merge/pull: verify GPG signatures of commits being merged

diff --git a/setup.c b/setup.c
index 9107f54a076f9aa71dee293d535bffd04ce5156f..94c1e61bda747ed5c664bbbf8431234dc8276d29 100644 (file)
--- a/setup.c
+++ b/setup.c
@@ -207,10 +207,11 @@ static const char *prefix_pathspec(const char *prefix, int prefixlen, const char
                     *copyfrom && *copyfrom != ')';
                     copyfrom = nextat) {
                        size_t len = strcspn(copyfrom, ",)");
-                       if (copyfrom[len] == ')')
-                               nextat = copyfrom + len;
-                       else
+                       if (copyfrom[len] == ',')
                                nextat = copyfrom + len + 1;
+                       else
+                               /* handle ')' and '\0' */
+                               nextat = copyfrom + len;
                        if (!len)
                                continue;
                        for (i = 0; i < ARRAY_SIZE(pathspec_magic); i++)
@@ -223,8 +224,9 @@ static const char *prefix_pathspec(const char *prefix, int prefixlen, const char
                                die("Invalid pathspec magic '%.*s' in '%s'",
                                    (int) len, copyfrom, elt);
                }
-               if (*copyfrom == ')')
-                       copyfrom++;
+               if (*copyfrom != ')')
+                       die("Missing ')' at the end of pathspec magic in '%s'", elt);
+               copyfrom++;
        } else {
                /* shorthand */
                for (copyfrom = elt + 1;