hush: improve parse_stream: does not require parsing context struct;

 cleans up on syntax errors (we used to leak memory in this case);
 much simplified interface to the rest of hush.

function                                             old     new   delta
parse_stream                                        1204    1447    +243
done_word                                            658     669     +11
static_get                                            22      28      +6
builtin_source                                        84      89      +5
parse_and_run_file                                    27      30      +3
parse_and_run_string                                  31      27      -4
builtin_eval                                          55      50      -5
hush_main                                            991     985      -6
free_pipe_list                                        39      31      -8
free_pipe                                            210     189     -21
expand_variables                                    2242    2199     -43
parse_and_run_stream                                 289     153    -136
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 5/7 up/down: 268/-223)           Total: 45 bytes

2 files changed, 268 insertions, 230 deletions

diff --git a/shell/hush.c b/shell/hush.c
index aa05e3a83..e0c1fde6b 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -217,24 +217,24 @@ void xxfree(void *ptr);
 void *xxmalloc(int lineno, size_t size)
 {
         void *ptr = xmalloc((size + 0xff) & ~0xff);
-        fprintf(stderr, "line %d: malloc %p\n", lineno, ptr);
+        fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
         return ptr;
 }
 void *xxrealloc(int lineno, void *ptr, size_t size)
 {
         ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
-        fprintf(stderr, "line %d: realloc %p\n", lineno, ptr);
+        fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
         return ptr;
 }
 char *xxstrdup(int lineno, const char *str)
 {
         char *ptr = xstrdup(str);
-        fprintf(stderr, "line %d: strdup %p\n", lineno, ptr);
+        fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
         return ptr;
 }
 void xxfree(void *ptr)
 {
-        fprintf(stderr, "free %p\n", ptr);
+        fdprintf(2, "free %p\n", ptr);
         free(ptr);
 }
 #define xmalloc(s)     xxmalloc(__LINE__, s)
@@ -244,12 +244,13 @@ void xxfree(void *ptr)
 #endif
 
 
+#define ERR_PTR ((void*)(long)1)
+
 static const char hush_version_str[] ALIGN1 = "HUSH_VERSION="HUSH_VER_STR;
 
 #define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
 
-#define SPECIAL_VAR_SYMBOL       3
-#define PARSEFLAG_EXIT_FROM_LOOP 1
+#define SPECIAL_VAR_SYMBOL 3
 
 typedef enum redir_type {
         REDIRECT_INPUT     = 1,
@@ -1209,8 +1210,10 @@ static void arith_set_local_var(const char *name, const char *val, int flags)
 static int static_get(struct in_str *i)
 {
         int ch = *i->p++;
-        if (ch == '\0') return EOF;
-        return ch;
+        if (ch != '\0')
+                return ch;
+        i->p--;
+        return EOF;
 }
 
 static int static_peek(struct in_str *i)
@@ -2147,18 +2150,18 @@ static void restore_redirects(int squirrel[])
 #define free_pipe_list(head, indent) free_pipe_list(head)
 #define free_pipe(pi, indent)        free_pipe(pi)
 #endif
-static int free_pipe_list(struct pipe *head, int indent);
+static void free_pipe_list(struct pipe *head, int indent);
 
 /* return code is the exit status of the pipe */
-static int free_pipe(struct pipe *pi, int indent)
+static void free_pipe(struct pipe *pi, int indent)
 {
         char **p;
         struct command *command;
         struct redir_struct *r, *rnext;
-        int a, i, ret_code = 0;
+        int a, i;
 
         if (pi->stopped_cmds > 0)
-                return ret_code;
+                return;
         debug_printf_clean("%s run pipe: (pid %d)\n", indenter(indent), getpid());
         for (i = 0; i < pi->num_cmds; i++) {
                 command = &pi->cmds[i];
@@ -2169,12 +2172,13 @@ static int free_pipe(struct pipe *pi, int indent)
                         }
                         free_strings(command->argv);
                         command->argv = NULL;
-                } else if (command->group) {
+                }
+                /* not "else if": on syntax error, we may have both! */
+                if (command->group) {
                         debug_printf_clean("%s   begin group (grp_type:%d)\n", indenter(indent), command->grp_type);
-                        ret_code = free_pipe_list(command->group, indent+3);
+                        free_pipe_list(command->group, indent+3);
                         debug_printf_clean("%s   end group\n", indenter(indent));
-                } else {
-                        debug_printf_clean("%s   (nil)\n", indenter(indent));
+                        command->group = NULL;
                 }
                 for (r = command->redirects; r; r = rnext) {
                         debug_printf_clean("%s   redirect %d%s", indenter(indent), r->fd, redir_table[r->rd_type].descrip);
@@ -2199,25 +2203,22 @@ static int free_pipe(struct pipe *pi, int indent)
         free(pi->cmdtext);
         pi->cmdtext = NULL;
 #endif
-        return ret_code;
 }
 
