From c374aa19a791ef96dd173cc5748660601e39cf99 Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Sat, 4 Apr 2026 11:32:05 +0000
Subject: [PATCH] Do not read off end of buffer if it ends in \ when expanding
 \c, found by ossfuzz.

---
 usr.bin/tmux/regsub.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/usr.bin/tmux/regsub.c b/usr.bin/tmux/regsub.c
index 3c9beb71cc3..d31d5042322 100644
--- a/usr.bin/tmux/regsub.c
+++ b/usr.bin/tmux/regsub.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: regsub.c,v 1.7 2026/04/02 08:45:35 nicm Exp $ */
+/* $OpenBSD: regsub.c,v 1.8 2026/04/04 11:32:05 nicm Exp $ */
 
 /*
  * Copyright (c) 2019 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -41,7 +41,7 @@ regsub_expand(char **buf, ssize_t *len, const char *with, const char *text,
 	u_int		 i;
 
 	for (cp = with; *cp != '\0'; cp++) {
-		if (*cp == '\\') {
+		if (cp[0] == '\\' && cp[1] != '\0') {
 			cp++;
 			if (*cp >= '0' && *cp <= '9') {
 				i = *cp - '0';