From: Matthias Aßhauer via GitGitGadget Date: Sat, 25 Jul 2026 11:19:05 GMT Subject: [PATCH 0/2] worktree: Fix out of bounds read that causes data loss and reject invalid empty input in worktree add Message-ID: Passing an empty string to git worktree add (typically via an unset variable, e.g. git worktree add "$UNSET_VAR" -b tb origin/main) can result in BUG: How come '' becomes empty after sanitization? but it can also have worse consequences: recursively deleting the current working directory, including .git. The inconsistent behaviour is caused by worktree_basename reading unrelated bytes from the memory before path and passing that back to add_worktree, which can circumvent the check for the BUG call. Matthias Aßhauer (2): worktree: don't read out of bounds worktree: reject empty string builtin/worktree.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) base-commit: 9a0c4701dcd5725c4184599322b52933ff5005ca Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2187%2Frimrul%2Fworktree-fix-oob-v1 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2187/rimrul/worktree-fix-oob-v1 Pull-Request: https://github.com/gitgitgadget/git/pull/2187 -- gitgitgadget