-static int free_pipe_list(struct pipe *head, int indent)
+static void free_pipe_list(struct pipe *head, int indent)
 {
-        int rcode = 0;   /* if list has no members */
         struct pipe *pi, *next;
 
         for (pi = head; pi; pi = next) {
 #if HAS_KEYWORDS
                 debug_printf_clean("%s pipe reserved mode %d\n", indenter(indent), pi->res_word);
 #endif
-                rcode = free_pipe(pi, indent);
+                free_pipe(pi, indent);
                 debug_printf_clean("%s pipe followup code %d\n", indenter(indent), pi->followup);
                 next = pi->next;
                 /*pi->next = NULL;*/
                 free(pi);
         }
-        return rcode;
 }
 
 
@@ -3412,7 +3413,6 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
                 new_p = new_pipe();
                 ctx->pipe->next = new_p;
                 ctx->pipe = new_p;
-                ctx->command = NULL; /* needed! */
                 /* RES_THEN, RES_DO etc are "sticky" -
                  * they remain set for commands inside if/while.
                  * This is used to control execution.
@@ -3428,6 +3428,7 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
                 if (ctx->ctx_res_w == RES_MATCH)
                         ctx->ctx_res_w = RES_CASEI;
 #endif
+                ctx->command = NULL; /* trick done_command below */
                 /* Create the memory for command, roughly:
                  * ctx->pipe->cmds = new struct command;
                  * ctx->command = &ctx->pipe->cmds[0];
@@ -3542,21 +3543,21 @@ static int reserved_word(o_string *word, struct parse_context *ctx)
 #endif
         if (r->flag == 0) { /* '!' */
                 if (ctx->ctx_inverted) { /* bash doesn't accept '! ! true' */
-                        syntax(NULL);
+                        syntax("! ! command");
                         IF_HAS_KEYWORDS(ctx->ctx_res_w = RES_SNTX;)
                 }
                 ctx->ctx_inverted = 1;
                 return 1;
         }
         if (r->flag & FLAG_START) {
-                struct parse_context *new;
-                debug_printf("push stack\n");
-                new = xmalloc(sizeof(*new));
-                *new = *ctx;   /* physical copy */
+                struct parse_context *old;
+                old = xmalloc(sizeof(*old));
+                debug_printf_parse("push stack %p\n", old);
+                *old = *ctx;   /* physical copy */
                 initialize_context(ctx);
-                ctx->stack = new;
+                ctx->stack = old;
         } else if (/*ctx->ctx_res_w == RES_NONE ||*/ !(ctx->old_flag & (1 << r->res))) {
-                syntax(NULL);
+                syntax(word->data);
                 ctx->ctx_res_w = RES_SNTX;
                 return 1;
         }
@@ -3564,8 +3565,8 @@ static int reserved_word(o_string *word, struct parse_context *ctx)
         ctx->old_flag = r->flag;
         if (ctx->old_flag & FLAG_END) {
                 struct parse_context *old;
-                debug_printf("pop stack\n");
                 done_pipe(ctx, PIPE_SEQ);
+                debug_printf_parse("pop stack %p\n", ctx->stack);
                 old = ctx->stack;
                 old->command->group = ctx->list_head;
                 old->command->grp_type = GRP_NORMAL;
@@ -3577,10 +3578,10 @@ static int reserved_word(o_string *word, struct parse_context *ctx)
 }
 #endif
 
-//TODO: many, many callers don't check error from done_word()
-
 /* Word is complete, look at it and update parsing context.
- * Normal return is 0. Syntax errors return 1. */
+ * Normal return is 0. Syntax errors return 1.
+ * Note: on return, word is reset, but not o_free'd!
+ */
 static int done_word(o_string *word, struct parse_context *ctx)
 {
         struct command *command = ctx->command;
@@ -3610,10 +3611,14 @@ static int done_word(o_string *word, struct parse_context *ctx)
                 debug_printf("word stored in rd_filename: '%s'\n", word->data);
         } else {
                 /* "{ echo foo; } echo bar" - bad */
-                /* NB: bash allows e.g. "if true; then { echo foo; } fi". TODO? */
+                /* NB: bash allows e.g.:
+                 * if true; then { echo foo; } fi
+                 * while if false; then false; fi do break; done
+                 * TODO? */
                 if (command->group) {
-                        syntax(NULL);
-                        debug_printf_parse("done_word return 1: syntax error, groups and arglists don't mix\n");
+                        syntax(word->data);
+                        debug_printf_parse("done_word return 1: syntax error, "
+                                        "groups and arglists don't mix\n");
                         return 1;
                 }
 #if HAS_KEYWORDS
@@ -3716,8 +3721,7 @@ static int redirect_opt_num(o_string *o)
         return num;
 }
 
