From 76b1d02aa2ad85f54354dd3d81113cd35b59efc6 Mon Sep 17 00:00:00 2001
From: Michal Hlavinka <mhlavink@redhat.com>
Date: Mar 30 2015 15:09:19 +0000
Subject: cd builtin could break IO redirection


- fix segfault when handling a trap
- exporting fixed with variable corrupted its data
- and more fixes

---

diff --git a/ksh-20120801-alarmifs.patch b/ksh-20120801-alarmifs.patch
new file mode 100644
index 0000000..88b0ba9
--- /dev/null
+++ b/ksh-20120801-alarmifs.patch
@@ -0,0 +1,33 @@
+--- ksh-20120801/src/cmd/ksh93/sh/init.c	2014-12-10 20:11:17.693446084 -0200
++++ ksh-20120801/src/cmd/ksh93/sh/init.c	2014-12-10 20:11:24.753442619 -0200
+@@ -576,6 +576,7 @@ static char* get_ifs(register Namval_t*
+ 			shp->ifstable[' '] = shp->ifstable['\t'] = S_SPACE;
+ 			shp->ifstable['\n'] = S_NL;
+ 		}
++		shp->ifstable[0] = S_EOF;
+ 	}
+ 	return(value);
+ }
+--- ksh-20120801/src/cmd/ksh93/bltins/alarm.c	2014-12-18 12:03:39.198461933 -0200
++++ ksh-20120801/src/cmd/ksh93/bltins/alarm.c	2014-12-18 12:04:32.464421268 -0200
+@@ -130,6 +130,7 @@ void	sh_timetraps(Shell_t *shp)
+ {
+ 	register struct tevent *tp, *tpnext;
+ 	register struct tevent *tptop;
++	char	ifstable[256];
+ 	while(1)
+ 	{
+ 		shp->sigflag[SIGALRM] &= ~SH_SIGALRM;
+@@ -141,7 +142,11 @@ void	sh_timetraps(Shell_t *shp)
+ 			{
+ 				tp->flags &= ~L_FLAG;
+ 				if(tp->action)
++				{
++				    	memcpy(ifstable,shp->ifstable,sizeof(ifstable));
+ 					sh_fun(tp->action,tp->node,(char**)0);
++					memcpy(shp->ifstable,ifstable,sizeof(ifstable));
++				}
+ 				tp->flags &= ~L_FLAG;
+ 				if(!tp->flags)
+ 				{
+
diff --git a/ksh-20120801-assoc-unset-leak.patch b/ksh-20120801-assoc-unset-leak.patch
new file mode 100644
index 0000000..1af7d16
--- /dev/null
+++ b/ksh-20120801-assoc-unset-leak.patch
@@ -0,0 +1,20 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/name.c.orig ksh-20120801/src/cmd/ksh93/sh/name.c
+--- ksh-20120801/src/cmd/ksh93/sh/name.c.orig	2015-02-10 17:15:37.180783550 -0200
++++ ksh-20120801/src/cmd/ksh93/sh/name.c	2015-02-10 18:25:51.726228437 -0200
+@@ -1298,7 +1298,16 @@ void nv_delete(Namval_t* np, Dt_t *root,
+ 		if(dtdelete(root,np))
+ 		{
+ 			if(!(flags&NV_NOFREE) && ((flags&NV_FUNCTION) || !nv_subsaved(np,flags&NV_TABLE)))
++			{
++				Namarr_t	*ap;
++				if(nv_isarray(np) && np->nvfun && (ap=nv_arrayptr(np)) && array_assoc(ap)) {
++					while(nv_associative(np,0,NV_ANEXT))
++						nv_associative(np, 0, NV_ADELETE);
++					nv_associative(np, 0, NV_AFREE);
++					free((void*)np->nvfun);
++				}
+ 				free((void*)np);
++			}
+ 		}
+ #if 0
+ 		else
diff --git a/ksh-20120801-cdfork.patch b/ksh-20120801-cdfork.patch
new file mode 100644
index 0000000..c82cb4c
--- /dev/null
+++ b/ksh-20120801-cdfork.patch
@@ -0,0 +1,40 @@
+--- ksh-20120801/src/cmd/ksh93/sh/path.c	2014-09-01 15:08:06.738969962 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/path.c	2014-09-01 15:13:51.321459978 -0300
+@@ -229,13 +229,12 @@ static pid_t path_xargs(Shell_t *shp,con
+ /*
+  * make sure PWD is set up correctly
+  * Return the present working directory
+- * Invokes getcwd() if flag==0 and if necessary
++ * Invokes getcwd() if necessary
+  * Sets the PWD variable to this value
+  */
+ char *path_pwd(Shell_t *shp,int flag)
+ {
+ 	register char *cp;
+-	register char *dfault = (char*)e_dot;
+ 	register int count = 0;
+ 	if(shp->pwd)
+ 		return((char*)shp->pwd);
+@@ -254,11 +253,6 @@ char *path_pwd(Shell_t *shp,int flag)
+ 				cp = "/";
+ 				break;
+ 			case 3:
+-				cp = (char*)e_crondir;
+-				if(flag) /* skip next case when non-zero flag */
+-					++count;
+-				break;
+-			case 4:
+ 			{
+ 				if(cp=getcwd(NIL(char*),0))
+ 				{  
+@@ -269,8 +263,8 @@ char *path_pwd(Shell_t *shp,int flag)
+ 				}
+ 				break;
+ 			}
+-			case 5:
++			case 4:
+-				return(dfault);
++				return((char*)e_dot);
