From 38b4813f4821d19e10d512be9c8a75d053d791c3 Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Mon, 5 Oct 2026 10:59:37 +0000
Subject: [PATCH 1/2] Check format time in format_skip1 before the loop as
 well.

---
 format.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/format.c b/format.c
index 5a9a86a05..4c4ede394 100644
--- a/format.c
+++ b/format.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: format.c,v 1.424 2026/09/29 14:12:21 nicm Exp $ */
+/* $OpenBSD: format.c,v 1.425 2026/10/05 10:59:37 nicm Exp $ */
 
 /*
  * Copyright (c) 2011 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -4813,6 +4813,9 @@ format_skip1(struct format_expand_state *es, const char *s, const char *end)
 	int	brackets = 0;
 	u_int	check = 0;
 
+	if (es != NULL && !format_check_time(es, NULL))
+		return (NULL);
+
 	for (; *s != '\0'; s++) {
 		if (es != NULL && !format_check_time(es, &check))
 			return (NULL);

From f8d74ec97b1a8b6a195390dff5c720a10b19ae4f Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Mon, 5 Oct 2026 13:45:49 +0000
Subject: [PATCH 2/2] Do not always perform environment variable assignments
 inside %else, GitHub issue 5688 from Tushar Muralidharan.

---
 cmd-parse.y | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/cmd-parse.y b/cmd-parse.y
index a6541c930..390ff627e 100644
--- a/cmd-parse.y
+++ b/cmd-parse.y
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd-parse.y,v 1.60 2026/09/08 10:20:08 nicm Exp $ */
+/* $OpenBSD: cmd-parse.y,v 1.61 2026/10/05 13:45:49 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -41,6 +41,7 @@ static char			*yylex_format(void);
 
 struct cmd_parse_scope {
 	int				 flag;
+	int				 taken;
 	TAILQ_ENTRY (cmd_parse_scope)	 entry;
 };
 
@@ -272,6 +273,7 @@ if_open		: IF expanded
 
 			scope = xmalloc(sizeof *scope);
 			$$ = scope->flag = format_true($2);
+			scope->taken = scope->flag;
 			free($2);
 
 			if (ps->scope != NULL)
@@ -285,7 +287,8 @@ if_else		: ELSE
 			struct cmd_parse_scope	*scope;
 
 			scope = xmalloc(sizeof *scope);
-			scope->flag = !ps->scope->flag;
+			scope->flag = !ps->scope->taken;
+			scope->taken = 1;
 
 			free(ps->scope);
 			ps->scope = scope;
@@ -297,7 +300,9 @@ if_elif		: ELIF expanded
 			struct cmd_parse_scope	*scope;
 
 			scope = xmalloc(sizeof *scope);
-			$$ = scope->flag = format_true($2);
+			scope->flag = !ps->scope->taken && format_true($2);
+			scope->taken = ps->scope->taken || scope->flag;
+			$$ = scope->flag;
 			free($2);
 
 			free(ps->scope);