-static int parse_stream(o_string *dest, struct parse_context *ctx,
-                struct in_str *input0, int end_trigger);
+static struct pipe *parse_stream(struct in_str *input, int end_trigger);
 
 #if ENABLE_HUSH_TICK
 static FILE *generate_stream_from_list(struct pipe *head)
@@ -3767,24 +3771,25 @@ static int process_command_subs(o_string *dest,
                 struct in_str *input)
 {
         int retcode, ch, eol_cnt;
-        o_string result = NULL_O_STRING;
-        struct parse_context inner;
+        struct pipe *pipe_list;
         FILE *p;
         struct in_str pipe_str;
 
         /* Recursion to generate command */
-        retcode = parse_stream(&result, &inner, input, '\0');
-        if (retcode != 0)
-                return retcode;  /* syntax error or EOF */
-        o_free(&result);
-
-        p = generate_stream_from_list(inner.list_head);
+        pipe_list = parse_stream(input, '\0');
+        if (pipe_list == NULL)
+                return 0;  /* EOF: empty `cmd`: ``, `  ` etc */
+        if (pipe_list == ERR_PTR)
+                return 1;  /* parse error. can this really happen? */
+
+        p = generate_stream_from_list(pipe_list);
+        free_pipe_list(pipe_list, /* indent: */ 0);
         if (p == NULL)
                 return 1;
         close_on_exec_on(fileno(p));
-        setup_file_in_str(&pipe_str, p);
 
         /* Now send results of command back into original context */
+        setup_file_in_str(&pipe_str, p);
         eol_cnt = 0;
         while ((ch = i_getch(&pipe_str)) != EOF) {
                 if (ch == '\n') {
@@ -3805,7 +3810,6 @@ static int process_command_subs(o_string *dest,
          * echo `echo Hi; exec 1>&-; sleep 2`
          */
         retcode = fclose(p);
-        free_pipe_list(inner.list_head, /* indent: */ 0);
         debug_printf("closed FILE from child, retcode=%d\n", retcode);
         return retcode;
 }
@@ -3817,9 +3821,8 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
         /* dest contains characters seen prior to ( or {.
          * Typically it's empty, but for function defs,
          * it contains function name (without '()'). */
-        int rcode;
+        struct pipe *pipe_list;
         int endch;
-        struct parse_context sub;
         struct command *command = ctx->command;
 
         debug_printf_parse("parse_group entered\n");
@@ -3845,12 +3848,16 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
                 endch = ')';
                 command->grp_type = GRP_SUBSHELL;
         }
-        rcode = parse_stream(dest, &sub, input, endch);
-        if (rcode == 0) {
-                command->group = sub.list_head;
+        pipe_list = parse_stream(input, endch);
+        /* empty ()/{} or parse error? */
+        if (!pipe_list || pipe_list == ERR_PTR) {
+                syntax(NULL);
+                debug_printf_parse("parse_group return 1: parse_stream returned %p\n", pipe_list);
+                return 1;
         }
-        debug_printf_parse("parse_group return %d\n", rcode);
-        return rcode;
+        command->group = pipe_list;
+        debug_printf_parse("parse_group return 0\n");
+        return 0;
         /* command remains "open", available for possible redirects */
 }
 
@@ -4211,17 +4218,18 @@ static int parse_stream_dquoted(o_string *dest, struct in_str *input, int dquote
         goto again;
 }
 
-/* Initalize ctx (i.e. caller does not need to do that).
- * Scan input, call done_word() whenever full IFS delimited word was seen.
- * Call done_pipe if '\n' was seen (and end_trigger != NULL).
- * Return code is 0 if end_trigger char is met,
- * -1 on EOF (but if end_trigger == NULL then return 0),
- * 1 for syntax error
- * Net result is a list of pipes in ctx->list_head.
+/*
+ * Scan input until EOF or end_trigger char.
+ * Return a list of pipes to execute, or NULL on EOF
+ * or if end_trigger character is met.
+ * On syntax error, exit is shell is not interactive,
+ * reset parsing machinery and start parsing anew,
+ * or return ERR_PTR.
  */
-static int parse_stream(o_string *dest, struct parse_context *ctx,
-                struct in_str *input, int end_trigger)
+static struct pipe *parse_stream(struct in_str *input, int end_trigger)
 {
+        struct parse_context ctx;
+        o_string dest = NULL_O_STRING;
         int ch, m;
         int redir_fd;
         redir_type redir_style;
@@ -4232,18 +4240,22 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
          * A single-quote triggers a bypass of the main loop until its mate is
          * found.  When recursing, quote state is passed in via dest->o_escape. */
 
-        debug_printf_parse("parse_stream entered, end_trigger='%c' "
-                "dest->o_assignment:%d\n", end_trigger ? : 'X'
-                , dest->o_assignment);
+        debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
+                        end_trigger ? : 'X');
 
