From 3034a71488ce5a76105b5777848dd8578a7aa376 Mon Sep 17 00:00:00 2001
From: deraadt <deraadt>
Date: Sun, 25 Oct 2015 07:48:16 +0000
Subject: [PATCH 1/2] Let's see if anyone screams about not being able to
 specify $TMPDIR for their tmux sockets.

(Over the years, I have seen $TMPDIR set up worse than /tmp many times,
and don't know how this practice infected other parts of the system.
Nothing uses tmpdir(3), nor a huge-temporary-file program like sort.)
ok nicm
---
 tmux.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tmux.c b/tmux.c
index b2530285..8b3d0bfe 100644
--- a/tmux.c
+++ b/tmux.c
@@ -128,8 +128,6 @@ makesocketpath(const char *label)
 	uid = getuid();
 	if ((s = getenv("TMUX_TMPDIR")) != NULL && *s != '\0')
 		xsnprintf(base, sizeof base, "%s/tmux-%u", s, uid);
-	else if ((s = getenv("TMPDIR")) != NULL && *s != '\0')
-		xsnprintf(base, sizeof base, "%s/tmux-%u", s, uid);
 	else
 		xsnprintf(base, sizeof base, "%s/tmux-%u", _PATH_TMP, uid);
 

From 3faa51a0caebb56746988ae7f5e9e9f649dc42b6 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Sun, 25 Oct 2015 08:59:26 +0000
Subject: [PATCH 2/2] Pass output from jobs through format_expand() so they are
 expanded again (this was the previous behaviour).

---
 format.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/format.c b/format.c
index 1d80fbf7..f5f036c2 100644
--- a/format.c
+++ b/format.c
@@ -39,7 +39,7 @@ struct format_entry;
 typedef void (*format_cb)(struct format_tree *, struct format_entry *);
 
 void	 format_job_callback(struct job *);
-const char *format_job_get(struct format_tree *, const char *);
+char	*format_job_get(struct format_tree *, const char *);
 void	 format_job_timer(int, short, void *);
 
 void	 format_cb_host(struct format_tree *, struct format_entry *);
@@ -212,7 +212,7 @@ format_job_callback(struct job *job)
 }
 
 /* Find a job. */
-const char *
+char *
 format_job_get(struct format_tree *ft, const char *cmd)
 {
 	struct format_job	fj0, *fj;
@@ -242,7 +242,7 @@ format_job_get(struct format_tree *ft, const char *cmd)
 	if (ft->flags & FORMAT_STATUS)
 		fj->status = 1;
 
-	return (fj->out);
+	return (format_expand(ft, fj->out));
 }
 
 /* Remove old jobs. */
@@ -709,9 +709,9 @@ format_expand_time(struct format_tree *ft, const char *fmt, time_t t)
 char *
 format_expand(struct format_tree *ft, const char *fmt)
 {
-	char		*buf, *tmp, *cmd;
+	char		*buf, *tmp, *cmd, *out;
 	const char	*ptr, *s, *saved = fmt;
-	size_t		 off, len, n, slen;
+	size_t		 off, len, n, outlen;
 	int     	 ch, brackets;
 
 	if (fmt == NULL)
@@ -751,18 +751,20 @@ format_expand(struct format_tree *ft, const char *fmt)
 			tmp[n] = '\0';
 			cmd = format_expand(ft, tmp);
 
-			s = format_job_get(ft, cmd);
-			slen = strlen(s);
+			out = format_job_get(ft, cmd);
+			outlen = strlen(out);
 
 			free(cmd);
 			free(tmp);
 
-			while (len - off < slen + 1) {
+			while (len - off < outlen + 1) {
 				buf = xreallocarray(buf, 2, len);
 				len *= 2;
 			}
-			memcpy(buf + off, s, slen);
-			off += slen;
+			memcpy(buf + off, out, outlen);
+			off += outlen;
+
+			free(out);
 
 			fmt += n + 1;
 			continue;