@matheusbsbs / matheus-bagliano / commits / 1034ad383f

builtin/clone: fix segfault when using --revision with protocol v0

Servers supporting protocol v2 do not advertise excess refs and honor `transport_ls_refs_options.ref_prefixes` when $ git clone --revision=refs/heads/main $URL contacts them, but when talking to a server that does not support protocol v2 the client segfaults. This can also be observed when v0 is enforced for example by $ git -c protocol.version=0 clone --revision=refs/heads/main $URL In the protocol v2 case the server honors `transport_ls_refs_options.ref_prefixes` and in `cmd_clone()` the linked list `refs` returned by `transport_get_remote_refs()` only contains a single item, which is the ref requested with the --revision argument. Both `remote_head` returned by `find_ref_by_name()` and `remote_head_points_at` returned by `guess_remote_head()` are NULL. The guard in `update_remote_refs()` skips a the affected code because `remote_head_points_at` is NULL. In the protocol v0 case in `cmd_clone()` the linked list `refs` returned by `transport_get_remote_refs()` contains many items, amongst others "HEAD". `remote_head` returned by `find_ref_by_name()` is not NULL and `remote_head_points_at` returned by `guess_remote_head()` is not NULL but its field `peer_ref` is NULL. Because `remote_head_points_at` is not NULL the guard in `update_remote_refs()` does not skip the affected code and `remote_head_points_at->peer_ref->name` is accessed, which causes a segfault later on. Signed-off-by: Adrian Friedli <adrian.friedli@mt.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Adrian Friedli committed Jul 24, 2026 at 14:41 UTC 1034ad383f149bf59f4d78f792a049c94240c8a5

2 files changed +9 -1

builtin/clone.c

+1 -1

@@ -557,7 +557,7 @@ static void update_remote_refs(const struct ref *refs,

557 write_followtags(refs, msg);

558 }

559

560 - if (remote_head_points_at && !option_bare) {

560 + if (remote_head_points_at && remote_head_points_at->peer_ref && !option_bare) {

561 struct strbuf head_ref = STRBUF_INIT;

562 strbuf_addstr(&head_ref, branch_top);

563 strbuf_addstr(&head_ref, "HEAD");

t/t5621-clone-revision.sh

@@ -90,6 +90,14 @@ test_expect_success 'clone with --revision and --bare' '

90 test_must_fail git -C dst config remote.origin.fetch

91 '

93 +test_expect_success 'clone with --revision and protocol v0' '

94 + test_when_finished "rm -rf dst" &&

95 + git -c protocol.version=0 clone --no-local --revision=refs/heads/main . dst &&

96 + git rev-parse refs/heads/main >expect &&

97 + git -C dst rev-parse HEAD >actual &&

98 + test_cmp expect actual

99 +'

100 +

101 test_expect_success 'clone with --revision being a short raw commit hash' '

102 test_when_finished "rm -rf dst" &&

103 oid=$(git rev-parse --short refs/heads/feature) &&