-        dest->o_assignment = MAYBE_ASSIGNMENT;
-        initialize_context(ctx);
-        is_in_dquote = dest->o_escape;
+ reset:
+#if ENABLE_HUSH_INTERACTIVE
+        input->promptmode = 0; /* PS1 */
+#endif
+        /* dest.o_assignment = MAYBE_ASSIGNMENT; - already is */
+        initialize_context(&ctx);
+        is_in_dquote = 0;
         while (1) {
                 if (is_in_dquote) {
-                        if (parse_stream_dquoted(dest, input, '"'))
-                                return 1; /* propagate parse error */
-                        /* If we're here, we reached closing '"' */
+                        if (parse_stream_dquoted(&dest, input, '"')) {
+                                goto parse_error;
+                        }
+                        /* We reached closing '"' */
                         is_in_dquote = 0;
                 }
                 m = CHAR_IFS;
@@ -4256,15 +4268,15 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                         }
                 }
                 debug_printf_parse(": ch=%c (%d) m=%d escape=%d\n",
-                                                ch, ch, m, dest->o_escape);
+                                                ch, ch, m, dest.o_escape);
                 if (m == CHAR_ORDINARY) {
-                        o_addQchr(dest, ch);
-                        if ((dest->o_assignment == MAYBE_ASSIGNMENT
-                            || dest->o_assignment == WORD_IS_KEYWORD)
+                        o_addQchr(&dest, ch);
+                        if ((dest.o_assignment == MAYBE_ASSIGNMENT
+                            || dest.o_assignment == WORD_IS_KEYWORD)
                          && ch == '='
-                         && is_assignment(dest->data)
+                         && is_assignment(dest.data)
                         ) {
-                                dest->o_assignment = DEFINITELY_ASSIGNMENT;
+                                dest.o_assignment = DEFINITELY_ASSIGNMENT;
                         }
                         continue;
                 }
@@ -4272,25 +4284,40 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                 /* m is SPECIAL ($,`), IFS, or ORDINARY_IF_QUOTED (*,#) */
 
                 if (m == CHAR_IFS) {
-                        if (ch == EOF)
-                                goto ret_EOF;
-                        if (done_word(dest, ctx)) {
-                                debug_printf_parse("parse_stream return 1: done_word!=0\n");
-                                return 1;
+                        if (ch == EOF) {
+                                struct pipe *pi;
+                                if (done_word(&dest, &ctx)) {
+                                        goto parse_error;
+                                }
+                                o_free(&dest);
+                                done_pipe(&ctx, PIPE_SEQ);
+                                /* If we got nothing... */
+                                pi = ctx.list_head;
+                                if (pi->num_cmds == 0
+                                 && pi->res_word == RES_NONE
+                                ) {
+                                        free_pipe_list(pi, 0);
+                                        pi = NULL;
+                                }
+                                debug_printf_parse("parse_stream return %p\n", pi);
+                                return pi;
+                        }
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
                         }
                         if (ch == '\n') {
 #if ENABLE_HUSH_CASE
                                 /* "case ... in <newline> word) ..." -
                                  * newlines are ignored (but ';' wouldn't be) */
-                                if (ctx->command->argv == NULL
-                                 && ctx->ctx_res_w == RES_MATCH
+                                if (ctx.command->argv == NULL
+                                 && ctx.ctx_res_w == RES_MATCH
                                 ) {
                                         continue;
                                 }
 #endif
                                 /* Treat newline as a command separator. */
-                                done_pipe(ctx, PIPE_SEQ);
-                                dest->o_assignment = MAYBE_ASSIGNMENT;
+                                done_pipe(&ctx, PIPE_SEQ);
+                                dest.o_assignment = MAYBE_ASSIGNMENT;
                                 ch = ';';
                                 /* note: if (m == CHAR_IFS) continue;
                                  * will still trigger for us */
@@ -4298,15 +4325,20 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                 }
                 if (end_trigger && end_trigger == ch) {
 //TODO: disallow "{ cmd }" without semicolon
-                        done_word(dest, ctx);
-                        done_pipe(ctx, PIPE_SEQ);
-                        dest->o_assignment = MAYBE_ASSIGNMENT;
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        done_pipe(&ctx, PIPE_SEQ);
+                        dest.o_assignment = MAYBE_ASSIGNMENT;
                         /* Do we sit outside of any if's, loops or case's? */
                         if (!HAS_KEYWORDS
-                         IF_HAS_KEYWORDS(|| (ctx->ctx_res_w == RES_NONE && ctx->old_flag == 0))
+                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
                         ) {
-                                debug_printf_parse("parse_stream return 0: end_trigger char found\n");
-                                return 0;
+                                debug_printf_parse("parse_stream return %p: "
+                                                "end_trigger char found\n",
+                                                ctx.list_head);
+                                o_free(&dest);
+                                return ctx.list_head;
                         }
                 }
                 if (m == CHAR_IFS)
@@ -4314,15 +4346,15 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
 
