diff --git a/ksh.changes b/ksh.changes
index f7f8b24..e909e0c 100644
--- a/ksh.changes
+++ b/ksh.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Fri Oct 18 12:21:58 UTC 2013 - werner@suse.de
+
+- Add patch ksh93-sfio.dif as on overlapping memory areas there
+  should memmove be used instead of memcopy (backport 2013-10-10)
+
 -------------------------------------------------------------------
 Fri Oct 18 10:41:05 UTC 2013 - werner@suse.de
 
diff --git a/ksh.spec b/ksh.spec
index a19b3fe..3f919c3 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -133,6 +133,8 @@ Patch34:        ksh93-alias-k.dif
 Patch35:        ksh93-uninitialized.dif
 # PATCH-FIX-SUSE Do not use mount(2) system call instead of fs3d_mount(3ast)
 Patch36:        ksh93-fs3d.dif
+# PATCH-FIX-UPSTREAM Ouch ... use memmove instead of memcopy on overlapping areas
+Patch37:        ksh93-sfio.dif
 Patch42:        ksh-locale.patch
 
 %description
@@ -223,6 +225,7 @@ fi
 %patch34
 %patch35
 %patch36
+%patch37
 
 %build
   #
diff --git a/ksh93-sfio.dif b/ksh93-sfio.dif
new file mode 100644
index 0000000..c839b16
--- /dev/null
+++ b/ksh93-sfio.dif
@@ -0,0 +1,125 @@
+--- src/lib/libast/sfio/sfflsbuf.c
++++ src/lib/libast/sfio/sfflsbuf.c	2013-10-18 11:50:01.866235555 +0000
+@@ -96,7 +96,7 @@ int	c;	/* if c>=0, c is also written out
+ 		isall = SFISALL(f,isall);
+ 		if((w = SFWR(f,data,n,f->disc)) > 0)
+ 		{	if((n -= w) > 0) /* save unwritten data, then resume */
+-				memcpy((char*)f->data,(char*)data+w,n);
++				memmove((char*)f->data,(char*)data+w,n);
+ 			written += w;
+ 			f->next = f->data+n;
+ 			if(c < 0 && (!isall || n == 0))
+--- src/lib/libast/sfio/sfmove.c
++++ src/lib/libast/sfio/sfmove.c	2013-10-18 12:04:03.194735625 +0000
+@@ -113,7 +113,11 @@ reg int		rc;	/* record separator */
+ 
+ 		/* try reading a block of data */
+ 		direct = 0;
+-		if((r = fr->endb - (next = fr->next)) <= 0)
++		if(fr->rsrv && (r = -fr->rsrv->slen) > 0)
++		{	fr->rsrv->slen = 0;
++			next = fr->rsrv->data;
++		}
++		else if((r = fr->endb - (next = fr->next)) <= 0)
+ 		{	/* amount of data remained to be read */
+ 			if((w = n > MAX_SSIZE ? MAX_SSIZE : (ssize_t)n) < 0)
+ 			{	if(fr->extent < 0)
+--- src/lib/libast/sfio/sfpoll.c
++++ src/lib/libast/sfio/sfpoll.c	2013-10-18 11:59:50.778735232 +0000
+@@ -138,7 +138,7 @@ int		tm;	/* time in millisecs for select
+ 		while((np = SFPOLL(fds,m,tm)) < 0 )
+ 		{	if(errno == eintr || errno == EAGAIN)
+ 				errno = 0;
+-			else	break;
++			else	goto report;
+ 		}
+ 		if(np > 0) /* poll succeeded */
+ 			np = c;
+@@ -147,14 +147,14 @@ int		tm;	/* time in millisecs for select
+ 		{	f = fa[check[r]];
+ 
+ 			if((f->flags&SF_WRITE) && !WRREADY(f) )
+-			{	if(fds[m].revents&POLLOUT)
++			{	if(fds[m].revents&(POLLOUT|POLLHUP|POLLERR))
+ 					status[check[r]] |= SF_WRITE;
+ 			}
+ 
+ 			if((f->flags&SF_READ)  && !RDREADY(f))
+ 			{	if((f->mode&SF_WRITE) && HASAUXFD(f))
+ 					m += 1;
+-				if(fds[m].revents&POLLIN)
++				if(fds[m].revents&(POLLIN|POLLHUP|POLLERR))
+ 					status[check[r]] |= SF_READ;
+ 			}
+ 		}
+@@ -200,7 +200,7 @@ int		tm;	/* time in millisecs for select
+ 		while((np = select(m+1,&rd,&wr,NIL(fd_set*),tmp)) < 0 )
+ 		{	if(errno == eintr)
+ 				errno = 0;
+-			else	break;
++			else	goto report;
+ 		}
+ 		if(np > 0)
+ 			np = c;
+@@ -227,6 +227,7 @@ int		tm;	/* time in millisecs for select
+ 	}
+ #endif /*_lib_select*/
+ 
++ report:
+ 	for(r = c = 0; c < n; ++c)
+ 	{	if(status[c] == 0)
+ 			continue;
+--- src/lib/libast/sfio/sfpool.c
++++ src/lib/libast/sfio/sfpool.c	2013-10-18 11:49:25.614237061 +0000
+@@ -138,7 +138,7 @@ int		n;	/* current position in pool	*/
+ 			else	/* write failed, recover buffer then quit */
+ 			{	if(w > 0)
+ 				{	v -= w;
+-					memcpy(head->data,(head->data+w),v);
++					memmove(head->data,(head->data+w),v);
+ 				}
+ 				head->next = head->data+v;
+ 				goto done;
+@@ -147,7 +147,7 @@ int		n;	/* current position in pool	*/
+ 
+ 		/* move data from head to f */
+ 		if((head->data+k) != f->data )
+-			memcpy(f->data,(head->data+k),v);
++			memmove(f->data,(head->data+k),v);
+ 		f->next = f->data+v;
+ 	}
+ 
+--- src/lib/libast/sfio/sfsetbuf.c
++++ src/lib/libast/sfio/sfsetbuf.c	2013-10-18 12:02:37.534736056 +0000
+@@ -254,6 +254,15 @@ size_t	size;	/* buffer size, -1 for defa
+ #endif
+ 		}
+ 
++		/* set page size, this is also the desired default buffer size */
++		if(_Sfpage <= 0)
++		{
++#if _lib_getpagesize
++			if((_Sfpage = (size_t)getpagesize()) <= 0)
++#endif
++				_Sfpage = SF_PAGE;
++		}
++
+ #if SFSETLINEMODE
+ 		if(init)
+ 			f->flags |= sfsetlinemode();
+@@ -308,15 +317,6 @@ size_t	size;	/* buffer size, -1 for defa
+ 					(void)_sfpopen(f,-1,-1,1);
+ 			}
+ 		}
+-
+-		/* set page size, this is also the desired default buffer size */
+-		if(_Sfpage <= 0)
+-		{
+-#if _lib_getpagesize
+-			if((_Sfpage = (size_t)getpagesize()) <= 0)
+-#endif
+-				_Sfpage = SF_PAGE;
+-		}
+ 	}
+ 
+ #ifdef MAP_TYPE