_type].descrip);
+                        /* guard against the case >$FOO, where foo is unset or blank */
+                        if (r->rd_filename) {
+                                debug_printf_clean(" fname:'%s'\n", r->rd_filename);
+                                free(r->rd_filename);
+                                r->rd_filename = NULL;
+                        }
+                        debug_printf_clean(" rd_dup:%d\n", r->rd_dup);
+                        rnext = r->next;
+                        free(r);
+                }
+                command->redirects = NULL;
+        }
+        free(pi->cmds);   /* children are an array, they get freed all at once */
+        pi->cmds = NULL;
+#if ENABLE_HUSH_JOB
+        free(pi->cmdtext);
+        pi->cmdtext = NULL;
+#endif
+}
+
+static void free_pipe_list(struct pipe *head)
+{
+        struct pipe *pi, *next;
+
+        for (pi = head; pi; pi = next) {
+#if HAS_KEYWORDS
+                debug_printf_clean(" pipe reserved word %d\n", pi->res_word);
+#endif
+                free_pipe(pi);
+                debug_printf_clean("pipe followup code %d\n", pi->followup);
+                next = pi->next;
+                /*pi->next = NULL;*/
+                free(pi);
+        }
+}
+
+
+/*** Parsing routines ***/
+
+static struct pipe *new_pipe(void)
+{
+        struct pipe *pi;
+        pi = xzalloc(sizeof(struct pipe));
+        /*pi->followup = 0; - deliberately invalid value */
+        /*pi->res_word = RES_NONE; - RES_NONE is 0 anyway */
+        return pi;
+}
+
+/* Command (member of a pipe) is complete, or we start a new pipe
+ * if ctx->command is NULL.
+ * No errors possible here.
+ */
+static int done_command(struct parse_context *ctx)
+{
+        /* The command is really already in the pipe structure, so
+         * advance the pipe counter and make a new, null command. */
+        struct pipe *pi = ctx->pipe;
+        struct command *command = ctx->command;
+
+        if (command) {
+                if (IS_NULL_CMD(command)) {
+                        debug_printf_parse("done_command: skipping null cmd, num_cmds=%d\n", pi->num_cmds);
+                        goto clear_and_ret;
+                }
+                pi->num_cmds++;
+                debug_printf_parse("done_command: ++num_cmds=%d\n", pi->num_cmds);
+                //debug_print_tree(ctx->list_head, 20);
+        } else {
+                debug_printf_parse("done_command: initializing, num_cmds=%d\n", pi->num_cmds);
+        }
+
+        /* Only real trickiness here is that the uncommitted
+         * command structure is not counted in pi->num_cmds. */
+        pi->cmds = xrealloc(pi->cmds, sizeof(*pi->cmds) * (pi->num_cmds+1));
+        ctx->command = command = &pi->cmds[pi->num_cmds];
+ clear_and_ret:
+        memset(command, 0, sizeof(*command));
+        return pi->num_cmds; /* used only for 0/nonzero check */
+}
+
+static void done_pipe(struct parse_context *ctx, pipe_style type)
+{
+        int not_null;
+
+        debug_printf_parse("done_pipe entered, followup %d\n", type);
+        /* Close previous command */
+        not_null = done_command(ctx);
+        ctx->pipe->followup = type;
+#if HAS_KEYWORDS
+        ctx->pipe->pi_inverted = ctx->ctx_inverted;
+        ctx->ctx_inverted = 0;
+        ctx->pipe->res_word = ctx->ctx_res_w;
+#endif
+
+        /* Without this check, even just <enter> on command line generates
+         * tree of three NOPs (!). Which is harmless but annoying.
+         * IOW: it is safe to do it unconditionally. */
+        if (not_null
+#if ENABLE_HUSH_IF
+         || ctx->ctx_res_w == RES_FI
+#endif
+#if ENABLE_HUSH_LOOPS
+         || ctx->ctx_res_w == RES_DONE
+         || ctx->ctx_res_w == RES_FOR
+         || ctx->ctx_res_w == RES_IN
+#endif
+#if ENABLE_HUSH_CASE
+         || ctx->ctx_res_w == RES_ESAC
+#endif
+        ) {
+                struct pipe *new_p;
+                debug_printf_parse("done_pipe: adding new pipe: "
+                                "not_null:%d ctx->ctx_res_w:%d\n",
+                                not_null, ctx->ctx_res_w);
+                new_p = new_pipe();
+                ctx->pipe->next = new_p;
+                ctx->pipe = new_p;
+                /* RES_THEN, RES_DO etc are "sticky" -
+                 * they remain set for pipes inside if/while.
+                 * This is used to control execution.
+                 * RES_FOR and RES_IN are NOT sticky (needed to support
+                 * cases where variable or value happens to match a keyword):
+                 */
+#if ENABLE_HUSH_LOOPS
+                if (ctx->ctx_res_w == RES_FOR
+                 || ctx->ctx_res_w == RES_IN)
+                        ctx->ctx_res_w = RES_NONE;
+#endif
+#if ENABLE_HUSH_CASE
+                if (ctx->ctx_res_w == RES_MATCH)
+                        ctx->ctx_res_w = RES_CASE_BODY;
+                if (ctx->ctx_res_w == RES_CASE)
+                        ctx->ctx_res_w = RES_CASE_IN;
+#endif
+                ctx->command = NULL; /* trick done_command below */
+                /* Create the memory for command, roughly:
+                 * ctx->pipe->cmds = new struct command;
+                 * ctx->command = &ctx->pipe->cmds[0];
+                 */
+                done_command(ctx);
+                //debug_print_tree(ctx->list_head, 10);
+        }
+        debug_printf_parse("done_pipe return\n");
+}
+
+static void initialize_context(struct parse_context *ctx)
+{
+        memset(ctx, 0, sizeof(*ctx));
+        ctx->pipe = ctx->list_head = new_pipe();
+        /* Create the memory for command, roughly:
+         * ctx->pipe->cmds = new struct command;
+         * ctx->command = &ctx->pipe->cmds[0];
+         */
+        done_command(ctx);
+}
+
+/* If a reserved word is found and processed, parse context is modified
+ * and 1 is returned.
+ */
+#if HAS_KEYWORDS
+struct reserved_combo {
+        char literal[6];
+        unsigned char res;
+        unsigned char assignment_flag;
+        int flag;
+};
+enum {
+        FLAG_END   = (1 << RES_NONE ),
+# if ENABLE_HUSH_IF
+        FLAG_IF    = (1 << RES_IF   ),
+        FLAG_THEN  = (1 << RES_THEN ),
+        FLAG_ELIF  = (1 << RES_ELIF ),
+        FLAG_ELSE  = (1 << RES_ELSE ),
+        FLAG_FI    = (1 << RES_FI   ),
+# endif
+# if ENABLE_HUSH_LOOPS
+        FLAG_FOR   = (1 << RES_FOR  ),
+        FLAG_WHILE = (1 << RES_WHILE),
+        FLAG_UNTIL = (1 << RES_UNTIL),
+        FLAG_DO    = (1 << RES_DO   ),
+        FLAG_DONE  = (1 << RES_DONE ),
+        FLAG_IN    = (1 << RES_IN   ),
+# endif
+# if ENABLE_HUSH_CASE
+        FLAG_MATCH = (1 << RES_MATCH),
+        FLAG_ESAC  = (1 << RES_ESAC ),
+# endif
+        FLAG_START = (1 << RES_XXXX ),
+};
+
+static const struct reserved_combo* match_reserved_word(o_string *word)
+{
+        /* Mostly a list of accepted follow-up reserved words.
+         * FLAG_END means we are done with the sequence, and are ready
+         * to turn the compound list into a command.
+         * FLAG_START means the word must start a new compound list.
+         */
+        static const struct reserved_combo reserved_list[] = {
+# if ENABLE_HUSH_IF
+                { "!",     RES_NONE,  NOT_ASSIGNMENT , 0 },
+                { "if",    RES_IF,    WORD_IS_KEYWORD, FLAG_THEN | FLAG_START },
+                { "then",  RES_THEN,  WORD_IS_KEYWORD, FLAG_ELIF | FLAG_ELSE | FLAG_FI },
+                { "elif",  RES_ELIF,  WORD_IS_KEYWORD, FLAG_THEN },
+                { "else",  RES_ELSE,  WORD_IS_KEYWORD, FLAG_FI   },
+                { "fi",    RES_FI,    NOT_ASSIGNMENT , FLAG_END  },
+# endif
+# if ENABLE_HUSH_LOOPS
+                { "for",   RES_FOR,   NOT_ASSIGNMENT , FLAG_IN | FLAG_DO | FLAG_START },
+                { "while", RES_WHILE, WORD_IS_KEYWORD, FLAG_DO | FLAG_START },
+                { "until", RES_UNTIL, WORD_IS_KEYWORD, FLAG_DO | FLAG_START },
+                { "in",    RES_IN,    NOT_ASSIGNMENT , FLAG_DO   },
+                { "do",    RES_DO,    WORD_IS_KEYWORD, FLAG_DONE },
+                { "done",  RES_DONE,  NOT_ASSIGNMENT , FLAG_END  },
+# endif
+# if ENABLE_HUSH_CASE
+                { "case",  RES_CASE,  NOT_ASSIGNMENT , FLAG_MATCH | FLAG_START },
+                { "esac",  RES_ESAC,  NOT_ASSIGNMENT , FLAG_END  },
+# endif
+        };
+        const struct reserved_combo *r;
+
+        for (r = reserved_list; r < reserved_list + ARRAY_SIZE(reserved_list); r++) {
+                if (strcmp(word->data, r->literal) == 0)
+                        return r;
+        }
+        return NULL;
+}
+/* Return 0: not a keyword, 1: keyword
+ */
+static int reserved_word(o_string *word, struct parse_context *ctx)
+{
+# if ENABLE_HUSH_CASE
+        static const struct reserved_combo reserved_match = {
+                "",        RES_MATCH, NOT_ASSIGNMENT , FLAG_MATCH | FLAG_ESAC
+        };
+# endif
+        const struct reserved_combo *r;
+
+        if (word->has_quoted_part)
+                return 0;
+        r = match_reserved_word(word);
+        if (!r)
+                return 0;
+
+        debug_printf("found reserved word %s, res %d\n", r->literal, r->res);
+# if ENABLE_HUSH_CASE
+        if (r->res == RES_IN && ctx->ctx_res_w == RES_CASE_IN) {
+                /* "case word IN ..." - IN part starts first MATCH part */
+                r = &reserved_match;
+        } else
+# endif
+        if (r->flag == 0) { /* '!' */
+                if (ctx->ctx_inverted) { /* bash doesn't accept '! ! true' */
+                        syntax_error("! ! command");
+                        ctx->ctx_res_w = RES_SNTX;
+                }
+                ctx->ctx_inverted = 1;
+                return 1;
+        }
+        if (r->flag & FLAG_START) {
+                struct parse_context *old;
+
+                old = xmalloc(sizeof(*old));
+                debug_printf_parse("push stack %p\n", old);
+                *old = *ctx;   /* physical copy */
+                initialize_context(ctx);
+                ctx->stack = old;
+        } else if (/*ctx->ctx_res_w == RES_NONE ||*/ !(ctx->old_flag & (1 << r->res))) {
+                syntax_error_at(word->data);
+                ctx->ctx_res_w = RES_SNTX;
+                return 1;
+        } else {
+                /* "{...} fi" is ok. "{...} if" is not
+                 * Example:
+                 * if { echo foo; } then { echo bar; } fi */
+                if (ctx->command->group)
+                        done_pipe(ctx, PIPE_SEQ);
+        }
+
+        ctx->ctx_res_w = r->res;
+        ctx->old_flag = r->flag;
+        word->o_assignment = r->assignment_flag;
+
+        if (ctx->old_flag & FLAG_END) {
+                struct parse_context *old;
+
+                done_pipe(ctx, PIPE_SEQ);
+                debug_printf_parse("pop stack %p\n", ctx->stack);
+                old = ctx->stack;
+                old->command->group = ctx->list_head;
+                old->command->cmd_type = CMD_NORMAL;
+# if !BB_MMU
+                o_addstr(&old->as_string, ctx->as_string.data);
+                o_free_unsafe(&ctx->as_string);
+                old->command->group_as_string = xstrdup(old->as_string.data);
+                debug_printf_parse("pop, remembering as:'%s'\n",
+                                old->command->group_as_string);
+# endif
+                *ctx = *old;   /* physical copy */
+                free(old);
+        }
+        return 1;
+}
+#endif /* HAS_KEYWORDS */
+
+/* Word is complete, look at it and update parsing context.
+ * Normal return is 0. Syntax errors return 1.
+ * Note: on return, word is reset, but not o_free'd!
+ */
+static int done_word(o_string *word, struct parse_context *ctx)
+{
+        struct command *command = ctx->command;
+
+        debug_printf_parse("done_word entered: '%s' %p\n", word->data, command);
+        if (word->length == 0 && !word->has_quoted_part) {
+                debug_printf_parse("done_word return 0: true null, ignored\n");
+                return 0;
+        }
+
+        if (ctx->pending_redirect) {
+                /* We do not glob in e.g. >*.tmp case. bash seems to glob here
+                 * only if run as "bash", not "sh" */
+                /* http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
+                 * "2.7 Redirection
+                 * ...the word that follows the redirection operator
+                 * shall be subjected to tilde expansion, parameter expansion,
+                 * command substitution, arithmetic expansion, and quote
+                 * removal. Pathname expansion shall not be performed
+                 * on the word by a non-interactive shell; an interactive
+                 * shell may perform it, but shall do so only when
+                 * the expansion would result in one word."
+                 */
+                ctx->pending_redirect->rd_filename = xstrdup(word->data);
+                /* Cater for >\file case:
+                 * >\a creates file a; >\\a, >"\a", >"\\a" create file \a
+                 * Same with heredocs:
+                 * for <<\H delim is H; <<\\H, <<"\H", <<"\\H" - \H
+                 */
+                if (ctx->pending_redirect->rd_type == REDIRECT_HEREDOC) {
+                        unbackslash(ctx->pending_redirect->rd_filename);
+                        /* Is it <<"HEREDOC"? */
+                        if (word->has_quoted_part) {
+                                ctx->pending_redirect->rd_dup |= HEREDOC_QUOTED;
+                        }
+                }
+                debug_printf_parse("word stored in rd_filename: '%s'\n", word->data);
+                ctx->pending_redirect = NULL;
+        } else {
+                /* If this word wasn't an assignment, next ones definitely
+                 * can't be assignments. Even if they look like ones. */
+                if (word->o_assignment != DEFINITELY_ASSIGNMENT
+                 && word->o_assignment != WORD_IS_KEYWORD
+                ) {
+                        word->o_assignment = NOT_ASSIGNMENT;
+                } else {
+                        if (word->o_assignment == DEFINITELY_ASSIGNMENT)
+                                command->assignment_cnt++;
+                        word->o_assignment = MAYBE_ASSIGNMENT;
+                }
+
+#if HAS_KEYWORDS
+# if ENABLE_HUSH_CASE
+                if (ctx->ctx_dsemicolon
+                 && strcmp(word->data, "esac") != 0 /* not "... pattern) cmd;; esac" */
+                ) {
+                        /* already done when ctx_dsemicolon was set to 1: */
+                        /* ctx->ctx_res_w = RES_MATCH; */
+                        ctx->ctx_dsemicolon = 0;
+                } else
+# endif
+                if (!command->argv /* if it's the first word... */
+# if ENABLE_HUSH_LOOPS
+                 && ctx->ctx_res_w != RES_FOR /* ...not after FOR or IN */
+                 && ctx->ctx_res_w != RES_IN
+# endif
+# if ENABLE_HUSH_CASE
+                 && ctx->ctx_res_w != RES_CASE
+# endif
+                ) {
+                        debug_printf_parse("checking '%s' for reserved-ness\n", word->data);
+                        if (reserved_word(word, ctx)) {
+                                o_reset_to_empty_unquoted(word);
+                                debug_printf_parse("done_word return %d\n",
+                                                (ctx->ctx_res_w == RES_SNTX));
+                                return (ctx->ctx_res_w == RES_SNTX);
+                        }
+# ifdef CMD_SINGLEWORD_NOGLOB_COND
+                        if (strcmp(word->data, "export") == 0
+#  if ENABLE_HUSH_LOCAL
+                         || strcmp(word->data, "local") == 0
+#  endif
+                        ) {
+                                command->cmd_type = CMD_SINGLEWORD_NOGLOB_COND;
+                        } else
+# endif
+# if ENABLE_HUSH_BASH_COMPAT
+                        if (strcmp(word->data, "[[") == 0) {
+                                command->cmd_type = CMD_SINGLEWORD_NOGLOB;
+                        }
+                        /* fall through */
+# endif
+                }
+#endif
+                if (command->group) {
+                        /* "{ echo foo; } echo bar" - bad */
+                        syntax_error_at(word->data);
+                        debug_printf_parse("done_word return 1: syntax error, "
+                                        "groups and arglists don't mix\n");
+                        return 1;
+                }
+                if (word->has_quoted_part
+                 /* optimization: and if it's ("" or '') or ($v... or `cmd`...): */
+                 && (word->data[0] == '\0' || word->data[0] == SPECIAL_VAR_SYMBOL)
+                 /* (otherwise it's known to be not empty and is already safe) */
+                ) {
+                        /* exclude "$@" - it can expand to no word despite "" */
+                        char *p = word->data;
+                        while (p[0] == SPECIAL_VAR_SYMBOL
+                            && (p[1] & 0x7f) == '@'
+                            && p[2] == SPECIAL_VAR_SYMBOL
+                        ) {
+                                p += 3;
+                        }
+                        if (p == word->data || p[0] != '\0') {
+                                /* saw no "$@", or not only "$@" but some
+                                 * real text is there too */
+                                /* insert "empty variable" reference, this makes
+                                 * e.g. "", $empty"" etc to not disappear */
+                                o_addchr(word, SPECIAL_VAR_SYMBOL);
+                                o_addchr(word, SPECIAL_VAR_SYMBOL);
+                        }
+                }
+                command->argv = add_string_to_strings(command->argv, xstrdup(word->data));
+                debug_print_strings("word appended to argv", command->argv);
+        }
+
+#if ENABLE_HUSH_LOOPS
+        if (ctx->ctx_res_w == RES_FOR) {
+                if (word->has_quoted_part
+                 || !is_well_formed_var_name(command->argv[0], '\0')
+                ) {
+                        /* bash says just "not a valid identifier" */
+                        syntax_error("not a valid identifier in for");
+                        return 1;
+                }
+                /* Force FOR to have just one word (variable name) */
+                /* NB: basically, this makes hush see "for v in ..."
