Merge branch 'busybox' into merge

27 files changed, 427 insertions, 195 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 4bd1c2c9d..7131609e4 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -6272,7 +6272,7 @@ static int substr_atoi(const char *s)
 #define EXP_CASE        0x10    /* keeps quotes around for CASE pattern */
 #define EXP_VARTILDE2   0x20    /* expand tildes after colons only */
 #define EXP_WORD        0x40    /* expand word in parameter expansion */
-#define EXP_QUOTED      0x80    /* expand word in double quotes */
+#define EXP_QUOTED      0x100   /* expand word in double quotes */
 /*
  * rmescape() flags
  */
@@ -6606,9 +6606,7 @@ memtodest(const char *p, size_t len, int syntax, int quotes)
                         if (quotes & QUOTES_ESC) {
                                 int n = SIT(c, syntax);
                                 if (n == CCTL
-                                 || (((quotes & EXP_FULL) || syntax != BASESYNTAX)
-                                     && n == CBACK
-                                    )
+                                 || (syntax != BASESYNTAX && n == CBACK)
                                 ) {
                                         USTPUTC(CTLESC, q);
                                 }
@@ -7236,8 +7234,15 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
         if (subtype == VSREPLACE || subtype == VSREPLACEALL) {
                 /* Find '/' and replace with NUL */
                 repl = p;
+                /* The pattern can't be empty.
+                 * IOW: if the first char after "${v//" is a slash,
+                 * it does not terminate the pattern - it's the first char of the pattern:
+                 *  v=/dev/ram; echo ${v////-}  prints -dev-ram (pattern is "/")
+                 *  v=/dev/ram; echo ${v///r/-} prints /dev-am  (pattern is "/r")
+                 */
+                if (*repl == '/')
+                        repl++;
                 for (;;) {
-                        /* Handle escaped slashes, e.g. "${v/\//_}" (they are CTLESC'ed by this point) */
                         if (*repl == '\0') {
                                 repl = NULL;
                                 break;
@@ -7246,6 +7251,7 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                                 *repl = '\0';
                                 break;
                         }
+                        /* Handle escaped slashes, e.g. "${v/\//_}" (they are CTLESC'ed by this point) */
                         if ((unsigned char)*repl == CTLESC && repl[1])
                                 repl++;
                         repl++;
@@ -7549,14 +7555,13 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
  * ash -c 'echo ${#1#}'  name:'1=#'
  */
 static NOINLINE ssize_t
-varvalue(char *name, int varflags, int flags, int *quotedp)
+varvalue(char *name, int varflags, int flags, int quoted)
 {
         const char *p;
         int num;
         int i;
         ssize_t len = 0;
         int sep;
-        int quoted = *quotedp;
         int subtype = varflags & VSTYPE;
         int discard = subtype == VSPLUS || subtype == VSLENGTH;
         int quotes = (discard ? 0 : (flags & QUOTES_ESC)) | QUOTES_KEEPNUL;
@@ -7604,13 +7609,27 @@ varvalue(char *name, int varflags, int flags, int *quotedp)
         case '*': {
                 char **ap;
                 char sepc;
+                char c;
 
-                if (quoted)
-                        sep = 0;
-                sep |= ifsset() ? ifsval()[0] : ' ';
+                /* We will set c to 0 or ~0 depending on whether
+                 * we're doing field splitting.  We won't do field
+                 * splitting if either we're quoted or sep is zero.
+                 *
+                 * Instead of testing (quoted || !sep) the following
+                 * trick optimises away any branches by using the
+                 * fact that EXP_QUOTED (which is the only bit that
+                 * can be set in quoted) is the same as EXP_FULL <<
+                 * CHAR_BIT (which is the only bit that can be set
+                 * in sep).
+                 */
+#if EXP_QUOTED >> CHAR_BIT != EXP_FULL
+#error The following two lines expect EXP_QUOTED == EXP_FULL << CHAR_BIT
+#endif
+                c = !((quoted | ~sep) & EXP_QUOTED) - 1;
+                sep &= ~quoted;
+                sep |= ifsset() ? (unsigned char)(c & ifsval()[0]) : ' ';
  param:
                 sepc = sep;
-                *quotedp = !sepc;
                 ap = shellparam.p;
                 if (!ap)
                         return -1;
@@ -7675,7 +7694,6 @@ evalvar(char *p, int flag)
         char varflags;
         char subtype;
         int quoted;
-        char easy;
         char *var;
         int patloc;
         int startloc;
@@ -7689,12 +7707,11 @@ evalvar(char *p, int flag)
 
         quoted = flag & EXP_QUOTED;
         var = p;
-        easy = (!quoted || (*var == '@' && shellparam.nparam));
         startloc = expdest - (char *)stackblock();
         p = strchr(p, '=') + 1; //TODO: use var_end(p)?
 
  again:
-        varlen = varvalue(var, varflags, flag, &quoted);
+        varlen = varvalue(var, varflags, flag, quoted);
         if (varflags & VSNUL)
                 varlen--;
 
@@ -7740,8 +7757,11 @@ evalvar(char *p, int flag)
 
         if (subtype == VSNORMAL) {
  record:
-                if (!easy)
-                        goto end;
+                if (quoted) {
+                        quoted = *var == '@' && shellparam.nparam;
+                        if (!quoted)
+                                goto end;
+                }
                 recordregion(startloc, expdest - (char *)stackblock(), quoted);
                 goto end;
         }
@@ -7999,7 +8019,7 @@ expmeta(exp_t *exp, char *name, unsigned name_len, unsigned expdir_len)
                                 }
                         }
                 } else {
-                        if (*p == '\\')
+                        if (*p == '\\' && p[1])
                                 esc++;
                         if (p[esc] == '/') {
                                 if (metaflag)
@@ -8013,7 +8033,7 @@ expmeta(exp_t *exp, char *name, unsigned name_len, unsigned expdir_len)
                         return;
                 p = name;
                 do {
-                        if (*p == '\\')
+                        if (*p == '\\' && p[1])
                                 p++;
                         *enddir++ = *p;
                 } while (*p++);
@@ -8025,7 +8045,7 @@ expmeta(exp_t *exp, char *name, unsigned name_len, unsigned expdir_len)
         if (name < start) {
                 p = name;
                 do {
-                        if (*p == '\\')
+                        if (*p == '\\' && p[1])
                                 p++;
                         *enddir++ = *p++;
                 } while (p < start);
@@ -8473,15 +8493,15 @@ static void shellexec(char *prog, char **argv, const char *path, int idx)
 
