From 649c768a25b191dbea72c7bacaed5b81ef195bf5 Mon Sep 17 00:00:00 2001 From: K Jayatheerth Date: Tue, 24 Mar 2026 07:27:33 +0530 Subject: [PATCH 1/2] remote-curl: fall back to default hash outside repo When a remote helper like git-remote-http is invoked outside of a repository (for example, by running git ls-remote in a non-git directory), setup_git_directory_gently() leaves the_hash_algo uninitialized as NULL. If the user has a globally configured fetch refspec, remote-curl attempts to parse it during initialization. Inside parse_refspec(), it checks whether the LHS of the refspec is an exact OID by evaluating llen == the_hash_algo->hexsz. Because the_hash_algo is NULL, this results in a segmentation fault. In 9e89dcb66a (builtin/ls-remote: fall back to SHA1 outside of a repo, 2024-08-02), we added a workaround to ls-remote to fall back to the default hash algorithm to prevent exactly this type of crash when parsing refspec capabilities. However, because remote-curl runs as a separate process, it does not inherit that fallback and crashes anyway. Instead of pushing a NULL-guard workaround down into parse_refspec(), fix this by mirroring the ls-remote workaround directly in remote-curl.c. If we are operating outside a repository, initialize the_hash_algo to GIT_HASH_DEFAULT. This keeps the HTTP transport consistent with non-HTTP transports that execute in-process, preventing crashes without altering the generic refspec parsing logic. Reported-by: Jo Liss Helped-by: Jeff King Signed-off-by: K Jayatheerth Signed-off-by: Junio C Hamano --- remote-curl.c | 7 +++++++ t/t5551-http-fetch-smart.sh | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/remote-curl.c b/remote-curl.c index 69f919454a..a489cbe6f4 100644 --- a/remote-curl.c +++ b/remote-curl.c @@ -1551,6 +1551,13 @@ int cmd_main(int argc, const char **argv) goto cleanup; } + /* + * yuck, see 9e89dcb66a (builtin/ls-remote: fall back to SHA1 outside + * of a repo, 2024-08-02) + */ + if (nongit) + repo_set_hash_algo(the_repository, GIT_HASH_DEFAULT); + options.verbosity = 1; options.progress = !!isatty(2); options.thin = 1; diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh index 73cf531580..a26b6c2844 100755 --- a/t/t5551-http-fetch-smart.sh +++ b/t/t5551-http-fetch-smart.sh @@ -782,4 +782,11 @@ test_expect_success 'tag following always works over v0 http' ' test_cmp expect actual ' +test_expect_success 'ls-remote outside repo does not segfault with fetch refspec' ' + nongit git \ + -c remote.origin.url="$HTTPD_URL/smart/repo.git" \ + -c remote.origin.fetch=anything \ + ls-remote origin +' + test_done From 4e5dc601ddc5f0d8ab035210554d9e15aa376032 Mon Sep 17 00:00:00 2001 From: K Jayatheerth Date: Tue, 24 Mar 2026 07:27:34 +0530 Subject: [PATCH 2/2] refspec: fix typo in comment Fix a long-standing typo in a comment: "refpsecs" -> "refspecs". Signed-off-by: K Jayatheerth Signed-off-by: Junio C Hamano --- refspec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/refspec.c b/refspec.c index 0775358d96..fb89bce1db 100644 --- a/refspec.c +++ b/refspec.c @@ -85,7 +85,7 @@ static int parse_refspec(struct refspec_item *item, const char *refspec, int fet if (!*item->src) return 0; /* negative refspecs must not be empty */ else if (llen == the_hash_algo->hexsz && !get_oid_hex(item->src, &unused)) - return 0; /* negative refpsecs cannot be exact sha1 */ + return 0; /* negative refspecs cannot be exact sha1 */ else if (!check_refname_format(item->src, flags)) ; /* valid looking ref is ok */ else