refs.c: off-by-one fix.

Signed-off-by: Junio C Hamano <junkio@cox.net>

1 files changed, 5 insertions, 2 deletions

diff --git a/refs.c b/refs.c
index b8fcb98dad..69858e48cb 100644
--- a/refs.c
+++ b/refs.c
@@ -346,8 +346,11 @@ int check_ref_format(const char *ref)
 			if (level < 2)
 				return -1; /* at least of form "heads/blah" */
 
-			/* do not allow ref name to end in "HEAD" */
-			if (cp - ref > 4 && !strcmp(cp - 4, "HEAD"))
+			/* Do not allow ref name to end in "HEAD"
+			 * Note that cp is poiting at one past NUL at the end.
+			 * i.e. cp[-1] = NUL.
+			 */
+			if (5 <= cp - ref && !strcmp(cp - 5, "HEAD"))
 				return -1;
 
 			return 0;