#31 Reject unregistered expect file descriptors

[Mikhail Dmitrichenko]

expectv() looks up per-file state with fdfp2f() and then stores the
current buffer pointers back through that state in the cleanup path.

fdfp2f() only performed pointer arithmetic on the global fd table. If a
caller passed an fd or FILE that had not been registered through
exp_spawnv(), exp_spawnfd() or exp_popen(), the lookup could return NULL
or an invalid table entry. The NULL case still jumped to cleanup, where
the state pointer was dereferenced.

Validate the table, descriptor range and entry state before returning a
struct f. Return EBADF directly from expectv() when no registered state is
available, before the cleanup path can use the missing state.

Found by Linux Verification Center (linuxtesting.org) with SVACE.