--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/ksh93/patches/100-CR6964621.patch Mon Apr 27 10:19:50 2015 -0500
@@ -0,0 +1,551 @@
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/include/io.h INIT.2011-02-08/src/cmd/ksh93/include/io.h
+--- INIT.2011-02-08.clean/src/cmd/ksh93/include/io.h 2012-05-02 03:16:17.383778774 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/include/io.h 2012-05-02 03:17:53.562408338 -0700
+@@ -23,6 +23,9 @@
+ * David Korn
+ *
+ */
++/*
++ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
++ */
+
+ #include <ast.h>
+ #include <sfio.h>
+@@ -84,6 +87,12 @@ extern int sh_devtofd(const char*);
+ extern int sh_isdevfd(const char*);
+ extern int sh_source(Shell_t*, Sfio_t*, const char*);
+
++extern int VALIDATE_FD(Shell_t *, int);
++
++#define VALIDATE_FD(shp, fd) \
++ (((fd) >= (shp)->gd->lim.open_max) ? sh_iovalidfd(shp, fd) : 1)
++
++
+ /* the following are readonly */
+ extern const char e_pexists[];
+ extern const char e_query[];
+@@ -123,4 +132,5 @@ extern const char e_bash_profile[];
+ extern const char e_stdprompt[];
+ extern const char e_supprompt[];
+ extern const char e_ambiguous[];
++
+ #endif /* KSHELL */
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/io.c INIT.2011-02-08/src/cmd/ksh93/sh/io.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/io.c 2012-05-02 03:16:17.389917698 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/io.c 2012-05-02 03:19:12.669621809 -0700
+@@ -596,8 +596,10 @@ static void io_preserve(Shell_t* shp, re
+ ((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;
+ errormsg(SH_DICT,ERROR_system(1),e_toomany);
+ }
+- if(f2 >= shp->gd->lim.open_max)
+- sh_iovalidfd(shp,f2);
++
++ VALIDATE_FD(shp, fd);
++ VALIDATE_FD(shp, f2);
++
+ if(shp->fdptrs[fd]=shp->fdptrs[f2])
+ {
+ if(f2==job.fd)
+@@ -623,7 +625,12 @@ static void io_preserve(Shell_t* shp, re
+ */
+ int sh_iorenumber(Shell_t *shp, register int f1,register int f2)
+ {
+- register Sfio_t *sp = shp->sftable[f2];
++ register Sfio_t *sp;
++
++ VALIDATE_FD(shp, f1);
++ VALIDATE_FD(shp, f2);
++
++ sp = shp->sftable[f2];
+ if(f1!=f2)
+ {
+ /* see whether file descriptor is in use */
+@@ -663,8 +670,7 @@ int sh_iorenumber(Shell_t *shp, register
+ if(f2<=2)
+ sfset(sp,SF_SHARE|SF_PUBLIC,1);
+ }
+- if(f2>=shp->gd->lim.open_max)
+- sh_iovalidfd(shp,f2);
++ VALIDATE_FD(shp, f2);
+ return(f2);
+ }
+
+@@ -678,8 +684,9 @@ int sh_close(register int fd)
+ register int r = 0;
+ if(fd<0)
+ return(-1);
+- if(fd >= shp->gd->lim.open_max)
+- sh_iovalidfd(shp,fd);
++
++ VALIDATE_FD(shp, fd);
++
+ if(!(sp=shp->sftable[fd]) || sfclose(sp) < 0)
+ {
+ if(fdnotify)
+@@ -835,6 +842,9 @@ int sh_open(register const char *path, i
+ mode = (IOREAD|IOWRITE);
+ else
+ mode = IOREAD;
++
++ VALIDATE_FD(shp, fd);
++
+ shp->fdstatus[fd] = mode;
+ return(fd);
+ }
+@@ -861,6 +871,8 @@ int sh_iomovefd(register int fdold)
+ if(fdold<0 || fdold>2)
+ return(fdold);
+ fdnew = sh_iomovefd(dup(fdold));
++ VALIDATE_FD(shp, fdold);
