Index: src/os_unix.c
==================================================================
--- src/os_unix.c
+++ src/os_unix.c
@@ -548,10 +548,35 @@
   for(i++; i<ArraySize(aSyscall); i++){
     if( aSyscall[i].pCurrent!=0 ) return aSyscall[i].zName;
   }
   return 0;
 }
+
+/*
+** If fd is a file descriptor that would be dangerous to use for an
+** ordinary file, the close it, reopen it as /dev/null to get it out
+** of the way, then return true.
+**
+** If fd is safe, return 0.
+**
+** It is dangerous to have a database file open of file descriptors 1 or
+** 2 because those normally mean standard output and standard error.  Other
+** components of the system might write directly to those file descriptors
+** and overwrite parts of the database file.  Something like this happened
+** on 2013-08-29 to the canonical Fossil repository when some error caused
+** the database file to be opened on file descriptor 2 and later an assert()
+** fired and wrote error message text into file descriptor 2, corrupting
+** the repository.
+*/
+static int isReservedFd(int fd, const char *z, int f, int m){
+  if( fd<0 || fd>2 ) return 0;
+  sqlite3_log(SQLITE_WARNING,
+              "attempt to open \"%s\" as file descriptor %d", z, fd);
+  osClose(fd);
+  (void)osOpen("/dev/null",f,m);
+  return 1;
+}
 
 /*
 ** Invoke open().  Do so multiple times, until it either succeeds or
 ** fails for some reason other than EINTR.
 **
@@ -575,11 +600,11 @@
 #if defined(O_CLOEXEC)
     fd = osOpen(z,f|O_CLOEXEC,m2);
 #else
     fd = osOpen(z,f,m2);
 #endif
-  }while( fd<0 && errno==EINTR );
+  }while( (fd<0 && errno==EINTR) || isReservedFd(fd,z,f,m2) );
   if( fd>=0 ){
     if( m!=0 ){
       struct stat statbuf;
       if( osFstat(fd, &statbuf)==0 
        && statbuf.st_size==0
@@ -3097,10 +3122,11 @@
 #if (!defined(USE_PREAD) && !defined(USE_PREAD64))
   i64 newOffset;
 #endif
   TIMER_START;
   assert( cnt==(cnt&0x1ffff) );
+  assert( id->h>2 );
   cnt &= 0x1ffff;
   do{
 #if defined(USE_PREAD)
     got = osPread(id->h, pBuf, cnt, offset);
     SimulateIOError( got = -1 );
@@ -3211,10 +3237,11 @@
   int *piErrno                    /* OUT: Error number if error occurs */
 ){
   int rc = 0;                     /* Value returned by system call */
 
   assert( nBuf==(nBuf&0x1ffff) );
+  assert( fd>2 );
   nBuf &= 0x1ffff;
   TIMER_START;
 
 #if defined(USE_PREAD)
   do{ rc = osPwrite(fd, pBuf, nBuf, iOff); }while( rc<0 && errno==EINTR );