+                 * syntax as if it is "for v; in ...". FOR and IN become
+                 * two pipe structs in parse tree. */
+                done_pipe(ctx, PIPE_SEQ);
+        }
+#endif
+#if ENABLE_HUSH_CASE
+        /* Force CASE to have just one word */
+        if (ctx->ctx_res_w == RES_CASE) {
+                done_pipe(ctx, PIPE_SEQ);
+        }
+#endif
+
+        o_reset_to_empty_unquoted(word);
+
+        debug_printf_parse("done_word return 0\n");
+        return 0;
+}
+
+
+/* Peek ahead in the input to find out if we have a "&n" construct,
+ * as in "2>&1", that represents duplicating a file descriptor.
+ * Return:
+ * REDIRFD_CLOSE if >&- "close fd" construct is seen,
+ * REDIRFD_SYNTAX_ERR if syntax error,
+ * REDIRFD_TO_FILE if no & was seen,
+ * or the number found.
+ */
+#if BB_MMU
+#define parse_redir_right_fd(as_string, input) \
+        parse_redir_right_fd(input)
+#endif
+static int parse_redir_right_fd(o_string *as_string, struct in_str *input)
+{
+        int ch, d, ok;
+
+        ch = i_peek(input);
+        if (ch != '&')
+                return REDIRFD_TO_FILE;
+
+        ch = i_getch(input);  /* get the & */
+        nommu_addchr(as_string, ch);
+        ch = i_peek(input);
+        if (ch == '-') {
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+                return REDIRFD_CLOSE;
+        }
+        d = 0;
+        ok = 0;
+        while (ch != EOF && isdigit(ch)) {
+                d = d*10 + (ch-'0');
+                ok = 1;
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+                ch = i_peek(input);
+        }
+        if (ok) return d;
+
+//TODO: this is the place to catch ">&file" bashism (redirect both fd 1 and 2)
+
+        bb_error_msg("ambiguous redirect");
+        return REDIRFD_SYNTAX_ERR;
+}
+
+/* Return code is 0 normal, 1 if a syntax error is detected
+ */
+static int parse_redirect(struct parse_context *ctx,
+                int fd,
+                redir_type style,
+                struct in_str *input)
+{
+        struct command *command = ctx->command;
+        struct redir_struct *redir;
+        struct redir_struct **redirp;
+        int dup_num;
+
+        dup_num = REDIRFD_TO_FILE;
+        if (style != REDIRECT_HEREDOC) {
+                /* Check for a '>&1' type redirect */
+                dup_num = parse_redir_right_fd(&ctx->as_string, input);
+                if (dup_num == REDIRFD_SYNTAX_ERR)
+                        return 1;
+        } else {
+                int ch = i_peek(input);
+                dup_num = (ch == '-'); /* HEREDOC_SKIPTABS bit is 1 */
+                if (dup_num) { /* <<-... */
+                        ch = i_getch(input);
+                        nommu_addchr(&ctx->as_string, ch);
+                        ch = i_peek(input);
+                }
+        }
+
+        if (style == REDIRECT_OVERWRITE && dup_num == REDIRFD_TO_FILE) {
+                int ch = i_peek(input);
+                if (ch == '|') {
+                        /* >|FILE redirect ("clobbering" >).
+                         * Since we do not support "set -o noclobber" yet,
+                         * >| and > are the same for now. Just eat |.
+                         */
+                        ch = i_getch(input);
+                        nommu_addchr(&ctx->as_string, ch);
+                }
+        }
+
+        /* Create a new redir_struct and append it to the linked list */
+        redirp = &command->redirects;
+        while ((redir = *redirp) != NULL) {
+                redirp = &(redir->next);
+        }
+        *redirp = redir = xzalloc(sizeof(*redir));
+        /* redir->next = NULL; */
+        /* redir->rd_filename = NULL; */
+        redir->rd_type = style;
+        redir->rd_fd = (fd == -1) ? redir_table[style].default_fd : fd;
+
+        debug_printf_parse("redirect type %d %s\n", redir->rd_fd,
+                                redir_table[style].descrip);
+
+        redir->rd_dup = dup_num;
+        if (style != REDIRECT_HEREDOC && dup_num != REDIRFD_TO_FILE) {
+                /* Erik had a check here that the file descriptor in question
+                 * is legit; I postpone that to "run time"
+                 * A "-" representation of "close me" shows up as a -3 here */
+                debug_printf_parse("duplicating redirect '%d>&%d'\n",
+                                redir->rd_fd, redir->rd_dup);
+        } else {
+                /* Set ctx->pending_redirect, so we know what to do at the
+                 * end of the next parsed word. */
+                ctx->pending_redirect = redir;
+        }
+        return 0;
+}
+
+/* If a redirect is immediately preceded by a number, that number is
+ * supposed to tell which file descriptor to redirect.  This routine
+ * looks for such preceding numbers.  In an ideal world this routine
+ * needs to handle all the following classes of redirects...
+ *     echo 2>foo     # redirects fd  2 to file "foo", nothing passed to echo
+ *     echo 49>foo    # redirects fd 49 to file "foo", nothing passed to echo
+ *     echo -2>foo    # redirects fd  1 to file "foo",    "-2" passed to echo
+ *     echo 49x>foo   # redirects fd  1 to file "foo",   "49x" passed to echo
+ *
+ * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
+ * "2.7 Redirection
+ * ... If n is quoted, the number shall not be recognized as part of
+ * the redirection expression. For example:
+ * echo \2>a
+ * writes the character 2 into file a"
+ * We are getting it right by setting ->has_quoted_part on any \<char>
+ *
+ * A -1 return means no valid number was found,
+ * the caller should use the appropriate default for this redirection.
+ */
+static int redirect_opt_num(o_string *o)
+{
+        int num;
+
+        if (o->data == NULL)
+                return -1;
+        num = bb_strtou(o->data, NULL, 10);
+        if (errno || num < 0)
+                return -1;
+        o_reset_to_empty_unquoted(o);
+        return num;
+}
+
+#if BB_MMU
+#define fetch_till_str(as_string, input, word, skip_tabs) \
+        fetch_till_str(input, word, skip_tabs)
+#endif
+static char *fetch_till_str(o_string *as_string,
+                struct in_str *input,
+                const char *word,
+                int skip_tabs)
+{
+        o_string heredoc = NULL_O_STRING;
+        int past_EOL = 0;
+        int ch;
+
+        goto jump_in;
+        while (1) {
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+                if (ch == '\n') {
+                        if (strcmp(heredoc.data + past_EOL, word) == 0) {
+                                heredoc.data[past_EOL] = '\0';
+                                debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
+                                return heredoc.data;
+                        }
+                        do {
+                                o_addchr(&heredoc, ch);
+                                past_EOL = heredoc.length;
+ jump_in:
+                                do {
+                                        ch = i_getch(input);
+                                        nommu_addchr(as_string, ch);
+                                } while (skip_tabs && ch == '\t');
+                        } while (ch == '\n');
+                }
+                if (ch == EOF) {
+                        o_free_unsafe(&heredoc);
+                        return NULL;
+                }
+                o_addchr(&heredoc, ch);
+                nommu_addchr(as_string, ch);
+        }
+}
+
+/* Look at entire parse tree for not-yet-loaded REDIRECT_HEREDOCs
+ * and load them all. There should be exactly heredoc_cnt of them.
+ */
+static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_str *input)
+{
+        struct pipe *pi = ctx->list_head;
+
+        while (pi && heredoc_cnt) {
+                int i;
+                struct command *cmd = pi->cmds;
+
+                debug_printf_parse("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
+                                pi->num_cmds,
+                                cmd->argv ? cmd->argv[0] : "NONE");
+                for (i = 0; i < pi->num_cmds; i++) {
+                        struct redir_struct *redir = cmd->redirects;
+
+                        debug_printf_parse("fetch_heredocs: %d cmd argv0:'%s'\n",
+                                        i, cmd->argv ? cmd->argv[0] : "NONE");
+                        while (redir) {
+                                if (redir->rd_type == REDIRECT_HEREDOC) {
+                                        char *p;
+
+                                        redir->rd_type = REDIRECT_HEREDOC2;
+                                        /* redir->rd_dup is (ab)used to indicate <<- */
+                                        p = fetch_till_str(&ctx->as_string, input,
+                                                redir->rd_filename, redir->rd_dup & HEREDOC_SKIPTABS);
+                                        if (!p) {
+                                                syntax_error("unexpected EOF in here document");
+                                                return 1;
+                                        }
+                                        free(redir->rd_filename);
+                                        redir->rd_filename = p;
+                                        heredoc_cnt--;
+                                }
+                                redir = redir->next;
+                        }
+                        cmd++;
+                }
+                pi = pi->next;
+        }
+#if 0
+        /* Should be 0. If it isn't, it's a parse error */
+        if (heredoc_cnt)
+                bb_error_msg_and_die("heredoc BUG 2");
+#endif
+        return 0;
+}
+
+
+static int run_list(struct pipe *pi);
+#if BB_MMU
+#define parse_stream(pstring, input, end_trigger) \
+        parse_stream(input, end_trigger)
+#endif
+static struct pipe *parse_stream(char **pstring,
+                struct in_str *input,
+                int end_trigger);
+
+
+#if !ENABLE_HUSH_FUNCTIONS
+#define parse_group(dest, ctx, input, ch) \
+        parse_group(ctx, input, ch)
+#endif
+static int parse_group(o_string *dest, struct parse_context *ctx,
+        struct in_str *input, int ch)
+{
+        /* dest contains characters seen prior to ( or {.
+         * Typically it's empty, but for function defs,
+         * it contains function name (without '()'). */
+        struct pipe *pipe_list;
+        int endch;
+        struct command *command = ctx->command;
+
+        debug_printf_parse("parse_group entered\n");
+#if ENABLE_HUSH_FUNCTIONS
+        if (ch == '(' && !dest->has_quoted_part) {
+                if (dest->length)
+                        if (done_word(dest, ctx))
+                                return 1;
+                if (!command->argv)
+                        goto skip; /* (... */
+                if (command->argv[1]) { /* word word ... (... */
+                        syntax_error_unexpected_ch('(');
+                        return 1;
+                }
+                /* it is "word(..." or "word (..." */
+                do
+                        ch = i_getch(input);
+                while (ch == ' ' || ch == '\t');
+                if (ch != ')') {
+                        syntax_error_unexpected_ch(ch);
+                        return 1;
+                }
+                nommu_addchr(&ctx->as_string, ch);
+                do
+                        ch = i_getch(input);
+                while (ch == ' ' || ch == '\t' || ch == '\n');
+                if (ch != '{') {
+                        syntax_error_unexpected_ch(ch);
+                        return 1;
+                }
+                nommu_addchr(&ctx->as_string, ch);
+                command->cmd_type = CMD_FUNCDEF;
+                goto skip;
+        }
+#endif
+
+#if 0 /* Prevented by caller */
+        if (command->argv /* word [word]{... */
+         || dest->length /* word{... */
+         || dest->has_quoted_part /* ""{... */
+        ) {
+                syntax_error(NULL);
+                debug_printf_parse("parse_group return 1: "
+                        "syntax error, groups and arglists don't mix\n");
+                return 1;
+        }
+#endif
+
+#if ENABLE_HUSH_FUNCTIONS
+ skip:
+#endif
+        endch = '}';
+        if (ch == '(') {
+                endch = ')';
+                command->cmd_type = CMD_SUBSHELL;
+        } else {
+                /* bash does not allow "{echo...", requires whitespace */
+                ch = i_getch(input);
+                if (ch != ' ' && ch != '\t' && ch != '\n') {
+                        syntax_error_unexpected_ch(ch);
+                        return 1;
+                }
+                nommu_addchr(&ctx->as_string, ch);
+        }
+
+        {
+#if BB_MMU
+# define as_string NULL
+#else
+                char *as_string = NULL;
+#endif
+                pipe_list = parse_stream(&as_string, input, endch);
+#if !BB_MMU
+                if (as_string)
+                        o_addstr(&ctx->as_string, as_string);
+#endif
+                /* empty ()/{} or parse error? */
+                if (!pipe_list || pipe_list == ERR_PTR) {
+                        /* parse_stream already emitted error msg */
+                        if (!BB_MMU)
+                                free(as_string);
+                        debug_printf_parse("parse_group return 1: "
+                                "parse_stream returned %p\n", pipe_list);
+                        return 1;
+                }
+                command->group = pipe_list;
+#if !BB_MMU
+                as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
+                command->group_as_string = as_string;
+                debug_printf_parse("end of group, remembering as:'%s'\n",
+                                command->group_as_string);
+#endif
+#undef as_string
+        }
+        debug_printf_parse("parse_group return 0\n");
+        return 0;
+        /* command remains "open", available for possible redirects */
+}
+
+#if ENABLE_HUSH_TICK || ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_DOLLAR_OPS
+/* Subroutines for copying $(...) and `...` things */
+static void add_till_backquote(o_string *dest, struct in_str *input);
+/* '...' */
+static void add_till_single_quote(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = i_getch(input);
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('\'');
+                        /*xfunc_die(); - redundant */
+                }
+                if (ch == '\'')
+                        return;
+                o_addchr(dest, ch);
+        }
+}
+/* "...\"...`..`...." - do we need to handle "...$(..)..." too? */
+static void add_till_double_quote(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = i_getch(input);
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('"');
+                        /*xfunc_die(); - redundant */
+                }
+                if (ch == '"')
+                        return;
+                if (ch == '\\') {  /* \x. Copy both chars. */
+                        o_addchr(dest, ch);
+                        ch = i_getch(input);
+                }
+                o_addchr(dest, ch);
+                if (ch == '`') {
+                        add_till_backquote(dest, input);
+                        o_addchr(dest, ch);
+                        continue;
+                }
+                //if (ch == '$') ...
+        }
+}
+/* Process `cmd` - copy contents until "`" is seen. Complicated by
+ * \` quoting.
+ * "Within the backquoted style of command substitution, backslash
+ * shall retain its literal meaning, except when followed by: '$', '`', or '\'.
+ * The search for the matching backquote shall be satisfied by the first
+ * backquote found without a preceding backslash; during this search,
+ * if a non-escaped backquote is encountered within a shell comment,
+ * a here-document, an embedded command substitution of the $(command)
+ * form, or a quoted string, undefined results occur. A single-quoted
+ * or double-quoted string that begins, but does not end, within the
+ * "`...`" sequence produces undefined results."
+ * Example                               Output
+ * echo `echo '\'TEST\`echo ZZ\`BEST`    \TESTZZBEST
+ */
+static void add_till_backquote(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = i_getch(input);
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('`');
+                        /*xfunc_die(); - redundant */
+                }
+                if (ch == '`')
+                        return;
+                if (ch == '\\') {
+                        /* \x. Copy both chars unless it is \` */
+                        int ch2 = i_getch(input);
+                        if (ch2 == EOF) {
+                                syntax_error_unterm_ch('`');
+                                /*xfunc_die(); - redundant */
+                        }
+                        if (ch2 != '`' && ch2 != '$' && ch2 != '\\')
+                                o_addchr(dest, ch);
+                        ch = ch2;
+                }
+                o_addchr(dest, ch);
+        }
+}
+/* Process $(cmd) - copy contents until ")" is seen. Complicated by
+ * quoting and nested ()s.
+ * "With the $(command) style of command substitution, all characters
+ * following the open parenthesis to the matching closing parenthesis
+ * constitute the command. Any valid shell script can be used for command,
+ * except a script consisting solely of redirections which produces
+ * unspecified results."
+ * Example                              Output
+ * echo $(echo '(TEST)' BEST)           (TEST) BEST
+ * echo $(echo 'TEST)' BEST)            TEST) BEST
+ * echo $(echo \(\(TEST\) BEST)         ((TEST) BEST
+ *
+ * Also adapted to eat ${var%...} and $((...)) constructs, since ... part
+ * can contain arbitrary constructs, just like $(cmd).
+ * In bash compat mode, it needs to also be able to stop on ':' or '/'
+ * for ${var:N[:M]} and ${var/P[/R]} parsing.
