hush: replace flag bytes in struct o_string with bit flags
[oweals/busybox.git] / shell / hush.c
index 54aee882ebe912db7ae2849145b7e43102ee3c18..05ac4096fe9fd9bd90b065ac8c4f277aca4b91eb 100644 (file)
@@ -349,7 +349,7 @@ typedef struct nommu_save_t {
 } nommu_save_t;
 #endif
 
-typedef enum reserved_style {
+enum {
        RES_NONE  = 0,
 #if ENABLE_HUSH_IF
        RES_IF    ,
@@ -378,7 +378,13 @@ typedef enum reserved_style {
 #endif
        RES_XXXX  ,
        RES_SNTX
-} reserved_style;
+};
+
+enum {
+       EXP_FLAG_GLOB = 0x200,
+       EXP_FLAG_ESC_GLOB_CHARS = 0x100,
+       EXP_FLAG_SINGLEWORD = 0x80, /* must be 0x80 */
+};
 
 typedef struct o_string {
        char *data;
@@ -386,8 +392,7 @@ typedef struct o_string {
        int maxlen;
        /* Protect newly added chars against globbing
         * (by prepending \ to *, ?, [, \) */
-       smallint o_escape;
-       smallint o_glob;
+       int o_expflags;
        /* At least some part of the string was inside '' or "",
         * possibly empty one: word"", wo''rd etc. */
        smallint has_quoted_part;
@@ -1344,11 +1349,14 @@ static void hush_exit(int exitcode)
                /* Prevent recursion:
                 * trap "echo Hi; exit" EXIT; exit
                 */
-               char *argv[] = { NULL, G.traps[0], NULL };
+               char *argv[3];
+               /* argv[0] is unused */
+               argv[1] = G.traps[0];
+               argv[2] = NULL;
                G.traps[0] = NULL;
                G.exiting = 1;
                builtin_eval(argv);
-               free(argv[1]);
+               /* free(argv[1]); - why bother */
        }
 
 #if ENABLE_HUSH_JOB
@@ -1376,10 +1384,12 @@ static int check_and_run_traps(int sig)
                if (G.traps && G.traps[sig]) {
                        if (G.traps[sig][0]) {
                                /* We have user-defined handler */
-                               char *argv[] = { NULL, xstrdup(G.traps[sig]), NULL };
+                               char *argv[3];
+                               /* argv[0] is unused */
+                               argv[1] = G.traps[sig];
+                               argv[2] = NULL;
                                save_rcode = G.last_exitcode;
                                builtin_eval(argv);
-                               free(argv[1]);
                                G.last_exitcode = save_rcode;
                        } /* else: "" trap, ignoring signal */
                        continue;
@@ -1439,13 +1449,11 @@ static const char *get_cwd(int force)
 /*
  * Shell and environment variable support
  */
-static struct variable **get_ptr_to_local_var(const char *name)
+static struct variable **get_ptr_to_local_var(const char *name, unsigned len)
 {
        struct variable **pp;
        struct variable *cur;
-       int len;
 
-       len = strlen(name);
        pp = &G.top_var;
        while ((cur = *pp) != NULL) {
                if (strncmp(cur->varstr, name, len) == 0 && cur->varstr[len] == '=')
@@ -1455,21 +1463,13 @@ static struct variable **get_ptr_to_local_var(const char *name)
        return NULL;
 }
 
-static struct variable *get_local_var(const char *name)
-{
-       struct variable **pp = get_ptr_to_local_var(name);
-       if (pp)
-               return *pp;
-       return NULL;
-}
-
 static const char* FAST_FUNC get_local_var_value(const char *name)
 {
        struct variable **vpp;
+       unsigned len = strlen(name);
 
        if (G.expanded_assignments) {
                char **cpp = G.expanded_assignments;
-               int len = strlen(name);
                while (*cpp) {
                        char *cp = *cpp;
                        if (strncmp(cp, name, len) == 0 && cp[len] == '=')
@@ -1478,17 +1478,16 @@ static const char* FAST_FUNC get_local_var_value(const char *name)
                }
        }
 