                 /* m is SPECIAL (e.g. $,`) or ORDINARY_IF_QUOTED (*,#) */
 
-                if (dest->o_assignment == MAYBE_ASSIGNMENT) {
+                if (dest.o_assignment == MAYBE_ASSIGNMENT) {
                         /* ch is a special char and thus this word
                          * cannot be an assignment */
-                        dest->o_assignment = NOT_ASSIGNMENT;
+                        dest.o_assignment = NOT_ASSIGNMENT;
                 }
 
                 switch (ch) {
                 case '#':
-                        if (dest->length == 0) {
+                        if (dest.length == 0) {
                                 while (1) {
                                         ch = i_peek(input);
                                         if (ch == EOF || ch == '\n')
@@ -4330,61 +4362,61 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                                         i_getch(input);
                                 }
                         } else {
-                                o_addQchr(dest, ch);
+                                o_addQchr(&dest, ch);
                         }
                         break;
                 case '\\':
                         if (next == EOF) {
                                 syntax("\\<eof>");
-                                debug_printf_parse("parse_stream return 1: \\<eof>\n");
-                                return 1;
+                                goto parse_error;
                         }
-                        o_addchr(dest, '\\');
-                        o_addchr(dest, i_getch(input));
+                        o_addchr(&dest, '\\');
+                        o_addchr(&dest, i_getch(input));
                         break;
                 case '$':
-                        if (handle_dollar(dest, input) != 0) {
-                                debug_printf_parse("parse_stream return 1: handle_dollar returned non-0\n");
-                                return 1;
+                        if (handle_dollar(&dest, input) != 0) {
+                                debug_printf_parse("parse_stream parse error: handle_dollar returned non-0\n");
+                                goto parse_error;
                         }
                         break;
                 case '\'':
-                        dest->nonnull = 1;
+                        dest.nonnull = 1;
                         while (1) {
                                 ch = i_getch(input);
                                 if (ch == EOF) {
                                         syntax("unterminated '");
-                                        debug_printf_parse("parse_stream return 1: unterminated '\n");
-                                        return 1;
+                                        goto parse_error;
                                 }
                                 if (ch == '\'')
                                         break;
-                                if (dest->o_assignment == NOT_ASSIGNMENT)
-                                        o_addqchr(dest, ch);
+                                if (dest.o_assignment == NOT_ASSIGNMENT)
+                                        o_addqchr(&dest, ch);
                                 else
-                                        o_addchr(dest, ch);
+                                        o_addchr(&dest, ch);
                         }
                         break;
                 case '"':
-                        dest->nonnull = 1;
+                        dest.nonnull = 1;
                         is_in_dquote ^= 1; /* invert */
-                        if (dest->o_assignment == NOT_ASSIGNMENT)
-                                dest->o_escape ^= 1;
+                        if (dest.o_assignment == NOT_ASSIGNMENT)
+                                dest.o_escape ^= 1;
                         break;
 #if ENABLE_HUSH_TICK
                 case '`': {
-                        //int pos = dest->length;
-                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                        o_addchr(dest, '`');
-                        add_till_backquote(dest, input);
-                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
-                        //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
+                        //int pos = dest.length;
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(&dest, '`');
+                        add_till_backquote(&dest, input);
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        //debug_printf_subst("SUBST RES3 '%s'\n", dest.data + pos);
                         break;
                 }
 #endif
                 case '>':
-                        redir_fd = redirect_opt_num(dest);
-                        done_word(dest, ctx);
+                        redir_fd = redirect_opt_num(&dest);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
                         redir_style = REDIRECT_OVERWRITE;
                         if (next == '>') {
                                 redir_style = REDIRECT_APPEND;
@@ -4393,15 +4425,16 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
 #if 0
                         else if (next == '(') {
                                 syntax(">(process) not supported");
-                                debug_printf_parse("parse_stream return 1: >(process) not supported\n");
-                                return 1;
+                                goto parse_error;
                         }
 #endif
-                        setup_redirect(ctx, redir_fd, redir_style, input);
+                        setup_redirect(&ctx, redir_fd, redir_style, input);
                         break;
                 case '<':
-                        redir_fd = redirect_opt_num(dest);
-                        done_word(dest, ctx);
+                        redir_fd = redirect_opt_num(&dest);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
                         redir_style = REDIRECT_INPUT;
                         if (next == '<') {
                                 redir_style = REDIRECT_HEREIS;
@@ -4413,18 +4446,19 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
 #if 0
                         else if (next == '(') {
                                 syntax("<(process) not supported");
-                                debug_printf_parse("parse_stream return 1: <(process) not supported\n");
-                                return 1;
+                                goto parse_error;
                         }
 #endif
-                        setup_redirect(ctx, redir_fd, redir_style, input);
+                        setup_redirect(&ctx, redir_fd, redir_style, input);
                         break;
