1 files changed, 24 insertions, 28 deletions

diff --git a/shell/ash.c b/shell/ash.c
index de1f8006d..8f3143669 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -4828,6 +4828,7 @@ openredirect(union node *redir)
 		abort();
 #endif
 		/* Fall through to eliminate warning. */
+/* Our single caller does this itself */
 //	case NTOFD:
 //	case NFROMFD:
 //		f = -1;
@@ -4864,30 +4865,13 @@ copyfd(int from, int to)
 	return newfd;
 }
 
-static void
-dupredirect(union node *redir, int f)
-{
-	int fd = redir->nfile.fd;
-
-	if (f < 0) { /* redir->nfile.type == NTOFD || redir->nfile.type == NFROMFD */
-		if (redir->ndup.dupfd >= 0) {   /* if not ">&-" */
-			copyfd(redir->ndup.dupfd, fd);
-		}
-		return;
-	}
-	if (f != fd) {
-		copyfd(f, fd);
-		close(f);
-	}
-}
-
-/**/
+/* Struct def and variable are moved down to the first usage site */
 struct redirtab {
 	struct redirtab *next;
 	int renamed[10];
 	int nullredirs;
 };
-#define redirlist     (G_var.redirlist    )
+#define redirlist (G_var.redirlist)
 
 /*
  * Process a list of redirection commands.  If the REDIR_PUSH flag is set,
@@ -4918,10 +4902,11 @@ redirect(union node *redir, int flags)
 		sv->next = redirlist;
 		redirlist = sv;
 		sv->nullredirs = g_nullredirs - 1;
+		g_nullredirs = 0;
 		for (i = 0; i < 10; i++)
 			sv->renamed[i] = EMPTY;
-		g_nullredirs = 0;
 	}
+
 	do {
 		fd = redir->nfile.fd;
 		if (redir->nfile.type == NTOFD || redir->nfile.type == NFROMFD) {
@@ -4943,26 +4928,37 @@ redirect(union node *redir, int flags)
 			i = fcntl(fd, F_DUPFD, 10);
 			if (i == -1) {
 				i = errno;
-				if (i != EBADF) { /* strange error */
-					close(newfd);
+				if (i != EBADF) {
+					/* Strange error (e.g. "too many files" EMFILE?) */
+					/*if (newfd >= 0)*/ close(newfd);
 					errno = i;
 					ash_msg_and_raise_error("%d: %m", fd);
 					/* NOTREACHED */
 				}
-				/* it is not open - ok */
+				/* EBADF: it is not open - ok */
 			} else {
-				/* it is open, save its copy */
+				/* fd is open, save its copy */
+//TODO: CLOEXEC the copy? currently these extra "saved" fds are closed
+// in popredir() in the child, preventing them from leaking into child.
+// (popredir() also cleans up the mess in case of failures)
 				sv->renamed[fd] = i;
 				close(fd);
 			}
 		} else {
 			close(fd);
 		}
-		/* Here fd is closed */
-		/* NTOFD/NFROMFD: copy redir->ndup.dupfd to fd */
-		/* else: move newfd to fd */
-		dupredirect(redir, newfd);
+		/* At this point fd is closed */
+		if (newfd < 0) {
+			/* NTOFD/NFROMFD: copy redir->ndup.dupfd to fd */
+			if (redir->ndup.dupfd >= 0) {   /* if not ">&-" */
+				copyfd(redir->ndup.dupfd, fd);
+			}
+		} else { /* move newfd to fd */
+			copyfd(newfd, fd);
+			close(newfd);
+		}
 	} while ((redir = redir->nfile.next) != NULL);
+
 	INT_ON;
 	if ((flags & REDIR_SAVEFD2) && sv && sv->renamed[2] >= 0)
 		preverrout_fd = sv->renamed[2];