5 files changed, 22 insertions, 0 deletions

diff --git a/shell/ash.c b/shell/ash.c
index d29de37b7..c731a333b 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -7028,6 +7028,7 @@ varunset(const char *end, const char *var, const char *umsg, int varflags)
                         msg = umsg;
                 }
         }
+        ifsfree();
         ash_msg_and_raise_error("%.*s: %s%s", (int)(end - var - 1), var, msg, tail);
 }
 
@@ -7453,6 +7454,7 @@ varvalue(char *name, int varflags, int flags, int quoted)
                 if (discard)
                         return -1;
 
+                ifsfree();
                 raise_error_syntax("bad substitution");
         }
 
diff --git a/shell/ash_test/ash-heredoc/heredoc_and_cmd.right b/shell/ash_test/ash-heredoc/heredoc_and_cmd.right
new file mode 100644
index 000000000..25ae70561
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_and_cmd.right
@@ -0,0 +1,2 @@
+./heredoc_and_cmd.tests: line 4: D: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+Y
diff --git a/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests b/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests
new file mode 100755
index 000000000..197542de7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests
@@ -0,0 +1,8 @@
+# The bug was only happening with <<REDIR;CMD form below:
+M='AAAAAAAAAAAAAAAAA'
+fff(){
+date <<000; echo Y
+${D?$M$M$M$M$M$M}
+000
+}
+fff
diff --git a/shell/hush_test/hush-heredoc/heredoc_and_cmd.right b/shell/hush_test/hush-heredoc/heredoc_and_cmd.right
new file mode 100644
index 000000000..5c19a0621
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_and_cmd.right
@@ -0,0 +1,2 @@
+hush: D: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+Y
diff --git a/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests b/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests
new file mode 100755
index 000000000..197542de7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests
@@ -0,0 +1,8 @@
+# The bug was only happening with <<REDIR;CMD form below:
+M='AAAAAAAAAAAAAAAAA'
+fff(){
+date <<000; echo Y
+${D?$M$M$M$M$M$M}
+000
+}
+fff