         /* Map to POSIX errors */
         switch (e) {
-        case EACCES:
+        default:
                 exerrno = 126;
                 break;
+        case ELOOP:
+        case ENAMETOOLONG:
         case ENOENT:
+        case ENOTDIR:
                 exerrno = 127;
                 break;
-        default:
-                exerrno = 2;
-                break;
         }
         exitstatus = exerrno;
         TRACE(("shellexec failed for %s, errno %d, suppress_int %d\n",
@@ -10083,9 +10103,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
         shellparam.optind = 1;
         shellparam.optoff = -1;
 #endif
-        pushlocalvars();
         evaltree(func->n.ndefun.body, flags & EV_TESTED);
-        poplocalvars(0);
  funcdone:
         INT_OFF;
         funcline = savefuncline;
@@ -10413,6 +10431,7 @@ find_builtin(const char *name)
 /*
  * Execute a simple command.
  */
+static void unwindfiles(struct parsefile *stop);
 static int
 isassignment(const char *p)
 {
@@ -10436,6 +10455,7 @@ evalcommand(union node *cmd, int flags)
                 "\0\0", bltincmd /* why three NULs? */
         };
         struct localvar_list *localvar_stop;
+        struct parsefile *file_stop;
         struct redirtab *redir_stop;
         struct stackmark smark;
         union node *argp;
@@ -10461,6 +10481,7 @@ evalcommand(union node *cmd, int flags)
         TRACE(("evalcommand(0x%lx, %d) called\n", (long)cmd, flags));
         setstackmark(&smark);
         localvar_stop = pushlocalvars();
+        file_stop = g_parsefile;
         back_exitstatus = 0;
 
         cmdentry.cmdtype = CMDBUILTIN;
@@ -10742,7 +10763,6 @@ evalcommand(union node *cmd, int flags)
                 goto readstatus;
 
         case CMDFUNCTION:
-                poplocalvars(1);
                 /* See above for the rationale */
                 dowait(DOWAIT_NONBLOCK, NULL);
                 if (evalfun(cmdentry.u.func, argc, argv, flags))
@@ -10756,6 +10776,7 @@ evalcommand(union node *cmd, int flags)
         if (cmd->ncmd.redirect)
                 popredir(/*drop:*/ cmd_is_exec);
         unwindredir(redir_stop);
+        unwindfiles(file_stop);
         unwindlocalvars(localvar_stop);
         if (lastarg) {
                 /* dsl: I think this is intended to be used to support
@@ -11278,14 +11299,20 @@ popfile(void)
         INT_ON;
 }
 
+static void
+unwindfiles(struct parsefile *stop)
+{
+        while (g_parsefile != stop)
+                popfile();
+}
+
 /*
  * Return to top level.
  */
 static void
 popallfiles(void)
 {
-        while (g_parsefile != &basepf)
-                popfile();
+        unwindfiles(&basepf);
 }
 
 #if !ENABLE_PLATFORM_MINGW32
@@ -12929,7 +12956,7 @@ parsesub: {
                                 STPUTC(c, out);
                                 c = pgetc_eatbnl();
                         } while (isdigit(c));
-                } else {
+                } else if (c != '}') {
                         /* $[{[#]]<specialchar>[}] */
                         int cc = c;
 
@@ -12955,7 +12982,8 @@ parsesub: {
                         }
 
                         USTPUTC(cc, out);
-                }
+                } else
+                        goto badsub;
 
                 if (c != '}' && subtype == VSLENGTH) {
                         /* ${#VAR didn't end with } */
@@ -14297,38 +14325,35 @@ letcmd(int argc UNUSED_PARAM, char **argv)
 static int FAST_FUNC
 readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
-        char *opt_n = NULL;
-        char *opt_p = NULL;
-        char *opt_t = NULL;
-        char *opt_u = NULL;
-        char *opt_d = NULL; /* optimized out if !BASH */
-        int read_flags = 0;
+        struct builtin_read_params params;
         const char *r;
         int i;
 
+        memset(&params, 0, sizeof(params));
+
         while ((i = nextopt("p:u:rt:n:sd:")) != '\0') {
                 switch (i) {
                 case 'p':
-                        opt_p = optionarg;
+                        params.opt_p = optionarg;
                         break;
                 case 'n':
-                        opt_n = optionarg;
+                        params.opt_n = optionarg;
                         break;
                 case 's':
-                        read_flags |= BUILTIN_READ_SILENT;
+                        params.read_flags |= BUILTIN_READ_SILENT;
                         break;
                 case 't':
-                        opt_t = optionarg;
+                        params.opt_t = optionarg;
                         break;
                 case 'r':
-                        read_flags |= BUILTIN_READ_RAW;
+                        params.read_flags |= BUILTIN_READ_RAW;
                         break;
                 case 'u':
-                        opt_u = optionarg;
+                        params.opt_u = optionarg;
                         break;
 #if BASH_READ_D
                 case 'd':
-                        opt_d = optionarg;
+                        params.opt_d = optionarg;
                         break;
 #endif
                 default:
@@ -14336,21 +14361,16 @@ readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                 }
         }
 
+        params.argv = argptr;
+        params.setvar = setvar0;
+        params.ifs = bltinlookup("IFS"); /* can be NULL */
+
         /* "read -s" needs to save/restore termios, can't allow ^C
          * to jump out of it.
          */
  again:
         INT_OFF;
-        r = shell_builtin_read(setvar0,
-                argptr,
-                bltinlookup("IFS"), /* can be NULL */
-                read_flags,
-                opt_n,
-                opt_p,
-                opt_t,
-                opt_u,
-                opt_d
-        );
+        r = shell_builtin_read(&params);
         INT_ON;
 
         if ((uintptr_t)r == 1 && errno == EINTR) {
@@ -14595,6 +14615,7 @@ init(void)
                         }
                 }
 
