bundle: do not free uninitialized memory on bad arguments

"git bundle create" gives up with an error when setup_revisions()
leaves an argument it does not understand, as in

  $ git bundle create private.bundle main --no-such-option
  error: unrecognized argument: --no-such-option

Since 11ee9a75e7 (bundle: plug leaks in `create_bundle()`,
2024-06-11), that error jumps to the cleanup at the end of
create_bundle(), which clears "revs_copy.pending".  But "revs_copy"
is only filled from "revs" further down, so the cleanup reads
uninitialized stack memory and may free a garbage pointer.  valgrind
reports "Conditional jump or move depends on uninitialised value(s)"
in object_array_clear() and in free(); whether the command crashes
depends on what happens to be on the stack.

Give “revs_copy” its value where it is declared, and add a test that
fails under valgrind without this fix.

Signed-off-by: Olof Fairbrook <olof.fairbrook@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

bundle.c

@@ -492,7 +492,7 @@ int create_bundle(struct repository *r, const char *path,
 	int bundle_fd = -1;
 	int bundle_to_stdout;
 	int ref_count = 0;
-	struct rev_info revs, revs_copy;
+	struct rev_info revs, revs_copy = { 0 };
 	int min_version = 2;
 	struct bundle_prerequisites_info bpi;
 	int ret;

t/t5607-clone-bundle.sh

@@ -127,6 +127,13 @@ test_expect_success 'failed bundle creation does not leave cruft' '
 	test_path_is_missing fail.bundle.lock
 '
 
+test_expect_success 'an unknown argument after the revisions is an error' '
+	test_must_fail git bundle create unknown.bundle main --no-such-option \
+		2>err &&
+	test_grep "unrecognized argument: --no-such-option" err &&
+	test_path_is_missing unknown.bundle
+'
+
 test_expect_success 'fetch SHA-1 from bundle' '
 	test_create_repo foo &&
 	test_commit -C foo x &&