78 files changed, 874 insertions, 387 deletions
diff --git a/shell/ash.c b/shell/ash.c
index f3eb98d85..4d4137800 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -35,7 +35,7 @@
 //config:       depends on !NOMMU
 //config:
 //config:config ASH
-//config:       bool "ash (78 kb)"
+//config:       bool "ash (80 kb)"
 //config:       default y
 //config:       depends on !NOMMU
 //config:       select SHELL_ASH
@@ -149,11 +149,23 @@
 //config:       default y
 //config:       depends on SHELL_ASH
 //config:
-//config:config ASH_SLEEP
+//
-//config:       bool "sleep builtin"
+////config:config ASH_SLEEP
-//config:       default y
+////config:     bool "sleep builtin"
-//config:       depends on SHELL_ASH
+////config:     default y
-//config:
+////config:     depends on SHELL_ASH
+////config:
+//^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+//Disabled for now. Has a few annoying problems:
+// * sleepcmd() -> sleep_main(), the parsing of bad arguments exits the shell.
+// * sleep_for_duration() in sleep_main() has to be interruptible for
+//   ^C traps to work, which may be a problem for other users
+//   of sleep_for_duration().
+// * BUT, if sleep_for_duration() is interruptible, then SIGCHLD interrupts it
+//   as well (try "/bin/sleep 1 & sleep 10").
+// * sleep_main() must not allocate anything as ^C in ash longjmp's.
+//   (currently, allocations are only on error paths, in message printing).
+//
 //config:config ASH_HELP
 //config:       bool "help builtin"
 //config:       default y
@@ -599,7 +611,12 @@ struct globals_misc {
        struct jmploc *exception_handler;
-        volatile int suppress_int; /* counter */
+        /*volatile*/ int suppress_int; /* counter */
+        /* ^^^^^^^ removed "volatile" since on x86, gcc turns suppress_int++
+         * into ridiculous 3-insn sequence otherwise.
+         * We don't change suppress_int asyncronously (in a signal handler),
+         * but we do read it async.
+         */
        volatile /*sig_atomic_t*/ smallint pending_int; /* 1 = got SIGINT */
 #if !ENABLE_PLATFORM_MINGW32
        volatile /*sig_atomic_t*/ smallint got_sigchld; /* 1 = got SIGCHLD */
@@ -954,7 +971,8 @@ int_on(void)
 {
        barrier();
        if (--suppress_int == 0 && pending_int)
-                raise_interrupt();
+                raise_interrupt(); /* does not return */
+        barrier();
 }
 #if DEBUG_INTONOFF
 # define INT_ON do { \
@@ -970,7 +988,8 @@ force_int_on(void)
        barrier();
        suppress_int = 0;
        if (pending_int)
-                raise_interrupt();
+                raise_interrupt(); /* does not return */
+        barrier();
 }
 #define FORCE_INT_ON force_int_on()
@@ -980,7 +999,8 @@ force_int_on(void)
        barrier(); \
        suppress_int = (v); \
        if (suppress_int == 0 && pending_int) \
-                raise_interrupt(); \
+                raise_interrupt(); /* does not return */ \
+        barrier(); \
 } while (0)
@@ -2547,30 +2567,6 @@ getoptsreset(const char *value)
 #endif
 /*
- * Compares two strings up to the first = or '\0'.  The first
- * string must be terminated by '='; the second may be terminated by
- * either '=' or '\0'.
- */
-static int
-varcmp(const char *p, const char *q)
-{
-        int c, d;
-        while ((c = *p) == (d = *q)) {
-                if (c == '\0' || c == '=')
-                        goto out;
-                p++;
-                q++;
-        }
-        if (c == '=')
-                c = '\0';
-        if (d == '=')
-                d = '\0';
- out:
-        return c - d;
-}
-/*
 * Find the appropriate entry in the hash table from the name.
 */
 static struct var **
@@ -2881,7 +2877,7 @@ setvar(const char *name, const char *val, int flags)
        p = mempcpy(nameeq, name, namelen);
        if (val) {
                *p++ = '=';
-                memcpy(p, val, vallen);
+                strcpy(p, val);
        }
        vp = setvareq(nameeq, flags | VNOSAVE);
        INT_ON;
@@ -10485,7 +10481,7 @@ evaltree(union node *n, int flags)
        }
        if (flags & EV_EXIT) {
 exexit:
-                raise_exception(EXEND);
+                raise_exception(EXEND); /* does not return */
        }
        popstackmark(&smark);
@@ -11554,7 +11550,7 @@ evalcommand(union node *cmd, int flags)
                /* We have a redirection error. */
                if (spclbltin > 0)
-                        raise_exception(EXERROR);
+                        raise_exception(EXERROR); /* does not return */
                goto out;
        }
@@ -13347,18 +13343,19 @@ simplecmd(void)
                        if (args && app == &args->narg.next
                         && !vars && !redir
                        ) {
-                                struct builtincmd *bcmd;
+//                              struct builtincmd *bcmd;
-                                const char *name;
+//                              const char *name;
                                /* We have a function */
                                if (IF_BASH_FUNCTION(!function_flag &&) readtoken() != TRP)
                                        raise_error_unexpected_syntax(TRP);
-                                name = n->narg.text;
+//bash allows functions named "123", "..", "return"!
-                                if (!goodname(name)
+//                              name = n->narg.text;
-                                 || ((bcmd = find_builtin(name)) && IS_BUILTIN_SPECIAL(bcmd))
+//                              if (!goodname(name)
-                                ) {
+//                               || ((bcmd = find_builtin(name)) && IS_BUILTIN_SPECIAL(bcmd))
-                                        raise_error_syntax("bad function name");
+//                              ) {
-                                }
+//                                      raise_error_syntax("bad function name");
+//                              }
                                n->type = NDEFUN;
                                checkkwd = CHKNL | CHKKWD | CHKALIAS;
                                n->ndefun.text = n->narg.text;
@@ -15964,7 +15961,7 @@ procargs(char **argv)
                optlist[i] = 2;
        if (options(&login_sh)) {
                /* it already printed err message */
-                raise_exception(EXERROR);
+                raise_exception(EXERROR); /* does not return */
        }
        xargv = argptr;
        xminusc = minusc;
diff --git a/shell/ash_test/ash-arith/arith-assign-in-varexp.right b/shell/ash_test/ash-arith/arith-assign-in-varexp.right
new file mode 100644
index 000000000..06ac80a64
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-assign-in-varexp.right
@@ -0,0 +1,3 @@
+20:20
+a=b=10
+b=10
diff --git a/shell/ash_test/ash-arith/arith-assign-in-varexp.tests b/shell/ash_test/ash-arith/arith-assign-in-varexp.tests
new file mode 100755
index 000000000..920aaa779
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-assign-in-varexp.tests
@@ -0,0 +1,8 @@
+exec 2>&1
+a='b=10'
+b=3
+# The variables should evaluate left-to-right,
+# thus b is set to 10 _before_ addition
+echo 20:$((a + b))
+echo "a=$a"
+echo "b=$b"
diff --git a/shell/ash_test/ash-arith/arith-assign-in-varexp1.right b/shell/ash_test/ash-arith/arith-assign-in-varexp1.right
new file mode 100644
index 000000000..1feb307d2
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-assign-in-varexp1.right
@@ -0,0 +1,2 @@
+7:7
+x=3
diff --git a/shell/ash_test/ash-arith/arith-assign-in-varexp1.tests b/shell/ash_test/ash-arith/arith-assign-in-varexp1.tests
new file mode 100755
index 000000000..fc8ac9d97
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-assign-in-varexp1.tests
@@ -0,0 +1,9 @@
+exec 2>&1
+a='x=1'
+b='x=2'
+c='x=3'
+# The variables should evaluate immediately when they encountered,
+# not when they go into an operation. Here, order of evaluation
+# of names to numbers should be a,b,c - not b,c,a:
+echo 7:$((a+b*c))
+echo "x=$x"
diff --git a/shell/ash_test/ash-arith/arith-bignum1.right b/shell/ash_test/ash-arith/arith-bignum1.right
new file mode 100644
index 000000000..42a8016ec
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-bignum1.right
@@ -0,0 +1,13 @@
+18 digits: 999999999999999999
+19 digits: -8446744073709551617
+20 digits: 7766279631452241919
+18 digits- -999999999999999999
+19 digits- 8446744073709551617
+20 digits- -7766279631452241919
+Hex base#:
+16 digits: 9876543210abcedf
+17 digits: 876543210abcedfc
+18 digits: 76543210abcedfcc
+16 digits: 6789abcdef543121
+17 digits: 789abcdef5431204
+18 digits: 89abcdef54312034
diff --git a/shell/ash_test/ash-arith/arith-bignum1.tests b/shell/ash_test/ash-arith/arith-bignum1.tests
new file mode 100755
index 000000000..ef8f928bc
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-bignum1.tests
@@ -0,0 +1,17 @@
+exec 2>&1
+# If the number does not fit in 64 bits, bash uses truncated 64-bit value
+# (essentially, it does not check for overflow in "n = n * base + digit"
+# calculation).
+echo 18 digits: $((999999999999999999))
+echo 19 digits: $((9999999999999999999))
+echo 20 digits: $((99999999999999999999))
+echo 18 digits- $((-999999999999999999))
+echo 19 digits- $((-9999999999999999999))
+echo 20 digits- $((-99999999999999999999))
+echo "Hex base#:"
+printf '16 digits: %016x\n' $((16#9876543210abcedf))
+printf '17 digits: %016x\n' $((16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((16#9876543210abcedfcc))
+printf '16 digits: %016x\n' $((-16#9876543210abcedf))
+printf '17 digits: %016x\n' $((-16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((-16#9876543210abcedfcc))
diff --git a/shell/ash_test/ash-arith/arith-comma1.right b/shell/ash_test/ash-arith/arith-comma1.right
new file mode 100644
index 000000000..be1264cc0
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-comma1.right
@@ -0,0 +1,3 @@
+10:10
+a=b=10
+b=10
diff --git a/shell/ash_test/ash-arith/arith-comma1.tests b/shell/ash_test/ash-arith/arith-comma1.tests
new file mode 100755
index 000000000..f86304303
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-comma1.tests
@@ -0,0 +1,6 @@
+exec 2>&1
+a='b=10'
+b=3
+echo 10:$((a,b))
+echo "a=$a"
+echo "b=$b"
diff --git a/shell/ash_test/ash-arith/arith-precedence1.right b/shell/ash_test/ash-arith/arith-precedence1.right
new file mode 100644
index 000000000..3f9320a13
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-precedence1.right
@@ -0,0 +1,4 @@
+4:4
+4:4
+4:4
+4:4
diff --git a/shell/ash_test/ash-arith/arith-precedence1.tests b/shell/ash_test/ash-arith/arith-precedence1.tests
new file mode 100755
index 000000000..bfef05292
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-precedence1.tests
@@ -0,0 +1,15 @@
+exec 2>&1
+# bash documentation says that precedence order is:
+#  ...
