[PATCH] serve: reject valueless promisor-remote capability
From: Elijah Newren via GitGitGadget <hidden>
Date: 2026-08-12 06:39:46
Subsystem:
the rest · Maintainer:
Linus Torvalds
From: Elijah Newren <redacted>
d460267613da (Add 'promisor-remote' capability to protocol v2,
2025-02-18) added a receive callback which passes the capability value
directly to mark_promisor_remotes_as_accepted(). However, a client can
send the capability name without an '=' or value, in which case
get_capability() supplies NULL and strbuf_split_str() dereferences it.
Reject the missing argument before parsing it, and add a test covering
this case.
Signed-off-by: Elijah Newren <redacted>
---
serve: reject valueless promisor-remote capability
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2199%2Fnewren%2Fpromisor-remote-require-argument-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2199/newren/promisor-remote-require-argument-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/2199
serve.c | 3 +++
t/t5701-git-serve.sh | 11 +++++++++++
2 files changed, 14 insertions(+)
diff --git a/serve.c b/serve.c
index 2b07d922b3..5a64344467 100644
--- a/serve.c
+++ b/serve.c@@ -46,6 +46,9 @@ static int promisor_remote_advertise(struct repository *r, static void promisor_remote_receive(struct repository *r, const char *remotes) { + if (!remotes) + die("promisor-remote capability requires an argument"); + mark_promisor_remotes_as_accepted(r, remotes); }
diff --git a/t/t5701-git-serve.sh b/t/t5701-git-serve.sh
index 9a575aa098..d888cc5c3c 100755
--- a/t/t5701-git-serve.sh
+++ b/t/t5701-git-serve.sh@@ -71,6 +71,17 @@ test_expect_success 'request invalid capability' ' test_grep "unknown capability" err ' +test_expect_success 'promisor-remote capability requires an argument' ' + test-tool pkt-line pack >in <<-EOF && + command=ls-refs + object-format=$(test_oid algo) + promisor-remote + 0000 + EOF + test_must_fail test-tool serve-v2 --stateless-rpc 2>err <in && + test_grep "promisor-remote capability requires an argument" err +' + test_expect_success 'request with no command' ' test-tool pkt-line pack >in <<-EOF && agent=git/test
base-commit: 2c78326f810173a4f3aefd8021f1e07575412481 -- gitgitgadget