+                setvareq((char*)defifsvar, VTEXTFIXED);
                 setvareq((char*)defoptindvar, VTEXTFIXED);
 
                 setvar0("PPID", utoa(getppid()));
diff --git a/shell/ash_test/ash-glob/glob_bkslash_in_var.right b/shell/ash_test/ash-glob/glob_bkslash_in_var.right
new file mode 100644
index 000000000..f1484b9e4
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_bkslash_in_var.right
@@ -0,0 +1,4 @@
+Unquoted non-matching glob in var:'test*.TMP/\name_doesnt_exist'
+Unquoted matching glob in var:    'testdir.TMP/name'
+Quoted non-matching glob in var:  'test*.TMP/\name_doesnt_exist'
+Quoted matching glob in var:      'test*.TMP/\name'
diff --git a/shell/ash_test/ash-glob/glob_bkslash_in_var.tests b/shell/ash_test/ash-glob/glob_bkslash_in_var.tests
new file mode 100755
index 000000000..e3dedc4ac
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_bkslash_in_var.tests
@@ -0,0 +1,10 @@
+mkdir testdir.TMP
+>testdir.TMP/name
+a="test*.TMP/\name_doesnt_exist"
+b="test*.TMP/\name"
+printf "Unquoted non-matching glob in var:'%s'\n" $a
+printf "Unquoted matching glob in var:    '%s'\n" $b
+printf "Quoted non-matching glob in var:  '%s'\n" "$a"
+printf "Quoted matching glob in var:      '%s'\n" "$b"
+rm -f testdir.TMP/name
+rmdir testdir.TMP
diff --git a/shell/ash_test/ash-misc/empty_for1.right b/shell/ash_test/ash-misc/empty_for1.right
new file mode 100644
index 000000000..46ffcece7
--- /dev/null
+++ b/shell/ash_test/ash-misc/empty_for1.right
@@ -0,0 +1 @@
+Zero:0
diff --git a/shell/ash_test/ash-misc/empty_for1.tests b/shell/ash_test/ash-misc/empty_for1.tests
new file mode 100755
index 000000000..5a2554d54
--- /dev/null
+++ b/shell/ash_test/ash-misc/empty_for1.tests
@@ -0,0 +1,5 @@
+false
+for v; do
+        exit 2
+done
+echo Zero:$?
diff --git a/shell/ash_test/ash-misc/env_and_func.right b/shell/ash_test/ash-misc/env_and_func.right
index 5fc3488ae..4a1545058 100644
--- a/shell/ash_test/ash-misc/env_and_func.right
+++ b/shell/ash_test/ash-misc/env_and_func.right
@@ -1,2 +1,2 @@
 var=val
-var=val
+var=old
diff --git a/shell/ash_test/ash-misc/env_and_func.tests b/shell/ash_test/ash-misc/env_and_func.tests
index 3efef1a41..1c63eafd8 100755
--- a/shell/ash_test/ash-misc/env_and_func.tests
+++ b/shell/ash_test/ash-misc/env_and_func.tests
@@ -3,6 +3,6 @@ f() { echo "var=$var"; }
 # bash: POSIXLY_CORRECT behavior is to "leak" new variable values
 # out of function invocations (similar to "special builtins" behavior);
 # but in "bash mode", they don't leak.
-# hush does not "leak" values. ash does.
+# hush does not "leak" values. ash used to, but now does not.
 var=val f
 echo "var=$var"
diff --git a/shell/ash_test/ash-vars/var_bash_pattern_starting_with_slash.right b/shell/ash_test/ash-vars/var_bash_pattern_starting_with_slash.right
new file mode 100644
index 000000000..439dca578
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash_pattern_starting_with_slash.right
@@ -0,0 +1,2 @@
+-dev-ram
+/dev-am
diff --git a/shell/ash_test/ash-vars/var_bash_pattern_starting_with_slash.tests b/shell/ash_test/ash-vars/var_bash_pattern_starting_with_slash.tests
new file mode 100755
index 000000000..b83fb8eeb
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash_pattern_starting_with_slash.tests
@@ -0,0 +1,3 @@
+v=/dev/ram
+echo ${v////-}
+echo ${v///r/-}
diff --git a/shell/ash_test/ash-vars/var_leak.right b/shell/ash_test/ash-vars/var_leak.right
index 01a5e3263..764680086 100644
--- a/shell/ash_test/ash-vars/var_leak.right
+++ b/shell/ash_test/ash-vars/var_leak.right
@@ -1,4 +1,4 @@
 should be empty: ''
 should be empty: ''
 should be not empty: 'val2'
-should be not empty: 'val3'
+should be empty: ''
diff --git a/shell/ash_test/ash-vars/var_leak.tests b/shell/ash_test/ash-vars/var_leak.tests
index 5242e24eb..adf66692e 100755
--- a/shell/ash_test/ash-vars/var_leak.tests
+++ b/shell/ash_test/ash-vars/var_leak.tests
@@ -15,9 +15,7 @@ VAR=''
 VAR=val2 exec 2>&1
 echo "should be not empty: '$VAR'"
 
-# ash follows the "function call is a special builtin" rule here
-# (bash does not do it)
 f() { true; }
 VAR=''
 VAR=val3 f
-echo "should be not empty: '$VAR'"
+echo "should be empty: '$VAR'"
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs5.right b/shell/ash_test/ash-vars/var_wordsplit_ifs5.right
new file mode 100644
index 000000000..46ffcece7
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs5.right
@@ -0,0 +1 @@
+Zero:0
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs5.tests b/shell/ash_test/ash-vars/var_wordsplit_ifs5.tests
new file mode 100755
index 000000000..d382116df
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs5.tests
@@ -0,0 +1,4 @@
+IFS=
+set --
+set -- $@ $*
+echo Zero:$#
diff --git a/shell/hush.c b/shell/hush.c
index e3c6e2de9..881331c5b 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -990,7 +990,16 @@ struct globals {
 #if ENABLE_HUSH_MEMLEAK
         unsigned long memleak_value;
 #endif
-#if HUSH_DEBUG
+#if ENABLE_HUSH_MODE_X
+        unsigned x_mode_depth;
+        /* "set -x" output should not be redirectable with subsequent 2>FILE.
+         * We dup fd#2 to x_mode_fd when "set -x" is executed, and use it
+         * for all subsequent output.
+         */
+        int x_mode_fd;
+        o_string x_mode_buf;
+#endif
+#if HUSH_DEBUG >= 2
         int debug_indent;
 #endif
         struct sigaction sa;
@@ -1212,7 +1221,7 @@ static const struct built_in_command bltins2[] = {
 
