From f90d3af40353da3bbe89eaf210269908987bf35e Mon Sep 17 00:00:00 2001 From: nicm Date: Tue, 28 Apr 2026 08:32:44 +0000 Subject: [PATCH 1/5] Fix -p for for join-pane, from Dane Jensen. --- cmd-join-pane.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd-join-pane.c b/cmd-join-pane.c index 3300498f..6eb0ea65 100644 --- a/cmd-join-pane.c +++ b/cmd-join-pane.c @@ -119,7 +119,7 @@ cmd_join_pane_exec(struct cmd *self, struct cmdq_item *item) size = args_percentage_and_expand(args, 'l', 0, INT_MAX, curval, item, &cause); } else if (args_has(args, 'p')) { - size = args_strtonum_and_expand(args, 'l', 0, 100, item, + size = args_strtonum_and_expand(args, 'p', 0, 100, item, &cause); if (cause == NULL) size = curval * size / 100; From ec58272b9536cf0669964841dd5204ac06e3b84e Mon Sep 17 00:00:00 2001 From: nicm Date: Tue, 28 Apr 2026 08:34:15 +0000 Subject: [PATCH 2/5] Do not hang run-shell when job_run fails, from Barrett Ruth in GitHub issue 5037. --- cmd-run-shell.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/cmd-run-shell.c b/cmd-run-shell.c index 045f551e..a9f1c1fe 100644 --- a/cmd-run-shell.c +++ b/cmd-run-shell.c @@ -198,8 +198,17 @@ cmd_run_shell_timer(__unused int fd, __unused short events, void* arg) } if (job_run(cmd, 0, NULL, NULL, cdata->s, cdata->cwd, NULL, cmd_run_shell_callback, cmd_run_shell_free, cdata, - cdata->flags, -1, -1) == NULL) + cdata->flags, -1, -1) == NULL) { + if (cdata->item == NULL) + status_message_set(c, -1, 1, 0, 0, + "failed to run command: %s", cmd); + else { + cmdq_error(cdata->item, + "failed to run command: %s", cmd); + cmdq_continue(cdata->item); + } cmd_run_shell_free(cdata); + } return; } From 2a5715fad5a3f7c7cec5ba8a0a26b85a0df2c259 Mon Sep 17 00:00:00 2001 From: nicm Date: Tue, 28 Apr 2026 08:35:21 +0000 Subject: [PATCH 3/5] Do not deref NULL job in window_copy_pipe_run when job_run fails. From Barrett Ruth in GitHub issue 5036. --- window-copy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/window-copy.c b/window-copy.c index ac89dc56..0b6bf69a 100644 --- a/window-copy.c +++ b/window-copy.c @@ -5171,7 +5171,8 @@ window_copy_pipe_run(struct window_mode_entry *wme, struct session *s, if (cmd != NULL && *cmd != '\0') { job = job_run(cmd, 0, NULL, NULL, s, NULL, NULL, NULL, NULL, NULL, JOB_NOWAIT, -1, -1); - bufferevent_write(job_get_event(job), buf, *len); + if (job != NULL) + bufferevent_write(job_get_event(job), buf, *len); } return (buf); } From 763dec881a7dfad80ba3a1221b139ac8a78cba05 Mon Sep 17 00:00:00 2001 From: nicm Date: Tue, 28 Apr 2026 08:47:55 +0000 Subject: [PATCH 4/5] Do not leak socketpair fds in pipe-pane when fork fails. From Barrett Ruth. --- cmd-pipe-pane.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cmd-pipe-pane.c b/cmd-pipe-pane.c index 2247efb7..13fe679e 100644 --- a/cmd-pipe-pane.c +++ b/cmd-pipe-pane.c @@ -129,6 +129,8 @@ cmd_pipe_pane_exec(struct cmd *self, struct cmdq_item *item) sigprocmask(SIG_SETMASK, &oldset, NULL); cmdq_error(item, "fork error: %s", strerror(errno)); + close(pipe_fd[0]); + close(pipe_fd[1]); free(cmd); return (CMD_RETURN_ERROR); case 0: From 746dd91e860cacdfd67fc6585cd4c87bf97c1d53 Mon Sep 17 00:00:00 2001 From: nicm Date: Tue, 28 Apr 2026 08:52:37 +0000 Subject: [PATCH 5/5] Sanitize paste buffer names in paste_set and paste_rename, GitHub issue 5032 from Barrett Ruth. --- paste.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/paste.c b/paste.c index 509e2aa3..0e19bcee 100644 --- a/paste.c +++ b/paste.c @@ -205,6 +205,7 @@ int paste_rename(const char *oldname, const char *newname, char **cause) { struct paste_buffer *pb, *pb_new; + char *name; if (cause != NULL) *cause = NULL; @@ -220,23 +221,33 @@ paste_rename(const char *oldname, const char *newname, char **cause) return (-1); } + name = clean_name(newname, ""); + if (name == NULL) { + if (cause != NULL) + xasprintf(cause, "invalid buffer name: %s", newname); + return (-1); + } + pb = paste_get_name(oldname); if (pb == NULL) { if (cause != NULL) xasprintf(cause, "no buffer %s", oldname); + free(name); return (-1); } - pb_new = paste_get_name(newname); - if (pb_new == pb) + pb_new = paste_get_name(name); + if (pb_new == pb) { + free(name); return (0); + } if (pb_new != NULL) paste_free(pb_new); RB_REMOVE(paste_name_tree, &paste_by_name, pb); free(pb->name); - pb->name = xstrdup(newname); + pb->name = name; if (pb->automatic) paste_num_automatic--; @@ -245,7 +256,7 @@ paste_rename(const char *oldname, const char *newname, char **cause) RB_INSERT(paste_name_tree, &paste_by_name, pb); notify_paste_buffer(oldname, 1); - notify_paste_buffer(newname, 0); + notify_paste_buffer(pb->name, 0); return (0); } @@ -258,6 +269,7 @@ int paste_set(char *data, size_t size, const char *name, char **cause) { struct paste_buffer *pb, *old; + char *newname; if (cause != NULL) *cause = NULL; @@ -277,9 +289,16 @@ paste_set(char *data, size_t size, const char *name, char **cause) return (-1); } + newname = clean_name(name, ""); + if (newname == NULL) { + if (cause != NULL) + xasprintf(cause, "invalid buffer name: %s", name); + return (-1); + } + pb = xmalloc(sizeof *pb); - pb->name = xstrdup(name); + pb->name = newname; pb->data = data; pb->size = size; @@ -289,13 +308,13 @@ paste_set(char *data, size_t size, const char *name, char **cause) pb->created = time(NULL); - if ((old = paste_get_name(name)) != NULL) + if ((old = paste_get_name(pb->name)) != NULL) paste_free(old); RB_INSERT(paste_name_tree, &paste_by_name, pb); RB_INSERT(paste_time_tree, &paste_by_time, pb); - notify_paste_buffer(name, 0); + notify_paste_buffer(pb->name, 0); return (0); }