+#  expr ? expr1 : expr2
+#  = *= /= %= += -= <<= >>= &= ^= |=
+#  exprA , exprB
+# but in practice, the rules for expr1 and expr2 are different:
+# assignments and commas in expr1 have higher precedence than :?,
+# but in expr2 they haven't:
+# "v ? 1,2 : 3,4" is parsed as "(v ? (1,2) : 3),4"
+# "v ? a=2 : b=4" is parsed as "(v ? (a=1) : b)=4" (thus, this is a syntax error)
+echo 4:$((0 ? 1,2 : 3,4))
+echo 4:$((1 ? 1,2 : 3,4))
+echo 4:"$((0 ? 1,2 : 3,4))"
+echo 4:"$((1 ? 1,2 : 3,4))"
diff --git a/shell/ash_test/ash-arith/arith-ternary-assign.right b/shell/ash_test/ash-arith/arith-ternary-assign.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary-assign.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/ash_test/ash-arith/arith-ternary-assign.tests b/shell/ash_test/ash-arith/arith-ternary-assign.tests
new file mode 100755
index 000000000..fa18fe7b9
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary-assign.tests
@@ -0,0 +1,3 @@
+exec 2>&1
+a='@'
+echo 42:$((a=1?42:3,a))
diff --git a/shell/ash_test/ash-arith/arith-ternary-comma.right b/shell/ash_test/ash-arith/arith-ternary-comma.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary-comma.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/ash_test/ash-arith/arith-ternary-comma.tests b/shell/ash_test/ash-arith/arith-ternary-comma.tests
new file mode 100755
index 000000000..5e05b58c4
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary-comma.tests
@@ -0,0 +1,3 @@
+exec 2>&1
+x='@'
+echo 42:$((1?4:x,20*2+2))
diff --git a/shell/ash_test/ash-arith/arith-ternary-preincr.right b/shell/ash_test/ash-arith/arith-ternary-preincr.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary-preincr.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/ash_test/ash-arith/arith-ternary-preincr.tests b/shell/ash_test/ash-arith/arith-ternary-preincr.tests
new file mode 100755
index 000000000..3985c7079
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary-preincr.tests
@@ -0,0 +1,3 @@
+exec 2>&1
+x='@'
+echo 42:$((1?42:++x))
diff --git a/shell/ash_test/ash-arith/arith-ternary1.right b/shell/ash_test/ash-arith/arith-ternary1.right
new file mode 100644
index 000000000..6b751d7b8
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary1.right
@@ -0,0 +1,2 @@
+42:42
+a=0
diff --git a/shell/ash_test/ash-arith/arith-ternary1.tests b/shell/ash_test/ash-arith/arith-ternary1.tests
new file mode 100755
index 000000000..3532ce54d
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary1.tests
@@ -0,0 +1,5 @@
+exec 2>&1
+a=0
+# The not-taken branch should not evaluate
+echo 42:$((1 ? 42 : (a+=2)))
+echo "a=$a"
diff --git a/shell/ash_test/ash-arith/arith-ternary2.right b/shell/ash_test/ash-arith/arith-ternary2.right
new file mode 100644
index 000000000..a549b1b5c
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary2.right
@@ -0,0 +1,3 @@
+6:6
+a=b=+err+
+b=6
diff --git a/shell/ash_test/ash-arith/arith-ternary2.tests b/shell/ash_test/ash-arith/arith-ternary2.tests
new file mode 100755
index 000000000..cb3163932
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary2.tests
@@ -0,0 +1,7 @@
+exec 2>&1
+a='b=+err+'
+b=5
+# The not-taken branch should not parse variables
+echo 6:$((0 ? a : ++b))
+echo "a=$a"
+echo "b=$b"
diff --git a/shell/ash_test/ash-arith/arith-ternary3.right b/shell/ash_test/ash-arith/arith-ternary3.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary3.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/ash_test/ash-arith/arith-ternary3.tests b/shell/ash_test/ash-arith/arith-ternary3.tests
new file mode 100755
index 000000000..0bf9f3002
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary3.tests
@@ -0,0 +1,4 @@
+exec 2>&1
+# "EXPR ?..." should check _evaluated_ EXPR,
+# not its last value
+echo 42:$((1 < 1 ? -1 : 1 > 1 ? 1 : 42))
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested.right b/shell/ash_test/ash-arith/arith-ternary_nested.right
new file mode 100644
index 000000000..aa54bd925
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested.right
@@ -0,0 +1 @@
+5:5
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested.tests b/shell/ash_test/ash-arith/arith-ternary_nested.tests
new file mode 100755
index 000000000..eefc8e7ce
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested.tests
@@ -0,0 +1,2 @@
+exec 2>&1
+echo 5:$((1?2?3?4?5:6:7:8:9))
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested1.right b/shell/ash_test/ash-arith/arith-ternary_nested1.right
new file mode 100644
index 000000000..d80319695
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested1.right
@@ -0,0 +1 @@
+3:3
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested1.tests b/shell/ash_test/ash-arith/arith-ternary_nested1.tests
new file mode 100755
index 000000000..469584bea
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested1.tests
@@ -0,0 +1,2 @@
+exec 2>&1
+echo 3:$((1?(2?(3):4):5))
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested2.right b/shell/ash_test/ash-arith/arith-ternary_nested2.right
new file mode 100644
index 000000000..d80319695
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested2.right
@@ -0,0 +1 @@
+3:3
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested2.tests b/shell/ash_test/ash-arith/arith-ternary_nested2.tests
new file mode 100755
index 000000000..e8b8a9e1a
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested2.tests
@@ -0,0 +1,2 @@
+exec 2>&1
+echo 3:$((0?1:2?3:4?5:6?7:8))
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested3.right b/shell/ash_test/ash-arith/arith-ternary_nested3.right
new file mode 100644
index 000000000..1a34fde65
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested3.right
@@ -0,0 +1,2 @@
+42:42
+a=2:2
diff --git a/shell/ash_test/ash-arith/arith-ternary_nested3.tests b/shell/ash_test/ash-arith/arith-ternary_nested3.tests
new file mode 100755
index 000000000..6f753867e
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith-ternary_nested3.tests
@@ -0,0 +1,6 @@
+exec 2>&1
+x='@'
+a=2
+# After processing nested ?:, outermost ?: should still remember to NOT evaluate a*=2
+echo 42:$((1?0?41:42:(a*=2)))
+echo "a=2:$a"
diff --git a/shell/ash_test/ash-arith/arith.right b/shell/ash_test/ash-arith/arith.right
index 61fcab55e..b2c3f56d8 100644
--- a/shell/ash_test/ash-arith/arith.right
+++ b/shell/ash_test/ash-arith/arith.right
@@ -80,8 +80,9 @@ other bases
 62 62
 63 63
 missing number after base
-0 0
+./arith.tests: line 161: arithmetic syntax error
 ./arith.tests: line 162: arithmetic syntax error
+./arith.tests: line 163: arithmetic syntax error
 ./arith.tests: line 164: divide by zero
 ./arith.tests: let: line 165: arithmetic syntax error
 ./arith.tests: line 166: arithmetic syntax error
@@ -92,7 +93,7 @@ ghi
 ./arith.tests: line 190: arithmetic syntax error
 16 16
 ./arith.tests: line 195: arithmetic syntax error
-./arith.tests: line 196: malformed ?: operator
+./arith.tests: line 196: arithmetic syntax error
 ./arith.tests: line 197: arithmetic syntax error
 9 9
 ./arith.tests: line 204: arithmetic syntax error
diff --git a/shell/ash_test/ash-arith/arith.tests b/shell/ash_test/ash-arith/arith.tests
index b9cb8ba4c..42cd7fdbf 100755
--- a/shell/ash_test/ash-arith/arith.tests
+++ b/shell/ash_test/ash-arith/arith.tests
@@ -155,12 +155,12 @@ echo 63 $(( 64#_ ))
 #ash# # weird bases (error)
 #ash# echo $(( 3425#56 ))
-echo missing number after base
-echo 0 $(( 2# ))
 # these should generate errors
+echo missing number after base
+(  echo $(( 2# ))          )
 (  echo $(( 7 = 43 ))      )
-#ash# echo $(( 2#44 ))
+(  echo $(( 2#44 ))        )
 (  echo $(( 44 / 0 ))      )
 (  let 'jv += $iv'         )
 (  echo $(( jv += \$iv ))  )
diff --git a/shell/ash_test/ash-quoting/space_in_varexp1.right b/shell/ash_test/ash-quoting/space_in_varexp1.right
new file mode 100644
index 000000000..a617a91c3
--- /dev/null
+++ b/shell/ash_test/ash-quoting/space_in_varexp1.right
@@ -0,0 +1,2 @@
+1:'b c'
+2:'b c'
diff --git a/shell/ash_test/ash-quoting/space_in_varexp1.tests b/shell/ash_test/ash-quoting/space_in_varexp1.tests
new file mode 100755
index 000000000..1589587d1
--- /dev/null
+++ b/shell/ash_test/ash-quoting/space_in_varexp1.tests
@@ -0,0 +1,6 @@
+a=b
+a=${a:+$a }c
+echo "1:'$a'"
+a=b
+a="${a:+$a }c"
+echo "2:'$a'"
diff --git a/shell/ash_test/run-all b/shell/ash_test/run-all
index 96703ef12..066327dc0 100755
--- a/shell/ash_test/run-all
+++ b/shell/ash_test/run-all
@@ -47,6 +47,7 @@ do_test()
        # $1 but with / replaced by # so that it can be used as filename part
        noslash=`echo "$1" | sed 's:/:#:g'`
        (
+        tret=0
        cd "$1" || { echo "cannot cd $1!"; exit 1; }
        for x in run-*; do
                test -f "$x" || continue
@@ -69,13 +70,25 @@ do_test()
                test -f "$name.right" || continue
 #               echo Running test: "$x"
                echo -n "$1/$x:"
-                {
+                (
                        "$THIS_SH" "./$x" 2>&1 | \
-                                grep -va "^ash: using fallback suid method$" >"$name.xx" 
+                                grep -va "^ash: using fallback suid method$" >"$name.xx"
+                        r=$?
+                        # filter C library differences
+                        sed -i \
+                                -e "/: invalid option /s:'::g" \
+                                "$name.xx"
+                        test $r -eq 77 && rm -f "$TOPDIR/$noslash-$x.fail" && exit 77
                        diff -u "$name.xx" "$name.right" >"$TOPDIR/$noslash-$x.fail" \
                        && rm -f "$name.xx" "$TOPDIR/$noslash-$x.fail"
-                } && echo " ok" || echo " fail"
+                )
+                case $? in
+                        0)  echo " ok";;
+                        77) echo " skip (feature disabled)";;
+                        *)  echo " fail ($?)"; tret=1;;
+                esac
        done
+        exit $tret
        )
 }
@@ -103,4 +116,4 @@ else
        done
 fi
-exit ${ret}
+exit $ret
diff --git a/shell/cttyhack.c b/shell/cttyhack.c
index b9ee59bd0..62dfb2bc2 100644
--- a/shell/cttyhack.c
+++ b/shell/cttyhack.c
@@ -5,7 +5,7 @@
 * Licensed under GPLv2, see file LICENSE in this source tree.
