diff -urpN busybox-1.18.1/shell/hush.c busybox-1.18.1-hush/shell/hush.c
--- busybox-1.18.1/shell/hush.c	2010-12-21 05:31:04.000000000 +0100
+++ busybox-1.18.1-hush/shell/hush.c	2010-12-21 21:20:02.493651813 +0100
@@ -913,7 +913,7 @@ static const struct built_in_command blt
  */
 #if HUSH_DEBUG
 /* prevent disasters with G.debug_indent < 0 */
-# define indent() fprintf(stderr, "%*s", (G.debug_indent * 2) & 0xff, "")
+# define indent() fdprintf(2, "%*s", (G.debug_indent * 2) & 0xff, "")
 # define debug_enter() (G.debug_indent++)
 # define debug_leave() (G.debug_indent--)
 #else
@@ -923,56 +923,56 @@ static const struct built_in_command blt
 #endif
 
 #ifndef debug_printf
-# define debug_printf(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_parse
-# define debug_printf_parse(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_parse(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_exec
-#define debug_printf_exec(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#define debug_printf_exec(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_env
-# define debug_printf_env(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_env(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_jobs
-# define debug_printf_jobs(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_jobs(...) (indent(), fdprintf(2, __VA_ARGS__))
 # define DEBUG_JOBS 1
 #else
 # define DEBUG_JOBS 0
 #endif
 
 #ifndef debug_printf_expand
-# define debug_printf_expand(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_expand(...) (indent(), fdprintf(2, __VA_ARGS__))
 # define DEBUG_EXPAND 1
 #else
 # define DEBUG_EXPAND 0
 #endif
 
 #ifndef debug_printf_varexp
-# define debug_printf_varexp(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_varexp(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_glob
-# define debug_printf_glob(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_glob(...) (indent(), fdprintf(2, __VA_ARGS__))
 # define DEBUG_GLOB 1
 #else
 # define DEBUG_GLOB 0
 #endif
 
 #ifndef debug_printf_list
-# define debug_printf_list(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_list(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_subst
-# define debug_printf_subst(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_subst(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
 #ifndef debug_printf_clean
-# define debug_printf_clean(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define debug_printf_clean(...) (indent(), fdprintf(2, __VA_ARGS__))
 # define DEBUG_CLEAN 1
 #else
 # define DEBUG_CLEAN 0
@@ -982,9 +982,9 @@ static const struct built_in_command blt
 static void debug_print_strings(const char *prefix, char **vv)
 {
 	indent();
-	fprintf(stderr, "%s:\n", prefix);
+	fdprintf(2, "%s:\n", prefix);
 	while (*vv)
-		fprintf(stderr, " '%s'\n", *vv++);
+		fdprintf(2, " '%s'\n", *vv++);
 }
 #else
 # define debug_print_strings(prefix, vv) ((void)0)
@@ -1416,6 +1416,22 @@ static void hush_exit(int exitcode)
 		builtin_eval(argv);
 	}
 
+#if ENABLE_FEATURE_CLEAN_UP
+	{
+		struct variable *cur_var;
+		if (G.cwd != bb_msg_unknown)
+			free((char*)G.cwd);
+		cur_var = G.top_var;
+		while (cur_var) {
+			struct variable *tmp = cur_var;
+			if (!cur_var->max_len)
+				free(cur_var->varstr);
+			cur_var = cur_var->next;
+			free(tmp);
+		}
+	}
+#endif
+
 #if ENABLE_HUSH_JOB
 	fflush_all();
 	sigexit(- (exitcode & 0xff));
@@ -2158,22 +2174,22 @@ static void debug_print_list(const char 
 	int i = 0;
 
 	indent();
-	fprintf(stderr, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
+	fdprintf(2, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
 			prefix, list, n, string_start, o->length, o->maxlen,
 			!!(o->o_expflags & EXP_FLAG_GLOB),
 			o->has_quoted_part,
 			!!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
 	while (i < n) {
 		indent();
-		fprintf(stderr, " list[%d]=%d '%s' %p\n", i, (int)list[i],
-				o->data + (int)list[i] + string_start,
-				o->data + (int)list[i] + string_start);
+		fdprintf(2, " list[%d]=%d '%s' %p\n", i, (int)(uintptr_t)list[i],
+				o->data + (int)(uintptr_t)list[i] + string_start,
+				o->data + (int)(uintptr_t)list[i] + string_start);
 		i++;
 	}
 	if (n) {
-		const char *p = o->data + (int)list[n - 1] + string_start;
+		const char *p = o->data + (int)(uintptr_t)list[n - 1] + string_start;
 		indent();
-		fprintf(stderr, " total_sz:%ld\n", (long)((p + strlen(p) + 1) - o->data));
+		fdprintf(2, " total_sz:%ld\n", (long)((p + strlen(p) + 1) - o->data));
 	}
 }
 #else
@@ -2672,18 +2688,18 @@ static void debug_print_tree(struct pipe
 
