ash: dont allow e.g. exec <&10 to attach to stript's fd!

function                                             old     new   delta
is_hidden_fd                                           -      61     +61
redirect                                            1135    1164     +29
popstring                                            134     140      +6
printf_main                                          635     637      +2
evalvar                                             1374    1376      +2
echo_main                                            294     296      +2
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 5/0 up/down: 102/0)             Total: 102 bytes

3 files changed, 47 insertions, 18 deletions

diff --git a/coreutils/echo.c b/coreutils/echo.c
index 36cb6b3af..decca095f 100644
--- a/coreutils/echo.c
+++ b/coreutils/echo.c
@@ -46,8 +46,11 @@ int echo_main(int argc UNUSED_PARAM, char **argv)
          * even if libc receives EBADF on write attempts, it feels determined
          * to output data no matter what. So it will try later,
          * and possibly will clobber future output. Not good. */
-        if (dup2(1, 1) != 1)
-                return -1;
+// TODO: check fcntl() & O_ACCMODE == O_WRONLY or O_RDWR?
+        if (fcntl(1, F_GETFL) == -1)
+                return 1; /* match coreutils 6.10 (sans error msg to stderr) */
+        //if (dup2(1, 1) != 1) - old way
+        //      return 1;
 
         arg = *++argv;
         if (!arg)
@@ -58,8 +61,8 @@ int echo_main(int argc UNUSED_PARAM, char **argv)
         char eflag = 0;
 
         /* We must check that stdout is not closed. */
-        if (dup2(1, 1) != 1)
-                return -1;
+        if (fcntl(1, F_GETFL) == -1)
+                return 1;
 
         while (1) {
                 arg = *++argv;
diff --git a/coreutils/printf.c b/coreutils/printf.c
index 72acbc751..76524f706 100644
--- a/coreutils/printf.c
+++ b/coreutils/printf.c
@@ -348,8 +348,11 @@ int printf_main(int argc UNUSED_PARAM, char **argv)
          * even if libc receives EBADF on write attempts, it feels determined
          * to output data no matter what. So it will try later,
          * and possibly will clobber future output. Not good. */
-        if (dup2(1, 1) != 1)
-                return -1;
+// TODO: check fcntl() & O_ACCMODE == O_WRONLY or O_RDWR?
+        if (fcntl(1, F_GETFL) == -1)
+                return 1; /* match coreutils 6.10 (sans error msg to stderr) */
+        //if (dup2(1, 1) != 1) - old way
+        //      return 1;
 
         /* bash builtin errors out on "printf '-%s-\n' foo",
          * coreutils-6.9 works. Both work with "printf -- '-%s-\n' foo".
diff --git a/shell/ash.c b/shell/ash.c
index bd2433c88..11174683e 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -4889,7 +4889,7 @@ static int need_to_remember(struct redirtab *rp, int fd)
 {
         int i;
 
-        if (!rp) /* remebering was not requested */
+        if (!rp) /* remembering was not requested */
                 return 0;
 
         for (i = 0; i < rp->pair_count; i++) {
@@ -4901,6 +4901,28 @@ static int need_to_remember(struct redirtab *rp, int fd)
         return 1;
 }
 
+/* "hidden" fd is a fd used to read scripts, or a copy of such */
+static int is_hidden_fd(struct redirtab *rp, int fd)
+{
+        int i;
+        struct parsefile *pf = g_parsefile;
+        while (pf) {
+                if (fd == pf->fd) {
+                        return 1;
+                }
+                pf = pf->prev;
+        }
+        if (!rp)
+                return 0;
+        fd |= COPYFD_RESTORE;
+        for (i = 0; i < rp->pair_count; i++) {
+                if (rp->two_fd[i].copy == fd) {
+                        return 1;
+                }
+        }
+        return 0;
+}
+
 /*
  * Process a list of redirection commands.  If the REDIR_PUSH flag is set,
  * old file descriptors are stashed away so that the redirection can be
@@ -4950,8 +4972,15 @@ redirect(union node *redir, int flags)
         do {
                 fd = redir->nfile.fd;
                 if (redir->nfile.type == NTOFD || redir->nfile.type == NFROMFD) {
-                        if (redir->ndup.dupfd == fd)
-                                continue; /* redirect from/to same file descriptor */
+                        int right_fd = redir->ndup.dupfd;
+                        /* redirect from/to same file descriptor? */
+                        if (right_fd == fd)
+                                continue;
+                        /* echo >&10 and 10 is a fd opened to the sh script? */
+                        if (is_hidden_fd(sv, right_fd)) {
+                                errno = EBADF; /* as if it is closed */
+                                ash_msg_and_raise_error("%d: %m", right_fd);
+                        }
                         newfd = -1;
                 } else {
                         newfd = openredirect(redir); /* always >= 0 */
@@ -4988,14 +5017,8 @@ redirect(union node *redir, int flags)
                                 /* "exec fd>&-" should not close fds
                                  * which point to script file(s).
                                  * Force them to be restored afterwards */
-                                struct parsefile *pf = g_parsefile;
-                                while (pf) {
-                                        if (fd == pf->fd) {
-                                                i |= COPYFD_RESTORE;
-                                                break;
-                                        }
-                                        pf = pf->prev;
-                                }
+                                if (is_hidden_fd(sv, fd))
+                                        i |= COPYFD_RESTORE;
                         }
                         if (fd == 2)
                                 copied_fd2 = i;
@@ -9026,7 +9049,7 @@ static int
 preadfd(void)
 {
         int nr;
-        char *buf =  g_parsefile->buf;
+        char *buf = g_parsefile->buf;
         parsenextc = buf;
 
 #if ENABLE_FEATURE_EDITING