 */
 //config:config CTTYHACK
-//config:       bool "cttyhack (2.4 kb)"
+//config:       bool "cttyhack (2.7 kb)"
 //config:       default y
 //config:       help
 //config:       One common problem reported on the mailing list is the "can't
diff --git a/shell/hush.c b/shell/hush.c
index cdaa67a3b..8e632e0af 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -91,7 +91,7 @@
 * in word = GLOB, quoting should be significant on char-by-char basis: a*cd"*"
 */
 //config:config HUSH
-//config:       bool "hush (68 kb)"
+//config:       bool "hush (70 kb)"
 //config:       default y
 //config:       select SHELL_HUSH
 //config:       help
@@ -2255,14 +2255,14 @@ static const char *get_cwd(int force)
 /*
 * Shell and environment variable support
 */
-static struct variable **get_ptr_to_local_var(const char *name, unsigned len)
+static struct variable **get_ptr_to_local_var(const char *name)
 {
        struct variable **pp;
        struct variable *cur;
        pp = &G.top_var;
        while ((cur = *pp) != NULL) {
-                if (strncmp(cur->varstr, name, len) == 0 && cur->varstr[len] == '=')
+                if (varcmp(cur->varstr, name) == 0)
                        return pp;
                pp = &cur->next;
        }
@@ -2272,21 +2272,20 @@ static struct variable **get_ptr_to_local_var(const char *name, unsigned len)
 static const char* FAST_FUNC get_local_var_value(const char *name)
 {
        struct variable **vpp;
-        unsigned len = strlen(name);
        if (G.expanded_assignments) {
                char **cpp = G.expanded_assignments;
                while (*cpp) {
                        char *cp = *cpp;
-                        if (strncmp(cp, name, len) == 0 && cp[len] == '=')
+                        if (varcmp(cp, name) == 0)
-                                return cp + len + 1;
+                                return strchr(cp, '=') + 1;
                        cpp++;
                }
        }
-        vpp = get_ptr_to_local_var(name, len);
+        vpp = get_ptr_to_local_var(name);
        if (vpp)
-                return (*vpp)->varstr + len + 1;
+                return strchr((*vpp)->varstr, '=') + 1;
        if (strcmp(name, "PPID") == 0)
                return utoa(G.root_ppid);
@@ -2319,13 +2318,11 @@ static const char* FAST_FUNC get_local_var_value(const char *name)
 }
 #if ENABLE_HUSH_GETOPTS
-static void handle_changed_special_names(const char *name, unsigned name_len)
+static void handle_changed_special_names(const char *name)
 {
-        if (name_len == 6) {
+        if (varcmp(name, "OPTIND") == 0) {
-                if (strncmp(name, "OPTIND", 6) == 0) {
+                G.getopt_count = 0;
-                        G.getopt_count = 0;
+                return;
-                        return;
-                }
        }
 }
 #else
@@ -2476,7 +2473,7 @@ static int set_local_var(char *str, unsigned flags)
        }
        free(free_me);
-        handle_changed_special_names(cur->varstr, name_len - 1);
+        handle_changed_special_names(cur->varstr);
        return retval;
 }
@@ -2499,16 +2496,14 @@ static void set_pwd_var(unsigned flag)
 }
 #if ENABLE_HUSH_UNSET || ENABLE_HUSH_GETOPTS
-static int unset_local_var_len(const char *name, int name_len)
+static int unset_local_var(const char *name)
 {
        struct variable *cur;
        struct variable **cur_pp;
        cur_pp = &G.top_var;
        while ((cur = *cur_pp) != NULL) {
-                if (strncmp(cur->varstr, name, name_len) == 0
+                if (varcmp(cur->varstr, name) == 0) {
-                 && cur->varstr[name_len] == '='
-                ) {
                        if (cur->flg_read_only) {
                                bb_error_msg("%s: readonly variable", name);
                                return EXIT_FAILURE;
@@ -2527,15 +2522,10 @@ static int unset_local_var_len(const char *name, int name_len)
        }
        /* Handle "unset LINENO" et al even if did not find the variable to unset */
-        handle_changed_special_names(name, name_len);
+        handle_changed_special_names(name);
        return EXIT_SUCCESS;
 }
-static int unset_local_var(const char *name)
-{
-        return unset_local_var_len(name, strlen(name));
-}
 #endif
@@ -2581,7 +2571,7 @@ static void set_vars_and_save_old(char **strings)
                eq = strchr(*s, '=');
                if (HUSH_DEBUG && !eq)
                        bb_simple_error_msg_and_die("BUG in varexp4");
-                var_pp = get_ptr_to_local_var(*s, eq - *s);
+                var_pp = get_ptr_to_local_var(*s);
                if (var_pp) {
                        var_p = *var_pp;
                        if (var_p->flg_read_only) {
@@ -4316,7 +4306,7 @@ static int done_word(struct parse_context *ctx)
                 || endofname(command->argv[0])[0] != '\0'
                ) {
                        /* bash says just "not a valid identifier" */
-                        syntax_error("bad variable name in for");
+                        syntax_error("bad for loop variable");
                        return 1;
                }
                /* Force FOR to have just one word (variable name) */
@@ -4693,6 +4683,11 @@ static int parse_group(struct parse_context *ctx,
                        syntax_error_unexpected_ch(ch);
                        return -1;
                }
+//bash allows functions named "123", "..", "return"!
+//              if (endofname(command->argv[0])[0] != '\0') {
+//                      syntax_error("bad function name");
+//                      return -1;
+//              }
                nommu_addchr(&ctx->as_string, ch);
                command->cmd_type = CMD_FUNCDEF;
                goto skip;
@@ -6398,7 +6393,7 @@ static NOINLINE int encode_then_append_var_plusminus(o_string *output, int n,
                if (!dest.o_expflags) {
                        if (ch == EOF)
                                break;
-                        if (!dquoted && strchr(G.ifs, ch)) {
+                        if (!dquoted && !(output->o_expflags & EXP_FLAG_SINGLEWORD) && strchr(G.ifs, ch)) {
                                /* PREFIX${x:d${e}f ...} and we met space: expand "d${e}f" and start new word.
                                 * do not assume we are at the start of the word (PREFIX above).
                                 */
@@ -11178,7 +11173,7 @@ static int FAST_FUNC builtin_umask(char **argv)
 }
 #endif
-#if ENABLE_HUSH_EXPORT || ENABLE_HUSH_TRAP
+#if ENABLE_HUSH_EXPORT || ENABLE_HUSH_READONLY || ENABLE_HUSH_SET || ENABLE_HUSH_TRAP
 static void print_escaped(const char *s)
 {
 //TODO? bash "set" does not quote variables which contain only alnums and "%+,-./:=@_~",
@@ -11215,7 +11210,7 @@ static int helper_export_local(char **argv, unsigned flags)
                if (*name_end == '\0') {
                        struct variable *var, **vpp;
-                        vpp = get_ptr_to_local_var(name, name_end - name);
+                        vpp = get_ptr_to_local_var(name);
                        var = vpp ? *vpp : NULL;
                        if (flags & SETFLAG_UNEXPORT) {
@@ -11317,8 +11312,8 @@ static int FAST_FUNC builtin_export(char **argv)
                                if (!p) /* wtf? take next variable */
                                        continue;
-                                /* export var= */
+                                /* "export VAR=" */
-                                printf("export %.*s", (int)(p - s) + 1, s);
+                                printf("%s %.*s", "export", (int)(p - s) + 1, s);
                                print_escaped(p + 1);
                                putchar('\n');
 # endif
@@ -11362,8 +11357,15 @@ static int FAST_FUNC builtin_readonly(char **argv)
                struct variable *e;
                for (e = G.top_var; e; e = e->next) {
                        if (e->flg_read_only) {
-//TODO: quote value: readonly VAR='VAL'
+                                const char *s = e->varstr;
-                                printf("readonly %s\n", e->varstr);
+                                const char *p = strchr(s, '=');
+                                if (!p) /* wtf? take next variable */
+                                        continue;
+                                /* "readonly VAR=" */
+                                printf("%s %.*s", "readonly", (int)(p - s) + 1, s);
+                                print_escaped(p + 1);
+                                putchar('\n');
                        }
                }
                return EXIT_SUCCESS;
diff --git a/shell/hush_test/hush-arith/arith-assign-in-varexp.right b/shell/hush_test/hush-arith/arith-assign-in-varexp.right
new file mode 100644
index 000000000..06ac80a64
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-assign-in-varexp.right
@@ -0,0 +1,3 @@
+20:20
+a=b=10
+b=10
diff --git a/shell/hush_test/hush-arith/arith-assign-in-varexp.tests b/shell/hush_test/hush-arith/arith-assign-in-varexp.tests
new file mode 100755
index 000000000..920aaa779
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-assign-in-varexp.tests
@@ -0,0 +1,8 @@
+exec 2>&1
+a='b=10'
+b=3
+# The variables should evaluate left-to-right,
+# thus b is set to 10 _before_ addition
+echo 20:$((a + b))
+echo "a=$a"
+echo "b=$b"
diff --git a/shell/hush_test/hush-arith/arith-assign-in-varexp1.right b/shell/hush_test/hush-arith/arith-assign-in-varexp1.right
new file mode 100644
index 000000000..1feb307d2
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-assign-in-varexp1.right
@@ -0,0 +1,2 @@
+7:7
+x=3
diff --git a/shell/hush_test/hush-arith/arith-assign-in-varexp1.tests b/shell/hush_test/hush-arith/arith-assign-in-varexp1.tests
new file mode 100755
index 000000000..fc8ac9d97
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-assign-in-varexp1.tests
@@ -0,0 +1,9 @@
+exec 2>&1
+a='x=1'
+b='x=2'
+c='x=3'
+# The variables should evaluate immediately when they encountered,
+# not when they go into an operation. Here, order of evaluation
+# of names to numbers should be a,b,c - not b,c,a:
+echo 7:$((a+b*c))
+echo "x=$x"
diff --git a/shell/hush_test/hush-arith/arith-bignum1.right b/shell/hush_test/hush-arith/arith-bignum1.right
new file mode 100644
index 000000000..42a8016ec
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-bignum1.right
@@ -0,0 +1,13 @@
+18 digits: 999999999999999999
+19 digits: -8446744073709551617
+20 digits: 7766279631452241919
+18 digits- -999999999999999999
+19 digits- 8446744073709551617
+20 digits- -7766279631452241919
+Hex base#:
+16 digits: 9876543210abcedf
+17 digits: 876543210abcedfc
+18 digits: 76543210abcedfcc
+16 digits: 6789abcdef543121
+17 digits: 789abcdef5431204
+18 digits: 89abcdef54312034
diff --git a/shell/hush_test/hush-arith/arith-bignum1.tests b/shell/hush_test/hush-arith/arith-bignum1.tests
new file mode 100755
index 000000000..ef8f928bc
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-bignum1.tests
@@ -0,0 +1,17 @@
+exec 2>&1
+# If the number does not fit in 64 bits, bash uses truncated 64-bit value
+# (essentially, it does not check for overflow in "n = n * base + digit"
+# calculation).
+echo 18 digits: $((999999999999999999))
+echo 19 digits: $((9999999999999999999))
+echo 20 digits: $((99999999999999999999))
+echo 18 digits- $((-999999999999999999))
+echo 19 digits- $((-9999999999999999999))
+echo 20 digits- $((-99999999999999999999))
+echo "Hex base#:"
+printf '16 digits: %016x\n' $((16#9876543210abcedf))
+printf '17 digits: %016x\n' $((16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((16#9876543210abcedfcc))
+printf '16 digits: %016x\n' $((-16#9876543210abcedf))
+printf '17 digits: %016x\n' $((-16#9876543210abcedfc))
+printf '18 digits: %016x\n' $((-16#9876543210abcedfcc))
diff --git a/shell/hush_test/hush-arith/arith-comma1.right b/shell/hush_test/hush-arith/arith-comma1.right
new file mode 100644
index 000000000..be1264cc0
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-comma1.right
@@ -0,0 +1,3 @@
+10:10
+a=b=10
+b=10
diff --git a/shell/hush_test/hush-arith/arith-comma1.tests b/shell/hush_test/hush-arith/arith-comma1.tests
new file mode 100755
index 000000000..f86304303
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-comma1.tests
@@ -0,0 +1,6 @@
+exec 2>&1
+a='b=10'
+b=3
+echo 10:$((a,b))
+echo "a=$a"
+echo "b=$b"
diff --git a/shell/hush_test/hush-arith/arith-precedence1.right b/shell/hush_test/hush-arith/arith-precedence1.right
new file mode 100644
index 000000000..3f9320a13
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-precedence1.right
@@ -0,0 +1,4 @@
+4:4
+4:4
+4:4
+4:4
diff --git a/shell/hush_test/hush-arith/arith-precedence1.tests b/shell/hush_test/hush-arith/arith-precedence1.tests
new file mode 100755
index 000000000..bfef05292
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-precedence1.tests
@@ -0,0 +1,15 @@
+exec 2>&1
+# bash documentation says that precedence order is:
+#  ...
