diff --git a/.gitignore b/.gitignore
index f32373a..6be3080 100644
--- a/.gitignore
+++ b/.gitignore
@@ -58,3 +58,4 @@ INIT.2010-07-01.tgz
 /INIT.2012-07-27.tgz
 /ast-ksh.2012-08-01.tgz
 /INIT.2012-08-01.tgz
+/ast-ksh.2012-08-01b.tgz
diff --git a/ksh-20120801-F_dupfd_cloexec.patch b/ksh-20120801-F_dupfd_cloexec.patch
new file mode 100644
index 0000000..7a034b3
--- /dev/null
+++ b/ksh-20120801-F_dupfd_cloexec.patch
@@ -0,0 +1,22 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.orig ksh-20120801/src/cmd/ksh93/sh/io.c
+--- ksh-20120801/src/cmd/ksh93/sh/io.c.orig	2015-08-12 11:35:36.882268954 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/io.c	2015-08-12 11:44:06.324587019 -0300
+@@ -2580,10 +2580,18 @@ int sh_fcntl(register int fd, int op, ..
+ 	if(newfd>=0) switch(op)
+ 	{
+ 	    case F_DUPFD:
++#if F_dupfd_cloexec != F_DUPFD
++	    case F_dupfd_cloexec:
++#endif
+ 		if(shp->fdstatus[fd] == IOCLOSE)
+ 			shp->fdstatus[fd] = 0;
+ 		if(newfd>=shp->gd->lim.open_max)
+ 			sh_iovalidfd(shp,newfd);
++#if F_dupfd_cloexec != F_DUPFD
++		if(op==F_dupfd_cloexec)
++			shp->fdstatus[newfd] = (shp->fdstatus[fd]|IOCLEX);
++		else
++#endif
+ 		shp->fdstatus[newfd] = (shp->fdstatus[fd]&~IOCLEX);
+ 		if(fdnotify)
+ 			(*fdnotify)(fd,newfd);
diff --git a/ksh-20120801-badgcc.patch b/ksh-20120801-badgcc.patch
new file mode 100644
index 0000000..cd26316
--- /dev/null
+++ b/ksh-20120801-badgcc.patch
@@ -0,0 +1,22 @@
+diff -up ksh-20120801/src/lib/libast/string/strdup.c.badgcc ksh-20120801/src/lib/libast/string/strdup.c
+--- ksh-20120801/src/lib/libast/string/strdup.c.badgcc	2012-05-21 15:04:46.000000000 +0200
++++ ksh-20120801/src/lib/libast/string/strdup.c	2015-06-17 10:12:52.693922581 +0200
+@@ -50,11 +50,18 @@ __STDPP__directive pragma pp:nohide strd
+ #define extern	__EXPORT__
+ #endif
+ 
++#pragma GCC push_options
++#pragma GCC optimize ("O0")
++
++
+ extern char*
+ strdup(register const char* s)
+ {
+ 	register char*	t;
+ 	register int	n;
+ 
+ 	return (s && (t = oldof(0, char, n = strlen(s) + 1, 0))) ? (char*)memcpy(t, s, n) : (char*)0;
+ }
++
++#pragma GCC pop_options
++
diff --git a/ksh-20120801-crash.patch b/ksh-20120801-crash.patch
index 63eda72..37b7962 100644
--- a/ksh-20120801-crash.patch
+++ b/ksh-20120801-crash.patch
@@ -1,6 +1,6 @@
 diff -up ksh-20120801/src/cmd/ksh93/include/jobs.h.crash ksh-20120801/src/cmd/ksh93/include/jobs.h
---- ksh-20120801/src/cmd/ksh93/include/jobs.h.crash	2014-07-16 17:32:03.570057304 +0200
-+++ ksh-20120801/src/cmd/ksh93/include/jobs.h	2014-07-16 17:32:03.600057172 +0200
+--- ksh-20120801/src/cmd/ksh93/include/jobs.h.crash	2014-07-22 11:48:57.205062905 +0200
++++ ksh-20120801/src/cmd/ksh93/include/jobs.h	2014-07-22 11:48:57.243062711 +0200
 @@ -118,6 +118,7 @@ struct jobs
  	char		jobcontrol;	/* turned on for real job control */
  	char		waitsafe;	/* wait will not block */
@@ -10,8 +10,8 @@ diff -up ksh-20120801/src/cmd/ksh93/include/jobs.h.crash ksh-20120801/src/cmd/ks
  	unsigned char	*freejobs;	/* free jobs numbers */
  #if SHOPT_COSHELL
 diff -up ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash ksh-20120801/src/cmd/ksh93/sh/jobs.c
---- ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash	2014-07-16 17:32:03.554057375 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/jobs.c	2014-07-16 17:32:03.600057172 +0200
+--- ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash	2014-07-22 11:48:57.190062982 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/jobs.c	2014-07-22 11:48:57.243062711 +0200
 @@ -1957,6 +1957,7 @@ again:
  	{
  		count = bp->count;
@@ -21,8 +21,8 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/jobs.c.crash ksh-20120801/src/cmd/ksh93/s
  	}
  	if(jp)
 diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash ksh-20120801/src/cmd/ksh93/sh/subshell.c
---- ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash	2014-07-16 17:32:03.593057203 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-07-16 17:32:03.600057172 +0200
