64 files changed, 736 insertions, 210 deletions

diff --git a/shell/Config.src b/shell/Config.src
index ccb1b15fe..81c4ec874 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -10,26 +10,26 @@ choice
         prompt "Choose which shell is aliased to 'sh' name"
         default SH_IS_ASH
         help
-          Choose which shell you want to be executed by 'sh' alias.
-          The ash shell is the most bash compatible and full featured one.
+        Choose which shell you want to be executed by 'sh' alias.
+        The ash shell is the most bash compatible and full featured one.
 
 # note: cannot use "select ASH" here, it breaks "make allnoconfig"
 config SH_IS_ASH
         depends on !NOMMU
         bool "ash"
         help
-          Choose ash to be the shell executed by 'sh' name.
-          The ash code will be built into busybox. If you don't select
-          "ash" choice (CONFIG_ASH), this shell may only be invoked by
-          the name 'sh' (and not 'ash').
+        Choose ash to be the shell executed by 'sh' name.
+        The ash code will be built into busybox. If you don't select
+        "ash" choice (CONFIG_ASH), this shell may only be invoked by
+        the name 'sh' (and not 'ash').
 
 config SH_IS_HUSH
         bool "hush"
         help
-          Choose hush to be the shell executed by 'sh' name.
-          The hush code will be built into busybox. If you don't select
-          "hush" choice (CONFIG_HUSH), this shell may only be invoked by
-          the name 'sh' (and not 'hush').
+        Choose hush to be the shell executed by 'sh' name.
+        The hush code will be built into busybox. If you don't select
+        "hush" choice (CONFIG_HUSH), this shell may only be invoked by
+        the name 'sh' (and not 'hush').
 
 config SH_IS_NONE
         bool "none"
@@ -40,36 +40,36 @@ choice
         prompt "Choose which shell is aliased to 'bash' name"
         default BASH_IS_NONE
         help
-          Choose which shell you want to be executed by 'bash' alias.
-          The ash shell is the most bash compatible and full featured one,
-          although compatibility is far from being complete.
+        Choose which shell you want to be executed by 'bash' alias.
+        The ash shell is the most bash compatible and full featured one,
+        although compatibility is far from being complete.
 
-          Note that selecting this option does not switch on any bash
-          compatibility code. It merely makes it possible to install
-          /bin/bash (sym)link and run scripts which start with
-          #!/bin/bash line.
+        Note that selecting this option does not switch on any bash
+        compatibility code. It merely makes it possible to install
+        /bin/bash (sym)link and run scripts which start with
+        #!/bin/bash line.
 
-          Many systems use it in scripts which use bash-specific features,
-          even simple ones like $RANDOM. Without this option, busybox
-          can't be used for running them because it won't recongnize
-          "bash" as a supported applet name.
+        Many systems use it in scripts which use bash-specific features,
+        even simple ones like $RANDOM. Without this option, busybox
+        can't be used for running them because it won't recongnize
+        "bash" as a supported applet name.
 
 config BASH_IS_ASH
         depends on !NOMMU
         bool "ash"
         help
-          Choose ash to be the shell executed by 'bash' name.
-          The ash code will be built into busybox. If you don't select
-          "ash" choice (CONFIG_ASH), this shell may only be invoked by
-          the name 'bash' (and not 'ash').
+        Choose ash to be the shell executed by 'bash' name.
+        The ash code will be built into busybox. If you don't select
+        "ash" choice (CONFIG_ASH), this shell may only be invoked by
+        the name 'bash' (and not 'ash').
 
 config BASH_IS_HUSH
         bool "hush"
         help
-          Choose hush to be the shell executed by 'bash' name.
-          The hush code will be built into busybox. If you don't select
-          "hush" choice (CONFIG_HUSH), this shell may only be invoked by
-          the name 'bash' (and not 'hush').
+        Choose hush to be the shell executed by 'bash' name.
+        The hush code will be built into busybox. If you don't select
+        "hush" choice (CONFIG_HUSH), this shell may only be invoked by
+        the name 'bash' (and not 'hush').
 
 config BASH_IS_NONE
         bool "none"
@@ -88,71 +88,78 @@ config FEATURE_SH_MATH
         default y
         depends on ASH || HUSH || SH_IS_ASH || BASH_IS_ASH || SH_IS_HUSH || BASH_IS_HUSH
         help
-          Enable math support in the shell via $((...)) syntax.
+        Enable math support in the shell via $((...)) syntax.
 
 config FEATURE_SH_MATH_64
         bool "Extend POSIX math support to 64 bit"
         default y
         depends on FEATURE_SH_MATH
         help
-          Enable 64-bit math support in the shell. This will make the shell
-          slightly larger, but will allow computation with very large numbers.
-          This is not in POSIX, so do not rely on this in portable code.
+        Enable 64-bit math support in the shell. This will make the shell
+        slightly larger, but will allow computation with very large numbers.
+        This is not in POSIX, so do not rely on this in portable code.
 
 config FEATURE_SH_EXTRA_QUIET
         bool "Hide message on interactive shell startup"
         default y
         depends on ASH || HUSH || SH_IS_ASH || BASH_IS_ASH || SH_IS_HUSH || BASH_IS_HUSH
         help
-          Remove the busybox introduction when starting a shell.
+        Remove the busybox introduction when starting a shell.
 
 config FEATURE_SH_STANDALONE
         bool "Standalone shell"
         default n
         depends on ASH || HUSH || SH_IS_ASH || BASH_IS_ASH || SH_IS_HUSH || BASH_IS_HUSH
         help
-          This option causes busybox shells to use busybox applets
-          in preference to executables in the PATH whenever possible. For
-          example, entering the command 'ifconfig' into the shell would cause
-          busybox to use the ifconfig busybox applet. Specifying the fully
-          qualified executable name, such as '/sbin/ifconfig' will still
-          execute the /sbin/ifconfig executable on the filesystem. This option
-          is generally used when creating a statically linked version of busybox
-          for use as a rescue shell, in the event that you screw up your system.
-
-          This is implemented by re-execing /proc/self/exe (typically)
-          with right parameters.
-
-          However, there are drawbacks: it is problematic in chroot jails
-          without mounted /proc, and ps/top may show command name as 'exe'
-          for applets started this way.
+        This option causes busybox shells to use busybox applets
+        in preference to executables in the PATH whenever possible. For
+        example, entering the command 'ifconfig' into the shell would cause
+        busybox to use the ifconfig busybox applet. Specifying the fully
+        qualified executable name, such as '/sbin/ifconfig' will still
+        execute the /sbin/ifconfig executable on the filesystem. This option
+        is generally used when creating a statically linked version of busybox
+        for use as a rescue shell, in the event that you screw up your system.
+
+        This is implemented by re-execing /proc/self/exe (typically)
+        with right parameters.
+
+        However, there are drawbacks: it is problematic in chroot jails
+        without mounted /proc, and ps/top may show command name as 'exe'
+        for applets started this way.
 
 config FEATURE_SH_NOFORK
         bool "Run 'nofork' applets directly"
         default n
         depends on ASH || HUSH || SH_IS_ASH || BASH_IS_ASH || SH_IS_HUSH || BASH_IS_HUSH
         help
-          This option causes busybox shells to not execute typical
-          fork/exec/wait sequence, but call <applet>_main directly,
-          if possible. (Sometimes it is not possible: for example,
-          this is not possible in pipes).
+        This option causes busybox shells to not execute typical
+        fork/exec/wait sequence, but call <applet>_main directly,
+        if possible. (Sometimes it is not possible: for example,
+        this is not possible in pipes).
 
-          This will be done only for some applets (those which are marked
-          NOFORK in include/applets.h).
+        This will be done only for some applets (those which are marked
+        NOFORK in include/applets.h).
 
-          This may significantly speed up some shell scripts.
+        This may significantly speed up some shell scripts.
 