++ VALIDATE_FD(shp, fdnew);
+ shp->fdstatus[fdnew] = (shp->fdstatus[fdold]&~IOCLEX);
+ close(fdold);
+ shp->fdstatus[fdold] = IOCLOSE;
+@@ -897,6 +909,9 @@ int sh_pipe(register int pv[])
+ sh_close(fd);
+ else
+ pv[out] = sh_iomovefd(fd);
++
++ VALIDATE_FD(shp, pv[out]);
++
+ if(fcntl(pv[out],F_SETFD,FD_CLOEXEC) >=0)
+ shp->fdstatus[pv[out]] |= IOCLEX;
+ shp->fdstatus[pv[out]] = (out?IOWRITE:IOREAD);
+@@ -929,6 +944,9 @@ int sh_pipe(register int pv[])
+ errormsg(SH_DICT,ERROR_system(1),e_pipe);
+ }
+ fcntl(pv[out],F_SETFD,FD_CLOEXEC);
++
++ VALIDATE_FD(shp, pv[out]);
++
+ shp->fdstatus[pv[out]] |= IOCLEX;
+ pv[1-out] = -1;
+ pv[2] = port;
+@@ -958,9 +976,13 @@ static int pat_line(const regex_t* rp, c
+ static int io_patseek(Shell_t *shp, regex_t *rp, Sfio_t* sp, int flags)
+ {
+ char *cp, *match;
+- int r, fd=sffileno(sp), close_exec = shp->fdstatus[fd]&IOCLEX;
++ int r, fd, close_exec;
+ int was_share,s=(PIPE_BUF>SF_BUFSIZE?SF_BUFSIZE:PIPE_BUF);
+ size_t n,m;
++
++ fd = sffileno(sp);
++ VALIDATE_FD(shp, fd);
++ close_exec = shp->fdstatus[fd]&IOCLEX;
+ shp->fdstatus[sffileno(sp)] |= IOCLEX;
+ if(fd==0)
+ was_share = sfset(sp,SF_SHARE,1);
+@@ -994,12 +1016,17 @@ static int io_patseek(Shell_t *shp, rege
+
+ static Sfoff_t file_offset(Shell_t *shp, int fn, char *fname)
+ {
+- Sfio_t *sp = shp->sftable[fn];
++ Sfio_t *sp;
+ char *cp;
+ Sfoff_t off;
+ struct Eof endf;
+ Namval_t *mp = nv_open("EOF",shp->var_tree,0);
+ Namval_t *pp = nv_open("CUR",shp->var_tree,0);
++
++ VALIDATE_FD(shp, fn);
++
++ sp = shp->sftable[fn];
++
+ memset(&endf,0,sizeof(struct Eof));
+ endf.fd = fn;
+ endf.hdr.disc = &EOF_disc;
+@@ -1169,7 +1196,7 @@ int sh_redirect(Shell_t *shp,struct iono
+ if((iof&IOLSEEK) || ((iof&IOMOV) && *fname=='-'))
+ fn = nv_getnum(np);
+ }
+- if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))
++ if (!VALIDATE_FD(shp, fn))
+ errormsg(SH_DICT,ERROR_system(1),e_file+4);
+ if(iof&IOLSEEK)
+ {
+@@ -1212,6 +1239,7 @@ int sh_redirect(Shell_t *shp,struct iono
+ message = e_file;
+ goto fail;
+ }
++ VALIDATE_FD(shp, dupfd);
+ if(shp->subshell && dupfd==1)
+ {
+ if(sfset(sfstdout,0,0)&SF_STRING)
+@@ -1248,8 +1276,7 @@ int sh_redirect(Shell_t *shp,struct iono
+ goto traceit;
+ if((fd=sh_fcntl(dupfd,F_DUPFD,3))<0)
+ goto fail;
+- if(fd>= shp->gd->lim.open_max)
+- sh_iovalidfd(shp,fd);
++ VALIDATE_FD(shp, fd);
+ sh_iocheckfd(shp,dupfd);
+ shp->fdstatus[fd] = (shp->fdstatus[dupfd]&~IOCLEX);
+ if(toclose<0 && shp->fdstatus[fd]&IOREAD)
+@@ -1362,7 +1389,11 @@ int sh_redirect(Shell_t *shp,struct iono
+ }
+ if(iof&IOLSEEK)
+ {
+- Sfio_t *sp = shp->sftable[fn];
++ Sfio_t *sp;
++
++ VALIDATE_FD(shp, fn);
++
++ sp = shp->sftable[fn];
+ r = shp->fdstatus[fn];
+ if(!(r&(IOSEEK|IONOSEEK)))
+ r = sh_iocheckfd(shp,fn);
+@@ -1443,6 +1474,7 @@ int sh_redirect(Shell_t *shp,struct iono
+ }
+ if(fd<0)
+ {
++ VALIDATE_FD(shp, fn);
+ if(sh_inuse(shp,fn) || (fn && fn==shp->infd))
+ {
+ if(fn>9 || !(shp->inuse_bits&(1<<fn)))