 /* Debug printouts.
  */
-#if HUSH_DEBUG
+#if HUSH_DEBUG >= 2
 /* prevent disasters with G.debug_indent < 0 */
 # define indent() fdprintf(2, "%*s", (G.debug_indent * 2) & 0xff, "")
 # define debug_enter() (G.debug_indent++)
@@ -1657,6 +1666,12 @@ static int move_HFILEs_on_redirect(int fd, int avoid_fd)
                 }
                 fl = fl->next_hfile;
         }
+#if ENABLE_HUSH_MODE_X
+        if (G.x_mode_fd > 0 && fd == G.x_mode_fd) {
+                G.x_mode_fd = xdup_CLOEXEC_and_close(fd, avoid_fd);
+                return 1; /* "found and moved" */
+        }
+#endif
         return 0; /* "not in the list" */
 }
 #if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
@@ -1668,9 +1683,15 @@ static void close_all_HFILE_list(void)
                  * It is disastrous if we share memory with a vforked parent.
                  * I'm not sure we never come here after vfork.
                  * Therefore just close fd, nothing more.
+                 *
+                 * ">" instead of ">=": we don't close fd#0,
+                 * interactive shell uses hfopen(NULL) as stdin input
+                 * which has fl->fd == 0, but fd#0 gets redirected in pipes.
+                 * If we'd close it here, then e.g. interactive "set | sort"
+                 * with NOFORKed sort, would have sort's input fd closed.
                  */
-                /*hfclose(fl); - unsafe */
-                if (fl->fd >= 0)
+                if (fl->fd > 0)
+                        /*hfclose(fl); - unsafe */
                         close(fl->fd);
                 fl = fl->next_hfile;
         }
@@ -2376,6 +2397,12 @@ static int set_local_var(char *str, unsigned flags)
         return 0;
 }
 
+static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
+{
+        char *var = xasprintf("%s=%s", name, val);
+        set_local_var(var, /*flag:*/ 0);
+}
+
 /* Used at startup and after each cd */
 static void set_pwd_var(unsigned flag)
 {
@@ -2422,15 +2449,6 @@ static int unset_local_var(const char *name)
 }
 #endif
 
-#if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS \
- || (ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT)
-static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
-{
-        char *var = xasprintf("%s=%s", name, val);
-        set_local_var(var, /*flag:*/ 0);
-}
-#endif
-
 
 /*
  * Helpers for "var1=val1 var2=val2 cmd" feature
@@ -2900,6 +2918,11 @@ static void o_addstr(o_string *o, const char *str)
         o_addblock(o, str, strlen(str));
 }
 
+static void o_addstr_with_NUL(o_string *o, const char *str)
+{
+        o_addblock(o, str, strlen(str) + 1);
+}
+
 #if !BB_MMU
 static void nommu_addchr(o_string *o, int ch)
 {
@@ -2910,10 +2933,36 @@ static void nommu_addchr(o_string *o, int ch)
 # define nommu_addchr(o, str) ((void)0)
 #endif
 
-static void o_addstr_with_NUL(o_string *o, const char *str)
+#if ENABLE_HUSH_MODE_X
+static void x_mode_addchr(int ch)
 {
-        o_addblock(o, str, strlen(str) + 1);
+        o_addchr(&G.x_mode_buf, ch);
+}
+static void x_mode_addstr(const char *str)
+{
+        o_addstr(&G.x_mode_buf, str);
 }
+static void x_mode_addblock(const char *str, int len)
+{
+        o_addblock(&G.x_mode_buf, str, len);
+}
+static void x_mode_prefix(void)
+{
+        int n = G.x_mode_depth;
+        do x_mode_addchr('+'); while (--n >= 0);
+}
+static void x_mode_flush(void)
+{
+        int len = G.x_mode_buf.length;
+        if (len <= 0)
+                return;
+        if (G.x_mode_fd > 0) {
+                G.x_mode_buf.data[len] = '\n';
+                full_write(G.x_mode_fd, G.x_mode_buf.data, len + 1);
+        }
+        G.x_mode_buf.length = 0;
+}
+#endif
 
 /*
  * HUSH_BRACE_EXPANSION code needs corresponding quoting on variable expansion side.
@@ -3068,6 +3117,13 @@ static int o_save_ptr_helper(o_string *o, int n)
                         o->data = xrealloc(o->data, o->maxlen + 1);
                         list = (char**)o->data;
                         memmove(list + n + 0x10, list + n, string_len);
+                        /*
+                         * expand_on_ifs() has a "previous argv[] ends in IFS?"
+                         * check. (grep for -prev-ifs-check-).
+                         * Ensure that argv[-1][last] is not garbage
+                         * but zero bytes, to save index check there.
+                         */
+                        list[n + 0x10 - 1] = 0;
                         o->length += 0x10 * sizeof(list[0]);
                 } else {
                         debug_printf_list("list[%d]=%d string_start=%d\n",
@@ -3095,6 +3151,41 @@ static int o_get_last_ptr(o_string *o, int n)
         return ((int)(uintptr_t)list[n-1]) + string_start;
 }
 
+/*
+ * Globbing routines.
+ *
+ * Most words in commands need to be globbed, even ones which are
+ * (single or double) quoted. This stems from the possiblity of
+ * constructs like "abc"* and 'abc'* - these should be globbed.
+ * Having a different code path for fully-quoted strings ("abc",
+ * 'abc') would only help performance-wise, but we still need
+ * code for partially-quoted strings.
+ *
+ * Unfortunately, if we want to match bash and ash behavior in all cases,
+ * the logic can't be "shell-syntax argument is first transformed
+ * to a string, then globbed, and if globbing does not match anything,
+ * it is used verbatim". Here are two examples where it fails:
+ *
+ *      echo 'b\*'?
+ *
+ * The globbing can't be avoided (because of '?' at the end).
+ * The glob pattern is: b\\\*? - IOW, both \ and * are literals
+ * and are glob-escaped. If this does not match, bash/ash print b\*?
+ * - IOW: they "unbackslash" the glob pattern.
+ * Now, look at this:
+ *
+ *      v='\\\*'; echo b$v?
+ *
+ * The glob pattern is the same here: b\\\*? - the unquoted $v expansion
+ * should be used as glob pattern with no changes. However, if glob
+ * does not match, bash/ash print b\\\*? - NOT THE SAME as first example!
+ *
+ * ash implements this by having an encoded representation of the word
+ * to glob, which IS NOT THE SAME as the glob pattern - it has more data.
+ * Glob pattern is derived from it. If glob fails, the decision what result
+ * should be is made using that encoded representation. Not glob pattern.
+ */
+
 #if ENABLE_HUSH_BRACE_EXPANSION
 /* There in a GNU extension, GLOB_BRACE, but it is not usable:
  * first, it processes even {a} (no commas), second,
@@ -4877,6 +4968,15 @@ static int parse_dollar(o_string *as_string,
                                         end_ch = '}' * 0x100 + '/';
                                 }
                                 o_addchr(dest, ch);
+                                /* The pattern can't be empty.
+                                 * IOW: if the first char after "${v//" is a slash,
+                                 * it does not terminate the pattern - it's the first char of the pattern:
+                                 *  v=/dev/ram; echo ${v////-}  prints -dev-ram (pattern is "/")
+                                 *  v=/dev/ram; echo ${v///r/-} prints /dev-am  (pattern is "/r")
+                                 */
+                                if (i_peek(input) == '/') {
+                                        o_addchr(dest, i_getch(input));
+                                }
  again:
                                 if (!BB_MMU)
                                         pos = dest->length;
@@ -5796,12 +5896,16 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
                 /* Start new word... but not always! */
                 /* Case "v=' a'; echo ''$v": we do need to finalize empty word: */
                 if (output->has_quoted_part
-                /* Case "v=' a'; echo $v":
+                /*
+                 * Case "v=' a'; echo $v":
                  * here nothing precedes the space in $v expansion,
                  * therefore we should not finish the word
                  * (IOW: if there *is* word to finalize, only then do it):
+                 * It's okay if this accesses the byte before first argv[]:
+                 * past call to o_save_ptr() cleared it to zero byte
+                 * (grep for -prev-ifs-check-).
                  */
-                 || (n > 0 && output->data[output->length - 1])
+                 || output->data[output->length - 1]
                 ) {
  new_word:
                         o_addchr(output, '\0');
@@ -5856,6 +5960,26 @@ static char *encode_then_expand_string(const char *str)
         return exp_str;
 }
 
