components/ksh93/patches/100-CR6964621.patch
changeset 4268 d723f8ed85fe
parent 4196 d697072a92f5
child 4305 90493abe0c5c
equal deleted inserted replaced
4266:bcfdeff915c4 4268:d723f8ed85fe
     1 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/include/io.h INIT.2011-02-08/src/cmd/ksh93/include/io.h
     1 # This patch has been developed inhouse. This fixes a Solaris specific
     2 --- INIT.2011-02-08.clean/src/cmd/ksh93/include/io.h	2012-05-02 03:16:17.383778774 -0700
     2 # issue and has not been submitted to the community.
     3 +++ INIT.2011-02-08/src/cmd/ksh93/include/io.h	2012-05-02 03:17:53.562408338 -0700
     3 --- INIT.2012-08-01.old/src/cmd/ksh93/include/io.h	2015-02-24 13:25:19.331558350 -0800
       
     4 +++ INIT.2012-08-01/src/cmd/ksh93/include/io.h	2015-03-04 13:27:49.205782578 -0800
     4 @@ -23,6 +23,9 @@
     5 @@ -23,6 +23,9 @@
     5   *	David Korn
     6   *	David Korn
     6   *
     7   *
     7   */
     8   */
     8 +/*
     9 +/*
     9 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
    10 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
    10 + */
    11 + */
    11  
    12  
    12  #include	<ast.h>
    13  #include	<ast.h>
    13  #include	<sfio.h>
    14  #include	<sfio.h>
    14 @@ -84,6 +87,12 @@ extern int	sh_devtofd(const char*);
    15 @@ -87,6 +90,12 @@ extern int	sh_devtofd(const char*);
    15  extern int	sh_isdevfd(const char*);
    16  extern int	sh_isdevfd(const char*);
    16  extern int	sh_source(Shell_t*, Sfio_t*, const char*);
    17  extern int	sh_source(Shell_t*, Sfio_t*, const char*);
    17  
    18  
    18 +extern int	VALIDATE_FD(Shell_t *, int);
    19 +extern int	VALIDATE_FD(Shell_t *, int);
    19 +
    20 +
    22 +
    23 +
    23 +
    24 +
    24  /* the following are readonly */
    25  /* the following are readonly */
    25  extern const char	e_pexists[];
    26  extern const char	e_pexists[];
    26  extern const char	e_query[];
    27  extern const char	e_query[];
    27 @@ -123,4 +132,5 @@ extern const char	e_bash_profile[];
    28 @@ -126,4 +135,5 @@ extern const char	e_bash_profile[];
    28  extern const char	e_stdprompt[];
    29  extern const char	e_stdprompt[];
    29  extern const char	e_supprompt[];
    30  extern const char	e_supprompt[];
    30  extern const char	e_ambiguous[];
    31  extern const char	e_ambiguous[];
    31 +
    32 +
    32  #endif /* KSHELL */
    33  #endif /* KSHELL */
    33 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/io.c INIT.2011-02-08/src/cmd/ksh93/sh/io.c
    34 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/io.c	2015-02-24 13:25:19.362427732 -0800
    34 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/io.c	2012-05-02 03:16:17.389917698 -0700
    35 +++ INIT.2012-08-01/src/cmd/ksh93/sh/io.c	2015-03-04 14:04:54.981280201 -0800
    35 +++ INIT.2011-02-08/src/cmd/ksh93/sh/io.c	2012-05-02 03:19:12.669621809 -0700
    36 @@ -605,8 +605,10 @@ static void io_preserve(Shell_t* shp, re
    36 @@ -596,8 +596,10 @@ static void io_preserve(Shell_t* shp, re
       
    37  		((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;
    37  		((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;
    38  		errormsg(SH_DICT,ERROR_system(1),e_toomany);
    38  		errormsg(SH_DICT,ERROR_system(1),e_toomany);
    39  	}
    39  	}
    40 -	if(f2 >= shp->gd->lim.open_max)
    40 -	if(f2 >= shp->gd->lim.open_max)
    41 -		sh_iovalidfd(shp,f2);
    41 -		sh_iovalidfd(shp,f2);
    44 +	VALIDATE_FD(shp, f2);
    44 +	VALIDATE_FD(shp, f2);
    45 +
    45 +
    46  	if(shp->fdptrs[fd]=shp->fdptrs[f2])
    46  	if(shp->fdptrs[fd]=shp->fdptrs[f2])
    47  	{
    47  	{
    48  		if(f2==job.fd)
    48  		if(f2==job.fd)
    49 @@ -623,7 +625,12 @@ static void io_preserve(Shell_t* shp, re
    49 @@ -632,7 +634,12 @@ static void io_preserve(Shell_t* shp, re
    50   */
    50   */
    51  int sh_iorenumber(Shell_t *shp, register int f1,register int f2)
    51  int sh_iorenumber(Shell_t *shp, register int f1,register int f2)
    52  {
    52  {
    53 -	register Sfio_t *sp = shp->sftable[f2];
    53 -	register Sfio_t *sp = shp->sftable[f2];
    54 +	register Sfio_t *sp;
    54 +	register Sfio_t *sp;
    58 +
    58 +
    59 +	sp = shp->sftable[f2];
    59 +	sp = shp->sftable[f2];
    60  	if(f1!=f2)
    60  	if(f1!=f2)
    61  	{
    61  	{
    62  		/* see whether file descriptor is in use */
    62  		/* see whether file descriptor is in use */
    63 @@ -663,8 +670,7 @@ int sh_iorenumber(Shell_t *shp, register
    63 @@ -672,8 +679,7 @@ int sh_iorenumber(Shell_t *shp, register
    64  		if(f2<=2)
    64  		if(f2<=2)
    65  			sfset(sp,SF_SHARE|SF_PUBLIC,1);
    65  			sfset(sp,SF_SHARE|SF_PUBLIC,1);
    66  	}
    66  	}
    67 -	if(f2>=shp->gd->lim.open_max)
    67 -	if(f2>=shp->gd->lim.open_max)
    68 -		sh_iovalidfd(shp,f2);
    68 -		sh_iovalidfd(shp,f2);
    69 +	VALIDATE_FD(shp, f2);
    69 +	VALIDATE_FD(shp, f2);
    70  	return(f2);
    70  	return(f2);
    71  }
    71  }
    72  
    72  
    73 @@ -678,8 +684,9 @@ int sh_close(register int fd)
    73 @@ -687,8 +693,9 @@ int sh_close(register int fd)
    74  	register int r = 0;
