diff --git a/ksh-20130628-longer.patch b/ksh-20130628-longer.patch
new file mode 100644
index 0000000..887fafd
--- /dev/null
+++ b/ksh-20130628-longer.patch
@@ -0,0 +1,56 @@
+diff -up ksh-20120801/src/cmd/ksh93/include/defs.h.longer ksh-20120801/src/cmd/ksh93/include/defs.h
+--- ksh-20120801/src/cmd/ksh93/include/defs.h.longer	2012-06-25 20:47:47.000000000 +0200
++++ ksh-20120801/src/cmd/ksh93/include/defs.h	2014-01-17 13:10:49.624714556 +0100
+@@ -162,8 +162,8 @@ struct shared
+ 	Namval_t	*prev_table;	/* previous table used in nv_open  */ \
+ 	Sfio_t		*outpool;	/* ouput stream pool */ \
+ 	long		timeout;	/* read timeout */ \
+-	short		curenv;		/* current subshell number */ \
+-	short		jobenv;		/* subshell number for jobs */ \
++	long		curenv;		/* current subshell number */ \
++	long		jobenv;		/* subshell number for jobs */ \
+ 	int		infd;		/* input file descriptor */ \
+ 	short		nextprompt;	/* next prompt is PS<nextprompt> */ \
+ 	short		poolfiles; \
+diff -up ksh-20120801/src/cmd/ksh93/include/jobs.h.longer ksh-20120801/src/cmd/ksh93/include/jobs.h
+--- ksh-20120801/src/cmd/ksh93/include/jobs.h.longer	2011-12-19 13:36:37.000000000 +0100
++++ ksh-20120801/src/cmd/ksh93/include/jobs.h	2014-01-17 13:10:49.625714536 +0100
+@@ -87,7 +87,7 @@ struct process
+ 	unsigned short	p_exit;		/* exit value or signal number */
+ 	unsigned short	p_exitmin;	/* minimum exit value for xargs */
+ 	unsigned short	p_flag;		/* flags - see below */
+-	int		p_env;		/* subshell environment number */
++	long		p_env;		/* subshell environment number */
+ #ifdef JOBS
+ 	off_t		p_name;		/* history file offset for command */
+ 	struct termios	p_stty;		/* terminal state for job */
+diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.longer ksh-20120801/src/cmd/ksh93/sh/subshell.c
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.longer	2014-01-17 13:10:49.559715864 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-01-17 13:13:41.392290104 +0100
+@@ -98,7 +98,7 @@ static struct subshell
+ #endif /* SHOPT_COSHELL */
+ } *subshell_data;
+ 
+-static int subenv;
++static long subenv;
+ 
+ 
+ /*
+@@ -171,7 +171,7 @@ void sh_subfork(void)
+ {
+ 	register struct subshell *sp = subshell_data;
+ 	Shell_t	*shp = sp->shp;
+-	int	curenv = shp->curenv;
++	long curenv = shp->curenv;
+ 	pid_t pid;
+ 	char *trap = shp->st.trapcom[0];
+ 	if(trap)
+@@ -461,7 +461,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 	struct subshell sub_data;
+ 	register struct subshell *sp = &sub_data;
+ 	int jmpval,nsig=0,duped=0;
+-	int savecurenv = shp->curenv;
++	long savecurenv = shp->curenv;
+ 	int savejobpgid = job.curpgid;
+ 	int *saveexitval = job.exitval;
+ 	int16_t subshell;
diff --git a/ksh.spec b/ksh.spec
index 4373c00..d74b330 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -6,7 +6,7 @@ URL:          http://www.kornshell.com/
 Group:        System Environment/Shells
 License:      EPL
 Version:      20120801
-Release:      11%{?dist}
+Release:      12%{?dist}
 Source0:      http://www.research.att.com/~gsf/download/tgz/ast-ksh.%{releasedate}.tgz
 Source1:      http://www.research.att.com/~gsf/download/tgz/INIT.%{releasedate}.tgz
 Source2:      kshcomp.conf
@@ -29,6 +29,7 @@ Patch8: ksh-20120801-kshmfix.patch
 Patch9: ksh-20120801-memlik.patch
 Patch10: ksh-20120801-mtty.patch
 Patch11: ksh-20120801-argvfix.patch
+Patch12: ksh-20130628-longer.patch
 
 BuildRoot:    %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Conflicts:    pdksh
@@ -59,6 +60,7 @@ with "sh" (the Bourne Shell).
 %patch9 -p1 -b .memlik
 %patch10 -p1 -b .mtty
 %patch11 -p1 -b .argvfix
+%patch12 -p1 -b .longer
 
 #/dev/fd test does not work because of mock
 sed -i 's|ls /dev/fd|ls /proc/self/fd|' src/cmd/ksh93/features/options
@@ -153,6 +155,9 @@ fi
     rm -rf $RPM_BUILD_ROOT
 
 %changelog
+* Fri Jan 17 2014 Michal Hlavinka <mhlavink@redhat.com> - 20120801-12
+- fix overflow in subshell loop
+
 * Tue Jan 14 2014 Michal Hlavinka <mhlavink@redhat.com> - 20120801-11
 - fix argv rewrite (#1047508)
 - ksh stops on read when monitor mode is enabled