[PATCH] pretty: avoid reading past end-of-string with "%G"

From: Jeff King <peff@peff.net>
Date: Jun 16, 2014, 20:13 UTC
Message-ID: <20140616201311.GA26829@sigill.intra.peff.net>

If the user asks for --format=%G with nothing else, we correctly realize that "%G" is not a valid placeholder (it should be "%G?", "%GK", etc). But we still tell the strbuf_expand code that we consumed 2 characters, causing it to jump over the trailing NUL and output garbage.

This also fixes the case where "%GX" would be consumed (and produce no output). In other cases, we pass unrecognized placeholders through to the final string.

Signed-off-by: Jeff King <peff@peff.net>
---
Noticed while experimenting with "%G" placeholders in the nearby thread.

It doesn't look like we have any tests of "%G*" and friends at all. :(

 pretty.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pretty.c b/pretty.c
index e1e2cad..70d8776 100644
--- a/pretty.c
+++ b/pretty.c
@@ -1267,6 +1267,8 @@ static size_t format_commit_one(struct strbuf *sb, /* in UTF-8 */
 			if (c->signature_check.key)
 				strbuf_addstr(sb, c->signature_check.key);
 			break;
+		default:
+			return 0;
 		}
 		return 2;
 	}

-- 
2.0.0.566.gfe3e6b2