+ */
+#define DOUBLE_CLOSE_CHAR_FLAG 0x80
+static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsigned end_ch)
+{
+        int ch;
+        char dbl = end_ch & DOUBLE_CLOSE_CHAR_FLAG;
+# if ENABLE_HUSH_BASH_COMPAT
+        char end_char2 = end_ch >> 8;
+# endif
+        end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
+
+        while (1) {
+                ch = i_getch(input);
+                if (ch == EOF) {
+                        syntax_error_unterm_ch(end_ch);
+                        /*xfunc_die(); - redundant */
+                }
+                if (ch == end_ch  IF_HUSH_BASH_COMPAT( || ch == end_char2)) {
+                        if (!dbl)
+                                break;
+                        /* we look for closing )) of $((EXPR)) */
+                        if (i_peek(input) == end_ch) {
+                                i_getch(input); /* eat second ')' */
+                                break;
+                        }
+                }
+                o_addchr(dest, ch);
+                if (ch == '(' || ch == '{') {
+                        ch = (ch == '(' ? ')' : '}');
+                        add_till_closing_bracket(dest, input, ch);
+                        o_addchr(dest, ch);
+                        continue;
+                }
+                if (ch == '\'') {
+                        add_till_single_quote(dest, input);
+                        o_addchr(dest, ch);
+                        continue;
+                }
+                if (ch == '"') {
+                        add_till_double_quote(dest, input);
+                        o_addchr(dest, ch);
+                        continue;
+                }
+                if (ch == '`') {
+                        add_till_backquote(dest, input);
+                        o_addchr(dest, ch);
+                        continue;
+                }
+                if (ch == '\\') {
+                        /* \x. Copy verbatim. Important for  \(, \) */
+                        ch = i_getch(input);
+                        if (ch == EOF) {
+                                syntax_error_unterm_ch(')');
+                                /*xfunc_die(); - redundant */
+                        }
+                        o_addchr(dest, ch);
+                        continue;
+                }
+        }
+        return ch;
+}
+#endif /* ENABLE_HUSH_TICK || ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_DOLLAR_OPS */
+
+/* Return code: 0 for OK, 1 for syntax error */
+#if BB_MMU
+#define parse_dollar(as_string, dest, input) \
+        parse_dollar(dest, input)
+#define as_string NULL
+#endif
+static int parse_dollar(o_string *as_string,
+                o_string *dest,
+                struct in_str *input)
+{
+        int ch = i_peek(input);  /* first character after the $ */
+        unsigned char quote_mask = dest->o_escape ? 0x80 : 0;
+
+        debug_printf_parse("parse_dollar entered: ch='%c'\n", ch);
+        if (isalpha(ch)) {
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+ make_var:
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                while (1) {
+                        debug_printf_parse(": '%c'\n", ch);
+                        o_addchr(dest, ch | quote_mask);
+                        quote_mask = 0;
+                        ch = i_peek(input);
+                        if (!isalnum(ch) && ch != '_')
+                                break;
+                        ch = i_getch(input);
+                        nommu_addchr(as_string, ch);
+                }
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+        } else if (isdigit(ch)) {
+ make_one_char_var:
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                debug_printf_parse(": '%c'\n", ch);
+                o_addchr(dest, ch | quote_mask);
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+        } else switch (ch) {
+        case '$': /* pid */
+        case '!': /* last bg pid */
+        case '?': /* last exit code */
+        case '#': /* number of args */
+        case '*': /* args */
+        case '@': /* args */
+                goto make_one_char_var;
+        case '{': {
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+
+                ch = i_getch(input); /* eat '{' */
+                nommu_addchr(as_string, ch);
+
+                ch = i_getch(input); /* first char after '{' */
+                nommu_addchr(as_string, ch);
+                /* It should be ${?}, or ${#var},
+                 * or even ${?+subst} - operator acting on a special variable,
+                 * or the beginning of variable name.
+                 */
+                if (!strchr(_SPECIAL_VARS_STR, ch) && !isalnum(ch)) { /* not one of those */
+ bad_dollar_syntax:
+                        syntax_error_unterm_str("${name}");
+                        debug_printf_parse("parse_dollar return 1: unterminated ${name}\n");
+                        return 1;
+                }
+                ch |= quote_mask;
+
+                /* It's possible to just call add_till_closing_bracket() at this point.
+                 * However, this regresses some of our testsuite cases
+                 * which check invalid constructs like ${%}.
+                 * Oh well... let's check that the var name part is fine... */
+
+                while (1) {
+                        unsigned pos;
+
+                        o_addchr(dest, ch);
+                        debug_printf_parse(": '%c'\n", ch);
+
+                        ch = i_getch(input);
+                        nommu_addchr(as_string, ch);
+                        if (ch == '}')
+                                break;
+
+                        if (!isalnum(ch) && ch != '_') {
+                                unsigned end_ch;
+                                unsigned char last_ch;
+                                /* handle parameter expansions
+                                 * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_06_02
+                                 */
+                                if (!strchr(VAR_SUBST_OPS, ch)) /* ${var<bad_char>... */
+                                        goto bad_dollar_syntax;
+
+                                /* Eat everything until closing '}' (or ':') */
+                                end_ch = '}';
+                                if (ENABLE_HUSH_BASH_COMPAT
+                                 && ch == ':'
+                                 && !strchr(MINUS_PLUS_EQUAL_QUESTION, i_peek(input))
+                                ) {
+                                        /* It's ${var:N[:M]} thing */
+                                        end_ch = '}' * 0x100 + ':';
+                                }
+                                if (ENABLE_HUSH_BASH_COMPAT
+                                 && ch == '/'
+                                ) {
+                                        /* It's ${var/[/]pattern[/repl]} thing */
+                                        if (i_peek(input) == '/') { /* ${var//pattern[/repl]}? */
+                                                i_getch(input);
+                                                nommu_addchr(as_string, '/');
+                                                ch = '\\';
+                                        }
+                                        end_ch = '}' * 0x100 + '/';
+                                }
+                                o_addchr(dest, ch);
+ again:
+                                if (!BB_MMU)
+                                        pos = dest->length;
+#if ENABLE_HUSH_DOLLAR_OPS
+                                last_ch = add_till_closing_bracket(dest, input, end_ch);
+#else
+#error Simple code to only allow ${var} is not implemented
+#endif
+                                if (as_string) {
+                                        o_addstr(as_string, dest->data + pos);
+                                        o_addchr(as_string, last_ch);
+                                }
+
+                                if (ENABLE_HUSH_BASH_COMPAT && (end_ch & 0xff00)) {
+                                        /* close the first block: */
+                                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                                        /* while parsing N from ${var:N[:M]}
+                                         * or pattern from ${var/[/]pattern[/repl]} */
+                                        if ((end_ch & 0xff) == last_ch) {
+                                                /* got ':' or '/'- parse the rest */
+                                                end_ch = '}';
+                                                goto again;
+                                        }
+                                        /* got '}' */
+                                        if (end_ch == '}' * 0x100 + ':') {
+                                                /* it's ${var:N} - emulate :999999999 */
+                                                o_addstr(dest, "999999999");
+                                        } /* else: it's ${var/[/]pattern} */
+                                }
+                                break;
+                        }
+                }
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                break;
+        }
+#if ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_TICK
+        case '(': {
+                unsigned pos;
+
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+# if ENABLE_SH_MATH_SUPPORT
+                if (i_peek(input) == '(') {
+                        ch = i_getch(input);
+                        nommu_addchr(as_string, ch);
+                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(dest, /*quote_mask |*/ '+');
+                        if (!BB_MMU)
+                                pos = dest->length;
+                        add_till_closing_bracket(dest, input, ')' | DOUBLE_CLOSE_CHAR_FLAG);
+                        if (as_string) {
+                                o_addstr(as_string, dest->data + pos);
+                                o_addchr(as_string, ')');
+                                o_addchr(as_string, ')');
+                        }
+                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                        break;
+                }
+# endif
+# if ENABLE_HUSH_TICK
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                o_addchr(dest, quote_mask | '`');
+                if (!BB_MMU)
+                        pos = dest->length;
+                add_till_closing_bracket(dest, input, ')');
+                if (as_string) {
+                        o_addstr(as_string, dest->data + pos);
+                        o_addchr(as_string, ')');
+                }
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+# endif
+                break;
+        }
+#endif
+        case '_':
+                ch = i_getch(input);
+                nommu_addchr(as_string, ch);
+                ch = i_peek(input);
+                if (isalnum(ch)) { /* it's $_name or $_123 */
+                        ch = '_';
+                        goto make_var;
+                }
+                /* else: it's $_ */
+        /* TODO: $_ and $-: */
+        /* $_ Shell or shell script name; or last argument of last command
+         * (if last command wasn't a pipe; if it was, bash sets $_ to "");
+         * but in command's env, set to full pathname used to invoke it */
+        /* $- Option flags set by set builtin or shell options (-i etc) */
+        default:
+                o_addQchr(dest, '$');
+        }
+        debug_printf_parse("parse_dollar return 0\n");
+        return 0;
+#undef as_string
+}
+
 #if BB_MMU
 #define parse_stream_dquoted(as_string, dest, input, dquote_end) \
         parse_stream_dquoted(dest, input, dquote_end)
+#define as_string NULL
 #endif
 static int parse_stream_dquoted(o_string *as_string,
                 o_string *dest,
                 struct in_str *input,
-                int dquote_end);
+                int dquote_end)
+{
+        int ch;
+        int next;
+
+ again:
+        ch = i_getch(input);
+        if (ch != EOF)
+                nommu_addchr(as_string, ch);
+        if (ch == dquote_end) { /* may be only '"' or EOF */
+                if (dest->o_assignment == NOT_ASSIGNMENT)
+                        dest->o_escape ^= 1;
+                debug_printf_parse("parse_stream_dquoted return 0\n");
+                return 0;
+        }
+        /* note: can't move it above ch == dquote_end check! */
+        if (ch == EOF) {
+                syntax_error_unterm_ch('"');
+                /*xfunc_die(); - redundant */
+        }
+        next = '\0';
+        if (ch != '\n') {
+                next = i_peek(input);
+        }
+        debug_printf_parse("\" ch=%c (%d) escape=%d\n",
+                                        ch, ch, dest->o_escape);
+        if (ch == '\\') {
+                if (next == EOF) {
+                        syntax_error("\\<eof>");
+                        xfunc_die();
+                }
+                /* bash:
+                 * "The backslash retains its special meaning [in "..."]
+                 * only when followed by one of the following characters:
+                 * $, `, ", \, or <newline>.  A double quote may be quoted
+                 * within double quotes by preceding it with a backslash."
+                 */
+                if (strchr("$`\"\\\n", next) != NULL) {
+                        ch = i_getch(input);
+                        if (ch != '\n') {
+                                o_addqchr(dest, ch);
+                                nommu_addchr(as_string, ch);
+                        }
+                } else {
+                        o_addqchr(dest, '\\');
+                        nommu_addchr(as_string, '\\');
+                }
+                goto again;
+        }
+        if (ch == '$') {
+                if (parse_dollar(as_string, dest, input) != 0) {
+                        debug_printf_parse("parse_stream_dquoted return 1: "
+                                        "parse_dollar returned non-0\n");
+                        return 1;
+                }
+                goto again;
+        }
+#if ENABLE_HUSH_TICK
+        if (ch == '`') {
+                //unsigned pos = dest->length;
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                o_addchr(dest, 0x80 | '`');
+                add_till_backquote(dest, input);
+                o_addchr(dest, SPECIAL_VAR_SYMBOL);
+                //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
+                goto again;
+        }
+#endif
+        o_addQchr(dest, ch);
+        if (ch == '='
+         && (dest->o_assignment == MAYBE_ASSIGNMENT
+            || dest->o_assignment == WORD_IS_KEYWORD)
+         && is_well_formed_var_name(dest->data, '=')
+        ) {
+                dest->o_assignment = DEFINITELY_ASSIGNMENT;
+        }
+        goto again;
+#undef as_string
+}
+
+/*
+ * Scan input until EOF or end_trigger char.
+ * Return a list of pipes to execute, or NULL on EOF
+ * or if end_trigger character is met.
+ * On syntax error, exit is shell is not interactive,
+ * reset parsing machinery and start parsing anew,
+ * or return ERR_PTR.
+ */
+static struct pipe *parse_stream(char **pstring,
+                struct in_str *input,
+                int end_trigger)
+{
+        struct parse_context ctx;
+        o_string dest = NULL_O_STRING;
+        int is_in_dquote;
+        int heredoc_cnt;
+
+        /* Double-quote state is handled in the state variable is_in_dquote.
+         * A single-quote triggers a bypass of the main loop until its mate is
+         * found.  When recursing, quote state is passed in via dest->o_escape.
+         */
+        debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
+                        end_trigger ? end_trigger : 'X');
+        debug_enter();
+
+        /* If very first arg is "" or '', dest.data may end up NULL.
+         * Preventing this: */
+        o_addchr(&dest, '\0');
+        dest.length = 0;
+
+        G.ifs = get_local_var_value("IFS");
+        if (G.ifs == NULL)
+                G.ifs = defifs;
+
+ reset:
+#if ENABLE_HUSH_INTERACTIVE
+        input->promptmode = 0; /* PS1 */
+#endif
+        /* dest.o_assignment = MAYBE_ASSIGNMENT; - already is */
+        initialize_context(&ctx);
+        is_in_dquote = 0;
+        heredoc_cnt = 0;
+        while (1) {
+                const char *is_ifs;
+                const char *is_special;
+                int ch;
+                int next;
+                int redir_fd;
+                redir_type redir_style;
+
+                if (is_in_dquote) {
+                        /* dest.has_quoted_part = 1; - already is (see below) */
+                        if (parse_stream_dquoted(&ctx.as_string, &dest, input, '"')) {
+                                goto parse_error;
+                        }
+                        /* We reached closing '"' */
+                        is_in_dquote = 0;
+                }
+                ch = i_getch(input);
+                debug_printf_parse(": ch=%c (%d) escape=%d\n",
+                                                ch, ch, dest.o_escape);
+                if (ch == EOF) {
+                        struct pipe *pi;
+
+                        if (heredoc_cnt) {
+                                syntax_error_unterm_str("here document");
+                                goto parse_error;
+                        }
+                        /* end_trigger == '}' case errors out earlier,
+                         * checking only ')' */
+                        if (end_trigger == ')') {
+                                syntax_error_unterm_ch('('); /* exits */
+                                /* goto parse_error; */
+                        }
+
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        o_free(&dest);
+                        done_pipe(&ctx, PIPE_SEQ);
+                        pi = ctx.list_head;
+                        /* If we got nothing... */
+                        /* (this makes bare "&" cmd a no-op.
+                         * bash says: "syntax error near unexpected token '&'") */
+                        if (pi->num_cmds == 0
+                            IF_HAS_KEYWORDS( && pi->res_word == RES_NONE)
+                        ) {
+                                free_pipe_list(pi);
+                                pi = NULL;
+                        }
+#if !BB_MMU
+                        debug_printf_parse("as_string '%s'\n", ctx.as_string.data);
+                        if (pstring)
+                                *pstring = ctx.as_string.data;
+                        else
+                                o_free_unsafe(&ctx.as_string);
+#endif
+                        debug_leave();
+                        debug_printf_parse("parse_stream return %p\n", pi);
+                        return pi;
+                }
+                nommu_addchr(&ctx.as_string, ch);
+
+                next = '\0';
+                if (ch != '\n')
+                        next = i_peek(input);
+
+                is_special = "{}<>;&|()#'" /* special outside of "str" */
+                                "\\$\"" IF_HUSH_TICK("`"); /* always special */
+                /* Are { and } special here? */
+                if (ctx.command->argv /* word [word]{... - non-special */
+                 || dest.length       /* word{... - non-special */
+                 || dest.has_quoted_part     /* ""{... - non-special */
+                 || (next != ';'            /* }; - special */
+                    && next != ')'          /* }) - special */
+                    && next != '&'          /* }& and }&& ... - special */
+                    && next != '|'          /* }|| ... - special */
+                    && !strchr(G.ifs, next) /* {word - non-special */
+                    )
+                ) {
+                        /* They are not special, skip "{}" */
+                        is_special += 2;
+                }
+                is_special = strchr(is_special, ch);
+                is_ifs = strchr(G.ifs, ch);
+
+                if (!is_special && !is_ifs) { /* ordinary char */
+ ordinary_char:
+                        o_addQchr(&dest, ch);
+                        if ((dest.o_assignment == MAYBE_ASSIGNMENT
+                            || dest.o_assignment == WORD_IS_KEYWORD)
+                         && ch == '='
+                         && is_well_formed_var_name(dest.data, '=')
+                        ) {
+                                dest.o_assignment = DEFINITELY_ASSIGNMENT;
+                        }
+                        continue;
+                }
+
+                if (is_ifs) {
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        if (ch == '\n') {
+#if ENABLE_HUSH_CASE
+                                /* "case ... in <newline> word) ..." -
+                                 * newlines are ignored (but ';' wouldn't be) */
+                                if (ctx.command->argv == NULL
+                                 && ctx.ctx_res_w == RES_MATCH
+                                ) {
+                                        continue;
+                                }
+#endif
+                                /* Treat newline as a command separator. */
+                                done_pipe(&ctx, PIPE_SEQ);
+                                debug_printf_parse("heredoc_cnt:%d\n", heredoc_cnt);
+                                if (heredoc_cnt) {
+                                        if (fetch_heredocs(heredoc_cnt, &ctx, input)) {
+                                                goto parse_error;
+                                        }
+                                        heredoc_cnt = 0;
+                                }
+                                dest.o_assignment = MAYBE_ASSIGNMENT;
+                                ch = ';';
+                                /* note: if (is_ifs) continue;
+                                 * will still trigger for us */
+                        }
+                }
+
+                /* "cmd}" or "cmd }..." without semicolon or &:
+                 * } is an ordinary char in this case, even inside { cmd; }
+                 * Pathological example: { ""}; } should exec "}" cmd
+                 */
+                if (ch == '}') {
+                        if (!IS_NULL_CMD(ctx.command) /* cmd } */
+                         || dest.length != 0 /* word} */
+                         || dest.has_quoted_part    /* ""} */
+                        ) {
+                                goto ordinary_char;
+                        }
+                        if (!IS_NULL_PIPE(ctx.pipe)) /* cmd | } */
+                                goto skip_end_trigger;
+                        /* else: } does terminate a group */
+                }
+
+                if (end_trigger && end_trigger == ch
+                 && (ch != ';' || heredoc_cnt == 0)
+#if ENABLE_HUSH_CASE
+                 && (ch != ')'
+                    || ctx.ctx_res_w != RES_MATCH
+                    || (!dest.has_quoted_part && strcmp(dest.data, "esac") == 0)
+                    )
+#endif
+                ) {
+                        if (heredoc_cnt) {
+                                /* This is technically valid:
+                                 * { cat <<HERE; }; echo Ok
+                                 * heredoc
+                                 * heredoc
+                                 * HERE
+                                 * but we don't support this.
+                                 * We require heredoc to be in enclosing {}/(),
+                                 * if any.
