From 8e576b4d10adc87ad55fd926278aaf5ad827831d Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Tue, 19 May 2026 08:31:11 +0000
Subject: [PATCH] tmux: fix NULL deref in control_write on uninitialized
 control client

Assisted-by: Claude Opus 4.7
---
 pkgs/by-name/tm/tmux/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/tm/tmux/package.nix b/pkgs/by-name/tm/tmux/package.nix
index b5efd8d2c9b0..edc21ddf934f 100644
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   bison,
   libevent,
@@ -36,6 +37,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VwOyR9YYhA/uyVRJbspNrKkJWJGYFFktwPnnwnIJ97s=";
   };
 
+  patches = [
+    # Fix NULL pointer dereference in control_write() when a control-mode
+    # client is notified before control_state has been allocated.
+    # https://github.com/tmux/tmux/issues/4980
+    (fetchpatch {
+      name = "tmux-control-notify-uninitialized.patch";
+      url = "https://github.com/tmux/tmux/commit/e5a2a25fafb8ee107c230d8acad694f6b635f8bb.patch";
+      hash = "sha256-UPbhMNnH1WJwTH/LVwjVonTqvNhyuniUrYm7iLVkCfg=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook