Re: [Crash] git-push $remote $non_ref:$anything

[Jeff King <peff@peff.net>]

[cc'ing Daniel for remote.c advice]

On Sun, Jun 15, 2008 at 09:38:23PM +0200, Mike Hommey wrote:

> I somehow managed to get a segfault by running this:
> 
> git push origin non-existant-branch-name:non-existant-branch-name

Hmm. The problem is the ref-guessing code. Given "git push foo:bar",
when we try to figure out what "bar" means we first try to find
refs/heads/bar or refs/heads/bar on the remote. But if that fails, we
are pushing a new item, so we try to use the same prefix as what "foo"
resolved to (e.g., if "foo" is a branch, we make it "refs/heads/bar").

So if "foo" doesn't resolve, we end up dereferencing NULL as part of our
guess. And the fix is obvious and the patch is below.

But it kind of makes me wonder why we bother looking at the dst side of
the refspec at all, since the src has already failed. Is there a good
reason not to just bail from match_explicit when we can't resolve the
src?

---
diff --git a/remote.c b/remote.c
index 91e3b11..fd8c71a 100644
--- a/remote.c
+++ b/remote.c
@@ -920,7 +920,8 @@ static int match_explicit(struct ref *src, struct ref *dst,
 	case 0:
 		if (!memcmp(dst_value, "refs/", 5))
 			matched_dst = make_linked_ref(dst_value, dst_tail);
-		else if((dst_guess = guess_ref(dst_value, matched_src)))
+		else if(matched_src &&
+			(dst_guess = guess_ref(dst_value, matched_src)))
 			matched_dst = make_linked_ref(dst_guess, dst_tail);
 		else
 			error("unable to push to unqualified destination: %s\n"