+#  expr ? expr1 : expr2
+#  = *= /= %= += -= <<= >>= &= ^= |=
+#  exprA , exprB
+# but in practice, the rules for expr1 and expr2 are different:
+# assignments and commas in expr1 have higher precedence than :?,
+# but in expr2 they haven't:
+# "v ? 1,2 : 3,4" is parsed as "(v ? (1,2) : 3),4"
+# "v ? a=2 : b=4" is parsed as "(v ? (a=1) : b)=4" (thus, this is a syntax error)
+echo 4:$((0 ? 1,2 : 3,4))
+echo 4:$((1 ? 1,2 : 3,4))
+echo 4:"$((0 ? 1,2 : 3,4))"
+echo 4:"$((1 ? 1,2 : 3,4))"
diff --git a/shell/hush_test/hush-arith/arith-ternary-assign.right b/shell/hush_test/hush-arith/arith-ternary-assign.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary-assign.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/hush_test/hush-arith/arith-ternary-assign.tests b/shell/hush_test/hush-arith/arith-ternary-assign.tests
new file mode 100755
index 000000000..fa18fe7b9
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary-assign.tests
@@ -0,0 +1,3 @@
+exec 2>&1
+a='@'
+echo 42:$((a=1?42:3,a))
diff --git a/shell/hush_test/hush-arith/arith-ternary-comma.right b/shell/hush_test/hush-arith/arith-ternary-comma.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary-comma.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/hush_test/hush-arith/arith-ternary-comma.tests b/shell/hush_test/hush-arith/arith-ternary-comma.tests
new file mode 100755
index 000000000..5e05b58c4
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary-comma.tests
@@ -0,0 +1,3 @@
+exec 2>&1
+x='@'
+echo 42:$((1?4:x,20*2+2))
diff --git a/shell/hush_test/hush-arith/arith-ternary-preincr.right b/shell/hush_test/hush-arith/arith-ternary-preincr.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary-preincr.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/hush_test/hush-arith/arith-ternary-preincr.tests b/shell/hush_test/hush-arith/arith-ternary-preincr.tests
new file mode 100755
index 000000000..3985c7079
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary-preincr.tests
@@ -0,0 +1,3 @@
+exec 2>&1
+x='@'
+echo 42:$((1?42:++x))
diff --git a/shell/hush_test/hush-arith/arith-ternary1.right b/shell/hush_test/hush-arith/arith-ternary1.right
new file mode 100644
index 000000000..6b751d7b8
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary1.right
@@ -0,0 +1,2 @@
+42:42
+a=0
diff --git a/shell/hush_test/hush-arith/arith-ternary1.tests b/shell/hush_test/hush-arith/arith-ternary1.tests
new file mode 100755
index 000000000..3532ce54d
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary1.tests
@@ -0,0 +1,5 @@
+exec 2>&1
+a=0
+# The not-taken branch should not evaluate
+echo 42:$((1 ? 42 : (a+=2)))
+echo "a=$a"
diff --git a/shell/hush_test/hush-arith/arith-ternary2.right b/shell/hush_test/hush-arith/arith-ternary2.right
new file mode 100644
index 000000000..a549b1b5c
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary2.right
@@ -0,0 +1,3 @@
+6:6
+a=b=+err+
+b=6
diff --git a/shell/hush_test/hush-arith/arith-ternary2.tests b/shell/hush_test/hush-arith/arith-ternary2.tests
new file mode 100755
index 000000000..cb3163932
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary2.tests
@@ -0,0 +1,7 @@
+exec 2>&1
+a='b=+err+'
+b=5
+# The not-taken branch should not parse variables
+echo 6:$((0 ? a : ++b))
+echo "a=$a"
+echo "b=$b"
diff --git a/shell/hush_test/hush-arith/arith-ternary3.right b/shell/hush_test/hush-arith/arith-ternary3.right
new file mode 100644
index 000000000..6644d86bf
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary3.right
@@ -0,0 +1 @@
+42:42
diff --git a/shell/hush_test/hush-arith/arith-ternary3.tests b/shell/hush_test/hush-arith/arith-ternary3.tests
new file mode 100755
index 000000000..0bf9f3002
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary3.tests
@@ -0,0 +1,4 @@
+exec 2>&1
+# "EXPR ?..." should check _evaluated_ EXPR,
+# not its last value
+echo 42:$((1 < 1 ? -1 : 1 > 1 ? 1 : 42))
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested.right b/shell/hush_test/hush-arith/arith-ternary_nested.right
new file mode 100644
index 000000000..aa54bd925
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested.right
@@ -0,0 +1 @@
+5:5
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested.tests b/shell/hush_test/hush-arith/arith-ternary_nested.tests
new file mode 100755
index 000000000..eefc8e7ce
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested.tests
@@ -0,0 +1,2 @@
+exec 2>&1
+echo 5:$((1?2?3?4?5:6:7:8:9))
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested1.right b/shell/hush_test/hush-arith/arith-ternary_nested1.right
new file mode 100644
index 000000000..d80319695
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested1.right
@@ -0,0 +1 @@
+3:3
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested1.tests b/shell/hush_test/hush-arith/arith-ternary_nested1.tests
new file mode 100755
index 000000000..469584bea
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested1.tests
@@ -0,0 +1,2 @@
+exec 2>&1
+echo 3:$((1?(2?(3):4):5))
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested2.right b/shell/hush_test/hush-arith/arith-ternary_nested2.right
new file mode 100644
index 000000000..d80319695
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested2.right
@@ -0,0 +1 @@
+3:3
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested2.tests b/shell/hush_test/hush-arith/arith-ternary_nested2.tests
new file mode 100755
index 000000000..e8b8a9e1a
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested2.tests
@@ -0,0 +1,2 @@
+exec 2>&1
+echo 3:$((0?1:2?3:4?5:6?7:8))
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested3.right b/shell/hush_test/hush-arith/arith-ternary_nested3.right
new file mode 100644
index 000000000..1a34fde65
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested3.right
@@ -0,0 +1,2 @@
+42:42
+a=2:2
diff --git a/shell/hush_test/hush-arith/arith-ternary_nested3.tests b/shell/hush_test/hush-arith/arith-ternary_nested3.tests
new file mode 100755
index 000000000..6f753867e
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith-ternary_nested3.tests
@@ -0,0 +1,6 @@
+exec 2>&1
+x='@'
+a=2
+# After processing nested ?:, outermost ?: should still remember to NOT evaluate a*=2
+echo 42:$((1?0?41:42:(a*=2)))
+echo "a=2:$a"
diff --git a/shell/hush_test/hush-arith/arith.right b/shell/hush_test/hush-arith/arith.right
index a8612295e..d3a978611 100644
--- a/shell/hush_test/hush-arith/arith.right
+++ b/shell/hush_test/hush-arith/arith.right
@@ -82,7 +82,8 @@ other bases
 62 62
 63 63
 missing number after base
-0 0
+hush: arithmetic syntax error
+hush: arithmetic syntax error
 hush: arithmetic syntax error
 hush: divide by zero
 hush: can't execute 'let': No such file or directory
@@ -94,7 +95,7 @@ ghi
 hush: arithmetic syntax error
 16 16
 hush: arithmetic syntax error
-hush: malformed ?: operator
+hush: arithmetic syntax error
 hush: arithmetic syntax error
 9 9
 hush: arithmetic syntax error
diff --git a/shell/hush_test/hush-arith/arith.tests b/shell/hush_test/hush-arith/arith.tests
index 6b707486c..9f0399816 100755
--- a/shell/hush_test/hush-arith/arith.tests
+++ b/shell/hush_test/hush-arith/arith.tests
@@ -159,12 +159,12 @@ echo 63 $(( 64#_ ))
 #ash# # weird bases (error)
 #ash# echo $(( 3425#56 ))
-echo missing number after base
-echo 0 $(( 2# ))
 # these should generate errors
+echo missing number after base
+(  echo $(( 2# ))          )
 (  echo $(( 7 = 43 ))      )
-#ash# echo $(( 2#44 ))
+(  echo $(( 2#44 ))        )
 (  echo $(( 44 / 0 ))      )
 (  let 'jv += $iv'         )
 (  echo $(( jv += \$iv ))  )
diff --git a/shell/hush_test/hush-quoting/space_in_varexp1.right b/shell/hush_test/hush-quoting/space_in_varexp1.right
new file mode 100644
index 000000000..a617a91c3
--- /dev/null
+++ b/shell/hush_test/hush-quoting/space_in_varexp1.right
@@ -0,0 +1,2 @@
+1:'b c'
+2:'b c'
diff --git a/shell/hush_test/hush-quoting/space_in_varexp1.tests b/shell/hush_test/hush-quoting/space_in_varexp1.tests
new file mode 100755
index 000000000..1589587d1
--- /dev/null
+++ b/shell/hush_test/hush-quoting/space_in_varexp1.tests
@@ -0,0 +1,6 @@
+a=b
+a=${a:+$a }c
+echo "1:'$a'"
+a=b
+a="${a:+$a }c"
+echo "2:'$a'"
diff --git a/shell/hush_test/hush-vars/readonly0.right b/shell/hush_test/hush-vars/readonly0.right
index 8b750eb5f..7599698d2 100644
--- a/shell/hush_test/hush-vars/readonly0.right
+++ b/shell/hush_test/hush-vars/readonly0.right
@@ -1,5 +1,5 @@
-readonly a=A
+readonly a='A'
-readonly b=B
+readonly b='B'
 Ok:0
 hush: a=A: readonly variable
diff --git a/shell/hush_test/run-all b/shell/hush_test/run-all
index 3fbc7c531..7345fee43 100755
--- a/shell/hush_test/run-all
+++ b/shell/hush_test/run-all
@@ -29,7 +29,7 @@ fi
 eval $(sed -e '/^#/d' -e '/^$/d' -e 's:^:export :' .config)
-PATH="`pwd`:$PATH" # for hush and recho/zecho/printenv
+PATH="`pwd`:$PATH" # for hush
 export PATH
 THIS_SH="`pwd`/hush"
@@ -67,7 +67,8 @@ do_test()
 #               echo Running test: "$x"
                echo -n "$1/$x:"
                (
-                        "$THIS_SH" "./$x" >"$name.xx" 2>&1
+                        "$THIS_SH" "./$x" 2>&1 | \
+                                grep -va "^hush: using fallback suid method$" >"$name.xx"
                        r=$?
