diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/include/io.h INIT.2011-02-08/src/cmd/ksh93/include/io.h

--- INIT.2011-02-08.clean/src/cmd/ksh93/include/io.h	2012-05-02 03:16:17.383778774 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/include/io.h	2012-05-02 03:17:53.562408338 -0700

@@ -23,6 +23,9 @@

  *	David Korn

  *

  */

+/*

+ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.

+ */

 #include	<ast.h>

 #include	<sfio.h>

@@ -84,6 +87,12 @@ extern int	sh_devtofd(const char*);

 extern int	sh_isdevfd(const char*);

 extern int	sh_source(Shell_t*, Sfio_t*, const char*);

+extern int	VALIDATE_FD(Shell_t *, int);

+

+#define	VALIDATE_FD(shp, fd) \

+	(((fd) >= (shp)->gd->lim.open_max) ? sh_iovalidfd(shp, fd) : 1)

+

+

 /* the following are readonly */

 extern const char	e_pexists[];

 extern const char	e_query[];

@@ -123,4 +132,5 @@ extern const char	e_bash_profile[];

 extern const char	e_stdprompt[];

 extern const char	e_supprompt[];

 extern const char	e_ambiguous[];

+

 #endif /* KSHELL */

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/io.c INIT.2011-02-08/src/cmd/ksh93/sh/io.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/io.c	2012-05-02 03:16:17.389917698 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/io.c	2012-05-02 03:19:12.669621809 -0700

@@ -596,8 +596,10 @@ static void io_preserve(Shell_t* shp, re

 		((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;

 		errormsg(SH_DICT,ERROR_system(1),e_toomany);

 	}

-	if(f2 >= shp->gd->lim.open_max)

-		sh_iovalidfd(shp,f2);

+

+	VALIDATE_FD(shp, fd);

+	VALIDATE_FD(shp, f2);

+

 	if(shp->fdptrs[fd]=shp->fdptrs[f2])

 	{

 		if(f2==job.fd)

@@ -623,7 +625,12 @@ static void io_preserve(Shell_t* shp, re

  */

 int sh_iorenumber(Shell_t *shp, register int f1,register int f2)

 {

-	register Sfio_t *sp = shp->sftable[f2];

+	register Sfio_t *sp;

+

+	VALIDATE_FD(shp, f1);

+	VALIDATE_FD(shp, f2);

+

+	sp = shp->sftable[f2];

 	if(f1!=f2)

 	{

 		/* see whether file descriptor is in use */

@@ -663,8 +670,7 @@ int sh_iorenumber(Shell_t *shp, register

 		if(f2<=2)

 			sfset(sp,SF_SHARE|SF_PUBLIC,1);

 	}

-	if(f2>=shp->gd->lim.open_max)

-		sh_iovalidfd(shp,f2);

+	VALIDATE_FD(shp, f2);

 	return(f2);

 }

@@ -678,8 +684,9 @@ int sh_close(register int fd)

 	register int r = 0;

 	if(fd<0)

 		return(-1);

-	if(fd >= shp->gd->lim.open_max)

-		sh_iovalidfd(shp,fd);

+

+	VALIDATE_FD(shp, fd);

+

 	if(!(sp=shp->sftable[fd]) || sfclose(sp) < 0)

 	{

 		if(fdnotify)

@@ -835,6 +842,9 @@ int sh_open(register const char *path, i

 		mode = (IOREAD|IOWRITE);

 	else

 		mode = IOREAD;

+

+	VALIDATE_FD(shp, fd);

+

 	shp->fdstatus[fd] = mode;

 	return(fd);

 }

@@ -861,6 +871,8 @@ int sh_iomovefd(register int fdold)

 	if(fdold<0 || fdold>2)

 		return(fdold);

 	fdnew = sh_iomovefd(dup(fdold));

+	VALIDATE_FD(shp, fdold);

+	VALIDATE_FD(shp, fdnew);

 	shp->fdstatus[fdnew] = (shp->fdstatus[fdold]&~IOCLEX);

 	close(fdold);

 	shp->fdstatus[fdold] = IOCLOSE;

@@ -897,6 +909,9 @@ int	sh_pipe(register int pv[])

 		sh_close(fd);

 	else

 		pv[out] = sh_iomovefd(fd);

+

+	VALIDATE_FD(shp, pv[out]);

+

 	if(fcntl(pv[out],F_SETFD,FD_CLOEXEC) >=0)

 		shp->fdstatus[pv[out]] |= IOCLEX;

 	shp->fdstatus[pv[out]] = (out?IOWRITE:IOREAD);

