===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/tmux/format.c,v
retrieving revision 1.30
retrieving revision 1.31
diff -c -r1.30 -r1.31
*** src/usr.bin/tmux/format.c	2013/10/10 11:50:20	1.30
--- src/usr.bin/tmux/format.c	2013/10/10 11:50:36	1.31
***************
*** 1,4 ****
! /* $OpenBSD: format.c,v 1.30 2013/10/10 11:50:20 nicm Exp $ */
  
  /*
   * Copyright (c) 2011 Nicholas Marriott <nicm@users.sourceforge.net>
--- 1,4 ----
! /* $OpenBSD: format.c,v 1.31 2013/10/10 11:50:36 nicm Exp $ */
  
  /*
   * Copyright (c) 2011 Nicholas Marriott <nicm@users.sourceforge.net>
***************
*** 193,199 ****
  format_replace(struct format_tree *ft, const char *key, size_t keylen,
      char **buf, size_t *len, size_t *off)
  {
! 	char		*copy, *copy0, *endptr, *ptr;
  	const char	*value;
  	size_t		 valuelen;
  	u_long		 limit = ULONG_MAX;
--- 193,199 ----
  format_replace(struct format_tree *ft, const char *key, size_t keylen,
      char **buf, size_t *len, size_t *off)
  {
! 	char		*copy, *copy0, *endptr, *ptr, *saved;
  	const char	*value;
  	size_t		 valuelen;
  	u_long		 limit = ULONG_MAX;
***************
*** 247,256 ****
--- 247,259 ----
  				goto fail;
  			value = ptr + 1;
  		}
+ 		saved = format_expand(ft, value);
+ 		value = saved;
  	} else {
  		value = format_find(ft, copy);
  		if (value == NULL)
  			value = "";
+ 		saved = NULL;
  	}
  	valuelen = strlen(value);
  
***************
*** 266,271 ****
--- 269,275 ----
  	memcpy(*buf + *off, value, valuelen);
  	*off += valuelen;
  
+ 	free(saved);
  	free(copy0);
  	return (0);
  
***************
*** 278,287 ****
  char *
  format_expand(struct format_tree *ft, const char *fmt)
  {
! 	char		*buf, *ptr;
! 	const char	*s;
  	size_t		 off, len, n;
! 	int     	 ch;
  
  	len = 64;
  	buf = xmalloc(len);
--- 282,291 ----
  char *
  format_expand(struct format_tree *ft, const char *fmt)
  {
! 	char		*buf;
! 	const char	*ptr, *s;
  	size_t		 off, len, n;
! 	int     	 ch, brackets;
  
  	len = 64;
  	buf = xmalloc(len);
***************
*** 299,309 ****
  		fmt++;
  
  		ch = (u_char) *fmt++;
- 
  		switch (ch) {
  		case '{':
! 			ptr = strchr(fmt, '}');
! 			if (ptr == NULL)
  				break;
  			n = ptr - fmt;
  
--- 303,318 ----
  		fmt++;
  
  		ch = (u_char) *fmt++;
  		switch (ch) {
  		case '{':
! 			brackets = 1;
! 			for (ptr = fmt; *ptr != '\0'; ptr++) {
! 				if (*ptr == '{')
! 					brackets++;
! 				if (*ptr == '}' && --brackets == 0)
! 					break;
! 			}
! 			if (*ptr != '}' || brackets != 0)
  				break;
  			n = ptr - fmt;