From 7a8f8f5a74527517dcd8777cac916caf798aa5c8 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Sat, 4 Jul 2026 22:09:06 +0000
Subject: [PATCH] Do not use stale pointers in modes.

---
 window-client.c |  5 ++++-
 window-tree.c   | 10 ++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/window-client.c b/window-client.c
index a780222e3..5a8c71862 100644
--- a/window-client.c
+++ b/window-client.c
@@ -164,6 +164,7 @@ const struct window_mode window_client_mode = {
 
 struct window_client_itemdata {
 	struct client	*c;
+	char		*ttyname;
 };
 
 struct window_client_modedata {
@@ -204,6 +205,7 @@ static void
 window_client_free_item(struct window_client_itemdata *item)
 {
 	server_client_unref(item->c);
+	free(item->ttyname);
 	free(item);
 }
 
@@ -231,6 +233,7 @@ window_client_build(void *modedata, struct sort_criteria *sort_crit,
 
 		item = window_client_add_item(data);
 		item->c = l[i];
+		item->ttyname = xstrdup(l[i]->ttyname);
 
 		l[i]->references++;
 	}
@@ -552,7 +555,7 @@ window_client_key(struct window_mode_entry *wme, struct client *c,
 		break;
 	case '\r':
 		item = mode_tree_get_current(mtd);
-		mode_tree_run_command(c, NULL, data->command, item->c->ttyname);
+		mode_tree_run_command(c, NULL, data->command, item->ttyname);
 		finished = 1;
 		break;
 	}
diff --git a/window-tree.c b/window-tree.c
index 8a9749009..2d15eb536 100644
--- a/window-tree.c
+++ b/window-tree.c
@@ -330,6 +330,7 @@ window_tree_build_window(struct session *s, struct winlink *wl,
 	u_int				 n, i, found;
 	int				 expanded;
 	struct format_tree		*ft;
+	uint64_t			 tag = FORMAT_NONE;
 
 	item = window_tree_add_item(data);
 	item->type = WINDOW_TREE_WINDOW;
@@ -337,7 +338,9 @@ window_tree_build_window(struct session *s, struct winlink *wl,
 	item->winlink = wl->idx;
 	item->pane = -1;
 
-	ft = format_create(NULL, NULL, FORMAT_PANE|wl->window->active->id, 0);
+	if (wl->window != NULL && wl->window->active != NULL)
+		tag = FORMAT_PANE|wl->window->active->id;
+	ft = format_create(NULL, NULL, tag, 0);
 	format_defaults(ft, NULL, s, wl, NULL);
 	text = format_expand(ft, data->format);
 	xasprintf(&name, "%u", wl->idx);
@@ -385,6 +388,7 @@ window_tree_build_session(struct session *s, void *modedata,
 	u_int				 n, i, empty;
 	int				 expanded;
 	struct format_tree		*ft;
+	uint64_t			 tag = FORMAT_NONE;
 
 	item = window_tree_add_item(data);
 	item->type = WINDOW_TREE_SESSION;
@@ -392,7 +396,9 @@ window_tree_build_session(struct session *s, void *modedata,
 	item->winlink = -1;
 	item->pane = -1;
 
-	ft = format_create(NULL, NULL, FORMAT_PANE|wl->window->active->id, 0);
+	if (wl != NULL && wl->window != NULL && wl->window->active != NULL)
+		tag = FORMAT_PANE|wl->window->active->id;
+	ft = format_create(NULL, NULL, tag, 0);
 	format_defaults(ft, NULL, s, NULL, NULL);
 	text = format_expand(ft, data->format);
 	format_free(ft);