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash	2014-07-22 11:48:57.234062758 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-07-22 11:54:04.164491483 +0200
 @@ -492,6 +492,7 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
  	struct sh_scoped savst;
  	struct dolnod   *argsav=0;
@@ -47,12 +47,12 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.crash ksh-20120801/src/cmd/ksh
  		else
  		{
 +			job.hack1_waitall=0;
- 			/* move tmp file to iop and restore sfstdout */
- 			iop = sfswap(sfstdout,NIL(Sfio_t*));
- 			if(!iop)
+ 			if(comsub!=1 && shp->spid)
+ 			{
+ 				job_wait(shp->spid);
 diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.crash ksh-20120801/src/cmd/ksh93/sh/xec.c
---- ksh-20120801/src/cmd/ksh93/sh/xec.c.crash	2014-07-16 17:32:03.587057230 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-07-16 17:32:03.601057168 +0200
+--- ksh-20120801/src/cmd/ksh93/sh/xec.c.crash	2014-07-22 11:48:57.228062787 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-07-22 11:48:57.245062700 +0200
 @@ -2125,7 +2125,7 @@ int sh_exec(register const Shnode_t *t,
  				memset(exitval,0,job.waitall*sizeof(int));
  			}
diff --git a/ksh-20120801-dotdoublefree.patch b/ksh-20120801-dotdoublefree.patch
new file mode 100644
index 0000000..bf29cb1
--- /dev/null
+++ b/ksh-20120801-dotdoublefree.patch
@@ -0,0 +1,19 @@
+diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
+index 1ba7347..ab745d4 100644
+--- a/src/cmd/ksh93/sh/xec.c
++++ b/src/cmd/ksh93/sh/xec.c
+@@ -640,7 +640,11 @@ int sh_eval(register Sfio_t *iop, int mode)
+ 	if(lineno)
+ 		shp->inlineno = lineno;
+ 	if(io_save)
++	{
+ 		sfclose(io_save);
++		io_save = 0;
++	}
++
+ 	sh_freeup(shp);
+ 	shp->st.staklist = saveslp;
+ 	shp->fn_reset = 0;
+-- 
+2.9.3
+
diff --git a/ksh-20120801-fd2lost.patch b/ksh-20120801-fd2lost.patch
index fbb7607..0605f6e 100644
--- a/ksh-20120801-fd2lost.patch
+++ b/ksh-20120801-fd2lost.patch
@@ -1,6 +1,6 @@
-diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.orig ksh-20120801/src/cmd/ksh93/sh/macro.c
---- ksh-20120801/src/cmd/ksh93/sh/macro.c.orig	2013-12-09 13:13:22.153525239 +0100
-+++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2013-12-09 13:20:58.144635385 +0100
+diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.fd2lost ksh-20120801/src/cmd/ksh93/sh/macro.c
+--- ksh-20120801/src/cmd/ksh93/sh/macro.c.fd2lost	2014-01-22 16:23:21.211658984 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2014-01-22 16:23:21.243658703 +0100
 @@ -391,7 +391,7 @@ void sh_machere(Shell_t *shp,Sfio_t *inf
  				break;
  			    }
@@ -19,24 +19,9 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.orig ksh-20120801/src/cmd/ksh93/s
  		return(1);
  	    case S_DIG:
  		var = 0;
-@@ -2152,10 +2152,12 @@ static void comsubst(Mac_t *mp,register
- 	mp->ifsp = nv_getval(np);
- 	stkset(stkp,savptr,savtop);
- 	newlines = 0;
--	if(type/*==3 - don't break `` vs $() */ && mp->shp->spid)
-+	if(type==3 && mp->shp->spid)
- 	{
- 		job_wait(mp->shp->spid);
--		mp->shp->spid = 0;
-+		if(mp->shp->pipepid==mp->shp->spid)
-+			mp->shp->spid = 0;
-+		mp->shp->pipepid = 0;
- 	}
- 	sfsetbuf(sp,(void*)sp,0);
- 	bufsize = sfvalue(sp);
-diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.anotherfix ksh-20120801/src/cmd/ksh93/sh/subshell.c
---- ksh-20120801/src/cmd/ksh93/sh/subshell.c.anotherfix	2014-01-20 14:43:46.410416327 +0100
-+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-01-20 14:43:46.444416042 +0100
+diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.fd2lost ksh-20120801/src/cmd/ksh93/sh/subshell.c
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.fd2lost	2014-01-22 16:23:21.222658887 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-01-22 16:23:21.243658703 +0100
 @@ -122,7 +122,8 @@ void	sh_subtmpfile(Shell_t *shp)
  		else if(errno!=EBADF)
  			errormsg(SH_DICT,ERROR_system(1),e_toomany);
@@ -47,10 +32,33 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.anotherfix ksh-20120801/src/cm
  		if((fd=sffileno(sfstdout))<0)
  		{
  			/* unable to create the /tmp file so use a pipe */
-diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.anotherfix ksh-20120801/src/cmd/ksh93/sh/xec.c
---- ksh-20120801/src/cmd/ksh93/sh/xec.c.anotherfix	2014-01-20 14:47:30.527524008 +0100
-+++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-01-20 14:47:30.563523703 +0100
-@@ -1773,7 +1773,11 @@ int sh_exec(register const Shnode_t *t,
+@@ -635,6 +636,13 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 		}
+ 		else
+ 		{
++			if(comsub!=1 && shp->spid)
++			{
++				job_wait(shp->spid);
++				if(shp->pipepid==shp->spid)
++					shp->spid = 0;
++				shp->pipepid = 0;
++			}
+ 			/* move tmp file to iop and restore sfstdout */
+ 			iop = sfswap(sfstdout,NIL(Sfio_t*));
+ 			if(!iop)
+diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.fd2lost ksh-20120801/src/cmd/ksh93/sh/xec.c
+--- ksh-20120801/src/cmd/ksh93/sh/xec.c.fd2lost	2014-01-22 16:23:21.237658756 +0100
++++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2014-01-22 16:38:36.374666019 +0100
+@@ -1756,6 +1756,8 @@ int sh_exec(register const Shnode_t *t,
+ 					nlock--;
+ 					job_unlock();
+ 				}
++				if(shp->subshell)
++					shp->spid = parent;
+ 				if(type&FPCL)
+ 					sh_close(shp->inpipe[0]);
+ 				if(type&(FCOOP|FAMP))
+@@ -1771,7 +1773,11 @@ int sh_exec(register const Shnode_t *t,
  					if(shp->pipepid)
  						shp->pipepid = parent;
  					else
diff --git a/ksh-20120801-filecomsubst.patch b/ksh-20120801-filecomsubst.patch
index 6aa1fea..676cc27 100644
--- a/ksh-20120801-filecomsubst.patch
+++ b/ksh-20120801-filecomsubst.patch
@@ -1,5 +1,5 @@
-diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.filecombsubst ksh-20120801/src/cmd/ksh93/sh/io.c
---- ksh-20120801/src/cmd/ksh93/sh/io.c.filecombsubst	2014-02-26 16:15:52.355391420 +0100
+diff -up ksh-20120801/src/cmd/ksh93/sh/io.c.tryfix01 ksh-20120801/src/cmd/ksh93/sh/io.c
+--- ksh-20120801/src/cmd/ksh93/sh/io.c.tryfix01	2014-02-26 16:15:52.355391420 +0100
 +++ ksh-20120801/src/cmd/ksh93/sh/io.c	2014-02-26 16:23:55.588148801 +0100
 @@ -1326,6 +1326,7 @@ int	sh_redirect(Shell_t *shp,struct iono
  				if(flag==SH_SHOWME)
diff --git a/ksh-20120801-macro.patch b/ksh-20120801-macro.patch
index ca8024e..004a5eb 100644
--- a/ksh-20120801-macro.patch
+++ b/ksh-20120801-macro.patch
@@ -176,30 +176,3 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.macro ksh-20120801/src/cmd/ksh93/sh
  #if 0
  	nv_putval(SH_FUNNAMENOD,shp->st.funname,NV_NOFREE);
  #else
-diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.orig ksh-20120801/src/cmd/ksh93/sh/macro.c
---- ksh-20120801/src/cmd/ksh93/sh/macro.c.orig	2012-06-29 20:05:47.000000000 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2013-08-12 18:06:17.291843164 +0200
-@@ -2152,6 +2152,11 @@ static void comsubst(Mac_t *mp,register
- 	mp->ifsp = nv_getval(np);
- 	stkset(stkp,savptr,savtop);
- 	newlines = 0;
-+	if(type/*==3 - don't break `` vs $() */ && mp->shp->spid)
-+	{
-+		job_wait(mp->shp->spid);
-+		mp->shp->spid = 0;
-+	}
- 	sfsetbuf(sp,(void*)sp,0);
- 	bufsize = sfvalue(sp);
- 	/* read command substitution output and put on stack or here-doc */
-diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.orig ksh-20120801/src/cmd/ksh93/sh/xec.c
---- ksh-20120801/src/cmd/ksh93/sh/xec.c.orig	2013-08-12 18:06:57.567497226 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2013-08-12 18:20:36.443454280 +0200
-@@ -1734,6 +1734,8 @@ int sh_exec(register const Shnode_t *t,
- 					nlock--;
- 					job_unlock();
- 				}
-+				if(shp->subshell)
-+					shp->spid = parent;
- 				if(type&FPCL)
- 					sh_close(shp->inpipe[0]);
- 				if(type&(FCOOP|FAMP))
diff --git a/ksh-20120801-mb-after-argvar.patch b/ksh-20120801-mb-after-argvar.patch
new file mode 100644
index 0000000..1b71a57
--- /dev/null
+++ b/ksh-20120801-mb-after-argvar.patch
@@ -0,0 +1,15 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.orig ksh-20120801/src/cmd/ksh93/sh/macro.c
+--- ksh-20120801/src/cmd/ksh93/sh/macro.c.orig	2015-08-24 14:29:58.602967855 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2015-08-24 14:31:13.682850008 -0300
+@@ -1479,7 +1479,10 @@ retry1:
+ 	    default:
