--- src/cmd/ksh93/sh/io.c
+++ src/cmd/ksh93/sh/io.c	2007-09-14 18:15:17.000000000 +0200
@@ -380,7 +380,7 @@
 {
 	register int n;
 	filemapsize = 8;
-	filemap = (struct fdsave*)malloc(8*sizeof(struct fdsave));
+	filemap = (struct fdsave*)malloc(filemapsize*sizeof(struct fdsave));
 #if SHOPT_FASTPIPE
 	n = sh.lim.open_max+2;
 #else
@@ -502,7 +502,7 @@
 		if(f2==job.fd)
 			job.fd=fd;
 		*sh.fdptrs[fd] = fd;
-		sh.fdptrs[f2] = 0;
+		sh.fdptrs[f2] = (int*)0;
 	}
 	sh.sftable[fd] = sp;
 	sh.fdstatus[fd] = sh.fdstatus[f2];
@@ -578,7 +578,7 @@
 	sh.fdstatus[fd] = IOCLOSE;
 	if(sh.fdptrs[fd])
 		*sh.fdptrs[fd] = -1;
-	sh.fdptrs[fd] = 0;
+	sh.fdptrs[fd] = (int*)0;
 	if(fd < 10)
 		sh.inuse_bits &= ~(1<<fd);
 	return(r);
@@ -1276,10 +1276,31 @@
 	/* make sure table is large enough */
 	if(sh.topfd >= filemapsize)
 	{
+		long oldptr = (long)filemap;
+		long moved;
+
 		filemapsize += 8;
 		if(!(filemap = (struct fdsave*)realloc(filemap,filemapsize*sizeof(struct fdsave))))
 			errormsg(SH_DICT,ERROR_exit(4),e_nospace);
-			
+		moved = (long)filemap - oldptr;
+
+		/* realloc(2) possibly has moved start address of filemap */
+#if SHOPT_FASTPIPE
+		for(savefd=sh.lim.open_max+2; --savefd>=0; )
+#else
+		for(savefd=sh.lim.open_max; --savefd>=0; )
+#endif /* SHOPT_FASTPIPE */
+		{
+			if (sh.fdptrs[savefd])	/* update address if used */
+			{
+				oldptr = (long)sh.fdptrs[savefd];
+				if (oldptr == (long)(&sh.coutpipe))
+					continue;
+				if (oldptr == (long)(&sh.cpipe[0]))
+					continue;
+				sh.fdptrs[savefd] = (int*)(oldptr+moved);
+			}
+		}
 	}
 #if SHOPT_DEVFD
 	if(origfd <0)
--- src/cmd/ksh93/sh/jobs.c
+++ src/cmd/ksh93/sh/jobs.c	2007-09-12 14:25:34.000000000 +0000
@@ -1011,12 +1011,14 @@ void	job_clear(void)
 		{
 			pw = pw->p_nxtproc;
 			free((void*)px);
+			px = (struct process *)0;
 		}
 	}
 	for(jp=bck.list; jp;jp=jpnext)
 	{
 		jpnext = jp->next;
 		free((void*)jp);
+		jp = (struct jobsave *)0;
 	}
 	bck.list = 0;
 	if(njob_savelist < NJOB_SAVELIST)
@@ -1638,7 +1640,10 @@ static int job_chksave(register pid_t pi
 			job_savelist = jp;
 		}
 		else
+		{
 			free((void*)jp);
+			jp = (struct jobsave *)0;
+		}
 	}
 	return(r);
 }
@@ -1673,6 +1678,7 @@ void job_subrestore(void* ptr)
 	{
 		jpnext = jp->next;
 		free((void*)jp);
+		jp = (struct jobsave *)0;
 	}
 	free(ptr);
 	job_unlock();
--- src/cmd/ksh93/sh/macro.c
+++ src/cmd/ksh93/sh/macro.c	2007-09-14 10:13:04.000000000 +0000
@@ -1829,9 +1829,19 @@ static void comsubst(Mac_t *mp,int type)
 			mac_copy(mp,&lastc,1);
 			lastc = 0;
 		}
+		/* nothing todo */
+		if(c <= 0)
+			continue;
 		/* delay appending trailing new-lines */
 		while(str[--c]=='\n')
+		{
 			newlines++;
+			if(c == 0)
+			{
+				c--;
+				break;
+			}
+		}
 		if(++c < bufsize)
 			str[c] = 0;
 		else
--- src/cmd/ksh93/sh/xec.c
+++ src/cmd/ksh93/sh/xec.c	2007-09-14 18:16:17.000000000 +0200
@@ -755,10 +755,11 @@
 				if(np && is_abuiltin(np))
 				{
 					void *context;
-					int scope=0, jmpval, save_prompt,share;
+					int scope=0, jmpval, save_prompt,share=0;
 					struct checkpt buff;
 					unsigned long was_vi=0, was_emacs=0, was_gmacs=0;
 					struct stat statb;
+					memset(&statb, 0, sizeof(struct stat));
 					if(strchr(nv_name(np),'/'))
 					{
 						/*
@@ -2539,7 +2540,7 @@
 		}
 		if(fcntl(*sh.cpipe,F_SETFD,FD_CLOEXEC)>=0)
 			sh.fdstatus[sh.cpipe[0]] |= IOCLEX;
-		sh.fdptrs[sh.cpipe[0]] = sh.cpipe;
+		sh.fdptrs[sh.cpipe[0]] = &sh.cpipe[0];
 			
 		if(fcntl(sh.cpipe[1],F_SETFD,FD_CLOEXEC) >=0)
 			sh.fdstatus[sh.cpipe[1]] |= IOCLEX;