9c226b5
diff -up ksh-20120801/src/cmd/ksh93/include/io.h.safefd ksh-20120801/src/cmd/ksh93/include/io.h
9c226b5
--- ksh-20120801/src/cmd/ksh93/include/io.h.safefd	2015-03-03 18:21:40.544732158 +0100
9c226b5
+++ ksh-20120801/src/cmd/ksh93/include/io.h	2015-03-03 18:22:16.284447849 +0100
9c226b5
@@ -78,6 +78,7 @@ extern void 	sh_iorestore(Shell_t*,int,i
9c226b5
 extern Sfio_t 	*sh_iostream(Shell_t*,int);
9c226b5
 extern int	sh_redirect(Shell_t*,struct ionod*,int);
9c226b5
 extern void 	sh_iosave(Shell_t *, int,int,char*);
9c226b5
+extern int 	safefdnumber(Shell_t* shp, int sfd);
9c226b5
 extern int 	sh_iovalidfd(Shell_t*, int);
9c226b5
 extern int 	sh_inuse(Shell_t*, int);
9c226b5
 extern void 	sh_iounsave(Shell_t*);
9c226b5
diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.safefd ksh-20120801/src/cmd/ksh93/sh/io.c
9c226b5
--- ksh-20120801/src/cmd/ksh93/sh/io.c.safefd	2015-03-03 18:21:40.511732421 +0100
9c226b5
+++ ksh-20120801/src/cmd/ksh93/sh/io.c	2015-03-03 18:21:40.544732158 +0100
9c226b5
@@ -1724,6 +1724,25 @@ void sh_iosave(Shell_t *shp, register in
9c226b5
 	}
9c226b5
 }
9c226b5
 
9c226b5
+int safefdnumber(Shell_t* shp, int sfd)
9c226b5
+{
9c226b5
+	register int fd;
9c226b5
+
9c226b5
+	while(1)
9c226b5
+	{
9c226b5
+		for(fd=0; fd < shp->topfd; fd++)
9c226b5
+		{
9c226b5
+			if (filemap[fd].save_fd==sfd || filemap[fd].orig_fd==sfd || (fcntl(sfd, F_GETFD) != -1 || errno != EBADF))
9c226b5
+			{
9c226b5
+				sfd++;
9c226b5
+				continue;
9c226b5
+			}
9c226b5
+		}
9c226b5
+		break;
9c226b5
+	}
9c226b5
+	return sfd;
9c226b5
+}
9c226b5
+
9c226b5
 /*
9c226b5
  *  close all saved file descriptors
9c226b5
  */
9c226b5
diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.safefd ksh-20120801/src/cmd/ksh93/sh/subshell.c
9c226b5
--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.safefd	2015-03-03 18:21:40.531732261 +0100
9c226b5
+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2015-03-03 18:21:40.544732158 +0100
9c226b5
@@ -673,7 +673,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
9c226b5
 			}
9c226b5
 			if(iop && sffileno(iop)==1)
9c226b5
 			{
9c226b5
-				int fd=sfsetfd(iop,3);
9c226b5
+				int fd=sfsetfd(iop,safefdnumber(shp,3));
9c226b5
 				if(fd<0)
9c226b5
 				{
9c226b5
 					shp->toomany = 1;