                 case ';':
 #if ENABLE_HUSH_CASE
  case_semi:
 #endif
-                        done_word(dest, ctx);
-                        done_pipe(ctx, PIPE_SEQ);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
+                        done_pipe(&ctx, PIPE_SEQ);
 #if ENABLE_HUSH_CASE
                         /* Eat multiple semicolons, detect
                          * whether it means something special */
@@ -4433,9 +4467,9 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                                 if (ch != ';')
                                         break;
                                 i_getch(input);
-                                if (ctx->ctx_res_w == RES_CASEI) {
-                                        ctx->ctx_dsemicolon = 1;
-                                        ctx->ctx_res_w = RES_MATCH;
+                                if (ctx.ctx_res_w == RES_CASEI) {
+                                        ctx.ctx_dsemicolon = 1;
+                                        ctx.ctx_res_w = RES_MATCH;
                                         break;
                                 }
                         }
@@ -4443,51 +4477,55 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
  new_cmd:
                         /* We just finished a cmd. New one may start
                          * with an assignment */
-                        dest->o_assignment = MAYBE_ASSIGNMENT;
+                        dest.o_assignment = MAYBE_ASSIGNMENT;
                         break;
                 case '&':
-                        done_word(dest, ctx);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
                         if (next == '&') {
                                 i_getch(input);
-                                done_pipe(ctx, PIPE_AND);
+                                done_pipe(&ctx, PIPE_AND);
                         } else {
-                                done_pipe(ctx, PIPE_BG);
+                                done_pipe(&ctx, PIPE_BG);
                         }
                         goto new_cmd;
                 case '|':
-                        done_word(dest, ctx);
+                        if (done_word(&dest, &ctx)) {
+                                goto parse_error;
+                        }
 #if ENABLE_HUSH_CASE
-                        if (ctx->ctx_res_w == RES_MATCH)
+                        if (ctx.ctx_res_w == RES_MATCH)
                                 break; /* we are in case's "word | word)" */
 #endif
                         if (next == '|') { /* || */
                                 i_getch(input);
-                                done_pipe(ctx, PIPE_OR);
+                                done_pipe(&ctx, PIPE_OR);
                         } else {
                                 /* we could pick up a file descriptor choice here
                                  * with redirect_opt_num(), but bash doesn't do it.
                                  * "echo foo 2| cat" yields "foo 2". */
-                                done_command(ctx);
+                                done_command(&ctx);
                         }
                         goto new_cmd;
                 case '(':
 #if ENABLE_HUSH_CASE
                         /* "case... in [(]word)..." - skip '(' */
-                        if (ctx->ctx_res_w == RES_MATCH
-                         && ctx->command->argv == NULL /* not (word|(... */
-                         && dest->length == 0 /* not word(... */
-                         && dest->nonnull == 0 /* not ""(... */
+                        if (ctx.ctx_res_w == RES_MATCH
+                         && ctx.command->argv == NULL /* not (word|(... */
+                         && dest.length == 0 /* not word(... */
+                         && dest.nonnull == 0 /* not ""(... */
                         ) {
                                 continue;
                         }
 #endif
 #if ENABLE_HUSH_FUNCTIONS
-                        if (dest->length != 0 /* not just () but word() */
-                         && dest->nonnull == 0 /* not a"b"c() */
-                         && ctx->command->argv == NULL /* it's the first word */
+                        if (dest.length != 0 /* not just () but word() */
+                         && dest.nonnull == 0 /* not a"b"c() */
+                         && ctx.command->argv == NULL /* it's the first word */
 //TODO: "func ( ) {...}" - note spaces - is valid format too in bash
                          && i_peek(input) == ')'
-                         && !match_reserved_word(dest)
+                         && !match_reserved_word(&dest)
                         ) {
                                 bb_error_msg("seems like a function definition");
                                 i_getch(input);
@@ -4497,21 +4535,19 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                                 } while (ch == ' ' || ch == '\n');
                                 if (ch != '{') {
                                         syntax("was expecting {");
-                                        debug_printf_parse("parse_stream return 1\n");
-                                        return 1;
+                                        goto parse_error;
                                 }
                                 ch = 'F'; /* magic value */
                         }
 #endif
                 case '{':
-                        if (parse_group(dest, ctx, input, ch) != 0) {
-                                debug_printf_parse("parse_stream return 1: parse_group returned non-0\n");
-                                return 1;
+                        if (parse_group(&dest, &ctx, input, ch) != 0) {
+                                goto parse_error;
                         }
                         goto new_cmd;
                 case ')':
 #if ENABLE_HUSH_CASE
-                        if (ctx->ctx_res_w == RES_MATCH)
+                        if (ctx.ctx_res_w == RES_MATCH)
                                 goto case_semi;
 #endif
                 case '}':
@@ -4519,23 +4555,51 @@ static int parse_stream(o_string *dest, struct parse_context *ctx,
                          * if we see {, we call parse_group(..., end_trigger='}')
                          * and it will match } earlier (not here). */
                         syntax("unexpected } or )");
-                        debug_printf_parse("parse_stream return 1: unexpected '}'\n");
-                        return 1;
+                        goto parse_error;
                 default:
                         if (HUSH_DEBUG)
                                 bb_error_msg_and_die("BUG: unexpected %c\n", ch);
                 }
         } /* while (1) */
 
