diff --git a/format.c b/format.c
index 031d38e1..d84dfd35 100644
--- a/format.c
+++ b/format.c
@@ -5444,7 +5444,7 @@ format_expand1(struct format_expand_state *es, const char *fmt)
 			buf[off++] = *fmt++;
 			continue;
 		}
-		if (*fmt++ == '\0')
+		if (*++fmt == '\0')
 			break;
 
 		ch = (u_char)*fmt++;
diff --git a/window-copy.c b/window-copy.c
index cc9f3e5d..16626563 100644
--- a/window-copy.c
+++ b/window-copy.c
@@ -3333,7 +3333,7 @@ window_copy_command(struct window_mode_entry *wme, struct client *c,
 	enum window_copy_cmd_clear	 clear = WINDOW_COPY_CMD_CLEAR_NEVER;
 	const char			*command;
 	u_int				 i, count = args_count(args);
-	int				 keys;
+	int				 keys, flags;
 	char				*error = NULL;
 
 	if (count == 0)
@@ -3355,9 +3355,10 @@ window_copy_command(struct window_mode_entry *wme, struct client *c,
 	action = WINDOW_COPY_CMD_NOTHING;
 	for (i = 0; i < nitems(window_copy_cmd_table); i++) {
 		if (strcmp(window_copy_cmd_table[i].command, command) == 0) {
-			if (c->flags & CLIENT_READONLY &&
-			    (~window_copy_cmd_table[i].flags &
-			    WINDOW_COPY_CMD_FLAG_READONLY)) {
+			flags = window_copy_cmd_table[i].flags;
+			if (c != NULL &&
+			    c->flags & CLIENT_READONLY &&
+			    (~flags & WINDOW_COPY_CMD_FLAG_READONLY)) {
 				status_message_set(c, -1, 1, 0, 0,
 				    "client is read-only");
 				return;