+ 		}
+ 		if(cp && *cp=='/' && test_inode(cp,e_dot))
+ 			break;
diff --git a/ksh-20120801-crash.patch b/ksh-20120801-crash.patch
index 37b7962..63eda72 100644
--- a/ksh-20120801-crash.patch
+++ b/ksh-20120801-crash.patch
@@ -1,6 +1,6 @@
 diff -up ksh-20120801/src/cmd/ksh93/include/jobs.h.crash ksh-20120801/src/cmd/ksh93/include/jobs.h
---- ksh-20120801/src/cmd/ksh93/include/jobs.h.crash	2014-07-22 11:48:57.205062905 +0200
-+++ ksh-20120801/src/cmd/ksh93/include/jobs.h	2014-07-22 11:48:57.243062711 +0200
+--- ksh-20120801/src/cmd/ksh93/include/jobs.h.crash	2014-07-16 17:32:03.570057304 +0200
++++ ksh-20120801/src/cmd/ksh93/include/jobs.h	2014-07-16 17:32:03.600057172 +0200
 @@ -118,6 +118,7 @@ struct jobs
  	char		jobcontrol;	/* turned on for real job control */
  	char		waitsafe;	/* wait will not block */
@@ -10,8 +10,8 @@ diff -up ksh-20120801/src/cmd/ksh93/include/jobs.h.crash ksh-20120801/src/cmd/ks
  	unsigned char	*freejobs;	/* free jobs numbers */
  #if SHOPT_COSHELL
 diff -up ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash ksh-20120801/src/cmd/ksh93/sh/jobs.c
---- ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash	2014-07-22 11:48:57.190062982 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/jobs.c	2014-07-22 11:48:57.243062711 +0200
+--- ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash	2014-07-16 17:32:03.554057375 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/jobs.c	2014-07-16 17:32:03.600057172 +0200
 @@ -1957,6 +1957,7 @@ again:
  	{
  		count = bp->count;
@@ -21,8 +21,8 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash ksh-20120801/src/cmd/ksh93/s
  	}
  	if(jp)
 diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash ksh-20120801/src/cmd/ksh93/sh/subshell.c
---- ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash	2014-07-22 11:48:57.234062758 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-07-22 11:54:04.164491483 +0200
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash	2014-07-16 17:32:03.593057203 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-07-16 17:32:03.600057172 +0200
 @@ -492,6 +492,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
  	struct sh_scoped savst;
  	struct dolnod   *argsav=0;
@@ -47,12 +47,12 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash ksh-20120801/src/cmd/ksh
  		else
  		{
 +			job.hack1_waitall=0;
- 			if(comsub!=1 && shp->spid)
- 			{
- 				job_wait(shp->spid);
+ 			/* move tmp file to iop and restore sfstdout */
+ 			iop = sfswap(sfstdout,NIL(Sfio_t*));
+ 			if(!iop)
 diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.crash ksh-20120801/src/cmd/ksh93/sh/xec.c
---- ksh-20120801/src/cmd/ksh93/sh/xec.c.crash	2014-07-22 11:48:57.228062787 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-07-22 11:48:57.245062700 +0200
+--- ksh-20120801/src/cmd/ksh93/sh/xec.c.crash	2014-07-16 17:32:03.587057230 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-07-16 17:32:03.601057168 +0200
 @@ -2125,7 +2125,7 @@ int sh_exec(register const Shnode_t *t,
  				memset(exitval,0,job.waitall*sizeof(int));
  			}
diff --git a/ksh-20120801-emptyarrayinit.patch b/ksh-20120801-emptyarrayinit.patch
new file mode 100644
index 0000000..c888b31
--- /dev/null
+++ b/ksh-20120801-emptyarrayinit.patch
@@ -0,0 +1,11 @@
+--- ksh-20120801/src/cmd/ksh93/sh/array.c	2014-12-11 16:39:34.253860675 -0200
++++ ksh-20120801/src/cmd/ksh93/sh/array.c	2014-12-11 16:39:40.794857083 -0200
+@@ -1003,7 +1003,7 @@ Namarr_t *nv_setarray(Namval_t *np, void
+ 		ap->nelem = nelem;
+ 		ap->fun = fun;
+ 		nv_onattr(np,NV_ARRAY);
+-		if(fp || value)
++		if(fp || (value && value != Empty))
+ 		{
+ 			nv_putsub(np, "0", ARRAY_ADD);
+ 			if(value)
diff --git a/ksh-20120801-fd2lost.patch b/ksh-20120801-fd2lost.patch
index 0605f6e..fbb7607 100644
