3.1c.

colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.

CHANGES

@@ -1,3 +1,13 @@
+CHANGED FROM 3.1b TO 3.1c
+
+* Fix a stack overflow on colon-separated CSI parsing.
+
+CHANGES FROM 3.1a TO 3.1b
+
+* Fix build on systems without sys/queue.h.
+
+* Fix crash when allow-rename is on and an empty name is set.
+
 CHANGES FROM 3.1 TO 3.1a
 
 * Do not close stdout prematurely in control mode since it is needed to print

configure.ac

@@ -1,6 +1,6 @@
 # configure.ac
 
-AC_INIT([tmux], 3.1a)
+AC_INIT([tmux], 3.1c)
 AC_PREREQ([2.60])
 
 AC_CONFIG_AUX_DIR(etc)

file.c

@@ -17,7 +17,6 @@
  */
 
 #include <sys/types.h>
-#include <sys/queue.h>
 
 #include <errno.h>
 #include <fcntl.h>

input.c

@@ -1929,8 +1929,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);
@@ -2304,7 +2309,7 @@ input_exit_rename(struct input_ctx *ictx)
 		return;
 
 	if (ictx->input_len == 0) {
-		oe = options_get(wp->window->options, "automatic-rename");
+		oe = options_get_only(wp->window->options, "automatic-rename");
 		if (oe != NULL)
 			options_remove(oe);
 		return;