+                                 */
+                                syntax_error_unterm_str("here document");
+                                goto parse_error;
+                        }
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        done_pipe(&ctx, PIPE_SEQ);
+                        dest.o_assignment = MAYBE_ASSIGNMENT;
+                        /* Do we sit outside of any if's, loops or case's? */
+                        if (!HAS_KEYWORDS
+                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
+                        ) {
+                                o_free(&dest);
+#if !BB_MMU
+                                debug_printf_parse("as_string '%s'\n", ctx.as_string.data);
+                                if (pstring)
+                                        *pstring = ctx.as_string.data;
+                                else
+                                        o_free_unsafe(&ctx.as_string);
+#endif
+                                debug_leave();
+                                debug_printf_parse("parse_stream return %p: "
+                                                "end_trigger char found\n",
+                                                ctx.list_head);
+                                return ctx.list_head;
+                        }
+                }
+ skip_end_trigger:
+                if (is_ifs)
+                        continue;
+
+                /* Catch <, > before deciding whether this word is
+                 * an assignment. a=1 2>z b=2: b=2 is still assignment */
+                switch (ch) {
+                case '>':
+                        redir_fd = redirect_opt_num(&dest);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        redir_style = REDIRECT_OVERWRITE;
+                        if (next == '>') {
+                                redir_style = REDIRECT_APPEND;
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx.as_string, ch);
+                        }
+#if 0
+                        else if (next == '(') {
+                                syntax_error(">(process) not supported");
+                                goto parse_error;
+                        }
+#endif
+                        if (parse_redirect(&ctx, redir_fd, redir_style, input))
+                                goto parse_error;
+                        continue; /* back to top of while (1) */
+                case '<':
+                        redir_fd = redirect_opt_num(&dest);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        redir_style = REDIRECT_INPUT;
+                        if (next == '<') {
+                                redir_style = REDIRECT_HEREDOC;
+                                heredoc_cnt++;
+                                debug_printf_parse("++heredoc_cnt=%d\n", heredoc_cnt);
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx.as_string, ch);
+                        } else if (next == '>') {
+                                redir_style = REDIRECT_IO;
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx.as_string, ch);
+                        }
+#if 0
+                        else if (next == '(') {
+                                syntax_error("<(process) not supported");
+                                goto parse_error;
+                        }
+#endif
+                        if (parse_redirect(&ctx, redir_fd, redir_style, input))
+                                goto parse_error;
+                        continue; /* back to top of while (1) */
+                }
+
+                if (dest.o_assignment == MAYBE_ASSIGNMENT
+                 /* check that we are not in word in "a=1 2>word b=1": */
+                 && !ctx.pending_redirect
+                ) {
+                        /* ch is a special char and thus this word
+                         * cannot be an assignment */
+                        dest.o_assignment = NOT_ASSIGNMENT;
+                }
+
+                /* Note: nommu_addchr(&ctx.as_string, ch) is already done */
+
+                switch (ch) {
+                case '#':
+                        if (dest.length == 0) {
+                                while (1) {
+                                        ch = i_peek(input);
+                                        if (ch == EOF || ch == '\n')
+                                                break;
+                                        i_getch(input);
+                                        /* note: we do not add it to &ctx.as_string */
+                                }
+                                nommu_addchr(&ctx.as_string, '\n');
+                        } else {
+                                o_addQchr(&dest, ch);
+                        }
+                        break;
+                case '\\':
+                        if (next == EOF) {
+                                syntax_error("\\<eof>");
+                                xfunc_die();
+                        }
+                        ch = i_getch(input);
+                        if (ch != '\n') {
+                                o_addchr(&dest, '\\');
+                                /*nommu_addchr(&ctx.as_string, '\\'); - already done */
+                                o_addchr(&dest, ch);
+                                nommu_addchr(&ctx.as_string, ch);
+                                /* Example: echo Hello \2>file
+                                 * we need to know that word 2 is quoted */
+                                dest.has_quoted_part = 1;
+                        }
+#if !BB_MMU
+                        else {
+                                /* It's "\<newline>". Remove trailing '\' from ctx.as_string */
+                                ctx.as_string.data[--ctx.as_string.length] = '\0';
+                        }
+#endif
+                        break;
+                case '$':
+                        if (parse_dollar(&ctx.as_string, &dest, input) != 0) {
+                                debug_printf_parse("parse_stream parse error: "
+                                        "parse_dollar returned non-0\n");
+                                goto parse_error;
+                        }
+                        break;
+                case '\'':
+                        dest.has_quoted_part = 1;
+                        while (1) {
+                                ch = i_getch(input);
+                                if (ch == EOF) {
+                                        syntax_error_unterm_ch('\'');
+                                        /*xfunc_die(); - redundant */
+                                }
+                                nommu_addchr(&ctx.as_string, ch);
+                                if (ch == '\'')
+                                        break;
+                                o_addqchr(&dest, ch);
+                        }
+                        break;
+                case '"':
+                        dest.has_quoted_part = 1;
+                        is_in_dquote ^= 1; /* invert */
+                        if (dest.o_assignment == NOT_ASSIGNMENT)
+                                dest.o_escape ^= 1;
+                        break;
+#if ENABLE_HUSH_TICK
+                case '`': {
+                        unsigned pos;
+
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(&dest, '`');
+                        pos = dest.length;
+                        add_till_backquote(&dest, input);
+# if !BB_MMU
+                        o_addstr(&ctx.as_string, dest.data + pos);
+                        o_addchr(&ctx.as_string, '`');
+# endif
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        //debug_printf_subst("SUBST RES3 '%s'\n", dest.data + pos);
+                        break;
+                }
+#endif
+                case ';':
+#if ENABLE_HUSH_CASE
+ case_semi:
+#endif
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        done_pipe(&ctx, PIPE_SEQ);
+#if ENABLE_HUSH_CASE
+                        /* Eat multiple semicolons, detect
+                         * whether it means something special */
+                        while (1) {
+                                ch = i_peek(input);
+                                if (ch != ';')
+                                        break;
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx.as_string, ch);
+                                if (ctx.ctx_res_w == RES_CASE_BODY) {
+                                        ctx.ctx_dsemicolon = 1;
+                                        ctx.ctx_res_w = RES_MATCH;
+                                        break;
+                                }
+                        }
+#endif
+ new_cmd:
+                        /* We just finished a cmd. New one may start
+                         * with an assignment */
+                        dest.o_assignment = MAYBE_ASSIGNMENT;
+                        break;
+                case '&':
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        if (next == '&') {
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx.as_string, ch);
+                                done_pipe(&ctx, PIPE_AND);
+                        } else {
+                                done_pipe(&ctx, PIPE_BG);
+                        }
+                        goto new_cmd;
+                case '|':
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+#if ENABLE_HUSH_CASE
+                        if (ctx.ctx_res_w == RES_MATCH)
+                                break; /* we are in case's "word | word)" */
+#endif
+                        if (next == '|') { /* || */
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx.as_string, ch);
+                                done_pipe(&ctx, PIPE_OR);
+                        } else {
+                                /* we could pick up a file descriptor choice here
+                                 * with redirect_opt_num(), but bash doesn't do it.
+                                 * "echo foo 2| cat" yields "foo 2". */
+                                done_command(&ctx);
+#if !BB_MMU
+                                o_reset_to_empty_unquoted(&ctx.as_string);
+#endif
+                        }
+                        goto new_cmd;
+                case '(':
+#if ENABLE_HUSH_CASE
+                        /* "case... in [(]word)..." - skip '(' */
+                        if (ctx.ctx_res_w == RES_MATCH
+                         && ctx.command->argv == NULL /* not (word|(... */
+                         && dest.length == 0 /* not word(... */
+                         && dest.has_quoted_part == 0 /* not ""(... */
+                        ) {
+                                continue;
+                        }
+#endif
+                case '{':
+                        if (parse_group(&dest, &ctx, input, ch) != 0) {
+                                goto parse_error;
+                        }
+                        goto new_cmd;
+                case ')':
+#if ENABLE_HUSH_CASE
+                        if (ctx.ctx_res_w == RES_MATCH)
+                                goto case_semi;
+#endif
+                case '}':
+                        /* proper use of this character is caught by end_trigger:
+                         * if we see {, we call parse_group(..., end_trigger='}')
+                         * and it will match } earlier (not here). */
+                        syntax_error_unexpected_ch(ch);
+                        goto parse_error;
+                default:
+                        if (HUSH_DEBUG)
+                                bb_error_msg_and_die("BUG: unexpected %c\n", ch);
+                }
+        } /* while (1) */
+
+ parse_error:
+        {
+                struct parse_context *pctx;
+                IF_HAS_KEYWORDS(struct parse_context *p2;)
+
+                /* Clean up allocated tree.
+                 * Sample for finding leaks on syntax error recovery path.
+                 * Run it from interactive shell, watch pmap `pidof hush`.
+                 * while if false; then false; fi; do break; fi
+                 * Samples to catch leaks at execution:
+                 * while if (true | {true;}); then echo ok; fi; do break; done
+                 * while if (true | {true;}); then echo ok; fi; do (if echo ok; break; then :; fi) | cat; break; done
+                 */
+                pctx = &ctx;
+                do {
+                        /* Update pipe/command counts,
+                         * otherwise freeing may miss some */
+                        done_pipe(pctx, PIPE_SEQ);
+                        debug_printf_clean("freeing list %p from ctx %p\n",
+                                        pctx->list_head, pctx);
+                        debug_print_tree(pctx->list_head, 0);
+                        free_pipe_list(pctx->list_head);
+                        debug_printf_clean("freed list %p\n", pctx->list_head);
+#if !BB_MMU
+                        o_free_unsafe(&pctx->as_string);
+#endif
+                        IF_HAS_KEYWORDS(p2 = pctx->stack;)
+                        if (pctx != &ctx) {
+                                free(pctx);
+                        }
+                        IF_HAS_KEYWORDS(pctx = p2;)
+                } while (HAS_KEYWORDS && pctx);
+                /* Free text, clear all dest fields */
+                o_free(&dest);
+                /* If we are not in top-level parse, we return,
+                 * our caller will propagate error.
+                 */
+                if (end_trigger != ';') {
+#if !BB_MMU
+                        if (pstring)
+                                *pstring = NULL;
+#endif
+                        debug_leave();
+                        return ERR_PTR;
+                }
+                /* Discard cached input, force prompt */
+                input->p = NULL;
+                IF_HUSH_INTERACTIVE(input->promptme = 1;)
+                goto reset;
+        }
+}
+
+
+/*** Execution routines ***/
+
+/* Expansion can recurse, need forward decls: */
+static char *expand_string_to_string(const char *str);
+static int process_command_subs(o_string *dest, const char *s);
 
 /* expand_strvec_to_strvec() takes a list of strings, expands
  * all variable references within and returns a pointer to
@@ -3463,6 +5307,194 @@ static void re_execute_shell(char ***to_free, const char *s,
 #endif  /* !BB_MMU */
 
 
+static int run_and_free_list(struct pipe *pi);
+
+/* Executing from string: eval, sh -c '...'
+ *          or from file: /etc/profile, . file, sh <script>, sh (intereactive)
+ * end_trigger controls how often we stop parsing
+ * NUL: parse all, execute, return
+ * ';': parse till ';' or newline, execute, repeat till EOF
+ */
+static void parse_and_run_stream(struct in_str *inp, int end_trigger)
+{
+        /* Why we need empty flag?
+         * An obscure corner case "false; ``; echo $?":
+         * empty command in `` should still set $? to 0.
+         * But we can't just set $? to 0 at the start,
+         * this breaks "false; echo `echo $?`" case.
+         */
+        bool empty = 1;
+        while (1) {
+                struct pipe *pipe_list;
+
+                pipe_list = parse_stream(NULL, inp, end_trigger);
+                if (!pipe_list) { /* EOF */
+                        if (empty)
+                                G.last_exitcode = 0;
+                        break;
+                }
+                debug_print_tree(pipe_list, 0);
+                debug_printf_exec("parse_and_run_stream: run_and_free_list\n");
+                run_and_free_list(pipe_list);
+                empty = 0;
+        }
+}
+
+static void parse_and_run_string(const char *s)
+{
+        struct in_str input;
+        setup_string_in_str(&input, s);
+        parse_and_run_stream(&input, '\0');
+}
+
+static void parse_and_run_file(FILE *f)
+{
+        struct in_str input;
+        setup_file_in_str(&input, f);
+        parse_and_run_stream(&input, ';');
+}
+
+#if ENABLE_HUSH_TICK
+static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
+{
+        pid_t pid;
+        int channel[2];
+# if !BB_MMU
+        char **to_free = NULL;
+# endif
+
+        xpipe(channel);
+        pid = BB_MMU ? xfork() : xvfork();
+        if (pid == 0) { /* child */
+                disable_restore_tty_pgrp_on_exit();
+                /* Process substitution is not considered to be usual
+                 * 'command execution'.
+                 * SUSv3 says ctrl-Z should be ignored, ctrl-C should not.
+                 */
+                bb_signals(0
+                        + (1 << SIGTSTP)
+                        + (1 << SIGTTIN)
+                        + (1 << SIGTTOU)
+                        , SIG_IGN);
+                CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
+                close(channel[0]); /* NB: close _first_, then move fd! */
+                xmove_fd(channel[1], 1);
+                /* Prevent it from trying to handle ctrl-z etc */
+                IF_HUSH_JOB(G.run_list_level = 1;)
+                /* Awful hack for `trap` or $(trap).
+                 *
+                 * http://www.opengroup.org/onlinepubs/009695399/utilities/trap.html
+                 * contains an example where "trap" is executed in a subshell:
+                 *
+                 * save_traps=$(trap)
+                 * ...
+                 * eval "$save_traps"
+                 *
+                 * Standard does not say that "trap" in subshell shall print
+                 * parent shell's traps. It only says that its output
+                 * must have suitable form, but then, in the above example
+                 * (which is not supposed to be normative), it implies that.
+                 *
+                 * bash (and probably other shell) does implement it
+                 * (traps are reset to defaults, but "trap" still shows them),
+                 * but as a result, "trap" logic is hopelessly messed up:
+                 *
+                 * # trap
+                 * trap -- 'echo Ho' SIGWINCH  <--- we have a handler
+                 * # (trap)        <--- trap is in subshell - no output (correct, traps are reset)
+                 * # true | trap   <--- trap is in subshell - no output (ditto)
+                 * # echo `true | trap`    <--- in subshell - output (but traps are reset!)
+                 * trap -- 'echo Ho' SIGWINCH
+                 * # echo `(trap)`         <--- in subshell in subshell - output
+                 * trap -- 'echo Ho' SIGWINCH
+                 * # echo `true | (trap)`  <--- in subshell in subshell in subshell - output!
+                 * trap -- 'echo Ho' SIGWINCH
+                 *
+                 * The rules when to forget and when to not forget traps
+                 * get really complex and nonsensical.
+                 *
+                 * Our solution: ONLY bare $(trap) or `trap` is special.
+                 */
+                s = skip_whitespace(s);
+                if (strncmp(s, "trap", 4) == 0
+                 && skip_whitespace(s + 4)[0] == '\0'
+                ) {
+                        static const char *const argv[] = { NULL, NULL };
+                        builtin_trap((char**)argv);
+                        exit(0); /* not _exit() - we need to fflush */
+                }
+# if BB_MMU
+                reset_traps_to_defaults();
+                parse_and_run_string(s);
+                _exit(G.last_exitcode);
+# else
+        /* We re-execute after vfork on NOMMU. This makes this script safe:
+         * yes "0123456789012345678901234567890" | dd bs=32 count=64k >BIG
+         * huge=`cat BIG` # was blocking here forever
+         * echo OK
+         */
+                re_execute_shell(&to_free,
+                                s,
+                                G.global_argv[0],
+                                G.global_argv + 1,
+                                NULL);
+# endif
+        }
+
+        /* parent */
+        *pid_p = pid;
+# if ENABLE_HUSH_FAST
+        G.count_SIGCHLD++;
+//bb_error_msg("[%d] fork in generate_stream_from_string:"
+//              " G.count_SIGCHLD:%d G.handled_SIGCHLD:%d",
+//              getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
+# endif
+        enable_restore_tty_pgrp_on_exit();
+# if !BB_MMU
+        free(to_free);
+# endif
+        close(channel[1]);
+        close_on_exec_on(channel[0]);
+        return xfdopen_for_read(channel[0]);
+}
+
+/* Return code is exit status of the process that is run. */
+static int process_command_subs(o_string *dest, const char *s)
+{
+        FILE *fp;
+        struct in_str pipe_str;
+        pid_t pid;
+        int status, ch, eol_cnt;
+
+        fp = generate_stream_from_string(s, &pid);
+
+        /* Now send results of command back into original context */
+        setup_file_in_str(&pipe_str, fp);
+        eol_cnt = 0;
+        while ((ch = i_getch(&pipe_str)) != EOF) {
+                if (ch == '\n') {
+                        eol_cnt++;
+                        continue;
+                }
+                while (eol_cnt) {
+                        o_addchr(dest, '\n');
+                        eol_cnt--;
+                }
+                o_addQchr(dest, ch);
+        }
+
+        debug_printf("done reading from `cmd` pipe, closing it\n");
+        fclose(fp);
+        /* We need to extract exitcode. Test case
+         * "true; echo `sleep 1; false` $?"
+         * should print 1 */
+        safe_waitpid(pid, &status, 0);
+        debug_printf("child exited. returning its exitcode:%d\n", WEXITSTATUS(status));
+        return WEXITSTATUS(status);
+}
+#endif /* ENABLE_HUSH_TICK */
+
+
 static void setup_heredoc(struct redir_struct *redir)
 {
         struct fd_pair pair;
@@ -3622,101 +5654,6 @@ static void restore_redirects(int squirrel[])
         }
 }
 
-
-static void free_pipe_list(struct pipe *head);
-
-/* Return code is the exit status of the pipe */
-static void free_pipe(struct pipe *pi)
-{
-        char **p;
-        struct command *command;
-        struct redir_struct *r, *rnext;
-        int a, i;
-
-        if (pi->stopped_cmds > 0) /* why? */
-                return;
-        debug_printf_clean("run pipe: (pid %d)\n", getpid());
-        for (i = 0; i < pi->num_cmds; i++) {
-                command = &pi->cmds[i];
-                debug_printf_clean("  command %d:\n", i);
-                if (command->argv) {
-                        for (a = 0, p = command->argv; *p; a++, p++) {
-                                debug_printf_clean("   argv[%d] = %s\n", a, *p);
-                        }
-                        free_strings(command->argv);
-                        command->argv = NULL;
-                }
-                /* not "else if": on syntax error, we may have both! */
-                if (command->group) {
-                        debug_printf_clean("   begin group (cmd_type:%d)\n",
-                                        command->cmd_type);
-                        free_pipe_list(command->group);
-                        debug_printf_clean("   end group\n");
-                        command->group = NULL;
-                }
-                /* else is crucial here.