--- a/ksh-20120801-fd2lost.patch
+++ b/ksh-20120801-fd2lost.patch
@@ -1,6 +1,6 @@
-diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.fd2lost ksh-20120801/src/cmd/ksh93/sh/macro.c
---- ksh-20120801/src/cmd/ksh93/sh/macro.c.fd2lost	2014-01-22 16:23:21.211658984 +0100
-+++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2014-01-22 16:23:21.243658703 +0100
+diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.orig ksh-20120801/src/cmd/ksh93/sh/macro.c
+--- ksh-20120801/src/cmd/ksh93/sh/macro.c.orig	2013-12-09 13:13:22.153525239 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2013-12-09 13:20:58.144635385 +0100
 @@ -391,7 +391,7 @@ void sh_machere(Shell_t *shp,Sfio_t *inf
  				break;
  			    }
@@ -19,9 +19,24 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.fd2lost ksh-20120801/src/cmd/ksh9
  		return(1);
  	    case S_DIG:
  		var = 0;
-diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.fd2lost ksh-20120801/src/cmd/ksh93/sh/subshell.c
---- ksh-20120801/src/cmd/ksh93/sh/subshell.c.fd2lost	2014-01-22 16:23:21.222658887 +0100
-+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-01-22 16:23:21.243658703 +0100
+@@ -2152,10 +2152,12 @@ static void comsubst(Mac_t *mp,register
+ 	mp->ifsp = nv_getval(np);
+ 	stkset(stkp,savptr,savtop);
+ 	newlines = 0;
+-	if(type/*==3 - don't break `` vs $() */ && mp->shp->spid)
++	if(type==3 && mp->shp->spid)
+ 	{
+ 		job_wait(mp->shp->spid);
+-		mp->shp->spid = 0;
++		if(mp->shp->pipepid==mp->shp->spid)
++			mp->shp->spid = 0;
++		mp->shp->pipepid = 0;
+ 	}
+ 	sfsetbuf(sp,(void*)sp,0);
+ 	bufsize = sfvalue(sp);
+diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.anotherfix ksh-20120801/src/cmd/ksh93/sh/subshell.c
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.anotherfix	2014-01-20 14:43:46.410416327 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-01-20 14:43:46.444416042 +0100
 @@ -122,7 +122,8 @@ void	sh_subtmpfile(Shell_t *shp)
  		else if(errno!=EBADF)
  			errormsg(SH_DICT,ERROR_system(1),e_toomany);
@@ -32,33 +47,10 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.fd2lost ksh-20120801/src/cmd/k
  		if((fd=sffileno(sfstdout))<0)
  		{
  			/* unable to create the /tmp file so use a pipe */
-@@ -635,6 +636,13 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
- 		}
- 		else
- 		{
-+			if(comsub!=1 && shp->spid)
-+			{
-+				job_wait(shp->spid);
-+				if(shp->pipepid==shp->spid)
-+					shp->spid = 0;
-+				shp->pipepid = 0;
-+			}
- 			/* move tmp file to iop and restore sfstdout */
- 			iop = sfswap(sfstdout,NIL(Sfio_t*));
- 			if(!iop)
-diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.fd2lost ksh-20120801/src/cmd/ksh93/sh/xec.c
---- ksh-20120801/src/cmd/ksh93/sh/xec.c.fd2lost	2014-01-22 16:23:21.237658756 +0100
-+++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-01-22 16:38:36.374666019 +0100
-@@ -1756,6 +1756,8 @@ int sh_exec(register const Shnode_t *t,
- 					nlock--;
- 					job_unlock();
- 				}
-+				if(shp->subshell)
-+					shp->spid = parent;
- 				if(type&FPCL)
- 					sh_close(shp->inpipe[0]);
- 				if(type&(FCOOP|FAMP))
-@@ -1771,7 +1773,11 @@ int sh_exec(register const Shnode_t *t,
+diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.anotherfix ksh-20120801/src/cmd/ksh93/sh/xec.c
+--- ksh-20120801/src/cmd/ksh93/sh/xec.c.anotherfix	2014-01-20 14:47:30.527524008 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-01-20 14:47:30.563523703 +0100
+@@ -1773,7 +1773,11 @@ int sh_exec(register const Shnode_t *t,
  					if(shp->pipepid)
  						shp->pipepid = parent;
  					else
diff --git a/ksh-20120801-filecomsubst.patch b/ksh-20120801-filecomsubst.patch
index 676cc27..6aa1fea 100644
--- a/ksh-20120801-filecomsubst.patch
+++ b/ksh-20120801-filecomsubst.patch
@@ -1,5 +1,5 @@
-diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.tryfix01 ksh-20120801/src/cmd/ksh93/sh/io.c
---- ksh-20120801/src/cmd/ksh93/sh/io.c.tryfix01	2014-02-26 16:15:52.355391420 +0100
+diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.filecombsubst ksh-20120801/src/cmd/ksh93/sh/io.c
+--- ksh-20120801/src/cmd/ksh93/sh/io.c.filecombsubst	2014-02-26 16:15:52.355391420 +0100
 +++ ksh-20120801/src/cmd/ksh93/sh/io.c	2014-02-26 16:23:55.588148801 +0100
 @@ -1326,6 +1326,7 @@ int	sh_redirect(Shell_t *shp,struct iono
  				if(flag==SH_SHOWME)
diff --git a/ksh-20120801-macro.patch b/ksh-20120801-macro.patch
index 004a5eb..ca8024e 100644
--- a/ksh-20120801-macro.patch
+++ b/ksh-20120801-macro.patch
@@ -176,3 +176,30 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.macro ksh-20120801/src/cmd/ksh93/sh
  #if 0
  	nv_putval(SH_FUNNAMENOD,shp->st.funname,NV_NOFREE);
  #else
+diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.orig ksh-20120801/src/cmd/ksh93/sh/macro.c
+--- ksh-20120801/src/cmd/ksh93/sh/macro.c.orig	2012-06-29 20:05:47.000000000 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2013-08-12 18:06:17.291843164 +0200
+@@ -2152,6 +2152,11 @@ static void comsubst(Mac_t *mp,register
+ 	mp->ifsp = nv_getval(np);
+ 	stkset(stkp,savptr,savtop);
+ 	newlines = 0;
++	if(type/*==3 - don't break `` vs $() */ && mp->shp->spid)
++	{
++		job_wait(mp->shp->spid);
++		mp->shp->spid = 0;
++	}
+ 	sfsetbuf(sp,(void*)sp,0);
+ 	bufsize = sfvalue(sp);
+ 	/* read command substitution output and put on stack or here-doc */
+diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.orig ksh-20120801/src/cmd/ksh93/sh/xec.c
+--- ksh-20120801/src/cmd/ksh93/sh/xec.c.orig	2013-08-12 18:06:57.567497226 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2013-08-12 18:20:36.443454280 +0200
+@@ -1734,6 +1734,8 @@ int sh_exec(register const Shnode_t *t,
+ 					nlock--;
+ 					job_unlock();
+ 				}
++				if(shp->subshell)
++					shp->spid = parent;
+ 				if(type&FPCL)
+ 					sh_close(shp->inpipe[0]);
+ 				if(type&(FCOOP|FAMP))
diff --git a/ksh-20120801-noexeccdfix.patch b/ksh-20120801-noexeccdfix.patch
new file mode 100644
index 0000000..47128e0
--- /dev/null
+++ b/ksh-20120801-noexeccdfix.patch
@@ -0,0 +1,40 @@
+From b8260293a8ed7849a358291faae7b58f4a05dcc9 Mon Sep 17 00:00:00 2001
+From: Kamil Dudka <kdudka@redhat.com>
+Date: Mon, 10 Nov 2014 18:23:34 +0100
+Subject: [PATCH] Resolves: #1160923 - handle failure of fchdir()
+
+... and chdir()
+---
+ src/cmd/ksh93/bltins/cd_pwd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/cmd/ksh93/bltins/cd_pwd.c b/src/cmd/ksh93/bltins/cd_pwd.c
+index a972da6..c20959c 100644
+--- a/src/cmd/ksh93/bltins/cd_pwd.c
++++ b/src/cmd/ksh93/bltins/cd_pwd.c
+@@ -329,18 +329,20 @@ int	b_cd(int argc, char *argv[],Shbltin_t *context)
+ 		if(newdirfd >=0)
+ 		{
+ 			/* chdir for directories on HSM/tapeworms may take minutes */
+-			if(fchdir(newdirfd) >= 0)
++			if((rval=fchdir(newdirfd)) >= 0)
+ 			{
+ 				if(shp->pwdfd >= 0)
+ 					sh_close(shp->pwdfd);
+ 				shp->pwdfd=newdirfd;
+ 				goto success;
+ 			}
++			else
++				sh_close(newdirfd);
+ 		}
+ #ifndef O_SEARCH
+ 		else
+ 		{
+-			if(chdir(dir) >=0)
++			if((rval=chdir(dir)) >=0)
+ 			{
+ 				if(shp->pwdfd >= 0)
+ 				{
+-- 
+2.1.0
+
diff --git a/ksh-20120801-oldenvinit.patch b/ksh-20120801-oldenvinit.patch
new file mode 100644
index 0000000..8ee0863
--- /dev/null
+++ b/ksh-20120801-oldenvinit.patch
@@ -0,0 +1,95 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/init.c.fixset ksh-20120801/src/cmd/ksh93/sh/init.c
+--- ksh-20120801/src/cmd/ksh93/sh/init.c.fixset	2014-11-03 15:45:36.510997271 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/init.c	2014-11-03 16:20:44.398917280 +0100
+@@ -2003,8 +2003,91 @@ static Dt_t *inittree(Shell_t *shp,const
+  * skip over items that are not name-value pairs
+  */
+ 