    74  	register int r = 0;
    75  	if(fd<0)
    75  	if(fd<0)
    76  		return(-1);
    76  		return(-1);
    77 -	if(fd >= shp->gd->lim.open_max)
    77 -	if(fd >= shp->gd->lim.open_max)
    78 -		sh_iovalidfd(shp,fd);
    78 -		sh_iovalidfd(shp,fd);
    79 +
    79 +
    80 +	VALIDATE_FD(shp, fd);
    80 +	VALIDATE_FD(shp, fd);
    81 +
    81 +
    82  	if(!(sp=shp->sftable[fd]) || sfclose(sp) < 0)
    82  	if(!(sp=shp->sftable[fd]) || sfclose(sp) < 0)
    83  	{
    83  	{
    84  		if(fdnotify)
    84  		int err=errno;
    85 @@ -835,6 +842,9 @@ int sh_open(register const char *path, i
    85 @@ -846,8 +853,7 @@ int sh_open(register const char *path, i
    86  		mode = (IOREAD|IOWRITE);
    86  		mode = (IOREAD|IOWRITE);
    87  	else
    87  	else
    88  		mode = IOREAD;
    88  		mode = IOREAD;
    89 +
    89 -	if(fd >= shp->gd->lim.open_max)
    90 +	VALIDATE_FD(shp, fd);
    90 -		sh_iovalidfd(shp,fd);
    91 +
    91 +	VALIDATE_FD(shp, fd);
    92  	shp->fdstatus[fd] = mode;
    92  	shp->fdstatus[fd] = mode;
    93  	return(fd);
    93  	return(fd);
    94  }
    94  }
    95 @@ -861,6 +871,8 @@ int sh_iomovefd(register int fdold)
    95 @@ -876,6 +882,8 @@ int sh_iomovefd(register int fdold)
    96  	if(fdold<0 || fdold>2)
    96  	if(fdold<0 || fdold>2)
    97  		return(fdold);
    97  		return(fdold);
    98  	fdnew = sh_iomovefd(dup(fdold));
    98  	fdnew = sh_iomovefd(dup(fdold));
    99 +	VALIDATE_FD(shp, fdold);
    99 +	VALIDATE_FD(shp, fdold);
   100 +	VALIDATE_FD(shp, fdnew);
   100 +	VALIDATE_FD(shp, fdnew);
   101  	shp->fdstatus[fdnew] = (shp->fdstatus[fdold]&~IOCLEX);
   101  	shp->fdstatus[fdnew] = (shp->fdstatus[fdold]&~IOCLEX);
   102  	close(fdold);
   102  	close(fdold);
   103  	shp->fdstatus[fdold] = IOCLOSE;
   103  	shp->fdstatus[fdold] = IOCLOSE;
   104 @@ -897,6 +909,9 @@ int	sh_pipe(register int pv[])
   104 @@ -936,6 +944,9 @@ int	sh_pipe(register int pv[])
   105  		sh_close(fd);
   105  		sh_close(fd);
   106  	else
   106  	else
   107  		pv[out] = sh_iomovefd(fd);
   107  		pv[out] = sh_iomovefd(fd);
   108 +
   108 +
   109 +	VALIDATE_FD(shp, pv[out]);
   109 +	VALIDATE_FD(shp, pv[out]);
   110 +
   110 +
   111  	if(fcntl(pv[out],F_SETFD,FD_CLOEXEC) >=0)
   111  	if(fcntl(pv[out],F_SETFD,FD_CLOEXEC) >=0)
   112  		shp->fdstatus[pv[out]] |= IOCLEX;
   112  		shp->fdstatus[pv[out]] |= IOCLEX;
   113  	shp->fdstatus[pv[out]] = (out?IOWRITE:IOREAD);
   113  	shp->fdstatus[pv[out]] = (out?IOWRITE:IOREAD);
   114 @@ -929,6 +944,9 @@ int	sh_pipe(register int pv[])
   114 @@ -968,6 +979,9 @@ int	sh_pipe(register int pv[])
   115  		errormsg(SH_DICT,ERROR_system(1),e_pipe);
   115  		errormsg(SH_DICT,ERROR_system(1),e_pipe);
   116  	}
   116  	}
   117  	fcntl(pv[out],F_SETFD,FD_CLOEXEC);
   117  	fcntl(pv[out],F_SETFD,FD_CLOEXEC);
   118 +
   118 +
   119 +	VALIDATE_FD(shp, pv[out]);
   119 +	VALIDATE_FD(shp, pv[out]);
   120 +
   120 +
   121  	shp->fdstatus[pv[out]] |= IOCLEX;
   121  	shp->fdstatus[pv[out]] |= IOCLEX;
   122  	pv[1-out] = -1;
   122  	pv[1-out] = -1;
   123  	pv[2] = port;
   123  	pv[2] = port;
   124 @@ -958,9 +976,13 @@ static int pat_line(const regex_t* rp, c
   124 @@ -997,9 +1011,13 @@ static int pat_line(const regex_t* rp, c
   125  static int io_patseek(Shell_t *shp, regex_t *rp, Sfio_t* sp, int flags)
   125  static int io_patseek(Shell_t *shp, regex_t *rp, Sfio_t* sp, int flags)
   126  {
   126  {
   127  	char	*cp, *match;
   127  	char	*cp, *match;
   128 -	int	r, fd=sffileno(sp), close_exec = shp->fdstatus[fd]&IOCLEX;
   128 -	int	r, fd=sffileno(sp), close_exec = shp->fdstatus[fd]&IOCLEX;
   129 +	int	r, fd, close_exec;
   129 +	int	r, fd, close_exec;
   134 +	VALIDATE_FD(shp, fd);
   134 +	VALIDATE_FD(shp, fd);
   135 +	close_exec = shp->fdstatus[fd]&IOCLEX;
   135 +	close_exec = shp->fdstatus[fd]&IOCLEX;
   136  	shp->fdstatus[sffileno(sp)] |= IOCLEX;
   136  	shp->fdstatus[sffileno(sp)] |= IOCLEX;
   137  	if(fd==0)
   137  	if(fd==0)
   138  		was_share = sfset(sp,SF_SHARE,1);
   138  		was_share = sfset(sp,SF_SHARE,1);
   139 @@ -994,12 +1016,17 @@ static int io_patseek(Shell_t *shp, rege
   139 @@ -1033,12 +1051,17 @@ static int io_patseek(Shell_t *shp, rege
   140  
   140  
   141  static Sfoff_t	file_offset(Shell_t *shp, int fn, char *fname)
   141  static Sfoff_t	file_offset(Shell_t *shp, int fn, char *fname)
   142  {
   142  {
   143 -	Sfio_t		*sp = shp->sftable[fn];
   143 -	Sfio_t		*sp = shp->sftable[fn];
   144 +	Sfio_t		*sp;
   144 +	Sfio_t		*sp;
   153 +	sp = shp->sftable[fn];
   153 +	sp = shp->sftable[fn];
   154 +
   154 +
   155  	memset(&endf,0,sizeof(struct Eof));
   155  	memset(&endf,0,sizeof(struct Eof));
   156  	endf.fd = fn;
   156  	endf.fd = fn;
   157  	endf.hdr.disc = &EOF_disc;
   157  	endf.hdr.disc = &EOF_disc;
   158 @@ -1169,7 +1196,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   158 @@ -1216,7 +1239,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   159  			if((iof&IOLSEEK) || ((iof&IOMOV) && *fname=='-'))
   159  			if((iof&IOLSEEK) || ((iof&IOMOV) && *fname=='-'))
   160  				fn = nv_getnum(np);
   160  				fn = nv_getnum(np);
