diff --git a/mksh-39c-fixsusbst.patch b/mksh-39c-fixsusbst.patch
new file mode 100644
index 0000000..4e74886
--- /dev/null
+++ b/mksh-39c-fixsusbst.patch
@@ -0,0 +1,47 @@
+diff -up mksh-39c/check.t.fixsubst mksh-39c/check.t
+--- mksh-39c/check.t.fixsubst	2011-01-04 15:55:30.493395051 +0100
++++ mksh-39c/check.t	2011-01-04 15:57:48.681133798 +0100
+@@ -4452,6 +4452,22 @@ expected-stderr-pattern:
+ 	/bad substitution/
+ expected-exit: 1
+ ---
++name: xxx-variable-syntax-2
++stdin:
++	set 0
++	echo ${*:0}
++expected-stderr-pattern:
++	/bad substitution/
++expected-exit: 1
++---
++name: xxx-variable-syntax-3
++stdin:
++	set -A foo 0
++	echo ${foo[*]:0}
++expected-stderr-pattern:
++	/bad substitution/
++expected-exit: 1
++---
+ name: xxx-substitution-eval-order
+ description:
+ 	Check order of evaluation of expressions
+diff -up mksh-39c/eval.c.fixsubst mksh-39c/eval.c
+--- mksh-39c/eval.c.fixsubst	2010-02-25 21:18:39.000000000 +0100
++++ mksh-39c/eval.c	2011-01-04 15:55:30.500394934 +0100
+@@ -1016,6 +1016,8 @@ varsub(Expand *xp, const char *sp, const
+ 		case '=':	/* can't assign to a vector */
+ 		case '%':	/* can't trim a vector (yet) */
+ 		case '#':
++		case '0':
++		case '/':
+ 			return (-1);
+ 		}
+ 		if (e->loc->argc == 0) {
+@@ -1039,6 +1041,8 @@ varsub(Expand *xp, const char *sp, const
+ 			case '%':	/* can't trim a vector (yet) */
+ 			case '#':
+ 			case '?':
++			case '0':
++			case '/':
+ 				return (-1);
+ 			}
+ 			XPinit(wv, 32);
diff --git a/mksh.spec b/mksh.spec
index 6112717..0c79397 100644
--- a/mksh.spec
+++ b/mksh.spec
@@ -3,7 +3,7 @@
 Summary:          MirBSD enhanced version of the Korn Shell
 Name:             mksh
 Version:          39c
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          MirOS
 Group:            System Environment/Shells
 URL:              http://www.mirbsd.de/%{name}/
@@ -11,6 +11,7 @@ Source0:          http://www.mirbsd.org/MirOS/dist/mir/%{name}/%{name}-R%{versio
 Source1:          http://www.mirbsd.org/MirOS/dist/hosted/other/arc4random.c
 Patch1:           mksh-39c-fixsetx.patch
 Patch2:           mksh-39c-dblalias.patch
+Patch3:           mksh-39c-fixsusbst.patch
 Requires(post):   grep
 Requires(postun): coreutils, grep
 BuildRequires:    util-linux, ed
@@ -37,6 +38,9 @@ cp -f %{SOURCE1} .
 # from upstream cvs, for mksh < "R39 2010/07/21", rhbz#616777
 %patch2 -p1 -b .dblalias
 
+# from upstream cvs, for mksh < "R39 2010/05/17", rhbz#618274
+%patch3 -p1 -b .fixsubst
+
 %build
 CFLAGS="$RPM_OPT_FLAGS" sh Build.sh -r -combine
 
@@ -79,6 +83,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man1/%{name}.1*
 
 %changelog
+* Wed Jan 05 2011 Michal Hlavinka <mhlavink@redhat.com> 39c-3
+- fix crash when bad substitution is used
+
 * Wed Jul 21 2010 Michal Hlavinka <mhlavink@redhat.com> 39c-2
 - fix crash when alias contains alias
 - fix crash when xtrace is enabled