                        # filter C library differences
                        sed -i \
@@ -83,7 +84,7 @@ do_test()
                        *)  echo " fail ($?)"; tret=1;;
                esac
        done
-        exit ${tret}
+        exit $tret
        )
 }
@@ -95,6 +96,9 @@ ret=0
 if [ $# -lt 1 ]; then
        # All sub directories
        modules=`ls -d hush-*`
+        # If you want to test hush against ash testsuite
+        # (have to copy ash_test dir to current dir first):
+        #modules=`ls -d hush-* ash_test/ash-*`
        for module in $modules; do
                do_test $module || ret=1
@@ -108,4 +112,4 @@ else
        done
 fi
-exit ${ret}
+exit $ret
diff --git a/shell/math.c b/shell/math.c
index 76d22c9bd..e90a38f05 100644
--- a/shell/math.c
+++ b/shell/math.c
@@ -46,7 +46,6 @@
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 /* This is my infix parser/evaluator. It is optimized for size, intended
 * as a replacement for yacc-based parsers. However, it may well be faster
 * than a comparable parser written in yacc. The supported operators are
@@ -61,7 +60,6 @@
 * to the stack instead of adding them to a queue to end up with an
 * expression).
 */
 /*
 * Aug 24, 2001              Manuel Novoa III
 *
@@ -96,7 +94,6 @@
 *
 * Merge in Aaron's comments previously posted to the busybox list,
 * modified slightly to take account of my changes to the code.
- *
 */
 /*
 *  (C) 2003 Vladimir Oleynik <dzo@simtreas.ru>
@@ -116,6 +113,12 @@
 #include "libbb.h"
 #include "math.h"
+#if 1
+# define dbg(...) ((void)0)
+#else
+# define dbg(...) bb_error_msg(__VA_ARGS__)
+#endif
 typedef unsigned char operator;
 /* An operator's token id is a bit of a bitfield. The lower 5 bits are the
@@ -125,9 +128,13 @@ typedef unsigned char operator;
 * Consider * and /
 */
 #define tok_decl(prec,id)       (((id)<<5) | (prec))
-#define PREC(op)                ((op) & 0x1F)
+#define ID_SHIFT                5
+#define PREC(op)                ((op) & 0x1f)
+#define PREC_LPAREN             0
 #define TOK_LPAREN              tok_decl(0,0)
+/* Precedence value of RPAREN is used only to distinguish it from LPAREN */
+#define TOK_RPAREN              tok_decl(1,1)
 #define TOK_COMMA               tok_decl(1,0)
@@ -135,22 +142,37 @@ typedef unsigned char operator;
 * but there are 11 of them, which doesn't fit into 3 bits for unique id.
 * Abusing another precedence level:
 */
+#define PREC_ASSIGN1            2
 #define TOK_ASSIGN              tok_decl(2,0)
 #define TOK_AND_ASSIGN          tok_decl(2,1)
 #define TOK_OR_ASSIGN           tok_decl(2,2)
 #define TOK_XOR_ASSIGN          tok_decl(2,3)
-#define TOK_PLUS_ASSIGN         tok_decl(2,4)
+#define TOK_ADD_ASSIGN          tok_decl(2,4)
-#define TOK_MINUS_ASSIGN        tok_decl(2,5)
+#define TOK_SUB_ASSIGN          tok_decl(2,5)
 #define TOK_LSHIFT_ASSIGN       tok_decl(2,6)
 #define TOK_RSHIFT_ASSIGN       tok_decl(2,7)
+#define PREC_ASSIGN2            3
 #define TOK_MUL_ASSIGN          tok_decl(3,0)
-#define TOK_DIV_ASSIGN          tok_decl(3,1)
+/* "/" and "/=" ops have the same id bits */
+#define DIV_ID1                 1
+#define TOK_DIV_ASSIGN          tok_decl(3,DIV_ID1)
 #define TOK_REM_ASSIGN          tok_decl(3,2)
-#define fix_assignment_prec(prec) do { if (prec == 3) prec = 2; } while (0)
+#define fix_assignment_prec(prec) do { prec -= (prec == 3); } while (0)
 /* Ternary conditional operator is right associative too */
+/*
+ * bash documentation says that precedence order is:
+ *  ...
+ *  expr ? expr1 : expr2
+ *  = *= /= %= += -= <<= >>= &= ^= |=
+ *  exprA , exprB
+ * What it omits is that expr1 is parsed as if parenthesized
+ * (this matches the rules of ?: in C language):
+ * "v ? 1,2 : 3,4" is parsed as "(v ? (1,2) : 3),4"
+ * "v ? a=2 : b=4" is parsed as "(v ? (a=1) : b)=4" (thus, this is a syntax error)
+ */
 #define TOK_CONDITIONAL         tok_decl(4,0)
 #define TOK_CONDITIONAL_SEP     tok_decl(4,1)
@@ -179,7 +201,7 @@ typedef unsigned char operator;
 #define TOK_SUB                 tok_decl(13,1)
 #define TOK_MUL                 tok_decl(14,0)
-#define TOK_DIV                 tok_decl(14,1)
+#define TOK_DIV                 tok_decl(14,DIV_ID1)
 #define TOK_REM                 tok_decl(14,2)
 /* Exponent is right associative */
@@ -194,26 +216,25 @@ typedef unsigned char operator;
 #define TOK_UPLUS               tok_decl(UNARYPREC+1,1)
 #define PREC_PRE                (UNARYPREC+2)
+#define TOK_PRE_INC             tok_decl(PREC_PRE,0)
-#define TOK_PRE_INC             tok_decl(PREC_PRE, 0)
+#define TOK_PRE_DEC             tok_decl(PREC_PRE,1)
-#define TOK_PRE_DEC             tok_decl(PREC_PRE, 1)
 #define PREC_POST               (UNARYPREC+3)
+#define TOK_POST_INC            tok_decl(PREC_POST,0)
+#define TOK_POST_DEC            tok_decl(PREC_POST,1)
-#define TOK_POST_INC            tok_decl(PREC_POST, 0)
+/* TOK_VALUE marks a number, name, name++/name--, or (EXPR):
-#define TOK_POST_DEC            tok_decl(PREC_POST, 1)
+ * IOW: something which can be used as the left side of a binary op.
+ * Since it's never pushed to opstack, its precedence does not matter.
-#define SPEC_PREC               (UNARYPREC+4)
+ */
+#define TOK_VALUE               tok_decl(PREC_POST,2)
-#define TOK_NUM                 tok_decl(SPEC_PREC, 0)
-#define TOK_RPAREN              tok_decl(SPEC_PREC, 1)
 static int
 is_assign_op(operator op)
 {
        operator prec = PREC(op);
-        fix_assignment_prec(prec);
+        return prec == PREC_ASSIGN1
-        return prec == PREC(TOK_ASSIGN)
+        || prec == PREC_ASSIGN2
        || prec == PREC_PRE
        || prec == PREC_POST;
 }
@@ -226,91 +247,107 @@ is_right_associative(operator prec)
        || prec == PREC(TOK_CONDITIONAL);
 }
 typedef struct {
        arith_t val;
-        /* We acquire second_val only when "expr1 : expr2" part
+        const char *var_name;
-         * of ternary ?: op is evaluated.
-         * We treat ?: as two binary ops: (expr ? (expr1 : expr2)).
-         * ':' produces a new value which has two parts, val and second_val;
-         * then '?' selects one of them based on its left side.
-         */
-        arith_t second_val;
-        char second_val_present;
-        /* If NULL then it's just a number, else it's a named variable */
-        char *var;
 } var_or_num_t;
+#define VALID_NAME(name) (name)
+#define NOT_NAME(name)   (!(name))
 typedef struct remembered_name {
        struct remembered_name *next;
-        const char *var;
+        const char *var_name;
 } remembered_name;
+static ALWAYS_INLINE int isalnum_(int c)
+{
+        return (isalnum(c) || c == '_');
+}
 static arith_t
 evaluate_string(arith_state_t *math_state, const char *expr);
-static const char*
+static arith_t
-arith_lookup_val(arith_state_t *math_state, var_or_num_t *t)
+arith_lookup_val(arith_state_t *math_state, const char *name, char *endname)
 {
-        if (t->var) {
+        char c;
-                const char *p = math_state->lookupvar(t->var);
+        const char *p;
-                if (p) {
-                        remembered_name *cur;
+        c = *endname;
-                        remembered_name cur_save;
+        *endname = '\0';
+        p = math_state->lookupvar(name);
-                        /* did we already see this name?
+        *endname = c;
-                         * testcase: a=b; b=a; echo $((a))
+        if (p) {
-                         */
+                arith_t val;
-                        for (cur = math_state->list_of_recursed_names; cur; cur = cur->next) {
+                size_t len = endname - name;
-                                if (strcmp(cur->var, t->var) == 0) {
+                remembered_name *cur;
-                                        /* Yes */
+                remembered_name remember;
-                                        return "expression recursion loop detected";
-                                }
+                /* did we already see this name?
+                 * testcase: a=b; b=a; echo $((a))
+                 */
+                for (cur = math_state->list_of_recursed_names; cur; cur = cur->next) {
+                        if (strncmp(cur->var_name, name, len) == 0
+                         && !isalnum_(cur->var_name[len])
+                        ) {
+                                /* yes */
+                                math_state->errmsg = "expression recursion loop detected";
+                                return -1;
                        }
+                }
-                        /* push current var name */
+                /* push current var name */
-                        cur = math_state->list_of_recursed_names;
+                remember.var_name = name;
-                        cur_save.var = t->var;
+                remember.next = math_state->list_of_recursed_names;
-                        cur_save.next = cur;
+                math_state->list_of_recursed_names = &remember;
-                        math_state->list_of_recursed_names = &cur_save;
-                        /* recursively evaluate p as expression */
+                /* recursively evaluate p as expression */
-                        t->val = evaluate_string(math_state, p);
+                /* this sets math_state->errmsg on error */
+                val = evaluate_string(math_state, p);
-                        /* pop current var name */
+                /* pop current var name */
-                        math_state->list_of_recursed_names = cur;
+                math_state->list_of_recursed_names = remember.next;
-                        return math_state->errmsg;
+                return val;
-                }
-                /* treat undefined var as 0 */
-                t->val = 0;
        }
+        /* treat undefined var as 0 */
        return 0;
 }
 /* "Applying" a token means performing it on the top elements on the integer
- * stack. For an unary operator it will only change the top element, but a
+ * stack. For an unary operator it will only change the top element,
- * binary operator will pop two arguments and push the result */
+ * a binary operator will pop two arguments and push the result,
+ * the ternary ?: op will pop three arguments and push the result.
