From fc6d94a9f8a593bd8b7031650802084385d4ee03 Mon Sep 17 00:00:00 2001
From: Nicholas Marriott <nicholas.marriott@gmail.com>
Date: Mon, 27 Apr 2026 13:09:07 +0100
Subject: [PATCH] Track which list (images or saved_images) each image is on so
 they can be removed from the correct list when the total image count is
 reached. Fixes crash reported by xlabai at tencent dot com.

---
 image.c  |  7 +++----
 screen.c | 14 ++++++++++++--
 tmux.h   |  4 +++-
 3 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/image.c b/image.c
index 0948925b..f0543dc4 100644
--- a/image.c
+++ b/image.c
@@ -53,14 +53,12 @@ image_log(struct image *im, const char* from, const char* fmt, ...)
 static void
 image_free(struct image *im)
 {
-	struct screen	*s = im->s;
-
 	image_log(im, __func__, NULL);
 
 	TAILQ_REMOVE(&all_images, im, all_entry);
 	all_images_count--;
 
-	TAILQ_REMOVE(&s->images, im, entry);
+	TAILQ_REMOVE(im->list, im, entry);
 	sixel_free(im->data);
 	free(im->fallback);
 	free(im);
@@ -137,7 +135,8 @@ image_store(struct screen *s, struct sixel_image *si)
 	image_fallback(&im->fallback, im->sx, im->sy);
 
 	image_log(im, __func__, NULL);
-	TAILQ_INSERT_TAIL(&s->images, im, entry);
+	im->list = &s->images;
+	TAILQ_INSERT_TAIL(im->list, im, entry);
 
 	TAILQ_INSERT_TAIL(&all_images, im, all_entry);
 	if (++all_images_count == MAX_IMAGE_COUNT)
diff --git a/screen.c b/screen.c
index c93a689b..f2ea34d8 100644
--- a/screen.c
+++ b/screen.c
@@ -657,7 +657,10 @@ screen_reflow(struct screen *s, u_int new_x, u_int *cx, u_int *cy, int cursor)
 void
 screen_alternate_on(struct screen *s, struct grid_cell *gc, int cursor)
 {
-	u_int	sx, sy;
+	u_int		 sx, sy;
+#ifdef ENABLE_SIXEL
+	struct image	*im;
+#endif
 
 	if (SCREEN_IS_ALTERNATE(s))
 		return;
@@ -674,6 +677,8 @@ screen_alternate_on(struct screen *s, struct grid_cell *gc, int cursor)
 
 #ifdef ENABLE_SIXEL
 	TAILQ_CONCAT(&s->saved_images, &s->images, entry);
+	TAILQ_FOREACH(im, &s->saved_images, entry)
+	    im->list = &s->saved_images;
 #endif
 
 	grid_view_clear(s->grid, 0, 0, sx, sy, 8);
@@ -686,7 +691,10 @@ screen_alternate_on(struct screen *s, struct grid_cell *gc, int cursor)
 void
 screen_alternate_off(struct screen *s, struct grid_cell *gc, int cursor)
 {
-	u_int	sx = screen_size_x(s), sy = screen_size_y(s);
+	u_int		 sx = screen_size_x(s), sy = screen_size_y(s);
+#ifdef ENABLE_SIXEL
+	struct image	*im;
+#endif
 
 	/*
 	 * If the current size is different, temporarily resize to the old size
@@ -733,6 +741,8 @@ screen_alternate_off(struct screen *s, struct grid_cell *gc, int cursor)
 #ifdef ENABLE_SIXEL
 	image_free_all(s);
 	TAILQ_CONCAT(&s->images, &s->saved_images, entry);
+	TAILQ_FOREACH(im, &s->images, entry)
+	    im->list = &s->images;
 #endif
 
 	if (s->cx > screen_size_x(s) - 1)
diff --git a/tmux.h b/tmux.h
index f6785df9..7d0a9d80 100644
--- a/tmux.h
+++ b/tmux.h
@@ -971,8 +971,10 @@ struct image {
 	u_int			 sx;
 	u_int			 sy;
 
-	TAILQ_ENTRY (image)	 all_entry;
+	struct images		*list;
 	TAILQ_ENTRY (image)	 entry;
+
+	TAILQ_ENTRY (image)	 all_entry;
 };
 TAILQ_HEAD(images, image);
 #endif