bin/49125: /bin/sh does not support redirecting to or from FDs > 9

[he%NetBSD.org@localhost]

>Number:         49125
>Category:       bin
>Synopsis:       /bin/sh does not support redirecting to or from FDs > 9
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 19 08:55:00 +0000 2014
>Originator:     Havard Eidnes
>Release:        NetBSD 6.1.4
>Organization:
        None
>Environment:
        
        
System: NetBSD smistad.uninett.no 6.1.4 NetBSD 6.1.4 (MAANEN) #2: Sat May 17 
15:02:30 CEST 2014 
he%smistad.uninett.no@localhost:/usr/obj/sys/arch/i386/compile/MAANEN i386
Architecture: i386
Machine: i386
>Description:
        It does not look like our /bin/sh supports redirection to FDs
        with a numeric value above 9:

$ (echo x) 10>/dev/null
sh: Syntax error: word unexpected
$ 
$ echo x 2>&10      
sh: Syntax error: Bad fd number
$ 

        as opposed to

$ echo x 2>&5 
sh: 5: Bad file descriptor
$ 

        Our /bin/ksh also doesn't do this:

$ (echo x) 10>/dev/null
ksh: syntax error: `10' unexpected
ksh: 
$ (echo x) 9>/dev/null
x
$ 

        while bash accepts it willingly:

bash-4.3$ (echo x) 10>/dev/null
x
bash-4.3$ 


>How-To-Repeat:
        See above.

>Fix:
        Looking at the /bin/sh parser.c, it's evident that
        readtoken1() has something to do with this.  I suspect the
        test for len<=2 in this has something to do with it:

        if (eofmark == NULL) {
                if ((c == '>' || c == '<')
                 && quotef == 0
                 && len <= 2
                 && (*out == '\0' || is_digit(*out))) {
                        PARSEREDIR();
                        return lasttoken = TREDIR;
                } else {
                        pungetc();
                }
        }

        If len > 2, a "word" token is returned, and you get the error
        listed in the first example above.

        The handling under the parseredir label also assumes that the
        FD just consists of a single digit, since it just does
        "digit_val(fd)" and "fd" is just a single char.

        The code in fixredir() (same file) is responsible for the "Bad
        fd number" error message, and also assumes just a single
        digit.

        Our sh(1) man page just says "number", and not that it needs
        to be just a single digit.

        The ksh(1) man page does specify, though, that "fd" needs to
        be a single digit with the "<&" and ">&" redirections.  It
        does however look like the ksh(1) man page doesn't actually
        document the "fd>" redirections, although it has an example
        using it at the end of the "Input/Output Redirection" section.

        Whether FDs over 9 are supposed to be supported or whether
        it's a bash extension should be looked into; if our shell
        should not support it, the example in the flock(1) man page
        needs to be fixed, since it doesn't work with either our
        /bin/sh or our /bin/ksh.

>Unformatted: