7 files changed, 103 insertions, 32 deletions
diff --git a/debian/changelog b/debian/changelog
index ed257ef..5a5bcfd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+tmux (3.4-3) unstable; urgency=medium
+
+  * Cherry-pick commit aa17f0e0c1 from upstream to fix crash on invalid
+    Sixel input.
+  * Re-enable Sixel support.
+
+ -- Romain Francoise <rfrancoise@debian.org>  Sat, 23 Mar 2024 17:07:31 +0100
+
 tmux (3.4-2~progress7.99u1) graograman-backports; urgency=medium
 
   * Uploading to graograman-backports, remaining changes:
diff --git a/debian/patches/series b/debian/patches/series
index 30716db..c87bbc1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 platform-quirks.diff
 upstream-bd29a48b56.diff
-upstream-PR-3860.diff
+upstream-6c0067c103.diff
+upstream-aa17f0e0c1.diff
diff --git a/debian/patches/upstream-PR-3860.diff b/debian/patches/upstream-6c0067c103.diff
index 4711745..ed9423b 100644
--- a/debian/patches/upstream-PR-3860.diff
+++ b/debian/patches/upstream-6c0067c103.diff
@@ -1,23 +1,12 @@
-From 5363a5475a1dd4158c1ddb23de2da34e88738673 Mon Sep 17 00:00:00 2001
-From: Romain Francoise <romain@rfr.io>
-Date: Sun, 25 Feb 2024 15:53:25 +0100
-Subject: [PATCH] Don't notify when unzooming windows from window_destroy()
+commit 6c0067c10360880334afa50815b880d04edcbf42
+Author: Nicholas Marriott <nicholas.marriott@gmail.com>
+Date:   Thu Mar 21 11:30:42 2024 +0000
 
-Since commit 36e1ac65560, window_destroy() calls window_unzoom()
-but the latter emits a 'window-layout-changed' notification with
-the window which is about to be freed. This results in the
-callback later dereferencing a freed window, or a double-free.
+    Do not notify window-layout-changed if the window is about to be
+    destroyed (since it may have been freed by the time the notify happens),
+    from Romain Francoise in GitHub issue 3860.
 
-Closes: #3857.
----
- cmd-display-panes.c |  2 +-
- cmd-resize-pane.c   |  2 +-
- popup.c             |  2 +-
- resize.c            |  2 +-
- server-fn.c         |  2 +-
- tmux.h              |  2 +-
- window.c            | 10 ++++++----
- 7 files changed, 12 insertions(+), 10 deletions(-)
+Origin: upstream, https://github.com/tmux/tmux/commit/6c0067c10360880334afa50815b880d04edcbf42
 
 diff --git a/cmd-display-panes.c b/cmd-display-panes.c
 index 06f6dc277a..25556f3d58 100644
@@ -46,10 +35,10 @@ index c9439441f6..b2c167f59f 100644
  			window_zoom(wp);
  		server_redraw_window(w);
 diff --git a/popup.c b/popup.c
-index 4742733932..01b95e27b8 100644
+index 38a4c17fdf..804dd6ef07 100644
 --- a/popup.c
 +++ b/popup.c
-@@ -345,7 +345,7 @@ popup_make_pane(struct popup_data *pd, enum layout_type type)
+@@ -346,7 +346,7 @@ popup_make_pane(struct popup_data *pd, enum layout_type type)
  	u_int			 hlimit;
  	const char		*shell;
  