++
+ static void env_init(Shell_t *shp)
+ {
++	register char *cp;
++	register Namval_t	*np;
++	register char **ep=environ;
++	register char *next=0;
++#ifdef _ENV_H
++	shp->env = env_open(environ,3);
++	env_delete(shp->env,"_");
++#endif
++	if(ep)
++	{
++		while(cp= *ep++)
++		{
++			if(*cp=='A' && cp[1]=='_' && cp[2]=='_' && cp[3]=='z' && cp[4]=='=')
++				next = cp+4;
++			else if(np=nv_open(cp,shp->var_tree,(NV_EXPORT|NV_IDENT|NV_ASSIGN|NV_NOFAIL))) 
++			{
++				nv_onattr(np,NV_IMPORT);
++				np->nvenv = cp;
++				nv_close(np);
++			}
++			else  /* swap with front */
++			{
++				ep[-1] = environ[shp->nenv];
++				environ[shp->nenv++] = cp;
++			}
++		}
++		while(cp=next)
++		{
++			if(next = strchr(++cp,'='))
++				*next = 0;
++			np = nv_search(cp+2,shp->var_tree,NV_ADD);
++			if(np!=SHLVL && nv_isattr(np,NV_IMPORT|NV_EXPORT))
++			{
++				int flag = *(unsigned char*)cp-' ';
++				int size = *(unsigned char*)(cp+1)-' ';
++				if((flag&NV_INTEGER) && size==0)
++				{
++					/* check for floating*/
++					char *ep,*val = nv_getval(np);
++					strtol(val,&ep,10);
++					if(*ep=='.' || *ep=='e' || *ep=='E')
++					{
++						char *lp;
++						flag |= NV_DOUBLE;
++						if(*ep=='.')
++						{
++							strtol(ep+1,&lp,10);
++							if(*lp)
++								ep = lp;
++						}
++						if(*ep && *ep!='.')
++						{
++							flag |= NV_EXPNOTE;
++							size = ep-val;
++						}
++						else
++							size = strlen(ep);
++						size--;
++					}
++				}
++				nv_newattr(np,flag|NV_IMPORT|NV_EXPORT,size);
++			}
++			else
++				cp += 2;
++		}
++	}
++#ifdef _ENV_H
++	env_delete(shp->env,e_envmarker);
++#endif
++	if(nv_isnull(PWDNOD) || nv_isattr(PWDNOD,NV_TAGGED))
++	{
++		nv_offattr(PWDNOD,NV_TAGGED);
++		path_pwd(shp,0);
++	}
++	if((cp = nv_getval(SHELLNOD)) && (sh_type(cp)&SH_TYPE_RESTRICTED))
++		sh_onoption(SH_RESTRICTED); /* restricted shell */
++	return;
++}
++
++
++static void env_init_backup(Shell_t *shp)
++{
+ 	register char		*cp;
+ 	register Namval_t	*np,*mp;
+ 	register char		**ep=environ;
diff --git a/ksh-20120801-retfix.patch b/ksh-20120801-retfix.patch
new file mode 100644
index 0000000..bcb5b33
--- /dev/null
+++ b/ksh-20120801-retfix.patch
@@ -0,0 +1,20 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.retfix ksh-20120801/src/cmd/ksh93/sh/subshell.c
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.retfix	2014-09-01 13:50:02.956085721 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-09-01 13:54:01.104818416 +0200
+@@ -652,6 +652,16 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 		}
+ 		else
+ 		{
++			if(comsub!=1 && shp->spid)
++			{
++				int c = shp->exitval;
++				job_wait(shp->spid);
++				shp->exitval = c;
++				exitset();
++				if(shp->pipepid==shp->spid)
++					shp->spid = 0;
++				shp->pipepid = 0;
++			}
+ 			job.hack1_waitall=0;
+ 			/* move tmp file to iop and restore sfstdout */
+ 			iop = sfswap(sfstdout,NIL(Sfio_t*));
diff --git a/ksh-20120801-trapcom.patch b/ksh-20120801-trapcom.patch
new file mode 100644
index 0000000..a900b54
--- /dev/null
+++ b/ksh-20120801-trapcom.patch
@@ -0,0 +1,47 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.orig ksh-20120801/src/cmd/ksh93/sh/subshell.c
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.orig	2014-08-23 20:20:24.676186573 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-08-23 20:29:00.772151283 -0300
+@@ -481,12 +481,12 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ {
+ 	struct subshell sub_data;
+ 	register struct subshell *sp = &sub_data;
+-	int jmpval,nsig=0,duped=0;
++	int jmpval,isig,nsig=0,duped=0;
+ 	long savecurenv = shp->curenv;
+ 	int savejobpgid = job.curpgid;
+ 	int *saveexitval = job.exitval;
+ 	int16_t subshell;
+-	char *savsig;
++	char **savsig;
+ 	Sfio_t *iop=0;
+ 	struct checkpt buff;
+ 	struct sh_scoped savst;