   161  		}
   161  		}
   162 -		if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))
   162 -		if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))
   163 +		if (!VALIDATE_FD(shp, fn))
   163 +		if (!VALIDATE_FD(shp, fn))
   164  			errormsg(SH_DICT,ERROR_system(1),e_file+4);
   164  			errormsg(SH_DICT,ERROR_system(1),e_file+4);
   165  		if(iof&IOLSEEK)
   165  		if(iof&IOLSEEK)
   166  		{
   166  		{
   167 @@ -1212,6 +1239,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   167 @@ -1259,6 +1282,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   168  						message = e_file;
   168  						message = e_file;
   169  						goto fail;
   169  						goto fail;
   170  					}
   170  					}
   171 +					VALIDATE_FD(shp, dupfd);
   171 +					VALIDATE_FD(shp, dupfd);
   172  					if(shp->subshell && dupfd==1)
   172  					if(shp->subshell && dupfd==1)
   173  					{
   173  					{
   174  						if(sfset(sfstdout,0,0)&SF_STRING)
   174  						if(sfset(sfstdout,0,0)&SF_STRING)
   175 @@ -1248,8 +1276,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   175 @@ -1295,8 +1319,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   176  					goto traceit;
   176  					goto traceit;
   177  				if((fd=sh_fcntl(dupfd,F_DUPFD,3))<0)
   177  				if((fd=sh_fcntl(dupfd,F_DUPFD,3))<0)
   178  					goto fail;
   178  					goto fail;
   179 -				if(fd>= shp->gd->lim.open_max)
   179 -				if(fd>= shp->gd->lim.open_max)
   180 -					sh_iovalidfd(shp,fd);
   180 -					sh_iovalidfd(shp,fd);
   181 +				VALIDATE_FD(shp, fd);
   181 +				VALIDATE_FD(shp, fd);
   182  				sh_iocheckfd(shp,dupfd);
   182  				sh_iocheckfd(shp,dupfd);
   183  				shp->fdstatus[fd] = (shp->fdstatus[dupfd]&~IOCLEX);
   183  				shp->fdstatus[fd] = (shp->fdstatus[dupfd]&~IOCLEX);
   184  				if(toclose<0 && shp->fdstatus[fd]&IOREAD)
   184  				if(toclose<0 && shp->fdstatus[fd]&IOREAD)
   185 @@ -1362,7 +1389,11 @@ int	sh_redirect(Shell_t *shp,struct iono
   185 @@ -1410,7 +1433,11 @@ int	sh_redirect(Shell_t *shp,struct iono
   186  			}
   186  			}
   187  			if(iof&IOLSEEK)
   187  			if(iof&IOLSEEK)
   188  			{
   188  			{
   189 -				Sfio_t *sp = shp->sftable[fn];
   189 -				Sfio_t *sp = shp->sftable[fn];
   190 +				Sfio_t *sp;
   190 +				Sfio_t *sp;
   193 +
   193 +
   194 +				sp = shp->sftable[fn];
   194 +				sp = shp->sftable[fn];
   195  				r = shp->fdstatus[fn];
   195  				r = shp->fdstatus[fn];
   196  				if(!(r&(IOSEEK|IONOSEEK)))
   196  				if(!(r&(IOSEEK|IONOSEEK)))
   197  					r = sh_iocheckfd(shp,fn);
   197  					r = sh_iocheckfd(shp,fn);
   198 @@ -1443,6 +1474,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   198 @@ -1491,6 +1518,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   199  			}
   199  			}
   200  			if(fd<0)
   200  			if(fd<0)
   201  			{
   201  			{
   202 +				VALIDATE_FD(shp, fn);
   202 +				VALIDATE_FD(shp, fn);
   203  				if(sh_inuse(shp,fn) || (fn && fn==shp->infd))
   203  				if(sh_inuse(shp,fn) || (fn && fn==shp->infd))
   204  				{
   204  				{
   205  					if(fn>9 || !(shp->inuse_bits&(1<<fn)))
   205  					if(fn>9 || !(shp->inuse_bits&(1<<fn)))
   206 @@ -1462,7 +1494,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   206 @@ -1510,7 +1538,7 @@ int	sh_redirect(Shell_t *shp,struct iono
   207  					{
   207  					{
   208  						if((fn=fcntl(fd,F_DUPFD,10)) < 0)
   208  						if((fn=fcntl(fd,F_DUPFD,10)) < 0)
   209  							goto fail;
   209  							goto fail;
   210 -						if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))
   210 -						if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))
   211 +						if (!VALIDATE_FD(shp, fn))
   211 +						if (!VALIDATE_FD(shp, fn))
   212  							goto fail;
   212  							goto fail;
   213  						shp->fdstatus[fn] = shp->fdstatus[fd];
   213  						if(flag!=2 || shp->subshell)
   214  						sh_close(fd);
   214  							sh_iosave(shp,fn,indx|0x10000,tname?fname:(trunc?Empty:0));
   215 @@ -1622,7 +1654,12 @@ void sh_iosave(Shell_t *shp, register in
   215 @@ -1701,7 +1729,12 @@ void sh_iosave(Shell_t *shp, register in
   216  	filemap[shp->topfd++].save_fd = savefd;
   216  	filemap[shp->topfd++].save_fd = savefd;
   217  	if(savefd >=0)
   217  	if(savefd >=0)
   218  	{
   218  	{
   219 -		register Sfio_t* sp = shp->sftable[origfd];
   219 -		register Sfio_t* sp = shp->sftable[origfd];
   220 +		register Sfio_t* sp;
   220 +		register Sfio_t* sp;
   224 +
   224 +
   225 +		sp = shp->sftable[origfd];
   225 +		sp = shp->sftable[origfd];
   226  		/* make saved file close-on-exec */
   226  		/* make saved file close-on-exec */
   227  		sh_fcntl(savefd,F_SETFD,FD_CLOEXEC);
   227  		sh_fcntl(savefd,F_SETFD,FD_CLOEXEC);
   228  		if(origfd==job.fd)
   228  		if(origfd==job.fd)
   229 @@ -1655,6 +1692,7 @@ void	sh_iounsave(Shell_t* shp)
   229 @@ -1734,6 +1767,7 @@ void	sh_iounsave(Shell_t* shp)
   230  			filemap[newfd++] = filemap[fd];
   230  			filemap[newfd++] = filemap[fd];
   231  		else
   231  		else
   232  		{
   232  		{
   233 +			VALIDATE_FD(shp, savefd);
   233 +			VALIDATE_FD(shp, savefd);
   234  			shp->sftable[savefd] = 0;
   234  			shp->sftable[savefd] = 0;