@@ -929,6 +944,9 @@ int	sh_pipe(register int pv[])

 		errormsg(SH_DICT,ERROR_system(1),e_pipe);

 	}

 	fcntl(pv[out],F_SETFD,FD_CLOEXEC);

+

+	VALIDATE_FD(shp, pv[out]);

+

 	shp->fdstatus[pv[out]] |= IOCLEX;

 	pv[1-out] = -1;

 	pv[2] = port;

@@ -958,9 +976,13 @@ static int pat_line(const regex_t* rp, c

 static int io_patseek(Shell_t *shp, regex_t *rp, Sfio_t* sp, int flags)

 {

 	char	*cp, *match;

-	int	r, fd=sffileno(sp), close_exec = shp->fdstatus[fd]&IOCLEX;

+	int	r, fd, close_exec;

 	int	was_share,s=(PIPE_BUF>SF_BUFSIZE?SF_BUFSIZE:PIPE_BUF);

 	size_t	n,m;

+

+	fd = sffileno(sp);

+	VALIDATE_FD(shp, fd);

+	close_exec = shp->fdstatus[fd]&IOCLEX;

 	shp->fdstatus[sffileno(sp)] |= IOCLEX;

 	if(fd==0)

 		was_share = sfset(sp,SF_SHARE,1);

@@ -994,12 +1016,17 @@ static int io_patseek(Shell_t *shp, rege

 static Sfoff_t	file_offset(Shell_t *shp, int fn, char *fname)

 {

-	Sfio_t		*sp = shp->sftable[fn];

+	Sfio_t		*sp;

 	char		*cp;

 	Sfoff_t		off;

 	struct Eof	endf;

 	Namval_t	*mp = nv_open("EOF",shp->var_tree,0);

 	Namval_t	*pp = nv_open("CUR",shp->var_tree,0);

+

+	VALIDATE_FD(shp, fn);

+

+	sp = shp->sftable[fn];

+

 	memset(&endf,0,sizeof(struct Eof));

 	endf.fd = fn;

 	endf.hdr.disc = &EOF_disc;

@@ -1169,7 +1196,7 @@ int	sh_redirect(Shell_t *shp,struct iono

 			if((iof&IOLSEEK) || ((iof&IOMOV) && *fname=='-'))

 				fn = nv_getnum(np);

 		}

-		if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))

+		if (!VALIDATE_FD(shp, fn))

 			errormsg(SH_DICT,ERROR_system(1),e_file+4);

 		if(iof&IOLSEEK)

 		{

@@ -1212,6 +1239,7 @@ int	sh_redirect(Shell_t *shp,struct iono

 						message = e_file;

 						goto fail;

 					}

+					VALIDATE_FD(shp, dupfd);

 					if(shp->subshell && dupfd==1)

 					{

 						if(sfset(sfstdout,0,0)&SF_STRING)

@@ -1248,8 +1276,7 @@ int	sh_redirect(Shell_t *shp,struct iono

 					goto traceit;

 				if((fd=sh_fcntl(dupfd,F_DUPFD,3))<0)

 					goto fail;

-				if(fd>= shp->gd->lim.open_max)

-					sh_iovalidfd(shp,fd);

+				VALIDATE_FD(shp, fd);

 				sh_iocheckfd(shp,dupfd);

 				shp->fdstatus[fd] = (shp->fdstatus[dupfd]&~IOCLEX);

 				if(toclose<0 && shp->fdstatus[fd]&IOREAD)

@@ -1362,7 +1389,11 @@ int	sh_redirect(Shell_t *shp,struct iono

 			}

 			if(iof&IOLSEEK)

 			{

-				Sfio_t *sp = shp->sftable[fn];

+				Sfio_t *sp;

+

+				VALIDATE_FD(shp, fn);

+

+				sp = shp->sftable[fn];

 				r = shp->fdstatus[fn];

 				if(!(r&(IOSEEK|IONOSEEK)))

 					r = sh_iocheckfd(shp,fn);

@@ -1443,6 +1474,7 @@ int	sh_redirect(Shell_t *shp,struct iono

 			}

 			if(fd<0)

 			{

+				VALIDATE_FD(shp, fn);

 				if(sh_inuse(shp,fn) || (fn && fn==shp->infd))

 				{

 					if(fn>9 || !(shp->inuse_bits&(1<<fn)))

@@ -1462,7 +1494,7 @@ int	sh_redirect(Shell_t *shp,struct iono

 					{

 						if((fn=fcntl(fd,F_DUPFD,10)) < 0)

 							goto fail;

-						if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))

+						if (!VALIDATE_FD(shp, fn))

 							goto fail;

 						shp->fdstatus[fn] = shp->fdstatus[fd];

 						sh_close(fd);

@@ -1622,7 +1654,12 @@ void sh_iosave(Shell_t *shp, register in

 	filemap[shp->topfd++].save_fd = savefd;

 	if(savefd >=0)

 	{

-		register Sfio_t* sp = shp->sftable[origfd];

+		register Sfio_t* sp;

+

+		VALIDATE_FD(shp, origfd);

+		VALIDATE_FD(shp, savefd);

+

+		sp = shp->sftable[origfd];

 		/* make saved file close-on-exec */

 		sh_fcntl(savefd,F_SETFD,FD_CLOEXEC);

 		if(origfd==job.fd)

@@ -1655,6 +1692,7 @@ void	sh_iounsave(Shell_t* shp)

 			filemap[newfd++] = filemap[fd];

 		else

 		{

+			VALIDATE_FD(shp, savefd);

 			shp->sftable[savefd] = 0;

 			sh_close(savefd);

 		}

@@ -1678,16 +1716,19 @@ void	sh_iorestore(Shell_t *shp, int last

 		{

 			if ((savefd = filemap[fd].save_fd) >= 0)

 			{

+				VALIDATE_FD(shp, savefd);

 				shp->sftable[savefd] = 0;

 				sh_close(savefd);

 			}

 			continue;

 		}

 		origfd = filemap[fd].orig_fd;

+		VALIDATE_FD(shp, origfd);

 		if(origfd<0)

 		{

 			/* this should never happen */

 			savefd = filemap[fd].save_fd;

+			VALIDATE_FD(shp, savefd);

 			shp->sftable[savefd] = 0;

 			sh_close(savefd);

 			return;

@@ -1699,6 +1740,7 @@ void	sh_iorestore(Shell_t *shp, int last

 		sh_close(origfd);

 		if ((savefd = filemap[fd].save_fd) >= 0)

 		{

+			VALIDATE_FD(shp, savefd);

 			sh_fcntl(savefd, F_DUPFD, origfd);

 			if(savefd==job.fd)

 				job.fd=origfd;

@@ -1954,6 +1996,9 @@ static ssize_t slowread(Sfio_t *iop,void

 int sh_iocheckfd(Shell_t *shp, register int fd)

 {

 	register int flags, n;

+

+	VALIDATE_FD(shp, fd);

+

 	if((n=shp->fdstatus[fd])&IOCLOSE)

 		return(n);

 	if(!(n&(IOREAD|IOWRITE)))

@@ -2145,7 +2190,7 @@ static void	sftrack(Sfio_t* sp, int flag

 		return;

 	}

 #endif

-	if(fd<0 || (fd>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fd)))

+	if (fd < 0 || !VALIDATE_FD(shp, fd))

 		return;

 	if(sh_isstate(SH_NOTRACK))

 		return;

@@ -2413,6 +2458,8 @@ ssize_t sh_read(register int fd, void* b

 {

 	Shell_t *shp = sh_getinterp();

 	register Sfio_t *sp;

+

+	VALIDATE_FD(shp, fd);

 	if(sp=shp->sftable[fd])

 		return(sfread(sp,buff,n));

 	else

@@ -2427,6 +2474,8 @@ ssize_t sh_write(register int fd, const 

 {

 	Shell_t *shp = sh_getinterp();

 	register Sfio_t *sp;

+

+	VALIDATE_FD(shp, fd);

 	if(sp=shp->sftable[fd])

 		return(sfwrite(sp,buff,n));

 	else

@@ -2441,6 +2490,8 @@ off_t sh_seek(register int fd, off_t off

 {

 	Shell_t *shp = sh_getinterp();

 	register Sfio_t *sp;

+

+	VALIDATE_FD(shp, fd);

 	if((sp=shp->sftable[fd]) && (sfset(sp,0,0)&(SF_READ|SF_WRITE)))

 		return(sfseek(sp,offset,whence));

 	else

@@ -2452,6 +2503,9 @@ int sh_dup(register int old)

 {

 	Shell_t *shp = sh_getinterp();

 	register int fd = dup(old);

+

+	VALIDATE_FD(shp, old);

+	VALIDATE_FD(shp, fd);

 	if(fd>=0)

 	{

 		if(shp->fdstatus[old] == IOCLOSE)

