3.1c.

colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.

CHANGES

@@ -1,3 +1,7 @@
+CHANGED FROM 3.1b TO 3.1c
+
+* Fix a stack overflow on colon-separated CSI parsing.
+
 CHANGES FROM 3.1a TO 3.1b
 
 * Fix build on systems without sys/queue.h.

configure.ac

@@ -1,6 +1,6 @@
 # configure.ac
 
-AC_INIT([tmux], 3.1b)
+AC_INIT([tmux], 3.1c)
 AC_PREREQ([2.60])
 
 AC_CONFIG_AUX_DIR(etc)

input.c

@@ -1929,8 +1929,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);