 	pin = 0;
 	while (pi) {
-		fprintf(stderr, "%*spipe %d res_word=%s followup=%d %s\n", lvl*2, "",
+		fdprintf(2, "%*spipe %d res_word=%s followup=%d %s\n", lvl*2, "",
 				pin, RES[pi->res_word], pi->followup, PIPE[pi->followup]);
 		prn = 0;
 		while (prn < pi->num_cmds) {
 			struct command *command = &pi->cmds[prn];
 			char **argv = command->argv;
 
-			fprintf(stderr, "%*s cmd %d assignment_cnt:%d",
+			fdprintf(2, "%*s cmd %d assignment_cnt:%d",
 					lvl*2, "", prn,
 					command->assignment_cnt);
 			if (command->group) {
-				fprintf(stderr, " group %s: (argv=%p)%s%s\n",
+				fdprintf(2, " group %s: (argv=%p)%s%s\n",
 						CMDTYPE[command->cmd_type],
 						argv
 # if !BB_MMU
@@ -2697,10 +2713,10 @@ static void debug_print_tree(struct pipe
 				continue;
 			}
 			if (argv) while (*argv) {
-				fprintf(stderr, " '%s'", *argv);
+				fdprintf(2, " '%s'", *argv);
 				argv++;
 			}
-			fprintf(stderr, "\n");
+			fdprintf(2, "\n");
 			prn++;
 		}
 		pi = pi->next;
@@ -7445,7 +7461,7 @@ int hush_main(int argc, char **argv)
 	unsigned builtin_argc;
 	char **e;
 	struct variable *cur_var;
-	struct variable shell_ver;
+	struct variable *shell_ver;
 
 	INIT_G();
 	if (EXIT_SUCCESS) /* if EXIT_SUCCESS == 0, it is already done */
@@ -7454,17 +7470,17 @@ int hush_main(int argc, char **argv)
 	G.argv0_for_re_execing = argv[0];
 #endif
 	/* Deal with HUSH_VERSION */
-	memset(&shell_ver, 0, sizeof(shell_ver));
-	shell_ver.flg_export = 1;
-	shell_ver.flg_read_only = 1;
+	shell_ver = xzalloc(sizeof(*shell_ver));
+	shell_ver->flg_export = 1;
+	shell_ver->flg_read_only = 1;
 	/* Code which handles ${var<op>...} needs writable values for all variables,
 	 * therefore we xstrdup: */
-	shell_ver.varstr = xstrdup(hush_version_str),
-	G.top_var = &shell_ver;
+	shell_ver->varstr = xstrdup(hush_version_str);
 	/* Create shell local variables from the values
 	 * currently living in the environment */
 	debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
 	unsetenv("HUSH_VERSION"); /* in case it exists in initial env */
+	G.top_var = shell_ver;
 	cur_var = G.top_var;
 	e = environ;
 	if (e) while (*e) {
@@ -7479,8 +7495,8 @@ int hush_main(int argc, char **argv)
 		e++;
 	}
 	/* (Re)insert HUSH_VERSION into env (AFTER we scanned the env!) */
-	debug_printf_env("putenv '%s'\n", shell_ver.varstr);
-	putenv(shell_ver.varstr);
+	debug_printf_env("putenv '%s'\n", shell_ver->varstr);
+	putenv(shell_ver->varstr);
 
 	/* Export PWD */
 	set_pwd_var(/*exp:*/ 1);
@@ -7840,18 +7856,6 @@ int hush_main(int argc, char **argv)
 	parse_and_run_file(stdin);
 
  final_return:
-#if ENABLE_FEATURE_CLEAN_UP
-	if (G.cwd != bb_msg_unknown)
-		free((char*)G.cwd);
-	cur_var = G.top_var->next;
-	while (cur_var) {
-		struct variable *tmp = cur_var;
-		if (!cur_var->max_len)
-			free(cur_var->varstr);
-		cur_var = cur_var->next;
-		free(tmp);
-	}
-#endif
 	hush_exit(G.last_exitcode);
 }