+@@ -1462,7 +1494,7 @@ int sh_redirect(Shell_t *shp,struct iono
+ {
+ if((fn=fcntl(fd,F_DUPFD,10)) < 0)
+ goto fail;
+- if(fn>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fn))
++ if (!VALIDATE_FD(shp, fn))
+ goto fail;
+ shp->fdstatus[fn] = shp->fdstatus[fd];
+ sh_close(fd);
+@@ -1622,7 +1654,12 @@ void sh_iosave(Shell_t *shp, register in
+ filemap[shp->topfd++].save_fd = savefd;
+ if(savefd >=0)
+ {
+- register Sfio_t* sp = shp->sftable[origfd];
++ register Sfio_t* sp;
++
++ VALIDATE_FD(shp, origfd);
++ VALIDATE_FD(shp, savefd);
++
++ sp = shp->sftable[origfd];
+ /* make saved file close-on-exec */
+ sh_fcntl(savefd,F_SETFD,FD_CLOEXEC);
+ if(origfd==job.fd)
+@@ -1655,6 +1692,7 @@ void sh_iounsave(Shell_t* shp)
+ filemap[newfd++] = filemap[fd];
+ else
+ {
++ VALIDATE_FD(shp, savefd);
+ shp->sftable[savefd] = 0;
+ sh_close(savefd);
+ }
+@@ -1678,16 +1716,19 @@ void sh_iorestore(Shell_t *shp, int last
+ {
+ if ((savefd = filemap[fd].save_fd) >= 0)
+ {
++ VALIDATE_FD(shp, savefd);
+ shp->sftable[savefd] = 0;
+ sh_close(savefd);
+ }
+ continue;
+ }
+ origfd = filemap[fd].orig_fd;
++ VALIDATE_FD(shp, origfd);
+ if(origfd<0)
+ {
+ /* this should never happen */
+ savefd = filemap[fd].save_fd;
++ VALIDATE_FD(shp, savefd);
+ shp->sftable[savefd] = 0;
+ sh_close(savefd);
+ return;
+@@ -1699,6 +1740,7 @@ void sh_iorestore(Shell_t *shp, int last
+ sh_close(origfd);
+ if ((savefd = filemap[fd].save_fd) >= 0)
+ {
++ VALIDATE_FD(shp, savefd);
+ sh_fcntl(savefd, F_DUPFD, origfd);
+ if(savefd==job.fd)
+ job.fd=origfd;
+@@ -1954,6 +1996,9 @@ static ssize_t slowread(Sfio_t *iop,void
+ int sh_iocheckfd(Shell_t *shp, register int fd)
+ {
+ register int flags, n;
++
++ VALIDATE_FD(shp, fd);
++
+ if((n=shp->fdstatus[fd])&IOCLOSE)
+ return(n);
+ if(!(n&(IOREAD|IOWRITE)))
+@@ -2145,7 +2190,7 @@ static void sftrack(Sfio_t* sp, int flag
+ return;
+ }
+ #endif
+- if(fd<0 || (fd>=shp->gd->lim.open_max && !sh_iovalidfd(shp,fd)))
++ if (fd < 0 || !VALIDATE_FD(shp, fd))
+ return;
+ if(sh_isstate(SH_NOTRACK))
+ return;
+@@ -2413,6 +2458,8 @@ ssize_t sh_read(register int fd, void* b
+ {
+ Shell_t *shp = sh_getinterp();
+ register Sfio_t *sp;
++
++ VALIDATE_FD(shp, fd);
+ if(sp=shp->sftable[fd])
+ return(sfread(sp,buff,n));
+ else
+@@ -2427,6 +2474,8 @@ ssize_t sh_write(register int fd, const
+ {
+ Shell_t *shp = sh_getinterp();
+ register Sfio_t *sp;
++
++ VALIDATE_FD(shp, fd);
+ if(sp=shp->sftable[fd])
+ return(sfwrite(sp,buff,n));
+ else
+@@ -2441,6 +2490,8 @@ off_t sh_seek(register int fd, off_t off
+ {
+ Shell_t *shp = sh_getinterp();
+ register Sfio_t *sp;
++
++ VALIDATE_FD(shp, fd);
+ if((sp=shp->sftable[fd]) && (sfset(sp,0,0)&(SF_READ|SF_WRITE)))
+ return(sfseek(sp,offset,whence));
+ else
+@@ -2452,6 +2503,9 @@ int sh_dup(register int old)
+ {
+ Shell_t *shp = sh_getinterp();
+ register int fd = dup(old);
++
++ VALIDATE_FD(shp, old);
++ VALIDATE_FD(shp, fd);
+ if(fd>=0)
+ {
+ if(shp->fdstatus[old] == IOCLOSE)
+@@ -2473,13 +2527,15 @@ int sh_fcntl(register int fd, int op, ..