+@@ -561,10 +561,13 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 		/* save trap table */
+ 		shp->st.otrapcom = 0;
+ 		shp->st.otrap = savst.trap;
+-		if((nsig=shp->st.trapmax*sizeof(char*))>0 || shp->st.trapcom[0])
++		if((nsig=shp->st.trapmax)>0 || shp->st.trapcom[0])
+ 		{
+-			nsig += sizeof(char*);
+-			memcpy(savsig=malloc(nsig),(char*)&shp->st.trapcom[0],nsig);
++			++nsig;
++			savsig = malloc(nsig * sizeof(char*));
++			/* contents of shp->st.st.trapcom may change */
++			for (isig = 0; isig < nsig; ++isig)
++				savsig[isig] = shp->st.trapcom[isig] ? strdup(shp->st.trapcom[isig]) : NULL;
+ 			/* this nonsense needed for $(trap) */
+ 			shp->st.otrapcom = (char**)savsig;
+ 		}
+@@ -729,7 +732,10 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 		shp->st.otrap = 0;
+ 		if(nsig)
+ 		{
+-			memcpy((char*)&shp->st.trapcom[0],savsig,nsig);
++			for (isig = 0; isig < nsig; ++isig)
++				if (shp->st.trapcom[isig])
++					free(shp->st.trapcom[isig]);
++			memcpy((char*)&shp->st.trapcom[0],savsig,nsig*sizeof(char*));
+ 			free((void*)savsig);
+ 		}
+ 		shp->options = sp->options;
diff --git a/ksh-20140929-safefd.patch b/ksh-20140929-safefd.patch
new file mode 100644
index 0000000..80db205
--- /dev/null
+++ b/ksh-20140929-safefd.patch
@@ -0,0 +1,52 @@
+diff -up ksh-20120801/src/cmd/ksh93/include/io.h.safefd ksh-20120801/src/cmd/ksh93/include/io.h
+--- ksh-20120801/src/cmd/ksh93/include/io.h.safefd	2015-03-03 18:21:40.544732158 +0100
++++ ksh-20120801/src/cmd/ksh93/include/io.h	2015-03-03 18:22:16.284447849 +0100
+@@ -78,6 +78,7 @@ extern void 	sh_iorestore(Shell_t*,int,i
+ extern Sfio_t 	*sh_iostream(Shell_t*,int);
+ extern int	sh_redirect(Shell_t*,struct ionod*,int);
+ extern void 	sh_iosave(Shell_t *, int,int,char*);
++extern int 	safefdnumber(Shell_t* shp, int sfd);
+ extern int 	sh_iovalidfd(Shell_t*, int);
+ extern int 	sh_inuse(Shell_t*, int);
+ extern void 	sh_iounsave(Shell_t*);
+diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.safefd ksh-20120801/src/cmd/ksh93/sh/io.c
+--- ksh-20120801/src/cmd/ksh93/sh/io.c.safefd	2015-03-03 18:21:40.511732421 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/io.c	2015-03-03 18:21:40.544732158 +0100
+@@ -1724,6 +1724,25 @@ void sh_iosave(Shell_t *shp, register in
+ 	}
+ }
+ 
++int safefdnumber(Shell_t* shp, int sfd)
++{
++	register int fd;
++
++	while(1)
++	{
++		for(fd=0; fd < shp->topfd; fd++)
++		{
++			if (filemap[fd].save_fd==sfd || filemap[fd].orig_fd==sfd || (fcntl(sfd, F_GETFD) != -1 || errno != EBADF))
++			{
++				sfd++;
++				continue;
++			}
++		}
++		break;
++	}
++	return sfd;
++}
++
+ /*
+  *  close all saved file descriptors
+  */
+diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.safefd ksh-20120801/src/cmd/ksh93/sh/subshell.c
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.safefd	2015-03-03 18:21:40.531732261 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2015-03-03 18:21:40.544732158 +0100
+@@ -673,7 +673,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 			}
+ 			if(iop && sffileno(iop)==1)
+ 			{
+-				int fd=sfsetfd(iop,3);
++				int fd=sfsetfd(iop,safefdnumber(shp,3));
+ 				if(fd<0)
+ 				{
+ 					shp->toomany = 1;
diff --git a/ksh.spec b/ksh.spec
index 0df89e5..8ee53e5 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -9,7 +9,7 @@ Group:        System Environment/Shells
 #CPL everywhere else (for KSH itself)
 License:      CPL
 Version:      %{releasedate}
-Release:      22%{?dist}
+Release:      23%{?dist}
 Source0:      http://www.research.att.com/~gsf/download/tgz/ast-ksh.%{release_date}.tgz
 Source1:      http://www.research.att.com/~gsf/download/tgz/INIT.%{release_date}.tgz
 Source2:      kshcomp.conf
@@ -68,58 +68,87 @@ Patch32: ksh-20100621-manfix3.patch
 # rhbz#1016611
 Patch33: ksh-20120801-nomulti.patch
 
