lineedit: fix another corner case with bad unicode input

function                                             old     new   delta
read_key                                             607     646     +39
readit                                                50      55      +5
getch_nowait                                         290     295      +5
hash_find                                            233     234      +1
xstrtoul_range_sfx                                   231     230      -1
passwd_main                                         1058    1056      -2
builtin_exit                                          45      43      -2
cmp_main                                             649     645      -4
lineedit_read_key                                    257     245     -12
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 4/5 up/down: 50/-21)             Total: 29 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index 8e339da..7c0eef9 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -1658,27 +1658,28 @@
 static int lineedit_read_key(char *read_key_buffer)
 {
 	int64_t ic;
-	struct pollfd pfd;
-	int delay = -1;
+	int timeout = -1;
 #if ENABLE_FEATURE_ASSUME_UNICODE
 	char unicode_buf[MB_CUR_MAX + 1];
 	int unicode_idx = 0;
 #endif
 
-	pfd.fd = STDIN_FILENO;
-	pfd.events = POLLIN;
-	do {
-#if ENABLE_FEATURE_EDITING_ASK_TERMINAL || ENABLE_FEATURE_ASSUME_UNICODE
- poll_again:
+	while (1) {
+		/* Wait for input. TIMEOUT = -1 makes read_key wait even
+		 * on nonblocking stdin, TIMEOUT = 50 makes sure we won't
+		 * insist on full MB_CUR_MAX buffer to declare input like
+		 * "\xff\n",pause,"ls\n" invalid and thus won't lose "ls".
+		 *
+		 * Note: read_key sets errno to 0 on success.
+		 */
+		ic = read_key(STDIN_FILENO, read_key_buffer, timeout);
+		if (errno) {
+#if ENABLE_FEATURE_ASSUME_UNICODE
+			if (errno == EAGAIN && unicode_idx != 0)
+				goto pushback;
 #endif
-		if (read_key_buffer[0] == 0) {
-			/* Wait for input. Can't just call read_key,
-			 * it returns at once if stdin
-			 * is in non-blocking mode. */
-			safe_poll(&pfd, 1, delay);
+			break;
 		}
-		/* Note: read_key sets errno to 0 on success: */
-		ic = read_key(STDIN_FILENO, read_key_buffer);
 
 #if ENABLE_FEATURE_EDITING_ASK_TERMINAL
 		if ((int32_t)ic == KEYCODE_CURSOR_POS
@@ -1695,7 +1696,7 @@
 					}
 				}
 			}
-			goto poll_again;
+			continue;
 		}
 #endif
 
@@ -1704,19 +1705,20 @@
 			wchar_t wc;
 
 			if ((int32_t)ic < 0) /* KEYCODE_xxx */
-				return ic;
-			// TODO: imagine sequence like: 0xff, <left-arrow>: we are currently losing 0xff...
+				break;
+			// TODO: imagine sequence like: 0xff,<left-arrow>: we are currently losing 0xff...
 
 			unicode_buf[unicode_idx++] = ic;
 			unicode_buf[unicode_idx] = '\0';
 			if (mbstowcs(&wc, unicode_buf, 1) != 1) {
 				/* Not (yet?) a valid unicode char */
 				if (unicode_idx < MB_CUR_MAX) {
-					delay = 50;
-					goto poll_again;
+					timeout = 50;
+					continue;
 				}
+ pushback:
 				/* Invalid sequence. Save all "bad bytes" except first */
-				read_key_ungets(read_key_buffer, unicode_buf + 1, MB_CUR_MAX - 1);
+				read_key_ungets(read_key_buffer, unicode_buf + 1, unicode_idx - 1);
 				/*
 				 * ic = unicode_buf[0] sounds even better, but currently
 				 * this does not work: wchar_t[] -> char[] conversion
@@ -1730,7 +1732,8 @@
 			}
 		}
 #endif
-	} while (errno == EAGAIN);
+		break;
+	}
 
 	return ic;
 }
diff --git a/libbb/read_key.c b/libbb/read_key.c
index 98b3131..0faa12c 100644
--- a/libbb/read_key.c
+++ b/libbb/read_key.c
@@ -9,7 +9,7 @@
  */
 #include "libbb.h"
 
-int64_t FAST_FUNC read_key(int fd, char *buffer)
+int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
 {
 	struct pollfd pfd;
 	const char *seq;
@@ -90,14 +90,27 @@
 		/* ESC [ Z - Shift-Tab */
 	};
 
+	pfd.fd = fd;
+	pfd.events = POLLIN;
+
 	buffer++; /* saved chars counter is in buffer[-1] now */
 
  start_over:
 	errno = 0;
 	n = (unsigned char)buffer[-1];
 	if (n == 0) {
-		/* If no data, block waiting for input.
-		 * It is tempting to read more than one byte here,
+		/* If no data, wait for input.
+		 * If requested, wait TIMEOUT ms. TIMEOUT = -1 is useful
+		 * if fd can be in non-blocking mode.
+		 */
+		if (timeout >= -1) {
+			if (safe_poll(&pfd, 1, timeout) == 0) {
+				/* Timed out */
+				errno = EAGAIN;
+				return -1;
+			}
+		}
+		/* It is tempting to read more than one byte here,
 		 * but it breaks pasting. Example: at shell prompt,
 		 * user presses "c","a","t" and then pastes "\nline\n".
 		 * When we were reading 3 bytes here, we were eating
@@ -121,8 +134,6 @@
 	}
 
 	/* Loop through known ESC sequences */
-	pfd.fd = fd;
-	pfd.events = POLLIN;
 	seq = esccmds;
 	while (*seq != '\0') {
 		/* n - position in sequence we did not read yet */