+ arg = va_arg(ap, int) ;
+ va_end(ap);
+ newfd = fcntl(fd,op,arg);
++
++ VALIDATE_FD(shp, fd);
++ VALIDATE_FD(shp, newfd);
++
+ if(newfd>=0) switch(op)
+ {
+ case F_DUPFD:
+ if(shp->fdstatus[fd] == IOCLOSE)
+ shp->fdstatus[fd] = 0;
+- if(newfd>=shp->gd->lim.open_max)
+- sh_iovalidfd(shp,newfd);
+ shp->fdstatus[newfd] = (shp->fdstatus[fd]&~IOCLEX);
+ if(fdnotify)
+ (*fdnotify)(fd,newfd);
+@@ -2548,6 +2604,7 @@ Sfio_t *sh_iogetiop(int fd, int mode)
+ return(iop);
+ if(mode==SF_READ && !(n&IOREAD))
+ return(iop);
++ VALIDATE_FD(shp, fd);
+ if(!(iop = shp->sftable[fd]))
+ iop=sh_iostream(shp,fd);
+ return(iop);
+@@ -2567,7 +2624,10 @@ Sfio_t *sh_fd2sfio(int fd)
+ {
+ Shell_t *shp = sh_getinterp();
+ register int status;
+- Sfio_t *sp = shp->sftable[fd];
++ Sfio_t *sp;
++
++ VALIDATE_FD(shp, fd);
++ sp = shp->sftable[fd];
+ if(!sp && (status = sh_iocheckfd(shp,fd))!=IOCLOSE)
+ {
+ register int flags=0;
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/lex.c INIT.2011-02-08/src/cmd/ksh93/sh/lex.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/lex.c 2012-05-02 03:16:17.388010187 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/lex.c 2012-05-02 03:17:53.567785551 -0700
+@@ -25,6 +25,9 @@
+ * AT&T Labs
+ *
+ */
++/*
++ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
++ */
+
+ #include <ast.h>
+ #include <stak.h>
+@@ -2053,6 +2056,7 @@ void sh_syntax(Lex_t *lp)
+ else
+ lp->lastline = shp->inlineno;
+ tokstr = fmttoken(lp,tok,tokbuf);
++ VALIDATE_FD(shp, shp->infd);
+ if((sp=fcfile()) || (shp->infd>=0 && (sp=shp->sftable[shp->infd])))
+ {
+ /* clear out any pending input */
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/macro.c INIT.2011-02-08/src/cmd/ksh93/sh/macro.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/macro.c 2012-05-02 03:16:26.100861446 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/macro.c 2012-05-02 03:17:53.569195199 -0700
+@@ -2086,6 +2086,7 @@ static void comsubst(Mac_t *mp,register
+ sh_popcontext(mp->shp,&buff);
+ if(r==0 && ip && (ip->iofile&IOLSEEK))
+ {
++ VALIDATE_FD(mp->shp, fd);
+ if(sp=mp->shp->sftable[fd])
+ num = sftell(sp);
+ else
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/main.c INIT.2011-02-08/src/cmd/ksh93/sh/main.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/main.c 2012-05-02 03:16:17.389138504 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/main.c 2012-05-02 03:17:53.570027033 -0700
+@@ -26,6 +26,9 @@
+ * AT&T Labs
+ *
+ */
++/*
++ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
++ */
+
+ #include <ast.h>
+ #include <sfio.h>
+@@ -396,8 +399,10 @@ static void exfile(register Shell_t *shp
+ if(fno > 0)
+ {
+ int r;
++ VALIDATE_FD(shp, fno);
+ if(fno < 10 && ((r=sh_fcntl(fno,F_DUPFD,10))>=10))
+ {
++ VALIDATE_FD(shp, r);
+ shp->fdstatus[r] = shp->fdstatus[fno];
+ sh_close(fno);
+ fno = r;
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/path.c INIT.2011-02-08/src/cmd/ksh93/sh/path.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/path.c 2012-05-02 03:16:20.752378905 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/path.c 2012-05-02 03:17:53.571078341 -0700
+@@ -23,6 +23,9 @@
+ * AT&T Labs
+ *
+ */
++/*
++ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved.
