12 files changed, 40 insertions, 31 deletions

diff --git a/Makefile b/Makefile
index e8bead003..656ee2c79 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 1
 PATCHLEVEL = 18
-SUBLEVEL = 2
+SUBLEVEL = 3
 EXTRAVERSION =
 NAME = Unnamed
 
diff --git a/archival/tar.c b/archival/tar.c
index 82caec770..c0b92615d 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -1037,8 +1037,10 @@ int tar_main(int argc UNUSED_PARAM, char **argv)
                         tar_handle->src_fd = tar_fd;
                         tar_handle->seek = seek_by_read;
                 } else {
-                        if (ENABLE_FEATURE_TAR_AUTODETECT && flags == O_RDONLY) {
-                                get_header_ptr = get_header_tar;
+                        if (ENABLE_FEATURE_TAR_AUTODETECT
+                         && flags == O_RDONLY
+                         && get_header_ptr == get_header_tar
+                        ) {
                                 tar_handle->src_fd = open_zipped(tar_filename);
                                 if (tar_handle->src_fd < 0)
                                         bb_perror_msg_and_die("can't open '%s'", tar_filename);
diff --git a/coreutils/wc.c b/coreutils/wc.c
index fe3f274f8..6e22c66c8 100644
--- a/coreutils/wc.c
+++ b/coreutils/wc.c
@@ -81,11 +81,11 @@
  * column order in "wc -cmlwL" output:
  */
 enum {
-        WC_LINES    = 0,
-        WC_WORDS    = 1,
-        WC_UNICHARS = 2,
-        WC_CHARS    = 3,
-        WC_LENGTH   = 4,
+        WC_LINES    = 0, /* -l */
+        WC_WORDS    = 1, /* -w */
+        WC_UNICHARS = 2, /* -m */
+        WC_BYTES    = 3, /* -c */
+        WC_LENGTH   = 4, /* -L */
         NUM_WCS     = 5,
 };
 
@@ -104,10 +104,10 @@ int wc_main(int argc UNUSED_PARAM, char **argv)
 
         init_unicode();
 
-        print_type = getopt32(argv, "lwcmL");
+        print_type = getopt32(argv, "lwmcL");
 
         if (print_type == 0) {
-                print_type = (1 << WC_LINES) | (1 << WC_WORDS) | (1 << WC_CHARS);
+                print_type = (1 << WC_LINES) | (1 << WC_WORDS) | (1 << WC_BYTES);
         }
 
         argv += optind;
@@ -157,7 +157,7 @@ int wc_main(int argc UNUSED_PARAM, char **argv)
                         }
 
                         /* Cater for -c and -m */
-                        ++counts[WC_CHARS];
+                        ++counts[WC_BYTES];
                         if (unicode_status != UNICODE_ON /* every byte is a new char */
                          || (c & 0xc0) != 0x80 /* it isn't a 2nd+ byte of a Unicode char */
                         ) {
diff --git a/libbb/vfork_daemon_rexec.c b/libbb/vfork_daemon_rexec.c
index 5e0fb0d73..0c879f68f 100644
--- a/libbb/vfork_daemon_rexec.c
+++ b/libbb/vfork_daemon_rexec.c
@@ -52,6 +52,7 @@ pid_t FAST_FUNC spawn(char **argv)
          * Interested party can wait on pid and learn exit code.
          * If 111 - then it (most probably) failed to exec */
         if (failed) {
+                safe_waitpid(pid, NULL, 0); /* prevent zombie */
                 errno = failed;
                 return -1;
         }
diff --git a/loginutils/Config.src b/loginutils/Config.src
index 8158bce74..4c771bbc4 100644
--- a/loginutils/Config.src
+++ b/loginutils/Config.src
@@ -186,7 +186,6 @@ config GETTY
 config LOGIN
         bool "login"
         default y
-        select FEATURE_SUID
         select FEATURE_SYSLOG
         help
           login is used when signing onto a system.
@@ -229,7 +228,6 @@ config FEATURE_SECURETTY
 config PASSWD
         bool "passwd"
         default y
-        select FEATURE_SUID
         select FEATURE_SYSLOG
         help
           passwd changes passwords for user and group accounts. A normal user
@@ -265,7 +263,6 @@ config CHPASSWD
 config SU
         bool "su"
         default y
-        select FEATURE_SUID
         select FEATURE_SYSLOG
         help
           su is used to become another user during a login session.
@@ -295,7 +292,6 @@ config SULOGIN
 config VLOCK
         bool "vlock"
         default y
-        select FEATURE_SUID
         help
           Build the "vlock" applet which allows you to lock (virtual) terminals.
 
diff --git a/miscutils/Config.src b/miscutils/Config.src
index 4912daf88..da52e14c6 100644
--- a/miscutils/Config.src
+++ b/miscutils/Config.src
@@ -170,7 +170,6 @@ config FEATURE_CROND_DIR
 config CRONTAB
         bool "crontab"
         default y
-        select FEATURE_SUID
         help
           Crontab manipulates the crontab for a particular user. Only
           the superuser may specify a different user and/or crontab directory.
diff --git a/modutils/modprobe-small.c b/modutils/modprobe-small.c
index f4f17e766..188a7f229 100644
--- a/modutils/modprobe-small.c
+++ b/modutils/modprobe-small.c
@@ -205,6 +205,7 @@ static void parse_module(module_info *info, const char *pathname)
         /* Read (possibly compressed) module */
         len = 64 * 1024 * 1024; /* 64 Mb at most */
         module_image = xmalloc_open_zipped_read_close(pathname, &len);
+        /* module_image == NULL is ok here, find_keyword handles it */
 //TODO: optimize redundant module body reads
 