-                 * If group != NULL, child_func is meaningless */
-#if ENABLE_HUSH_FUNCTIONS
-                else if (command->child_func) {
-                        debug_printf_exec("cmd %p releases child func at %p\n", command, command->child_func);
-                        command->child_func->parent_cmd = NULL;
-                }
-#endif
-#if !BB_MMU
-                free(command->group_as_string);
-                command->group_as_string = NULL;
-#endif
-                for (r = command->redirects; r; r = rnext) {
-                        debug_printf_clean("   redirect %d%s",
-                                        r->rd_fd, redir_table[r->rd_type].descrip);
-                        /* guard against the case >$FOO, where foo is unset or blank */
-                        if (r->rd_filename) {
-                                debug_printf_clean(" fname:'%s'\n", r->rd_filename);
-                                free(r->rd_filename);
-                                r->rd_filename = NULL;
-                        }
-                        debug_printf_clean(" rd_dup:%d\n", r->rd_dup);
-                        rnext = r->next;
-                        free(r);
-                }
-                command->redirects = NULL;
-        }
-        free(pi->cmds);   /* children are an array, they get freed all at once */
-        pi->cmds = NULL;
-#if ENABLE_HUSH_JOB
-        free(pi->cmdtext);
-        pi->cmdtext = NULL;
-#endif
-}
-
-static void free_pipe_list(struct pipe *head)
-{
-        struct pipe *pi, *next;
-
-        for (pi = head; pi; pi = next) {
-#if HAS_KEYWORDS
-                debug_printf_clean(" pipe reserved word %d\n", pi->res_word);
-#endif
-                free_pipe(pi);
-                debug_printf_clean("pipe followup code %d\n", pi->followup);
-                next = pi->next;
-                /*pi->next = NULL;*/
-                free(pi);
-        }
-}
-
-
-static int run_list(struct pipe *pi);
-#if BB_MMU
-#define parse_stream(pstring, input, end_trigger) \
-        parse_stream(input, end_trigger)
-#endif
-static struct pipe *parse_stream(char **pstring,
-                struct in_str *input,
-                int end_trigger);
-static void parse_and_run_string(const char *s);
-
-
 static char *find_in_path(const char *arg)
 {
         char *ret = NULL;
@@ -4482,7 +6419,11 @@ static int checkjobs_and_fg_shell(struct pipe* fg_pipe)
 #define redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel, char argv_expanded) \
         redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel)
 #endif
-static int redirect_and_varexp_helper(char ***new_env_p, struct variable **old_vars_p, struct command *command, int squirrel[3], char **argv_expanded)
+static int redirect_and_varexp_helper(char ***new_env_p,
+                struct variable **old_vars_p,
+                struct command *command,
+                int squirrel[3],
+                char **argv_expanded)
 {
         /* setup_redirects acts on file descriptors, not FILEs.
          * This is perfect for work that comes after exec().
@@ -5291,1947 +7232,6 @@ static int run_and_free_list(struct pipe *pi)
 }
 
 
-static struct pipe *new_pipe(void)
-{
-        struct pipe *pi;
-        pi = xzalloc(sizeof(struct pipe));
-        /*pi->followup = 0; - deliberately invalid value */
-        /*pi->res_word = RES_NONE; - RES_NONE is 0 anyway */
-        return pi;
-}
-
-/* Command (member of a pipe) is complete, or we start a new pipe
- * if ctx->command is NULL.
- * No errors possible here.
- */
-static int done_command(struct parse_context *ctx)
-{
-        /* The command is really already in the pipe structure, so
-         * advance the pipe counter and make a new, null command. */
-        struct pipe *pi = ctx->pipe;
-        struct command *command = ctx->command;
-
-        if (command) {
-                if (IS_NULL_CMD(command)) {
-                        debug_printf_parse("done_command: skipping null cmd, num_cmds=%d\n", pi->num_cmds);
-                        goto clear_and_ret;
-                }
-                pi->num_cmds++;
-                debug_printf_parse("done_command: ++num_cmds=%d\n", pi->num_cmds);
-                //debug_print_tree(ctx->list_head, 20);
-        } else {
-                debug_printf_parse("done_command: initializing, num_cmds=%d\n", pi->num_cmds);
-        }
-
-        /* Only real trickiness here is that the uncommitted
-         * command structure is not counted in pi->num_cmds. */
-        pi->cmds = xrealloc(pi->cmds, sizeof(*pi->cmds) * (pi->num_cmds+1));
-        ctx->command = command = &pi->cmds[pi->num_cmds];
- clear_and_ret:
-        memset(command, 0, sizeof(*command));
-        return pi->num_cmds; /* used only for 0/nonzero check */
-}
-
-static void done_pipe(struct parse_context *ctx, pipe_style type)
-{
-        int not_null;
-
-        debug_printf_parse("done_pipe entered, followup %d\n", type);
-        /* Close previous command */
-        not_null = done_command(ctx);
-        ctx->pipe->followup = type;
-#if HAS_KEYWORDS
-        ctx->pipe->pi_inverted = ctx->ctx_inverted;
-        ctx->ctx_inverted = 0;
-        ctx->pipe->res_word = ctx->ctx_res_w;
-#endif
-
-        /* Without this check, even just <enter> on command line generates
-         * tree of three NOPs (!). Which is harmless but annoying.
-         * IOW: it is safe to do it unconditionally. */
-        if (not_null
-#if ENABLE_HUSH_IF
-         || ctx->ctx_res_w == RES_FI
-#endif
-#if ENABLE_HUSH_LOOPS
-         || ctx->ctx_res_w == RES_DONE
-         || ctx->ctx_res_w == RES_FOR
-         || ctx->ctx_res_w == RES_IN
-#endif
-#if ENABLE_HUSH_CASE
-         || ctx->ctx_res_w == RES_ESAC
-#endif
-        ) {
-                struct pipe *new_p;
-                debug_printf_parse("done_pipe: adding new pipe: "
-                                "not_null:%d ctx->ctx_res_w:%d\n",
-                                not_null, ctx->ctx_res_w);
-                new_p = new_pipe();
-                ctx->pipe->next = new_p;
-                ctx->pipe = new_p;
-                /* RES_THEN, RES_DO etc are "sticky" -
-                 * they remain set for pipes inside if/while.
-                 * This is used to control execution.
-                 * RES_FOR and RES_IN are NOT sticky (needed to support
-                 * cases where variable or value happens to match a keyword):
-                 */
-#if ENABLE_HUSH_LOOPS
-                if (ctx->ctx_res_w == RES_FOR
-                 || ctx->ctx_res_w == RES_IN)
-                        ctx->ctx_res_w = RES_NONE;
-#endif
-#if ENABLE_HUSH_CASE
-                if (ctx->ctx_res_w == RES_MATCH)
-                        ctx->ctx_res_w = RES_CASE_BODY;
-                if (ctx->ctx_res_w == RES_CASE)
-                        ctx->ctx_res_w = RES_CASE_IN;
-#endif
-                ctx->command = NULL; /* trick done_command below */
-                /* Create the memory for command, roughly:
-                 * ctx->pipe->cmds = new struct command;
-                 * ctx->command = &ctx->pipe->cmds[0];
-                 */
-                done_command(ctx);
-                //debug_print_tree(ctx->list_head, 10);
-        }
-        debug_printf_parse("done_pipe return\n");
-}
-
-static void initialize_context(struct parse_context *ctx)
-{
-        memset(ctx, 0, sizeof(*ctx));
-        ctx->pipe = ctx->list_head = new_pipe();
-        /* Create the memory for command, roughly:
-         * ctx->pipe->cmds = new struct command;
-         * ctx->command = &ctx->pipe->cmds[0];
-         */
-        done_command(ctx);
-}
-
-/* If a reserved word is found and processed, parse context is modified
- * and 1 is returned.
- */
-#if HAS_KEYWORDS
-struct reserved_combo {
-        char literal[6];
-        unsigned char res;
-        unsigned char assignment_flag;
-        int flag;
-};
-enum {
-        FLAG_END   = (1 << RES_NONE ),
-# if ENABLE_HUSH_IF
-        FLAG_IF    = (1 << RES_IF   ),
-        FLAG_THEN  = (1 << RES_THEN ),
-        FLAG_ELIF  = (1 << RES_ELIF ),
-        FLAG_ELSE  = (1 << RES_ELSE ),
-        FLAG_FI    = (1 << RES_FI   ),
-# endif
-# if ENABLE_HUSH_LOOPS
-        FLAG_FOR   = (1 << RES_FOR  ),
-        FLAG_WHILE = (1 << RES_WHILE),
-        FLAG_UNTIL = (1 << RES_UNTIL),
-        FLAG_DO    = (1 << RES_DO   ),
-        FLAG_DONE  = (1 << RES_DONE ),
-        FLAG_IN    = (1 << RES_IN   ),
-# endif
-# if ENABLE_HUSH_CASE
-        FLAG_MATCH = (1 << RES_MATCH),
-        FLAG_ESAC  = (1 << RES_ESAC ),
-# endif
-        FLAG_START = (1 << RES_XXXX ),
-};
-
-static const struct reserved_combo* match_reserved_word(o_string *word)
-{
-        /* Mostly a list of accepted follow-up reserved words.
-         * FLAG_END means we are done with the sequence, and are ready
-         * to turn the compound list into a command.
-         * FLAG_START means the word must start a new compound list.
-         */
-        static const struct reserved_combo reserved_list[] = {
-# if ENABLE_HUSH_IF
-                { "!",     RES_NONE,  NOT_ASSIGNMENT , 0 },
-                { "if",    RES_IF,    WORD_IS_KEYWORD, FLAG_THEN | FLAG_START },
-                { "then",  RES_THEN,  WORD_IS_KEYWORD, FLAG_ELIF | FLAG_ELSE | FLAG_FI },
-                { "elif",  RES_ELIF,  WORD_IS_KEYWORD, FLAG_THEN },
-                { "else",  RES_ELSE,  WORD_IS_KEYWORD, FLAG_FI   },
-                { "fi",    RES_FI,    NOT_ASSIGNMENT , FLAG_END  },
-# endif
-# if ENABLE_HUSH_LOOPS
-                { "for",   RES_FOR,   NOT_ASSIGNMENT , FLAG_IN | FLAG_DO | FLAG_START },
-                { "while", RES_WHILE, WORD_IS_KEYWORD, FLAG_DO | FLAG_START },
-                { "until", RES_UNTIL, WORD_IS_KEYWORD, FLAG_DO | FLAG_START },
-                { "in",    RES_IN,    NOT_ASSIGNMENT , FLAG_DO   },
-                { "do",    RES_DO,    WORD_IS_KEYWORD, FLAG_DONE },
-                { "done",  RES_DONE,  NOT_ASSIGNMENT , FLAG_END  },
-# endif
-# if ENABLE_HUSH_CASE
-                { "case",  RES_CASE,  NOT_ASSIGNMENT , FLAG_MATCH | FLAG_START },
-                { "esac",  RES_ESAC,  NOT_ASSIGNMENT , FLAG_END  },
-# endif
-        };
-        const struct reserved_combo *r;
-
-        for (r = reserved_list; r < reserved_list + ARRAY_SIZE(reserved_list); r++) {
-                if (strcmp(word->data, r->literal) == 0)
-                        return r;
-        }
-        return NULL;
-}
-/* Return 0: not a keyword, 1: keyword
- */
-static int reserved_word(o_string *word, struct parse_context *ctx)
-{
-# if ENABLE_HUSH_CASE
-        static const struct reserved_combo reserved_match = {
-                "",        RES_MATCH, NOT_ASSIGNMENT , FLAG_MATCH | FLAG_ESAC
-        };
-# endif
-        const struct reserved_combo *r;
-
-        if (word->has_quoted_part)
-                return 0;
-        r = match_reserved_word(word);
-        if (!r)
-                return 0;
-
-        debug_printf("found reserved word %s, res %d\n", r->literal, r->res);
-# if ENABLE_HUSH_CASE
-        if (r->res == RES_IN && ctx->ctx_res_w == RES_CASE_IN) {
-                /* "case word IN ..." - IN part starts first MATCH part */
-                r = &reserved_match;
-        } else
-# endif
-        if (r->flag == 0) { /* '!' */
-                if (ctx->ctx_inverted) { /* bash doesn't accept '! ! true' */
-                        syntax_error("! ! command");
-                        ctx->ctx_res_w = RES_SNTX;
-                }
-                ctx->ctx_inverted = 1;
-                return 1;
-        }
-        if (r->flag & FLAG_START) {
-                struct parse_context *old;
-
-                old = xmalloc(sizeof(*old));
-                debug_printf_parse("push stack %p\n", old);
-                *old = *ctx;   /* physical copy */
-                initialize_context(ctx);
-                ctx->stack = old;
-        } else if (/*ctx->ctx_res_w == RES_NONE ||*/ !(ctx->old_flag & (1 << r->res))) {
-                syntax_error_at(word->data);
-                ctx->ctx_res_w = RES_SNTX;
-                return 1;
-        } else {
-                /* "{...} fi" is ok. "{...} if" is not
-                 * Example:
-                 * if { echo foo; } then { echo bar; } fi */
-                if (ctx->command->group)
-                        done_pipe(ctx, PIPE_SEQ);
-        }
-
-        ctx->ctx_res_w = r->res;
-        ctx->old_flag = r->flag;
-        word->o_assignment = r->assignment_flag;
-
-        if (ctx->old_flag & FLAG_END) {
-                struct parse_context *old;
-
-                done_pipe(ctx, PIPE_SEQ);
-                debug_printf_parse("pop stack %p\n", ctx->stack);
-                old = ctx->stack;
-                old->command->group = ctx->list_head;
-                old->command->cmd_type = CMD_NORMAL;
-# if !BB_MMU
-                o_addstr(&old->as_string, ctx->as_string.data);
-                o_free_unsafe(&ctx->as_string);
-                old->command->group_as_string = xstrdup(old->as_string.data);
-                debug_printf_parse("pop, remembering as:'%s'\n",
-                                old->command->group_as_string);
-# endif
-                *ctx = *old;   /* physical copy */
-                free(old);
-        }
-        return 1;
-}
-#endif /* HAS_KEYWORDS */
-
-/* Word is complete, look at it and update parsing context.
- * Normal return is 0. Syntax errors return 1.
- * Note: on return, word is reset, but not o_free'd!
- */
-static int done_word(o_string *word, struct parse_context *ctx)
-{
-        struct command *command = ctx->command;
-
-        debug_printf_parse("done_word entered: '%s' %p\n", word->data, command);
-        if (word->length == 0 && !word->has_quoted_part) {
-                debug_printf_parse("done_word return 0: true null, ignored\n");
-                return 0;
-        }
-
-        if (ctx->pending_redirect) {
-                /* We do not glob in e.g. >*.tmp case. bash seems to glob here
-                 * only if run as "bash", not "sh" */
-                /* http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
-                 * "2.7 Redirection
-                 * ...the word that follows the redirection operator
-                 * shall be subjected to tilde expansion, parameter expansion,
-                 * command substitution, arithmetic expansion, and quote
-                 * removal. Pathname expansion shall not be performed
-                 * on the word by a non-interactive shell; an interactive
-                 * shell may perform it, but shall do so only when
-                 * the expansion would result in one word."
-                 */
-                ctx->pending_redirect->rd_filename = xstrdup(word->data);
-                /* Cater for >\file case:
-                 * >\a creates file a; >\\a, >"\a", >"\\a" create file \a
-                 * Same with heredocs:
-                 * for <<\H delim is H; <<\\H, <<"\H", <<"\\H" - \H
-                 */
-                if (ctx->pending_redirect->rd_type == REDIRECT_HEREDOC) {
-                        unbackslash(ctx->pending_redirect->rd_filename);
-                        /* Is it <<"HEREDOC"? */
-                        if (word->has_quoted_part) {
-                                ctx->pending_redirect->rd_dup |= HEREDOC_QUOTED;
-                        }
-                }
-                debug_printf_parse("word stored in rd_filename: '%s'\n", word->data);
-                ctx->pending_redirect = NULL;
-        } else {
-                /* If this word wasn't an assignment, next ones definitely
-                 * can't be assignments. Even if they look like ones. */
-                if (word->o_assignment != DEFINITELY_ASSIGNMENT
-                 && word->o_assignment != WORD_IS_KEYWORD
-                ) {
-                        word->o_assignment = NOT_ASSIGNMENT;
-                } else {
-                        if (word->o_assignment == DEFINITELY_ASSIGNMENT)
-                                command->assignment_cnt++;
-                        word->o_assignment = MAYBE_ASSIGNMENT;
-                }
-
-#if HAS_KEYWORDS
-# if ENABLE_HUSH_CASE
-                if (ctx->ctx_dsemicolon
-                 && strcmp(word->data, "esac") != 0 /* not "... pattern) cmd;; esac" */
-                ) {
-                        /* already done when ctx_dsemicolon was set to 1: */
-                        /* ctx->ctx_res_w = RES_MATCH; */
-                        ctx->ctx_dsemicolon = 0;
-                } else
-# endif
-                if (!command->argv /* if it's the first word... */
-# if ENABLE_HUSH_LOOPS
-                 && ctx->ctx_res_w != RES_FOR /* ...not after FOR or IN */
-                 && ctx->ctx_res_w != RES_IN
-# endif
-# if ENABLE_HUSH_CASE
-                 && ctx->ctx_res_w != RES_CASE
-# endif
-                ) {
-                        debug_printf_parse("checking '%s' for reserved-ness\n", word->data);
-                        if (reserved_word(word, ctx)) {
-                                o_reset_to_empty_unquoted(word);
-                                debug_printf_parse("done_word return %d\n",
-                                                (ctx->ctx_res_w == RES_SNTX));
-                                return (ctx->ctx_res_w == RES_SNTX);
-                        }
-# ifdef CMD_SINGLEWORD_NOGLOB_COND
-                        if (strcmp(word->data, "export") == 0
-#  if ENABLE_HUSH_LOCAL
-                         || strcmp(word->data, "local") == 0
-#  endif
-                        ) {
-                                command->cmd_type = CMD_SINGLEWORD_NOGLOB_COND;
-                        } else
-# endif
-# if ENABLE_HUSH_BASH_COMPAT
-                        if (strcmp(word->data, "[[") == 0) {
-                                command->cmd_type = CMD_SINGLEWORD_NOGLOB;
-                        }
-                        /* fall through */
-# endif
-                }
-#endif
-                if (command->group) {
-                        /* "{ echo foo; } echo bar" - bad */
-                        syntax_error_at(word->data);
-                        debug_printf_parse("done_word return 1: syntax error, "
-                                        "groups and arglists don't mix\n");
-                        return 1;
-                }
-                if (word->has_quoted_part
-                 /* optimization: and if it's ("" or '') or ($v... or `cmd`...): */
-                 && (word->data[0] == '\0' || word->data[0] == SPECIAL_VAR_SYMBOL)
-                 /* (otherwise it's known to be not empty and is already safe) */
-                ) {
-                        /* exclude "$@" - it can expand to no word despite "" */
-                        char *p = word->data;
-                        while (p[0] == SPECIAL_VAR_SYMBOL
-                            && (p[1] & 0x7f) == '@'
-                            && p[2] == SPECIAL_VAR_SYMBOL
-                        ) {
-                                p += 3;
-                        }
-                        if (p == word->data || p[0] != '\0') {
-                                /* saw no "$@", or not only "$@" but some
-                                 * real text is there too */
-                                /* insert "empty variable" reference, this makes
-                                 * e.g. "", $empty"" etc to not disappear */
-                                o_addchr(word, SPECIAL_VAR_SYMBOL);
-                                o_addchr(word, SPECIAL_VAR_SYMBOL);
-                        }
-                }
-                command->argv = add_string_to_strings(command->argv, xstrdup(word->data));
-                debug_print_strings("word appended to argv", command->argv);
-        }
-
-#if ENABLE_HUSH_LOOPS
-        if (ctx->ctx_res_w == RES_FOR) {
-                if (word->has_quoted_part
-                 || !is_well_formed_var_name(command->argv[0], '\0')
-                ) {
-                        /* bash says just "not a valid identifier" */
-                        syntax_error("not a valid identifier in for");
-                        return 1;
-                }
-                /* Force FOR to have just one word (variable name) */
-                /* NB: basically, this makes hush see "for v in ..."