@@ -72,10 +61,10 @@ index 457fee0a7b..dff9571270 100644
  	/* Resize the layout first. */
  	layout_resize(w, sx, sy);
 diff --git a/server-fn.c b/server-fn.c
-index 2f649329cb..00d0e37843 100644
+index 8d66bce913..052169568f 100644
 --- a/server-fn.c
 +++ b/server-fn.c
-@@ -488,6 +488,6 @@ server_check_unattached(void)
+@@ -487,6 +487,6 @@ server_check_unattached(void)
  void
  server_unzoom_window(struct window *w)
  {
@@ -84,10 +73,10 @@ index 2f649329cb..00d0e37843 100644
  		server_redraw_window(w);
  }
 diff --git a/tmux.h b/tmux.h
-index a50adbfae0..7671cca097 100644
+index e6516a7251..f61d1032eb 100644
 --- a/tmux.h
 +++ b/tmux.h
-@@ -3070,7 +3070,7 @@ struct window_pane *window_add_pane(struct window *, struct window_pane *,
+@@ -3021,7 +3021,7 @@ struct window_pane *window_add_pane(struct window *, struct window_pane *,
  void		 window_resize(struct window *, u_int, u_int, int, int);
  void		 window_pane_send_resize(struct window_pane *, u_int, u_int);
  int		 window_zoom(struct window_pane *);
@@ -97,10 +86,10 @@ index a50adbfae0..7671cca097 100644
  int		 window_pop_zoom(struct window *);
  void		 window_lost_pane(struct window *, struct window_pane *);
 diff --git a/window.c b/window.c
-index 77ce41d8f7..69a42ab7e6 100644
+index c5d00e29fe..43c272bc8e 100644
 --- a/window.c
 +++ b/window.c
-@@ -338,7 +338,7 @@ window_destroy(struct window *w)
+@@ -340,7 +340,7 @@ window_destroy(struct window *w)
  {
  	log_debug("window @%u destroyed (%d references)", w->id, w->references);
  
@@ -109,7 +98,7 @@ index 77ce41d8f7..69a42ab7e6 100644
  	RB_REMOVE(windows, &windows, w);
  
  	if (w->layout_root != NULL)
-@@ -673,7 +673,7 @@ window_zoom(struct window_pane *wp)
+@@ -666,7 +666,7 @@ window_zoom(struct window_pane *wp)
  }
  
  int
@@ -118,7 +107,7 @@ index 77ce41d8f7..69a42ab7e6 100644
  {
  	struct window_pane	*wp;
  
-@@ -690,7 +690,9 @@ window_unzoom(struct window *w)
+@@ -683,7 +683,9 @@ window_unzoom(struct window *w)
  		wp->saved_layout_cell = NULL;
  	}
  	layout_fix_panes(w, NULL);
@@ -129,7 +118,7 @@ index 77ce41d8f7..69a42ab7e6 100644
  