++ */
+
+ #include "defs.h"
+ #include <fcin.h>
+@@ -1239,6 +1242,7 @@ static void exscript(Shell_t *shp,regist
+ if(sp=fcfile())
+ while(sfstack(sp,SF_POPSTACK));
+ job_clear();
++ VALIDATE_FD(shp, shp->infd);
+ if(shp->infd>0 && (shp->fdstatus[shp->infd]&IOCLEX))
+ sh_close(shp->infd);
+ sh_setstate(sh_state(SH_FORKED));
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/subshell.c INIT.2011-02-08/src/cmd/ksh93/sh/subshell.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/subshell.c 2012-05-02 03:16:25.241021529 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/subshell.c 2012-05-02 03:17:53.571942019 -0700
+@@ -115,6 +115,7 @@ void sh_subtmpfile(Shell_t *shp)
+ if((sp->tmpfd = fd = fcntl(1,F_DUPFD,10)) >= 0)
+ {
+ fcntl(fd,F_SETFD,FD_CLOEXEC);
++ VALIDATE_FD(shp, fd);
+ shp->fdstatus[fd] = shp->fdstatus[1]|IOCLEX;
+ close(1);
+ }
+@@ -141,6 +142,7 @@ void sh_subtmpfile(Shell_t *shp)
+ }
+ else
+ {
++ VALIDATE_FD(shp, fd);
+ shp->fdstatus[fd] = IOREAD|IOWRITE;
+ sfsync(sfstdout);
+ if(fd==1)
+@@ -627,6 +629,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ ((struct checkpt*)shp->jmplist)->mode = SH_JMPERREXIT;
+ errormsg(SH_DICT,ERROR_system(1),e_toomany);
+ }
++ VALIDATE_FD(shp, fd);
+ shp->sftable[fd] = iop;
+ fcntl(fd,F_SETFD,FD_CLOEXEC);
+ shp->fdstatus[fd] = (shp->fdstatus[1]|IOCLEX);
+diff -rupN INIT.2011-02-08.clean/src/cmd/ksh93/sh/xec.c INIT.2011-02-08/src/cmd/ksh93/sh/xec.c
+--- INIT.2011-02-08.clean/src/cmd/ksh93/sh/xec.c 2012-05-02 03:16:17.393286735 -0700
++++ INIT.2011-02-08/src/cmd/ksh93/sh/xec.c 2012-05-02 03:17:53.574535124 -0700
+@@ -94,6 +94,8 @@ static void iousepipe(Shell_t *shp)
+ usepipe++;
+ fcntl(subpipe[0],F_SETFD,FD_CLOEXEC);
+ subpipe[2] = fcntl(1,F_DUPFD,10);
++ VALIDATE_FD(shp, subpipe[1]);
++ VALIDATE_FD(shp, subpipe[2]);
+ shp->fdstatus[subpipe[2]] = shp->fdstatus[1];
+ close(1);
+ fcntl(subpipe[1],F_DUPFD,1);
+@@ -117,6 +119,7 @@ static void iounpipe(Shell_t *shp)
+ usepipe = 0;
+ close(1);
+ fcntl(subpipe[2], F_DUPFD, 1);
++ VALIDATE_FD(shp, subpipe[2]);
+ shp->fdstatus[1] = shp->fdstatus[subpipe[2]];
+ if(subdup) for(n=0; n < 10; n++)
+ {
+@@ -844,6 +847,7 @@ static int sh_coexec(Shell_t *shp,const
+ if(filt > 2)
+ {
+ shp->coutpipe = shp->inpipe[1];
++ VALIDATE_FD(shp, shp->coutpipe);