-                 * syntax as if it is "for v; in ...". FOR and IN become
-                 * two pipe structs in parse tree. */
-                done_pipe(ctx, PIPE_SEQ);
-        }
-#endif
-#if ENABLE_HUSH_CASE
-        /* Force CASE to have just one word */
-        if (ctx->ctx_res_w == RES_CASE) {
-                done_pipe(ctx, PIPE_SEQ);
-        }
-#endif
-
-        o_reset_to_empty_unquoted(word);
-
-        debug_printf_parse("done_word return 0\n");
-        return 0;
-}
-
-
-/* Peek ahead in the input to find out if we have a "&n" construct,
- * as in "2>&1", that represents duplicating a file descriptor.
- * Return:
- * REDIRFD_CLOSE if >&- "close fd" construct is seen,
- * REDIRFD_SYNTAX_ERR if syntax error,
- * REDIRFD_TO_FILE if no & was seen,
- * or the number found.
- */
-#if BB_MMU
-#define parse_redir_right_fd(as_string, input) \
-        parse_redir_right_fd(input)
-#endif
-static int parse_redir_right_fd(o_string *as_string, struct in_str *input)
-{
-        int ch, d, ok;
-
-        ch = i_peek(input);
-        if (ch != '&')
-                return REDIRFD_TO_FILE;
-
-        ch = i_getch(input);  /* get the & */
-        nommu_addchr(as_string, ch);
-        ch = i_peek(input);
-        if (ch == '-') {
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
-                return REDIRFD_CLOSE;
-        }
-        d = 0;
-        ok = 0;
-        while (ch != EOF && isdigit(ch)) {
-                d = d*10 + (ch-'0');
-                ok = 1;
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
-                ch = i_peek(input);
-        }
-        if (ok) return d;
-
-//TODO: this is the place to catch ">&file" bashism (redirect both fd 1 and 2)
-
-        bb_error_msg("ambiguous redirect");
-        return REDIRFD_SYNTAX_ERR;
-}
-
-/* Return code is 0 normal, 1 if a syntax error is detected
- */
-static int parse_redirect(struct parse_context *ctx,
-                int fd,
-                redir_type style,
-                struct in_str *input)
-{
-        struct command *command = ctx->command;
-        struct redir_struct *redir;
-        struct redir_struct **redirp;
-        int dup_num;
-
-        dup_num = REDIRFD_TO_FILE;
-        if (style != REDIRECT_HEREDOC) {
-                /* Check for a '>&1' type redirect */
-                dup_num = parse_redir_right_fd(&ctx->as_string, input);
-                if (dup_num == REDIRFD_SYNTAX_ERR)
-                        return 1;
-        } else {
-                int ch = i_peek(input);
-                dup_num = (ch == '-'); /* HEREDOC_SKIPTABS bit is 1 */
-                if (dup_num) { /* <<-... */
-                        ch = i_getch(input);
-                        nommu_addchr(&ctx->as_string, ch);
-                        ch = i_peek(input);
-                }
-        }
-
-        if (style == REDIRECT_OVERWRITE && dup_num == REDIRFD_TO_FILE) {
-                int ch = i_peek(input);
-                if (ch == '|') {
-                        /* >|FILE redirect ("clobbering" >).
-                         * Since we do not support "set -o noclobber" yet,
-                         * >| and > are the same for now. Just eat |.
-                         */
-                        ch = i_getch(input);
-                        nommu_addchr(&ctx->as_string, ch);
-                }
-        }
-
-        /* Create a new redir_struct and append it to the linked list */
-        redirp = &command->redirects;
-        while ((redir = *redirp) != NULL) {
-                redirp = &(redir->next);
-        }
-        *redirp = redir = xzalloc(sizeof(*redir));
-        /* redir->next = NULL; */
-        /* redir->rd_filename = NULL; */
-        redir->rd_type = style;
-        redir->rd_fd = (fd == -1) ? redir_table[style].default_fd : fd;
-
-        debug_printf_parse("redirect type %d %s\n", redir->rd_fd,
-                                redir_table[style].descrip);
-
-        redir->rd_dup = dup_num;
-        if (style != REDIRECT_HEREDOC && dup_num != REDIRFD_TO_FILE) {
-                /* Erik had a check here that the file descriptor in question
-                 * is legit; I postpone that to "run time"
-                 * A "-" representation of "close me" shows up as a -3 here */
-                debug_printf_parse("duplicating redirect '%d>&%d'\n",
-                                redir->rd_fd, redir->rd_dup);
-        } else {
-                /* Set ctx->pending_redirect, so we know what to do at the
-                 * end of the next parsed word. */
-                ctx->pending_redirect = redir;
-        }
-        return 0;
-}
-
-/* If a redirect is immediately preceded by a number, that number is
- * supposed to tell which file descriptor to redirect.  This routine
- * looks for such preceding numbers.  In an ideal world this routine
- * needs to handle all the following classes of redirects...
- *     echo 2>foo     # redirects fd  2 to file "foo", nothing passed to echo
- *     echo 49>foo    # redirects fd 49 to file "foo", nothing passed to echo
- *     echo -2>foo    # redirects fd  1 to file "foo",    "-2" passed to echo
- *     echo 49x>foo   # redirects fd  1 to file "foo",   "49x" passed to echo
- *
- * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
- * "2.7 Redirection
- * ... If n is quoted, the number shall not be recognized as part of
- * the redirection expression. For example:
- * echo \2>a
- * writes the character 2 into file a"
- * We are getting it right by setting ->has_quoted_part on any \<char>
- *
- * A -1 return means no valid number was found,
- * the caller should use the appropriate default for this redirection.
- */
-static int redirect_opt_num(o_string *o)
-{
-        int num;
-
-        if (o->data == NULL)
-                return -1;
-        num = bb_strtou(o->data, NULL, 10);
-        if (errno || num < 0)
-                return -1;
-        o_reset_to_empty_unquoted(o);
-        return num;
-}
-
-#if BB_MMU
-#define fetch_till_str(as_string, input, word, skip_tabs) \
-        fetch_till_str(input, word, skip_tabs)
-#endif
-static char *fetch_till_str(o_string *as_string,
-                struct in_str *input,
-                const char *word,
-                int skip_tabs)
-{
-        o_string heredoc = NULL_O_STRING;
-        int past_EOL = 0;
-        int ch;
-
-        goto jump_in;
-        while (1) {
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
-                if (ch == '\n') {
-                        if (strcmp(heredoc.data + past_EOL, word) == 0) {
-                                heredoc.data[past_EOL] = '\0';
-                                debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
-                                return heredoc.data;
-                        }
-                        do {
-                                o_addchr(&heredoc, ch);
-                                past_EOL = heredoc.length;
- jump_in:
-                                do {
-                                        ch = i_getch(input);
-                                        nommu_addchr(as_string, ch);
-                                } while (skip_tabs && ch == '\t');
-                        } while (ch == '\n');
-                }
-                if (ch == EOF) {
-                        o_free_unsafe(&heredoc);
-                        return NULL;
-                }
-                o_addchr(&heredoc, ch);
-                nommu_addchr(as_string, ch);
-        }
-}
-
-/* Look at entire parse tree for not-yet-loaded REDIRECT_HEREDOCs
- * and load them all. There should be exactly heredoc_cnt of them.
- */
-static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_str *input)
-{
-        struct pipe *pi = ctx->list_head;
-
-        while (pi && heredoc_cnt) {
-                int i;
-                struct command *cmd = pi->cmds;
-
-                debug_printf_parse("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
-                                pi->num_cmds,
-                                cmd->argv ? cmd->argv[0] : "NONE");
-                for (i = 0; i < pi->num_cmds; i++) {
-                        struct redir_struct *redir = cmd->redirects;
-
-                        debug_printf_parse("fetch_heredocs: %d cmd argv0:'%s'\n",
-                                        i, cmd->argv ? cmd->argv[0] : "NONE");
-                        while (redir) {
-                                if (redir->rd_type == REDIRECT_HEREDOC) {
-                                        char *p;
-
-                                        redir->rd_type = REDIRECT_HEREDOC2;
-                                        /* redir->rd_dup is (ab)used to indicate <<- */
-                                        p = fetch_till_str(&ctx->as_string, input,
-                                                redir->rd_filename, redir->rd_dup & HEREDOC_SKIPTABS);
-                                        if (!p) {
-                                                syntax_error("unexpected EOF in here document");
-                                                return 1;
-                                        }
-                                        free(redir->rd_filename);
-                                        redir->rd_filename = p;
-                                        heredoc_cnt--;
-                                }
-                                redir = redir->next;
-                        }
-                        cmd++;
-                }
-                pi = pi->next;
-        }
-#if 0
-        /* Should be 0. If it isn't, it's a parse error */
-        if (heredoc_cnt)
-                bb_error_msg_and_die("heredoc BUG 2");
-#endif
-        return 0;
-}
-
-
-#if ENABLE_HUSH_TICK
-static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
-{
-        pid_t pid;
-        int channel[2];
-# if !BB_MMU
-        char **to_free = NULL;
-# endif
-
-        xpipe(channel);
-        pid = BB_MMU ? xfork() : xvfork();
-        if (pid == 0) { /* child */
-                disable_restore_tty_pgrp_on_exit();
-                /* Process substitution is not considered to be usual
-                 * 'command execution'.
-                 * SUSv3 says ctrl-Z should be ignored, ctrl-C should not.
-                 */
-                bb_signals(0
-                        + (1 << SIGTSTP)
-                        + (1 << SIGTTIN)
-                        + (1 << SIGTTOU)
-                        , SIG_IGN);
-                CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
-                close(channel[0]); /* NB: close _first_, then move fd! */
-                xmove_fd(channel[1], 1);
-                /* Prevent it from trying to handle ctrl-z etc */
-                IF_HUSH_JOB(G.run_list_level = 1;)
-                /* Awful hack for `trap` or $(trap).
-                 *
-                 * http://www.opengroup.org/onlinepubs/009695399/utilities/trap.html
-                 * contains an example where "trap" is executed in a subshell:
-                 *
-                 * save_traps=$(trap)
-                 * ...
-                 * eval "$save_traps"
-                 *
-                 * Standard does not say that "trap" in subshell shall print
-                 * parent shell's traps. It only says that its output
-                 * must have suitable form, but then, in the above example
-                 * (which is not supposed to be normative), it implies that.
-                 *
-                 * bash (and probably other shell) does implement it
-                 * (traps are reset to defaults, but "trap" still shows them),
-                 * but as a result, "trap" logic is hopelessly messed up:
-                 *
-                 * # trap
-                 * trap -- 'echo Ho' SIGWINCH  <--- we have a handler
-                 * # (trap)        <--- trap is in subshell - no output (correct, traps are reset)
-                 * # true | trap   <--- trap is in subshell - no output (ditto)
-                 * # echo `true | trap`    <--- in subshell - output (but traps are reset!)
-                 * trap -- 'echo Ho' SIGWINCH
-                 * # echo `(trap)`         <--- in subshell in subshell - output
-                 * trap -- 'echo Ho' SIGWINCH
-                 * # echo `true | (trap)`  <--- in subshell in subshell in subshell - output!
-                 * trap -- 'echo Ho' SIGWINCH
-                 *
-                 * The rules when to forget and when to not forget traps
-                 * get really complex and nonsensical.
-                 *
-                 * Our solution: ONLY bare $(trap) or `trap` is special.
-                 */
-                s = skip_whitespace(s);
-                if (strncmp(s, "trap", 4) == 0 && (*skip_whitespace(s + 4) == '\0'))
-                {
-                        static const char *const argv[] = { NULL, NULL };
-                        builtin_trap((char**)argv);
-                        exit(0); /* not _exit() - we need to fflush */
-                }
-# if BB_MMU
-                reset_traps_to_defaults();
-                parse_and_run_string(s);
-                _exit(G.last_exitcode);
-# else
-        /* We re-execute after vfork on NOMMU. This makes this script safe:
-         * yes "0123456789012345678901234567890" | dd bs=32 count=64k >BIG
-         * huge=`cat BIG` # was blocking here forever
-         * echo OK
-         */
-                re_execute_shell(&to_free,
-                                s,
-                                G.global_argv[0],
-                                G.global_argv + 1,
-                                NULL);
-# endif
-        }
-
-        /* parent */
-        *pid_p = pid;
-# if ENABLE_HUSH_FAST
-        G.count_SIGCHLD++;
-//bb_error_msg("[%d] fork in generate_stream_from_string:"
-//              " G.count_SIGCHLD:%d G.handled_SIGCHLD:%d",
-//              getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
-# endif
-        enable_restore_tty_pgrp_on_exit();
-# if !BB_MMU
-        free(to_free);
-# endif
-        close(channel[1]);
-        close_on_exec_on(channel[0]);
-        return xfdopen_for_read(channel[0]);
-}
-
-/* Return code is exit status of the process that is run. */
-static int process_command_subs(o_string *dest, const char *s)
-{
-        FILE *fp;
-        struct in_str pipe_str;
-        pid_t pid;
-        int status, ch, eol_cnt;
-
-        fp = generate_stream_from_string(s, &pid);
-
-        /* Now send results of command back into original context */
-        setup_file_in_str(&pipe_str, fp);
-        eol_cnt = 0;
-        while ((ch = i_getch(&pipe_str)) != EOF) {
-                if (ch == '\n') {
-                        eol_cnt++;
-                        continue;
-                }
-                while (eol_cnt) {
-                        o_addchr(dest, '\n');
-                        eol_cnt--;
-                }
-                o_addQchr(dest, ch);
-        }
-
-        debug_printf("done reading from `cmd` pipe, closing it\n");
-        fclose(fp);
-        /* We need to extract exitcode. Test case
-         * "true; echo `sleep 1; false` $?"
-         * should print 1 */
-        safe_waitpid(pid, &status, 0);
-        debug_printf("child exited. returning its exitcode:%d\n", WEXITSTATUS(status));
-        return WEXITSTATUS(status);
-}
-#endif /* ENABLE_HUSH_TICK */
-
-#if !ENABLE_HUSH_FUNCTIONS
-#define parse_group(dest, ctx, input, ch) \
-        parse_group(ctx, input, ch)
-#endif
-static int parse_group(o_string *dest, struct parse_context *ctx,
-        struct in_str *input, int ch)
-{
-        /* dest contains characters seen prior to ( or {.