+ */
 static NOINLINE const char*
 arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_or_num_t **numstackptr)
 {
-#define NUMPTR (*numstackptr)
+#define NUMSTACKPTR (*numstackptr)
        var_or_num_t *top_of_stack;
        arith_t rez;
-        const char *err;
        /* There is no operator that can work without arguments */
-        if (NUMPTR == numstack)
+        if (NUMSTACKPTR == numstack)
-                goto err;
+                goto syntax_err;
-        top_of_stack = NUMPTR - 1;
+        top_of_stack = NUMSTACKPTR - 1;
-        /* Resolve name to value, if needed */
+        if (op == TOK_CONDITIONAL_SEP) {
-        err = arith_lookup_val(math_state, top_of_stack);
+                /* "expr1 ? expr2 : expr3" operation */
-        if (err)
+                var_or_num_t *expr1 = &top_of_stack[-2];
-                return err;
+                NUMSTACKPTR = expr1 + 1;
+                if (expr1 < numstack) /* Example: $((2:3)) */
+                        return "malformed ?: operator";
+                if (expr1->val != 0) /* select expr2 or expr3 */
+                        top_of_stack--;
+                rez = top_of_stack->val;
+                top_of_stack = expr1;
+                goto ret_rez;
+        }
+        if (op == TOK_CONDITIONAL) /* Example: $((a ? b)) */
+                return "malformed ?: operator";
        rez = top_of_stack->val;
        if (op == TOK_UMINUS)
@@ -323,50 +360,30 @@ arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_
                rez++;
        else if (op == TOK_POST_DEC || op == TOK_PRE_DEC)
                rez--;
-        else if (op != TOK_UPLUS) {
+        else /*if (op != TOK_UPLUS) - always true, we drop TOK_UPLUS earlier */ {
                /* Binary operators */
                arith_t right_side_val;
-                char bad_second_val;
-                /* Binary operators need two arguments */
-                if (top_of_stack == numstack)
-                        goto err;
-                /* ...and they pop one */
-                NUMPTR = top_of_stack; /* this decrements NUMPTR */
-                bad_second_val = top_of_stack->second_val_present;
-                if (op == TOK_CONDITIONAL) { /* ? operation */
-                        /* Make next if (...) protect against
-                         * $((expr1 ? expr2)) - that is, missing ": expr" */
-                        bad_second_val = !bad_second_val;
-                }
-                if (bad_second_val) {
-                        /* Protect against $((expr <not_?_op> expr1 : expr2)) */
-                        return "malformed ?: operator";
-                }
-                top_of_stack--; /* now points to left side */
+                if (top_of_stack == numstack) /* have two arguments? */
+                        goto syntax_err; /* no */
+                /* Pop numstack */
+                NUMSTACKPTR = top_of_stack; /* this decrements NUMSTACKPTR */
-                if (op != TOK_ASSIGN) {
+                if (math_state->evaluation_disabled) {
-                        /* Resolve left side value (unless the op is '=') */
+                        dbg("binary op %02x skipped", op);
-                        err = arith_lookup_val(math_state, top_of_stack);
+                        return NULL;
-                        if (err)
+                        /* bash 5.2.12 does not execute "2/0" in disabled
-                                return err;
+                         * branches of ?: (and thus does not complain),
+                         * but complains about negative exp: "2**-1".
+                         * I don't think we need to emulate that.
+                         */
                }
+                top_of_stack--; /* now points to left side */
                right_side_val = rez;
                rez = top_of_stack->val;
-                if (op == TOK_CONDITIONAL) /* ? operation */
+                if (op == TOK_BOR || op == TOK_OR_ASSIGN)
-                        rez = (rez ? right_side_val : top_of_stack[1].second_val);
-                else if (op == TOK_CONDITIONAL_SEP) { /* : operation */
-                        if (top_of_stack == numstack) {
-                                /* Protect against $((expr : expr)) */
-                                return "malformed ?: operator";
-                        }
-                        top_of_stack->second_val_present = op;
-                        top_of_stack->second_val = right_side_val;
-                }
-                else if (op == TOK_BOR || op == TOK_OR_ASSIGN)
                        rez |= right_side_val;
                else if (op == TOK_OR)
                        rez = right_side_val || rez;
@@ -394,9 +411,9 @@ arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_
                        rez = (rez <= right_side_val);
                else if (op == TOK_MUL || op == TOK_MUL_ASSIGN)
                        rez *= right_side_val;
-                else if (op == TOK_ADD || op == TOK_PLUS_ASSIGN)
+                else if (op == TOK_ADD || op == TOK_ADD_ASSIGN)
                        rez += right_side_val;
-                else if (op == TOK_SUB || op == TOK_MINUS_ASSIGN)
+                else if (op == TOK_SUB || op == TOK_SUB_ASSIGN)
                        rez -= right_side_val;
                else if (op == TOK_ASSIGN || op == TOK_COMMA)
                        rez = right_side_val;
@@ -405,14 +422,26 @@ arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_
                        if (right_side_val < 0)
                                return "exponent less than 0";
                        c = 1;
-                        while (--right_side_val >= 0)
+                        while (right_side_val != 0) {
+                                if ((right_side_val & 1) == 0) {
+                                        /* this if() block is not necessary for correctness,
+                                         * but otherwise echo $((3**999999999999999999))
+                                         * takes a VERY LONG time
+                                         * (and it's not interruptible by ^C)
+                                         */
+                                        rez *= rez;
+                                        right_side_val >>= 1;
+                                }
                                c *= rez;
+                                right_side_val--;
+                        }
                        rez = c;
                }
-                else if (right_side_val == 0)
+                else /*if (op == TOK_DIV || op == TOK_DIV_ASSIGN
-                        return "divide by zero";
+                      || op == TOK_REM || op == TOK_REM_ASSIGN) - always true */
-                else if (op == TOK_DIV || op == TOK_DIV_ASSIGN
+                {
-                      || op == TOK_REM || op == TOK_REM_ASSIGN) {
+                        if (right_side_val == 0)
+                                return "divide by zero";
                        /*
                         * bash 4.2.45 x86 64bit: SEGV on 'echo $((2**63 / -1))'
                         *
@@ -424,42 +453,53 @@ arith_apply(arith_state_t *math_state, operator op, var_or_num_t *numstack, var_
                         * Make sure to at least not SEGV here:
                         */
                        if (right_side_val == -1
-                         && rez << 1 == 0 /* MAX_NEGATIVE_INT or 0 */
+                         && (rez << 1) == 0 /* MAX_NEGATIVE_INT or 0 */
                        ) {
                                right_side_val = 1;
                        }
-                        if (op == TOK_DIV || op == TOK_DIV_ASSIGN)
+                        if (op & (DIV_ID1 << ID_SHIFT)) /* DIV or DIV_ASSIGN? */
                                rez /= right_side_val;
-                        else {
+                        else
                                rez %= right_side_val;
-                        }
                }
        }
+        if (math_state->evaluation_disabled) {
+                dbg("unary op %02x skipped", op);
+                return NULL;
+        }
        if (is_assign_op(op)) {
                char buf[sizeof(arith_t)*3 + 2];
-                if (top_of_stack->var == NULL) {
+                if (NOT_NAME(top_of_stack->var_name)) {
                        /* Hmm, 1=2 ? */
-                        goto err;
+                        goto syntax_err;
                }
                /* Save to shell variable */
                sprintf(buf, ARITH_FMT, rez);
-                math_state->setvar(top_of_stack->var, buf);
+                {
-                /* After saving, make previous value for v++ or v-- */
+                        char *e = (char*)endofname(top_of_stack->var_name);
-                if (op == TOK_POST_INC)
+                        char c = *e;
-                        rez--;
+                        *e = '\0';
-                if (op == TOK_POST_DEC)
+                        math_state->setvar(top_of_stack->var_name, buf);
-                        rez++;
+                        *e = c;
+                }
+                /* VAR++ or VAR--? */
+                if (PREC(op) == PREC_POST) {
+                        /* Do not store new value to stack (keep old value) */
+                        goto ret_NULL;
+                }
        }
+ ret_rez:
        top_of_stack->val = rez;
+ ret_NULL:
        /* Erase var name, it is just a number now */
-        top_of_stack->var = NULL;
+        top_of_stack->var_name = NULL;
        return NULL;
- err:
+ syntax_err:
        return "arithmetic syntax error";
-#undef NUMPTR
+#undef NUMSTACKPTR
 }
 /* longest must be first */
@@ -479,8 +519,8 @@ static const char op_tokens[] ALIGN1 = {
        '*','=',    0, TOK_MUL_ASSIGN,
        '/','=',    0, TOK_DIV_ASSIGN,
        '%','=',    0, TOK_REM_ASSIGN,
-        '+','=',    0, TOK_PLUS_ASSIGN,
+        '+','=',    0, TOK_ADD_ASSIGN,
-        '-','=',    0, TOK_MINUS_ASSIGN,
+        '-','=',    0, TOK_SUB_ASSIGN,
        '-','-',    0, TOK_POST_DEC,
        '^','=',    0, TOK_XOR_ASSIGN,
        '+','+',    0, TOK_POST_INC,
@@ -497,7 +537,6 @@ static const char op_tokens[] ALIGN1 = {
        '+',        0, TOK_ADD,
        '-',        0, TOK_SUB,
        '^',        0, TOK_BXOR,
-        /* uniq */
        '~',        0, TOK_BNOT,
        ',',        0, TOK_COMMA,
        '?',        0, TOK_CONDITIONAL,
@@ -506,41 +545,26 @@ static const char op_tokens[] ALIGN1 = {
        '(',        0, TOK_LPAREN,
        0
 };
-#define ptr_to_rparen (&op_tokens[sizeof(op_tokens)-7])
+#define END_POINTER (&op_tokens[sizeof(op_tokens)-1])
 #if ENABLE_FEATURE_SH_MATH_BASE
-static arith_t strto_arith_t(const char *nptr, char **endptr)
+static arith_t parse_with_base(const char *nptr, char **endptr, unsigned base)
 {
-        unsigned base;
+        arith_t n = 0;
-        arith_t n;
+        const char *start = nptr;
-# if ENABLE_FEATURE_SH_MATH_64
-        n = strtoull(nptr, endptr, 0);
-# else
-        n = strtoul(nptr, endptr, 0);
-# endif
-        if (**endptr != '#'
-         || (*nptr < '1' || *nptr > '9')
-         || (n < 2 || n > 64)
-        ) {
-                return n;
-        }
-        /* It's "N#nnnn" or "NN#nnnn" syntax, NN can't start with 0,
-         * NN is in 2..64 range.
-         */
-        base = (unsigned)n;
-        n = 0;
-        nptr = *endptr + 1;
        for (;;) {
                unsigned digit = (unsigned)*nptr - '0';
                if (digit >= 10 /* not 0..9 */
-                 && digit <= 'z' - '0' /* needed to reject e.g. $((64#~)) */
+                 && digit <= 'z' - '0' /* reject e.g. $((64#~)) */
                ) {
-                        /* in bases up to 36, case does not matter for a-z */
+                        /* current char is one of :;<=>?@A..Z[\]^_`a..z */
+                        /* in bases up to 36, case does not matter for a-z,
+                         * map @A..Z and `a..z to 9..35: */
                        digit = (unsigned)(*nptr | 0x20) - ('a' - 10);
                        if (base > 36 && *nptr <= '_') {
-                                /* otherwise, A-Z,@,_ are 36-61,62,63 */
+                                /* base > 36: A-Z,@,_ are 36-61,62,63 */
                                if (*nptr == '_')
                                        digit = 63;
                                else if (*nptr == '@')
@@ -551,8 +575,8 @@ static arith_t strto_arith_t(const char *nptr, char **endptr)
                                        break; /* error: one of [\]^ */
                        }
                        //bb_error_msg("ch:'%c'%d digit:%u", *nptr, *nptr, digit);
-                        //if (digit < 10) - example where we need this?
+                        if (digit < 10) /* reject e.g. $((36#@)) */
-                        //      break;
+                                break;
                }
                if (digit >= base)
                        break;
@@ -560,15 +584,55 @@ static arith_t strto_arith_t(const char *nptr, char **endptr)
                n = n * base + digit;
                nptr++;
        }
-        /* Note: we do not set errno on bad chars, we just set a pointer
-         * to the first invalid char. For example, this allows
-         * "N#" (empty "nnnn" part): 64#+1 is a valid expression,
-         * it means 64# + 1, whereas 64#~... is not, since ~ is not a valid
-         * operator.
-         */
        *endptr = (char*)nptr;
+        /* "64#" and "64#+1" used to be valid expressions, but bash 5.2.15
+         * no longer allow such, detect this:
+         */
+// NB: bash allows $((0x)), this is probably a bug...
+        if (nptr == start)
+                *endptr = NULL; /* there weren't any digits, bad */
        return n;
 }
+static arith_t strto_arith_t(const char *nptr, char **endptr)
+{
+/* NB: we do not use strtoull here to be bash-compatible:
+ * $((99999999999999999999)) is 7766279631452241919
+ * (the 64-bit truncated value).
