pretty: avoid reading past end-of-string with "%G"

If the user asks for --format=%G with nothing else, we
correctly realize that "%G" is not a valid placeholder (it
should be "%G?", "%GK", etc). But we still tell the
strbuf_expand code that we consumed 2 characters, causing it
to jump over the trailing NUL and output garbage.

This also fixes the case where "%GX" would be consumed (and
produce no output). In other cases, we pass unrecognized
placeholders through to the final string.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/pretty.c b/pretty.c
index 3c43db558aee43b0ea69c23c6611dcc9fae0661f..fe249f8820f3787c737cad2da49c16b50c092601 100644 (file)
--- a/pretty.c
+++ b/pretty.c
@@ -1267,6 +1267,8 @@ static size_t format_commit_one(struct strbuf *sb, /* in UTF-8 */
                        if (c->signature_check.key)
                                strbuf_addstr(sb, c->signature_check.key);
                        break;
+               default:
+                       return 0;
                }
                return 2;
        }

diff --git a/t/t7510-signed-commit.sh b/t/t7510-signed-commit.sh
index e97477a3b98a49c80ce01f06b966eacff52a3bd1..9810242435b40682c6cfa67e926590145b688ac9 100755 (executable)
--- a/t/t7510-signed-commit.sh
+++ b/t/t7510-signed-commit.sh
@@ -147,4 +147,10 @@ test_expect_success GPG 'show lack of signature with custom format' '
        test_cmp expect actual
 '
 
+test_expect_success 'unused %G placeholders are passed through' '
+       echo "%GX %G" >expect &&
+       git log -1 --format="%GX %G" >actual &&
+       test_cmp expect actual
+'
+
 test_done