diff --git a/CHANGELOG.md b/CHANGELOG.md
index 47cca36e..766d052a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Changelog
 
+* [Unreleased](#unreleased)
 * [1.4.1](#1-4-1)
 * [1.4.0](#1-4-0)
 * [1.3.0](#1-3-0)
@@ -9,6 +10,25 @@
 * [1.2.0](#1-2-0)
 
 
+## Unreleased
+### Added
+### Changed
+
+* Maximum window title length from 100 to 2048.
+
+
+### Deprecated
+### Removed
+### Fixed
+
+* Crash when overwriting a sixel and the row being overwritten did not
+  cover an entire cell.
+* Assertion failure in debug builds when overwriting a sixel image.
+
+
+### Security
+
+
 ## 1.4.1
 
 ### Fixed
diff --git a/render.c b/render.c
index b71325f6..80611d22 100644
--- a/render.c
+++ b/render.c
@@ -1660,8 +1660,7 @@ render_search_box(struct terminal *term)
 static void
 render_update_title(struct terminal *term)
 {
-    /* TODO: figure out what the limit actually is */
-    static const size_t max_len = 100;
+    static const size_t max_len = 2048;
 
     const char *title = term->window_title != NULL ? term->window_title : "foot";
     char *copy = NULL;
diff --git a/sixel.c b/sixel.c
index 7dab1fcc..ab9ad0e9 100644
--- a/sixel.c
+++ b/sixel.c
@@ -272,7 +272,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six,
                 (six->pos.row + rel_above) & (term->grid->num_rows - 1)},
         };
         imgs[2].data = malloc(imgs[2].width * imgs[2].height * sizeof(uint32_t));
-        for (size_t i = 0; i < term->cell_height; i++)
+        for (size_t i = 0; i < imgs[2].height; i++)
             memcpy(
                 &((uint32_t *)imgs[2].data)[i * imgs[2].width],
                 &((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width],
@@ -290,7 +290,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six,
                 (six->pos.row + rel_above) & (term->grid->num_rows - 1)},
         };
         imgs[3].data = malloc(imgs[3].width * imgs[3].height * sizeof(uint32_t));
-        for (size_t i = 0; i < term->cell_height; i++)
+        for (size_t i = 0; i < imgs[3].height; i++)
             memcpy(
                 &((uint32_t *)imgs[3].data)[i * imgs[3].width],
                 &((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width + rel_right * term->cell_width],
@@ -350,9 +350,11 @@ _sixel_overwrite_by_rectangle(
                 (col <= col_end && col + width - 1 >= col_end) ||
                 (col >= col_start && col + width - 1 <= col_end))
             {
-                sixel_overwrite(term, six, start, col, height, width);
-                sixel_erase(term, six);
+                struct sixel to_be_erased = *six;
                 tll_remove(term->grid->sixel_images, it);
+
+                sixel_overwrite(term, &to_be_erased, start, col, height, width);
+                sixel_erase(term, &to_be_erased);
             }
         }
     }
@@ -421,9 +423,11 @@ sixel_overwrite_by_row(struct terminal *term, int _row, int col, int width)
                 (col <= col_end && col + width - 1 >= col_end) ||
                 (col >= col_start && col + width - 1 <= col_end))
             {
-                sixel_overwrite(term, six, row, col, 1, width);
-                sixel_erase(term, six);
+                struct sixel to_be_erased = *six;
                 tll_remove(term->grid->sixel_images, it);
+
+                sixel_overwrite(term, &to_be_erased, row, col, 1, width);
+                sixel_erase(term, &to_be_erased);
             }
         }
     }