   235  			sh_close(savefd);
   235  			sh_close(savefd);
   236  		}
   236  		}
   237 @@ -1678,16 +1716,19 @@ void	sh_iorestore(Shell_t *shp, int last
   237 @@ -1757,16 +1791,19 @@ void	sh_iorestore(Shell_t *shp, int last
   238  		{
   238  		{
   239  			if ((savefd = filemap[fd].save_fd) >= 0)
   239  			if ((savefd = filemap[fd].save_fd) >= 0)
   240  			{
   240  			{
   241 +				VALIDATE_FD(shp, savefd);
   241 +				VALIDATE_FD(shp, savefd);
   242  				shp->sftable[savefd] = 0;
   242  				shp->sftable[savefd] = 0;
   252  			savefd = filemap[fd].save_fd;
   252  			savefd = filemap[fd].save_fd;
   253 +			VALIDATE_FD(shp, savefd);
   253 +			VALIDATE_FD(shp, savefd);
   254  			shp->sftable[savefd] = 0;
   254  			shp->sftable[savefd] = 0;
   255  			sh_close(savefd);
   255  			sh_close(savefd);
   256  			return;
   256  			return;
   257 @@ -1699,6 +1740,7 @@ void	sh_iorestore(Shell_t *shp, int last
   257 @@ -1778,6 +1815,7 @@ void	sh_iorestore(Shell_t *shp, int last
   258  		sh_close(origfd);
   258  		sh_close(origfd);
   259  		if ((savefd = filemap[fd].save_fd) >= 0)
   259  		if ((savefd = filemap[fd].save_fd) >= 0)
   260  		{
   260  		{
   261 +			VALIDATE_FD(shp, savefd);
   261 +			VALIDATE_FD(shp, savefd);
   262  			sh_fcntl(savefd, F_DUPFD, origfd);
   262  			sh_fcntl(savefd, F_DUPFD, origfd);
   263  			if(savefd==job.fd)
   263  			if(savefd==job.fd)
   264  				job.fd=origfd;
   264  				job.fd=origfd;
   265 @@ -1954,6 +1996,9 @@ static ssize_t slowread(Sfio_t *iop,void
   265 @@ -2035,6 +2073,9 @@ static ssize_t slowread(Sfio_t *iop,void
   266  int sh_iocheckfd(Shell_t *shp, register int fd)
   266  int sh_iocheckfd(Shell_t *shp, register int fd)
   267  {
   267  {
   268  	register int flags, n;
   268  	register int flags, n;
   269 +
   269 +
   270 +	VALIDATE_FD(shp, fd);
   270 +	VALIDATE_FD(shp, fd);
   271 +
   271 +
   272  	if((n=shp->fdstatus[fd])&IOCLOSE)
   272  	if((n=shp->fdstatus[fd])&IOCLOSE)
   273  		return(n);
   273  		return(n);
   274  	if(!(n&(IOREAD|IOWRITE)))
   274  	if(!(n&(IOREAD|IOWRITE)))
   275 @@ -2145,7 +2190,7 @@ static void	sftrack(Sfio_t* sp, int flag
   275 @@ -2226,7 +2267,7 @@ static void	sftrack(Sfio_t* sp, int flag
   276  		return;
   276  		return;
   277  	}
   277  	}
   278  #endif
   278  #endif
   279 -	if(fd<0 || (fd>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fd)))
   279 -	if(fd<0 || fd==PSEUDOFD || (fd>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fd)))
   280 +	if (fd < 0 || !VALIDATE_FD(shp, fd))
   280 +	if(fd<0 || fd==PSEUDOFD || !VALIDATE_FD(shp, fd))
   281  		return;
   281  		return;
   282  	if(sh_isstate(SH_NOTRACK))
   282  	if(sh_isstate(SH_NOTRACK))
   283  		return;
   283  		return;
   284 @@ -2413,6 +2458,8 @@ ssize_t sh_read(register int fd, void* b
   284 @@ -2495,6 +2536,8 @@ ssize_t sh_read(register int fd, void* b
   285  {
   285  {
   286  	Shell_t *shp = sh_getinterp();
   286  	Shell_t *shp = sh_getinterp();
   287  	register Sfio_t *sp;
   287  	register Sfio_t *sp;
   288 +
   288 +
   289 +	VALIDATE_FD(shp, fd);
   289 +	VALIDATE_FD(shp, fd);
   290  	if(sp=shp->sftable[fd])
   290  	if(sp=shp->sftable[fd])
   291  		return(sfread(sp,buff,n));
   291  		return(sfread(sp,buff,n));
   292  	else
   292  	else
   293 @@ -2427,6 +2474,8 @@ ssize_t sh_write(register int fd, const 
   293 @@ -2509,6 +2552,8 @@ ssize_t sh_write(register int fd, const
   294  {
   294  {
   295  	Shell_t *shp = sh_getinterp();
   295  	Shell_t *shp = sh_getinterp();
   296  	register Sfio_t *sp;
   296  	register Sfio_t *sp;
   297 +
   297 +
   298 +	VALIDATE_FD(shp, fd);
   298 +	VALIDATE_FD(shp, fd);
   299  	if(sp=shp->sftable[fd])
   299  	if(sp=shp->sftable[fd])
   300  		return(sfwrite(sp,buff,n));
   300  		return(sfwrite(sp,buff,n));
   301  	else
   301  	else
   302 @@ -2441,6 +2490,8 @@ off_t sh_seek(register int fd, off_t off
   302 @@ -2523,6 +2568,8 @@ off_t sh_seek(register int fd, off_t off
   303  {
   303  {
   304  	Shell_t *shp = sh_getinterp();
   304  	Shell_t *shp = sh_getinterp();
   305  	register Sfio_t *sp;
   305  	register Sfio_t *sp;
   306 +
   306 +
   307 +	VALIDATE_FD(shp, fd);
   307 +	VALIDATE_FD(shp, fd);
   308  	if((sp=shp->sftable[fd]) && (sfset(sp,0,0)&(SF_READ|SF_WRITE)))
   308  	if((sp=shp->sftable[fd]) && (sfset(sp,0,0)&(SF_READ|SF_WRITE)))
   309  		return(sfseek(sp,offset,whence));
   309  		return(sfseek(sp,offset,whence));
   310  	else
   310  	else
   311 @@ -2452,6 +2503,9 @@ int sh_dup(register int old)
   311 @@ -2534,6 +2581,9 @@ int sh_dup(register int old)
   312  {
   312  {
   313  	Shell_t *shp = sh_getinterp();
   313  	Shell_t *shp = sh_getinterp();
   314  	register int fd = dup(old);
   314  	register int fd = dup(old);
   315 +
   315 +
   316 +	VALIDATE_FD(shp, old);
   316 +	VALIDATE_FD(shp, old);
   317 +	VALIDATE_FD(shp, fd);
   317 +	VALIDATE_FD(shp, fd);
   318  	if(fd>=0)
   318  	if(fd>=0)
   319  	{
   319  	{
   320  		if(shp->fdstatus[old] == IOCLOSE)
   320  		if(shp->fdstatus[old] == IOCLOSE)
   321 @@ -2473,13 +2527,15 @@ int sh_fcntl(register int fd, int op, ..