-          This feature is relatively new. Use with care. Report bugs
-          to project mailing list.
+        This feature is relatively new. Use with care. Report bugs
+        to project mailing list.
+
+config FEATURE_SH_READ_FRAC
+        bool "read -t N.NNN support (+110 bytes)"
+        default y
+        depends on ASH || HUSH || SH_IS_ASH || BASH_IS_ASH || SH_IS_HUSH || BASH_IS_HUSH
+        help
+        Enable support for fractional second timeout in read builtin.
 
 config FEATURE_SH_HISTFILESIZE
         bool "Use $HISTFILESIZE"
         default y
         depends on ASH || HUSH || SH_IS_ASH || BASH_IS_ASH || SH_IS_HUSH || BASH_IS_HUSH
         help
-          This option makes busybox shells to use $HISTFILESIZE variable
-          to set shell history size. Note that its max value is capped
-          by "History size" setting in library tuning section.
+        This option makes busybox shells to use $HISTFILESIZE variable
+        to set shell history size. Note that its max value is capped
+        by "History size" setting in library tuning section.
 
 endif # Options common to all shells
 
diff --git a/shell/ash.c b/shell/ash.c
index dc5561765..28b522d7c 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -31,15 +31,14 @@
  */
 
 //config:config ASH
-//config:       bool "ash"
+//config:       bool "ash (77 kb)"
 //config:       default y
 //config:       depends on !NOMMU
 //config:       help
-//config:         Tha 'ash' shell adds about 60k in the default configuration and is
-//config:         the most complete and most pedantically correct shell included with
-//config:         busybox. This shell is actually a derivative of the Debian 'dash'
-//config:         shell (by Herbert Xu), which was created by porting the 'ash' shell
-//config:         (written by Kenneth Almquist) from NetBSD.
+//config:       The most complete and most pedantically correct shell included with
+//config:       busybox. This shell is actually a derivative of the Debian 'dash'
+//config:       shell (by Herbert Xu), which was created by porting the 'ash' shell
+//config:       (written by Kenneth Almquist) from NetBSD.
 //config:
 //config:# ash options
 //config:# note: Don't remove !NOMMU part in the next line; it would break
@@ -56,11 +55,11 @@
 //config:       default y       # Y is bigger, but because of uclibc glob() bug, let Y be default for now
 //config:       depends on ASH || SH_IS_ASH || BASH_IS_ASH
 //config:       help
-//config:         Do not use glob() function from libc, use internal implementation.
-//config:         Use this if you are getting "glob.h: No such file or directory"
-//config:         or similar build errors.
-//config:         Note that as of now (2017-01), uclibc and musl glob() both have bugs
-//config:         which would break ash if you select N here.
+//config:       Do not use glob() function from libc, use internal implementation.
+//config:       Use this if you are getting "glob.h: No such file or directory"
+//config:       or similar build errors.
+//config:       Note that as of now (2017-01), uclibc and musl glob() both have bugs
+//config:       which would break ash if you select N here.
 //config:
 //config:config ASH_BASH_COMPAT
 //config:       bool "bash-compatible extensions"
@@ -82,37 +81,37 @@
 //config:       default y
 //config:       depends on ASH || SH_IS_ASH || BASH_IS_ASH
 //config:       help
-//config:         Enable pseudorandom generator and dynamic variable "$RANDOM".
-//config:         Each read of "$RANDOM" will generate a new pseudorandom value.
-//config:         You can reset the generator by using a specified start value.
-//config:         After "unset RANDOM" the generator will switch off and this
-//config:         variable will no longer have special treatment.
+//config:       Enable pseudorandom generator and dynamic variable "$RANDOM".
+//config:       Each read of "$RANDOM" will generate a new pseudorandom value.
+//config:       You can reset the generator by using a specified start value.
+//config:       After "unset RANDOM" the generator will switch off and this
+//config:       variable will no longer have special treatment.
 //config:
 //config:config ASH_EXPAND_PRMT
 //config:       bool "Expand prompt string"
 //config:       default y
 //config:       depends on ASH || SH_IS_ASH || BASH_IS_ASH
 //config:       help
-//config:         $PS# may contain volatile content, such as backquote commands.
-//config:         This option recreates the prompt string from the environment
-//config:         variable each time it is displayed.
+//config:       $PS# may contain volatile content, such as backquote commands.
+//config:       This option recreates the prompt string from the environment
+//config:       variable each time it is displayed.
 //config:
 //config:config ASH_IDLE_TIMEOUT
 //config:       bool "Idle timeout variable $TMOUT"
 //config:       default y
 //config:       depends on ASH || SH_IS_ASH || BASH_IS_ASH
 //config:       help
-//config:         Enable bash-like auto-logout after $TMOUT seconds of idle time.
+//config:       Enable bash-like auto-logout after $TMOUT seconds of idle time.
 //config:
 //config:config ASH_MAIL
 //config:       bool "Check for new mail in interactive shell"
 //config:       default y
 //config:       depends on ASH || SH_IS_ASH || BASH_IS_ASH
 //config:       help
-//config:         Enable "check for new mail" function:
-//config:         if set, $MAIL file and $MAILPATH list of files
-//config:         are checked for mtime changes, and "you have mail"
-//config:         message is printed if change is detected.
+//config:       Enable "check for new mail" function:
+//config:       if set, $MAIL file and $MAILPATH list of files
+//config:       are checked for mtime changes, and "you have mail"
+//config:       message is printed if change is detected.
 //config:
 //config:config ASH_ECHO
 //config:       bool "echo builtin"
@@ -144,9 +143,9 @@
 //config:       default y
 //config:       depends on ASH || SH_IS_ASH || BASH_IS_ASH
 //config:       help
-//config:         Enable support for the 'command' builtin, which allows
-//config:         you to run the specified command or builtin,
-//config:         even when there is a function with the same name.
+//config:       Enable support for the 'command' builtin, which allows
+//config:       you to run the specified command or builtin,
+//config:       even when there is a function with the same name.
 //config:
 //config:
 //config:config ASH_NOCONSOLE
@@ -1746,7 +1745,7 @@ static char *
 stack_nputstr(const char *s, size_t n, char *p)
 {
         p = makestrspace(n, p);
-        p = (char *)memcpy(p, s, n) + n;
+        p = (char *)mempcpy(p, s, n);
         return p;
 }
 
@@ -1830,7 +1829,7 @@ number(const char *s)
 }
 
 /*
- * Produce a possibly single quoted string suitable as input to the shell.
+ * Produce a single quoted string suitable as input to the shell.
  * The return string is allocated on the stack.
  */
 static char *
@@ -1849,7 +1848,7 @@ single_quote(const char *s)
                 q = p = makestrspace(len + 3, p);
 
                 *q++ = '\'';
-                q = (char *)memcpy(q, s, len) + len;
+                q = (char *)mempcpy(q, s, len);
                 *q++ = '\'';
                 s += len;
 
@@ -1863,7 +1862,7 @@ single_quote(const char *s)
                 q = p = makestrspace(len + 3, p);
 
                 *q++ = '"';
-                q = (char *)memcpy(q, s - len, len) + len;
+                q = (char *)mempcpy(q, s - len, len);
                 *q++ = '"';
 
                 STADJUST(q - p, p);
@@ -1874,6 +1873,47 @@ single_quote(const char *s)
         return stackblock();
 }
 
+/*
+ * Produce a possibly single quoted string suitable as input to the shell.
+ * If 'conditional' is nonzero, quoting is only done if the string contains
+ * non-shellsafe characters, or is identical to a shell keyword (reserved
+ * word); if it is zero, quoting is always done.
+ * If quoting was done, the return string is allocated on the stack,
+ * otherwise a pointer to the original string is returned.
+ */
+static const char *
+maybe_single_quote(const char *s)
+{
+        const char *p = s;
+
+        while (*p) {
+                /* Assuming ACSII */
+                /* quote ctrl_chars space !"#$%&'()* */
+                if (*p < '+')
+                        goto need_quoting;
+                /* quote ;<=>? */
+                if (*p >= ';' && *p <= '?')
+                        goto need_quoting;
+                /* quote `[\ */
+                if (*p == '`')
+                        goto need_quoting;
+                if (*p == '[')
+                        goto need_quoting;
+                if (*p == '\\')
+                        goto need_quoting;
+                /* quote {|}~ DEL and high bytes */
+                if (*p > 'z')
+                        goto need_quoting;
+                /* Not quoting these: +,-./ 0-9 :@ A-Z ]^_ a-z */
+                /* TODO: maybe avoid quoting % */
+                p++;
+        }
+        return s;
+
+ need_quoting:
+        return single_quote(s);
+}
+
 
