5 files changed, 10 insertions, 0 deletions

diff --git a/shell/ash.c b/shell/ash.c
index adb0f223a..54335c5dd 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -7081,6 +7081,10 @@ subevalvar(char *start, char *str, int strloc,
                                 *repl = '\0';
                                 break;
                         }
+                        if ((unsigned char)*repl == CTLENDVAR) { /* ${v/pattern} (no trailing /, no repl) */
+                                repl = NULL;
+                                break;
+                        }
                         /* Handle escaped slashes, e.g. "${v/\//_}" (they are CTLESC'ed by this point) */
                         if ((unsigned char)*repl == CTLESC && repl[1])
                                 repl++;
diff --git a/shell/ash_test/ash-vars/var_bash_repl_unterminated.right b/shell/ash_test/ash-vars/var_bash_repl_unterminated.right
new file mode 100644
index 000000000..5bff3a6fa
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash_repl_unterminated.right
@@ -0,0 +1 @@
+b/d
diff --git a/shell/ash_test/ash-vars/var_bash_repl_unterminated.tests b/shell/ash_test/ash-vars/var_bash_repl_unterminated.tests
new file mode 100755
index 000000000..c9513343d
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash_repl_unterminated.tests
@@ -0,0 +1,2 @@
+a=b-c
+echo ${a/-*}/d
diff --git a/shell/hush_test/hush-vars/var_bash_repl_unterminated.right b/shell/hush_test/hush-vars/var_bash_repl_unterminated.right
new file mode 100644
index 000000000..5bff3a6fa
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash_repl_unterminated.right
@@ -0,0 +1 @@
+b/d
diff --git a/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests b/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests
new file mode 100755
index 000000000..c9513343d
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash_repl_unterminated.tests
@@ -0,0 +1,2 @@
+a=b-c
+echo ${a/-*}/d