From d5b1f3ad890259f6b91309f72dafcdeb4612bbcb Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Fri, 17 Jul 2026 08:13:23 +0000
Subject: [PATCH] Clear cfg_client if the client is destroyed to prevent UAF
 found by Ilya Grigoriev.

---
 server-client.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server-client.c b/server-client.c
index eb516187b..e9c62a745 100644
--- a/server-client.c
+++ b/server-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: server-client.c,v 1.494 2026/07/15 14:14:50 nicm Exp $ */
+/* $OpenBSD: server-client.c,v 1.495 2026/07/17 08:13:23 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -502,6 +502,8 @@ server_client_lost(struct client *c)
 	struct client_file	*cf, *cf1;
 	struct client_window	*cw, *cw1;
 
+	if (cfg_client == c)
+		cfg_client = NULL;
 	c->flags |= CLIENT_DEAD;
 
 	server_client_clear_overlay(c);