 /* ============ nextopt */
 
@@ -2362,10 +2402,10 @@ setvar(const char *name, const char *val, int flags)
 
         INT_OFF;
         nameeq = ckmalloc(namelen + vallen + 2);
-        p = memcpy(nameeq, name, namelen) + namelen;
+        p = mempcpy(nameeq, name, namelen);
         if (val) {
                 *p++ = '=';
-                p = memcpy(p, val, vallen) + vallen;
+                p = mempcpy(p, val, vallen);
         }
         *p = '\0';
         setvareq(nameeq, flags | VNOSAVE);
@@ -2512,8 +2552,7 @@ path_advance(const char **path, const char *name)
                 growstackblock();
         q = stackblock();
         if (p != start) {
-                memcpy(q, start, p - start);
-                q += p - start;
+                q = mempcpy(q, start, p - start);
                 *q++ = '/';
         }
         strcpy(q, name);
@@ -6277,7 +6316,7 @@ rmescapes(char *str, int flag)
                 }
                 q = r;
                 if (len > 0) {
-                        q = (char *)memcpy(q, str, len) + len;
+                        q = (char *)mempcpy(q, str, len);
                 }
         }
 
@@ -10161,18 +10200,36 @@ evalcommand(union node *cmd, int flags)
 
         /* Print the command if xflag is set. */
         if (xflag) {
-                int n;
-                const char *p = " %s" + 1;
+                const char *pfx = "";
+
+                fdprintf(preverrout_fd, "%s", expandstr(ps4val()));
 
