receive-pack: crash when checking with non-exist HEAD

jiangxin · gitster · commit b112b14d7869 · 2015-07-22T14:18:22.000-07:00
If HEAD of a repository points to a conflict reference, such as:

* There exist a reference named 'refs/heads/jx/feature1', but HEAD
  points to 'refs/heads/jx', or

* There exist a reference named 'refs/heads/feature', but HEAD points
  to 'refs/heads/feature/bad'.

When we push to delete a reference for this repo, such as:

        git push /path/to/bad-head-repo.git :some/good/reference

The git-receive-pack process will crash.

This is because if HEAD points to a conflict reference, the function
`resolve_refdup("HEAD", ...)` does not return a valid reference name,
but a null buffer.  Later matching the delete reference against the null
buffer will cause git-receive-pack crash.

Signed-off-by: Jiang Xin &lt;worldhello.net@gmail.com&gt;
Signed-off-by: Junio C Hamano &lt;gitster@pobox.com&gt;
diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
@@ -514,7 +514,7 @@ static const char *update(struct command *cmd, struct shallow_info *si)
 			return "deletion prohibited";
 		}
 
-		if (!strcmp(namespaced_name, head_name)) {
+		if (head_name && !strcmp(namespaced_name, head_name)) {
 			switch (deny_delete_current) {
 			case DENY_IGNORE:
 				break;

Original file line number	Diff line number	Diff line change
`@@ -514,7 +514,7 @@ static const char update(struct command cmd, struct shallow_info *si)`
`514`	`514`	`return "deletion prohibited";`
`515`	`515`	`}`
`516`	`516`
`517`		`- if (!strcmp(namespaced_name, head_name)) {`
	`517`	`+ if (head_name && !strcmp(namespaced_name, head_name)) {`
`518`	`518`	`switch (deny_delete_current) {`
`519`	`519`	`case DENY_IGNORE:`
`520`	`520`	`break;`