   321 @@ -2555,13 +2605,15 @@ int sh_fcntl(register int fd, int op, ..
   322  	arg =  va_arg(ap, int) ;
   322  	arg =  va_arg(ap, int) ;
   323  	va_end(ap);
   323  	va_end(ap);
   324  	newfd = fcntl(fd,op,arg);
   324  	newfd = fcntl(fd,op,arg);
   325 +
   325 +
   326 +	VALIDATE_FD(shp, fd);
   326 +	VALIDATE_FD(shp, fd);
   334 -		if(newfd>=shp->gd->lim.open_max)
   334 -		if(newfd>=shp->gd->lim.open_max)
   335 -			sh_iovalidfd(shp,newfd);
   335 -			sh_iovalidfd(shp,newfd);
   336  		shp->fdstatus[newfd] = (shp->fdstatus[fd]&~IOCLEX);
   336  		shp->fdstatus[newfd] = (shp->fdstatus[fd]&~IOCLEX);
   337  		if(fdnotify)
   337  		if(fdnotify)
   338  			(*fdnotify)(fd,newfd);
   338  			(*fdnotify)(fd,newfd);
   339 @@ -2548,6 +2604,7 @@ Sfio_t *sh_iogetiop(int fd, int mode)
   339 @@ -2630,6 +2682,7 @@ Sfio_t *sh_iogetiop(int fd, int mode)
   340  		return(iop);
   340  		return(iop);
   341  	if(mode==SF_READ && !(n&IOREAD))
   341  	if(mode==SF_READ && !(n&IOREAD))
   342  		return(iop);
   342  		return(iop);
   343 +	VALIDATE_FD(shp, fd);
   343 +	VALIDATE_FD(shp, fd);
   344  	if(!(iop = shp->sftable[fd]))
   344  	if(!(iop = shp->sftable[fd]))
   345  		iop=sh_iostream(shp,fd);
   345  		iop=sh_iostream(shp,fd);
   346  	return(iop);
   346  	return(iop);
   347 @@ -2567,7 +2624,10 @@ Sfio_t	*sh_fd2sfio(int fd)
   347 @@ -2649,7 +2702,10 @@ Sfio_t	*sh_fd2sfio(int fd)
   348  {
   348  {
   349  	Shell_t	*shp = sh_getinterp();
   349  	Shell_t	*shp = sh_getinterp();
   350  	register int status;
   350  	register int status;
   351 -	Sfio_t *sp = shp->sftable[fd];
   351 -	Sfio_t *sp = shp->sftable[fd];
   352 +	Sfio_t *sp;
   352 +	Sfio_t *sp;
   354 +	VALIDATE_FD(shp, fd);
   354 +	VALIDATE_FD(shp, fd);
   355 +	sp = shp->sftable[fd];
   355 +	sp = shp->sftable[fd];
   356  	if(!sp  && (status = sh_iocheckfd(shp,fd))!=IOCLOSE)
   356  	if(!sp  && (status = sh_iocheckfd(shp,fd))!=IOCLOSE)
   357  	{
   357  	{
   358  		register int flags=0;
   358  		register int flags=0;
   359 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/lex.c INIT.2011-02-08/src/cmd/ksh93/sh/lex.c
   359 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/lex.c	2015-02-24 13:25:19.370183959 -0800
   360 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/lex.c	2012-05-02 03:16:17.388010187 -0700
   360 +++ INIT.2012-08-01/src/cmd/ksh93/sh/lex.c	2015-03-04 13:27:49.211457345 -0800
   361 +++ INIT.2011-02-08/src/cmd/ksh93/sh/lex.c	2012-05-02 03:17:53.567785551 -0700
       
   362 @@ -25,6 +25,9 @@
   361 @@ -25,6 +25,9 @@
   363   * AT&T Labs
   362   * AT&T Labs
   364   *
   363   *
   365   */
   364   */
   366 +/*
   365 +/*
   367 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
   366 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
   368 + */
   367 + */
   369  
   368  
   370  #include	<ast.h>
   369  #include	<ast.h>
   371  #include	<stak.h>
   370  #include	<stak.h>
   372 @@ -2053,6 +2056,7 @@ void	sh_syntax(Lex_t *lp)
   371 @@ -2122,6 +2125,7 @@ void	sh_syntax(Lex_t *lp)
   373  	else
   372  	else
   374  		lp->lastline = shp->inlineno;
   373  		lp->lastline = shp->inlineno;
   375  	tokstr = fmttoken(lp,tok,tokbuf);
   374  	tokstr = fmttoken(lp,tok,tokbuf);
   376 +	VALIDATE_FD(shp, shp->infd);
   375 +	VALIDATE_FD(shp, shp->infd);
   377  	if((sp=fcfile()) || (shp->infd>=0 && (sp=shp->sftable[shp->infd])))
   376  	if((sp=fcfile()) || (shp->infd>=0 && (sp=shp->sftable[shp->infd])))
   378  	{
   377  	{
   379  		/* clear out any pending input */
   378  		/* clear out any pending input */
   380 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/macro.c INIT.2011-02-08/src/cmd/ksh93/sh/macro.c
   379 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/macro.c	2015-02-24 13:25:19.363200741 -0800
   381 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/macro.c	2012-05-02 03:16:26.100861446 -0700
   380 +++ INIT.2012-08-01/src/cmd/ksh93/sh/macro.c	2015-03-04 13:27:49.212566247 -0800
   382 +++ INIT.2011-02-08/src/cmd/ksh93/sh/macro.c	2012-05-02 03:17:53.569195199 -0700
   381 @@ -2121,6 +2121,7 @@ static void comsubst(Mac_t *mp,register
   383 @@ -2086,6 +2086,7 @@ static void comsubst(Mac_t *mp,register 
       
   384  			sh_popcontext(mp->shp,&buff);
   382  			sh_popcontext(mp->shp,&buff);
   385  			if(r==0 && ip && (ip->iofile&IOLSEEK))
   383  			if(r==0 && ip && (ip->iofile&IOLSEEK))
   386  			{
   384  			{
   387 +				VALIDATE_FD(mp->shp, fd);
   385 +				VALIDATE_FD(mp->shp, fd);
