===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/tmux/cmd.c,v
retrieving revision 1.126
retrieving revision 1.127
diff -u -r1.126 -r1.127
--- src/usr.bin/tmux/cmd.c	2016/10/16 19:04:05	1.126
+++ src/usr.bin/tmux/cmd.c	2016/10/21 13:51:59	1.127
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd.c,v 1.126 2016/10/16 19:04:05 nicm Exp $ */
+/* $OpenBSD: cmd.c,v 1.127 2016/10/21 13:51:59 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -653,8 +653,8 @@
 cmd_template_replace(const char *template, const char *s, int idx)
 {
 	char		 ch, *buf;
-	const char	*ptr;
-	int		 replaced;
+	const char	*ptr, *cp;
+	int		 replaced, quoted;
 	size_t		 len;
 
 	if (strchr(template, '%') == NULL)
@@ -676,9 +676,17 @@
 			}
 			ptr++;
 
-			len += strlen(s);
-			buf = xrealloc(buf, len + 1);
-			strlcat(buf, s, len + 1);
+			quoted = (*ptr == '%');
+			if (quoted)
+				ptr++;
+
+			buf = xrealloc(buf, len + (strlen(s) * 2) + 1);
+			for (cp = s; *cp != '\0'; cp++) {
+				if (quoted && *cp == '"')
+					buf[len++] = '\\';
+				buf[len++] = *cp;
+			}
+			buf[len] = '\0';
 			continue;
 		}
 		buf = xrealloc(buf, len + 2);