refs: No component of a refname can end with '.lock'

src/refs.c

@@ -1599,6 +1599,7 @@ static int ensure_segment_validity(const char *name)
 {
 	const char *current = name;
 	char prev = '\0';
+	int lock_len = strlen(GIT_FILELOCK_EXTENSION);
 
 	if (*current == '.')
 		return -1; /* Refname starts with "." */
@@ -1619,6 +1620,11 @@ static int ensure_segment_validity(const char *name)
 		prev = *current;
 	}
 
+	/* A refname component can not end with ".lock" */
+	if (current - name >= lock_len &&
+		!git__strncmp(current - lock_len, GIT_FILELOCK_EXTENSION, lock_len))
+			return -1;
+
 	return (int)(current - name);
 }
 
@@ -1714,10 +1720,6 @@ int git_reference__normalize_name(
 	if (current[segment_len - 1] == '/')
 		goto cleanup;
 
-	/* A refname can not end with ".lock" */
-	if (!git__suffixcmp(name, GIT_FILELOCK_EXTENSION))
-		goto cleanup;
-
 	if ((segments_count == 1 ) && !(flags & GIT_REF_FORMAT_ALLOW_ONELEVEL))
 		goto cleanup;
 

tests-clar/refs/isvalidname.c

@@ -13,6 +13,7 @@ void test_refs_isvalidname__can_detect_invalid_formats(void)
 	cl_assert_equal_i(false, git_reference_is_valid_name("/stupid/name/master"));
 	cl_assert_equal_i(false, git_reference_is_valid_name("/"));
 	cl_assert_equal_i(false, git_reference_is_valid_name(""));
+	cl_assert_equal_i(false, git_reference_is_valid_name("refs/heads/sub.lock/webmatrix"));
 }
 
 void test_refs_isvalidname__wont_hopefully_choke_on_valid_formats(void)