-         * Typically it's empty, but for function defs,
-         * it contains function name (without '()'). */
-        struct pipe *pipe_list;
-        int endch;
-        struct command *command = ctx->command;
-
-        debug_printf_parse("parse_group entered\n");
-#if ENABLE_HUSH_FUNCTIONS
-        if (ch == '(' && !dest->has_quoted_part) {
-                if (dest->length)
-                        if (done_word(dest, ctx))
-                                return 1;
-                if (!command->argv)
-                        goto skip; /* (... */
-                if (command->argv[1]) { /* word word ... (... */
-                        syntax_error_unexpected_ch('(');
-                        return 1;
-                }
-                /* it is "word(..." or "word (..." */
-                do
-                        ch = i_getch(input);
-                while (ch == ' ' || ch == '\t');
-                if (ch != ')') {
-                        syntax_error_unexpected_ch(ch);
-                        return 1;
-                }
-                nommu_addchr(&ctx->as_string, ch);
-                do
-                        ch = i_getch(input);
-                while (ch == ' ' || ch == '\t' || ch == '\n');
-                if (ch != '{') {
-                        syntax_error_unexpected_ch(ch);
-                        return 1;
-                }
-                nommu_addchr(&ctx->as_string, ch);
-                command->cmd_type = CMD_FUNCDEF;
-                goto skip;
-        }
-#endif
-
-#if 0 /* Prevented by caller */
-        if (command->argv /* word [word]{... */
-         || dest->length /* word{... */
-         || dest->has_quoted_part /* ""{... */
-        ) {
-                syntax_error(NULL);
-                debug_printf_parse("parse_group return 1: "
-                        "syntax error, groups and arglists don't mix\n");
-                return 1;
-        }
-#endif
-
-#if ENABLE_HUSH_FUNCTIONS
- skip:
-#endif
-        endch = '}';
-        if (ch == '(') {
-                endch = ')';
-                command->cmd_type = CMD_SUBSHELL;
-        } else {
-                /* bash does not allow "{echo...", requires whitespace */
-                ch = i_getch(input);
-                if (ch != ' ' && ch != '\t' && ch != '\n') {
-                        syntax_error_unexpected_ch(ch);
-                        return 1;
-                }
-                nommu_addchr(&ctx->as_string, ch);
-        }
-
-        {
-#if BB_MMU
-# define as_string NULL
-#else
-                char *as_string = NULL;
-#endif
-                pipe_list = parse_stream(&as_string, input, endch);
-#if !BB_MMU
-                if (as_string)
-                        o_addstr(&ctx->as_string, as_string);
-#endif
-                /* empty ()/{} or parse error? */
-                if (!pipe_list || pipe_list == ERR_PTR) {
-                        /* parse_stream already emitted error msg */
-                        if (!BB_MMU)
-                                free(as_string);
-                        debug_printf_parse("parse_group return 1: "
-                                "parse_stream returned %p\n", pipe_list);
-                        return 1;
-                }
-                command->group = pipe_list;
-#if !BB_MMU
-                as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
-                command->group_as_string = as_string;
-                debug_printf_parse("end of group, remembering as:'%s'\n",
-                                command->group_as_string);
-#endif
-#undef as_string
-        }
-        debug_printf_parse("parse_group return 0\n");
-        return 0;
-        /* command remains "open", available for possible redirects */
-}
-
-#if ENABLE_HUSH_TICK || ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_DOLLAR_OPS
-/* Subroutines for copying $(...) and `...` things */
-static void add_till_backquote(o_string *dest, struct in_str *input);
-/* '...' */
-static void add_till_single_quote(o_string *dest, struct in_str *input)
-{
-        while (1) {
-                int ch = i_getch(input);
-                if (ch == EOF) {
-                        syntax_error_unterm_ch('\'');
-                        /*xfunc_die(); - redundant */
-                }
-                if (ch == '\'')
-                        return;
-                o_addchr(dest, ch);
-        }
-}
-/* "...\"...`..`...." - do we need to handle "...$(..)..." too? */
-static void add_till_double_quote(o_string *dest, struct in_str *input)
-{
-        while (1) {
-                int ch = i_getch(input);
-                if (ch == EOF) {
-                        syntax_error_unterm_ch('"');
-                        /*xfunc_die(); - redundant */
-                }
-                if (ch == '"')
-                        return;
-                if (ch == '\\') {  /* \x. Copy both chars. */
-                        o_addchr(dest, ch);
-                        ch = i_getch(input);
-                }
-                o_addchr(dest, ch);
-                if (ch == '`') {
-                        add_till_backquote(dest, input);
-                        o_addchr(dest, ch);
-                        continue;
-                }
-                //if (ch == '$') ...
-        }
-}
-/* Process `cmd` - copy contents until "`" is seen. Complicated by
- * \` quoting.
- * "Within the backquoted style of command substitution, backslash
- * shall retain its literal meaning, except when followed by: '$', '`', or '\'.
- * The search for the matching backquote shall be satisfied by the first
- * backquote found without a preceding backslash; during this search,
- * if a non-escaped backquote is encountered within a shell comment,
- * a here-document, an embedded command substitution of the $(command)
- * form, or a quoted string, undefined results occur. A single-quoted
- * or double-quoted string that begins, but does not end, within the
- * "`...`" sequence produces undefined results."
- * Example                               Output
- * echo `echo '\'TEST\`echo ZZ\`BEST`    \TESTZZBEST
- */
-static void add_till_backquote(o_string *dest, struct in_str *input)
-{
-        while (1) {
-                int ch = i_getch(input);
-                if (ch == EOF) {
-                        syntax_error_unterm_ch('`');
-                        /*xfunc_die(); - redundant */
-                }
-                if (ch == '`')
-                        return;
-                if (ch == '\\') {
-                        /* \x. Copy both chars unless it is \` */
-                        int ch2 = i_getch(input);
-                        if (ch2 == EOF) {
-                                syntax_error_unterm_ch('`');
-                                /*xfunc_die(); - redundant */
-                        }
-                        if (ch2 != '`' && ch2 != '$' && ch2 != '\\')
-                                o_addchr(dest, ch);
-                        ch = ch2;
-                }
-                o_addchr(dest, ch);
-        }
-}
-/* Process $(cmd) - copy contents until ")" is seen. Complicated by
- * quoting and nested ()s.
- * "With the $(command) style of command substitution, all characters
- * following the open parenthesis to the matching closing parenthesis
- * constitute the command. Any valid shell script can be used for command,
- * except a script consisting solely of redirections which produces
- * unspecified results."
- * Example                              Output
- * echo $(echo '(TEST)' BEST)           (TEST) BEST
- * echo $(echo 'TEST)' BEST)            TEST) BEST
- * echo $(echo \(\(TEST\) BEST)         ((TEST) BEST
- *
- * Also adapted to eat ${var%...} and $((...)) constructs, since ... part
- * can contain arbitrary constructs, just like $(cmd).
- * In bash compat mode, it needs to also be able to stop on ':' or '/'
- * for ${var:N[:M]} and ${var/P[/R]} parsing.
- */
-#define DOUBLE_CLOSE_CHAR_FLAG 0x80
-static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsigned end_ch)
-{
-        int ch;
-        char dbl = end_ch & DOUBLE_CLOSE_CHAR_FLAG;
-# if ENABLE_HUSH_BASH_COMPAT
-        char end_char2 = end_ch >> 8;
-# endif
-        end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
-
-        while (1) {
-                ch = i_getch(input);
-                if (ch == EOF) {
-                        syntax_error_unterm_ch(end_ch);
-                        /*xfunc_die(); - redundant */
-                }
-                if (ch == end_ch  IF_HUSH_BASH_COMPAT( || ch == end_char2)) {
-                        if (!dbl)
-                                break;
-                        /* we look for closing )) of $((EXPR)) */
-                        if (i_peek(input) == end_ch) {
-                                i_getch(input); /* eat second ')' */
-                                break;
-                        }
-                }
-                o_addchr(dest, ch);
-                if (ch == '(' || ch == '{') {
-                        ch = (ch == '(' ? ')' : '}');
-                        add_till_closing_bracket(dest, input, ch);
-                        o_addchr(dest, ch);
-                        continue;
-                }
-                if (ch == '\'') {
-                        add_till_single_quote(dest, input);
-                        o_addchr(dest, ch);
-                        continue;
-                }
-                if (ch == '"') {
-                        add_till_double_quote(dest, input);
-                        o_addchr(dest, ch);
-                        continue;
-                }
-                if (ch == '`') {
-                        add_till_backquote(dest, input);
-                        o_addchr(dest, ch);
-                        continue;
-                }
-                if (ch == '\\') {
-                        /* \x. Copy verbatim. Important for  \(, \) */
-                        ch = i_getch(input);
-                        if (ch == EOF) {
-                                syntax_error_unterm_ch(')');
-                                /*xfunc_die(); - redundant */
-                        }
-                        o_addchr(dest, ch);
-                        continue;
-                }
-        }
-        return ch;
-}
-#endif /* ENABLE_HUSH_TICK || ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_DOLLAR_OPS */
-
-/* Return code: 0 for OK, 1 for syntax error */
-#if BB_MMU
-#define parse_dollar(as_string, dest, input) \
-        parse_dollar(dest, input)
-#define as_string NULL
-#endif
-static int parse_dollar(o_string *as_string,
-                o_string *dest,
-                struct in_str *input)
-{
-        int ch = i_peek(input);  /* first character after the $ */
-        unsigned char quote_mask = dest->o_escape ? 0x80 : 0;
-
-        debug_printf_parse("parse_dollar entered: ch='%c'\n", ch);
-        if (isalpha(ch)) {
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
- make_var:
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                while (1) {
-                        debug_printf_parse(": '%c'\n", ch);
-                        o_addchr(dest, ch | quote_mask);
-                        quote_mask = 0;
-                        ch = i_peek(input);
-                        if (!isalnum(ch) && ch != '_')
-                                break;
-                        ch = i_getch(input);
-                        nommu_addchr(as_string, ch);
-                }
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-        } else if (isdigit(ch)) {
- make_one_char_var:
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                debug_printf_parse(": '%c'\n", ch);
-                o_addchr(dest, ch | quote_mask);
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-        } else switch (ch) {
-        case '$': /* pid */
-        case '!': /* last bg pid */
-        case '?': /* last exit code */
-        case '#': /* number of args */
-        case '*': /* args */
-        case '@': /* args */
-                goto make_one_char_var;
-        case '{': {
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-
-                ch = i_getch(input); /* eat '{' */
-                nommu_addchr(as_string, ch);
-
-                ch = i_getch(input); /* first char after '{' */
-                nommu_addchr(as_string, ch);
-                /* It should be ${?}, or ${#var},
-                 * or even ${?+subst} - operator acting on a special variable,
-                 * or the beginning of variable name.
-                 */
-                if (!strchr(_SPECIAL_VARS_STR, ch) && !isalnum(ch)) { /* not one of those */
- bad_dollar_syntax:
-                        syntax_error_unterm_str("${name}");
-                        debug_printf_parse("parse_dollar return 1: unterminated ${name}\n");
-                        return 1;
-                }
-                ch |= quote_mask;
-
-                /* It's possible to just call add_till_closing_bracket() at this point.
-                 * However, this regresses some of our testsuite cases
-                 * which check invalid constructs like ${%}.
-                 * Oh well... let's check that the var name part is fine... */
-
-                while (1) {
-                        unsigned pos;
-
-                        o_addchr(dest, ch);
-                        debug_printf_parse(": '%c'\n", ch);
-
-                        ch = i_getch(input);
-                        nommu_addchr(as_string, ch);
-                        if (ch == '}')
-                                break;
-
-                        if (!isalnum(ch) && ch != '_') {
-                                unsigned end_ch;
-                                unsigned char last_ch;
-                                /* handle parameter expansions
-                                 * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_06_02
-                                 */
-                                if (!strchr(VAR_SUBST_OPS, ch)) /* ${var<bad_char>... */
-                                        goto bad_dollar_syntax;
-
-                                /* Eat everything until closing '}' (or ':') */
-                                end_ch = '}';
-                                if (ENABLE_HUSH_BASH_COMPAT
-                                 && ch == ':'
-                                 && !strchr(MINUS_PLUS_EQUAL_QUESTION, i_peek(input))
-                                ) {
-                                        /* It's ${var:N[:M]} thing */
-                                        end_ch = '}' * 0x100 + ':';
-                                }
-                                if (ENABLE_HUSH_BASH_COMPAT
-                                 && ch == '/'
-                                ) {
-                                        /* It's ${var/[/]pattern[/repl]} thing */
-                                        if (i_peek(input) == '/') { /* ${var//pattern[/repl]}? */
-                                                i_getch(input);
-                                                nommu_addchr(as_string, '/');
-                                                ch = '\\';
-                                        }
-                                        end_ch = '}' * 0x100 + '/';
-                                }
-                                o_addchr(dest, ch);
- again:
-                                if (!BB_MMU)
-                                        pos = dest->length;
-#if ENABLE_HUSH_DOLLAR_OPS
-                                last_ch = add_till_closing_bracket(dest, input, end_ch);
-#else
-#error Simple code to only allow ${var} is not implemented
-#endif
-                                if (as_string) {
-                                        o_addstr(as_string, dest->data + pos);
-                                        o_addchr(as_string, last_ch);
-                                }
-
-                                if (ENABLE_HUSH_BASH_COMPAT && (end_ch & 0xff00)) {
-                                        /* close the first block: */
-                                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                                        /* while parsing N from ${var:N[:M]}
-                                         * or pattern from ${var/[/]pattern[/repl]} */
-                                        if ((end_ch & 0xff) == last_ch) {
-                                                /* got ':' or '/'- parse the rest */
-                                                end_ch = '}';
-                                                goto again;
-                                        }
-                                        /* got '}' */
-                                        if (end_ch == '}' * 0x100 + ':') {
-                                                /* it's ${var:N} - emulate :999999999 */
-                                                o_addstr(dest, "999999999");
-                                        } /* else: it's ${var/[/]pattern} */
-                                }
-                                break;
-                        }
-                }
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                break;
-        }
-#if ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_TICK
-        case '(': {
-                unsigned pos;
-
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
-# if ENABLE_SH_MATH_SUPPORT
-                if (i_peek(input) == '(') {
-                        ch = i_getch(input);
-                        nommu_addchr(as_string, ch);
-                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                        o_addchr(dest, /*quote_mask |*/ '+');
-                        if (!BB_MMU)
-                                pos = dest->length;
-                        add_till_closing_bracket(dest, input, ')' | DOUBLE_CLOSE_CHAR_FLAG);
-                        if (as_string) {
-                                o_addstr(as_string, dest->data + pos);
-                                o_addchr(as_string, ')');
-                                o_addchr(as_string, ')');
-                        }
-                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                        break;
-                }
-# endif
-# if ENABLE_HUSH_TICK
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                o_addchr(dest, quote_mask | '`');
-                if (!BB_MMU)
-                        pos = dest->length;
-                add_till_closing_bracket(dest, input, ')');
-                if (as_string) {
-                        o_addstr(as_string, dest->data + pos);
-                        o_addchr(as_string, ')');
-                }
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-# endif
-                break;
-        }
-#endif
-        case '_':
-                ch = i_getch(input);
-                nommu_addchr(as_string, ch);
-                ch = i_peek(input);
-                if (isalnum(ch)) { /* it's $_name or $_123 */
-                        ch = '_';
-                        goto make_var;
-                }
-                /* else: it's $_ */
-        /* TODO: $_ and $-: */
-        /* $_ Shell or shell script name; or last argument of last command
-         * (if last command wasn't a pipe; if it was, bash sets $_ to "");
-         * but in command's env, set to full pathname used to invoke it */
-        /* $- Option flags set by set builtin or shell options (-i etc) */
-        default:
-                o_addQchr(dest, '$');
-        }
-        debug_printf_parse("parse_dollar return 0\n");
-        return 0;
-#undef as_string
-}
-
-#if BB_MMU
-#define parse_stream_dquoted(as_string, dest, input, dquote_end) \
-        parse_stream_dquoted(dest, input, dquote_end)
-#define as_string NULL
-#endif
-static int parse_stream_dquoted(o_string *as_string,
-                o_string *dest,
-                struct in_str *input,
-                int dquote_end)
-{
-        int ch;
-        int next;
-
- again:
-        ch = i_getch(input);
-        if (ch != EOF)
-                nommu_addchr(as_string, ch);
-        if (ch == dquote_end) { /* may be only '"' or EOF */
-                if (dest->o_assignment == NOT_ASSIGNMENT)
-                        dest->o_escape ^= 1;
-                debug_printf_parse("parse_stream_dquoted return 0\n");
-                return 0;
-        }
-        /* note: can't move it above ch == dquote_end check! */
-        if (ch == EOF) {
-                syntax_error_unterm_ch('"');
-                /*xfunc_die(); - redundant */
-        }
-        next = '\0';
-        if (ch != '\n') {
-                next = i_peek(input);
-        }
-        debug_printf_parse("\" ch=%c (%d) escape=%d\n",
-                                        ch, ch, dest->o_escape);
-        if (ch == '\\') {
-                if (next == EOF) {
-                        syntax_error("\\<eof>");
-                        xfunc_die();
-                }
-                /* bash:
-                 * "The backslash retains its special meaning [in "..."]
-                 * only when followed by one of the following characters:
-                 * $, `, ", \, or <newline>.  A double quote may be quoted
-                 * within double quotes by preceding it with a backslash."
-                 */
-                if (strchr("$`\"\\\n", next) != NULL) {
-                        ch = i_getch(input);
-                        if (ch != '\n') {
-                                o_addqchr(dest, ch);
-                                nommu_addchr(as_string, ch);
-                        }
-                } else {
-                        o_addqchr(dest, '\\');
-                        nommu_addchr(as_string, '\\');
-                }
-                goto again;
-        }
-        if (ch == '$') {
-                if (parse_dollar(as_string, dest, input) != 0) {
-                        debug_printf_parse("parse_stream_dquoted return 1: "
-                                        "parse_dollar returned non-0\n");
-                        return 1;
-                }
-                goto again;
-        }
-#if ENABLE_HUSH_TICK
-        if (ch == '`') {
-                //unsigned pos = dest->length;
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                o_addchr(dest, 0x80 | '`');
-                add_till_backquote(dest, input);
-                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
-                goto again;
-        }
-#endif
-        o_addQchr(dest, ch);
-        if (ch == '='
-         && (dest->o_assignment == MAYBE_ASSIGNMENT
-            || dest->o_assignment == WORD_IS_KEYWORD)
-         && is_well_formed_var_name(dest->data, '=')
-        ) {
-                dest->o_assignment = DEFINITELY_ASSIGNMENT;
-        }
-        goto again;
-#undef as_string
-}
-
-/*
- * Scan input until EOF or end_trigger char.
- * Return a list of pipes to execute, or NULL on EOF
- * or if end_trigger character is met.
- * On syntax error, exit is shell is not interactive,
- * reset parsing machinery and start parsing anew,
- * or return ERR_PTR.
- */
-static struct pipe *parse_stream(char **pstring,
-                struct in_str *input,
-                int end_trigger)
-{
-        struct parse_context ctx;
-        o_string dest = NULL_O_STRING;
-        int is_in_dquote;
-        int heredoc_cnt;
-
-        /* Double-quote state is handled in the state variable is_in_dquote.
-         * A single-quote triggers a bypass of the main loop until its mate is
-         * found.  When recursing, quote state is passed in via dest->o_escape.
-         */
-        debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
-                        end_trigger ? end_trigger : 'X');
-        debug_enter();
-
-        /* If very first arg is "" or '', dest.data may end up NULL.
