From 9fc228dccad395a7ca74b34cf6d16e87669bbb58 Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Mon, 23 Feb 2026 08:45:27 +0000
Subject: [PATCH] Fix memory leaks, reported by Huihui Huang in GitHub issue
 4872.

---
 usr.bin/tmux/cmd-display-menu.c | 46 ++++++++++++++++++---------------
 usr.bin/tmux/environ.c          |  5 +++-
 2 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/usr.bin/tmux/cmd-display-menu.c b/usr.bin/tmux/cmd-display-menu.c
index c1f58bb5064..661aca7c589 100644
--- a/usr.bin/tmux/cmd-display-menu.c
+++ b/usr.bin/tmux/cmd-display-menu.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd-display-menu.c,v 1.47 2025/11/12 13:47:51 nicm Exp $ */
+/* $OpenBSD: cmd-display-menu.c,v 1.48 2026/02/23 08:45:27 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -394,7 +394,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 	const char		*style = args_get(args, 's');
 	const char		*border_style = args_get(args, 'S');
 	char			*cwd = NULL, *cause = NULL, **argv = NULL;
-	char			*title;
+	char			*title = NULL;
 	int			 modify = popup_present(tc);
 	int			 flags = -1, argc = 0;
 	enum box_lines		 lines = BOX_LINES_DEFAULT;
@@ -418,8 +418,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 			    &cause);
 			if (cause != NULL) {
 				cmdq_error(item, "height %s", cause);
-				free(cause);
-				return (CMD_RETURN_ERROR);
+				goto fail;
 			}
 		}
 
@@ -429,8 +428,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 			    &cause);
 			if (cause != NULL) {
 				cmdq_error(item, "width %s", cause);
-				free(cause);
-				return (CMD_RETURN_ERROR);
+				goto fail;
 			}
 		}
 
@@ -439,7 +437,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 		if (h > tty->sy)
 			h = tty->sy;
 		if (!cmd_display_menu_get_pos(tc, item, args, &px, &py, w, h))
-			return (CMD_RETURN_NORMAL);
+			goto out;
 
 		value = args_get(args, 'd');
 		if (value != NULL)
@@ -479,8 +477,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 		    &cause);
 		if (cause != NULL) {
 			cmdq_error(item, "popup-border-lines %s", cause);
-			free(cause);
-			return (CMD_RETURN_ERROR);
+			goto fail;
 		}
 	}
 
@@ -508,22 +505,29 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 
 	if (modify) {
 		popup_modify(tc, title, style, border_style, lines, flags);
-		free(title);
-		return (CMD_RETURN_NORMAL);
+		goto out;
 	}
 	if (popup_display(flags, lines, item, px, py, w, h, env, shellcmd, argc,
-	    argv, cwd, title, tc, s, style, border_style, NULL, NULL) != 0) {
-		cmd_free_argv(argc, argv);
-		if (env != NULL)
-			environ_free(env);
-		free(cwd);
-		free(title);
-		return (CMD_RETURN_NORMAL);
-	}
-	if (env != NULL)
-		environ_free(env);
+	    argv, cwd, title, tc, s, style, border_style, NULL, NULL) != 0)
+		goto out;
+	environ_free(env);
 	free(cwd);
 	free(title);
 	cmd_free_argv(argc, argv);
 	return (CMD_RETURN_WAIT);
+
+out:
+	cmd_free_argv(argc, argv);
+	environ_free(env);
+	free(cwd);
+	free(title);
+	return (CMD_RETURN_NORMAL);
+
+fail:
+	free(cause);
+	cmd_free_argv(argc, argv);
+	environ_free(env);
+	free(cwd);
+	free(title);
+	return (CMD_RETURN_ERROR);
 }
diff --git a/usr.bin/tmux/environ.c b/usr.bin/tmux/environ.c
index bd6d68fddf0..b9ee1297a64 100644
--- a/usr.bin/tmux/environ.c
+++ b/usr.bin/tmux/environ.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: environ.c,v 1.29 2025/11/28 09:42:48 nicm Exp $ */
+/* $OpenBSD: environ.c,v 1.30 2026/02/23 08:45:27 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -57,6 +57,9 @@ environ_free(struct environ *env)
 {
 	struct environ_entry	*envent, *envent1;
 
+	if (env == NULL)
+		return;
+
 	RB_FOREACH_SAFE(envent, environ, env, envent1) {
 		RB_REMOVE(environ, env, envent);
 		free(envent->name);