   388  				if(sp=mp->shp->sftable[fd])
   386  				if(sp=mp->shp->sftable[fd])
   389  					num = sftell(sp);
   387  					num = sftell(sp);
   390  				else
   388  				else
   391 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/main.c INIT.2011-02-08/src/cmd/ksh93/sh/main.c
   389 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/main.c	2015-02-24 13:25:19.364162232 -0800
   392 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/main.c	2012-05-02 03:16:17.389138504 -0700
   390 +++ INIT.2012-08-01/src/cmd/ksh93/sh/main.c	2015-03-04 13:27:49.213386462 -0800
   393 +++ INIT.2011-02-08/src/cmd/ksh93/sh/main.c	2012-05-02 03:17:53.570027033 -0700
       
   394 @@ -26,6 +26,9 @@
   391 @@ -26,6 +26,9 @@
   395   * AT&T Labs
   392   * AT&T Labs
   396   *
   393   *
   397   */
   394   */
   398 +/*
   395 +/*
   399 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
   396 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
   400 + */
   397 + */
   401  
   398  
   402  #include	<ast.h>
   399  #include	<ast.h>
   403  #include	<sfio.h>
   400  #include	<sfio.h>
   404 @@ -396,8 +399,10 @@ static void	exfile(register Shell_t *shp
   401 @@ -376,8 +379,10 @@ static void	exfile(register Shell_t *shp
   405  		if(fno > 0)
   402  		if(fno > 0)
   406  		{
   403  		{
   407  			int r;
   404  			int r;
   408 +			VALIDATE_FD(shp, fno);
   405 +			VALIDATE_FD(shp, fno);
   409  			if(fno < 10 && ((r=sh_fcntl(fno,F_DUPFD,10))>=10))
   406  			if(fno < 10 && ((r=sh_fcntl(fno,F_DUPFD,10))>=10))
   410  			{
   407  			{
   411 +				VALIDATE_FD(shp, r);
   408 +				VALIDATE_FD(shp, r);
   412  				shp->fdstatus[r] = shp->fdstatus[fno];
   409  				shp->fdstatus[r] = shp->fdstatus[fno];
   413  				sh_close(fno);
   410  				sh_close(fno);
   414  				fno = r;
   411  				fno = r;
   415 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/path.c INIT.2011-02-08/src/cmd/ksh93/sh/path.c
   412 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/path.c	2015-02-24 13:25:19.360898415 -0800
   416 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/path.c	2012-05-02 03:16:20.752378905 -0700
   413 +++ INIT.2012-08-01/src/cmd/ksh93/sh/path.c	2015-03-04 13:27:49.214381188 -0800
   417 +++ INIT.2011-02-08/src/cmd/ksh93/sh/path.c	2012-05-02 03:17:53.571078341 -0700
       
   418 @@ -23,6 +23,9 @@
   414 @@ -23,6 +23,9 @@
   419   * AT&T Labs
   415   * AT&T Labs
   420   *
   416   *
   421   */
   417   */
   422 +/*
   418 +/*
   423 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
   419 + * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
   424 + */
   420 + */
   425  
   421  
   426  #include	"defs.h"
   422  #include	"defs.h"
   427  #include	<fcin.h>
   423  #include	<fcin.h>
   428 @@ -1239,6 +1242,7 @@ static void exscript(Shell_t *shp,regist
   424 @@ -1272,6 +1275,7 @@ static void exscript(Shell_t *shp,regist
   429  	if(sp=fcfile())
   425  	if(sp=fcfile())
   430  		while(sfstack(sp,SF_POPSTACK));
   426  		while(sfstack(sp,SF_POPSTACK));
   431  	job_clear();
   427  	job_clear();
   432 +	VALIDATE_FD(shp, shp->infd);
   428 +	VALIDATE_FD(shp, shp->infd);
   433  	if(shp->infd>0 && (shp->fdstatus[shp->infd]&IOCLEX))
   429  	if(shp->infd>0 && (shp->fdstatus[shp->infd]&IOCLEX))
   434  		sh_close(shp->infd);
   430  		sh_close(shp->infd);
   435  	sh_setstate(sh_state(SH_FORKED));
   431  	sh_setstate(sh_state(SH_FORKED));
   436 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/subshell.c INIT.2011-02-08/src/cmd/ksh93/sh/subshell.c
   432 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/subshell.c	2015-02-24 13:25:19.363479570 -0800
   437 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/subshell.c	2012-05-02 03:16:25.241021529 -0700
   433 +++ INIT.2012-08-01/src/cmd/ksh93/sh/subshell.c	2015-03-04 14:05:03.665801329 -0800
   438 +++ INIT.2011-02-08/src/cmd/ksh93/sh/subshell.c	2012-05-02 03:17:53.571942019 -0700
   434 @@ -125,6 +125,7 @@ void	sh_subtmpfile(Shell_t *shp)
   439 @@ -115,6 +115,7 @@ void	sh_subtmpfile(Shell_t *shp)
       
   440  		if((sp->tmpfd = fd = fcntl(1,F_DUPFD,10)) >= 0)
   435  		if((sp->tmpfd = fd = fcntl(1,F_DUPFD,10)) >= 0)
   441  		{
   436  		{
   442  			fcntl(fd,F_SETFD,FD_CLOEXEC);
   437  			fcntl(fd,F_SETFD,FD_CLOEXEC);
   443 +			VALIDATE_FD(shp, fd);
   438 +			VALIDATE_FD(shp, fd);
   444  			shp->fdstatus[fd] = shp->fdstatus[1]|IOCLEX;
   439  			shp->fdstatus[fd] = shp->fdstatus[1]|IOCLEX;
   445  			close(1);
   440  			close(1);
   446  		}
   441  		}
