diff -ruN git-2.9.3/builtin/submodule--helper.c git-2.9.3_patched/builtin/submodule--helper.c
--- git-2.9.3/builtin/submodule--helper.c	2018-10-24 17:19:08.952614832 +0200
+++ git-2.9.3_patched/builtin/submodule--helper.c	2018-10-24 17:15:18.869070834 +0200
@@ -332,12 +332,12 @@
 	strbuf_reset(&sb);
 	strbuf_addf(&sb, "submodule.%s.url", sub->name);
 	if (git_config_get_string(sb.buf, &url)) {
-		url = xstrdup(sub->url);
-
-		if (!url)
+		if (!sub->url)
 			die(_("No url found for submodule path '%s' in .gitmodules"),
 				displaypath);
 
+		url = xstrdup(sub->url);
+
 		/* Possibly a url relative to parent */
 		if (starts_with_dot_dot_slash(url) ||
 		    starts_with_dot_slash(url)) {
@@ -458,6 +458,7 @@
 	if (gitdir && *gitdir)
 		argv_array_pushl(&cp.args, "--separate-git-dir", gitdir, NULL);
 
+	argv_array_push(&cp.args, "--");
 	argv_array_push(&cp.args, url);
 	argv_array_push(&cp.args, path);
 
diff -ruN git-2.9.3/submodule-config.c git-2.9.3_patched/submodule-config.c
--- git-2.9.3/submodule-config.c	2018-10-24 17:19:08.952614832 +0200
+++ git-2.9.3_patched/submodule-config.c	2018-10-24 17:14:53.013897339 +0200
@@ -302,6 +302,12 @@
 			commit_string, name, option);
 }
 
+static void warn_command_line_option(const char *var, const char *value)
+{
+	warning(_("ignoring '%s' which may be interpreted as"
+		  " a command-line option: %s"), var, value);
+}
+
 struct parse_config_parameter {
 	struct submodule_cache *cache;
 	const unsigned char *commit_sha1;
@@ -327,6 +333,8 @@
 	if (!strcmp(item.buf, "path")) {
 		if (!value)
 			ret = config_error_nonbool(var);
+		else if (looks_like_command_line_option(value))
+			warn_command_line_option(var, value);
 		else if (!me->overwrite && submodule->path)
 			warn_multiple_config(me->commit_sha1, submodule->name,
 					"path");
@@ -367,6 +375,8 @@
 	} else if (!strcmp(item.buf, "url")) {
 		if (!value) {
 			ret = config_error_nonbool(var);
+		} else if (looks_like_command_line_option(value)) {
+			warn_command_line_option(var, value);
 		} else if (!me->overwrite && submodule->url) {
 			warn_multiple_config(me->commit_sha1, submodule->name,
 					"url");