@@ -2473,13 +2527,15 @@ int sh_fcntl(register int fd, int op, ..

 	arg =  va_arg(ap, int) ;

 	va_end(ap);

 	newfd = fcntl(fd,op,arg);

+

+	VALIDATE_FD(shp, fd);

+	VALIDATE_FD(shp, newfd);

+

 	if(newfd>=0) switch(op)

 	{

 	    case F_DUPFD:

 		if(shp->fdstatus[fd] == IOCLOSE)

 			shp->fdstatus[fd] = 0;

-		if(newfd>=shp->gd->lim.open_max)

-			sh_iovalidfd(shp,newfd);

 		shp->fdstatus[newfd] = (shp->fdstatus[fd]&~IOCLEX);

 		if(fdnotify)

 			(*fdnotify)(fd,newfd);

@@ -2548,6 +2604,7 @@ Sfio_t *sh_iogetiop(int fd, int mode)

 		return(iop);

 	if(mode==SF_READ && !(n&IOREAD))

 		return(iop);

+	VALIDATE_FD(shp, fd);

 	if(!(iop = shp->sftable[fd]))

 		iop=sh_iostream(shp,fd);

 	return(iop);

@@ -2567,7 +2624,10 @@ Sfio_t	*sh_fd2sfio(int fd)

 {

 	Shell_t	*shp = sh_getinterp();

 	register int status;

-	Sfio_t *sp = shp->sftable[fd];

+	Sfio_t *sp;

+

+	VALIDATE_FD(shp, fd);

+	sp = shp->sftable[fd];

 	if(!sp  && (status = sh_iocheckfd(shp,fd))!=IOCLOSE)

 	{

 		register int flags=0;

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/lex.c INIT.2011-02-08/src/cmd/ksh93/sh/lex.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/lex.c	2012-05-02 03:16:17.388010187 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/lex.c	2012-05-02 03:17:53.567785551 -0700

@@ -25,6 +25,9 @@

  * AT&T Labs

  *

  */

+/*

+ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.

+ */

 #include	<ast.h>

 #include	<stak.h>

@@ -2053,6 +2056,7 @@ void	sh_syntax(Lex_t *lp)

 	else

 		lp->lastline = shp->inlineno;

 	tokstr = fmttoken(lp,tok,tokbuf);

+	VALIDATE_FD(shp, shp->infd);

 	if((sp=fcfile()) || (shp->infd>=0 && (sp=shp->sftable[shp->infd])))

 	{

 		/* clear out any pending input */

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/macro.c INIT.2011-02-08/src/cmd/ksh93/sh/macro.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/macro.c	2012-05-02 03:16:26.100861446 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/macro.c	2012-05-02 03:17:53.569195199 -0700

@@ -2086,6 +2086,7 @@ static void comsubst(Mac_t *mp,register 

 			sh_popcontext(mp->shp,&buff);

 			if(r==0 && ip && (ip->iofile&IOLSEEK))

 			{

+				VALIDATE_FD(mp->shp, fd);

 				if(sp=mp->shp->sftable[fd])

 					num = sftell(sp);

 				else

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/main.c INIT.2011-02-08/src/cmd/ksh93/sh/main.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/main.c	2012-05-02 03:16:17.389138504 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/main.c	2012-05-02 03:17:53.570027033 -0700

@@ -26,6 +26,9 @@

  * AT&T Labs

  *

  */

+/*

+ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.

+ */

 #include	<ast.h>

 #include	<sfio.h>

@@ -396,8 +399,10 @@ static void	exfile(register Shell_t *shp

 		if(fno > 0)

 		{

 			int r;

+			VALIDATE_FD(shp, fno);

 			if(fno < 10 && ((r=sh_fcntl(fno,F_DUPFD,10))>=10))

 			{

+				VALIDATE_FD(shp, r);

 				shp->fdstatus[r] = shp->fdstatus[fno];

 				sh_close(fno);

 				fno = r;

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/path.c INIT.2011-02-08/src/cmd/ksh93/sh/path.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/path.c	2012-05-02 03:16:20.752378905 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/path.c	2012-05-02 03:17:53.571078341 -0700

@@ -23,6 +23,9 @@

  * AT&T Labs

  *

  */

+/*

+ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.