+ */
+        unsigned base;
+        /* nptr[0] is '0'..'9' here */
+        base = nptr[0] - '0';
+        if (base == 0) { /* nptr[0] is '0' */
+                base = 8;
+                if ((nptr[1] | 0x20) == 'x') {
+                        base = 16;
+                        nptr += 2;
+                }
+// NB: bash allows $((0x)), this is probably a bug...
+                return parse_with_base(nptr, endptr, base);
+        }
+        /* base is 1..9 here */
+        if (nptr[1] == '#') {
+                if (base > 1)
+                        return parse_with_base(nptr + 2, endptr, base);
+                /* else: "1#NN", bash says "invalid arithmetic base" */
+        }
+        if (isdigit(nptr[1]) && nptr[2] == '#') {
+                base = 10 * base + (nptr[1] - '0');
+                /* base is at least 10 here */
+                if (base <= 64)
+                        return parse_with_base(nptr + 3, endptr, base);
+                /* else: bash says "invalid arithmetic base" */
+        }
+        return parse_with_base(nptr, endptr, 10);
+}
 #else /* !ENABLE_FEATURE_SH_MATH_BASE */
 # if ENABLE_FEATURE_SH_MATH_64
 #  define strto_arith_t(nptr, endptr) strtoull(nptr, endptr, 0)
@@ -580,23 +644,52 @@ static arith_t strto_arith_t(const char *nptr, char **endptr)
 static arith_t
 evaluate_string(arith_state_t *math_state, const char *expr)
 {
+        /* Stack of integers/names */
+        var_or_num_t *numstack, *numstackptr;
+        /* Stack of operator tokens */
+        operator *opstack, *opstackptr;
+        /* To detect whether we are after a "value": */
        operator lasttok;
+        /* To insert implicit () in ?: ternary op: */
+        operator insert_op = 0xff;
+        unsigned ternary_level = 0;
        const char *errmsg;
        const char *start_expr = expr = skip_whitespace(expr);
-        unsigned expr_len = strlen(expr) + 2;
-        /* Stack of integers */
+        {
-        /* The proof that there can be no more than strlen(startbuf)/2+1
+                unsigned expr_len = strlen(expr);
-         * integers in any given correct or incorrect expression
+                /* If LOTS of whitespace, do not blow up the estimation */
-         * is left as an exercise to the reader. */
+                const char *p = expr;
-        var_or_num_t *const numstack = alloca((expr_len / 2) * sizeof(numstack[0]));
+                while (*p) {
-        var_or_num_t *numstackptr = numstack;
+                        /* in a run of whitespace, count only 1st char */
-        /* Stack of operator tokens */
+                        if (isspace(*p)) {
-        operator *const stack = alloca(expr_len * sizeof(stack[0]));
+                                while (p++, isspace(*p))
-        operator *stackptr = stack;
+                                        expr_len--;
+                        } else {
+                                p++;
+                        }
+                }
+                dbg("expr:'%s' expr_len:%u", expr, expr_len);
+                /* expr_len deep opstack is needed. Think "------------7".
+                 * Only "?" operator temporarily needs two opstack slots
+                 * (IOW: more than one slot), but its second slot (LPAREN)
+                 * is popped off when ":" is reached.
+                 */
+                expr_len++; /* +1 for 1st LPAREN. See what $((1?)) pushes to opstack */
+                opstackptr = opstack = alloca(expr_len * sizeof(opstack[0]));
+                /* There can be no more than (expr_len/2 + 1)
+                 * integers/names in any given correct or incorrect expression.
+                 * (modulo "09", "0v" cases where 2 chars are 2 ints/names,
+                 * but we have code to detect that early)
+                 */
+                expr_len = (expr_len / 2)
+                        + 1 /* "1+2" has two nums, 2 = len/2+1, NOT len/2 */;
+                numstackptr = numstack = alloca(expr_len * sizeof(numstack[0]));
+        }
        /* Start with a left paren */
-        *stackptr++ = lasttok = TOK_LPAREN;
+        dbg("(%d) op:TOK_LPAREN", (int)(opstackptr - opstack));
-        errmsg = NULL;
+        *opstackptr++ = lasttok = TOK_LPAREN;
        while (1) {
                const char *p;
@@ -607,8 +700,7 @@ evaluate_string(arith_state_t *math_state, const char *expr)
                if (*expr == '\0') {
                        if (expr == start_expr) {
                                /* Null expression */
-                                numstack->val = 0;
+                                return 0;
-                                goto ret;
                        }
                        /* This is only reached after all tokens have been extracted from the
@@ -616,46 +708,71 @@ evaluate_string(arith_state_t *math_state, const char *expr)
                         * are to be applied in order. At the end, there should be a final
                         * result on the integer stack */
-                        if (expr != ptr_to_rparen + 1) {
+                        if (expr != END_POINTER) {
                                /* If we haven't done so already,
                                 * append a closing right paren
                                 * and let the loop process it */
-                                expr = ptr_to_rparen;
+                                expr = END_POINTER;
-//bb_error_msg("expr=')'");
+                                op = TOK_RPAREN;
-                                continue;
+                                goto tok_found1;
                        }
                        /* At this point, we're done with the expression */
                        if (numstackptr != numstack + 1) {
-                                /* ...but if there isn't, it's bad */
+                                /* if there is not exactly one result, it's bad */
-                                goto err;
+                                /* Example: $((1 2)) */
+                                goto syntax_err;
                        }
-                        goto ret;
+                        return numstack->val;
                }
                p = endofname(expr);
                if (p != expr) {
                        /* Name */
-                        size_t var_name_size = (p - expr) + 1;  /* +1 for NUL */
+                        if (!math_state->evaluation_disabled) {
-                        numstackptr->var = alloca(var_name_size);
+                                numstackptr->var_name = expr;
-                        safe_strncpy(numstackptr->var, expr, var_name_size);
+                                dbg("[%d] var:'%.*s'", (int)(numstackptr - numstack), (int)(p - expr), expr);
-//bb_error_msg("var:'%s'", numstackptr->var);
+                                expr = skip_whitespace(p);
-                        expr = p;
+                                /* If it is not followed by "=" operator... */
- num:
+                                if (expr[0] != '=' /* not "=..." */
-                        numstackptr->second_val_present = 0;
+                                 || expr[1] == '=' /* or "==..." */
+                                ) {
+                                        /* Evaluate variable to value */
+                                        arith_t val = arith_lookup_val(math_state, numstackptr->var_name, (char*)p);
+                                        if (math_state->errmsg)
+                                                return val; /* -1 */
+                                        numstackptr->val = val;
+                                }
+                        } else {
+                                dbg("[%d] var:IGNORED", (int)(numstackptr - numstack));
+                                expr = p;
+                                numstackptr->var_name = NULL; /* not needed, paranoia */
+                                numstackptr->val = 0; /* not needed, paranoia */
+                        }
+ push_value:
                        numstackptr++;
-                        lasttok = TOK_NUM;
+                        lasttok = TOK_VALUE;
                        continue;
                }
                if (isdigit(*expr)) {
                        /* Number */
-                        numstackptr->var = NULL;
+                        char *end;
-                        errno = 0;
+                        numstackptr->var_name = NULL;
-                        numstackptr->val = strto_arith_t(expr, (char**) &expr);
+                        /* code is smaller compared to using &expr here: */
-//bb_error_msg("val:%lld", numstackptr->val);
+                        numstackptr->val = strto_arith_t(expr, &end);
-                        if (errno)
+                        expr = end;
-                                numstackptr->val = 0; /* bash compat */
+                        dbg("[%d] val:%lld", (int)(numstackptr - numstack), numstackptr->val);
-                        goto num;
+                        if (!expr) /* example: $((10#)) */
+                                goto syntax_err;
+                        /* A number can't be followed by another number, or a variable name.
+                         * We'd catch this later anyway, but this would require numstack[]
+                         * to be ~twice as deep to handle strings where _every_ char is
+                         * a new number or name.
+                         * Examples: "09" is two numbers, "0v" is number and name.
+                         */
+                        if (isalnum(*expr) || *expr == '_')
+                                goto syntax_err;
+                        goto push_value;
                }
                /* Should be an operator */
@@ -671,10 +788,11 @@ evaluate_string(arith_state_t *math_state, const char *expr)
                if ((expr[0] == '+' || expr[0] == '-')
                 && (expr[1] == expr[0])
                ) {
-                        if (numstackptr == numstack || !numstackptr[-1].var) { /* not a VAR++ */
+                        if (numstackptr == numstack || NOT_NAME(numstackptr[-1].var_name)) {
+                                /* not a VAR++ */
                                char next = skip_whitespace(expr + 2)[0];
-                                if (!(isalpha(next) || next == '_')) { /* not a ++VAR */
+                                if (!(isalpha(next) || next == '_')) {
-                                        //bb_error_msg("special %c%c", expr[0], expr[0]);
+                                        /* not a ++VAR */
                                        op = (expr[0] == '+' ? TOK_ADD : TOK_SUB);
                                        expr++;
                                        goto tok_found1;
@@ -704,27 +822,41 @@ evaluate_string(arith_state_t *math_state, const char *expr)
                        if (*p == '\0') {
                                /* No next element, operator not found */
                                //math_state->syntax_error_at = expr;
-                                goto err;
+                                goto syntax_err;
                        }
                }
+                /* NB: expr now points past the operator */
 tok_found:
                op = p[1]; /* fetch TOK_foo value */
- tok_found1:
-                /* NB: expr now points past the operator */
-                /* post grammar: a++ reduce to num */
+                /* Special rule for "? EXPR :"
-                if (lasttok == TOK_POST_INC || lasttok == TOK_POST_DEC)
+                 * "EXPR in the middle of ? : is parsed as if parenthesized"
-                        lasttok = TOK_NUM;
+                 * (this quirk originates in C grammar, I think).
+                 */
+                if (op == TOK_CONDITIONAL) {
+                        insert_op = TOK_LPAREN;
+                        dbg("insert_op=%02x", insert_op);
+                }
+                if (op == TOK_CONDITIONAL_SEP) {
+                        insert_op = op;
+                        op = TOK_RPAREN;
+                        dbg("insert_op=%02x op=%02x", insert_op, op);
+                }
+ tok_found1:
+                /* NAME++ is a "value" (something suitable for a binop) */
+                if (PREC(lasttok) == PREC_POST)
+                        lasttok = TOK_VALUE;
                /* Plus and minus are binary (not unary) _only_ if the last
-                 * token was a number, or a right paren (which pretends to be
+                 * token was a "value". Think about it. It makes sense.
-                 * a number, since it evaluates to one). Think about it.
+                 */
-                 * It makes sense. */
+                if (lasttok != TOK_VALUE) {
-                if (lasttok != TOK_NUM) {
                        switch (op) {
                        case TOK_ADD:
-                                op = TOK_UPLUS;
+                                //op = TOK_UPLUS;
-                                break;
+                                //break;
+                                /* Unary plus does nothing, do not even push it to opstack */
+                                continue;
                        case TOK_SUB:
                                op = TOK_UMINUS;
                                break;
@@ -744,80 +876,137 @@ evaluate_string(arith_state_t *math_state, const char *expr)
                 * stack until we find an operator with a lesser priority than the
                 * one we have just extracted. If op is right-associative,
                 * then stop "applying" on the equal priority too.
-                 * Left paren is given the lowest priority so it will never be
+                 * Left paren will never be "applied" in this way.
-                 * "applied" in this way.
