diff -up ksh-20100621/src/cmd/ksh93/sh/io.c.fdcrash ksh-20100621/src/cmd/ksh93/sh/io.c
--- ksh-20100621/src/cmd/ksh93/sh/io.c.fdcrash	2012-03-01 15:47:45.025042906 +0100
+++ ksh-20100621/src/cmd/ksh93/sh/io.c	2012-03-01 15:55:01.827307753 +0100
@@ -409,7 +409,7 @@ int  sh_iovalidfd(Shell_t *shp, int fd)
 	if(n > max)
 		n = max;
 	max = sh.lim.open_max;
-	shp->sftable = (Sfio_t**)calloc(n*(sizeof(int*)+sizeof(Sfio_t*)+1),1);
+	shp->sftable = (Sfio_t**)calloc((n+1)*(sizeof(int*)+sizeof(Sfio_t*)+1),1);
 	if(max)
 		memcpy(shp->sftable,sftable,max*sizeof(Sfio_t*));
 	shp->fdptrs = (int**)(&shp->sftable[n]);
@@ -647,8 +647,15 @@ int sh_iorenumber(Shell_t *shp, register
 		}
 		if(sp)
 			shp->sftable[f1] = 0;
+		if(shp->fdstatus[f1]!=IOCLOSE)
 		sh_close(f1);
 	}
+	else if(sp)
+	{
+		sfsetfd(sp,f2);
+		if(f2<=2)
+			sfset(sp,SF_SHARE|SF_PUBLIC,1);
+	}
 	if(f2>=sh.lim.open_max)
 		sh_iovalidfd(shp,f2);
 	return(f2);
@@ -810,7 +817,9 @@ int sh_open(register const char *path, i
 		mode = (IOREAD|IOWRITE);
 	else
 		mode = IOREAD;
-	sh.fdstatus[fd] = mode;
+	if(fd >= sh.lim.open_max)
+		sh_iovalidfd(shp,fd);
+	shp->fdstatus[fd] = mode;
 	return(fd);
 }
 
@@ -831,7 +840,10 @@ int sh_chkopen(register const char *name
  */
 int sh_iomovefd(register int fdold)
 {
+	Shell_t *shp = sh_getinterp();
 	register int fdnew;
+	if(fdold >= sh.lim.open_max)
+		sh_iovalidfd(shp,fdold);
 	if(fdold<0 || fdold>2)
 		return(fdold);
 	fdnew = sh_iomovefd(dup(fdold));
@@ -977,7 +989,7 @@ static char *io_usename(char *name, int
 	sp = ep = stakptr(1);
 	if(ep = strrchr(sp,'/'))
 	{
-		memcpy(stakptr(0),sp,++ep-sp);
+		memmove(stakptr(0),sp,++ep-sp);
 		stakseek(ep-sp);
 	}
 	else