Fix segfault in rev-parse with invalid input (#1581678)

0001-rev-parse-check-lookup-ed-commit-references-for-NULL.patch

@@ -0,0 +1,72 @@
+From b03b51f889272622a3859a3765f1e7d1175b2346 Mon Sep 17 00:00:00 2001
+From: Elijah Newren <newren@gmail.com>
+Date: Wed, 23 May 2018 23:27:33 -0700
+Subject: [PATCH] rev-parse: check lookup'ed commit references for NULL
+
+Commits 2122f8b963d4 ("rev-parse: Add support for the ^! and ^@ syntax",
+2008-07-26) and 3dd4e7320d ("Teach rev-parse the ... syntax.", 2006-07-04)
+taught rev-parse new syntax, and used lookup_commit_reference() as part of
+their logic.  Neither usage checked the returned commit to see if it was
+non-NULL before using it.  Check for NULL and ensure an appropriate error
+is reported to the user.
+
+Reported by Florian Weimer and Todd Zullinger.
+
+Helped-by: Jeff King <peff@peff.net>
+Signed-off-by: Elijah Newren <newren@gmail.com>
+Signed-off-by: Todd Zullinger <tmz@pobox.com>
+---
+ builtin/rev-parse.c          | 8 ++++++--
+ t/t6101-rev-parse-parents.sh | 8 ++++++++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/builtin/rev-parse.c b/builtin/rev-parse.c
+index 7f965fe74e..fd8e52c7b7 100644
+--- a/builtin/rev-parse.c
++++ b/builtin/rev-parse.c
+@@ -282,6 +282,10 @@ static int try_difference(const char *arg)
+ 			struct commit *a, *b;
+ 			a = lookup_commit_reference(&oid);
+ 			b = lookup_commit_reference(&end);
++			if (!a || !b) {
++				*dotdot = '.';
++				return 0;
++			}
+ 			exclude = get_merge_bases(a, b);
+ 			while (exclude) {
+ 				struct commit *commit = pop_commit(&exclude);
+@@ -328,12 +332,12 @@ static int try_parent_shorthands(const char *arg)
+ 		return 0;
+ 
+ 	*dotdot = 0;
+-	if (get_sha1_committish(arg, oid.hash)) {
++	if (get_sha1_committish(arg, oid.hash) ||
++	    !(commit = lookup_commit_reference(&oid))) {
+ 		*dotdot = '^';
+ 		return 0;
+ 	}
+ 
+-	commit = lookup_commit_reference(&oid);
+ 	if (exclude_parent &&
+ 	    exclude_parent > commit_list_count(commit->parents)) {
+ 		*dotdot = '^';
+diff --git a/t/t6101-rev-parse-parents.sh b/t/t6101-rev-parse-parents.sh
+index 8c617981a3..7683e4a114 100755
+--- a/t/t6101-rev-parse-parents.sh
++++ b/t/t6101-rev-parse-parents.sh
+@@ -214,4 +214,12 @@ test_expect_success 'rev-list merge^-1x (garbage after ^-1)' '
+ 	test_must_fail git rev-list merge^-1x
+ '
+ 
++test_expect_success 'rev-parse $garbage^@ does not segfault' '
++	test_must_fail git rev-parse $EMPTY_TREE^@
++'
++
++test_expect_success 'rev-parse $garbage...$garbage does not segfault' '
++	test_must_fail git rev-parse $EMPTY_TREE...$EMPTY_BLOB
++'
++
+ test_done
+-- 
+2.17.0
+

git.spec

@@ -83,6 +83,10 @@ Patch2:         0001-revision-quit-pruning-diff-more-quickly-when-possibl.patch
 # https://github.com/git/git/commit/7f6f75e97a
 Patch3:         0001-git-svn-control-destruction-order-to-avoid-segfault.patch
 
+# https://bugzilla.redhat.com/1581678
+# https://public-inbox.org/git/20180524062733.5412-1-newren@gmail.com/
+Patch4:         0001-rev-parse-check-lookup-ed-commit-references-for-NULL.patch
+
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %if ! 0%{?_without_docs}
@@ -355,6 +359,7 @@ rm -rf "$tar" "$gpghome" # Cleanup tar files and tmp gpg home dir
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
 
 # Remove git-archimport from command list
 sed -i '/^git-archimport/d' command-list.txt
@@ -749,6 +754,7 @@ rm -rf %{buildroot}
 
 %changelog
 * Thu May 24 2018 Todd Zullinger <tmz@pobox.com> - 2.14.3-4
+- Fix segfault in rev-parse with invalid input (#1581678)
 - Install contrib/diff-highlight (#1550251)
 
 * Fri Feb 16 2018 Todd Zullinger <tmz@pobox.com> - 2.14.3-3