--- /dev/null
+diff -urpN busybox-1.18.1/shell/hush.c busybox-1.18.1-hush/shell/hush.c
+--- busybox-1.18.1/shell/hush.c 2010-12-21 05:31:04.000000000 +0100
++++ busybox-1.18.1-hush/shell/hush.c 2010-12-21 21:20:02.493651813 +0100
+@@ -913,7 +913,7 @@ static const struct built_in_command blt
+ */
+ #if HUSH_DEBUG
+ /* prevent disasters with G.debug_indent < 0 */
+-# define indent() fprintf(stderr, "%*s", (G.debug_indent * 2) & 0xff, "")
++# define indent() fdprintf(2, "%*s", (G.debug_indent * 2) & 0xff, "")
+ # define debug_enter() (G.debug_indent++)
+ # define debug_leave() (G.debug_indent--)
+ #else
+@@ -923,56 +923,56 @@ static const struct built_in_command blt
+ #endif
+
+ #ifndef debug_printf
+-# define debug_printf(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_parse
+-# define debug_printf_parse(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_parse(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_exec
+-#define debug_printf_exec(...) (indent(), fprintf(stderr, __VA_ARGS__))
++#define debug_printf_exec(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_env
+-# define debug_printf_env(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_env(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_jobs
+-# define debug_printf_jobs(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_jobs(...) (indent(), fdprintf(2, __VA_ARGS__))
+ # define DEBUG_JOBS 1
+ #else
+ # define DEBUG_JOBS 0
+ #endif
+
+ #ifndef debug_printf_expand
+-# define debug_printf_expand(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_expand(...) (indent(), fdprintf(2, __VA_ARGS__))
+ # define DEBUG_EXPAND 1
+ #else
+ # define DEBUG_EXPAND 0
+ #endif
+
+ #ifndef debug_printf_varexp
+-# define debug_printf_varexp(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_varexp(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_glob
+-# define debug_printf_glob(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_glob(...) (indent(), fdprintf(2, __VA_ARGS__))
+ # define DEBUG_GLOB 1
+ #else
+ # define DEBUG_GLOB 0
+ #endif
+
+ #ifndef debug_printf_list
+-# define debug_printf_list(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_list(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_subst
+-# define debug_printf_subst(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_subst(...) (indent(), fdprintf(2, __VA_ARGS__))
+ #endif
+
+ #ifndef debug_printf_clean
+-# define debug_printf_clean(...) (indent(), fprintf(stderr, __VA_ARGS__))
++# define debug_printf_clean(...) (indent(), fdprintf(2, __VA_ARGS__))
+ # define DEBUG_CLEAN 1
+ #else
+ # define DEBUG_CLEAN 0
+@@ -982,9 +982,9 @@ static const struct built_in_command blt
+ static void debug_print_strings(const char *prefix, char **vv)
+ {
+ indent();
+- fprintf(stderr, "%s:\n", prefix);
++ fdprintf(2, "%s:\n", prefix);
+ while (*vv)
+- fprintf(stderr, " '%s'\n", *vv++);
++ fdprintf(2, " '%s'\n", *vv++);
+ }
+ #else
+ # define debug_print_strings(prefix, vv) ((void)0)
+@@ -1416,6 +1416,22 @@ static void hush_exit(int exitcode)
+ builtin_eval(argv);
+ }
+
++#if ENABLE_FEATURE_CLEAN_UP
++ {
++ struct variable *cur_var;
++ if (G.cwd != bb_msg_unknown)
++ free((char*)G.cwd);
++ cur_var = G.top_var;
++ while (cur_var) {
++ struct variable *tmp = cur_var;
++ if (!cur_var->max_len)
++ free(cur_var->varstr);
++ cur_var = cur_var->next;
++ free(tmp);
++ }
++ }
++#endif
++
+ #if ENABLE_HUSH_JOB
+ fflush_all();
+ sigexit(- (exitcode & 0xff));
+@@ -2158,22 +2174,22 @@ static void debug_print_list(const char
+ int i = 0;
+
+ indent();
+- fprintf(stderr, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
++ fdprintf(2, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
+ prefix, list, n, string_start, o->length, o->maxlen,