+ shp->fdptrs[shp->coutpipe] = &shp->coutpipe;
+ }
+ }
+@@ -1487,6 +1491,7 @@ int sh_exec(register const Shnode_t *t,
+ if(shp->cpipe[0]<0 || shp->cpipe[1] < 0)
+ {
+ sh_copipe(shp,shp->outpipe=shp->cpipe,0);
++ VALIDATE_FD(shp, shp->cpipe[0]);
+ shp->fdptrs[shp->cpipe[0]] = shp->cpipe;
+ }
+ sh_copipe(shp,shp->inpipe=pipes,0);
+@@ -3419,6 +3424,8 @@ static void coproc_init(Shell_t *shp, in
+ if((outfd=shp->cpipe[1]) < 10)
+ {
+ int fd=fcntl(shp->cpipe[1],F_DUPFD,10);
++ VALIDATE_FD(shp, outfd);
++ VALIDATE_FD(shp, fd);
+ if(fd>=10)
+ {
+ shp->fdstatus[fd] = (shp->fdstatus[outfd]&~IOCLEX);
+@@ -3427,6 +3434,9 @@ static void coproc_init(Shell_t *shp, in
+ shp->cpipe[1] = fd;
+ }
+ }
++ VALIDATE_FD(shp, shp->cpipe[0]);
++ VALIDATE_FD(shp, shp->cpipe[1]);
++
+ if(fcntl(*shp->cpipe,F_SETFD,FD_CLOEXEC)>=0)
+ shp->fdstatus[shp->cpipe[0]] |= IOCLEX;
+ shp->fdptrs[shp->cpipe[0]] = shp->cpipe;
+@@ -3437,7 +3447,9 @@ static void coproc_init(Shell_t *shp, in
+ shp->outpipe = shp->cpipe;
+ sh_pipe(shp->inpipe=pipes);
+ shp->coutpipe = shp->inpipe[1];
++ VALIDATE_FD(shp, shp->coutpipe);
+ shp->fdptrs[shp->coutpipe] = &shp->coutpipe;
++ VALIDATE_FD(shp, shp->outpipe[0]);
+ if(fcntl(shp->outpipe[0],F_SETFD,FD_CLOEXEC)>=0)
+ shp->fdstatus[shp->outpipe[0]] |= IOCLEX;
+ }
+@@ -3608,6 +3620,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
+ int fd = shp->inpipe[1];
+ sh_iosave(shp,0,buff.topfd,(char*)0);
+ sh_iorenumber(shp,shp->inpipe[0],0);
++ VALIDATE_FD(shp, fd);
+ if(fd>=0 && (!(otype&FPOU) || (otype&FCOOP)) && fcntl(fd,F_SETFD,FD_CLOEXEC)>=0)
+ shp->fdstatus[fd] |= IOCLEX;
+ }
+@@ -3619,6 +3632,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
+ #endif /* SHOPT_COSHELL */
+ sh_iosave(shp,1,buff.topfd,(char*)0);
+ sh_iorenumber(shp,sh_dup(shp->outpipe[1]),1);
++ VALIDATE_FD(shp, shp->outpipe[0]);
+ if(fcntl(shp->outpipe[0],F_SETFD,FD_CLOEXEC)>=0)
+ shp->fdstatus[shp->outpipe[0]] |= IOCLEX;
+ }
+@@ -3658,6 +3672,7 @@ static pid_t sh_ntfork(Shell_t *shp,cons
+ signal(SIGQUIT,sh_fault);
+ signal(SIGINT,sh_fault);
+ }
++ VALIDATE_FD(shp, shp->inpipe[1]);
+ if((otype&FPIN) && (!(otype&FPOU) || (otype&FCOOP)) && fcntl(shp->inpipe[1],F_SETFD,FD_CLOEXEC)>=0)
+ shp->fdstatus[shp->inpipe[1]] &= ~IOCLEX;
+ if(t->fork.forkio || otype)