[PATCH] receive-pack: crash when checking with non-exist HEAD

From: Jiang Xin <worldhello.net@gmail.com>
Date: Jul 22, 2015, 01:49 UTC
Message-ID: <CANYiYbE3Vy_gtFMKTMw1wHLDhU758nXaJnKaNy6WMNRz0fjUnw@mail.gmail.com>

If HEAD of a repository points to a conflict reference, such as:

* There exist a reference named 'refs/heads/jx/feature1', but HEAD
  points to 'refs/heads/jx', or

* There exist a reference named 'refs/heads/feature', but HEAD points
  to 'refs/heads/feature/bad'.

When we push to delete a reference for this repo, such as:

        git push /path/to/bad-head-repo.git :some/good/reference

The git-receive-pack process will crash.

This is because if HEAD points to a conflict reference, the function `resolve_refdup("HEAD", ...)` does not return a valid reference name, but a null buffer. Later matching the delete reference against the null buffer will cause git-receive-pack crash.

Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
---
I'm not sure this email is well-formed for git-am. Because gmail changed
it's auth policy, I can not use git send-email command line to send mail.
You may know, in our China, we can not visit google/gmail directly, I
must access the outside world use VPN!

 builtin/receive-pack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index 94d0571..04cb5a1 100644
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -911,7 +911,7 @@ static const char *update(struct command *cmd,
struct shallow_info *si)
      return "deletion prohibited";
    }

-   if (!strcmp(namespaced_name, head_name)) {
+   if (head_name && !strcmp(namespaced_name, head_name)) {
      switch (deny_delete_current) {
      case DENY_IGNORE:
        break;

-- 
2.5.0.rc2.34.gfbdeabf.dirty