From 2cba1c74a7ed62d822e0b9c4ed7f3ba57ecec633 Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Mon, 3 Jul 2023 10:48:26 +0000
Subject: [PATCH] Do not risk writing over the end of the buffer when it ends
 in # (because strchr \0 will be non-NULL), reported by Robert Morris in
 GitHub issue 3610.

---
 usr.bin/tmux/format.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/usr.bin/tmux/format.c b/usr.bin/tmux/format.c
index 404a6080aee..bf89cbebd65 100644
--- a/usr.bin/tmux/format.c
+++ b/usr.bin/tmux/format.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: format.c,v 1.314 2023/06/30 13:19:32 nicm Exp $ */
+/* $OpenBSD: format.c,v 1.315 2023/07/03 10:48:26 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -3664,7 +3664,9 @@ format_skip(const char *s, const char *end)
 	for (; *s != '\0'; s++) {
 		if (*s == '#' && s[1] == '{')
 			brackets++;
-		if (*s == '#' && strchr(",#{}:", s[1]) != NULL) {
+		if (*s == '#' &&
+		    s[1] != '\0' &&
+		    strchr(",#{}:", s[1]) != NULL) {
 			s++;
 			continue;
 		}
-- 
2.20.1