-                fdprintf(preverrout_fd, p, expandstr(ps4val()));
                 sp = varlist.list;
-                for (n = 0; n < 2; n++) {
-                        while (sp) {
-                                fdprintf(preverrout_fd, p, sp->text);
-                                sp = sp->next;
-                                p = " %s";
-                        }
-                        sp = arglist.list;
+                while (sp) {
+                        char *varval = sp->text;
+                        char *eq = strchrnul(varval, '=');
+                        if (*eq)
+                                eq++;
+                        fdprintf(preverrout_fd, "%s%.*s%s",
+                                pfx,
+                                (int)(eq - varval), varval,
+                                maybe_single_quote(eq)
+                        );
+                        sp = sp->next;
+                        pfx = " ";
+                }
+
+                sp = arglist.list;
+                while (sp) {
+                        fdprintf(preverrout_fd, "%s%s",
+                                pfx,
+                                /* always quote if matches reserved word: */
+                                findkwd(sp->text)
+                                ? single_quote(sp->text)
+                                : maybe_single_quote(sp->text)
+                        );
+                        sp = sp->next;
+                        pfx = " ";
                 }
                 safe_write(preverrout_fd, "\n", 1);
         }
diff --git a/shell/ash_test/ash-parsing/argv0.right b/shell/ash_test/ash-parsing/argv0.right
new file mode 100644
index 000000000..d86bac9de
--- /dev/null
+++ b/shell/ash_test/ash-parsing/argv0.right
@@ -0,0 +1 @@
+OK
diff --git a/shell/ash_test/ash-parsing/argv0.tests b/shell/ash_test/ash-parsing/argv0.tests
new file mode 100755
index 000000000..f5c40f6fe
--- /dev/null
+++ b/shell/ash_test/ash-parsing/argv0.tests
@@ -0,0 +1,4 @@
+if test $# = 0; then
+    exec "$THIS_SH" "$0" arg
+fi
+echo OK
diff --git a/shell/ash_test/ash-parsing/brace1.right b/shell/ash_test/ash-parsing/brace1.right
new file mode 100644
index 000000000..10aa7a419
--- /dev/null
+++ b/shell/ash_test/ash-parsing/brace1.right
@@ -0,0 +1,7 @@
+{abc}
+{
+}
+./brace1.tests: line 4: {cmd: not found
+./brace1.tests: line 5: {: not found
+./brace1.tests: line 6: {: not found
+Done: 127
diff --git a/shell/ash_test/ash-parsing/brace1.tests b/shell/ash_test/ash-parsing/brace1.tests
new file mode 100755
index 000000000..2b45927c0
--- /dev/null
+++ b/shell/ash_test/ash-parsing/brace1.tests
@@ -0,0 +1,7 @@
+echo {abc}
+echo {
+echo }
+{cmd
+""{
+{""
+echo Done: $?
diff --git a/shell/ash_test/ash-parsing/brace2.right b/shell/ash_test/ash-parsing/brace2.right
new file mode 100644
index 000000000..37a966654
--- /dev/null
+++ b/shell/ash_test/ash-parsing/brace2.right
@@ -0,0 +1,3 @@
+{q,w}
+{q,w}
+Done
diff --git a/shell/ash_test/ash-parsing/brace2.tests b/shell/ash_test/ash-parsing/brace2.tests
new file mode 100755
index 000000000..ef75f0b70
--- /dev/null
+++ b/shell/ash_test/ash-parsing/brace2.tests
@@ -0,0 +1,5 @@
+v='{q,w}'
+# Should not brace-expand v value
+echo $v
+echo "$v"
+echo Done
diff --git a/shell/ash_test/ash-parsing/comment1.right b/shell/ash_test/ash-parsing/comment1.right
new file mode 100644
index 000000000..a102b1d4e
--- /dev/null
+++ b/shell/ash_test/ash-parsing/comment1.right
@@ -0,0 +1,2 @@
+Nothing:
+String: #should-be-echoed
diff --git a/shell/ash_test/ash-parsing/comment1.tests b/shell/ash_test/ash-parsing/comment1.tests
new file mode 100755
index 000000000..d268860ff
--- /dev/null
+++ b/shell/ash_test/ash-parsing/comment1.tests
@@ -0,0 +1,2 @@
+echo Nothing: #should-not-be-echoed
+echo String: ""#should-be-echoed
diff --git a/shell/ash_test/ash-parsing/eol1.right b/shell/ash_test/ash-parsing/eol1.right
new file mode 100644
index 000000000..31c896f62
--- /dev/null
+++ b/shell/ash_test/ash-parsing/eol1.right
@@ -0,0 +1 @@
+Done:0
diff --git a/shell/ash_test/ash-parsing/eol1.tests b/shell/ash_test/ash-parsing/eol1.tests
new file mode 100755
index 000000000..f1b55e8b8
--- /dev/null
+++ b/shell/ash_test/ash-parsing/eol1.tests
@@ -0,0 +1,18 @@
+# bug was that we treated <newline> as ';' in this line:
+true || echo foo |
+echo BAD1 | cat
+
+# variation on the same theme
+true || echo foo |
+# comment
+echo BAD2 | cat
+
+# variation on the same theme
+true || echo foo |
+
+echo BAD3 | cat
+
+# this should error out, but currently works in hush:
+#true || echo foo |;
+
+echo Done:$?
diff --git a/shell/ash_test/ash-parsing/escape1.right b/shell/ash_test/ash-parsing/escape1.right
new file mode 100644
index 000000000..1899b87ef
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape1.right
@@ -0,0 +1,4 @@
+\
+a\b
+\\
+c\\d
diff --git a/shell/ash_test/ash-parsing/escape1.tests b/shell/ash_test/ash-parsing/escape1.tests
new file mode 100755
index 000000000..25ac96b25
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape1.tests
@@ -0,0 +1,6 @@
+test "$CONFIG_FEATURE_FANCY_ECHO" = "y" || exit 77
+
+echo "\\"
+echo a"\\"b
+echo '\\'
+echo c'\\'d
diff --git a/shell/ash_test/ash-parsing/escape2.right b/shell/ash_test/ash-parsing/escape2.right
new file mode 100644
index 000000000..f55fd4a42
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape2.right
@@ -0,0 +1,4 @@
+*?[a]*
+a*?[a]*b
+*?[a]*
+c*?[a]*d
diff --git a/shell/ash_test/ash-parsing/escape2.tests b/shell/ash_test/ash-parsing/escape2.tests
new file mode 100755
index 000000000..ee718018d
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape2.tests
@@ -0,0 +1,4 @@
+echo "*?[a]*"
+echo a"*?[a]*"b
+echo '*?[a]*'
+echo c'*?[a]*'d
diff --git a/shell/ash_test/ash-parsing/escape3.right b/shell/ash_test/ash-parsing/escape3.right
new file mode 100644
index 000000000..da02a976a
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape3.right
@@ -0,0 +1,23 @@
+v: a \ b \\ c \\\ d \\\\ e
+v: a \ b \\ c \\\ d \\\\ e
+Unquoted:
+.a.
+.\.
+.b.
+.\\.
+.c.
+.\\\.
+.d.
+.\\\\.
+.e.
+Quoted:
+.a.
+.\.
+.b.
+.\\.
+.c.
+.\\\.
+.d.
+.\\\\.
+.e.
+done
diff --git a/shell/ash_test/ash-parsing/escape3.tests b/shell/ash_test/ash-parsing/escape3.tests
new file mode 100755
index 000000000..18705bd0c
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape3.tests
@@ -0,0 +1,10 @@
+test "$CONFIG_FEATURE_FANCY_ECHO" = "y" || exit 77
+
+v='a \ b \\ c \\\ d \\\\ e'
+echo v: $v
+echo v: "$v"
+echo Unquoted:
+for a in $v; do echo .$a.; done
+echo Quoted:
+for a in $v; do echo ".$a."; done
+echo done
diff --git a/shell/ash_test/ash-parsing/escape4.right b/shell/ash_test/ash-parsing/escape4.right
new file mode 100644
index 000000000..5de3e0c90
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape4.right
@@ -0,0 +1,2 @@
+Ok
+End
diff --git a/shell/ash_test/ash-parsing/escape4.tests b/shell/ash_test/ash-parsing/escape4.tests
new file mode 100755
index 000000000..df8bf0af7
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape4.tests
@@ -0,0 +1,6 @@
+i\
+f tr\
+ue; th\
+en echo "O\
+k"; fi; echo "\
+End"
\ No newline at end of file
diff --git a/shell/ash_test/ash-parsing/escape5.right b/shell/ash_test/ash-parsing/escape5.right
new file mode 100644
index 000000000..3cdd393c7
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape5.right
@@ -0,0 +1,9 @@
+a\nb\nc\n
+a
+b
+c
+a\nb\nc\n
+a
+b
+c
+Done
diff --git a/shell/ash_test/ash-parsing/escape5.tests b/shell/ash_test/ash-parsing/escape5.tests
new file mode 100755
index 000000000..337a98ec7
--- /dev/null
+++ b/shell/ash_test/ash-parsing/escape5.tests
@@ -0,0 +1,7 @@
+v="a\nb\nc\n"
+echo "$v"
+printf "$v"
+v='a\nb\nc\n'
+echo "$v"
+printf "$v"
+echo Done
diff --git a/shell/ash_test/ash-parsing/group1.right b/shell/ash_test/ash-parsing/group1.right
new file mode 100644
index 000000000..6a7c4be0a
--- /dev/null
+++ b/shell/ash_test/ash-parsing/group1.right
@@ -0,0 +1 @@
+word} }
diff --git a/shell/ash_test/ash-parsing/group1.tests b/shell/ash_test/ash-parsing/group1.tests
new file mode 100755
index 000000000..f063fbcb3
--- /dev/null
+++ b/shell/ash_test/ash-parsing/group1.tests
@@ -0,0 +1 @@
+{ echo word} }; }
diff --git a/shell/ash_test/ash-parsing/group2.right b/shell/ash_test/ash-parsing/group2.right
new file mode 100644
index 000000000..df4d9306a
--- /dev/null
+++ b/shell/ash_test/ash-parsing/group2.right
@@ -0,0 +1,2 @@
+got TERM
+Done: 0
diff --git a/shell/ash_test/ash-parsing/group2.tests b/shell/ash_test/ash-parsing/group2.tests
new file mode 100755
index 000000000..d99178585
--- /dev/null
+++ b/shell/ash_test/ash-parsing/group2.tests
@@ -0,0 +1,3 @@
+# Bug was in handling of "}&" without space
+{ trap "echo got TERM" TERM; sleep 2; }& sleep 1; kill $!; wait
+echo Done: $?
diff --git a/shell/ash_test/ash-parsing/groups_and_keywords1.right b/shell/ash_test/ash-parsing/groups_and_keywords1.right
new file mode 100644
index 000000000..4c46650dc
--- /dev/null
+++ b/shell/ash_test/ash-parsing/groups_and_keywords1.right
@@ -0,0 +1,11 @@
+Semicolons after } can be omitted 1:
+foo
+bar
+Semicolons after } can be omitted 2:
+foo
+bar
+Semicolons after fi can be omitted:
+foo
+bar
+baz
+Done:0
diff --git a/shell/ash_test/ash-parsing/groups_and_keywords1.tests b/shell/ash_test/ash-parsing/groups_and_keywords1.tests
new file mode 100755
index 000000000..01944d714
--- /dev/null
+++ b/shell/ash_test/ash-parsing/groups_and_keywords1.tests
@@ -0,0 +1,10 @@
+echo "Semicolons after } can be omitted 1:"
+if { echo foo; } then { echo bar; } fi
+
+echo "Semicolons after } can be omitted 2:"
+while { echo foo; } do { echo bar; break; } done
+
+echo "Semicolons after fi can be omitted:"
+while if echo foo; then echo bar; fi do echo baz; break; done
+
+echo Done:$?
diff --git a/shell/ash_test/ash-parsing/negate.right b/shell/ash_test/ash-parsing/negate.right
new file mode 100644
index 000000000..61d2ecd3a
--- /dev/null
+++ b/shell/ash_test/ash-parsing/negate.right
@@ -0,0 +1,36 @@
+! printing !
+0
+1
+1
+0
+0
+0
+!
+a
+b
+c
+! 1
+a 1
+b 1
+c 1
+! 1
+a 1
+b 1
+c 1
+0
+0
+0
+0
+1
+1
+1
+1
+0
+0
+0
+0
+1
+1
+1
+1
+Done
diff --git a/shell/ash_test/ash-parsing/negate.tests b/shell/ash_test/ash-parsing/negate.tests
new file mode 100755
index 000000000..51151cbd4
--- /dev/null
+++ b/shell/ash_test/ash-parsing/negate.tests
@@ -0,0 +1,19 @@
+echo ! printing !
+! false
+echo $?
+! true
+echo $?
+if ! false; then false; echo $?; fi
+echo $?
+if ! false; then ! false; echo $?; fi
+echo $?
+PRINTF=`which printf`
+for a in ! a b c; do echo $a; done
+for a in ! a b c; do ! printf "$a "; echo $?; done
+test x"$PRINTF" = x"" && exit 1
+for a in ! a b c; do ! "$PRINTF" "$a "; echo $?; done
+for a in ! a b c; do ! printf "$a " | false; echo $?; done
+for a in ! a b c; do ! printf "$a " | true; echo $?; done
+for a in ! a b c; do ! { printf "$a " | false; }; echo $?; done
+for a in ! a b c; do ! { printf "$a " | true; }; echo $?; done
+echo Done
diff --git a/shell/ash_test/ash-parsing/noeol.right b/shell/ash_test/ash-parsing/noeol.right
new file mode 100644
index 000000000..e427984d4
--- /dev/null
+++ b/shell/ash_test/ash-parsing/noeol.right
@@ -0,0 +1 @@
+HELLO
