From f9e4914c562edea76ee12c1d0bffba19cfee3994 Mon Sep 17 00:00:00 2001
From: chenjiayi <chenjiayi22@huawei.com>
Date: Sun, 16 Mar 2025 16:10:17 +0800
Subject: [PATCH 1/1] ksh: update sftable memory size before using pipe  fd as index of fdstatus

---
 src/cmd/ksh93/sh/io.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/cmd/ksh93/sh/io.c b/src/cmd/ksh93/sh/io.c
index 4cbfa75..3b897ef 100644
--- a/src/cmd/ksh93/sh/io.c
+++ b/src/cmd/ksh93/sh/io.c
@@ -746,14 +746,20 @@ void sh_rpipe(int pv[]) {
         errormsg(SH_DICT, ERROR_system(1), e_pipe);
         __builtin_unreachable();
     }
-    shp->fdstatus[pv[0]] = IONOSEEK | IOREAD | IOCLEX;
-    shp->fdstatus[pv[1]] = IONOSEEK | IOWRITE | IOCLEX;
+
 #if !_lib_pipe2
     if (pv[0] > 2) (void)fcntl(pv[0], F_SETFD, FD_CLOEXEC);
     if (pv[1] > 2) (void)fcntl(pv[1], F_SETFD, FD_CLOEXEC);
 #endif
     if (pv[0] <= 2) pv[0] = sh_iomovefd(shp, pv[0]);
     if (pv[1] <= 2) pv[1] = sh_iomovefd(shp, pv[1]);
+
+    if (!sh_iovalidfd(shp, pv[0])) abort();
+    if (!sh_iovalidfd(shp, pv[1])) abort();
+
+    shp->fdstatus[pv[0]] = IONOSEEK | IOREAD | IOCLEX;
+    shp->fdstatus[pv[1]] = IONOSEEK | IOWRITE | IOCLEX;
+
     sh_subsavefd(pv[0]);
     sh_subsavefd(pv[1]);
 }
-- 
2.33.0