-       vpp = get_ptr_to_local_var(name);
+       vpp = get_ptr_to_local_var(name, len);
        if (vpp)
-               return strchr((*vpp)->varstr, '=') + 1;
+               return (*vpp)->varstr + len + 1;
 
        if (strcmp(name, "PPID") == 0)
                return utoa(G.root_ppid);
        // bash compat: UID? EUID?
 #if ENABLE_HUSH_RANDOM_SUPPORT
-       if (strcmp(name, "RANDOM") == 0) {
+       if (strcmp(name, "RANDOM") == 0)
                return utoa(next_random(&G.random_gen));
-       }
 #endif
        return NULL;
 }
@@ -1677,24 +1676,6 @@ static void unset_vars(char **strings)
        free(strings);
 }
 
-#if ENABLE_SH_MATH_SUPPORT
-# define is_name(c)      ((c) == '_' || isalpha((unsigned char)(c)))
-# define is_in_name(c)   ((c) == '_' || isalnum((unsigned char)(c)))
-static char* FAST_FUNC endofname(const char *name)
-{
-       char *p;
-
-       p = (char *) name;
-       if (!is_name(*p))
-               return p;
-       while (*++p) {
-               if (!is_in_name(*p))
-                       break;
-       }
-       return p;
-}
-#endif
-
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
        char *var = xasprintf("%s=%s", name, val);
@@ -1738,9 +1719,7 @@ static struct variable *set_vars_and_save_old(char **strings)
 
                eq = strchr(*s, '=');
                if (eq) {
-                       *eq = '\0';
-                       var_pp = get_ptr_to_local_var(*s);
-                       *eq = '=';
+                       var_pp = get_ptr_to_local_var(*s, eq - *s);
                        if (var_pp) {
                                /* Remove variable from global linked list */
                                var_p = *var_pp;
@@ -2061,7 +2040,9 @@ static void o_addqchr(o_string *o, int ch)
 static void o_addQchr(o_string *o, int ch)
 {
        int sz = 1;
-       if (o->o_escape && strchr("*?[\\" MAYBE_BRACES, ch)) {
+       if ((o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)
+        && strchr("*?[\\" MAYBE_BRACES, ch)
+       ) {
                sz++;
                o->data[o->length] = '\\';
                o->length++;
@@ -2102,7 +2083,7 @@ static void o_addqblock(o_string *o, const char *str, int len)
 
 static void o_addQblock(o_string *o, const char *str, int len)
 {
-       if (!o->o_escape) {
+       if (!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)) {
                o_addblock(o, str, len);
                return;
        }
@@ -2133,7 +2114,10 @@ static void debug_print_list(const char *prefix, o_string *o, int n)
 
        indent();
        fprintf(stderr, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
-                       prefix, list, n, string_start, o->length, o->maxlen, o->o_glob, o->has_quoted_part, o->o_escape);
+                       prefix, list, n, string_start, o->length, o->maxlen,
+                       !!(o->o_expflags & EXP_FLAG_GLOB),
+                       o->has_quoted_part,
+                       !!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
        while (i < n) {
                indent();
                fprintf(stderr, " list[%d]=%d '%s' %p\n", i, (int)list[i],
@@ -2471,11 +2455,11 @@ static int perform_glob(o_string *o, int n)
 
 #endif /* !HUSH_BRACE_EXP */
 
-/* If o->o_glob == 1, glob the string so far remembered.
+/* If o->o_expflags & EXP_FLAG_GLOB, glob the string so far remembered.
  * Otherwise, just finish current list[] and start new */
 static int o_save_ptr(o_string *o, int n)
 {
-       if (o->o_glob) { /* if globbing is requested */
+       if (o->o_expflags & EXP_FLAG_GLOB) {
                /* If o->has_empty_slot, list[n] was already globbed
                 * (if it was requested back then when it was filled)
                 * so don't do that again! */
@@ -2500,33 +2484,36 @@ static char **o_finalize_list(o_string *o, int n)
        list[--n] = NULL;
        while (n) {
                n--;
-               list[n] = o->data + (int)(ptrdiff_t)list[n] + string_start;
+               list[n] = o->data + (int)(uintptr_t)list[n] + string_start;
        }
        return list;
 }
 