diff --git a/shell/ash_test/ash-parsing/noeol.tests b/shell/ash_test/ash-parsing/noeol.tests
new file mode 100755
index 000000000..a93113a03
--- /dev/null
+++ b/shell/ash_test/ash-parsing/noeol.tests
@@ -0,0 +1,2 @@
+# next line has no EOL!
+echo HELLO
\ No newline at end of file
diff --git a/shell/ash_test/ash-parsing/noeol2.right b/shell/ash_test/ash-parsing/noeol2.right
new file mode 100644
index 000000000..d00491fd7
--- /dev/null
+++ b/shell/ash_test/ash-parsing/noeol2.right
@@ -0,0 +1 @@
+1
diff --git a/shell/ash_test/ash-parsing/noeol2.tests b/shell/ash_test/ash-parsing/noeol2.tests
new file mode 100755
index 000000000..1220f056f
--- /dev/null
+++ b/shell/ash_test/ash-parsing/noeol2.tests
@@ -0,0 +1,7 @@
+# last line has no EOL!
+if true
+then
+  echo 1
+else
+  echo 2
+fi
\ No newline at end of file
diff --git a/shell/ash_test/ash-parsing/noeol3.right b/shell/ash_test/ash-parsing/noeol3.right
new file mode 100644
index 000000000..c2a0e38f8
--- /dev/null
+++ b/shell/ash_test/ash-parsing/noeol3.right
@@ -0,0 +1 @@
+./noeol3.tests: line 2: syntax error: unterminated quoted string
diff --git a/shell/ash_test/ash-parsing/noeol3.tests b/shell/ash_test/ash-parsing/noeol3.tests
new file mode 100755
index 000000000..ec958ed7a
--- /dev/null
+++ b/shell/ash_test/ash-parsing/noeol3.tests
@@ -0,0 +1,2 @@
+# last line has no EOL!
+echo "unterminated
\ No newline at end of file
diff --git a/shell/ash_test/ash-parsing/process_subst.right b/shell/ash_test/ash-parsing/process_subst.right
new file mode 100644
index 000000000..397bc8067
--- /dev/null
+++ b/shell/ash_test/ash-parsing/process_subst.right
@@ -0,0 +1,3 @@
+TESTzzBEST
+TEST$(echo zz)BEST
+TEST'BEST
diff --git a/shell/ash_test/ash-parsing/process_subst.tests b/shell/ash_test/ash-parsing/process_subst.tests
new file mode 100755
index 000000000..21996bc0e
--- /dev/null
+++ b/shell/ash_test/ash-parsing/process_subst.tests
@@ -0,0 +1,3 @@
+echo "TEST`echo zz;echo;echo`BEST"
+echo "TEST`echo '$(echo zz)'`BEST"
+echo "TEST`echo "'"`BEST"
diff --git a/shell/ash_test/ash-parsing/quote1.right b/shell/ash_test/ash-parsing/quote1.right
new file mode 100644
index 000000000..cb382054c
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote1.right
@@ -0,0 +1 @@
+'1'
diff --git a/shell/ash_test/ash-parsing/quote1.tests b/shell/ash_test/ash-parsing/quote1.tests
new file mode 100755
index 000000000..f55895466
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote1.tests
@@ -0,0 +1,2 @@
+a=1
+echo "'$a'"
diff --git a/shell/ash_test/ash-parsing/quote2.right b/shell/ash_test/ash-parsing/quote2.right
new file mode 100644
index 000000000..3bc9edcd6
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote2.right
@@ -0,0 +1 @@
+>1
diff --git a/shell/ash_test/ash-parsing/quote2.tests b/shell/ash_test/ash-parsing/quote2.tests
new file mode 100755
index 000000000..bd966f30b
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote2.tests
@@ -0,0 +1,2 @@
+a=1
+echo ">$a"
diff --git a/shell/ash_test/ash-parsing/quote3.right b/shell/ash_test/ash-parsing/quote3.right
new file mode 100644
index 000000000..bbe46df67
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote3.right
@@ -0,0 +1,12 @@
+Testing: in ""
+..
+Testing: in ''
+..
+Testing: in $empty
+Testing: in $empty""
+..
+Testing: in $empty''
+..
+Testing: in "$empty"
+..
+Finished
diff --git a/shell/ash_test/ash-parsing/quote3.tests b/shell/ash_test/ash-parsing/quote3.tests
new file mode 100755
index 000000000..b5fd5978c
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote3.tests
@@ -0,0 +1,21 @@
+empty=''
+
+echo 'Testing: in ""'
+for a in ""; do echo ".$a."; done
+
+echo 'Testing: in '"''"
+for a in ''; do echo ".$a."; done
+
+echo 'Testing: in $empty'
+for a in $empty; do echo ".$a."; done
+
+echo 'Testing: in $empty""'
+for a in $empty""; do echo ".$a."; done
+
+echo 'Testing: in $empty'"''"
+for a in $empty''; do echo ".$a."; done
+
+echo 'Testing: in "$empty"'
+for a in "$empty"; do echo ".$a."; done
+
+echo Finished
diff --git a/shell/ash_test/ash-parsing/quote4.right b/shell/ash_test/ash-parsing/quote4.right
new file mode 100644
index 000000000..b2901ea97
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote4.right
@@ -0,0 +1 @@
+a b
diff --git a/shell/ash_test/ash-parsing/quote4.tests b/shell/ash_test/ash-parsing/quote4.tests
new file mode 100755
index 000000000..f1dabfa54
--- /dev/null
+++ b/shell/ash_test/ash-parsing/quote4.tests
@@ -0,0 +1,2 @@
+a_b='a b'
+echo "$a_b"
diff --git a/shell/ash_test/ash-parsing/starquoted.right b/shell/ash_test/ash-parsing/starquoted.right
new file mode 100644
index 000000000..b56323fe1
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted.right
@@ -0,0 +1,8 @@
+.1 abc d e f.
+.1.
+.abc.
+.d e f.
+.-1 abc d e f-.
+.-1.
+.abc.
+.d e f-.
diff --git a/shell/ash_test/ash-parsing/starquoted.tests b/shell/ash_test/ash-parsing/starquoted.tests
new file mode 100755
index 000000000..2fe49b1cd
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted.tests
@@ -0,0 +1,8 @@
+if test $# = 0; then
+    exec "$THIS_SH" "$0" 1 abc 'd e f'
+fi
+
+for a in "$*"; do echo ".$a."; done
+for a in "$@"; do echo ".$a."; done
+for a in "-$*-"; do echo ".$a."; done
+for a in "-$@-"; do echo ".$a."; done
diff --git a/shell/ash_test/ash-parsing/starquoted2.right b/shell/ash_test/ash-parsing/starquoted2.right
new file mode 100644
index 000000000..1bff408ca
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted2.right
@@ -0,0 +1,8 @@
+Should be printed
+Would not be printed by bash
+Would not be printed by bash
+Would not be printed by bash
+Should be printed
+Empty:
+Empty:
+Empty:
diff --git a/shell/ash_test/ash-parsing/starquoted2.tests b/shell/ash_test/ash-parsing/starquoted2.tests
new file mode 100755
index 000000000..7c5ff45b8
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted2.tests
@@ -0,0 +1,19 @@
+if test $# != 0; then
+    exec "$THIS_SH" "$0"
+fi
+
+# No params!
+for a in "$*"; do echo Should be printed; done
+for a in "$@"; do echo Should not be printed; done
+# Yes, believe it or not, bash is mesmerized by "$@" and stops
+# treating "" as "this word cannot be expanded to nothing,
+# but must be at least null string". Now it can be expanded to nothing.
+for a in "$@"""; do echo Would not be printed by bash; done
+for a in """$@"; do echo Would not be printed by bash; done
+for a in """$@"''"$@"''; do echo Would not be printed by bash; done
+for a in ""; do echo Should be printed; done
+
+# Bug 207: "$@" expands to nothing, and we erroneously glob "%s\n" twice:
+printf 'Empty:%s\n' "$@"
+printf "Empty:%s\n" "$@"
+printf "Empty:%s\\n" "$@"
diff --git a/shell/ash_test/ash-quoting/mode_x.right b/shell/ash_test/ash-quoting/mode_x.right
new file mode 100644
index 000000000..c2dd3550c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/mode_x.right
@@ -0,0 +1,10 @@
++ var1=val
++ var2='one two'
++ true '%s\n' one 'two '"'"'three' four
++ this=command
++ 'this=command'
+./mode_x.tests: line 1: this=command: not found
++ true
++ true
++ 'if' true
+./mode_x.tests: line 1: if: not found
diff --git a/shell/ash_test/ash-quoting/mode_x.tests b/shell/ash_test/ash-quoting/mode_x.tests
new file mode 100755
index 000000000..16dae3f4b
--- /dev/null
+++ b/shell/ash_test/ash-quoting/mode_x.tests
@@ -0,0 +1,14 @@
+set -x
+
+var1=val
+var2='one two'
+true %s\\n one "two 'three" four
+
+# assignment:
+this=command
+# NOT assignment, +x code should show it quoted:
+"this=command"
+
+if true; then true; fi
+# +x code should quote 'if' here:
+"if" true
diff --git a/shell/ash_test/ash-read/read_t0.right b/shell/ash_test/ash-read/read_t0.right
new file mode 100644
index 000000000..f02105961
--- /dev/null
+++ b/shell/ash_test/ash-read/read_t0.right
@@ -0,0 +1,3 @@
+><[0]
+><[0]
+><[1]
diff --git a/shell/ash_test/ash-read/read_t0.tests b/shell/ash_test/ash-read/read_t0.tests
new file mode 100755
index 000000000..6b7bc217b
--- /dev/null
+++ b/shell/ash_test/ash-read/read_t0.tests
@@ -0,0 +1,14 @@
+# ><[0]
+echo Ok | { sleep 0.1; read -t 0 reply; echo ">$reply<[$?]"; }
+
+# This would not be deterministic: returns 0 "data exists" if EOF is seen
+# (true terminated) - because EOF is considered to be data (read will not block),
+# else returns 1 "no data".
+## ><[????]
+#true | { read -t 0 reply; echo ">$reply<[$?]"; }
+
+# ><[0]
+true | { sleep 0.1; read -t 0 reply; echo ">$reply<[$?]"; }
+
+# ><[1]
+sleep 0.2 | { read -p IGNORED_PROMPT -t 0 reply; echo ">$reply<[$?]"; }
diff --git a/shell/ash_test/ash-vars/readonly0.right b/shell/ash_test/ash-vars/readonly0.right
new file mode 100644
index 000000000..f3a6bde9e
--- /dev/null
+++ b/shell/ash_test/ash-vars/readonly0.right
@@ -0,0 +1,13 @@
+readonly a='A'
+readonly b='B'
+Ok:0
+
+./readonly0.tests: line 19: a: is read only
+Fail:2
+./readonly0.tests: readonly: line 21: a: is read only
+Fail:2
+
+./readonly0.tests: export: line 27: a: is read only
+Fail:2
+
+Fail:1
diff --git a/shell/ash_test/ash-vars/readonly0.tests b/shell/ash_test/ash-vars/readonly0.tests
new file mode 100755
index 000000000..94af79060
--- /dev/null
+++ b/shell/ash_test/ash-vars/readonly0.tests
@@ -0,0 +1,45 @@
+unset a b
+#
+readonly a=A
+b=B
+readonly b
+# readonly on already readonly var is harmless:
+readonly b a
+readonly | grep '^readonly [ab]='
+# this should work:
+export a b
+export -n a b
+echo Ok:$?
+env | grep -e^a= -e^b=  # shows nothing
+
+echo
+# these should all fail (despite the same value being assigned)
+# bash does not abort even in non-interactive more (in script)
+# ash does, using subshell to continue
+true; (a=A)
+echo Fail:$?
+true; (readonly a=A)
+echo Fail:$?
+
+echo
+# in bash, assignment in export fails, but export succeeds! :)
+# we don't mimic that!
+true; (export a=Z)
+echo Fail:$?
+#env | grep '^a='
+#echo "^^^a is exported"
+export -n a  # undo that bashism, if it happens
+
+## ash: assignment errors in "a=Z CMD" lead to CMD not executed
+## echo
+## export b
+## # this fails to both set and export a:
+## a=Z env | echo grep '^[ab]='
+## echo "^^^a is not exported"
+## # but external command does get executed, and $? is not mangled (stays 42):
+## (exit 42); a=Z env echo Visible:$?
+
+echo
+# ash: this fails *silently*, bug? bash says "cannot unset: readonly variable"
+true; unset a
+echo Fail:$?
diff --git a/shell/ash_test/ash-vars/readonly1.right b/shell/ash_test/ash-vars/readonly1.right
index 2b363e325..1f5be64c7 100644
--- a/shell/ash_test/ash-vars/readonly1.right
+++ b/shell/ash_test/ash-vars/readonly1.right
@@ -1,2 +1,2 @@
-One:1
-One:1
+Fail:2
+Fail:2
diff --git a/shell/ash_test/ash-vars/readonly1.tests b/shell/ash_test/ash-vars/readonly1.tests
index 81b461f5f..f3cccd940 100755
--- a/shell/ash_test/ash-vars/readonly1.tests
+++ b/shell/ash_test/ash-vars/readonly1.tests
@@ -1,7 +1,7 @@
 readonly bla=123
 # Bare "eval bla=123" should abort ("eval" is a special builtin):
 (eval bla=123 2>/dev/null; echo BUG)
-echo One:$?
+echo Fail:$?
 # "command BLTIN" disables "special-ness", should not abort:
 command eval bla=123 2>/dev/null
-echo One:$?
+echo Fail:$?
diff --git a/shell/ash_test/run-all b/shell/ash_test/run-all
index 983e6d184..caf033577 100755
--- a/shell/ash_test/run-all
+++ b/shell/ash_test/run-all
@@ -2,10 +2,24 @@
 
