Fix NULL dereference in refdb backend exists callback

When the Python exists callback raises, PyObject_CallObject returns NULL
and pygit2_refdb_backend_exists jumped to its cleanup block, where
Py_DECREF(result) dereferenced a NULL pointer, crashing the interpreter.
It also returned 0 on the error path, swallowing the exception.

Use Py_XDECREF and propagate the error instead. Add defensive Py_XDECREF
to the has_log and ensure_log callbacks as well.

Fixes #1476

Assisted-by: Kimi Code

Author: jdavid

CHANGELOG.md

@@ -23,6 +23,7 @@
   [#1471](https://github.com/libgit2/pygit2/issues/1471)
   [#1474](https://github.com/libgit2/pygit2/issues/1474)
   [#1475](https://github.com/libgit2/pygit2/issues/1475)
+  [#1476](https://github.com/libgit2/pygit2/issues/1476)
 
 - Update wheels to libgit2 1.9.6 and OpenSSL 3.5.7
 

src/refdb_backend.c

@@ -237,8 +237,8 @@ pygit2_refdb_backend_exists(int *exists,
     *exists = PyObject_IsTrue(result);
 
 out:
-    Py_DECREF(result);
-    return 0;
+    Py_XDECREF(result);
+    return err;
 }
 
 static int
@@ -423,6 +423,7 @@ pygit2_refdb_backend_has_log(git_refdb_backend *_be, const char *refname)
     Py_DECREF(args);
 
     if ((err = git_error_for_exc()) != 0) {
+        Py_XDECREF(result);
         return err;
     }
 
@@ -449,6 +450,7 @@ pygit2_refdb_backend_ensure_log(git_refdb_backend *_be, const char *refname)
     Py_DECREF(args);
 
     if ((err = git_error_for_exc()) != 0) {
+        Py_XDECREF(result);
         return err;
     }
 

test/test_refdb_backend.py

@@ -139,6 +139,25 @@ def test_exists(repo: Repository) -> None:
     assert repo.backend.exists('refs/heads/master')
 
 
+class RaisingRefdbBackend(ProxyRefdbBackend):
+    """A backend whose exists callback always raises."""
+
+    def exists(self, ref: str) -> bool:
+        raise RuntimeError('boom')
+
+
+def test_exists_callback_raises(testrepo: Repository) -> None:
+    # Regression test (issue #1476): when the exists callback raises, the C
+    # wrapper must not crash on a NULL result, and must propagate the error.
+    backend = RaisingRefdbBackend(pygit2.RefdbFsBackend(testrepo))
+    # Call the unbound C method so the call goes through the C wrapper
+    # (pygit2_refdb_backend_exists), not directly to the Python override.
+    # The error propagates as GitError, or as OSError/ValueError when a stale
+    # libgit2 error (with a matching class) is left over from an earlier call.
+    with pytest.raises((pygit2.GitError, OSError)):
+        pygit2.RefdbBackend.exists(backend, 'refs/heads/master')
+
+
 def test_lookup(repo: Repository) -> None:
     assert repo.backend.lookup('refs/heads/does-not-exist') is None
     assert repo.backend.lookup('refs/heads/master').name == 'refs/heads/master'