-static void free_pipe_list(struct pipe *head);
+static void free_pipe_list(struct pipe *pi);
 
-/* Return code is the exit status of the pipe */
-static void free_pipe(struct pipe *pi)
+/* Returns pi->next - next pipe in the list */
+static struct pipe *free_pipe(struct pipe *pi)
 {
-       char **p;
-       struct command *command;
-       struct redir_struct *r, *rnext;
-       int a, i;
+       struct pipe *next;
+       int i;
 
-       if (pi->stopped_cmds > 0) /* why? */
-               return;
-       debug_printf_clean("run pipe: (pid %d)\n", getpid());
+       debug_printf_clean("free_pipe (pid %d)\n", getpid());
        for (i = 0; i < pi->num_cmds; i++) {
+               struct command *command;
+               struct redir_struct *r, *rnext;
+
                command = &pi->cmds[i];
                debug_printf_clean("  command %d:\n", i);
                if (command->argv) {
-                       for (a = 0, p = command->argv; *p; a++, p++) {
-                               debug_printf_clean("   argv[%d] = %s\n", a, *p);
+                       if (DEBUG_CLEAN) {
+                               int a;
+                               char **p;
+                               for (a = 0, p = command->argv; *p; a++, p++) {
+                                       debug_printf_clean("   argv[%d] = %s\n", a, *p);
+                               }
                        }
                        free_strings(command->argv);
-                       command->argv = NULL;
+                       //command->argv = NULL;
                }
                /* not "else if": on syntax error, we may have both! */
                if (command->group) {
@@ -2534,7 +2521,7 @@ static void free_pipe(struct pipe *pi)
                                        command->cmd_type);
                        free_pipe_list(command->group);
                        debug_printf_clean("   end group\n");
-                       command->group = NULL;
+                       //command->group = NULL;
                }
                /* else is crucial here.
                 * If group != NULL, child_func is meaningless */
@@ -2546,7 +2533,7 @@ static void free_pipe(struct pipe *pi)
 #endif
 #if !BB_MMU
                free(command->group_as_string);
-               command->group_as_string = NULL;
+               //command->group_as_string = NULL;
 #endif
                for (r = command->redirects; r; r = rnext) {
                        debug_printf_clean("   redirect %d%s",
@@ -2555,35 +2542,34 @@ static void free_pipe(struct pipe *pi)
                        if (r->rd_filename) {
                                debug_printf_clean(" fname:'%s'\n", r->rd_filename);
                                free(r->rd_filename);
-                               r->rd_filename = NULL;
+                               //r->rd_filename = NULL;
                        }
                        debug_printf_clean(" rd_dup:%d\n", r->rd_dup);
                        rnext = r->next;
                        free(r);
                }
-               command->redirects = NULL;
+               //command->redirects = NULL;
        }
        free(pi->cmds);   /* children are an array, they get freed all at once */
-       pi->cmds = NULL;
+       //pi->cmds = NULL;
 #if ENABLE_HUSH_JOB
        free(pi->cmdtext);
-       pi->cmdtext = NULL;
+       //pi->cmdtext = NULL;
 #endif
+
+       next = pi->next;
+       free(pi);
+       return next;
 }
 
-static void free_pipe_list(struct pipe *head)
+static void free_pipe_list(struct pipe *pi)
 {
-       struct pipe *pi, *next;
-
-       for (pi = head; pi; pi = next) {
+       while (pi) {
 #if HAS_KEYWORDS
-               debug_printf_clean(" pipe reserved word %d\n", pi->res_word);
+               debug_printf_clean("pipe reserved word %d\n", pi->res_word);
 #endif
-               free_pipe(pi);
                debug_printf_clean("pipe followup code %d\n", pi->followup);
-               next = pi->next;
-               /*pi->next = NULL;*/
-               free(pi);
+               pi = free_pipe(pi);
        }
 }
 
