Merge branch 'master' into command_parser

# Conflicts:
#	cmd-parse.y
#	regress/control-client-exit.sh
#	regress/if-shell-error.sh
#	tmux.h

fuzz/input-fuzzer.c

@@ -44,7 +44,7 @@ LLVMFuzzerTestOneInput(const u_char *data, size_t size)
 	w = window_create(PANE_WIDTH, PANE_HEIGHT, 0, 0);
 	wp = window_add_pane(w, NULL, 0, 0);
 	bufferevent_pair_new(libevent, BEV_OPT_CLOSE_ON_FREE, vpty);
-	wp->ictx = input_init(wp, vpty[0], NULL, NULL);
+	wp->ictx = input_init(wp, vpty[0], NULL);
 	window_add_ref(w, __func__);
 
 	wp->fd = open("/dev/null", O_WRONLY);

fuzz/json-fuzzer.c

@@ -0,0 +1,88 @@
+/*
+ * Fuzz the tmux JSON parser and serializer.
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "tmux.h"
+
+struct event_base *libevent;
+
+static void
+walk_json(struct json_node *node)
+{
+	struct json_node	*child, *object;
+	const char		*string;
+	int64_t		 number;
+	int		 boolean;
+
+	if (node == NULL)
+		return;
+
+	(void)json_get_string(node, &string);
+	(void)json_get_number(node, &number);
+	(void)json_get_boolean(node, &boolean);
+
+	if (json_get_object(node, &object) == 0) {
+		(void)json_find(object, "V");
+		(void)json_find(object, "L");
+	}
+
+	for (child = json_array_first(node); child != NULL;
+	    child = json_array_next(child))
+		walk_json(child);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+	struct json_node	*node;
+	char			*input, *serialized, *cause = NULL;
+
+	if (size == 0 || size > 1U << 20)
+		return 0;
+
+	input = malloc(size + 1);
+	if (input == NULL)
+		return 0;
+	memcpy(input, data, size);
+	input[size] = '\0';
+
+	node = json_parse(input, &cause);
+	free(cause);
+	if (node != NULL) {
+		walk_json(node);
+		serialized = json_to_string(node);
+		free(serialized);
+		json_destroy_node(node);
+	}
+
+	free(input);
+	return 0;
+}
+
+int
+LLVMFuzzerInitialize(__unused int *argc, __unused char ***argv)
+{
+	const struct options_table_entry	*oe;
+
+	global_environ = environ_create();
+	global_options = options_create(NULL);
+	global_s_options = options_create(NULL);
+	global_w_options = options_create(NULL);
+	for (oe = options_table; oe->name != NULL; oe++) {
+		if (oe->scope & OPTIONS_TABLE_SERVER)
+			options_default(global_options, oe);
+		if (oe->scope & OPTIONS_TABLE_SESSION)
+			options_default(global_s_options, oe);
+		if (oe->scope & OPTIONS_TABLE_WINDOW)
+			options_default(global_w_options, oe);
+	}
+	libevent = osdep_event_init();
+	socket_path = xstrdup("dummy");
+
+	return 0;
+}

fuzz/json-fuzzer.dict

@@ -0,0 +1,37 @@
+# JSON structural tokens
+"{"
+"}"
+"["
+"]"
+":"
+","
+"\""
+
+# JSON values
+"true"
+"false"
+"null"
+"0"
+"-1"
+"123456789"
+"\\\""
+"\\\\"
+"\\n"
+"\\u0000"
+
+# tmux layout/control-mode keys
+"V"
+"L"
+"W"
+"H"
+"X"
+"Y"
+"T"
+"S"
+"id"
+"result"
+"error"
+"routes"
+"uri"
+"name"
+"value"

fuzz/json-fuzzer.options

@@ -0,0 +1,2 @@
+[libfuzzer]
+max_len = 4096

fuzz/layout-fuzzer.c

@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2026 Arthur Chan <arthur.chan@adalogics.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
+ * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Fuzz the custom layout parser.
+ *
+ * A layout string such as "bb62,80x24,0,0{40x24,0,0,1,39x24,41,0,2}" is
+ * accepted by select-layout and is what tmux stores and restores for a
+ * window, so it is parsed from configuration and from commands. It drives
+ * layout-custom.c (the string parser and the checksum), then layout.c, which
+ * resizes and assigns the cells.
+ *
+ * layout_parse() refuses a window with no panes, and refuses a layout whose
+ * cell count is smaller than the pane count, so the window is given a fixed
+ * number of panes. The count is fixed rather than derived from the input, so
+ * a mutation always means a different layout string.
+ */
+
+#include <sys/types.h>
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "tmux.h"
+
+#define FUZZER_MAXLEN 1024
+#define FUZZER_PANES 4
+
+struct event_base	*libevent;
+
+int
+LLVMFuzzerTestOneInput(const u_char *data, size_t size)
+{
+	struct window		*w;
+	struct window_pane	*wp;
+	char			*buf, *cause = NULL, *dump;
+	u_int			 i;
+
+	if (size == 0 || size > FUZZER_MAXLEN)
+		return 0;
+
+	/* layout_parse() takes a C string. */
+	buf = malloc(size + 1);
+	if (buf == NULL)
+		return 0;
+	memcpy(buf, data, size);
+	buf[size] = '\0';
+
+	w = window_create(80, 24, 0, 0);
+	if (w == NULL) {
+		free(buf);
+		return 0;
+	}
+	window_add_ref(w, __func__);
+
+	for (i = 0; i < FUZZER_PANES; i++) {
+		wp = window_add_pane(w, NULL, 0, 0);
+		if (w->active == NULL)
+			w->active = wp;
+	}
+
+	if (layout_parse(w, buf, &cause) == 0) {
+		dump = layout_dump(w, w->layout_root, 1);
+		free(dump);
+	}
+	free(cause);
+
+	window_remove_ref(w, __func__);
+
+	free(buf);
+	return 0;
+}
+
+int
+LLVMFuzzerInitialize(__unused int *argc, __unused char ***argv)
+{
+	const struct options_table_entry	*oe;
+
+	global_environ = environ_create();
+	global_options = options_create(NULL);
+	global_s_options = options_create(NULL);
+	global_w_options = options_create(NULL);
+	for (oe = options_table; oe->name != NULL; oe++) {
+		if (oe->scope & OPTIONS_TABLE_SERVER)
+			options_default(global_options, oe);
+		if (oe->scope & OPTIONS_TABLE_SESSION)
+			options_default(global_s_options, oe);
+		if (oe->scope & OPTIONS_TABLE_WINDOW)
+			options_default(global_w_options, oe);
+	}
+
+	libevent = osdep_event_init();
+
+	socket_path = xstrdup("dummy");
+
+	return 0;
+}

fuzz/layout-fuzzer.dict

@@ -0,0 +1,17 @@
+# tmux custom layout strings: "<checksum>,<sx>x<sy>,<x>,<y>{...}" / "[...]"
+","
+"x"
+"{"
+"}"
+"["
+"]"
+"0"
+"1"
+"80x24,0,0"
+"40x24,0,0"
+"bb62,"
+"cafe,"
+",0,0,0"
+",0,0{"
+",0,0["
+"@"

fuzz/layout-fuzzer.options

@@ -0,0 +1,2 @@
+[libfuzzer]
+max_len = 1024