Merge branch 'ax/line-log-range-merge-fix' into maint

The code to parse "git log -L..." command line was buggy when there
are many ranges specified with -L; overrun of the allocated buffer
has been fixed.

* ax/line-log-range-merge-fix:
line-log.c: prevent crash during union of too many ranges

diff --combined line-log.c
index 65f3558b3be695ce5259df9a2da4f28e95b35b71,47eaba73c68905a12037365f8a3d3118a3ea3ddd..9510296659a39475008aaa41c0a42196dc8d8d6d
--- 1/line-log.c
--- 2/line-log.c
+++ b/line-log.c
@@@ -113,7 -113,7 +113,7 @@@ void sort_and_merge_range_set(struct ra
        int i;
        int o = 0; /* output cursor */
  
 -      qsort(rs->ranges, rs->nr, sizeof(struct range), range_cmp);
 +      QSORT(rs->ranges, rs->nr, range_cmp);
  
        for (i = 0; i < rs->nr; i++) {
                if (rs->ranges[i].start == rs->ranges[i].end)
@@@ -144,7 -144,7 +144,7 @@@
  static void range_set_union(struct range_set *out,
                             struct range_set *a, struct range_set *b)
  {
-       int i = 0, j = 0, o = 0;
+       int i = 0, j = 0;
        struct range *ra = a->ranges;
        struct range *rb = b->ranges;
        /* cannot make an alias of out->ranges: it may change during grow */
@@@ -167,16 -167,15 +167,15 @@@
                        new = &rb[j++];
                if (new->start == new->end)
                        ; /* empty range */
-               else if (!o || out->ranges[o-1].end < new->start) {
+               else if (!out->nr || out->ranges[out->nr-1].end < new->start) {
                        range_set_grow(out, 1);
-                       out->ranges[o].start = new->start;
-                       out->ranges[o].end = new->end;
-                       o++;
-               } else if (out->ranges[o-1].end < new->end) {
-                       out->ranges[o-1].end = new->end;
+                       out->ranges[out->nr].start = new->start;
+                       out->ranges[out->nr].end = new->end;
+                       out->nr++;
+               } else if (out->ranges[out->nr-1].end < new->end) {
+                       out->ranges[out->nr-1].end = new->end;
                }
        }
-       out->nr = o;
  }
  
  /*