From 1e981f4c6d429f5c51cb0d7a5c40fcd78ad236a2 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 17 Feb 2014 18:12:47 +0000
Subject: [PATCH 1/3] Don't crash when given a invalid colour, reported by
 Felix Rosencrantz, fix from Thomas Adam.

---
 cmd-set-option.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/cmd-set-option.c b/cmd-set-option.c
index 046bebd6..9882e449 100644
--- a/cmd-set-option.c
+++ b/cmd-set-option.c
@@ -307,11 +307,13 @@ cmd_set_option_set(struct cmd *self, struct cmd_q *cmdq,
 		break;
 	case OPTIONS_TABLE_COLOUR:
 		o = cmd_set_option_colour(self, cmdq, oe, oo, value);
-		style_update_new(oo, o->name, oe->style);
+		if (o != NULL)
+			style_update_new(oo, o->name, oe->style);
 		break;
 	case OPTIONS_TABLE_ATTRIBUTES:
 		o = cmd_set_option_attributes(self, cmdq, oe, oo, value);
-		style_update_new(oo, o->name, oe->style);
+		if (o != NULL)
+			style_update_new(oo, o->name, oe->style);
 		break;
 	case OPTIONS_TABLE_FLAG:
 		o = cmd_set_option_flag(self, cmdq, oe, oo, value);

From 69b7c496accc2a646e5e2dee7870bea1194a6641 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 17 Feb 2014 22:42:20 +0000
Subject: [PATCH 2/3] Be consistent and allow only mouse down and mouse wheel
 for any pane with mouse-select-pane rather than just in copy mode, reported
 by Balazs Kezes.

---
 server-client.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server-client.c b/server-client.c
index c2903a0d..ed8159f5 100644
--- a/server-client.c
+++ b/server-client.c
@@ -324,9 +324,9 @@ server_client_check_mouse(struct client *c, struct window_pane *wp)
 	else if (statusat > 0 && m->y >= (u_int)statusat)
 		m->y = statusat - 1;
 
-	/* Is this a pane selection? Allow down only in copy mode. */
+	/* Is this a pane selection? */
 	if (options_get_number(oo, "mouse-select-pane") &&
-	    (m->event == MOUSE_EVENT_DOWN || wp->mode != &window_copy_mode)) {
+	    (m->event == MOUSE_EVENT_DOWN || m->event == MOUSE_EVENT_WHEEL)) {
 		window_set_active_at(wp->window, m->x, m->y);
 		server_redraw_window_borders(wp->window);
 		wp = wp->window->active; /* may have changed */

From 6daf06b1ad61f67e9f7780d787451b9b5f82dd43 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Mon, 17 Feb 2014 23:07:03 +0000
Subject: [PATCH 3/3] Fix memory leaks with paste_replace, based on changes
 from J Raynor.

---
 cmd-load-buffer.c | 1 +
 paste.c           | 4 +++-
 window-copy.c     | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/cmd-load-buffer.c b/cmd-load-buffer.c
index eb6e0d0c..636f0fcd 100644
--- a/cmd-load-buffer.c
+++ b/cmd-load-buffer.c
@@ -169,6 +169,7 @@ cmd_load_buffer_callback(struct client *c, int closed, void *data)
 		/* No context so can't use server_client_msg_error. */
 		evbuffer_add_printf(c->stderr_data, "no buffer %d\n", *buffer);
 		server_push_stderr(c);
+		free(pdata);
 	}
 
 	free(data);
diff --git a/paste.c b/paste.c
index 2e89a5ef..946935a3 100644
--- a/paste.c
+++ b/paste.c
@@ -131,8 +131,10 @@ paste_replace(struct paste_stack *ps, u_int idx, char *data, size_t size)
 {
 	struct paste_buffer	*pb;
 
-	if (size == 0)
+	if (size == 0) {
+		free(data);
 		return (0);
+	}
 
 	if (idx >= ARRAY_LENGTH(ps))
 		return (-1);
diff --git a/window-copy.c b/window-copy.c
index df4ca55a..76c9c3ce 100644
--- a/window-copy.c
+++ b/window-copy.c
@@ -1455,8 +1455,8 @@ window_copy_copy_buffer(struct window_pane *wp, int idx, void *buf, size_t len)
 	if (idx == -1) {
 		limit = options_get_number(&global_options, "buffer-limit");
 		paste_add(&global_buffers, buf, len, limit);
-	} else
-		paste_replace(&global_buffers, idx, buf, len);
+	} else if (paste_replace(&global_buffers, idx, buf, len) != 0)
+		free(buf);
 }
 
 void