@@ -3547,7 +3533,7 @@ static int parse_dollar(o_string *as_string,
                struct in_str *input)
 {
        int ch = i_peek(input);  /* first character after the $ */
-       unsigned char quote_mask = dest->o_escape ? 0x80 : 0;
+       unsigned char quote_mask = (dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS) ? 0x80 : 0;
 
        debug_printf_parse("parse_dollar entered: ch='%c'\n", ch);
        if (isalpha(ch)) {
@@ -3763,7 +3749,7 @@ static int parse_stream_dquoted(o_string *as_string,
                nommu_addchr(as_string, ch);
        if (ch == dquote_end) { /* may be only '"' or EOF */
                if (dest->o_assignment == NOT_ASSIGNMENT)
-                       dest->o_escape ^= 1;
+                       dest->o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
                debug_printf_parse("parse_stream_dquoted return 0\n");
                return 0;
        }
@@ -3777,7 +3763,7 @@ static int parse_stream_dquoted(o_string *as_string,
                next = i_peek(input);
        }
        debug_printf_parse("\" ch=%c (%d) escape=%d\n",
-                                       ch, ch, dest->o_escape);
+                       ch, ch, !!(dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
        if (ch == '\\') {
                if (next == EOF) {
                        syntax_error("\\<eof>");
@@ -3852,7 +3838,7 @@ static struct pipe *parse_stream(char **pstring,
 
        /* Double-quote state is handled in the state variable is_in_dquote.
         * A single-quote triggers a bypass of the main loop until its mate is
-        * found.  When recursing, quote state is passed in via dest->o_escape.
+        * found.  When recursing, quote state is passed in via dest->o_expflags.
         */
        debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
                        end_trigger ? end_trigger : 'X');
@@ -3863,10 +3849,10 @@ static struct pipe *parse_stream(char **pstring,
        o_addchr(&dest, '\0');
        dest.length = 0;
 
-       G.ifs = get_local_var_value("IFS");
-       if (G.ifs == NULL)
-               G.ifs = defifs;
-
+       /* We used to separate words on $IFS here. This was wrong.
+        * $IFS is used only for word splitting when $var is expanded,
+        * here we should use blank chars as separators, not $iFS
+        */
  reset:
 #if ENABLE_HUSH_INTERACTIVE
        input->promptmode = 0; /* PS1 */
@@ -3876,7 +3862,7 @@ static struct pipe *parse_stream(char **pstring,
        is_in_dquote = 0;
        heredoc_cnt = 0;
        while (1) {
-               const char *is_ifs;
+               const char *is_blank;
                const char *is_special;
                int ch;
                int next;
@@ -3893,7 +3879,7 @@ static struct pipe *parse_stream(char **pstring,
                }
                ch = i_getch(input);
                debug_printf_parse(": ch=%c (%d) escape=%d\n",
-                                               ch, ch, dest.o_escape);
+                               ch, ch, !!(dest.o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                if (ch == EOF) {
                        struct pipe *pi;
 
@@ -3946,20 +3932,20 @@ static struct pipe *parse_stream(char **pstring,
                if (ctx.command->argv /* word [word]{... - non-special */
                 || dest.length       /* word{... - non-special */
                 || dest.has_quoted_part     /* ""{... - non-special */
-                || (next != ';'            /* }; - special */
-                   && next != ')'          /* }) - special */
-                   && next != '&'          /* }& and }&& ... - special */
-                   && next != '|'          /* }|| ... - special */
-                   && !strchr(G.ifs, next) /* {word - non-special */
+                || (next != ';'             /* }; - special */
+                   && next != ')'           /* }) - special */
+                   && next != '&'           /* }& and }&& ... - special */
+                   && next != '|'           /* }|| ... - special */
+                   && !strchr(defifs, next) /* {word - non-special */
                    )
                ) {
                        /* They are not special, skip "{}" */
                        is_special += 2;
                }
                is_special = strchr(is_special, ch);
-               is_ifs = strchr(G.ifs, ch);
+               is_blank = strchr(defifs, ch);
 
