[PATCH] resolve_gitlink_ref_recursive(): verify format of symbolic refs

From: Michael Haggerty <mhagger@alum.mit.edu>
Date: Jun 27, 2014, 11:01 UTC
Message-ID: <1403866877-15733-1-git-send-email-mhagger@alum.mit.edu>

When reading a symbolic ref via resolve_gitlink_ref_recursive(), check that the reference name that is pointed at is formatted correctly, using the same check as resolve_ref_unsafe() uses for non-gitlink references. This prevents bogosity like

    ref: ../../other/file

from causing problems.

Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
---
Given that symbolic references cannot be transferred via the Git
protocol, I do not expect this bug to be exploitable.

 refs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/refs.c b/refs.c
index dc45774..7da8e7d 100644
--- a/refs.c
+++ b/refs.c
@@ -1273,6 +1273,9 @@ static int resolve_gitlink_ref_recursive(struct ref_cache *refs,
 	while (isspace(*p))
 		p++;
 
+	if (check_refname_format(p, REFNAME_ALLOW_ONELEVEL))
+		return -1;
+
 	return resolve_gitlink_ref_recursive(refs, p, sha1, recursion+1);
 }

-- 
2.0.0