 TOPDIR=`pwd`
 
-test -x ash || {
-    echo "No ./ash - creating a link to ../../busybox"
-    ln -s ../../busybox ash
-}
+if test ! -x ash; then
+        if test ! -x ../../busybox; then
+                echo "Can't run tests. Put ash binary into this directory (`pwd`)"
+                exit 1
+        fi
+        echo "No ./ash - creating a link to ../../busybox"
+        ln -s ../../busybox ash
+fi
+if test ! -f .config; then
+        if test ! -f ../../.config; then
+                echo "Missing .config file"
+                exit 1
+        fi
+        cp ../../.config . || exit 1
+fi
+
+eval $(sed -e '/^#/d' -e '/^$/d' -e 's:^:export :' .config)
+
 test -x printenv || gcc -O2 -o printenv printenv.c || exit $?
 test -x recho    || gcc -O2 -o recho    recho.c    || exit $?
 test -x zecho    || gcc -O2 -o zecho    zecho.c    || exit $?
diff --git a/shell/cttyhack.c b/shell/cttyhack.c
index f9b59c263..9004b4763 100644
--- a/shell/cttyhack.c
+++ b/shell/cttyhack.c
@@ -11,48 +11,48 @@
 //kbuild:lib-$(CONFIG_CTTYHACK) += cttyhack.o
 