+ 		goto nosub;
+ 	}
+-	c = fcmbget(&LEN);
++	if(type)
++		c = fcmbget(&LEN);
++	else
++		c = fcget();
+ 	if(type>M_TREE)
+ 	{
+ 		if(c!=RBRACE)
diff --git a/ksh-20120801-parserfix.patch b/ksh-20120801-parserfix.patch
new file mode 100644
index 0000000..1dc7695
--- /dev/null
+++ b/ksh-20120801-parserfix.patch
@@ -0,0 +1,26 @@
+--- ksh_20120801/src/cmd/ksh93/sh/lex.c	2012-06-12 21:05:18.000000000 +0200
++++ ksh_20120801/src/cmd/ksh93/sh/lex.c	2015-08-18 17:42:06.138076565 +0200
+@@ -1603,7 +1603,14 @@ static int comsub(register Lex_t *lp, in
+ 				if(n==4)
+ 					break;
+ 				if(sh_lexstates[ST_NAME][c])
++				{
++					if(c==' ' || c=='\t')
++					{
++						n = 0;
++						continue;
++					}
+ 					goto skip;
++				}
+ 				word[n++] = c;
+ 			}
+ 			if(sh_lexstates[ST_NAME][c]==S_BREAK)
+--- ksh_20120801/src/cmd/ksh93/tests/subshell.sh	2012-07-25 23:40:29.000000000 +0200
++++ ksh_20120801/src/cmd/ksh93/tests/subshell.sh	2015-08-18 17:42:06.143076553 +0200
+@@ -617,4 +617,6 @@ do	if	[[ -e $f ]]
+ 	fi
+ done
+ 
++$SHELL > /dev/null -c 'echo $(for x in whatever; do case y in *) true;; esac; done)' || err_exit 'syntax error with case in command substitution'
++
+ exit $((Errors<125?Errors:125))
diff --git a/ksh-20120801-retfix.patch b/ksh-20120801-retfix.patch
index bcb5b33..5af1053 100644
--- a/ksh-20120801-retfix.patch
+++ b/ksh-20120801-retfix.patch
@@ -1,20 +1,14 @@
 diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.retfix ksh-20120801/src/cmd/ksh93/sh/subshell.c
---- ksh-20120801/src/cmd/ksh93/sh/subshell.c.retfix	2014-09-01 13:50:02.956085721 +0200
-+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-09-01 13:54:01.104818416 +0200
-@@ -652,6 +652,16 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
- 		}
- 		else
- 		{
-+			if(comsub!=1 && shp->spid)
-+			{
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.retfix	2014-10-01 17:34:47.720532950 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-10-01 17:35:25.850350378 +0200
+@@ -655,7 +655,10 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+ 			job.hack1_waitall=0;
+ 			if(comsub!=1 && shp->spid)
+ 			{
 +				int c = shp->exitval;
-+				job_wait(shp->spid);
+ 				job_wait(shp->spid);
 +				shp->exitval = c;
 +				exitset();
-+				if(shp->pipepid==shp->spid)
-+					shp->spid = 0;
-+				shp->pipepid = 0;
-+			}
- 			job.hack1_waitall=0;
- 			/* move tmp file to iop and restore sfstdout */
- 			iop = sfswap(sfstdout,NIL(Sfio_t*));
+ 				if(shp->pipepid==shp->spid)
+ 					shp->spid = 0;
+ 				shp->pipepid = 0;
diff --git a/ksh-20120801-subshell-leak.patch b/ksh-20120801-subshell-leak.patch
new file mode 100644
index 0000000..24c7f6b
--- /dev/null
+++ b/ksh-20120801-subshell-leak.patch
@@ -0,0 +1,20 @@
+diff --git a/src/cmd/ksh93/sh/path.c b/src/cmd/ksh93/sh/path.c
+index d723987..9965bf5 100644
+--- a/src/cmd/ksh93/sh/path.c
++++ b/src/cmd/ksh93/sh/path.c
+@@ -1791,8 +1791,12 @@ void path_alias(register Namval_t *np,register Pathcomp_t *pp)
+ 	{
+ 		struct stat statb;
+ 		char *sp;
++		Pathcomp_t *old = 0;
+ 		nv_offattr(np,NV_NOPRINT);
+ 		nv_stack(np,&talias_init);
++		old = (Pathcomp_t*)np->nvalue.cp;
++		if (old && (--old->refcount <= 0))
++			free((void*)old);
+ 		np->nvalue.cp = (char*)pp;
+ 		pp->refcount++;
+ 		nv_setattr(np,NV_TAGGED|NV_NOFREE);
+-- 
+2.9.3
+
diff --git a/ksh-20120801-trapcom.patch b/ksh-20120801-trapcom.patch
index a900b54..91cb1a8 100644
--- a/ksh-20120801-trapcom.patch
+++ b/ksh-20120801-trapcom.patch
@@ -1,6 +1,6 @@
 diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.orig ksh-20120801/src/cmd/ksh93/sh/subshell.c
---- ksh-20120801/src/cmd/ksh93/sh/subshell.c.orig	2014-08-23 20:20:24.676186573 -0300
-+++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2014-08-23 20:29:00.772151283 -0300
+--- ksh-20120801/src/cmd/ksh93/sh/subshell.c.orig	2015-08-13 15:20:14.022167794 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/subshell.c	2015-08-13 15:21:43.263088168 -0300
 @@ -481,12 +481,12 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
  {
  	struct subshell sub_data;