   447 @@ -141,6 +142,7 @@ void	sh_subtmpfile(Shell_t *shp)
   442 @@ -151,6 +152,7 @@ void	sh_subtmpfile(Shell_t *shp)
   448  		}
   443  		}
   449  		else
   444  		else
   450  		{
   445  		{
   451 +			VALIDATE_FD(shp, fd);
   446 +			VALIDATE_FD(shp, fd);
   452  			shp->fdstatus[fd] = IOREAD|IOWRITE;
   447  			shp->fdstatus[fd] = IOREAD|IOWRITE;
   453  			sfsync(sfstdout);
   448  			sfsync(sfstdout);
   454  			if(fd==1)
   449  			if(fd==1)
   455 @@ -627,6 +629,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
   450 @@ -679,8 +681,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
   456  					((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;
   451  					((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;
   457  					errormsg(SH_DICT,ERROR_system(1),e_toomany);
   452  					errormsg(SH_DICT,ERROR_system(1),e_toomany);
   458  				}
   453  				}
       
   454 -				if(fd >= shp->gd->lim.open_max)
       
   455 -					sh_iovalidfd(shp,fd);
   459 +				VALIDATE_FD(shp, fd);
   456 +				VALIDATE_FD(shp, fd);
   460  				shp->sftable[fd] = iop;
   457  				shp->sftable[fd] = iop;
   461  				fcntl(fd,F_SETFD,FD_CLOEXEC);
   458  				fcntl(fd,F_SETFD,FD_CLOEXEC);
   462  				shp->fdstatus[fd] = (shp->fdstatus[1]|IOCLEX);
   459  				shp->fdstatus[fd] = (shp->fdstatus[1]|IOCLEX);
   463 diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/xec.c INIT.2011-02-08/src/cmd/ksh93/sh/xec.c
   460 --- INIT.2012-08-01.old/src/cmd/ksh93/sh/xec.c	2015-02-24 13:25:19.365424099 -0800
   464 --- INIT.2011-02-08.clean/src/cmd/ksh93/sh/xec.c	2012-05-02 03:16:17.393286735 -0700
   461 +++ INIT.2012-08-01/src/cmd/ksh93/sh/xec.c	2015-03-04 14:05:12.823587666 -0800
   465 +++ INIT.2011-02-08/src/cmd/ksh93/sh/xec.c	2012-05-02 03:17:53.574535124 -0700
   462 @@ -117,6 +117,8 @@ static int iousepipe(Shell_t *shp)
   466 @@ -94,6 +94,8 @@ static void iousepipe(Shell_t *shp)
       
   467  	usepipe++;
   463  	usepipe++;
   468  	fcntl(subpipe[0],F_SETFD,FD_CLOEXEC);
   464  	fcntl(subpipe[0],F_SETFD,FD_CLOEXEC);
   469  	subpipe[2] = fcntl(1,F_DUPFD,10);
   465  	subpipe[2] = fcntl(1,F_DUPFD,10);
   470 +	VALIDATE_FD(shp, subpipe[1]);
   466 +	VALIDATE_FD(shp, subpipe[1]);
   471 +	VALIDATE_FD(shp, subpipe[2]);
   467 +	VALIDATE_FD(shp, subpipe[2]);	
       
   468  	fcntl(subpipe[2],F_SETFD,FD_CLOEXEC);
   472  	shp->fdstatus[subpipe[2]] = shp->fdstatus[1];
   469  	shp->fdstatus[subpipe[2]] = shp->fdstatus[1];
   473  	close(1);
   470  	close(1);
   474  	fcntl(subpipe[1],F_DUPFD,1);
   471 @@ -141,6 +143,7 @@ static void iounpipe(Shell_t *shp)
   475 @@ -117,6 +119,7 @@ static void iounpipe(Shell_t *shp)
   472  	char buff[SF_BUFSIZE];
   476  	usepipe = 0;
       
   477  	close(1);
   473  	close(1);
   478  	fcntl(subpipe[2], F_DUPFD, 1);
   474  	fcntl(subpipe[2], F_DUPFD, 1);
   479 +	VALIDATE_FD(shp, subpipe[2]);
   475 +	VALIDATE_FD(shp, subpipe[2]);
   480  	shp->fdstatus[1] = shp->fdstatus[subpipe[2]];
   476  	shp->fdstatus[1] = shp->fdstatus[subpipe[2]];
       
   477  	--usepipe;
   481  	if(subdup) for(n=0; n < 10; n++)
   478  	if(subdup) for(n=0; n < 10; n++)
   482  	{
   479 @@ -886,6 +889,7 @@ static int sh_coexec(Shell_t *shp,const
   483 @@ -844,6 +847,7 @@ static int sh_coexec(Shell_t *shp,const 
       
   484  			if(filt > 2)
   480  			if(filt > 2)
   485  			{
   481  			{
   486  				shp->coutpipe = shp->inpipe[1];
   482  				shp->coutpipe = shp->inpipe[1];
   487 +				VALIDATE_FD(shp, shp->coutpipe);
   483 +				VALIDATE_FD(shp, shp->coutpipe);
   488  				shp->fdptrs[shp->coutpipe] = &shp->coutpipe;
   484  				shp->fdptrs[shp->coutpipe] = &shp->coutpipe;
   489  			}
   485  			}
   490  		}
   486  		}
   491 @@ -1487,6 +1491,7 @@ int sh_exec(register const Shnode_t *t, 
   487 @@ -1646,6 +1650,7 @@ int sh_exec(register const Shnode_t *t,
   492  						if(shp->cpipe[0]<0 || shp->cpipe[1] < 0)
   488  						if(shp->cpipe[0]<0 || shp->cpipe[1] < 0)
   493  						{
   489  						{
   494  							sh_copipe(shp,shp->outpipe=shp->cpipe,0);
   490  							sh_copipe(shp,shp->outpipe=shp->cpipe,0);
   495 +							VALIDATE_FD(shp, shp->cpipe[0]);
   491 +							VALIDATE_FD(shp, shp->cpipe[0]);
   496  							shp->fdptrs[shp->cpipe[0]] = shp->cpipe;
   492  							shp->fdptrs[shp->cpipe[0]] = shp->cpipe;
   497  						}
   493  						}
   498  						sh_copipe(shp,shp->inpipe=pipes,0);
   494  						sh_copipe(shp,shp->inpipe=pipes,0);
   499 @@ -3419,6 +3424,8 @@ static void coproc_init(Shell_t *shp, in
   495 @@ -3623,6 +3628,8 @@ static void coproc_init(Shell_t *shp, in
   500  		if((outfd=shp->cpipe[1]) < 10) 
   496  		if((outfd=shp->cpipe[1]) < 10) 
   501  		{
   497  		{
   502  		        int fd=fcntl(shp->cpipe[1],F_DUPFD,10);
   498  		        int fd=fcntl(shp->cpipe[1],F_DUPFD,10);
   503 +			VALIDATE_FD(shp, outfd);
   499 +			VALIDATE_FD(shp, outfd);
   504 +			VALIDATE_FD(shp, fd);
   500 +			VALIDATE_FD(shp, fd);
   505  			if(fd>=10)
   501  			if(fd>=10)
   506  			{
   502  			{
   507  			        shp->fdstatus[fd] = (shp->fdstatus[outfd]&~IOCLEX);
   503  			        shp->fdstatus[fd] = (shp->fdstatus[outfd]&~IOCLEX);
   508 @@ -3427,6 +3434,9 @@ static void coproc_init(Shell_t *shp, in
   504 @@ -3631,6 +3638,9 @@ static void coproc_init(Shell_t *shp, in
   509  				shp->cpipe[1] = fd;
   505  				shp->cpipe[1] = fd;
   510  			}
   506  			}
   511  		}
   507  		}
   512 +		VALIDATE_FD(shp, shp->cpipe[0]);
   508 +		VALIDATE_FD(shp, shp->cpipe[0]);
   513 +		VALIDATE_FD(shp, shp->cpipe[1]);
   509 +		VALIDATE_FD(shp, shp->cpipe[1]);
   514 +
   510 +
   515  		if(fcntl(*shp->cpipe,F_SETFD,FD_CLOEXEC)>=0)
   511  		if(fcntl(*shp->cpipe,F_SETFD,FD_CLOEXEC)>=0)
   516  			shp->fdstatus[shp->cpipe[0]] |= IOCLEX;
   512  			shp->fdstatus[shp->cpipe[0]] |= IOCLEX;
   517  		shp->fdptrs[shp->cpipe[0]] = shp->cpipe;
   513  		shp->fdptrs[shp->cpipe[0]] = shp->cpipe;
   518 @@ -3437,7 +3447,9 @@ static void coproc_init(Shell_t *shp, in
   514 @@ -3641,7 +3651,9 @@ static void coproc_init(Shell_t *shp, in
   519  	shp->outpipe = shp->cpipe;
   515  	shp->outpipe = shp->cpipe;
   520  	sh_pipe(shp->inpipe=pipes);
   516  	sh_pipe(shp->inpipe=pipes);
   521  	shp->coutpipe = shp->inpipe[1];
   517  	shp->coutpipe = shp->inpipe[1];
   522 +	VALIDATE_FD(shp, shp->coutpipe);
   518 +	VALIDATE_FD(shp, shp->coutpipe);
   523  	shp->fdptrs[shp->coutpipe] = &shp->coutpipe;
   519  	shp->fdptrs[shp->coutpipe] = &shp->coutpipe;
   524 +	VALIDATE_FD(shp, shp->outpipe[0]);
   520 +	VALIDATE_FD(shp, shp->outpipe[0]);
   525  	if(fcntl(shp->outpipe[0],F_SETFD,FD_CLOEXEC)>=0)
   521  	if(fcntl(shp->outpipe[0],F_SETFD,FD_CLOEXEC)>=0)
   526  		shp->fdstatus[shp->outpipe[0]] |= IOCLEX;
   522  		shp->fdstatus[shp->outpipe[0]] |= IOCLEX;
   527  }
   523  }
   528 @@ -3608,6 +3620,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
   524 @@ -3812,6 +3824,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
   529  				int fd = shp->inpipe[1];
   525  				int fd = shp->inpipe[1];
   530  				sh_iosave(shp,0,buff.topfd,(char*)0);
   526  				sh_iosave(shp,0,buffp->topfd,(char*)0);
   531  				sh_iorenumber(shp,shp->inpipe[0],0);
   527  				sh_iorenumber(shp,shp->inpipe[0],0);
   532 +				VALIDATE_FD(shp, fd);
   528 +				VALIDATE_FD(shp, fd);
   533  				if(fd>=0 && (!(otype&FPOU) || (otype&FCOOP)) && fcntl(fd,F_SETFD,FD_CLOEXEC)>=0)
   529  				if(fd>=0 && (!(otype&FPOU) || (otype&FCOOP)) && fcntl(fd,F_SETFD,FD_CLOEXEC)>=0)
   534  					shp->fdstatus[fd] |= IOCLEX;
   530  					shp->fdstatus[fd] |= IOCLEX;
   535  			}
   531  			}
   536 @@ -3619,6 +3632,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
   532 @@ -3823,6 +3836,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
   537  #endif /* SHOPT_COSHELL */
   533  #endif /* SHOPT_COSHELL */
   538  				sh_iosave(shp,1,buff.topfd,(char*)0);
   534  				sh_iosave(shp,1,buffp->topfd,(char*)0);
   539  				sh_iorenumber(shp,sh_dup(shp->outpipe[1]),1);
   535  				sh_iorenumber(shp,sh_dup(shp->outpipe[1]),1);
   540 +				VALIDATE_FD(shp, shp->outpipe[0]);
   536 +				VALIDATE_FD(shp, shp->outpipe[0]);
   541  				if(fcntl(shp->outpipe[0],F_SETFD,FD_CLOEXEC)>=0)
   537  				if(fcntl(shp->outpipe[0],F_SETFD,FD_CLOEXEC)>=0)
   542  					shp->fdstatus[shp->outpipe[0]] |= IOCLEX;
   538  					shp->fdstatus[shp->outpipe[0]] |= IOCLEX;
   543  			}
   539  			}
   544 @@ -3658,6 +3672,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
   540 @@ -3862,6 +3876,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
   545  			signal(SIGQUIT,sh_fault);
   541  			signal(SIGQUIT,sh_fault);
   546  			signal(SIGINT,sh_fault);
   542  			signal(SIGINT,sh_fault);
   547  		}
   543  		}
   548 +		VALIDATE_FD(shp, shp->inpipe[1]);
   544 +		VALIDATE_FD(shp, shp->inpipe[1]);
   549  		if((otype&FPIN) && (!(otype&FPOU) || (otype&FCOOP)) && fcntl(shp->inpipe[1],F_SETFD,FD_CLOEXEC)>=0)
   545  		if((otype&FPIN) && (!(otype&FPOU) || (otype&FCOOP)) && fcntl(shp->inpipe[1],F_SETFD,FD_CLOEXEC)>=0)