From: rofl0r <rofl0r@users.noreply.github.com>
Date: Thu, 18 Jun 2026 19:40:21 +0000
Subject: [PATCH] dash: fix redirect with fds > 9

When executing e.g. python3 999>debug.log, 999 wasn't recognized as an fd,
but instead passed as a command line argument to python3.

POSIX 2017 clearly states that file descriptors can be longer than a single
digit:

"The number n is an optional one or more digit decimal number designating
the file descriptor number"
https://pubs.opengroup.org/onlinepubs/9799919799/utilities/V3_chap02.html#tag_19_07

diff --git a/src/parser.c b/src/parser.c
index 412e876..7e26b5e 100644
--- a/src/parser.c
+++ b/src/parser.c
@@ -1209,7 +1209,6 @@ endword:
 	if (eofmark == NULL) {
 		if ((c == '>' || c == '<')
 		 && quotef == 0
-		 && len <= 2
 		 && (*out == '\0' || is_digit(*out))) {
 			PARSEREDIR();
 			return lasttoken = TREDIR;
@@ -1288,12 +1287,20 @@ more_heredoc:
  */
 
 parseredir: {
-	char fd = *out;
+	char *p = out;
 	union node *np;
+	int fd = -1;
+
+	while (is_digit(*p) && len--) {
+		if (fd == -1) fd = 0;
+		else fd *= 10;
+		fd += digit_val(*p);
+		++p;
+	}
 
 	np = (union node *)stalloc(sizeof (struct nfile));
 	if (c == '>') {
-		np->nfile.fd = 1;
+		np->nfile.fd = fd == -1 ? 1 : fd;
 		c = pgetc_eatbnl();
 		if (c == '>')
 			np->type = NAPPEND;
@@ -1338,8 +1345,6 @@ parseredir: {
 			break;
 		}
 	}
-	if (fd != '\0')
-		np->nfile.fd = digit_val(fd);
 	redirnode = np;
 	goto parseredir_return;
 }