+static const char *first_special_char_in_vararg(const char *cp)
+{
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') return cp;
+                if (*cp == '\\') return cp;
+                if (*cp == '\'') return cp;
+                if (*cp == '"') return cp;
+#if ENABLE_HUSH_TICK
+                if (*cp == '`') return cp;
+#endif
+                /* dquoted "${x:+ARG}" should not glob, therefore
+                 * '*' et al require some non-literal processing: */
+                if (*cp == '*') return cp;
+                if (*cp == '?') return cp;
+                if (*cp == '[') return cp;
+                cp++;
+        }
+}
+
 /* Expanding ARG in ${var#ARG}, ${var%ARG}, or ${var/ARG/ARG}.
  * These can contain single- and double-quoted strings,
  * and treated as if the ARG string is initially unquoted. IOW:
@@ -5875,19 +5999,10 @@ static char *encode_then_expand_vararg(const char *str, int handle_squotes, int
         char *exp_str;
         struct in_str input;
         o_string dest = NULL_O_STRING;
-        const char *cp;
 
-        cp = str;
-        for (;;) {
-                if (!*cp) return NULL; /* string has no special chars */
-                if (*cp == '$') break;
-                if (*cp == '\\') break;
-                if (*cp == '\'') break;
-                if (*cp == '"') break;
-#if ENABLE_HUSH_TICK
-                if (*cp == '`') break;
-#endif
-                cp++;
+        if (!first_special_char_in_vararg(str)) {
+                /* string has no special chars */
+                return NULL;
         }
 
         setup_string_in_str(&input, str);
@@ -5968,26 +6083,19 @@ static char *encode_then_expand_vararg(const char *str, int handle_squotes, int
 /* Expanding ARG in ${var+ARG}, ${var-ARG}
  */
 static int encode_then_append_var_plusminus(o_string *output, int n,
-                const char *str, int dquoted)
+                char *str, int dquoted)
 {
         struct in_str input;
         o_string dest = NULL_O_STRING;
 
-#if 0 //todo?
-        const char *cp;
-        cp = str;
-        for (;;) {
-                if (!*cp) return NULL; /* string has no special chars */
-                if (*cp == '$') break;
-                if (*cp == '\\') break;
-                if (*cp == '\'') break;
-                if (*cp == '"') break;
-#if ENABLE_HUSH_TICK
-                if (*cp == '`') break;
-#endif
-                cp++;
+        if (!first_special_char_in_vararg(str)
+         && '\0' == str[strcspn(str, G.ifs)]
+        ) {
+                /* string has no special chars
+                 * && string has no $IFS chars
+                 */
+                return expand_vars_to_list(output, n, str);
         }
-#endif
 
         setup_string_in_str(&input, str);
 
@@ -7182,11 +7290,8 @@ static int generate_stream_from_string(const char *s, pid_t *pid_p)
                         + (1 << SIGTTIN)
                         + (1 << SIGTTOU)
                         , SIG_IGN);
-                CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
                 close(channel[0]); /* NB: close _first_, then move fd! */
                 xmove_fd(channel[1], 1);
-                /* Prevent it from trying to handle ctrl-z etc */
-                IF_HUSH_JOB(G.run_list_level = 1;)
 # if ENABLE_HUSH_TRAP
                 /* Awful hack for `trap` or $(trap).
                  *
@@ -7233,7 +7338,12 @@ static int generate_stream_from_string(const char *s, pid_t *pid_p)
                 }
 # endif
 # if BB_MMU
+                /* Prevent it from trying to handle ctrl-z etc */
+                IF_HUSH_JOB(G.run_list_level = 1;)
+                CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
                 reset_traps_to_defaults();
+                IF_HUSH_MODE_X(G.x_mode_depth++;)
+                //bb_error_msg("%s: ++x_mode_depth=%d", __func__, G.x_mode_depth);
                 parse_and_run_string(s);
                 _exit(G.last_exitcode);
 # else
@@ -8014,28 +8124,65 @@ static void execvp_or_die(char **argv)
 }
 
 #if ENABLE_HUSH_MODE_X
+static void x_mode_print_optionally_squoted(const char *str)
+{
+        unsigned len;
+        const char *cp;
+
+        cp = str;
+
+        /* the set of chars which-cause-string-to-be-squoted mimics bash */
+        /* test a char with: bash -c 'set -x; echo "CH"' */
+        if (str[strcspn(str, "\\\"'`$(){}[]<>;#&|~*?!^"
+                        " " "\001\002\003\004\005\006\007"
+                        "\010\011\012\013\014\015\016\017"
+                        "\020\021\022\023\024\025\026\027"
+                        "\030\031\032\033\034\035\036\037"
+                        )
+                ] == '\0'
+        ) {
+                /* string has no special chars */
+                x_mode_addstr(str);
+                return;
+        }
+
+        cp = str;
+        for (;;) {
+                /* print '....' up to EOL or first squote */
+                len = (int)(strchrnul(cp, '\'') - cp);
+                if (len != 0) {
+                        x_mode_addchr('\'');
+                        x_mode_addblock(cp, len);
+                        x_mode_addchr('\'');
+                        cp += len;
+                }
+                if (*cp == '\0')
+                        break;
+                /* string contains squote(s), print them as \' */
+                x_mode_addchr('\\');
+                x_mode_addchr('\'');
+                cp++;
+        }
+}
 static void dump_cmd_in_x_mode(char **argv)
 {
         if (G_x_mode && argv) {
-                /* We want to output the line in one write op */
-                char *buf, *p;
-                int len;
-                int n;
+                unsigned n;
 
