Re: [PATCH] fetch-pack: fix unadvertised requests validation

> So the patch:
>
>> > diff --git a/fetch-pack.c b/fetch-pack.c
>>...
> is a wrong direction, I think. It removes the extra safety check that
> skips the ref above. But worse, in the example above, it overwrites the
> real object "1234..." with the name of the ref "abcd..." in the sha1
> field. We'll ask for an object that may not even exist.
>
> The commit message for Gabriel's patch says:
>
>> > Check was introduced in b791642 (filter_ref: avoid overwriting
>> > ref->old_sha1 with garbage, 2015-03-19), but was always false because
>> > ref->old_oid.hash is empty in this case. Instead copy sha1 from ref->name.
>
> but I don't think ref->old_oid.hash _is_ empty. At least, that was not
> the conclusion from our discussion in:
>
>    http://thread.gmane.org/gmane.comp.version-control.git/265480
>
> We expect whoever creates the "sought" list to fill in the name and sha1
> as appropriate. If that is not happening in some code path, then yeah,
> filter_refs() will not work as intended. But I think the solution there
> would be to fix the caller to set up the "struct ref" more completely.