• Jeff King's avatar
    worktree: handle broken symrefs in find_shared_symref() · dbd2b55c
    Jeff King authored
    The refs_resolve_ref_unsafe() function may return NULL even
    with a REF_ISSYMREF flag if a symref points to a broken ref.
    As a result, it's possible for find_shared_symref() to
    segfault when it passes NULL to strcmp().
    
    This is hard to trigger for most code paths. We typically
    pass HEAD to the function as the symref to resolve, and
    programs like "git branch" will bail much earlier if HEAD
    isn't valid.
    
    I did manage to trigger it through one very obscure
    sequence:
    
      # You have multiple notes refs which conflict.
      git notes add -m base
      git notes --ref refs/notes/foo add -m foo
    
      # There's left-over cruft in NOTES_MERGE_REF that
      # makes it a broken symref (in this case we point
      # to a syntactically invalid ref).
      echo "ref: refs/heads/master.lock" >.git/NOTES_MERGE_REF
    
      # You try to merge the notes. We read the broken value in
      # order to complain that another notes-merge is
      # in-progress, but we segfault in find_shared_symref().
      git notes merge refs/notes/foo
    
    This is obviously silly and almost certainly impossible to
    trigger accidentally, but it does show that the bug is
    triggerable from at least one code path. In addition, it
    would trigger if we saw a transient filesystem error when
    resolving the pointed-to ref.
    
    We can fix this by treating NULL the same as a non-matching
    symref. Arguably we'd prefer to know if a symref points to
    "refs/heads/foo", but "refs/heads/foo" is broken. But
    refs_resolve_ref_unsafe() isn't capable of giving us that
    information, so this is the best we can do.
    Signed-off-by: 's avatarJeff King <peff@peff.net>
    Signed-off-by: 's avatarJunio C Hamano <gitster@pobox.com>
    dbd2b55c
worktree.c 9.14 KB