@@ -27,21 +27,72 @@ diff -up ksh-20120801/src/cmd/ksh93/sh/subshell.c.orig ksh-20120801/src/cmd/ksh9
 -			memcpy(savsig=malloc(nsig),(char*)&shp->st.trapcom[0],nsig);
 +			++nsig;
 +			savsig = malloc(nsig * sizeof(char*));
-+			/* contents of shp->st.st.trapcom may change */
++			/* contents of shp->st.trapcom may change */
 +			for (isig = 0; isig < nsig; ++isig)
-+				savsig[isig] = shp->st.trapcom[isig] ? strdup(shp->st.trapcom[isig]) : NULL;
++				savsig[isig] = shp->st.trapcom[isig] == Empty ? Empty : (shp->st.trapcom[isig] ? strdup(shp->st.trapcom[isig]) : NULL);
  			/* this nonsense needed for $(trap) */
  			shp->st.otrapcom = (char**)savsig;
  		}
-@@ -729,7 +732,10 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
+@@ -732,7 +735,10 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_
  		shp->st.otrap = 0;
  		if(nsig)
  		{
 -			memcpy((char*)&shp->st.trapcom[0],savsig,nsig);
 +			for (isig = 0; isig < nsig; ++isig)
-+				if (shp->st.trapcom[isig])
++				if (shp->st.trapcom[isig] && shp->st.trapcom[isig]!=Empty)
 +					free(shp->st.trapcom[isig]);
 +			memcpy((char*)&shp->st.trapcom[0],savsig,nsig*sizeof(char*));
  			free((void*)savsig);
  		}
  		shp->options = sp->options;
+diff -up ksh-20120801/src/cmd/ksh93/sh/xec.c.orig ksh-20120801/src/cmd/ksh93/sh/xec.c
+--- ksh-20120801/src/cmd/ksh93/sh/xec.c.orig	2015-08-13 15:22:09.821062351 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/xec.c	2015-08-13 15:28:06.166662530 -0300
+@@ -3383,10 +3383,10 @@ int sh_funscope(int argn, char *argv[],i
+ 	struct dolnod		*argsav=0,*saveargfor;
+ 	struct sh_scoped	savst, *prevscope = shp->st.self;
+ 	struct argnod		*envlist=0;
+-	int			jmpval;
++	int			isig,jmpval;
+ 	volatile int		r = 0;
+ 	int			n;
+-	char 			*savstak;
++	char 			**savsig;
+ 	struct funenv		*fp = 0;
+ 	struct checkpt	*buffp = (struct checkpt*)stkalloc(shp->stk,sizeof(struct checkpt));
+ 	Namval_t		*nspace = shp->namespace;
+@@ -3435,10 +3435,13 @@ int sh_funscope(int argn, char *argv[],i
+ 	}
+ 	shp->st.cmdname = argv[0];
+ 	/* save trap table */
+-	if((nsig=shp->st.trapmax*sizeof(char*))>0 || shp->st.trapcom[0])
++	if((nsig=shp->st.trapmax)>0 || shp->st.trapcom[0])
+ 	{
+-		nsig += sizeof(char*);
+-		memcpy(savstak=stakalloc(nsig),(char*)&shp->st.trapcom[0],nsig);
++		++nsig;
++		savsig = malloc(nsig * sizeof(char*));
++		/* contents of shp->st.trapcom may change */
++		for (isig = 0; isig < nsig; ++isig)
++			savsig[isig] = shp->st.trapcom[isig] == Empty ? Empty : (shp->st.trapcom[isig] ? strdup(shp->st.trapcom[isig]) : NULL);
+ 	}
+ 	sh_sigreset(0);
+ 	argsav = sh_argnew(shp,argv,&saveargfor);
+@@ -3502,10 +3505,14 @@ int sh_funscope(int argn, char *argv[],i
+ 	shp->topscope = (Shscope_t*)prevscope;
+ 	nv_getval(sh_scoped(shp,IFSNOD));
+ 	if(nsig)
+-		memcpy((char*)&shp->st.trapcom[0],savstak,nsig);
++	{
++		for (isig = 0; isig < nsig; ++isig)
++			if (shp->st.trapcom[isig] && shp->st.trapcom[isig]!=Empty)
++				free(shp->st.trapcom[isig]);
++		memcpy((char*)&shp->st.trapcom[0],savsig,nsig*sizeof(char*));
++		free((void*)savsig);
++	}
+ 	shp->trapnote=0;
+-	if(nsig)
+-		stakset(savstak,0);
+ 	shp->options = options;
+ 	shp->last_root = last_root;
+ 	if(jmpval == SH_JMPSUB)
diff --git a/ksh-20120801-typeset.patch b/ksh-20120801-typeset.patch
new file mode 100644
index 0000000..03b56b8
--- /dev/null
+++ b/ksh-20120801-typeset.patch
@@ -0,0 +1,16 @@
+diff --git a/src/cmd/ksh93/bltins/typeset.c b/src/cmd/ksh93/bltins/typeset.c
+index 15fcd58..8939011 100644
+--- a/src/cmd/ksh93/bltins/typeset.c
++++ b/src/cmd/ksh93/bltins/typeset.c
+@@ -1442,7 +1442,7 @@ static void print_scan(Sfio_t *file, int flag, Dt_t *root, int option,struct tda
+ 		tp->scanmask |= (NV_DOUBLE|NV_EXPNOTE);
+ 	if(flag==NV_LTOU || flag==NV_UTOL)
+ 		tp->scanmask |= NV_UTOL|NV_LTOU;
+-	namec = nv_scan(root,nullscan,(void*)tp,tp->scanmask,flag);
++	namec = nv_scan(root,nullscan,(void*)tp,tp->scanmask,flag&~NV_IARRAY);
+ 	argv = tp->argnam  = (char**)stkalloc(tp->sh->stk,(namec+1)*sizeof(char*));