-        /* Non-error returns */
- ret_EOF:
-        debug_printf_parse("parse_stream return %d\n", -(end_trigger != NULL));
-        done_word(dest, ctx);
-        done_pipe(ctx, PIPE_SEQ);
-        if (end_trigger) {
-                return -1; /* EOF found while expecting end_trigger */
+ parse_error:
+        {
+                struct parse_context *pctx, *p2;
+
+                /* Clean up allocated tree.
+                 * Samples for finding leaks on syntax error recovery path.
+                 * Execute them from interactive shell and watch pmap `pidof hush`.
+                 * while if false; then false; fi do break; done (bash accepts it)
+                 * while if false; then false; fi; do break; fi
+                 */
+                pctx = &ctx;
+                do {
+                        /* Update pipe/command counts,
+                         * otherwise freeing may miss some */
+                        done_pipe(pctx, PIPE_SEQ);
+                        debug_printf_clean("freeing list %p from ctx %p\n",
+                                        pctx->list_head, pctx);
+                        debug_print_tree(pctx->list_head, 0);
+                        free_pipe_list(pctx->list_head, 0);
+                        debug_printf_clean("freed list %p\n", pctx->list_head);
+                        p2 = pctx->stack;
+                        if (pctx != &ctx) {
+                                free(pctx);
+                        }
+                        pctx = p2;
+                } while (pctx);
+                /* Free text, clear all dest fields */
+                o_free(&dest);
+                /* If we are not in top-level parse, we return,
+                 * our caller will propagate error.
+                 */
+                if (end_trigger != ';')
+                        return ERR_PTR;
+                /* Discard cached input, force prompt */
+                input->p = NULL;
+                input->promptme = 1;
+                goto reset;
         }
-        return 0;
 }
 
 static void set_in_charmap(const char *set, int code)
@@ -4565,71 +4629,41 @@ static void update_charmap(void)
         set_in_charmap(G.ifs, CHAR_IFS);  /* are ordinary if quoted */
 }
 
-/* Most recursion does not come through here, the exception is
- * from builtin_source() and builtin_eval() */
-static int parse_and_run_stream(struct in_str *inp, int parse_flag)
+/* Execiting from string: eval, sh -c '...'
+ *          or from file: /etc/profile, . file, sh <script>, sh (intereactive)
+ * end_trigger controls how often we stop parsing
+ * NUL: parse all, execute, return
+ * ';': parse till ';' or newline, execute, repeat till EOF
+ */
+static void parse_and_run_stream(struct in_str *inp, int end_trigger)
 {
-        struct parse_context ctx;
-        o_string temp = NULL_O_STRING;
-        int rcode;
+        while (1) {
+                struct pipe *pipe_list;
 
-        do {
                 update_charmap();
-#if ENABLE_HUSH_INTERACTIVE
-                inp->promptmode = 0; /* PS1 */
-#endif
-                /* We will stop & execute after each ';' or '\n'.
-                 * Example: "sleep 9999; echo TEST" + ctrl-C:
-                 * TEST should be printed */
-                temp.o_assignment = MAYBE_ASSIGNMENT;
-                rcode = parse_stream(&temp, &ctx, inp, ';');
-                debug_printf_parse("rcode %d ctx.old_flag %x\n", rcode, ctx.old_flag);
-#if HAS_KEYWORDS
-                if (rcode != 1 && ctx.old_flag != 0) {
-                        syntax(NULL);
-                }
-#endif
-                if (rcode != 1 IF_HAS_KEYWORDS(&& ctx.old_flag == 0)) {
-                        debug_print_tree(ctx.list_head, 0);
-                        debug_printf_exec("parse_and_run_stream: run_and_free_list\n");
-                        run_and_free_list(ctx.list_head);
-                } else {
-                        /* We arrive here also if rcode == 1 (error in parse_stream) */
-#if HAS_KEYWORDS
-                        if (ctx.old_flag != 0) {
-                                free(ctx.stack);
-                                o_reset(&temp);
-                        }
-#endif
-                        /*temp.nonnull = 0; - o_free does it below */
-                        /*temp.o_escape = 0; - o_free does it below */
-                        free_pipe_list(ctx.list_head, /* indent: */ 0);
-                        /* Discard all unprocessed line input, force prompt on */
-                        inp->p = NULL;
-#if ENABLE_HUSH_INTERACTIVE
-                        inp->promptme = 1;
-#endif
-                }
-                o_free(&temp);
-                /* loop on syntax errors, return on EOF: */
-        } while (rcode != -1 && !(parse_flag & PARSEFLAG_EXIT_FROM_LOOP));
-        return 0;
+
+                pipe_list = parse_stream(inp, end_trigger);
+                if (!pipe_list) /* EOF */
+                        break;
+                debug_print_tree(pipe_list, 0);
+                debug_printf_exec("parse_and_run_stream: run_and_free_list\n");
+                run_and_free_list(pipe_list);
+                /* Loop on syntax errors, return on EOF: */
+        }
 }
 
