No need for two different buffers

internal/git/upload-pack.go

 package git
 
 import (
-	"bytes"
 	"fmt"
 	"io"
 	"net/http"
@@ -11,28 +10,19 @@ import (
 )
 
 func handleUploadPack(w *GitHttpResponseWriter, r *http.Request, a *api.Response) (writtenIn int64, err error) {
-	buffer := &bytes.Buffer{}
-	// Only sniff on the first 4096 bytes: we assume that if we find no
-	// 'deepen' message in the first 4096 bytes there won't be one later
-	// either.
-	_, err = io.Copy(buffer, io.LimitReader(r.Body, 4096))
+	buffer, err := helper.ReadAllTempfile(r.Body)
 	if err != nil {
 		fail500(w)
-		return writtenIn, &copyError{fmt.Errorf("buffer git-upload-pack body: %v", err)}
+		return writtenIn, fmt.Errorf("ReadAllTempfile: %v", err)
 	}
-	isShallowClone := scanDeepen(bytes.NewReader(buffer.Bytes()))
+	defer buffer.Close()
+	r.Body.Close()
 
-	// We must drain the request body before writing the response, to avoid
-	// upsetting NGINX.
-	remainder, err := helper.ReadAllTempfile(r.Body)
-	if err != nil {
+	isShallowClone := scanDeepen(buffer)
+	if _, err := buffer.Seek(0, 0); err != nil {
 		fail500(w)
-		return writtenIn, fmt.Errorf("ReadAllTempfile: %v", err)
+		return writtenIn, fmt.Errorf("seek tempfile: %v", err)
 	}
-	defer remainder.Close()
-
-	body := io.MultiReader(buffer, remainder)
-	r.Body.Close()
 
 	action := getService(r)
 	cmd, stdin, stdout, err := setupGitCommand(action, a)
@@ -57,7 +47,7 @@ func handleUploadPack(w *GitHttpResponseWriter, r *http.Request, a *api.Response
 	}()
 
 	// Write the client request body to Git's standard input
-	if writtenIn, err = io.Copy(stdin, body); err != nil {
+	if writtenIn, err = io.Copy(stdin, buffer); err != nil {
 		fail500(w)
 		return writtenIn, fmt.Errorf("write to %v: %v", cmd.Args, err)
 	}

internal/helper/tempfile.go

@@ -6,12 +6,14 @@ import (
 	"os"
 )
 
-func ReadAllTempfile(r io.Reader) (_ io.ReadCloser, err error) {
-	tempfile, err := ioutil.TempFile("", "gitlab-workhorse-read-all-tempfile")
+func ReadAllTempfile(r io.Reader) (tempfile *os.File, err error) {
+	tempfile, err = ioutil.TempFile("", "gitlab-workhorse-read-all-tempfile")
 	if err != nil {
 		return nil, err
 	}
+
 	defer func() {
+		// Avoid leaking an open file if the function returns with an error
 		if err != nil {
 			tempfile.Close()
 		}