-                len = 3;
+                /* "+[+++...][ cmd...]\n\0" */
+                x_mode_prefix();
                 n = 0;
-                while (argv[n])
-                        len += strlen(argv[n++]) + 1;
-                buf = xmalloc(len);
-                buf[0] = '+';
-                p = buf + 1;
-                n = 0;
-                while (argv[n])
-                        p += sprintf(p, " %s", argv[n++]);
-                *p++ = '\n';
-                *p = '\0';
-                fputs(buf, stderr);
-                free(buf);
+                while (argv[n]) {
+                        x_mode_addchr(' ');
+                        if (argv[n][0] == '\0') {
+                                x_mode_addchr('\'');
+                                x_mode_addchr('\'');
+                        } else {
+                                x_mode_print_optionally_squoted(argv[n]);
+                        }
+                        n++;
+                }
+                x_mode_flush();
         }
 }
 #else
@@ -8821,16 +8968,25 @@ static NOINLINE int run_pipe(struct pipe *pi)
                         restore_redirects(squirrel);
 
                         /* Set shell variables */
-                        if (G_x_mode)
-                                bb_putchar_stderr('+');
                         i = 0;
                         while (i < command->assignment_cnt) {
                                 char *p = expand_string_to_string(argv[i],
                                                 EXP_FLAG_ESC_GLOB_CHARS,
                                                 /*unbackslash:*/ 1
                                 );
-                                if (G_x_mode)
-                                        fprintf(stderr, " %s", p);
+#if ENABLE_HUSH_MODE_X
+                                if (G_x_mode) {
+                                        char *eq;
+                                        if (i == 0)
+                                                x_mode_prefix();
+                                        x_mode_addchr(' ');
+                                        eq = strchrnul(p, '=');
+                                        if (*eq) eq++;
+                                        x_mode_addblock(p, (eq - p));
+                                        x_mode_print_optionally_squoted(eq);
+                                        x_mode_flush();
+                                }
+#endif
                                 debug_printf_env("set shell var:'%s'->'%s'\n", *argv, p);
                                 if (set_local_var(p, /*flag:*/ 0)) {
                                         /* assignment to readonly var / putenv error? */
@@ -8838,8 +8994,6 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                 }
                                 i++;
                         }
-                        if (G_x_mode)
-                                bb_putchar_stderr('\n');
                         /* Redirect error sets $? to 1. Otherwise,
                          * if evaluating assignment value set $?, retain it.
                          * Else, clear $?:
@@ -9288,11 +9442,11 @@ static int run_list(struct pipe *pi)
                                 }; /* argv list with one element: "$@" */
                                 char **vals;
 
+                                G.last_exitcode = rcode = EXIT_SUCCESS;
                                 vals = (char**)encoded_dollar_at_argv;
                                 if (pi->next->res_word == RES_IN) {
                                         /* if no variable values after "in" we skip "for" */
                                         if (!pi->next->cmds[0].argv) {
-                                                G.last_exitcode = rcode = EXIT_SUCCESS;
                                                 debug_printf_exec(": null FOR: exitcode EXIT_SUCCESS\n");
                                                 break;
                                         }
@@ -9626,6 +9780,7 @@ static int set_mode(int state, char mode, const char *o_opt)
                 break;
         case 'x':
                 IF_HUSH_MODE_X(G_x_mode = state;)
+                IF_HUSH_MODE_X(if (G.x_mode_fd <= 0) G.x_mode_fd = dup_CLOEXEC(2, 10);)
                 break;
         case 'o':
                 if (!o_opt) {
@@ -9731,6 +9886,10 @@ int hush_main(int argc, char **argv)
                 uname(&uts);
                 set_local_var_from_halves("HOSTNAME", uts.nodename);
         }
+#endif
+        /* IFS is not inherited from the parent environment */
+        set_local_var_from_halves("IFS", defifs);
+
         /* bash also exports SHLVL and _,
          * and sets (but doesn't export) the following variables:
          * BASH=/bin/bash
@@ -9761,10 +9920,8 @@ int hush_main(int argc, char **argv)
          * TERM=dumb
          * OPTERR=1
          * OPTIND=1
-         * IFS=$' \t\n'
          * PS4='+ '
          */
-#endif
 
 #if ENABLE_HUSH_LINENO_VAR
         if (ENABLE_HUSH_LINENO_VAR) {
@@ -10226,6 +10383,8 @@ static int FAST_FUNC builtin_eval(char **argv)
         if (!argv[0])
                 return EXIT_SUCCESS;
 
+        IF_HUSH_MODE_X(G.x_mode_depth++;)
+        //bb_error_msg("%s: ++x_mode_depth=%d", __func__, G.x_mode_depth);
         if (!argv[1]) {
                 /* bash:
                  * eval "echo Hi; done" ("done" is syntax error):
@@ -10255,6 +10414,8 @@ static int FAST_FUNC builtin_eval(char **argv)
                 parse_and_run_string(str);
                 free(str);
         }
+        IF_HUSH_MODE_X(G.x_mode_depth--;)
+        //bb_error_msg("%s: --x_mode_depth=%d", __func__, G.x_mode_depth);
         return G.last_exitcode;
 }
 
@@ -10374,40 +10535,29 @@ static int FAST_FUNC builtin_type(char **argv)
 static int FAST_FUNC builtin_read(char **argv)
 {
         const char *r;
-        char *opt_n = NULL;
-        char *opt_p = NULL;
-        char *opt_t = NULL;
-        char *opt_u = NULL;
-        char *opt_d = NULL; /* optimized out if !BASH */
-        const char *ifs;
-        int read_flags;
+        struct builtin_read_params params;
+
+        memset(&params, 0, sizeof(params));
 
