[PATCH 1/2] worktree: don't read out of bounds

From: Matthias Aßhauer via GitGitGadget <gitgitgadget@gmail.com>
Date: Jul 25, 2026, 11:19 UTC
Message-ID: <8bc69c6b80ed42888327331b1567cecf7225ea7e.1784978348.git.gitgitgadget@gmail.com>
In-Reply-To: <pull.2187.git.1784978348.gitgitgadget@gmail.com>

From: =?UTF-8?q?Matthias=20A=C3=9Fhauer?= <mha1993@live.de>

`worktree_basename` tries to read from memory before the passed `path` string, if `path` is empty (or only consists of directory separators). That results in unexpected nonsense data being returned to the caller, which can lead to issues, such as `git worktree add ""` recursively deleting the current working directory, including `.git`.

Stop reading out of bounds in these cases to avoid that behaviour.

This leads to `git worktree add ""` consistently exiting with the message `BUG: How come '' becomes empty after sanitization?`, which is still undesirable, but at least it doesn't result in data loss anymore.

This fixes https://github.com/git-for-windows/git/issues/6346

Signed-off-by: Matthias Aßhauer <mha1993@live.de>
---
 builtin/worktree.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/builtin/worktree.c b/builtin/worktree.c
index 4bc7b4f6e7..d8188035db 100644
--- a/builtin/worktree.c
+++ b/builtin/worktree.c
@@ -297,17 +297,21 @@ static void remove_junk_on_signal(int signo)
 static const char *worktree_basename(const char *path, int *olen)
 {
 	const char *name;
-	int len;
+	int len, len2;
 
-	len = strlen(path);
+	len2 = len = strlen(path);
 	while (len && is_dir_sep(path[len - 1]))
 		len--;
 
-	for (name = path + len - 1; name > path; name--)
-		if (is_dir_sep(*name)) {
-			name++;
-			break;
-		}
+	if(len) {
+		for (name = path + len - 1; name > path; name--)
+			if (is_dir_sep(*name)) {
+				name++;
+				break;
+			}
+	}
+	else
+		name = path + len2;
 
 	*olen = len;
 	return name;

-- 
gitgitgadget