receive-pack: crash when checking with non-exist HEAD

If HEAD of a repository points to a conflict reference, such as:

* There exist a reference named 'refs/heads/jx/feature1', but HEAD
points to 'refs/heads/jx', or

* There exist a reference named 'refs/heads/feature', but HEAD points
to 'refs/heads/feature/bad'.

When we push to delete a reference for this repo, such as:

git push /path/to/bad-head-repo.git :some/good/reference

The git-receive-pack process will crash.

This is because if HEAD points to a conflict reference, the function
`resolve_refdup("HEAD", ...)` does not return a valid reference name,
but a null buffer.  Later matching the delete reference against the null
buffer will cause git-receive-pack crash.

Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index c3230817db4a7676eb74335b254f30597e66edd9..2380127c91db0ff0a6cb56995c03ea9bc0b52c77 100644 (file)
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -514,7 +514,7 @@ static const char *update(struct command *cmd, struct shallow_info *si)
                        return "deletion prohibited";
                }
 
                        return "deletion prohibited";
                }
 

-               if (!strcmp(namespaced_name, head_name)) {
+               if (head_name && !strcmp(namespaced_name, head_name)) {

                        switch (deny_delete_current) {
                        case DENY_IGNORE:
                                break;
                        switch (deny_delete_current) {
                        case DENY_IGNORE:
                                break;