-static int parse_and_run_string(const char *s, int parse_flag)
+static void parse_and_run_string(const char *s)
 {
         struct in_str input;
         setup_string_in_str(&input, s);
-        return parse_and_run_stream(&input, parse_flag);
+        parse_and_run_stream(&input, '\0');
 }
 
-static int parse_and_run_file(FILE *f)
+static void parse_and_run_file(FILE *f)
 {
-        int rcode;
         struct in_str input;
         setup_file_in_str(&input, f);
-        rcode = parse_and_run_stream(&input, 0 /* parse_flag */);
-        return rcode;
+        parse_and_run_stream(&input, ';');
 }
 
 #if ENABLE_HUSH_JOB
@@ -4753,7 +4787,7 @@ int hush_main(int argc, char **argv)
                                 optind--;
                         } /* else -c 'script' PAR0 PAR1: $0 is PAR0 */
                         G.global_argc = argc - optind;
-                        opt = parse_and_run_string(optarg, 0 /* parse_flag */);
+                        parse_and_run_string(optarg);
                         goto final_return;
                 case 'i':
                         /* Well, we cannot just declare interactiveness,
@@ -4851,14 +4885,14 @@ int hush_main(int argc, char **argv)
 #endif
 
         if (argv[optind] == NULL) {
-                opt = parse_and_run_file(stdin);
+                parse_and_run_file(stdin);
         } else {
                 debug_printf("\nrunning script '%s'\n", argv[optind]);
                 G.global_argv = argv + optind;
                 G.global_argc = argc - optind;
                 input = xfopen_for_read(argv[optind]);
                 fcntl(fileno(input), F_SETFD, FD_CLOEXEC);
-                opt = parse_and_run_file(input);
+                parse_and_run_file(input);
         }
 
  final_return:
@@ -4876,7 +4910,7 @@ int hush_main(int argc, char **argv)
                 free(tmp);
         }
 #endif
-        hush_exit(opt ? opt : G.last_return_code);
+        hush_exit(G.last_return_code);
 }
 
 
@@ -5000,7 +5034,11 @@ static int builtin_eval(char **argv)
 
         if (argv[1]) {
                 char *str = expand_strvec_to_string(argv + 1);
-                parse_and_run_string(str, PARSEFLAG_EXIT_FROM_LOOP);
+                /* bash:
+                 * eval "echo Hi; done" ("done" is syntax error):
+                 * "echo Hi" will not execute too.
+                 */
+                parse_and_run_string(str);
                 free(str);
                 rcode = G.last_return_code;
         }
@@ -5011,8 +5049,9 @@ static int builtin_cd(char **argv)
 {
         const char *newdir;
         if (argv[1] == NULL) {
-                // bash does nothing (exitcode 0) if HOME is ""; if it's unset,
-                // bash says "bash: cd: HOME not set" and does nothing (exitcode 1)
+                /* bash does nothing (exitcode 0) if HOME is ""; if it's unset,
+                 * bash says "bash: cd: HOME not set" and does nothing (exitcode 1)
+                 */
                 newdir = getenv("HOME") ? : "/";
         } else
                 newdir = argv[1];
@@ -5309,7 +5348,6 @@ static int builtin_shift(char **argv)
 static int builtin_source(char **argv)
 {
         FILE *input;
-        int status;
 
         if (argv[1] == NULL)
                 return EXIT_FAILURE;
@@ -5326,9 +5364,9 @@ static int builtin_source(char **argv)
         /* XXX argv and argc are broken; need to save old G.global_argv
          * (pointer only is OK!) on this stack frame,
          * set G.global_argv=argv+1, recurse, and restore. */
-        status = parse_and_run_file(input);
+        parse_and_run_file(input);
         fclose(input);
-        return status;
+        return G.last_return_code;
 }
 
 static int builtin_umask(char **argv)
diff --git a/shell/hush_test/hush-misc/syntax_err_negate.right b/shell/hush_test/hush-misc/syntax_err_negate.right
index d1e7654f5..8c7010629 100644
--- a/shell/hush_test/hush-misc/syntax_err_negate.right
+++ b/shell/hush_test/hush-misc/syntax_err_negate.right
@@ -1,2 +1,2 @@
 bash 3.2 fails this
-hush: syntax error
+hush: syntax error: ! ! command