diff -urpN busybox-1.16.1/shell/ash.c busybox-1.16.1-ash/shell/ash.c
--- busybox-1.16.1/shell/ash.c	2010-03-28 19:44:04.000000000 +0200
+++ busybox-1.16.1-ash/shell/ash.c	2010-06-03 04:25:18.000000000 +0200
@@ -5059,7 +5059,7 @@ static int is_hidden_fd(struct redirtab 
 		return 0;
 	pf = g_parsefile;
 	while (pf) {
-		if (fd == pf->fd) {
+		if (pf->fd > 0 && fd == pf->fd) {
 			return 1;
 		}
 		pf = pf->prev;
@@ -5424,7 +5424,11 @@ rmescapes(char *str, int flag)
 		size_t fulllen = len + strlen(p) + 1;
 
 		if (flag & RMESCAPE_GROW) {
+			int strloc = str - (char *)stackblock();
 			r = makestrspace(fulllen, expdest);
+			/* p and str may be invalidated by makestrspace */
+			str = (char *)stackblock() + strloc;
+			p = str + len;
 		} else if (flag & RMESCAPE_HEAP) {
 			r = ckmalloc(fulllen);
 		} else {