-               if (!is_special && !is_ifs) { /* ordinary char */
+               if (!is_special && !is_blank) { /* ordinary char */
  ordinary_char:
                        o_addQchr(&dest, ch);
                        if ((dest.o_assignment == MAYBE_ASSIGNMENT
@@ -3972,7 +3958,7 @@ static struct pipe *parse_stream(char **pstring,
                        continue;
                }
 
-               if (is_ifs) {
+               if (is_blank) {
                        if (done_word(&dest, &ctx)) {
                                goto parse_error;
                        }
@@ -3997,7 +3983,7 @@ static struct pipe *parse_stream(char **pstring,
                                }
                                dest.o_assignment = MAYBE_ASSIGNMENT;
                                ch = ';';
-                               /* note: if (is_ifs) continue;
+                               /* note: if (is_blank) continue;
                                 * will still trigger for us */
                        }
                }
@@ -4065,7 +4051,7 @@ static struct pipe *parse_stream(char **pstring,
                        }
                }
  skip_end_trigger:
-               if (is_ifs)
+               if (is_blank)
                        continue;
 
                /* Catch <, > before deciding whether this word is
@@ -4192,7 +4178,7 @@ static struct pipe *parse_stream(char **pstring,
                        dest.has_quoted_part = 1;
                        is_in_dquote ^= 1; /* invert */
                        if (dest.o_assignment == NOT_ASSIGNMENT)
-                               dest.o_escape ^= 1;
+                               dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
                        break;
 #if ENABLE_HUSH_TICK
                case '`': {
@@ -4372,7 +4358,7 @@ static int process_command_subs(o_string *dest, const char *s);
  * of strings. (Think VAR="a b"; echo $VAR).
  * This new list is allocated as a single malloc block.
  * NULL-terminated list of char* pointers is at the beginning of it,
- * followed by strings themself.
+ * followed by strings themselves.
  * Caller can deallocate entire list by single free(list). */
 
 /* Store given string, finalizing the word and starting new one whenever
@@ -4383,9 +4369,9 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
        while (1) {
                int word_len = strcspn(str, G.ifs);
                if (word_len) {
-                       if (output->o_escape)
+                       if (output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)
                                o_addqblock(output, str, word_len);
-                       else if (!output->o_glob)
+                       else if (!(output->o_expflags & EXP_FLAG_GLOB))
                                o_addblock(output, str, word_len);
                        else /* if (!escape && glob) */ {
                                /* Protect backslashes against globbing up :)
@@ -4452,7 +4438,7 @@ static arith_t expand_and_evaluate_arith(const char *arg, int *errcode_p)
 
        hooks.lookupvar = get_local_var_value;
        hooks.setvar = set_local_var_from_halves;
-       hooks.endofname = endofname;
+       //hooks.endofname = endofname;
        exp_str = expand_pseudo_dquoted(arg);
        res = arith(exp_str ? exp_str : arg, errcode_p, &hooks);
        free(exp_str);
@@ -4529,18 +4515,20 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
        char *exp_saveptr; /* points to expansion operator */
        char *exp_word = exp_word; /* for compiler */
 
+       *p = '\0'; /* replace trailing SPECIAL_VAR_SYMBOL */
        var = arg;
-       *p = '\0';
        exp_saveptr = arg[1] ? strchr(VAR_ENCODED_SUBST_OPS, arg[1]) : NULL;
        first_char = arg[0] = first_ch & 0x7f;
        exp_op = 0;
 
-       if (first_char == '#' && arg[1] && !exp_saveptr) {
-               /* handle length expansion ${#var} */
+       if (first_char == '#'      /* ${#... */
+        && arg[1] && !exp_saveptr /* not ${#} and not ${#<op_char>...} */
+       ) {
+               /* It must be length operator: ${#var} */
                var++;
                exp_op = 'L';
        } else {
-               /* maybe handle parameter expansion */
+               /* Maybe handle parameter expansion */
                if (exp_saveptr /* if 2nd char is one of expansion operators */
                 && strchr(NUMERIC_SPECVARS_STR, first_char) /* 1st char is special variable */
                ) {
@@ -4555,8 +4543,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                        exp_word = exp_saveptr + 1;
                        if (exp_op == ':') {
                                exp_op = *exp_word++;
+//TODO: try ${var:} and ${var:bogus} in non-bash config
                                if (ENABLE_HUSH_BASH_COMPAT
-                                && (exp_op == '\0' || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
+                                && (!exp_op || !strchr(MINUS_PLUS_EQUAL_QUESTION, exp_op))
                                ) {
                                        /* oops... it's ${var:N[:M]}, not ${var:?xxx} or some such */
                                        exp_op = ':';
@@ -4567,7 +4556,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                } /* else: it's not an expansion op, but bare ${var} */
        }
 