+ */

 #include	"defs.h"

 #include	<fcin.h>

@@ -1239,6 +1242,7 @@ static void exscript(Shell_t *shp,regist

 	if(sp=fcfile())

 		while(sfstack(sp,SF_POPSTACK));

 	job_clear();

+	VALIDATE_FD(shp, shp->infd);

 	if(shp->infd>0 && (shp->fdstatus[shp->infd]&IOCLEX))

 		sh_close(shp->infd);

 	sh_setstate(sh_state(SH_FORKED));

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/subshell.c INIT.2011-02-08/src/cmd/ksh93/sh/subshell.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/subshell.c	2012-05-02 03:16:25.241021529 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/subshell.c	2012-05-02 03:17:53.571942019 -0700

@@ -115,6 +115,7 @@ void	sh_subtmpfile(Shell_t *shp)

 		if((sp->tmpfd = fd = fcntl(1,F_DUPFD,10)) >= 0)

 		{

 			fcntl(fd,F_SETFD,FD_CLOEXEC);

+			VALIDATE_FD(shp, fd);

 			shp->fdstatus[fd] = shp->fdstatus[1]|IOCLEX;

 			close(1);

 		}

@@ -141,6 +142,7 @@ void	sh_subtmpfile(Shell_t *shp)

 		}

 		else

 		{

+			VALIDATE_FD(shp, fd);

 			shp->fdstatus[fd] = IOREAD|IOWRITE;

 			sfsync(sfstdout);

 			if(fd==1)

@@ -627,6 +629,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_

 					((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;

 					errormsg(SH_DICT,ERROR_system(1),e_toomany);

 				}

+				VALIDATE_FD(shp, fd);

 				shp->sftable[fd] = iop;

 				fcntl(fd,F_SETFD,FD_CLOEXEC);

 				shp->fdstatus[fd] = (shp->fdstatus[1]|IOCLEX);

diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/xec.c INIT.2011-02-08/src/cmd/ksh93/sh/xec.c

--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/xec.c	2012-05-02 03:16:17.393286735 -0700

+++ INIT.2011-02-08/src/cmd/ksh93/sh/xec.c	2012-05-02 03:17:53.574535124 -0700

@@ -94,6 +94,8 @@ static void iousepipe(Shell_t *shp)

 	usepipe++;

 	fcntl(subpipe[0],F_SETFD,FD_CLOEXEC);

 	subpipe[2] = fcntl(1,F_DUPFD,10);

+	VALIDATE_FD(shp, subpipe[1]);

+	VALIDATE_FD(shp, subpipe[2]);

 	shp->fdstatus[subpipe[2]] = shp->fdstatus[1];

 	close(1);

 	fcntl(subpipe[1],F_DUPFD,1);

@@ -117,6 +119,7 @@ static void iounpipe(Shell_t *shp)

 	usepipe = 0;

 	close(1);

 	fcntl(subpipe[2], F_DUPFD, 1);

+	VALIDATE_FD(shp, subpipe[2]);

 	shp->fdstatus[1] = shp->fdstatus[subpipe[2]];

 	if(subdup) for(n=0; n < 10; n++)

 	{

@@ -844,6 +847,7 @@ static int sh_coexec(Shell_t *shp,const 

 			if(filt > 2)

 			{

 				shp->coutpipe = shp->inpipe[1];

+				VALIDATE_FD(shp, shp->coutpipe);

 				shp->fdptrs[shp->coutpipe] = &shp->coutpipe;

 			}

 		}

@@ -1487,6 +1491,7 @@ int sh_exec(register const Shnode_t *t, 

 						if(shp->cpipe[0]<0 || shp->cpipe[1] < 0)

 						{

 							sh_copipe(shp,shp->outpipe=shp->cpipe,0);

+							VALIDATE_FD(shp, shp->cpipe[0]);

 							shp->fdptrs[shp->cpipe[0]] = shp->cpipe;

 						}

 						sh_copipe(shp,shp->inpipe=pipes,0);

@@ -3419,6 +3424,8 @@ static void coproc_init(Shell_t *shp, in

 		if((outfd=shp->cpipe[1]) < 10) 

 		{

 		        int fd=fcntl(shp->cpipe[1],F_DUPFD,10);

+			VALIDATE_FD(shp, outfd);

+			VALIDATE_FD(shp, fd);

 			if(fd>=10)

 			{

 			        shp->fdstatus[fd] = (shp->fdstatus[outfd]&~IOCLEX);

@@ -3427,6 +3434,9 @@ static void coproc_init(Shell_t *shp, in

 				shp->cpipe[1] = fd;

 			}

 		}

+		VALIDATE_FD(shp, shp->cpipe[0]);

+		VALIDATE_FD(shp, shp->cpipe[1]);

+