Fix Remote::get_refspec() lifetime bounds and add regression tests

Cargo.toml

@@ -31,6 +31,7 @@ openssl-probe = { version = "0.1", optional = true }
 clap = { version = "4.4.13", features = ["derive"] }
 time = { version = "0.3.45", features = ["formatting"] }
 tempfile = "3.1.0"
+trybuild = "1.0.117"
 url = "2.5.4"
 
 [features]

src/remote.rs

@@ -298,7 +298,7 @@ impl<'repo> Remote<'repo> {
     /// Get the `nth` refspec from this remote.
     ///
     /// The `refspecs` iterator can be used to iterate over all refspecs.
-    pub fn get_refspec(&self, i: usize) -> Option<Refspec<'repo>> {
+    pub fn get_refspec(&self, i: usize) -> Option<Refspec<'_>> {
         unsafe {
             let ptr = raw::git_remote_get_refspec(&*self.raw, i as libc::size_t);
             Binding::from_raw_opt(ptr)

tests/compile_fail.rs

@@ -0,0 +1,7 @@
+//! Regression tests for things that should not compile but used to
+
+#[test]
+fn test_compile_fail() {
+    let t = trybuild::TestCases::new();
+    t.compile_fail("tests/compile_fail/remote_refspec.rs");
+}

tests/compile_fail/remote_refspec.rs

@@ -0,0 +1,23 @@
+// Regression tests for https://github.com/rust-lang/git2-rs/issues/1286
+
+#[forbid(unsafe_code)]
+
+use git2::Repository;
+
+fn main() {
+    let repo = Repository::init("temp_dir").unwrap();
+    repo.remote("origin", "https://aaa.com/bbb.git").unwrap();
+
+    let refspec = {
+        let remote = repo.find_remote("origin").unwrap();
+        remote.get_refspec(0)
+    };
+    // remote goes out of scope
+    // but refspec's lifetime is not bounded to remote    
+
+    // removing temp_dir, not necessary to trigger UAF
+    let _ = std::fs::remove_dir_all("temp_dir");
+
+    // triggers UAF
+    let _ = refspec.unwrap().str();
+}

tests/compile_fail/remote_refspec.stderr

@@ -0,0 +1,11 @@
+error[E0597]: `remote` does not live long enough
+  --> tests/compile_fail/remote_refspec.rs:13:9
+   |
+11 |     let refspec = {
+   |         ------- borrow later stored here
+12 |         let remote = repo.find_remote("origin").unwrap();
+   |             ------ binding `remote` declared here
+13 |         remote.get_refspec(0)
+   |         ^^^^^^ borrowed value does not live long enough
+14 |     };
+   |     - `remote` dropped here while still borrowed