-       /* lookup the variable in question */
+       /* Look up the variable in question */
        if (isdigit(var[0])) {
                /* parse_dollar() should have vetted var for us */
                int n = xatoi_positive(var);
@@ -4646,7 +4635,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                /* It's ${var/[/]pattern[/repl]} thing */
                                /*
                                 * Pattern is taken literally, while
-                                * repl should be de-backslased and globbed
+                                * repl should be unbackslashed and globbed
                                 * by the usual expansion rules:
                                 * >az; >bz;
                                 * v='a bz'; echo "${v/a*z/a*z}" prints "a*z"
@@ -4840,9 +4829,9 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                        i = 1;
                        ored_ch |= first_ch; /* do it for "$@" _now_, when we know it's not empty */
                        if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
-                               smallint sv = output->o_escape;
+                               int sv = output->o_expflags;
                                /* unquoted var's contents should be globbed, so don't escape */
-                               output->o_escape = 0;
+                               output->o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
                                while (G.global_argv[i]) {
                                        n = expand_on_ifs(output, n, G.global_argv[i]);
                                        debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, G.global_argc - 1);
@@ -4855,7 +4844,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                                                debug_print_list("expand_vars_to_list[3]", output, n);
                                        }
                                }
-                               output->o_escape = sv;
+                               output->o_expflags = sv;
                        } else
                        /* If or_mask is nonzero, we handle assignment 'a=....$@.....'
                         * and in this case should treat it like '$*' - see 'else...' below */
@@ -4932,17 +4921,19 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
                        val = expand_one_var(&to_be_freed, arg, &p, first_ch);
  IF_HUSH_TICK(store_val:)
                        if (!(first_ch & 0x80)) { /* unquoted $VAR */
-                               debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val, output->o_escape);
+                               debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
+                                               !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                                if (val && val[0]) {
                                        /* unquoted var's contents should be globbed, so don't escape */
-                                       smallint sv = output->o_escape;
-                                       output->o_escape = 0;
+                                       int sv = output->o_expflags;
+                                       output->o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
                                        n = expand_on_ifs(output, n, val);
                                        val = NULL;
-                                       output->o_escape = sv;
+                                       output->o_expflags = sv;
                                }
                        } else { /* quoted $VAR, val will be appended below */
-                               debug_printf_expand("quoted '%s', output->o_escape:%d\n", val, output->o_escape);
+                               debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
+                                               !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
                        }
                        break;
 
@@ -4981,21 +4972,13 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg, char
        return n;
 }
 
-enum {
-       EXPVAR_FLAG_GLOB = 0x200,
-       EXPVAR_FLAG_ESCAPE_VARS = 0x100,
-       EXPVAR_FLAG_SINGLEWORD = 0x80, /* must be 0x80 */
-};
 static char **expand_variables(char **argv, unsigned or_mask)
 {
        int n;
        char **list;
        o_string output = NULL_O_STRING;
 
-       /* protect against globbing for "$var"? */
-       /* (unquoted $var will temporarily switch it off) */
-       output.o_escape = 1 & (or_mask / EXPVAR_FLAG_ESCAPE_VARS);
-       output.o_glob = 1 & (or_mask / EXPVAR_FLAG_GLOB);
+       output.o_expflags = or_mask;
 
        n = 0;
        while (*argv) {
@@ -5012,19 +4995,22 @@ static char **expand_variables(char **argv, unsigned or_mask)
 
 static char **expand_strvec_to_strvec(char **argv)
 {
-       return expand_variables(argv, EXPVAR_FLAG_GLOB | EXPVAR_FLAG_ESCAPE_VARS);
+       return expand_variables(argv, EXP_FLAG_GLOB | EXP_FLAG_ESC_GLOB_CHARS);
 }
 