                 */
                prec = PREC(op);
-//bb_error_msg("prec:%02x", prec);
+                if (prec != PREC_LPAREN && prec < UNARYPREC) {
-                if ((prec > 0 && prec < UNARYPREC) || prec == SPEC_PREC) {
+                        /* Binary, ternary or RPAREN */
-                        /* not left paren or unary */
+                        if (lasttok != TOK_VALUE) {
-                        if (lasttok != TOK_NUM) {
+                                /* Must be preceded by a value.
-                                /* binary op must be preceded by a num */
+                                 * $((2 2 + * 3)) would be accepted without this.
-                                goto err;
+                                 */
+                                goto syntax_err;
                        }
-                        /* The algorithm employed here is simple: while we don't
+                        /* if op is RPAREN:
-                         * hit an open paren nor the bottom of the stack, pop
+                         *     while opstack is not empty:
-                         * tokens and apply them */
+                         *         pop prev_op
-                        while (stackptr != stack) {
+                         *         if prev_op is LPAREN (finished evaluating (EXPR)):
-                                operator prev_op = *--stackptr;
+                         *             goto N
+                         *         evaluate prev_op on top of numstack
+                         *     BUG (unpaired RPAREN)
+                         * else (op is not RPAREN):
+                         *     while opstack is not empty:
+                         *         pop prev_op
+                         *         if can't evaluate prev_op (it is lower precedence than op):
+                         *             push prev_op back
+                         *             goto C
+                         *         evaluate prev_op on top of numstack
+                         *     C:if op is "?": check result, set disable flag if needed
+                         * push op
+                         * N:loop to parse the rest of string
+                         */
+                        while (opstackptr != opstack) {
+                                operator prev_op = *--opstackptr;
                                if (op == TOK_RPAREN) {
-//bb_error_msg("op == TOK_RPAREN");
                                        if (prev_op == TOK_LPAREN) {
-//bb_error_msg("prev_op == TOK_LPAREN");
+                                                /* Erase var name: for example, (VAR) = 1 is not valid */
-//bb_error_msg("  %p %p numstackptr[-1].var:'%s'", numstack, numstackptr-1, numstackptr[-1].var);
+                                                numstackptr[-1].var_name = NULL;
-                                                if (numstackptr[-1].var) {
+                                                /* (EXPR) is a "value": next operator directly after
-                                                        /* Expression is (var), lookup now */
+                                                 * close paren should be considered binary
-                                                        errmsg = arith_lookup_val(math_state, &numstackptr[-1]);
+                                                 */
-                                                        if (errmsg)
+                                                lasttok = TOK_VALUE;
-                                                                goto err_with_custom_msg;
-                                                        /* Erase var name: (var) is just a number, for example, (var) = 1 is not valid */
-                                                        numstackptr[-1].var = NULL;
-                                                }
-                                                /* Any operator directly after a
-                                                 * close paren should consider itself binary */
-                                                lasttok = TOK_NUM;
                                                goto next;
                                        }
-//bb_error_msg("prev_op != TOK_LPAREN");
+                                        /* Not (y), but ...x~y). Fall through to evaluate x~y */
                                } else {
                                        operator prev_prec = PREC(prev_op);
-//bb_error_msg("op != TOK_RPAREN");
                                        fix_assignment_prec(prec);
                                        fix_assignment_prec(prev_prec);
                                        if (prev_prec < prec
                                         || (prev_prec == prec && is_right_associative(prec))
                                        ) {
-                                                stackptr++;
+                                                /* ...x~y@. push @ on opstack */
-                                                break;
+                                                opstackptr++; /* undo removal of ~ op */
+                                                goto check_cond;
                                        }
+                                        /* else: ...x~y@. Evaluate x~y, replace it on stack with result. Then repeat */
                                }
-//bb_error_msg("arith_apply(prev_op:%02x)", prev_op);
+                                dbg("arith_apply(prev_op:%02x, numstack:%d)", prev_op, (int)(numstackptr - numstack));
                                errmsg = arith_apply(math_state, prev_op, numstack, &numstackptr);
                                if (errmsg)
                                        goto err_with_custom_msg;
+dbg("    numstack:%d val:%lld '%s'", (int)(numstackptr - numstack), numstackptr[-1].val, numstackptr[-1].var_name);
+                                if (prev_op == TOK_CONDITIONAL_SEP) {
+                                        /* We just executed ":" */
+                                        /* Remove "?" from opstack too, not just ":" */
+                                        opstackptr--;
+                                        if (*opstackptr != TOK_CONDITIONAL) {
+                                                /* Example: $((1,2:3)) */
+                                                errmsg = "malformed ?: operator";
+                                                goto err_with_custom_msg;
+                                        }
+                                        /* Example: a=1?2:3,a. We just executed ":".
+                                         * Prevent assignment from being still disabled.
+                                         */
+                                        if (ternary_level == math_state->evaluation_disabled) {
+                                                math_state->evaluation_disabled = 0;
+                                                dbg("':' executed: evaluation_disabled=CLEAR");
+                                        }
+                                        ternary_level--;
+                                }
+                        } /* while (opstack not empty) */
+                        if (op == TOK_RPAREN) /* unpaired RPAREN? */
+                                goto syntax_err;
+ check_cond:
+                        if (op == TOK_CONDITIONAL) {
+                                /* We just now evaluated EXPR before "?".
+                                 * Should we disable evaluation now?
+                                 */
+                                ternary_level++;
+                                if (numstackptr[-1].val == 0 && !math_state->evaluation_disabled) {
+                                        math_state->evaluation_disabled = ternary_level;
+                                        dbg("'?' entered: evaluation_disabled=%u", math_state->evaluation_disabled);
+                                }
+                        }
+                } /* if */
+                /* else: LPAREN or UNARY: push it on opstack */
+                /* Push this operator to opstack */
+                dbg("(%d) op:%02x insert_op:%02x", (int)(opstackptr - opstack), op, insert_op);
+                *opstackptr++ = lasttok = op;
+ next:
+                if (insert_op != 0xff) {
+                        op = insert_op;
+                        insert_op = 0xff;
+                        dbg("inserting %02x", op);
+                        if (op == TOK_CONDITIONAL_SEP) {
+                                /* The next token is ":". Toggle "do not evaluate" state */
+                                if (!math_state->evaluation_disabled) {
+                                        math_state->evaluation_disabled = ternary_level;
+                                        dbg("':' entered: evaluation_disabled=%u", math_state->evaluation_disabled);
+                                } else if (ternary_level == math_state->evaluation_disabled) {
+                                        math_state->evaluation_disabled = 0;
+                                        dbg("':' entered: evaluation_disabled=CLEAR");
+                                } /* else: ternary_level > evaluation_disabled && evaluation_disabled != 0 */
+                                        /* We are in nested "?:" while in outer "?:" disabled branch */
+                                        /* do_nothing */
                        }
-                        if (op == TOK_RPAREN)
+                        goto tok_found1;
-                                goto err;
                }
-                /* Push this operator to the stack and remember it */
-//bb_error_msg("push op:%02x", op);
-                *stackptr++ = lasttok = op;
- next: ;
        } /* while (1) */
- err:
+ syntax_err:
        errmsg = "arithmetic syntax error";
 err_with_custom_msg:
-        numstack->val = -1;
- ret:
        math_state->errmsg = errmsg;
-        return numstack->val;
+        return -1;
 }
 arith_t FAST_FUNC
 arith(arith_state_t *math_state, const char *expr)
 {
+        math_state->evaluation_disabled = 0;
        math_state->errmsg = NULL;
        math_state->list_of_recursed_names = NULL;
        return evaluate_string(math_state, expr);
diff --git a/shell/math.h b/shell/math.h
index a3fe51b6b..aeb3b93c3 100644
--- a/shell/math.h
+++ b/shell/math.h
@@ -6,7 +6,6 @@
 *
 * See math.c for internal documentation.
 */
 /* The math library has just one function:
 *
 * arith_t arith(arith_state_t *state, const char *expr);
@@ -22,7 +21,6 @@
 * "1 + 2 + 3"
 * you would obviously get back 6.
 */
 /* To add support to a shell, you need to implement three functions:
 *
 * lookupvar() - look up and return the value of a variable
@@ -36,28 +34,12 @@
 * setvar() - set a variable to some value
 *
 *      If the arithmetic expansion does something like:
- *              $(( i = 1))
+ *              $((i = 1))
 *      then the math code will make a call like so:
- *              setvar("i", "1", 0);
+ *              setvar("i", "1");
 *      The storage for the first two parameters are not allocated, so your
 *      shell implementation will most likely need to strdup() them to save.
- *
- * endofname() - return the end of a variable name from input
- *
- *      The arithmetic code does not know about variable naming conventions.
- *      So when it is given an experession, it knows something is not numeric,
- *      but it is up to the shell to dictate what is a valid identifiers.
- *      So when it encounters something like:
- *              $(( some_var + 123 ))
- *      It will make a call like so:
- *              end = endofname("some_var + 123");
- *      So the shell needs to scan the input string and return a pointer to the
- *      first non-identifier string.  In this case, it should return the input
- *      pointer with an offset pointing to the first space.  The typical
- *      implementation will return the offset of first char that does not match
- *      the regex (in C locale): ^[a-zA-Z_][a-zA-Z_0-9]*
 */
 #ifndef SHELL_MATH_H
 #define SHELL_MATH_H 1
@@ -73,14 +55,13 @@ typedef long arith_t;
 typedef const char* FAST_FUNC (*arith_var_lookup_t)(const char *name);
 typedef void        FAST_FUNC (*arith_var_set_t)(const char *name, const char *val);
-//typedef const char* FAST_FUNC (*arith_var_endofname_t)(const char *name);
 typedef struct arith_state_t {
+        unsigned              evaluation_disabled;
        const char           *errmsg;
+        void                 *list_of_recursed_names;
        arith_var_lookup_t    lookupvar;
        arith_var_set_t       setvar;
-//      arith_var_endofname_t endofname;
-        void                 *list_of_recursed_names;
 } arith_state_t;
 arith_t FAST_FUNC arith(arith_state_t *state, const char *expr);
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 657ee9969..da157ea0e 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -22,6 +22,25 @@
 const char defifsvar[] ALIGN1 = "IFS= \t\n";
 const char defoptindvar[] ALIGN1 = "OPTIND=1";
+/* Compare two strings up to the first '=' or '\0'. */
+int FAST_FUNC varcmp(const char *p, const char *q)
+{
+        int c, d;
+        while ((c = *p) == (d = *q)) {
+                if (c == '\0' || c == '=')
+                        goto out;
+                p++;
+                q++;
+        }
+        if (c == '=')
+                c = '\0';
+        if (d == '=')
+                d = '\0';
+ out:
+        return c - d;
+}
 /* read builtin */
 /* Needs to be interruptible: shell must handle traps and shell-special signals
@@ -59,7 +78,7 @@ shell_builtin_read(struct builtin_read_params *params)
        argv = params->argv;
        pp = argv;
        while (*pp) {
-                if (endofname(*pp)[0] != '\0') {
+                if (!*pp[0] || endofname(*pp)[0] != '\0') {
                        /* Mimic bash message */
                        bb_error_msg("read: '%s': bad variable name", *pp);
                        return (const char *)(uintptr_t)1;
diff --git a/shell/shell_common.h b/shell/shell_common.h
index 7b478f1df..fab676e4a 100644
--- a/shell/shell_common.h
+++ b/shell/shell_common.h
@@ -26,6 +26,8 @@ extern const char defifsvar[] ALIGN1; /* "IFS= \t\n" */
 extern const char defoptindvar[] ALIGN1; /* "OPTIND=1" */
+int FAST_FUNC varcmp(const char *p, const char *q);
 /* Builtins */
 struct builtin_read_params {