  	return (0);
  }
-@@ -704,7 +706,7 @@ window_push_zoom(struct window *w, int always, int flag)
+@@ -697,7 +699,7 @@ window_push_zoom(struct window *w, int always, int flag)
  		w->flags |= WINDOW_WASZOOMED;
  	else
  		w->flags &= ~WINDOW_WASZOOMED;
diff --git a/debian/patches/upstream-aa17f0e0c1.diff b/debian/patches/upstream-aa17f0e0c1.diff
new file mode 100644
index 0000000..deb8e6a
--- /dev/null
+++ b/debian/patches/upstream-aa17f0e0c1.diff
@@ -0,0 +1,71 @@
+commit aa17f0e0c1c8b3f1d6fc8617613c74f07de66fae
+Author: Nicholas Marriott <nicholas.marriott@gmail.com>
+Date:   Thu Mar 21 11:37:09 2024 +0000
+
+    Fix crash if SIXEL colour register is invalid and remove SIXEL images before
+    reflow to avoid a different crash, from Anindya Mukherjee.
+
+Origin: upstream, https://github.com/tmux/tmux/commit/aa17f0e0c1c8b3f1d6fc8617613c74f07de66fae
+
+diff --git a/image-sixel.c b/image-sixel.c
+index 3396a22a7f..e23d17f902 100644
+--- a/image-sixel.c
++++ b/image-sixel.c
+@@ -489,6 +489,9 @@ sixel_print(struct sixel_image *si, struct sixel_image *map, size_t *size)
+ 		colours = si->colours;
+ 		ncolours = si->ncolours;
+ 	}
++
++	if (ncolours == 0)
++		return (NULL);
+ 	contains = xcalloc(1, ncolours);
+ 
+ 	len = 8192;
+diff --git a/input.c b/input.c
+index eb421b280e..e6016121ff 100644
+--- a/input.c
++++ b/input.c
+@@ -1839,7 +1839,7 @@ input_csi_dispatch_sm_private(struct input_ctx *ictx)
+ 
+ /* Handle CSI graphics SM. */
+ static void
+-input_csi_dispatch_sm_graphics(struct input_ctx *ictx)
++input_csi_dispatch_sm_graphics(__unused struct input_ctx *ictx)
+ {
+ #ifdef ENABLE_SIXEL
+ 	int	n, m, o;
+diff --git a/screen-write.c b/screen-write.c
+index 6892d04149..a732f093dc 100644
+--- a/screen-write.c
++++ b/screen-write.c
+@@ -2283,6 +2283,10 @@ screen_write_sixelimage(struct screen_write_ctx *ctx, struct sixel_image *si,
+ 		new = sixel_scale(si, 0, 0, 0, y - sy, sx, sy, 1);
+ 		sixel_free(si);
+ 		si = new;
++
++		/* Bail out if the image cannot be scaled. */
++		if (si == NULL)
++			return;
+ 		sixel_size_in_cells(si, &x, &y);
+ 	}
+ 
+diff --git a/screen.c b/screen.c
+index f73a850547..0eaf469886 100644
+--- a/screen.c
++++ b/screen.c
+@@ -308,12 +308,12 @@ screen_resize_cursor(struct screen *s, u_int sx, u_int sy, int reflow,
+ 	if (sy != screen_size_y(s))
+ 		screen_resize_y(s, sy, eat_empty, &cy);
+ 
+-	if (reflow) {
+ #ifdef ENABLE_SIXEL
+-		image_free_all(s);
++	image_free_all(s);
+ #endif
++
++	if (reflow)
+ 		screen_reflow(s, sx, &cx, &cy, cursor);
+-	}
+ 
+ 	if (cy >= s->grid->hsize) {
+ 		s->cx = cx;
diff --git a/debian/patches/upstream-bd29a48b56.diff b/debian/patches/upstream-bd29a48b56.diff
index 49f34be..3386da0 100644
--- a/debian/patches/upstream-bd29a48b56.diff
+++ b/debian/patches/upstream-bd29a48b56.diff
@@ -4,6 +4,8 @@ Date:   Wed Mar 6 21:32:39 2024 +0000
 
     Check for the right flag to fix split-window -p, from Bryan Childs.
 
+Origin: upstream, https://github.com/tmux/tmux/commit/bd29a48b56ae649d425fd6939d60f75d79d767da
+
 diff --git a/cmd-split-window.c b/cmd-split-window.c
 index 18df715ef0..82ff22aff0 100644
 --- a/cmd-split-window.c
diff --git a/debian/rules b/debian/rules
index 6a14e40..3274d2b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -10,7 +10,7 @@ endif
 	dh $@
 
 override_dh_auto_configure:
-	dh_auto_configure -- --enable-utempter $(enable_systemd)
+	dh_auto_configure -- --enable-utempter $(enable_systemd) --enable-sixel
 
 execute_after_dh_auto_install:
 	install -D -m 644 debian/shells \
diff --git a/debian/tmux.lintian-overrides b/debian/tmux.lintian-overrides
index 214e73f..76d2ec4 100644
--- a/debian/tmux.lintian-overrides
+++ b/debian/tmux.lintian-overrides
@@ -1 +1 @@
-tmux: groff-message troff:<standard input>:1032: warning: macro 'Tg' not defined [usr/share/man/man1/tmux.1.gz:1]
+groff-message