Git crashes when config keys are left without a value

Git can segfault if a configuration key is written without a value, Thomas Bachem found, after checking every config callback and every caller that reads a repository setting, then running common commands with each documented key left blank.

A valueless setting, whether from git -c foo.bar or a bare key under a section, is handed to readers as a null pointer. In the places Bachem hit, the code assumed a string and crashed. The list covers interactive rebase, fetch and receive-pack in a repository that borrows objects from an alternate, interactive add, grep, log and show, blame colors, merge options on a branch, remote groups, fetch and status tag options, bitmap writing during repack, and Scalar's reconfigure of every registered repository. A blank safe.bareRepository crashes Git in every bare repository it discovers. A blank remote URL, when an includeIf condition matches on remote URLs, crashes nearly every command, including log.

One of the crashes is not only a local config mistake. A bundle list that omits a value for mode, heuristic, uri, or creationToken can be advertised by a server to clients that clone or fetch with bundle URIs. Those clients then crash while parsing the list. With the fix, the list is treated as invalid and the clone or fetch continues without the bundles.

Most of the fixes reject the missing value with the same error Git already uses for other non-boolean settings that lack a value. A few are deliberately softer. A missing fetch.bundleCreationToken is treated as zero, so previously unseen bundles are still downloaded. A remote URL with no value is left out of includeIf matching, because it cannot match a pattern and other code already rejects it when remotes are read. git config list with a color or expiry-date type simply omits the key.

According to Bachem, the sweep may have missed crashes in code neither check reached. Phillip Wood helped shape several of the error and warning choices, including treating a blank rebase.missingCommitsCheck like an unrecognized value: warn, then ignore.