+ !!(o->o_expflags & EXP_FLAG_GLOB),
+ o->has_quoted_part,
+ !!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+ while (i < n) {
+ indent();
+- fprintf(stderr, " list[%d]=%d '%s' %p\n", i, (int)list[i],
+- o->data + (int)list[i] + string_start,
+- o->data + (int)list[i] + string_start);
++ fdprintf(2, " list[%d]=%d '%s' %p\n", i, (int)(uintptr_t)list[i],
++ o->data + (int)(uintptr_t)list[i] + string_start,
++ o->data + (int)(uintptr_t)list[i] + string_start);
+ i++;
+ }
+ if (n) {
+- const char *p = o->data + (int)list[n - 1] + string_start;
++ const char *p = o->data + (int)(uintptr_t)list[n - 1] + string_start;
+ indent();
+- fprintf(stderr, " total_sz:%ld\n", (long)((p + strlen(p) + 1) - o->data));
++ fdprintf(2, " total_sz:%ld\n", (long)((p + strlen(p) + 1) - o->data));
+ }
+ }
+ #else
+@@ -2672,18 +2688,18 @@ static void debug_print_tree(struct pipe
+
+ pin = 0;
+ while (pi) {
+- fprintf(stderr, "%*spipe %d res_word=%s followup=%d %s\n", lvl*2, "",
++ fdprintf(2, "%*spipe %d res_word=%s followup=%d %s\n", lvl*2, "",
+ pin, RES[pi->res_word], pi->followup, PIPE[pi->followup]);
+ prn = 0;
+ while (prn < pi->num_cmds) {
+ struct command *command = &pi->cmds[prn];
+ char **argv = command->argv;
+
+- fprintf(stderr, "%*s cmd %d assignment_cnt:%d",
++ fdprintf(2, "%*s cmd %d assignment_cnt:%d",
+ lvl*2, "", prn,
+ command->assignment_cnt);
+ if (command->group) {
+- fprintf(stderr, " group %s: (argv=%p)%s%s\n",
++ fdprintf(2, " group %s: (argv=%p)%s%s\n",
+ CMDTYPE[command->cmd_type],
+ argv
+ # if !BB_MMU
+@@ -2697,10 +2713,10 @@ static void debug_print_tree(struct pipe
+ continue;
+ }
+ if (argv) while (*argv) {
+- fprintf(stderr, " '%s'", *argv);
++ fdprintf(2, " '%s'", *argv);
+ argv++;
+ }
+- fprintf(stderr, "\n");
++ fdprintf(2, "\n");
+ prn++;
+ }
+ pi = pi->next;
+@@ -7445,7 +7461,7 @@ int hush_main(int argc, char **argv)
+ unsigned builtin_argc;
+ char **e;
+ struct variable *cur_var;
+- struct variable shell_ver;
++ struct variable *shell_ver;
+
+ INIT_G();
+ if (EXIT_SUCCESS) /* if EXIT_SUCCESS == 0, it is already done */
+@@ -7454,17 +7470,17 @@ int hush_main(int argc, char **argv)
+ G.argv0_for_re_execing = argv[0];
+ #endif
+ /* Deal with HUSH_VERSION */
+- memset(&shell_ver, 0, sizeof(shell_ver));
+- shell_ver.flg_export = 1;
+- shell_ver.flg_read_only = 1;
++ shell_ver = xzalloc(sizeof(*shell_ver));
++ shell_ver->flg_export = 1;
++ shell_ver->flg_read_only = 1;
+ /* Code which handles ${var<op>...} needs writable values for all variables,
+ * therefore we xstrdup: */
+- shell_ver.varstr = xstrdup(hush_version_str),
+- G.top_var = &shell_ver;
++ shell_ver->varstr = xstrdup(hush_version_str);
+ /* Create shell local variables from the values
+ * currently living in the environment */
+ debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
+ unsetenv("HUSH_VERSION"); /* in case it exists in initial env */
++ G.top_var = shell_ver;
+ cur_var = G.top_var;
+ e = environ;
+ if (e) while (*e) {
+@@ -7479,8 +7495,8 @@ int hush_main(int argc, char **argv)
+ e++;
+ }
+ /* (Re)insert HUSH_VERSION into env (AFTER we scanned the env!) */
+- debug_printf_env("putenv '%s'\n", shell_ver.varstr);
+- putenv(shell_ver.varstr);
++ debug_printf_env("putenv '%s'\n", shell_ver->varstr);
++ putenv(shell_ver->varstr);
+
+ /* Export PWD */
+ set_pwd_var(/*exp:*/ 1);
+@@ -7840,18 +7856,6 @@ int hush_main(int argc, char **argv)
+ parse_and_run_file(stdin);
+
+ final_return:
+-#if ENABLE_FEATURE_CLEAN_UP
+- if (G.cwd != bb_msg_unknown)
+- free((char*)G.cwd);
+- cur_var = G.top_var->next;
+- while (cur_var) {
+- struct variable *tmp = cur_var;
+- if (!cur_var->max_len)
+- free(cur_var->varstr);
+- cur_var = cur_var->next;
+- free(tmp);
+- }
+-#endif
+ hush_exit(G.last_exitcode);
+ }
+