+ 	namec = nv_scan(root, pushname, (void*)tp, tp->scanmask, flag&~NV_IARRAY);
+ 	if(mbcoll())
+-- 
+2.9.3
+
diff --git a/ksh-20120801-unset-param.patch b/ksh-20120801-unset-param.patch
new file mode 100644
index 0000000..7777270
--- /dev/null
+++ b/ksh-20120801-unset-param.patch
@@ -0,0 +1,17 @@
+diff -up ksh-20120801/src/cmd/ksh93/sh/macro.c.bz1222025 ksh-20120801/src/cmd/ksh93/sh/macro.c
+--- ksh-20120801/src/cmd/ksh93/sh/macro.c.bz1222025	2015-09-15 17:28:47.304722569 +0200
++++ ksh-20120801/src/cmd/ksh93/sh/macro.c	2015-09-17 17:49:46.842891942 +0200
+@@ -1195,6 +1195,13 @@ retry1:
+ 		}
+ 		else
+ 			v = 0;
++		if(!v && sh_isoption(SH_NOUNSET))
++		{
++			d=fcget();
++			fcseek(-1);
++			if(!(d && strchr(":+-?=",d)))
++				errormsg(SH_DICT,ERROR_exit(1),e_notset,ltos(c));
++		}
+ 		break;
+ 	    case S_ALP:
+ 		if(c=='.' && type==0)
diff --git a/ksh-20120801-diskfull.patch b/ksh-20140801-diskfull.patch
similarity index 55%
rename from ksh-20120801-diskfull.patch
rename to ksh-20140801-diskfull.patch
index 9d68d93..7276363 100644
--- a/ksh-20120801-diskfull.patch
+++ b/ksh-20140801-diskfull.patch
@@ -1,5 +1,6 @@
---- ksh-20120801/src/cmd/ksh93/sh/main.c	2015-04-17 16:55:57.802048900 -0300
-+++ ksh-20120801/src/cmd/ksh93/sh/main.c	2015-04-17 17:10:45.276129709 -0300
+diff -up ksh-20120801/src/cmd/ksh93/sh/main.c.orig ksh-20120801/src/cmd/ksh93/sh/main.c
+--- ksh-20120801/src/cmd/ksh93/sh/main.c.orig	2015-04-29 16:49:11.502958000 -0300
++++ ksh-20120801/src/cmd/ksh93/sh/main.c	2015-05-08 18:19:55.688776922 -0300
 @@ -423,7 +423,7 @@ static void	exfile(register Shell_t *shp
  		sfsync(shp->outpool);
  		shp->st.execbrk = shp->st.breakcnt = 0;
@@ -9,12 +10,12 @@
  		{
  			sh_setstate(states);
  			goto done;
-@@ -600,6 +600,8 @@ done:
+@@ -598,7 +598,7 @@ done:
+ 	}
+ 	if(jmpval == SH_JMPSCRIPT)
  		siglongjmp(*shp->jmplist,jmpval);
- 	else if(jmpval == SH_JMPEXIT)
+-	else if(jmpval == SH_JMPEXIT)
++	else if(jmpval == SH_JMPEXIT || jmpval == SH_JMPERREXIT)
  		sh_done(shp,0);
-+	else if(jmpval == SH_JMPERREXIT)
-+		sh_done(shp,-1);
  	if(fno>0)
  		sh_close(fno);
- 	if(shp->st.filename)
diff --git a/ksh.spec b/ksh.spec
index d502af5..a67f966 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -9,7 +9,7 @@ Group:        System Environment/Shells
 #CPL everywhere else (for KSH itself)
 License:      CPL
 Version:      %{releasedate}
-Release:      30%{?dist}
+Release:      31%{?dist}
 Source0:      http://www.research.att.com/~gsf/download/tgz/ast-ksh.%{release_date}.tgz
 Source1:      http://www.research.att.com/~gsf/download/tgz/INIT.%{release_date}.tgz
 Source2:      kshcomp.conf
@@ -68,94 +68,120 @@ Patch32: ksh-20100621-manfix3.patch
 # rhbz#1016611
 Patch33: ksh-20120801-nomulti.patch
 
-# from upstream, rhbz#1036802
-Patch34: ksh-20120801-fd2lost.patch
+# for ksh <= 2014-01-14, rhbz#
+Patch34: ksh-20120801-mtty.patch
 
-# for ksh <= 2014-01-14, rhbz#1036470
-Patch35: ksh-20120801-memlik3.patch
+# from upstream, rbzh#1048272
+Patch35: ksh-20120801-fd2lost.patch
 
-# for ksh <= 2014-03-04, rhbz#1066589
-Patch36: ksh-20120801-filecomsubst.patch
+# sent upstream 2014-01, rhbz#1047507
+Patch36: ksh-20120801-argvfix.patch
 
-# for ksh <= 2014-04-05, rhbz#825520
-Patch37: ksh-20120801-crash.patch
-
-# for ksh < 2013-03-19, rhbz#1075635
-Patch38: ksh-20120801-sufix.patch
-
-# for ksh < 2014-03, rhbz#1047506
-Patch39: ksh-20120801-argvfix.patch
-
-# sent upstream, rhbz#1078698
-Patch40: ksh-20140301-fikspand.patch
-
-# for ksh < 2014-04-15, rhbz#1070350
-Patch41: ksh-20120801-roundit.patch
-
-# for ksh < 2014-04-15, rhbz#1036931
-Patch42: ksh-20120801-heresub.patch
-
-# not included upstream yet, rhbz#1062296
-Patch43: ksh-20140415-hokaido.patch
-
-# for ksh < 20121004, rhbz#1083713
-Patch44: ksh-20120801-tpstl.patch
-
-# for ksh <= 20120214, rhbz#1023109
-Patch45: ksh-20120801-mtty.patch
-
-# sent upstream, rhbz#1019334
-Patch46: ksh-20120801-manfix4.patch
-
-# not upstream yet, rhbz#1105138
-Patch47: ksh-20120801-fununset.patch
-
-# not upstream yet, rhbz#1102627
-Patch48: ksh-20120801-cdfix3.patch
