From 56200ca044d073349c9e884dbbb2951cb3b851cb Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Fri, 1 May 2026 09:59:42 +0000
Subject: [PATCH 1/2] Do not leak cached last result from control subs, from
 Aaron Campbell in GitHub issue 5047.

---
 control.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/control.c b/control.c
index e4efb01f..30536183 100644
--- a/control.c
+++ b/control.c
@@ -208,10 +208,12 @@ control_free_sub(struct control_state *cs, struct control_sub *csub)
 
 	RB_FOREACH_SAFE(csp, control_sub_panes, &csub->panes, csp1) {
 		RB_REMOVE(control_sub_panes, &csub->panes, csp);
+		free(csp->last);
 		free(csp);
 	}
 	RB_FOREACH_SAFE(csw, control_sub_windows, &csub->windows, csw1) {
 		RB_REMOVE(control_sub_windows, &csub->windows, csw);
+		free(csw->last);
 		free(csw);
 	}
 	free(csub->last);

From 2e9c6c25869f0156aac20771f4a5f94a0496d642 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Fri, 1 May 2026 11:56:41 +0000
Subject: [PATCH 2/2] Add some checks on line size to avoid underflow, from
 san65384 at gmail dot com in GitHub issue 4955.

---
 mode-tree.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mode-tree.c b/mode-tree.c
index bf0b163c..6479d78d 100644
--- a/mode-tree.c
+++ b/mode-tree.c
@@ -301,6 +301,8 @@ mode_tree_clear_tagged(struct mode_tree_list *mtl)
 void
 mode_tree_up(struct mode_tree_data *mtd, int wrap)
 {
+	if (mtd->line_size == 0)
+		return;
 	if (mtd->current == 0) {
 		if (wrap) {
 			mtd->current = mtd->line_size - 1;
@@ -317,6 +319,8 @@ mode_tree_up(struct mode_tree_data *mtd, int wrap)
 int
 mode_tree_down(struct mode_tree_data *mtd, int wrap)
 {
+	if (mtd->line_size == 0)
+		return (0);
 	if (mtd->current == mtd->line_size - 1) {
 		if (wrap) {
 			mtd->current = 0;
@@ -363,6 +367,8 @@ mode_tree_swap(struct mode_tree_data *mtd, int direction)
 void *
 mode_tree_get_current(struct mode_tree_data *mtd)
 {
+	if (mtd->line_size == 0)
+		return (NULL);
 	return (mtd->line_list[mtd->current].item->itemdata);
 }
 
@@ -433,6 +439,8 @@ mode_tree_set_current(struct mode_tree_data *mtd, uint64_t tag)
 		return (1);
 	}
 	if (mtd->current >= mtd->line_size) {
+		if (mtd->line_size == 0)
+			return (0);
 		mtd->current = mtd->line_size - 1;
 		if (mtd->current > mtd->height - 1)
 			mtd->offset = mtd->current - mtd->height + 1;