From 997c1daf1dce036cd52ba2a4a3d4060b74dd9d54 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Tue, 25 Aug 2026 20:03:47 +0200 Subject: [PATCH] worktree add: don't read out of bounds in worktree_basename() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When we search for the start of the basename and `len` is zero, `name` ends up being `path` - 1, out of bounds. Avoid that by checking before decrementing. Fixes https://github.com/git-for-windows/git/issues/6346. Original-patch-by: Matthias Aßhauer Signed-off-by: René Scharfe Signed-off-by: Junio C Hamano --- builtin/worktree.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/builtin/worktree.c b/builtin/worktree.c index d21c43fde3..1d827c4eae 100644 --- a/builtin/worktree.c +++ b/builtin/worktree.c @@ -303,11 +303,9 @@ static const char *worktree_basename(const char *path, int *olen) while (len && is_dir_sep(path[len - 1])) len--; - for (name = path + len - 1; name > path; name--) - if (is_dir_sep(*name)) { - name++; - break; - } + name = path + len; + while (name > path && !is_dir_sep(name[-1])) + name--; *olen = len; return name;