-# for ksh <= 2014-01-14, rhbz#
-Patch34: ksh-20120801-mtty.patch
+# from upstream, rhbz#1036802
+Patch34: ksh-20120801-fd2lost.patch
 
-# from upstream, rbzh#1048272
-Patch35: ksh-20120801-fd2lost.patch
+# for ksh <= 2014-01-14, rhbz#1036470
+Patch35: ksh-20120801-memlik3.patch
 
-# sent upstream 2014-01, rhbz#1047507
-Patch36: ksh-20120801-argvfix.patch
+# for ksh <= 2014-03-04, rhbz#1066589
+Patch36: ksh-20120801-filecomsubst.patch
 
-# for ksh <= 2014-01-14, rhbz#1048995
-Patch37: ksh-20120801-memlik3.patch
+# for ksh <= 2014-04-05, rhbz#825520
+Patch37: ksh-20120801-crash.patch
 
-# for ksh <= 2013-04-09, rhbz#960371
-Patch38: ksh-20120801-lexfix.patch
+# for ksh < 2013-03-19, rhbz#1075635
+Patch38: ksh-20120801-sufix.patch
+
+# for ksh < 2014-03, rhbz#1047506
+Patch39: ksh-20120801-argvfix.patch
+
+# sent upstream, rhbz#1078698
+Patch40: ksh-20140301-fikspand.patch
+
+# for ksh < 2014-04-15, rhbz#1070350
+Patch41: ksh-20120801-roundit.patch
+
+# for ksh < 2014-04-15, rhbz#1036931
+Patch42: ksh-20120801-heresub.patch
+
+# not included upstream yet, rhbz#1062296
+Patch43: ksh-20140415-hokaido.patch
+
+# for ksh < 20121004, rhbz#1083713
+Patch44: ksh-20120801-tpstl.patch
 
-# not yet upstream, for ksh <= 2014-02-26, rhbz#1070328
-Patch39: ksh-20120801-filecomsubst.patch
+# for ksh <= 20120214, rhbz#1023109
+Patch45: ksh-20120801-mtty.patch
 
-# for ksh <= 2014-06-25, rhbz#825520,rhbz#1084406
-Patch40: ksh-20120801-crash.patch
+# sent upstream, rhbz#1019334
+Patch46: ksh-20120801-manfix4.patch
 
-# for ksh < 2013-03-19, rhbz#1085385
-Patch41: ksh-20120801-sufix.patch
+# not upstream yet, rhbz#1105138
+Patch47: ksh-20120801-fununset.patch
 
-# sent upstream, rhbz#1099935
-Patch42: ksh-20140301-fikspand.patch
+# not upstream yet, rhbz#1102627
+Patch48: ksh-20120801-cdfix3.patch
 
-# for ksh < 2014-04-15, rhbz#1070871
-Patch43: ksh-20120801-roundit.patch
+# sent upstream, rhbz#1112306
+Patch49: ksh-20120801-locking.patch
 
-# for ksh < 2014-04-15, rhbz#1111120
-Patch44: ksh-20120801-heresub.patch
+# for ksh <= 2013-06-13, rhbz#1133582
+Patch50: ksh-20130613-cdfix4.patch
+Patch51: ksh-20120801-retfix.patch
 
-# not included upstream yet, rhbz#1077090
-Patch45: ksh-20140415-hokaido.patch
+# not upstream yet, rhbz#1147645
+Patch52: ksh-20120801-oldenvinit.patch
 
-# for ksh < 2012-10-04, rhbz#1121960
-Patch46: ksh-20120801-tpstl.patch
+# not upstream yet, rhbz#1160923
+Patch53: ksh-20120801-noexeccdfix.patch
 
-# sent upstream, rhbz#1100215
-Patch47: ksh-20120801-manfix4.patch
+# sent upstream, for ksh <= 2014-09-30, rhbz#1168611
+Patch54: ksh-20120801-cdfork.patch
 
-# not upstream yet, rhbz#1100215
-Patch48: ksh-20120801-fununset.patch
+# from upsteam, for ksh < 2012-10-04, rhbz#1173668
+Patch55: ksh-20120801-emptyarrayinit.patch
 
-# for ksh < 2014-06-25, rhbz#1109893
-Patch49: ksh-20120801-cdfix3.patch
+# not upstream yet, rhbz#1188377
+Patch56: ksh-20120801-xufix.patch
 