 //config:config CTTYHACK
-//config:       bool "cttyhack"
+//config:       bool "cttyhack (2.5 kb)"
 //config:       default y
 //config:       help
-//config:         One common problem reported on the mailing list is the "can't
-//config:         access tty; job control turned off" error message, which typically
-//config:         appears when one tries to use a shell with stdin/stdout on
-//config:         /dev/console.
-//config:         This device is special - it cannot be a controlling tty.
+//config:       One common problem reported on the mailing list is the "can't
+//config:       access tty; job control turned off" error message, which typically
+//config:       appears when one tries to use a shell with stdin/stdout on
+//config:       /dev/console.
+//config:       This device is special - it cannot be a controlling tty.
 //config:
-//config:         The proper solution is to use the correct device instead of
-//config:         /dev/console.
+//config:       The proper solution is to use the correct device instead of
+//config:       /dev/console.
 //config:
-//config:         cttyhack provides a "quick and dirty" solution to this problem.
-//config:         It analyzes stdin with various ioctls, trying to determine whether
-//config:         it is a /dev/ttyN or /dev/ttySN (virtual terminal or serial line).
-//config:         On Linux it also checks sysfs for a pointer to the active console.
-//config:         If cttyhack is able to find the real console device, it closes
-//config:         stdin/out/err and reopens that device.
-//config:         Then it executes the given program. Opening the device will make
-//config:         that device a controlling tty. This may require cttyhack
-//config:         to be a session leader.
+//config:       cttyhack provides a "quick and dirty" solution to this problem.
+//config:       It analyzes stdin with various ioctls, trying to determine whether
+//config:       it is a /dev/ttyN or /dev/ttySN (virtual terminal or serial line).
+//config:       On Linux it also checks sysfs for a pointer to the active console.
+//config:       If cttyhack is able to find the real console device, it closes
+//config:       stdin/out/err and reopens that device.
+//config:       Then it executes the given program. Opening the device will make
+//config:       that device a controlling tty. This may require cttyhack
+//config:       to be a session leader.
 //config:
-//config:         Example for /etc/inittab (for busybox init):
+//config:       Example for /etc/inittab (for busybox init):
 //config:
-//config:         ::respawn:/bin/cttyhack /bin/sh
+//config:       ::respawn:/bin/cttyhack /bin/sh
 //config:
-//config:         Starting an interactive shell from boot shell script:
+//config:       Starting an interactive shell from boot shell script:
 //config:
-//config:         setsid cttyhack sh
+//config:       setsid cttyhack sh
 //config:
-//config:         Giving controlling tty to shell running with PID 1:
+//config:       Giving controlling tty to shell running with PID 1:
 //config:
-//config:         # exec cttyhack sh
+//config:       # exec cttyhack sh
 //config:
-//config:         Without cttyhack, you need to know exact tty name,
-//config:         and do something like this:
+//config:       Without cttyhack, you need to know exact tty name,
+//config:       and do something like this:
 //config:
-//config:         # exec setsid sh -c 'exec sh </dev/tty1 >/dev/tty1 2>&1'
+//config:       # exec setsid sh -c 'exec sh </dev/tty1 >/dev/tty1 2>&1'
 //config:
-//config:         Starting getty on a controlling tty from a shell script:
+//config:       Starting getty on a controlling tty from a shell script:
 //config:
-//config:         # getty 115200 $(cttyhack)
+//config:       # getty 115200 $(cttyhack)
 
 //usage:#define cttyhack_trivial_usage
 //usage:       "[PROG ARGS]"
diff --git a/shell/hush.c b/shell/hush.c
index f6da826d3..309ed2139 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -101,18 +101,18 @@
  *              aaa
  */
 //config:config HUSH
-//config:       bool "hush"
+//config:       bool "hush (64 kb)"
 //config:       default y
 //config:       help
-//config:         hush is a small shell (25k). It handles the normal flow control
-//config:         constructs such as if/then/elif/else/fi, for/in/do/done, while loops,
-//config:         case/esac. Redirections, here documents, $((arithmetic))
-//config:         and functions are supported.
+//config:       hush is a small shell. It handles the normal flow control
+//config:       constructs such as if/then/elif/else/fi, for/in/do/done, while loops,
+//config:       case/esac. Redirections, here documents, $((arithmetic))
+//config:       and functions are supported.
 //config:
-//config:         It will compile and work on no-mmu systems.
+//config:       It will compile and work on no-mmu systems.
 //config:
-//config:         It does not handle select, aliases, tilde expansion,
-//config:         &>file and >&file redirection of stdout+stderr.
+//config:       It does not handle select, aliases, tilde expansion,
+//config:       &>file and >&file redirection of stdout+stderr.
 //config:
 //config:config HUSH_BASH_COMPAT
 //config:       bool "bash-compatible extensions"
@@ -124,17 +124,17 @@
 //config:       default y
 //config:       depends on HUSH_BASH_COMPAT
 //config:       help
-//config:         Enable {abc,def} extension.
+//config:       Enable {abc,def} extension.
 //config:
 //config:config HUSH_INTERACTIVE
 //config:       bool "Interactive mode"
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         Enable interactive mode (prompt and command editing).
-//config:         Without this, hush simply reads and executes commands
-//config:         from stdin just like a shell script from a file.
-//config:         No prompt, no PS1/PS2 magic shell variables.
+//config:       Enable interactive mode (prompt and command editing).
+//config:       Without this, hush simply reads and executes commands
+//config:       from stdin just like a shell script from a file.
+//config:       No prompt, no PS1/PS2 magic shell variables.
 //config:
 //config:config HUSH_SAVEHISTORY
 //config:       bool "Save command history to .hush_history"
@@ -146,18 +146,18 @@
 //config:       default y
 //config:       depends on HUSH_INTERACTIVE
 //config:       help
-//config:         Enable job control: Ctrl-Z backgrounds, Ctrl-C interrupts current
-//config:         command (not entire shell), fg/bg builtins work. Without this option,
-//config:         "cmd &" still works by simply spawning a process and immediately
-//config:         prompting for next command (or executing next command in a script),
-//config:         but no separate process group is formed.
+//config:       Enable job control: Ctrl-Z backgrounds, Ctrl-C interrupts current
+//config:       command (not entire shell), fg/bg builtins work. Without this option,
+//config:       "cmd &" still works by simply spawning a process and immediately
+//config:       prompting for next command (or executing next command in a script),
+//config:       but no separate process group is formed.
 //config:
 //config:config HUSH_TICK
 //config:       bool "Support process substitution"
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         Enable `command` and $(command).
+//config:       Enable `command` and $(command).
 //config:
 //config:config HUSH_IF
 //config:       bool "Support if/then/elif/else/fi"
@@ -174,37 +174,37 @@
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         Enable case ... esac statement. +400 bytes.
+//config:       Enable case ... esac statement. +400 bytes.
 //config:
 //config:config HUSH_FUNCTIONS
 //config:       bool "Support funcname() { commands; } syntax"
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         Enable support for shell functions. +800 bytes.
+//config:       Enable support for shell functions. +800 bytes.
 //config:
 //config:config HUSH_LOCAL
 //config:       bool "local builtin"
 //config:       default y
 //config:       depends on HUSH_FUNCTIONS
 //config:       help
-//config:         Enable support for local variables in functions.
+//config:       Enable support for local variables in functions.
 //config:
 //config:config HUSH_RANDOM_SUPPORT
 //config:       bool "Pseudorandom generator and $RANDOM variable"
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         Enable pseudorandom generator and dynamic variable "$RANDOM".
-//config:         Each read of "$RANDOM" will generate a new pseudorandom value.
+//config:       Enable pseudorandom generator and dynamic variable "$RANDOM".
+//config:       Each read of "$RANDOM" will generate a new pseudorandom value.
 //config:
 //config:config HUSH_MODE_X
 //config:       bool "Support 'hush -x' option and 'set -x' command"
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         This instructs hush to print commands before execution.
-//config:         Adds ~300 bytes.
+//config:       This instructs hush to print commands before execution.
+//config:       Adds ~300 bytes.
 //config:
 //config:config HUSH_ECHO
 //config:       bool "echo builtin"
@@ -236,14 +236,14 @@
 //config:       default y
 //config:       depends on HUSH_EXPORT
 //config:       help
-//config:         export -n unexports variables. It is a bash extension.
+//config:       export -n unexports variables. It is a bash extension.
 //config:
 //config:config HUSH_READONLY
 //config:       bool "readonly builtin"
 //config:       default y
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:       help
-//config:         Enable support for read-only variables.
+//config:       Enable support for read-only variables.
 //config:
 //config:config HUSH_KILL
 //config:       bool "kill builtin (supports kill %jobspec)"
@@ -1068,7 +1068,7 @@ static const struct built_in_command bltins1[] = {
         BLTIN("export"   , builtin_export  , "Set environment variables"),
 #endif
 #if ENABLE_HUSH_JOB
-        BLTIN("fg"       , builtin_fg_bg   , "Bring job into foreground"),
+        BLTIN("fg"       , builtin_fg_bg   , "Bring job to foreground"),
 #endif
 #if ENABLE_HUSH_HELP
         BLTIN("help"     , builtin_help    , NULL),
@@ -1121,7 +1121,7 @@ static const struct built_in_command bltins1[] = {
         BLTIN("unset"    , builtin_unset   , "Unset variables"),
 #endif
 #if ENABLE_HUSH_WAIT
-        BLTIN("wait"     , builtin_wait    , "Wait for process"),
+        BLTIN("wait"     , builtin_wait    , "Wait for process to finish"),
 #endif
 };
 /* These builtins won't be used if we are on NOMMU and need to re-exec
@@ -2662,9 +2662,8 @@ static void o_delchr(o_string *o)
 static void o_addblock(o_string *o, const char *str, int len)
 {
         o_grow_by(o, len);
-        memcpy(&o->data[o->length], str, len);
+        ((char*)mempcpy(&o->data[o->length], str, len))[0] = '\0';
         o->length += len;
-        o->data[o->length] = '\0';
 }
 
