1 file changed, 57 insertions, 0 deletions
diff --git a/tests/t0200-security.sh b/tests/t0200-security.sh
index df60174..9238262 100755
--- a/tests/t0200-security.sh
+++ b/tests/t0200-security.sh
@@ -172,6 +172,63 @@ test_expect_success 'a message-less commit renders without crashing' '
 	grep "no commit message" tmp
 '
 
+# --- A branch need not point at a commit ------------------------------------
+# struct refinfo keeps taginfo and commitinfo in a union and fills only the one
+# matching the object type. Sorting branches by reading the commit member read
+# past the end of the smaller taginfo, and read NULL for a tree, which crashed.
+# git update-ref refuses to write these, so the refs go in as loose files: a
+# repository is just files on disk and cgit reads whatever is there.
+test_expect_success 'set up a repo whose branches point at odd objects' '
+	mkrepo repos/oddref 2 &&
+	(
+		cd repos/oddref &&
+		git tag -a annotated -m note &&
+		git rev-parse annotated >.git/refs/heads/points-at-tag &&
+		git rev-parse HEAD^{tree} >.git/refs/heads/points-at-tree &&
+		git for-each-ref refs/heads/ >refs.out &&
+		grep -q "tree.refs/heads/points-at-tree" refs.out &&
+		grep -q "tag.refs/heads/points-at-tag" refs.out
+	) &&
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "branch-sort=age" &&
+		echo "repo.url=oddref" &&
+		echo "repo.path=$PWD/repos/oddref/.git"
+	} >oddrefrc
+'
+
+test_expect_success 'refs page sorts such branches without crashing' '
+	CGIT_CONFIG="$PWD/oddrefrc" QUERY_STRING="url=oddref/refs/" cgit >tmp &&
+	grep "points-at-tree" tmp &&
+	grep "</html>" tmp
+'
+
+test_expect_success 'the branch page sorts them without crashing' '
+	CGIT_CONFIG="$PWD/oddrefrc" QUERY_STRING="url=oddref/refs/heads/" cgit >tmp &&
+	grep "points-at-tree" tmp &&
+	grep "</html>" tmp
+'
+
+test_expect_success 'the summary page sorts them without crashing' '
+	CGIT_CONFIG="$PWD/oddrefrc" QUERY_STRING="url=oddref/" cgit >tmp &&
+	grep "points-at-tree" tmp &&
+	grep "</html>" tmp
+'
+
+test_expect_success 'name-sorted branches are unaffected' '
+	{
+		echo "virtual-root=/" &&
+		echo "cache-size=0" &&
+		echo "branch-sort=name" &&
+		echo "repo.url=oddref" &&
+		echo "repo.path=$PWD/repos/oddref/.git"
+	} >oddrefnamerc &&
+	CGIT_CONFIG="$PWD/oddrefnamerc" QUERY_STRING="url=oddref/refs/heads/" cgit >tmp &&
+	grep "points-at-tree" tmp &&
+	grep "</html>" tmp
+'
+
 # --- A repository cannot supply a printf format string ----------------------
 # module-link is a template, and scan-path lets a repository set it through its
 # own cgitrc. Handing it to printf let a repo owner crash the process, or read