         /* "alias1 symbol:sym1 alias2 symbol:sym2" */
@@ -845,6 +846,8 @@ int modprobe_main(int argc UNUSED_PARAM, char **argv)
 
                 len = MAXINT(ssize_t);
                 map = xmalloc_open_zipped_read_close(*argv, &len);
+                if (!map)
+                        bb_perror_msg_and_die("can't read '%s'", *argv);
                 if (init_module(map, len,
                         IF_FEATURE_MODPROBE_SMALL_OPTIONS_ON_CMDLINE(options ? options : "")
                         IF_NOT_FEATURE_MODPROBE_SMALL_OPTIONS_ON_CMDLINE("")
diff --git a/modutils/modutils.c b/modutils/modutils.c
index 565d0d22f..415dbbe44 100644
--- a/modutils/modutils.c
+++ b/modutils/modutils.c
@@ -71,12 +71,11 @@ char* FAST_FUNC parse_cmdline_module_options(char **argv)
         optlen = 0;
         while (*++argv) {
                 options = xrealloc(options, optlen + 2 + strlen(*argv) + 2);
-                /* Older versions were enclosing space-containing *argv in "",
-                 * but both modprobe and insmod from module-init-tools 3.11.1
-                 * don't do this anymore. (As to extra trailing space,
-                 * insmod adds it but modprobe does not. We do in both cases)
-                 */
-                optlen += sprintf(options + optlen, "%s ", *argv);
+                /* Spaces handled by "" pairs, but no way of escaping quotes */
+//TODO: module-init-tools version 3.11.1 quotes only value:
+//it generates var="val with spaces", not "var=val with spaces"
+//(and it won't quote var *name* even if it has spaces)
+                optlen += sprintf(options + optlen, (strchr(*argv, ' ') ? "\"%s\" " : "%s "), *argv);
         }
         return options;
 }
diff --git a/networking/ping.c b/networking/ping.c
index 3aba4906e..5fc80fe4e 100644
--- a/networking/ping.c
+++ b/networking/ping.c
@@ -394,7 +394,7 @@ static void sendping4(int junk UNUSED_PARAM)
 #if ENABLE_PING6
 static void sendping6(int junk UNUSED_PARAM)
 {
-        struct icmp6_hdr *pkt = alloca(datalen + sizeof(struct icmp6_hdr) + 4);
+        struct icmp6_hdr *pkt = G.snd_packet;
 
         //memset(pkt, 0, datalen + sizeof(struct icmp6_hdr) + 4);
         pkt->icmp6_type = ICMP6_ECHO_REQUEST;
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 311f79e7e..0a60261ab 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -375,7 +375,7 @@ static NOINLINE void attach_option(
                 new->data = xmalloc(length + OPT_DATA);
                 new->data[OPT_CODE] = optflag->code;
                 new->data[OPT_LEN] = length;
-                memcpy(new->data + OPT_DATA, buffer, length);
+                memcpy(new->data + OPT_DATA, (allocated ? allocated : buffer), length);
 
                 curr = opt_list;
                 while (*curr && (*curr)->data[OPT_CODE] < optflag->code)
diff --git a/shell/hush.c b/shell/hush.c
index f9f815289..58d2c11a9 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -4123,15 +4123,26 @@ static struct pipe *parse_stream(char **pstring,
                                  && dest.length == 0 && !dest.has_quoted_part
                                 ) {
                                         /* This newline can be ignored. But...
-                                         * without the below check, interactive shell
-                                         * will ignore even lines with bare <newline>,
-                                         * and show the continuation prompt:
+                                         * Without check #1, interactive shell
+                                         * ignores even bare <newline>,
+                                         * and shows the continuation prompt:
                                          * ps1_prompt$ <enter>
-                                         * ps2> _   <=== wrong prompt, should be ps1
+                                         * ps2> _   <=== wrong, should be ps1
+                                         * Without check #2, "cmd & <newline>"
+                                         * is similarly mistreated.
+                                         * (BTW, this makes "cmd & cmd"
+                                         * and "cmd && cmd" non-orthogonal.
+                                         * Really, ask yourself, why
+                                         * "cmd && <newline>" doesn't start
+                                         * cmd but waits for more input?
+                                         * No reason...)
                                          */
                                         struct pipe *pi = ctx.list_head;
-                                        if (pi->num_cmds != 0)
+                                        if (pi->num_cmds != 0       /* check #1 */
+                                         && pi->followup != PIPE_BG /* check #2 */
+                                        ) {
                                                 continue;
+                                        }
                                 }
                                 /* Treat newline as a command separator. */
                                 done_pipe(&ctx, PIPE_SEQ);
diff --git a/util-linux/Config.src b/util-linux/Config.src
index c71b4de38..0f865acfd 100644
--- a/util-linux/Config.src
+++ b/util-linux/Config.src
@@ -354,7 +354,6 @@ config FEATURE_HWCLOCK_ADJTIME_FHS
 config IPCRM
         bool "ipcrm"
         default y
-        select FEATURE_SUID
         help
           The ipcrm utility allows the removal of System V interprocess
           communication (IPC) objects and the associated data structures
@@ -364,7 +363,6 @@ config IPCS
         bool "ipcs"
         default y
         depends on PLATFORM_LINUX
-        select FEATURE_SUID
         help
           The ipcs utility is used to provide information on the currently
           allocated System V interprocess (IPC) objects in the system.