 #if ENABLE_HUSH_BASH_COMPAT
 static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 {
-       return expand_variables(argv, EXPVAR_FLAG_SINGLEWORD);
+       return expand_variables(argv, EXP_FLAG_SINGLEWORD);
 }
 #endif
 
-/* Used for expansion of right hand of assignments */
-/* NB: should NOT do globbing!
- * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*" */
+/* Used for expansion of right hand of assignments,
+ * $((...)), heredocs, variable espansion parts.
+ *
+ * NB: should NOT do globbing!
+ * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*"
+ */
 static char *expand_string_to_string(const char *str)
 {
        char *argv[2], **list;
@@ -5041,7 +5027,7 @@ static char *expand_string_to_string(const char *str)
 
        argv[0] = (char*)str;
        argv[1] = NULL;
-       list = expand_variables(argv, EXPVAR_FLAG_ESCAPE_VARS | EXPVAR_FLAG_SINGLEWORD);
+       list = expand_variables(argv, EXP_FLAG_ESC_GLOB_CHARS | EXP_FLAG_SINGLEWORD);
        if (HUSH_DEBUG)
                if (!list[0] || list[1])
                        bb_error_msg_and_die("BUG in varexp2");
@@ -5057,7 +5043,7 @@ static char* expand_strvec_to_string(char **argv)
 {
        char **list;
 
-       list = expand_variables(argv, EXPVAR_FLAG_SINGLEWORD);
+       list = expand_variables(argv, EXP_FLAG_SINGLEWORD);
        /* Convert all NULs to spaces */
        if (list[0]) {
                int n = 1;
@@ -6184,15 +6170,13 @@ static void remove_bg_job(struct pipe *pi)
 static void delete_finished_bg_job(struct pipe *pi)
 {
        remove_bg_job(pi);
-       pi->stopped_cmds = 0;
        free_pipe(pi);
-       free(pi);
 }
 #endif /* JOB */
 
 /* Check to see if any processes have exited -- if they
  * have, figure out why and see if a job has completed */
-static int checkjobs(struct pipefg_pipe)
+static int checkjobs(struct pipe *fg_pipe)
 {
        int attributes;
        int status;
@@ -6439,6 +6423,13 @@ static NOINLINE int run_pipe(struct pipe *pi)
        debug_printf_exec("run_pipe start: members:%d\n", pi->num_cmds);
        debug_enter();
 
+       /* Testcase: set -- q w e; (IFS='' echo "$*"; IFS=''; echo "$*"); echo "$*"
+        * Result should be 3 lines: q w e, qwe, q w e
+        */
+       G.ifs = get_local_var_value("IFS");
+       if (!G.ifs)
+               G.ifs = defifs;
+
        IF_HUSH_JOB(pi->pgrp = -1;)
        pi->stopped_cmds = 0;
        command = &pi->cmds[0];
@@ -6885,7 +6876,7 @@ static int run_list(struct pipe *pi)
        enum { cond_code = 0 };
 #endif
 #if HAS_KEYWORDS
-       smallint rword; /* enum reserved_style */
+       smallint rword;      /* RES_foo */
        smallint last_rword; /* ditto */
 #endif
 
@@ -7879,13 +7870,16 @@ static void helper_export_local(char **argv, int exp, int lvl)
 {
        do {
                char *name = *argv;
+               char *name_end = strchrnul(name, '=');
 
                /* So far we do not check that name is valid (TODO?) */
 
-               if (strchr(name, '=') == NULL) {
-                       struct variable *var;
+               if (*name_end == '\0') {
+                       struct variable *var, **vpp;
+
+                       vpp = get_ptr_to_local_var(name, name_end - name);
+                       var = vpp ? *vpp : NULL;
 
-                       var = get_local_var(name);
                        if (exp == -1) { /* unexporting? */
                                /* export -n NAME (without =VALUE) */
                                if (var) {