Re: remote-curl: segfault parsing remote.<name>.fetch outside a repository

[Jeff King <peff@peff.net>]

On Sat, Mar 21, 2026 at 06:20:16PM -0700, Junio C Hamano wrote:

> Jeff King <peff@peff.net> writes:
> 
> > It's a curious case, though. The crashing code is parse_refspec() does
> > this:
> >
> >   if (llen == the_hash_algo->hexsz && !get_oid_hex(item->src, &unused))
> >         item->exact_sha1 = 1; /* ok */
> >
> > But what is the correct hash algo to use here when we are outside a
> > repository?
> 
> Hmph, who is calling into the transport outside a repository in the
> first place?  Even "git clone" should create the receiving
> repository before it calls into the transport, no?  Is this "git
> ls-remote" or something?

Yes, exactly; the real-world case that Jo mentioned is ls-remote.

> > to make the segfault go away, but it is mostly papering over the
> > problem. I'm not sure if the exact_sha1 flag would matter when we are
> > not actually fetching (and we cannot fetch when we are not in a local
> > repo). Grepping around, it looks like it does influence the ref prefixes
> > we send to the other side (yet another chicken-and-egg!).
> 
> Yup, I agree with your assessment that exact_sha1 should mostly be
> garbage if we do not have a repository in the first place.

There's at least one more instance of the same problem:

          if (item->negative)
		...
                  else if (llen == the_hash_algo->hexsz && !get_oid_hex(item->src, &unused))
                          return 0; /* negative refpsecs cannot be exact sha1 */

It might be OK to quietly disable the check outside a repo there, too.

-Peff