 static void o_addstr(o_string *o, const char *str)
@@ -5519,17 +5518,15 @@ static char *replace_pattern(char *val, const char *pattern, const char *repl, c
                         break;
 
                 result = xrealloc(result, res_len + (s - val) + repl_len + 1);
-                memcpy(result + res_len, val, s - val);
-                res_len += s - val;
-                strcpy(result + res_len, repl);
-                res_len += repl_len;
+                strcpy(mempcpy(result + res_len, val, s - val), repl);
+                res_len += (s - val) + repl_len;
                 debug_printf_varexp("val:'%s' s:'%s' result:'%s'\n", val, s, result);
 
                 val = s + size;
                 if (exp_op == '/')
                         break;
         }
-        if (val[0] && result) {
+        if (*val && result) {
                 result = xrealloc(result, res_len + strlen(val) + 1);
                 strcpy(result + res_len, val);
                 debug_printf_varexp("val:'%s' result:'%s'\n", val, result);
diff --git a/shell/hush_test/hush-read/read_t0.right b/shell/hush_test/hush-read/read_t0.right
new file mode 100644
index 000000000..f02105961
--- /dev/null
+++ b/shell/hush_test/hush-read/read_t0.right
@@ -0,0 +1,3 @@
+><[0]
+><[0]
+><[1]
diff --git a/shell/hush_test/hush-read/read_t0.tests b/shell/hush_test/hush-read/read_t0.tests
new file mode 100755
index 000000000..6b7bc217b
--- /dev/null
+++ b/shell/hush_test/hush-read/read_t0.tests
@@ -0,0 +1,14 @@
+# ><[0]
+echo Ok | { sleep 0.1; read -t 0 reply; echo ">$reply<[$?]"; }
+
+# This would not be deterministic: returns 0 "data exists" if EOF is seen
+# (true terminated) - because EOF is considered to be data (read will not block),
+# else returns 1 "no data".
+## ><[????]
+#true | { read -t 0 reply; echo ">$reply<[$?]"; }
+
+# ><[0]
+true | { sleep 0.1; read -t 0 reply; echo ">$reply<[$?]"; }
+
+# ><[1]
+sleep 0.2 | { read -p IGNORED_PROMPT -t 0 reply; echo ">$reply<[$?]"; }
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 154b860f8..750adc5d8 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -61,9 +61,10 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
         const char *opt_u
 )
 {
+        struct pollfd pfd[1];
+#define fd (pfd[0].fd) /* -u FD */
         unsigned err;
         unsigned end_ms; /* -t TIMEOUT */
-        int fd; /* -u FD */
         int nchars; /* -n NUM */
         char **pp;
         char *buffer;
@@ -92,38 +93,43 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                         return "invalid count";
                 /* note: "-n 0": off (bash 3.2 does this too) */
         }
+
         end_ms = 0;
-        if (opt_t) {
+        if (opt_t && !ENABLE_FEATURE_SH_READ_FRAC) {
                 end_ms = bb_strtou(opt_t, NULL, 10);
-                if (errno || end_ms > UINT_MAX / 2048)
+                if (errno)
                         return "invalid timeout";
+                if (end_ms > UINT_MAX / 2048) /* be safely away from overflow */
+                        end_ms = UINT_MAX / 2048;
                 end_ms *= 1000;
-#if 0 /* even bash has no -t N.NNN support */
-                ts.tv_sec = bb_strtou(opt_t, &p, 10);
-                ts.tv_usec = 0;
-                /* EINVAL means number is ok, but not terminated by NUL */
-                if (*p == '.' && errno == EINVAL) {
-                        char *p2;
-                        if (*++p) {
-                                int scale;
-                                ts.tv_usec = bb_strtou(p, &p2, 10);
-                                if (errno)
-                                        return "invalid timeout";
-                                scale = p2 - p;
-                                /* normalize to usec */
-                                if (scale > 6)
+        }
+        if (opt_t && ENABLE_FEATURE_SH_READ_FRAC) {
+                /* bash 4.3 (maybe earlier) supports -t N.NNNNNN */
+                char *p;
+                /* Eat up to three fractional digits */
+                int frac_digits = 3 + 1;
+
+                end_ms = bb_strtou(opt_t, &p, 10);
+                if (end_ms > UINT_MAX / 2048) /* be safely away from overflow */
+                        end_ms = UINT_MAX / 2048;
+
+                if (errno) {
+                        /* EINVAL = number is ok, but not NUL terminated */
+                        if (errno != EINVAL || *p != '.')
+                                return "invalid timeout";
+                        /* Do not check the rest: bash allows "0.123456xyz" */
+                        while (*++p && --frac_digits) {
+                                end_ms *= 10;
+                                end_ms += (*p - '0');
+                                if ((unsigned char)(*p - '0') > 9)
                                         return "invalid timeout";
-                                while (scale++ < 6)
-                                        ts.tv_usec *= 10;
                         }
-                } else if (ts.tv_sec < 0 || errno) {
-                        return "invalid timeout";
                 }
-                if (!(ts.tv_sec | ts.tv_usec)) { /* both are 0? */
-                        return "invalid timeout";
+                while (--frac_digits > 0) {
+                        end_ms *= 10;
                 }
-#endif /* if 0 */
         }
+
         fd = STDIN_FILENO;
         if (opt_u) {
                 fd = bb_strtou(opt_u, NULL, 10);
@@ -131,6 +137,19 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                         return "invalid file descriptor";
         }
 
+        if (opt_t && end_ms == 0) {
+                /* "If timeout is 0, read returns immediately, without trying
+                 * to read any data. The exit status is 0 if input is available
+                 * on the specified file descriptor, non-zero otherwise."
+                 * bash seems to ignore -p PROMPT for this use case.
+                 */
+                int r;
+                pfd[0].events = POLLIN;
+                r = poll(pfd, 1, /*timeout:*/ 0);
+                /* Return 0 only if poll returns 1 ("one fd ready"), else return 1: */
+                return (const char *)(uintptr_t)(r <= 0);
+        }
+
         if (opt_p && isatty(fd)) {
                 fputs(opt_p, stderr);
                 fflush_all();
@@ -165,21 +184,24 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
         retval = (const char *)(uintptr_t)0;
         startword = 1;
         backslash = 0;
-        if (end_ms) /* NB: end_ms stays nonzero: */
-                end_ms = ((unsigned)monotonic_ms() + end_ms) | 1;
+        if (opt_t)
+                end_ms += (unsigned)monotonic_ms();
         buffer = NULL;
         bufpos = 0;
         do {
                 char c;
-                struct pollfd pfd[1];
                 int timeout;
 
                 if ((bufpos & 0xff) == 0)
                         buffer = xrealloc(buffer, bufpos + 0x101);
 
                 timeout = -1;
-                if (end_ms) {
+                if (opt_t) {
                         timeout = end_ms - (unsigned)monotonic_ms();
+                        /* ^^^^^^^^^^^^^ all values are unsigned,
+                         * wrapping math is used here, good even if
+                         * 32-bit unix time wrapped (year 2038+).
+                         */
                         if (timeout <= 0) { /* already late? */
                                 retval = (const char *)(uintptr_t)1;
                                 goto ret;
@@ -192,9 +214,8 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
                  */
                 errno = 0;
 #if !ENABLE_PLATFORM_MINGW32
-                pfd[0].fd = fd;
                 pfd[0].events = POLLIN;
-                if (poll(pfd, 1, timeout) != 1) {
+                if (poll(pfd, 1, timeout) <= 0) {
                         /* timed out, or EINTR */
                         err = errno;
                         retval = (const char *)(uintptr_t)1;
@@ -278,6 +299,7 @@ shell_builtin_read(void FAST_FUNC (*setvar)(const char *name, const char *val),
 
         errno = err;
         return retval;
+#undef fd
 }
 
 /* ulimit builtin */