Make "--pretty=format" parser a bit more careful.

When a commit message that does not have a terminating LF is
read in and the memory that was allocated to read it happens to
have a LF immediately after that, the code was not careful and
went past the terminating NUL.

Signed-off-by: Junio C Hamano <gitster@pobox.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/pretty.c b/pretty.c
index 9db75b4e4f..5b1078beb6 100644
--- a/pretty.c
+++ b/pretty.c
@@ -412,7 +412,7 @@ static void parse_commit_header(struct format_commit_context *context)
 		if (i == eol) {
 			state++;
 			/* strip empty lines */
-			while (msg[eol + 1] == '\n')
+			while (msg[eol] == '\n' && msg[eol + 1] == '\n')
 				eol++;
 		} else if (!prefixcmp(msg + i, "author ")) {
 			context->author.off = i + 7;
@@ -425,6 +425,8 @@ static void parse_commit_header(struct format_commit_context *context)
 			context->encoding.len = eol - i - 9;
 		}
 		i = eol;
+		if (!msg[i])
+			break;
 	}
 	context->body_off = i;
 	context->commit_header_parsed = 1;