-
-# sent upstream, rhbz#1112306
-Patch49: ksh-20120801-locking.patch
-
-# for ksh <= 2013-06-13, rhbz#1133582
-Patch50: ksh-20130613-cdfix4.patch
-Patch51: ksh-20120801-retfix.patch
-
-# not upstream yet, rhbz#1147645
-Patch52: ksh-20120801-oldenvinit.patch
-
-# not upstream yet, rhbz#1160923
-Patch53: ksh-20120801-noexeccdfix.patch
-
-# sent upstream, for ksh <= 2014-09-30, rhbz#1168611
-Patch54: ksh-20120801-cdfork.patch
-
-# from upsteam, for ksh < 2012-10-04, rhbz#1173668
-Patch55: ksh-20120801-emptyarrayinit.patch
-
-# not upstream yet, rhbz#1188377
-Patch56: ksh-20120801-xufix.patch
-
-# sent upstream, for ksh <= 2015-02-10, rhbz#1189294
-Patch57: ksh-20120801-assoc-unset-leak.patch
-
-# sent upstream, for ksh <= 2014-12-18, rhbz#1176670
-Patch58: ksh-20120801-alarmifs.patch
-
-# not yet upstream, rhbz#1116072
-Patch59: ksh-20140929-safefd.patch
-
-# workaround, for ksh < 2013-05-24, rhbz#1117404
-Patch60: ksh-20120801-trapcom.patch
+# for ksh <= 2014-01-14, rhbz#1048995
+Patch37: ksh-20120801-memlik3.patch
 
 # for ksh <= 2013-04-09, rhbz#960371
-Patch61: ksh-20120801-lexfix.patch
-Patch62: ksh-20140801-arraylen.patch
-Patch63: ksh-20120801-diskfull.patch
+Patch38: ksh-20120801-lexfix.patch
+
+# not yet upstream, for ksh <= 2014-02-26, rhbz#1070328
+Patch39: ksh-20120801-filecomsubst.patch
+
+# for ksh <= 2014-06-25, rhbz#825520,rhbz#1084406
+Patch40: ksh-20120801-crash.patch
+
+# for ksh < 2013-03-19, rhbz#1085385
+Patch41: ksh-20120801-sufix.patch
+
+# sent upstream, rhbz#1099935
+Patch42: ksh-20140301-fikspand.patch
+
+# for ksh < 2014-04-15, rhbz#1070871
+Patch43: ksh-20120801-roundit.patch
+
+# for ksh < 2014-04-15, rhbz#1111120
+Patch44: ksh-20120801-heresub.patch
+
+# not included upstream yet, rhbz#1077090
+Patch45: ksh-20140415-hokaido.patch
+
+# for ksh < 2012-10-04, rhbz#1121960
+Patch46: ksh-20120801-tpstl.patch
+
+# sent upstream, rhbz#1100215
+Patch47: ksh-20120801-manfix4.patch
+
+# not upstream yet, rhbz#1100215
+Patch48: ksh-20120801-fununset.patch
+
+# for ksh < 2014-06-25, rhbz#1109893
+Patch49: ksh-20120801-cdfix3.patch
+
+# sent upstream, rhbz#1116506
+Patch50: ksh-20120801-locking.patch
+
+# for ksh <= 2013-06-13, rhbz#1133585
+Patch51: ksh-20130613-cdfix4.patch
+
+Patch52: ksh-20120801-retfix.patch
+
+# sent upstream, for ksh <= 2014-09-30
+Patch53: ksh-20120801-cdfork.patch
+
+# not upstream yet, for ksh <= 2015-04-03, rhbz#1200534
+Patch54: ksh-20140801-arraylen.patch
+
+# sent upstream, for ksh <= 2014-09-29, rhbz#1212993
+Patch55: ksh-20140801-diskfull.patch
+
+# not upstream yet, rhbz#1192026
+Patch56: ksh-20120801-xufix.patch
+
+# sent upstream, for ksh <= 2014-12-18, rhbz#1192119
+Patch58: ksh-20120801-alarmifs.patch
+
+# not yet upstream, rhbz#1202439
+Patch59: ksh-20140929-safefd.patch
+
+# workaround, for ksh < 2013-05-24, rhbz#1211540
+Patch60: ksh-20120801-trapcom.patch
+
+# not yet upstream, rhbz#1217237
 Patch64: ksh-20120801-nohupfork.patch
 
+# from upstream, for ksh <= 20130409, rhbz#1241014
+Patch65: ksh-20120801-parserfix.patch
+
+# not upstream yet, rhbz#1211538
+Patch66: ksh-20120801-oldenvinit.patch
+
+# from upsteam, for ksh < 2012-10-04, rhbz#1193557
+Patch67: ksh-20120801-emptyarrayinit.patch
+
+# not upstream yet, rhbz#1371630
+Patch68: ksh-20120801-typeset.patch
+
+# not upstream yet, rhbz#1321443
+Patch69: ksh-20120801-dotdoublefree.patch
+
+# not upstream yet, rhbz#1405784
+Patch70: ksh-20120801-subshell-leak.patch
+
+# rhbz#1189297
+Patch71: ksh-20120801-assoc-unset-leak.patch
+
+# rhbz#1222025
+Patch72: ksh-20120801-unset-param.patch
+
+# rhbz#1269088
+Patch73: ksh-20120801-badgcc.patch
+
+# rhbz#1299484
+Patch74: ksh-20120801-mb-after-argvar.patch
+Patch75: ksh-20120801-F_dupfd_cloexec.patch
+
 BuildRoot:    %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Conflicts:    pdksh
-Requires: coreutils, glibc-common, diffutils
+Requires: coreutils, diffutils, chkconfig
 BuildRequires: bison
 # regression test suite uses 'ps' from procps
 BuildRequires: procps
@@ -172,9 +198,9 @@ with "sh" (the Bourne Shell).