         /* "!": do not abort on errors.
          * Option string must start with "sr" to match BUILTIN_READ_xxx
          */
-        read_flags = getopt32(argv,
+        params.read_flags = getopt32(argv,
 #if BASH_READ_D
-                "!srn:p:t:u:d:", &opt_n, &opt_p, &opt_t, &opt_u, &opt_d
+                "!srn:p:t:u:d:", &params.opt_n, &params.opt_p, &params.opt_t, &params.opt_u, &params.opt_d
 #else
-                "!srn:p:t:u:", &opt_n, &opt_p, &opt_t, &opt_u
+                "!srn:p:t:u:", &params.opt_n, &params.opt_p, &params.opt_t, &params.opt_u
 #endif
         );
-        if (read_flags == (uint32_t)-1)
+        if ((uint32_t)params.read_flags == (uint32_t)-1)
                 return EXIT_FAILURE;
         argv += optind;
-        ifs = get_local_var_value("IFS"); /* can be NULL */
+        params.argv = argv;
+        params.setvar = set_local_var_from_halves;
+        params.ifs = get_local_var_value("IFS"); /* can be NULL */
 
  again:
-        r = shell_builtin_read(set_local_var_from_halves,
-                argv,
-                ifs,
-                read_flags,
-                opt_n,
-                opt_p,
-                opt_t,
-                opt_u,
-                opt_d
-        );
+        r = shell_builtin_read(&params);
 
         if ((uintptr_t)r == 1 && errno == EINTR) {
                 unsigned sig = check_and_run_traps();
diff --git a/shell/hush_test/hush-glob/glob_bkslash_in_var.right b/shell/hush_test/hush-glob/glob_bkslash_in_var.right
new file mode 100644
index 000000000..f1484b9e4
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_bkslash_in_var.right
@@ -0,0 +1,4 @@
+Unquoted non-matching glob in var:'test*.TMP/\name_doesnt_exist'
+Unquoted matching glob in var:    'testdir.TMP/name'
+Quoted non-matching glob in var:  'test*.TMP/\name_doesnt_exist'
+Quoted matching glob in var:      'test*.TMP/\name'
diff --git a/shell/hush_test/hush-glob/glob_bkslash_in_var.tests b/shell/hush_test/hush-glob/glob_bkslash_in_var.tests
new file mode 100755
index 000000000..e3dedc4ac
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_bkslash_in_var.tests
@@ -0,0 +1,10 @@
+mkdir testdir.TMP
+>testdir.TMP/name
+a="test*.TMP/\name_doesnt_exist"
+b="test*.TMP/\name"
+printf "Unquoted non-matching glob in var:'%s'\n" $a
+printf "Unquoted matching glob in var:    '%s'\n" $b
+printf "Quoted non-matching glob in var:  '%s'\n" "$a"
+printf "Quoted matching glob in var:      '%s'\n" "$b"
+rm -f testdir.TMP/name
+rmdir testdir.TMP
diff --git a/shell/hush_test/hush-misc/empty_for1.right b/shell/hush_test/hush-misc/empty_for1.right
new file mode 100644
index 000000000..46ffcece7
--- /dev/null
+++ b/shell/hush_test/hush-misc/empty_for1.right
@@ -0,0 +1 @@
+Zero:0
diff --git a/shell/hush_test/hush-misc/empty_for1.tests b/shell/hush_test/hush-misc/empty_for1.tests
new file mode 100755
index 000000000..5a2554d54
--- /dev/null
+++ b/shell/hush_test/hush-misc/empty_for1.tests
@@ -0,0 +1,5 @@
+false
+for v; do
+        exit 2
+done
+echo Zero:$?
diff --git a/shell/hush_test/hush-misc/env_and_func.tests b/shell/hush_test/hush-misc/env_and_func.tests
index 3efef1a41..1c63eafd8 100755
--- a/shell/hush_test/hush-misc/env_and_func.tests
+++ b/shell/hush_test/hush-misc/env_and_func.tests
@@ -3,6 +3,6 @@ f() { echo "var=$var"; }
 # bash: POSIXLY_CORRECT behavior is to "leak" new variable values
 # out of function invocations (similar to "special builtins" behavior);
 # but in "bash mode", they don't leak.
-# hush does not "leak" values. ash does.
+# hush does not "leak" values. ash used to, but now does not.
 var=val f
 echo "var=$var"
diff --git a/shell/hush_test/hush-quoting/quote_in_varexp1.right b/shell/hush_test/hush-quoting/quote_in_varexp1.right
new file mode 100644
index 000000000..99a0aea7c
--- /dev/null
+++ b/shell/hush_test/hush-quoting/quote_in_varexp1.right
@@ -0,0 +1,2 @@
+''
+Ok:0
diff --git a/shell/hush_test/hush-quoting/quote_in_varexp1.tests b/shell/hush_test/hush-quoting/quote_in_varexp1.tests
new file mode 100755
index 000000000..1b97b0556
--- /dev/null
+++ b/shell/hush_test/hush-quoting/quote_in_varexp1.tests
@@ -0,0 +1,2 @@
+x="''''"; echo "${x#"${x+''}"''}"
+echo Ok:$?
diff --git a/shell/hush_test/hush-vars/var_bash_pattern_starting_with_slash.right b/shell/hush_test/hush-vars/var_bash_pattern_starting_with_slash.right
new file mode 100644
index 000000000..439dca578
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash_pattern_starting_with_slash.right
@@ -0,0 +1,2 @@
+-dev-ram
+/dev-am
diff --git a/shell/hush_test/hush-vars/var_bash_pattern_starting_with_slash.tests b/shell/hush_test/hush-vars/var_bash_pattern_starting_with_slash.tests
new file mode 100755
index 000000000..b83fb8eeb
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash_pattern_starting_with_slash.tests
@@ -0,0 +1,3 @@
+v=/dev/ram
+echo ${v////-}
+echo ${v///r/-}
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs5.right b/shell/hush_test/hush-vars/var_wordsplit_ifs5.right
new file mode 100644
index 000000000..46ffcece7
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs5.right
@@ -0,0 +1 @@
+Zero:0
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs5.tests b/shell/hush_test/hush-vars/var_wordsplit_ifs5.tests
new file mode 100755
index 000000000..d382116df
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs5.tests
@@ -0,0 +1,4 @@
+IFS=
+set --
+set -- $@ $*
+echo Zero:$#
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 82102778c..23e5f1c25 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -50,16 +50,7 @@ int FAST_FUNC is_well_formed_var_name(const char *s, char terminator)
 //Here we can simply store "VAR=" at buffer start and store read data directly
 //after "=", then pass buffer to setvar() to consume.
 const char* FAST_FUNC
-shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
-        char       **argv,
-        const char *ifs,
-        int        read_flags,
-        const char *opt_n,
-        const char *opt_p,
-        const char *opt_t,
-        const char *opt_u,
-        const char *opt_d
-)
+shell_builtin_read(struct builtin_read_params *params)
 {
         struct pollfd pfd[1];
 #define fd (pfd[0].fd) /* -u FD */
@@ -76,9 +67,13 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
         int bufpos; /* need to be able to hold -1 */
         int startword;
         smallint backslash;
+        char **argv;
+        const char *ifs;
+        int read_flags;
 
         errno = err = 0;
 
+        argv = params->argv;
         pp = argv;
         while (*pp) {
                 if (!is_well_formed_var_name(*pp, '\0')) {
@@ -90,29 +85,29 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
         }
 
         nchars = 0; /* if != 0, -n is in effect */
-        if (opt_n) {
-                nchars = bb_strtou(opt_n, NULL, 10);
+        if (params->opt_n) {
+                nchars = bb_strtou(params->opt_n, NULL, 10);
                 if (nchars < 0 || errno)
                         return "invalid count";
                 /* note: "-n 0": off (bash 3.2 does this too) */
         }
 
         end_ms = 0;
-        if (opt_t && !ENABLE_FEATURE_SH_READ_FRAC) {
-                end_ms = bb_strtou(opt_t, NULL, 10);
+        if (params->opt_t && !ENABLE_FEATURE_SH_READ_FRAC) {
+                end_ms = bb_strtou(params->opt_t, NULL, 10);
                 if (errno)
                         return "invalid timeout";
                 if (end_ms > UINT_MAX / 2048) /* be safely away from overflow */
                         end_ms = UINT_MAX / 2048;
                 end_ms *= 1000;
         }
-        if (opt_t && ENABLE_FEATURE_SH_READ_FRAC) {
+        if (params->opt_t && ENABLE_FEATURE_SH_READ_FRAC) {
                 /* bash 4.3 (maybe earlier) supports -t N.NNNNNN */
                 char *p;
                 /* Eat up to three fractional digits */
                 int frac_digits = 3 + 1;
 
-                end_ms = bb_strtou(opt_t, &p, 10);
+                end_ms = bb_strtou(params->opt_t, &p, 10);
                 if (end_ms > UINT_MAX / 2048) /* be safely away from overflow */
                         end_ms = UINT_MAX / 2048;
 
@@ -134,13 +129,13 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
         }
 
         fd = STDIN_FILENO;
-        if (opt_u) {
-                fd = bb_strtou(opt_u, NULL, 10);
+        if (params->opt_u) {
+                fd = bb_strtou(params->opt_u, NULL, 10);
                 if (fd < 0 || errno)
                         return "invalid file descriptor";
         }
 
-        if (opt_t && end_ms == 0) {
+        if (params->opt_t && end_ms == 0) {
 #if !ENABLE_PLATFORM_MINGW32
                 /* "If timeout is 0, read returns immediately, without trying
                  * to read any data. The exit status is 0 if input is available
@@ -157,14 +152,16 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
 #endif
         }
 
-        if (opt_p && isatty(fd)) {
-                fputs(opt_p, stderr);
+        if (params->opt_p && isatty(fd)) {
+                fputs(params->opt_p, stderr);
                 fflush_all();
         }
 
+        ifs = params->ifs;
         if (ifs == NULL)
                 ifs = defifs;
 
+        read_flags = params->read_flags;
 #if !ENABLE_PLATFORM_MINGW32
         if (nchars || (read_flags & BUILTIN_READ_SILENT)) {
                 tcgetattr(fd, &tty);
@@ -193,11 +190,11 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
         retval = (const char *)(uintptr_t)0;
         startword = 1;
         backslash = 0;
-        if (opt_t)
+        if (params->opt_t)
                 end_ms += (unsigned)monotonic_ms();
         buffer = NULL;
         bufpos = 0;
-        delim = opt_d ? *opt_d : '\n';
+        delim = params->opt_d ? params->opt_d[0] : '\n';
         do {
                 char c;
                 int timeout;
@@ -206,7 +203,7 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                         buffer = xrealloc(buffer, bufpos + 0x101);
 
                 timeout = -1;
-                if (opt_t) {
+                if (params->opt_t) {
                         timeout = end_ms - (unsigned)monotonic_ms();
                         /* ^^^^^^^^^^^^^ all values are unsigned,
                          * wrapping math is used here, good even if
@@ -238,7 +235,7 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                 }
 #else
                 errno = 0;
-                if (isatty(fd) && (opt_n || opt_d || opt_t ||
+                if (isatty(fd) && (params->opt_n || params->opt_d || params->opt_t ||
                                                         (read_flags & BUILTIN_READ_SILENT))) {
                         int64_t key;
 
@@ -285,7 +282,7 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                  * without variable names (bash compat).
                  * Thus, "read" and "read REPLY" are not the same.
                  */
-                if (!opt_d && argv[0]) {
+                if (!params->opt_d && argv[0]) {
 /* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_06_05 */
                         const char *is_ifs = strchr(ifs, c);
                         if (startword && is_ifs) {
@@ -300,7 +297,7 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                         if (argv[1] != NULL && is_ifs) {
                                 buffer[bufpos] = '\0';
                                 bufpos = 0;
-                                setvar(*argv, buffer);
+                                params->setvar(*argv, buffer);
                                 argv++;
                                 /* can we skip one non-space ifs char? (2: yes) */
                                 startword = isspace(c) ? 2 : 1;
@@ -352,14 +349,14 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                 }
 
                 /* Use the remainder as a value for the next variable */
-                setvar(*argv, buffer);
+                params->setvar(*argv, buffer);
                 /* Set the rest to "" */
                 while (*++argv)
-                        setvar(*argv, "");
+                        params->setvar(*argv, "");
         } else {
                 /* Note: no $IFS removal */
                 buffer[bufpos] = '\0';
-                setvar("REPLY", buffer);
+                params->setvar("REPLY", buffer);
         }
 
  ret:
diff --git a/shell/shell_common.h b/shell/shell_common.h
index 875fd9ea7..a1323021d 100644
--- a/shell/shell_common.h
+++ b/shell/shell_common.h
@@ -30,6 +30,17 @@ int FAST_FUNC is_well_formed_var_name(const char *s, char terminator);
 
 /* Builtins */
 
+struct builtin_read_params {
+        int        read_flags;
+        void FAST_FUNC (*setvar)(const char *name, const char *val);
+        char       **argv;
+        const char *ifs;
+        const char *opt_n;
+        const char *opt_p;
+        const char *opt_t;
+        const char *opt_u;
+        const char *opt_d;
+};
 enum {
         BUILTIN_READ_SILENT = 1 << 0,
         BUILTIN_READ_RAW    = 1 << 1,
@@ -40,16 +51,7 @@ enum {
 //      shell_builtin_read(setvar,argv,ifs,read_flags)
 //#endif
 const char* FAST_FUNC
-shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
-        char       **argv,
-        const char *ifs,
-        int        read_flags,
-        const char *opt_n,
-        const char *opt_p,
-        const char *opt_t,
-        const char *opt_u,
-        const char *opt_d
-);
+shell_builtin_read(struct builtin_read_params *params);
 
 int FAST_FUNC
 shell_builtin_ulimit(char **argv);