-         * Preventing this: */
-        o_addchr(&dest, '\0');
-        dest.length = 0;
-
-        G.ifs = get_local_var_value("IFS");
-        if (G.ifs == NULL)
-                G.ifs = defifs;
-
- reset:
-#if ENABLE_HUSH_INTERACTIVE
-        input->promptmode = 0; /* PS1 */
-#endif
-        /* dest.o_assignment = MAYBE_ASSIGNMENT; - already is */
-        initialize_context(&ctx);
-        is_in_dquote = 0;
-        heredoc_cnt = 0;
-        while (1) {
-                const char *is_ifs;
-                const char *is_special;
-                int ch;
-                int next;
-                int redir_fd;
-                redir_type redir_style;
-
-                if (is_in_dquote) {
-                        /* dest.has_quoted_part = 1; - already is (see below) */
-                        if (parse_stream_dquoted(&ctx.as_string, &dest, input, '"')) {
-                                goto parse_error;
-                        }
-                        /* We reached closing '"' */
-                        is_in_dquote = 0;
-                }
-                ch = i_getch(input);
-                debug_printf_parse(": ch=%c (%d) escape=%d\n",
-                                                ch, ch, dest.o_escape);
-                if (ch == EOF) {
-                        struct pipe *pi;
-
-                        if (heredoc_cnt) {
-                                syntax_error_unterm_str("here document");
-                                goto parse_error;
-                        }
-                        /* end_trigger == '}' case errors out earlier,
-                         * checking only ')' */
-                        if (end_trigger == ')') {
-                                syntax_error_unterm_ch('('); /* exits */
-                                /* goto parse_error; */
-                        }
-
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        o_free(&dest);
-                        done_pipe(&ctx, PIPE_SEQ);
-                        pi = ctx.list_head;
-                        /* If we got nothing... */
-                        /* (this makes bare "&" cmd a no-op.
-                         * bash says: "syntax error near unexpected token '&'") */
-                        if (pi->num_cmds == 0
-                            IF_HAS_KEYWORDS( && pi->res_word == RES_NONE)
-                        ) {
-                                free_pipe_list(pi);
-                                pi = NULL;
-                        }
-#if !BB_MMU
-                        debug_printf_parse("as_string '%s'\n", ctx.as_string.data);
-                        if (pstring)
-                                *pstring = ctx.as_string.data;
-                        else
-                                o_free_unsafe(&ctx.as_string);
-#endif
-                        debug_leave();
-                        debug_printf_parse("parse_stream return %p\n", pi);
-                        return pi;
-                }
-                nommu_addchr(&ctx.as_string, ch);
-
-                next = '\0';
-                if (ch != '\n')
-                        next = i_peek(input);
-
-                is_special = "{}<>;&|()#'" /* special outside of "str" */
-                                "\\$\"" IF_HUSH_TICK("`"); /* always special */
-                /* Are { and } special here? */
-                if (ctx.command->argv /* word [word]{... - non-special */
-                 || dest.length       /* word{... - non-special */
-                 || dest.has_quoted_part     /* ""{... - non-special */
-                 || (next != ';'            /* }; - special */
-                    && next != ')'          /* }) - special */
-                    && next != '&'          /* }& and }&& ... - special */
-                    && next != '|'          /* }|| ... - special */
-                    && !strchr(G.ifs, next) /* {word - non-special */
-                    )
-                ) {
-                        /* They are not special, skip "{}" */
-                        is_special += 2;
-                }
-                is_special = strchr(is_special, ch);
-                is_ifs = strchr(G.ifs, ch);
-
-                if (!is_special && !is_ifs) { /* ordinary char */
- ordinary_char:
-                        o_addQchr(&dest, ch);
-                        if ((dest.o_assignment == MAYBE_ASSIGNMENT
-                            || dest.o_assignment == WORD_IS_KEYWORD)
-                         && ch == '='
-                         && is_well_formed_var_name(dest.data, '=')
-                        ) {
-                                dest.o_assignment = DEFINITELY_ASSIGNMENT;
-                        }
-                        continue;
-                }
-
-                if (is_ifs) {
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        if (ch == '\n') {
-#if ENABLE_HUSH_CASE
-                                /* "case ... in <newline> word) ..." -
-                                 * newlines are ignored (but ';' wouldn't be) */
-                                if (ctx.command->argv == NULL
-                                 && ctx.ctx_res_w == RES_MATCH
-                                ) {
-                                        continue;
-                                }
-#endif
-                                /* Treat newline as a command separator. */
-                                done_pipe(&ctx, PIPE_SEQ);
-                                debug_printf_parse("heredoc_cnt:%d\n", heredoc_cnt);
-                                if (heredoc_cnt) {
-                                        if (fetch_heredocs(heredoc_cnt, &ctx, input)) {
-                                                goto parse_error;
-                                        }
-                                        heredoc_cnt = 0;
-                                }
-                                dest.o_assignment = MAYBE_ASSIGNMENT;
-                                ch = ';';
-                                /* note: if (is_ifs) continue;
-                                 * will still trigger for us */
-                        }
-                }
-
-                /* "cmd}" or "cmd }..." without semicolon or &:
-                 * } is an ordinary char in this case, even inside { cmd; }
-                 * Pathological example: { ""}; } should exec "}" cmd
-                 */
-                if (ch == '}') {
-                        if (!IS_NULL_CMD(ctx.command) /* cmd } */
-                         || dest.length != 0 /* word} */
-                         || dest.has_quoted_part    /* ""} */
-                        ) {
-                                goto ordinary_char;
-                        }
-                        if (!IS_NULL_PIPE(ctx.pipe)) /* cmd | } */
-                                goto skip_end_trigger;
-                        /* else: } does terminate a group */
-                }
-
-                if (end_trigger && end_trigger == ch
-                 && (ch != ';' || heredoc_cnt == 0)
-#if ENABLE_HUSH_CASE
-                 && (ch != ')'
-                    || ctx.ctx_res_w != RES_MATCH
-                    || (!dest.has_quoted_part && strcmp(dest.data, "esac") == 0)
-                    )
-#endif
-                ) {
-                        if (heredoc_cnt) {
-                                /* This is technically valid:
-                                 * { cat <<HERE; }; echo Ok
-                                 * heredoc
-                                 * heredoc
-                                 * HERE
-                                 * but we don't support this.
-                                 * We require heredoc to be in enclosing {}/(),
-                                 * if any.
-                                 */
-                                syntax_error_unterm_str("here document");
-                                goto parse_error;
-                        }
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        done_pipe(&ctx, PIPE_SEQ);
-                        dest.o_assignment = MAYBE_ASSIGNMENT;
-                        /* Do we sit outside of any if's, loops or case's? */
-                        if (!HAS_KEYWORDS
-                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
-                        ) {
-                                o_free(&dest);
-#if !BB_MMU
-                                debug_printf_parse("as_string '%s'\n", ctx.as_string.data);
-                                if (pstring)
-                                        *pstring = ctx.as_string.data;
-                                else
-                                        o_free_unsafe(&ctx.as_string);
-#endif
-                                debug_leave();
-                                debug_printf_parse("parse_stream return %p: "
-                                                "end_trigger char found\n",
-                                                ctx.list_head);
-                                return ctx.list_head;
-                        }
-                }
- skip_end_trigger:
-                if (is_ifs)
-                        continue;
-
-                /* Catch <, > before deciding whether this word is
-                 * an assignment. a=1 2>z b=2: b=2 is still assignment */
-                switch (ch) {
-                case '>':
-                        redir_fd = redirect_opt_num(&dest);
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        redir_style = REDIRECT_OVERWRITE;
-                        if (next == '>') {
-                                redir_style = REDIRECT_APPEND;
-                                ch = i_getch(input);
-                                nommu_addchr(&ctx.as_string, ch);
-                        }
-#if 0
-                        else if (next == '(') {
-                                syntax_error(">(process) not supported");
-                                goto parse_error;
-                        }
-#endif
-                        if (parse_redirect(&ctx, redir_fd, redir_style, input))
-                                goto parse_error;
-                        continue; /* back to top of while (1) */
-                case '<':
-                        redir_fd = redirect_opt_num(&dest);
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        redir_style = REDIRECT_INPUT;
-                        if (next == '<') {
-                                redir_style = REDIRECT_HEREDOC;
-                                heredoc_cnt++;
-                                debug_printf_parse("++heredoc_cnt=%d\n", heredoc_cnt);
-                                ch = i_getch(input);
-                                nommu_addchr(&ctx.as_string, ch);
-                        } else if (next == '>') {
-                                redir_style = REDIRECT_IO;
-                                ch = i_getch(input);
-                                nommu_addchr(&ctx.as_string, ch);
-                        }
-#if 0
-                        else if (next == '(') {
-                                syntax_error("<(process) not supported");
-                                goto parse_error;
-                        }
-#endif
-                        if (parse_redirect(&ctx, redir_fd, redir_style, input))
-                                goto parse_error;
-                        continue; /* back to top of while (1) */
-                }
-
-                if (dest.o_assignment == MAYBE_ASSIGNMENT
-                 /* check that we are not in word in "a=1 2>word b=1": */
-                 && !ctx.pending_redirect
-                ) {
-                        /* ch is a special char and thus this word
-                         * cannot be an assignment */
-                        dest.o_assignment = NOT_ASSIGNMENT;
-                }
-
-                /* Note: nommu_addchr(&ctx.as_string, ch) is already done */
-
-                switch (ch) {
-                case '#':
-                        if (dest.length == 0) {
-                                while (1) {
-                                        ch = i_peek(input);
-                                        if (ch == EOF || ch == '\n')
-                                                break;
-                                        i_getch(input);
-                                        /* note: we do not add it to &ctx.as_string */
-                                }
-                                nommu_addchr(&ctx.as_string, '\n');
-                        } else {
-                                o_addQchr(&dest, ch);
-                        }
-                        break;
-                case '\\':
-                        if (next == EOF) {
-                                syntax_error("\\<eof>");
-                                xfunc_die();
-                        }
-                        ch = i_getch(input);
-                        if (ch != '\n') {
-                                o_addchr(&dest, '\\');
-                                /*nommu_addchr(&ctx.as_string, '\\'); - already done */
-                                o_addchr(&dest, ch);
-                                nommu_addchr(&ctx.as_string, ch);
-                                /* Example: echo Hello \2>file
-                                 * we need to know that word 2 is quoted */
-                                dest.has_quoted_part = 1;
-                        }
-#if !BB_MMU
-                        else {
-                                /* It's "\<newline>". Remove trailing '\' from ctx.as_string */
-                                ctx.as_string.data[--ctx.as_string.length] = '\0';
-                        }
-#endif
-                        break;
-                case '$':
-                        if (parse_dollar(&ctx.as_string, &dest, input) != 0) {
-                                debug_printf_parse("parse_stream parse error: "
-                                        "parse_dollar returned non-0\n");
-                                goto parse_error;
-                        }
-                        break;
-                case '\'':
-                        dest.has_quoted_part = 1;
-                        while (1) {
-                                ch = i_getch(input);
-                                if (ch == EOF) {
-                                        syntax_error_unterm_ch('\'');
-                                        /*xfunc_die(); - redundant */
-                                }
-                                nommu_addchr(&ctx.as_string, ch);
-                                if (ch == '\'')
-                                        break;
-                                o_addqchr(&dest, ch);
-                        }
-                        break;
-                case '"':
-                        dest.has_quoted_part = 1;
-                        is_in_dquote ^= 1; /* invert */
-                        if (dest.o_assignment == NOT_ASSIGNMENT)
-                                dest.o_escape ^= 1;
-                        break;
-#if ENABLE_HUSH_TICK
-                case '`': {
-                        unsigned pos;
-
-                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
-                        o_addchr(&dest, '`');
-                        pos = dest.length;
-                        add_till_backquote(&dest, input);
-# if !BB_MMU
-                        o_addstr(&ctx.as_string, dest.data + pos);
-                        o_addchr(&ctx.as_string, '`');
-# endif
-                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
-                        //debug_printf_subst("SUBST RES3 '%s'\n", dest.data + pos);
-                        break;
-                }
-#endif
-                case ';':
-#if ENABLE_HUSH_CASE
- case_semi:
-#endif
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        done_pipe(&ctx, PIPE_SEQ);
-#if ENABLE_HUSH_CASE
-                        /* Eat multiple semicolons, detect
-                         * whether it means something special */
-                        while (1) {
-                                ch = i_peek(input);
-                                if (ch != ';')
-                                        break;
-                                ch = i_getch(input);
-                                nommu_addchr(&ctx.as_string, ch);
-                                if (ctx.ctx_res_w == RES_CASE_BODY) {
-                                        ctx.ctx_dsemicolon = 1;
-                                        ctx.ctx_res_w = RES_MATCH;
-                                        break;
-                                }
-                        }
-#endif
- new_cmd:
-                        /* We just finished a cmd. New one may start
-                         * with an assignment */
-                        dest.o_assignment = MAYBE_ASSIGNMENT;
-                        break;
-                case '&':
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-                        if (next == '&') {
-                                ch = i_getch(input);
-                                nommu_addchr(&ctx.as_string, ch);
-                                done_pipe(&ctx, PIPE_AND);
-                        } else {
-                                done_pipe(&ctx, PIPE_BG);
-                        }
-                        goto new_cmd;
-                case '|':
-                        if (done_word(&dest, &ctx)) {
-                                goto parse_error;
-                        }
-#if ENABLE_HUSH_CASE
-                        if (ctx.ctx_res_w == RES_MATCH)
-                                break; /* we are in case's "word | word)" */
-#endif
-                        if (next == '|') { /* || */
-                                ch = i_getch(input);
-                                nommu_addchr(&ctx.as_string, ch);
-                                done_pipe(&ctx, PIPE_OR);
-                        } else {
-                                /* we could pick up a file descriptor choice here
-                                 * with redirect_opt_num(), but bash doesn't do it.
-                                 * "echo foo 2| cat" yields "foo 2". */
-                                done_command(&ctx);
-#if !BB_MMU
-                                o_reset_to_empty_unquoted(&ctx.as_string);
-#endif
-                        }
-                        goto new_cmd;
-                case '(':
-#if ENABLE_HUSH_CASE
-                        /* "case... in [(]word)..." - skip '(' */
-                        if (ctx.ctx_res_w == RES_MATCH
-                         && ctx.command->argv == NULL /* not (word|(... */
-                         && dest.length == 0 /* not word(... */
-                         && dest.has_quoted_part == 0 /* not ""(... */
-                        ) {
-                                continue;
-                        }
-#endif
-                case '{':
-                        if (parse_group(&dest, &ctx, input, ch) != 0) {
-                                goto parse_error;
-                        }
-                        goto new_cmd;
-                case ')':
-#if ENABLE_HUSH_CASE
-                        if (ctx.ctx_res_w == RES_MATCH)
-                                goto case_semi;
-#endif
-                case '}':
-                        /* proper use of this character is caught by end_trigger:
-                         * if we see {, we call parse_group(..., end_trigger='}')
-                         * and it will match } earlier (not here). */
-                        syntax_error_unexpected_ch(ch);
-                        goto parse_error;
-                default:
-                        if (HUSH_DEBUG)
-                                bb_error_msg_and_die("BUG: unexpected %c\n", ch);
-                }
-        } /* while (1) */
-
- parse_error:
-        {
-                struct parse_context *pctx;
-                IF_HAS_KEYWORDS(struct parse_context *p2;)
-
-                /* Clean up allocated tree.
-                 * Sample for finding leaks on syntax error recovery path.
-                 * Run it from interactive shell, watch pmap `pidof hush`.
-                 * while if false; then false; fi; do break; fi
-                 * Samples to catch leaks at execution:
-                 * while if (true | {true;}); then echo ok; fi; do break; done
-                 * while if (true | {true;}); then echo ok; fi; do (if echo ok; break; then :; fi) | cat; break; done
-                 */
-                pctx = &ctx;
-                do {
-                        /* Update pipe/command counts,
-                         * otherwise freeing may miss some */
-                        done_pipe(pctx, PIPE_SEQ);
-                        debug_printf_clean("freeing list %p from ctx %p\n",
-                                        pctx->list_head, pctx);
-                        debug_print_tree(pctx->list_head, 0);
-                        free_pipe_list(pctx->list_head);
-                        debug_printf_clean("freed list %p\n", pctx->list_head);
-#if !BB_MMU
-                        o_free_unsafe(&pctx->as_string);
-#endif
-                        IF_HAS_KEYWORDS(p2 = pctx->stack;)
-                        if (pctx != &ctx) {
-                                free(pctx);
-                        }
-                        IF_HAS_KEYWORDS(pctx = p2;)
-                } while (HAS_KEYWORDS && pctx);
-                /* Free text, clear all dest fields */
-                o_free(&dest);
-                /* If we are not in top-level parse, we return,
-                 * our caller will propagate error.
-                 */
-                if (end_trigger != ';') {
-#if !BB_MMU
-                        if (pstring)
-                                *pstring = NULL;
-#endif
-                        debug_leave();
-                        return ERR_PTR;
-                }
-                /* Discard cached input, force prompt */
-                input->p = NULL;
-                IF_HUSH_INTERACTIVE(input->promptme = 1;)
-                goto reset;
-        }
-}
-
-/* Executing from string: eval, sh -c '...'
- *          or from file: /etc/profile, . file, sh <script>, sh (intereactive)
- * end_trigger controls how often we stop parsing
- * NUL: parse all, execute, return
- * ';': parse till ';' or newline, execute, repeat till EOF
- */
-static void parse_and_run_stream(struct in_str *inp, int end_trigger)
-{
-        /* Why we need empty flag?
-         * An obscure corner case "false; ``; echo $?":
-         * empty command in `` should still set $? to 0.
-         * But we can't just set $? to 0 at the start,
-         * this breaks "false; echo `echo $?`" case.
-         */
-        bool empty = 1;
-        while (1) {
-                struct pipe *pipe_list;
-
-                pipe_list = parse_stream(NULL, inp, end_trigger);
-                if (!pipe_list) { /* EOF */
-                        if (empty)
-                                G.last_exitcode = 0;
-                        break;
-                }
-                debug_print_tree(pipe_list, 0);
-                debug_printf_exec("parse_and_run_stream: run_and_free_list\n");
-                run_and_free_list(pipe_list);
-                empty = 0;
-        }
-}
-
-static void parse_and_run_string(const char *s)
-{
-        struct in_str input;
-        setup_string_in_str(&input, s);
-        parse_and_run_stream(&input, '\0');
-}
-
-static void parse_and_run_file(FILE *f)
-{
-        struct in_str input;
-        setup_file_in_str(&input, f);
-        parse_and_run_stream(&input, ';');
-}
-
 /* Called a few times only (or even once if "sh -c") */
 static void init_sigmasks(void)
 {