-# sent upstream, rhbz#1116506
-Patch50: ksh-20120801-locking.patch
-Patch51: ksh-20130613-cdfix4.patch
-Patch52: ksh-20120801-xufix.patch
+# sent upstream, for ksh <= 2015-02-10, rhbz#1189294
+Patch57: ksh-20120801-assoc-unset-leak.patch
+
+# sent upstream, for ksh <= 2014-12-18, rhbz#1176670
+Patch58: ksh-20120801-alarmifs.patch
+
+# not yet upstream, rhbz#1116072
+Patch59: ksh-20140929-safefd.patch
+
+# workaround, for ksh < 2013-05-24, rhbz#1117404
+Patch60: ksh-20120801-trapcom.patch
+
+# for ksh <= 2013-04-09, rhbz#960371
+Patch61: ksh-20120801-lexfix.patch
 
 BuildRoot:    %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Conflicts:    pdksh
@@ -158,25 +187,34 @@ with "sh" (the Bourne Shell).
 %patch31 -p1 -b .covsfix
 %patch32 -p1 -b .manfix3
 %patch33 -p1 -b .nomulti
-%patch34 -p1 -b .mtty
-%patch35 -p1 -b .fd2lost
-%patch36 -p1 -b .argvfix
-%patch37 -p1 -b .memlik3
-%patch38 -p1 -b .lexfix
-%patch39 -p1 -b .filecomsubst
-%patch40 -p1 -b .crash
-%patch41 -p1 -b .sufix
-%patch42 -p1 -b .fikspand
-%patch43 -p1 -b .roundit
-%patch44 -p1 -b .heresub
-%patch45 -p1 -b .hokaido
-%patch46 -p1 -b .tpstl
-%patch47 -p1 -b .manfix4
-%patch48 -p1 -b .fununset
-%patch49 -p1 -b .cdfix3
-%patch50 -p1 -b .locking
-%patch51 -p1 -b .cdfix4
-%patch52 -p1 -b .xufix
+%patch34 -p1 -b .fd2lost
+%patch35 -p1 -b .memlik3
+%patch36 -p1 -b .filecomsubst
+%patch37 -p1 -b .crash
+%patch38 -p1 -b .sufix
+%patch39 -p1 -b .argvfix
+%patch40 -p1 -b .fikspand
+%patch41 -p1 -b .roundit
+%patch42 -p1 -b .heresub
+%patch43 -p1 -b .hokaido
+%patch44 -p1 -b .tpstl
+%patch45 -p1 -b .mtty
+%patch46 -p1 -b .manfix4
+%patch47 -p1 -b .fununset
+%patch48 -p1 -b .cdfix3
+%patch49 -p1 -b .locking
+%patch50 -p1 -b .cdfix4
+%patch51 -p1 -b .retfix
+%patch52 -p1 -b .oldenvinit
+%patch53 -p1 -b .noexeccdfix
+%patch54 -p1 -b .cdfork
+%patch55 -p1 -b .emptyarrayinit
+%patch56 -p1 -b .xufix
+%patch57 -p1 -b .assoc-unset-leak
+%patch58 -p1 -b .alarmifs
+%patch59 -p1 -b .safefd
+%patch60 -p1 -b .trapcom
+%patch61 -p1 -b .lexfix
 
 #/dev/fd test does not work because of mock
 sed -i 's|ls /dev/fd|ls /proc/self/fd|' src/cmd/ksh93/features/options
@@ -184,6 +222,9 @@ sed -i 's|ls /dev/fd|ls /proc/self/fd|' src/cmd/ksh93/features/options
 # sh/main.c was not using CCFLAGS
 sed -i '/-c sh\/main.c/s|${mam_cc_FLAGS} |${mam_cc_FLAGS} ${CCFLAGS} |p' src/cmd/ksh93/Mamfile
 
+# disable register for debugging
+sed -i 1i"#define register" src/lib/libast/include/ast.h
+
 %build
 XTRAFLAGS=""
 for f in -Wno-unknown-pragmas -Wno-missing-braces -Wno-unused-result -Wno-return-type -Wno-int-to-pointer-cast -Wno-parentheses -Wno-unused -Wno-unused-but-set-variable -Wno-cpp
@@ -277,6 +318,12 @@ fi
     rm -rf $RPM_BUILD_ROOT
 
 %changelog
+* Mon Mar 30 2015 Michal Hlavinka <mhlavink@redhat.com> - 20120801-23
+- cd builtin could break IO redirection
+- fix segfault when handling a trap
+- exporting fixed with variable corrupted its data
+- and more fixes
+
 * Fri Mar 06 2015 Michal Hlavinka <mhlavink@redhat.com> - 20120801-22
 - exporting fixed with variable corrupted its data (#1192027)
 - ksh hangs when command substitution containing a pipe fills out the pipe buffer (#1121204)