3 files changed, 15 insertions, 4 deletions

diff --git a/shell/ash.c b/shell/ash.c
index c5ad96909..0f9f73ec3 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -10556,7 +10556,7 @@ static union node *andor(void);
 static union node *pipeline(void);
 static union node *parse_command(void);
 static void parseheredoc(void);
-static char peektoken(void);
+static char nexttoken_ends_list(void);
 static int readtoken(void);
 
 static union node *
@@ -10566,7 +10566,7 @@ list(int nlflag)
         int tok;
 
         checkkwd = CHKNL | CHKKWD | CHKALIAS;
-        if (nlflag == 2 && peektoken())
+        if (nlflag == 2 && nexttoken_ends_list())
                 return NULL;
         n1 = NULL;
         for (;;) {
@@ -10608,8 +10608,15 @@ list(int nlflag)
                                 tokpushback = 1;
                         }
                         checkkwd = CHKNL | CHKKWD | CHKALIAS;
-                        if (peektoken())
+                        if (nexttoken_ends_list()) {
+                                /* Testcase: "<<EOF; then <W".
+                                 * It used to segfault w/o this check:
+                                 */
+                                if (heredoclist) {
+                                        raise_error_unexpected_syntax(-1);
+                                }
                                 return n1;
+                        }
                         break;
                 case TEOF:
                         if (heredoclist)
@@ -12046,7 +12053,7 @@ readtoken(void)
 }
 
 static char
-peektoken(void)
+nexttoken_ends_list(void)
 {
         int t;
 
diff --git a/shell/ash_test/ash-heredoc/heredoc1.right b/shell/ash_test/ash-heredoc/heredoc1.right
new file mode 100644
index 000000000..895f5ee80
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc1.right
@@ -0,0 +1 @@
+heredoc1.tests: line 3: syntax error: unexpected "then"
diff --git a/shell/ash_test/ash-heredoc/heredoc1.tests b/shell/ash_test/ash-heredoc/heredoc1.tests
new file mode 100755
index 000000000..a912a67c7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc1.tests
@@ -0,0 +1,3 @@
+# We used to SEGV on this:
+
+<<EOF; then <W