diff --git a/usr.sbin/pppd/pppd/sys-bsd.c b/usr.sbin/pppd/pppd/sys-bsd.c
index 50a7a5717325..df0befe01dfa 100644
--- a/usr.sbin/pppd/pppd/sys-bsd.c
+++ b/usr.sbin/pppd/pppd/sys-bsd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sys-bsd.c,v 1.38 2002/07/01 22:19:41 itojun Exp $	*/
+/*	$NetBSD: sys-bsd.c,v 1.39 2002/08/09 02:43:58 itojun Exp $	*/
 
 /*
  * sys-bsd.c - System-dependent procedures for setting up
@@ -64,7 +64,7 @@
 #if 0
 #define RCSID	"Id: sys-bsd.c,v 1.47 2000/04/13 12:04:23 paulus Exp "
 #else
-__RCSID("$NetBSD: sys-bsd.c,v 1.38 2002/07/01 22:19:41 itojun Exp $");
+__RCSID("$NetBSD: sys-bsd.c,v 1.39 2002/08/09 02:43:58 itojun Exp $");
 #endif
 #endif
 
@@ -978,6 +978,8 @@ wait_input(timo)
 void add_fd(fd)
     int fd;
 {
+    if (fd >= FD_SETSIZE)
+	fatal("descriptor too big");
     FD_SET(fd, &in_fds);
     if (fd > max_in_fd)
 	max_in_fd = fd;
@@ -1006,6 +1008,8 @@ wait_loop_output(timo)
     int n;
 
     FD_ZERO(&ready);
+    if (loop_master >= FD_SETSIZE)
+	fatal("descriptor too big");
     FD_SET(loop_master, &ready);
     n = select(loop_master + 1, &ready, NULL, &ready, timo);
     if (n < 0 && errno != EINTR)
diff --git a/usr.sbin/pppd/pppd/tty.c b/usr.sbin/pppd/pppd/tty.c
index 8b534b1dbd7f..d1ca15ff5076 100644
--- a/usr.sbin/pppd/pppd/tty.c
+++ b/usr.sbin/pppd/pppd/tty.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: tty.c,v 1.4 2002/08/02 02:52:07 christos Exp $	*/
+/*	$NetBSD: tty.c,v 1.5 2002/08/09 02:43:58 itojun Exp $	*/
 
 /*
  * tty.c - code for handling serial ports in pppd.
@@ -27,7 +27,7 @@
 #if 0
 #define RCSID	"Id: tty.c,v 1.6 2001/03/12 22:59:01 paulus Exp "
 #else
-__RCSID("$NetBSD: tty.c,v 1.4 2002/08/02 02:52:07 christos Exp $");
+__RCSID("$NetBSD: tty.c,v 1.5 2002/08/09 02:43:58 itojun Exp $");
 #endif
 #endif
 
@@ -1006,17 +1006,29 @@ charshunt(ifd, ofd, record_file)
 	if (nibuf != 0) {
 	    if (ilevel >= max_level)
 		top = &tout;
-	    else
+	    else {
+		if (pty_master >= FD_SETSIZE)
+		    fatal("descriptor too big");
 		FD_SET(pty_master, &writey);
-	} else if (stdin_readable)
+	    }
+	} else if (stdin_readable) {
+	    if (ifd >= FD_SETSIZE)
+		fatal("descriptor too big");
 	    FD_SET(ifd, &ready);
+	}
 	if (nobuf != 0) {
 	    if (olevel >= max_level)
 		top = &tout;
-	    else
+	    else {
+		if (ofd >= FD_SETSIZE)
+		    fatal("descriptor too big");
 		FD_SET(ofd, &writey);
-	} else if (pty_readable)
+	    }
+	} else if (pty_readable) {
+	    if (pty_master >= FD_SETSIZE)
+		fatal("descriptor too big");
 	    FD_SET(pty_master, &ready);
+	}
 	if (select(nfds, &ready, &writey, NULL, top) < 0) {
 	    if (errno != EINTR)
 		fatal("select");
@@ -1057,6 +1069,8 @@ charshunt(ifd, ofd, record_file)
 		    if (!record_write(recordf, 4, NULL, 0, &lasttime))
 			recordf = NULL;
 	    } else {
+		if (pty_master >= FD_SETSIZE)
+		    fatal("descriptor too big");
 		FD_SET(pty_master, &writey);
 		if (recordf)
 		    if (!record_write(recordf, 2, ibufp, nibuf, &lasttime))
@@ -1084,6 +1098,8 @@ charshunt(ifd, ofd, record_file)
 		    if (!record_write(recordf, 3, NULL, 0, &lasttime))
 			recordf = NULL;
 	    } else {
+		if (ofd >= FD_SETSIZE)
+		    fatal("descriptor too big");
 		FD_SET(ofd, &writey);
 		if (recordf)
 		    if (!record_write(recordf, 1, obufp, nobuf, &lasttime))