From c40302a7ff95eade7fb2584770e89d9fd70c9020 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Sat, 30 May 2026 08:58:29 +0000
Subject: [PATCH 1/2] Check if the range is invalid using start,end rather than
 length since it will never be negative.

---
 screen-write.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/screen-write.c b/screen-write.c
index c593dc0b..e6e6df45 100644
--- a/screen-write.c
+++ b/screen-write.c
@@ -2090,16 +2090,16 @@ screen_write_collect_flush_line(struct screen_write_ctx *ctx, u_int y)
 			if (c_start + xoff > r_end || c_end + xoff < r_start)
 				continue;
 			if (r_start > c_start + xoff)
-				w_start = c_start + (r_start - c_start + xoff);
+				w_start = r_start - xoff;
 			else
 				w_start = c_start;
 			if (c_end + xoff > r_end)
-				w_end = c_end - (c_end + xoff - r_end);
+				w_end = r_end - xoff;
 			else
 				w_end = c_end;
-			w_length = w_end - w_start;
-			if (w_length <= 0)
+			if (w_end <= w_start)
 				continue;
+			w_length = w_end - w_start;
 
 			screen_write_set_cursor(ctx, w_start, y);
 			if (ci->type == CLEAR) {

From b9d228c72f4c17e8502d38d5885c5ef25de4b2a9 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Sat, 30 May 2026 09:48:30 +0000
Subject: [PATCH 2/2] Do not crash when a pane offset is negative.

---
 screen-write.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/screen-write.c b/screen-write.c
index e6e6df45..91f1bb7a 100644
--- a/screen-write.c
+++ b/screen-write.c
@@ -2047,8 +2047,8 @@ screen_write_collect_flush_line(struct screen_write_ctx *ctx, u_int y)
 	struct screen_write_citem	*ci, *tmp;
 	struct screen_write_cline	*cl = &s->write_list[y];
 	u_int				 last = UINT_MAX, items = 0, wsx, wsy;
-	u_int				 w_start, w_end, w_length, i;
-	int				 xoff, yoff, written;
+	u_int				 w_length, i;
+	int				 w_start, w_end, xoff, yoff, written;
 	int				 r_start, r_end, c_start, c_end;
 	struct tty_ctx			 ttyctx;
 	struct visible_ranges		*r;
@@ -2087,7 +2087,7 @@ screen_write_collect_flush_line(struct screen_write_ctx *ctx, u_int y)
 			c_start = ci->x;
 			c_end = ci->x + ci->used;
 
-			if (c_start + xoff > r_end || c_end + xoff < r_start)
+			if (c_start + xoff >= r_end || c_end + xoff <= r_start)
 				continue;
 			if (r_start > c_start + xoff)
 				w_start = r_start - xoff;
@@ -2100,6 +2100,8 @@ screen_write_collect_flush_line(struct screen_write_ctx *ctx, u_int y)
 			if (w_end <= w_start)
 				continue;
 			w_length = w_end - w_start;
+			if (w_length <= 0)
+				continue;
 
 			screen_write_set_cursor(ctx, w_start, y);
 			if (ci->type == CLEAR) {