make git-shell paranoid about closed stdin/stdout/stderr
make git-shell paranoid about closed stdin/stdout/stderr

It is in general unsafe to start a program with one or more of file
descriptors 0/1/2 closed.  Karl Chen for example noticed that stat_command
does this in order to rename a pipe file descriptor to 0:

    dup2(from, 0);
    close(from);

... but if stdin was closed (for example) from == 0, so that

    dup2(0, 0);
    close(0);

just ends up closing the pipe.  Another extremely rare but nasty problem
would occur if an "important" file ends up in file descriptor 2, and is
corrupted by a call to die().

Fixing this in git was considered to be overkill, so this patch works
around it only for git-shell.  The fix is simply to open all the "low"
descriptors to /dev/null in main.

Signed-off-by: Paolo Bonzini <67a772724e2fbc123894e2d469547b8302dd9fd5@gnu.org>
Acked-by: Stephen R. van den Berg <0b41ccc5203ed453b8d3482b2289efec4326931b@cuci.nl>
Signed-off-by: Junio C Hamano <a6723cc3f76163bf7adb636a73ac3b0ceb3e6b9b@pobox.com>

destenson/git,destenson/git,destenson/git,destenson/git,destenson/git,destenson/git,destenson/git,destenson/git