 %setup -q -c
 %setup -q -T -D -a 1
 %patch1 -p1 -b .builtins
-%patch2 -p1 -b .fixregr
 %patch6 -p1 -b .manfix
 %patch17 -p1 -b .pathvar
+%patch2 -p1 -b .fixregr
 %patch18 -p1 -b .fdstatus
 %patch19 -p1 -b .rmdirfix
 %patch20 -p1 -b .cdfix
@@ -190,37 +216,44 @@ with "sh" (the Bourne Shell).
 %patch31 -p1 -b .covsfix
 %patch32 -p1 -b .manfix3
 %patch33 -p1 -b .nomulti
-%patch34 -p1 -b .fd2lost
-%patch35 -p1 -b .memlik3
-%patch36 -p1 -b .filecomsubst
-%patch37 -p1 -b .crash
-%patch38 -p1 -b .sufix
-%patch39 -p1 -b .argvfix
-%patch40 -p1 -b .fikspand
-%patch41 -p1 -b .roundit
-%patch42 -p1 -b .heresub
-%patch43 -p1 -b .hokaido
-%patch44 -p1 -b .tpstl
-%patch45 -p1 -b .mtty
-%patch46 -p1 -b .manfix4
-%patch47 -p1 -b .fununset
-%patch48 -p1 -b .cdfix3
-%patch49 -p1 -b .locking
-%patch50 -p1 -b .cdfix4
-%patch51 -p1 -b .retfix
-%patch52 -p1 -b .oldenvinit
-%patch53 -p1 -b .noexeccdfix
-%patch54 -p1 -b .cdfork
-%patch55 -p1 -b .emptyarrayinit
+%patch34 -p1 -b .mtty
+%patch35 -p1 -b .fd2lost
+%patch36 -p1 -b .argvfix
+%patch37 -p1 -b .memlik3
+%patch38 -p1 -b .lexfix
+%patch39 -p1 -b .filecomsubst
+%patch40 -p1 -b .crash
+%patch41 -p1 -b .sufix
+%patch42 -p1 -b .fikspand
+%patch43 -p1 -b .roundit
+%patch44 -p1 -b .heresub
+%patch45 -p1 -b .hokaido
+%patch46 -p1 -b .tpstl
+%patch47 -p1 -b .manfix4
+%patch48 -p1 -b .fununset
+%patch49 -p1 -b .cdfix3
+%patch50 -p1 -b .locking
+%patch51 -p1 -b .cdfix4
+%patch52 -p1 -b .retfix
+%patch53 -p1 -b .cdfork
+%patch54 -p1 -b .arraylen
+%patch55 -p1 -b .diskfull
 %patch56 -p1 -b .xufix
-%patch57 -p1 -b .assoc-unset-leak
 %patch58 -p1 -b .alarmifs
 %patch59 -p1 -b .safefd
 %patch60 -p1 -b .trapcom
-%patch61 -p1 -b .lexfix
-%patch62 -p1 -b .arraylen
-%patch63 -p1 -b .diskfull
 %patch64 -p1 -b .nohupfork
+%patch65 -p1 -b .parserfix
+%patch66 -p1 -b .oldenvinit
+%patch67 -p1 -b .emptyarrayinit
+%patch68 -p1 -b .typeset_a
+%patch69 -p1 -b .dotdoublefree
+%patch70 -p1 -b .subshell-leak
+%patch71 -p1 -b .assoc-unset-leak
+%patch72 -p1 -b .unset-param
+%patch73 -p1 -b .badgcc
+%patch74 -p1 -b .mb-after-argvar
+%patch75 -p1 -b .F_dupfd_cloexec
 
 #/dev/fd test does not work because of mock
 sed -i 's|ls /dev/fd|ls /proc/self/fd|' src/cmd/ksh93/features/options
@@ -324,6 +357,9 @@ fi
     rm -rf $RPM_BUILD_ROOT
 
 %changelog
+* Fri Mar 03 2017 Michal Hlavinka <mhlavink@redhat.com> - 20120801-31
+- use latest set of patches
+
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20120801-30
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild